OSDN Git Service

Merge "Revert "Fix potential OOB write in btm_read_remote_ext_features_complete"...
[android-x86/system-bt.git] / stack / btm / btm_acl.cc
index 07a80fb..8df6acb 100644 (file)
@@ -50,8 +50,6 @@
 #include "l2c_int.h"
 #include "osi/include/osi.h"
 
-extern fixed_queue_t* btu_general_alarm_queue;
-
 static void btm_read_remote_features(uint16_t handle);
 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
@@ -91,16 +89,13 @@ void btm_acl_init(void) {
  *                 NULL if not found.
  *
  ******************************************************************************/
-tACL_CONN* btm_bda_to_acl(const BD_ADDR bda, tBT_TRANSPORT transport) {
+tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
   tACL_CONN* p = &btm_cb.acl_db[0];
   uint16_t xx;
-  if (bda) {
-    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
-      if ((p->in_use) && (!memcmp(p->remote_addr, bda, BD_ADDR_LEN)) &&
-          p->transport == transport) {
-        BTM_TRACE_DEBUG("btm_bda_to_acl found");
-        return (p);
-      }
+  for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
+    if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
+      BTM_TRACE_DEBUG("btm_bda_to_acl found");
+      return (p);
     }
   }
 
@@ -143,30 +138,29 @@ uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
  * Returns          success return true, otherwise false.
  *
  ******************************************************************************/
-bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec, BD_ADDR conn_addr,
+bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
+                                 RawAddress& conn_addr,
                                  tBLE_ADDR_TYPE* p_addr_type) {
   bool st = true;
 
   if (p_dev_rec == NULL) {
-    BTM_TRACE_ERROR(
-        "btm_ble_get_acl_remote_addr can not find device with matching "
-        "address");
+    BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
     return false;
   }
 
   switch (p_dev_rec->ble.active_addr_type) {
     case BTM_BLE_ADDR_PSEUDO:
-      memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
+      conn_addr = p_dev_rec->bd_addr;
       *p_addr_type = p_dev_rec->ble.ble_addr_type;
       break;
 
     case BTM_BLE_ADDR_RRA:
-      memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
+      conn_addr = p_dev_rec->ble.cur_rand_addr;
       *p_addr_type = BLE_ADDR_RANDOM;
       break;
 
     case BTM_BLE_ADDR_STATIC:
-      memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
+      conn_addr = p_dev_rec->ble.static_addr;
       *p_addr_type = p_dev_rec->ble.static_addr_type;
       break;
 
@@ -190,7 +184,7 @@ bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec, BD_ADDR conn_addr,
  * Returns          void
  *
  ******************************************************************************/
-void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
+void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
                      uint16_t hci_handle, uint8_t link_role,
                      tBT_TRANSPORT transport) {
   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
@@ -205,9 +199,7 @@ void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
     p->hci_handle = hci_handle;
     p->link_role = link_role;
     p->transport = transport;
-    BTM_TRACE_DEBUG(
-        "Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-        bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+    VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
     BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
     return;
   }
@@ -219,7 +211,7 @@ void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
       p->hci_handle = hci_handle;
       p->link_role = link_role;
       p->link_up_issued = false;
-      memcpy(p->remote_addr, bda, BD_ADDR_LEN);
+      p->remote_addr = bda;
 
       p->transport = transport;
 #if (BLE_PRIVACY_SPT == TRUE)
@@ -228,8 +220,7 @@ void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
             bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
 #else
       p->conn_addr_type = BLE_ADDR_PUBLIC;
-      memcpy(p->conn_addr, &controller_get_interface()->get_address()->address,
-             BD_ADDR_LEN);
+      p->conn_addr = *controller_get_interface()->get_address();
 
 #endif
       p->switch_role_failed_attempts = 0;
@@ -269,7 +260,7 @@ void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
           BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
           if (req_pend) {
             /* Request for remaining Security Features (if any) */
-            l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
+            l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
           }
           btm_establish_continue(p);
           return;
@@ -300,10 +291,10 @@ void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
   }
 }
 
-void btm_acl_update_conn_addr(uint8_t conn_handle, BD_ADDR address) {
+void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
   uint8_t idx = btm_handle_to_acl_index(conn_handle);
   if (idx != MAX_L2CAP_LINKS) {
-    memcpy(btm_cb.acl_db[idx].conn_addr, address, BD_ADDR_LEN);
+    btm_cb.acl_db[idx].conn_addr = address;
   }
 }
 
@@ -317,12 +308,11 @@ void btm_acl_update_conn_addr(uint8_t conn_handle, BD_ADDR address) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_acl_report_role_change(uint8_t hci_status, BD_ADDR bda) {
+void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
   tBTM_ROLE_SWITCH_CMPL ref_data;
   BTM_TRACE_DEBUG("btm_acl_report_role_change");
   if (btm_cb.devcb.p_switch_role_cb &&
-      (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr,
-                           bda, BD_ADDR_LEN)))) {
+      (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
     memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
            sizeof(tBTM_ROLE_SWITCH_CMPL));
     ref_data.hci_status = hci_status;
@@ -344,9 +334,8 @@ void btm_acl_report_role_change(uint8_t hci_status, BD_ADDR bda) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_acl_removed(BD_ADDR bda, tBT_TRANSPORT transport) {
+void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
   tACL_CONN* p;
-  tBTM_BL_EVENT_DATA evt_data;
   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
   BTM_TRACE_DEBUG("btm_acl_removed");
   p = btm_bda_to_acl(bda, transport);
@@ -354,7 +343,7 @@ void btm_acl_removed(BD_ADDR bda, tBT_TRANSPORT transport) {
     p->in_use = false;
 
     /* if the disconnected channel has a pending role switch, clear it now */
-    btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
+    btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
 
     /* Only notify if link up has had a chance to be issued */
     if (p->link_up_issued) {
@@ -362,8 +351,9 @@ void btm_acl_removed(BD_ADDR bda, tBT_TRANSPORT transport) {
 
       /* If anyone cares, tell him database changed */
       if (btm_cb.p_bl_changed_cb) {
+        tBTM_BL_EVENT_DATA evt_data;
         evt_data.event = BTM_BL_DISCN_EVT;
-        evt_data.discn.p_bda = bda;
+        evt_data.discn.p_bda = &bda;
         evt_data.discn.handle = p->hci_handle;
         evt_data.discn.transport = p->transport;
         (*btm_cb.p_bl_changed_cb)(&evt_data);
@@ -489,7 +479,9 @@ void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
     evt.busy_level = busy_level;
     btm_cb.busy_level = busy_level;
     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
-      (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
+      tBTM_BL_EVENT_DATA btm_bl_event_data;
+      btm_bl_event_data.update = evt;
+      (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
     }
   }
 }
@@ -505,7 +497,7 @@ void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
  *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
  *
  ******************************************************************************/
-tBTM_STATUS BTM_GetRole(BD_ADDR remote_bd_addr, uint8_t* p_role) {
+tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
   tACL_CONN* p;
   BTM_TRACE_DEBUG("BTM_GetRole");
   p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
@@ -538,7 +530,7 @@ tBTM_STATUS BTM_GetRole(BD_ADDR remote_bd_addr, uint8_t* p_role) {
  *                  BTM_BUSY if the previous command is not completed
  *
  ******************************************************************************/
-tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
+tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
                            tBTM_CMPL_CB* p_cb) {
   tACL_CONN* p;
   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
@@ -548,20 +540,15 @@ tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
   tBTM_STATUS status;
   tBTM_PM_MODE pwr_mode;
   tBTM_PM_PWR_MD settings;
-  BD_ADDR_PTR p_bda;
-  BTM_TRACE_API("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
-                remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
-                remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
+  VLOG(1) << __func__ << " BDA: " << remote_bd_addr;
 
   /* Make sure the local device supports switching */
   if (!controller_get_interface()->supports_master_slave_role_switch())
     return (BTM_MODE_UNSUPPORTED);
 
   if (btm_cb.devcb.p_switch_role_cb && p_cb) {
-    p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
-    BTM_TRACE_DEBUG(
-        "Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
-        p_bda[0], p_bda[1], p_bda[2], p_bda[3], p_bda[4], p_bda[5]);
+    VLOG(2) << "Role switch on other device is in progress "
+            << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
     return (BTM_BUSY);
   }
 
@@ -571,10 +558,8 @@ tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
   /* Finished if already in desired role */
   if (p->link_role == new_role) return (BTM_SUCCESS);
 
-  if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH,
-                         (const bt_bdaddr_t*)&remote_bd_addr)) {
+  if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
     return BTM_DEV_BLACKLISTED;
-  }
 
 #if (BTM_SCO_INCLUDED == TRUE)
   /* Check if there is any SCO Active on this BD Address */
@@ -589,8 +574,7 @@ tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
     return (BTM_BUSY);
   }
 
-  if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
-                         (const bt_bdaddr_t*)&remote_bd_addr)) {
+  if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
     BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
                     __func__);
     return BTM_DEV_BLACKLISTED;
@@ -633,8 +617,7 @@ tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
 
   /* Initialize return structure in case request fails */
   if (p_cb) {
-    memcpy(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
-           BD_ADDR_LEN);
+    btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
     btm_cb.devcb.switch_role_ref_data.role = new_role;
     /* initialized to an error code */
     btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
@@ -660,7 +643,6 @@ void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
   tACL_CONN* p;
   uint8_t xx;
   tBTM_SEC_DEV_REC* p_dev_rec;
-  tBTM_BL_ROLE_CHG_DATA evt;
 
   BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
                   handle, status, encr_enable);
@@ -694,15 +676,18 @@ void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
     p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
     btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
-                               p->remote_addr);
+                               &p->remote_addr);
 
     /* if role change event is registered, report it now */
     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
+      tBTM_BL_ROLE_CHG_DATA evt;
       evt.event = BTM_BL_ROLE_CHG_EVT;
       evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
-      evt.p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
+      evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
       evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
-      (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
+      tBTM_BL_EVENT_DATA btm_bl_event_data;
+      btm_bl_event_data.role_chg = evt;
+      (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
 
       BTM_TRACE_DEBUG(
           "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
@@ -736,7 +721,8 @@ void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
  * Returns          status of the operation
  *
  ******************************************************************************/
-tBTM_STATUS BTM_SetLinkPolicy(BD_ADDR remote_bda, uint16_t* settings) {
+tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
+                              uint16_t* settings) {
   tACL_CONN* p;
   uint8_t* localFeatures = BTM_ReadLocalFeatures();
   BTM_TRACE_DEBUG("%s", __func__);
@@ -831,7 +817,7 @@ void BTM_SetDefaultLinkPolicy(uint16_t settings) {
   btsnd_hcic_write_def_policy_set(settings);
 }
 
-void btm_use_preferred_conn_params(BD_ADDR bda) {
+void btm_use_preferred_conn_params(const RawAddress& bda) {
   tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
 
@@ -953,7 +939,7 @@ void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
   BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
   if (req_pend) {
     /* Request for remaining Security Features (if any) */
-    l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
+    l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
   }
 }
 
@@ -1194,7 +1180,7 @@ void btm_establish_continue(tACL_CONN* p_acl_cb) {
   /* If anyone cares, tell him database changed */
   if (btm_cb.p_bl_changed_cb) {
     evt_data.event = BTM_BL_CONN_EVT;
-    evt_data.conn.p_bda = p_acl_cb->remote_addr;
+    evt_data.conn.p_bda = &p_acl_cb->remote_addr;
     evt_data.conn.p_bdn = p_acl_cb->remote_name;
     evt_data.conn.p_dc = p_acl_cb->remote_dc;
     evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
@@ -1231,7 +1217,8 @@ void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
  * Returns          status of the operation
  *
  ******************************************************************************/
-tBTM_STATUS BTM_GetLinkSuperTout(BD_ADDR remote_bda, uint16_t* p_timeout) {
+tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
+                                 uint16_t* p_timeout) {
   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
 
   BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
@@ -1252,7 +1239,8 @@ tBTM_STATUS BTM_GetLinkSuperTout(BD_ADDR remote_bda, uint16_t* p_timeout) {
  * Returns          status of the operation
  *
  ******************************************************************************/
-tBTM_STATUS BTM_SetLinkSuperTout(BD_ADDR remote_bda, uint16_t timeout) {
+tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
+                                 uint16_t timeout) {
   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
 
   BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
@@ -1264,8 +1252,9 @@ tBTM_STATUS BTM_SetLinkSuperTout(BD_ADDR remote_bda, uint16_t timeout) {
       btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
                                        p->hci_handle, timeout);
       return (BTM_CMD_STARTED);
-    } else
+    } else {
       return (BTM_SUCCESS);
+    }
   }
 
   /* If here, no BD Addr found */
@@ -1282,12 +1271,11 @@ tBTM_STATUS BTM_SetLinkSuperTout(BD_ADDR remote_bda, uint16_t timeout) {
  * Returns          true if connection is up, else false.
  *
  ******************************************************************************/
-bool BTM_IsAclConnectionUp(BD_ADDR remote_bda, tBT_TRANSPORT transport) {
+bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
+                           tBT_TRANSPORT transport) {
   tACL_CONN* p;
 
-  BTM_TRACE_API("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-                remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
-                remote_bda[4], remote_bda[5]);
+  VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
 
   p = btm_bda_to_acl(remote_bda, transport);
   if (p != (tACL_CONN*)NULL) {
@@ -1344,7 +1332,7 @@ uint16_t btm_get_acl_disc_reason_code(void) {
  * Returns          the handle of the connection, or 0xFFFF if none.
  *
  ******************************************************************************/
-uint16_t BTM_GetHCIConnHandle(const BD_ADDR remote_bda,
+uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
                               tBT_TRANSPORT transport) {
   tACL_CONN* p;
   BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
@@ -1391,7 +1379,8 @@ void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
 * Returns          void
 *
 *******************************************************************************/
-void btm_blacklist_role_change_device(BD_ADDR bd_addr, uint8_t hci_status) {
+void btm_blacklist_role_change_device(const RawAddress& bd_addr,
+                                      uint8_t hci_status) {
   tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
 
@@ -1414,17 +1403,14 @@ void btm_blacklist_role_change_device(BD_ADDR bd_addr, uint8_t hci_status) {
       ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
        (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
       ((cod & cod_audio_device) == cod_audio_device) &&
-      (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
-                           (const bt_bdaddr_t*)&bd_addr))) {
+      (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
     p->switch_role_failed_attempts++;
     if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
       BTM_TRACE_WARNING(
-          "%s: Device %02x:%02x:%02x:%02x:%02x:%02x blacklisted for role "
-          "switching - multiple role switch failed attempts: %u",
-          __func__, bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4],
-          bd_addr[5], p->switch_role_failed_attempts);
-      interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH,
-                           (const bt_bdaddr_t*)&bd_addr, 3);
+          "%s: Device %s blacklisted for role switching - "
+          "multiple role switch failed attempts: %u",
+          __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
+      interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
     }
   }
 }
@@ -1441,14 +1427,13 @@ void btm_blacklist_role_change_device(BD_ADDR bd_addr, uint8_t hci_status) {
  * Returns          void
  *
  ******************************************************************************/
-void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
+void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
                           uint8_t new_role) {
-  uint8_t* p_bda =
-      (bd_addr) ? bd_addr : btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
-  tACL_CONN* p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
+  const RawAddress* p_bda =
+      (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
+  tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
   tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
   tBTM_SEC_DEV_REC* p_dev_rec;
-  tBTM_BL_ROLE_CHG_DATA evt;
 
   BTM_TRACE_DEBUG("btm_acl_role_changed");
   /* Ignore any stray events */
@@ -1463,7 +1448,7 @@ void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
 
   if (hci_status == HCI_SUCCESS) {
     p_data->role = new_role;
-    memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
+    p_data->remote_bd_addr = *p_bda;
 
     /* Update cached value */
     p->link_role = new_role;
@@ -1502,11 +1487,14 @@ void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
 
   /* if role change event is registered, report it now */
   if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
+    tBTM_BL_ROLE_CHG_DATA evt;
     evt.event = BTM_BL_ROLE_CHG_EVT;
     evt.new_role = new_role;
     evt.p_bda = p_bda;
     evt.hci_status = hci_status;
-    (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
+    tBTM_BL_EVENT_DATA btm_bl_event_data;
+    btm_bl_event_data.role_chg = evt;
+    (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
   }
 
   BTM_TRACE_DEBUG(
@@ -1515,7 +1503,7 @@ void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
 
 #if (BTM_DISC_DURING_RS == TRUE)
   /* If a disconnect is pending, issue it now that role switch has completed */
-  p_dev_rec = btm_find_dev(p_bda);
+  p_dev_rec = btm_find_dev(*p_bda);
   if (p_dev_rec != NULL) {
     if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
       BTM_TRACE_WARNING(
@@ -1594,8 +1582,9 @@ bool BTM_FreeSCN(uint8_t scn) {
   if (scn <= BTM_MAX_SCN) {
     btm_cb.btm_scn[scn - 1] = false;
     return (true);
-  } else
+  } else {
     return (false); /* Illegal SCN passed in */
+  }
 }
 
 /*******************************************************************************
@@ -1640,7 +1629,7 @@ tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
  *                  connection, 0 if connection is not established
  *
  ******************************************************************************/
-uint16_t btm_get_max_packet_size(BD_ADDR addr) {
+uint16_t btm_get_max_packet_size(const RawAddress& addr) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
   uint16_t pkt_types = 0;
   uint16_t pkt_size = 0;
@@ -1649,8 +1638,7 @@ uint16_t btm_get_max_packet_size(BD_ADDR addr) {
     pkt_types = p->pkt_types_mask;
   } else {
     /* Special case for when info for the local device is requested */
-    if (memcmp(controller_get_interface()->get_address(), addr, BD_ADDR_LEN) ==
-        0) {
+    if (addr == *controller_get_interface()->get_address()) {
       pkt_types = btm_cb.btm_acl_pkt_types_supported;
     }
   }
@@ -1692,7 +1680,7 @@ uint16_t btm_get_max_packet_size(BD_ADDR addr) {
  * Returns          If connected report peer device info
  *
  ******************************************************************************/
-tBTM_STATUS BTM_ReadRemoteVersion(BD_ADDR addr, uint8_t* lmp_version,
+tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
                                   uint16_t* manufacturer,
                                   uint16_t* lmp_sub_version) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
@@ -1715,7 +1703,7 @@ tBTM_STATUS BTM_ReadRemoteVersion(BD_ADDR addr, uint8_t* lmp_version,
  * Returns          pointer to the remote supported features mask (8 bytes)
  *
  ******************************************************************************/
-uint8_t* BTM_ReadRemoteFeatures(BD_ADDR addr) {
+uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
   BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
   if (p == NULL) {
@@ -1733,7 +1721,8 @@ uint8_t* BTM_ReadRemoteFeatures(BD_ADDR addr) {
  *                  or NULL if bad page
  *
  ******************************************************************************/
-uint8_t* BTM_ReadRemoteExtendedFeatures(BD_ADDR addr, uint8_t page_number) {
+uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
+                                        uint8_t page_number) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
   BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
   if (p == NULL) {
@@ -1756,7 +1745,7 @@ uint8_t* BTM_ReadRemoteExtendedFeatures(BD_ADDR addr, uint8_t page_number) {
  * Returns          number of features pages read from the remote device.
  *
  ******************************************************************************/
-uint8_t BTM_ReadNumberRemoteFeaturesPages(BD_ADDR addr) {
+uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
   BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
   if (p == NULL) {
@@ -1773,7 +1762,7 @@ uint8_t BTM_ReadNumberRemoteFeaturesPages(BD_ADDR addr) {
  * Returns          pointer to all features of the remote (24 bytes).
  *
  ******************************************************************************/
-uint8_t* BTM_ReadAllRemoteFeatures(BD_ADDR addr) {
+uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr) {
   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
   BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
   if (p == NULL) {
@@ -1819,11 +1808,11 @@ tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
  * Returns          status of the operation
  *
  ******************************************************************************/
-tBTM_STATUS BTM_SetQoS(BD_ADDR bd, FLOW_SPEC* p_flow, tBTM_CMPL_CB* p_cb) {
+tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
+                       tBTM_CMPL_CB* p_cb) {
   tACL_CONN* p = &btm_cb.acl_db[0];
 
-  BTM_TRACE_API("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x", bd[0], bd[1],
-                bd[2], bd[3], bd[4], bd[5]);
+  VLOG(2) << __func__ << " BdAddr: " << bd;
 
   /* If someone already waiting on the version, do not allow another */
   if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
@@ -1831,8 +1820,8 @@ tBTM_STATUS BTM_SetQoS(BD_ADDR bd, FLOW_SPEC* p_flow, tBTM_CMPL_CB* p_cb) {
   p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
   if (p != NULL) {
     btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
-    alarm_set_on_queue(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
-                       btm_qos_setup_timeout, NULL, btu_general_alarm_queue);
+    alarm_set_on_mloop(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
+                       btm_qos_setup_timeout, NULL);
 
     btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
                          p_flow->token_rate, p_flow->peak_bandwidth,
@@ -1904,19 +1893,16 @@ void btm_qos_setup_complete(uint8_t status, uint16_t handle,
  * Description      This function is called to read the link policy settings.
  *                  The address of link policy results are returned in the
  *                  callback.
- *                  (tBTM_RSSI_RESULTS)
+ *                  (tBTM_RSSI_RESULT)
  *
  * Returns          BTM_CMD_STARTED if successfully initiated or error code
  *
  ******************************************************************************/
-tBTM_STATUS BTM_ReadRSSI(const BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
+tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
   tACL_CONN* p;
   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
   tBT_DEVICE_TYPE dev_type;
   tBLE_ADDR_TYPE addr_type;
-  BTM_TRACE_API("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-                remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
-                remote_bda[4], remote_bda[5]);
 
   /* If someone already waiting on the version, do not allow another */
   if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
@@ -1927,8 +1913,8 @@ tBTM_STATUS BTM_ReadRSSI(const BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
   p = btm_bda_to_acl(remote_bda, transport);
   if (p != (tACL_CONN*)NULL) {
     btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
-    alarm_set_on_queue(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
-                       btm_read_rssi_timeout, NULL, btu_general_alarm_queue);
+    alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
+                       btm_read_rssi_timeout, NULL);
 
     btsnd_hcic_read_rssi(p->hci_handle);
     return (BTM_CMD_STARTED);
@@ -1940,31 +1926,103 @@ tBTM_STATUS BTM_ReadRSSI(const BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
 
 /*******************************************************************************
  *
+ * Function         BTM_ReadFailedContactCounter
+ *
+ * Description      This function is called to read the failed contact counter.
+ *                  The result is returned in the callback.
+ *                  (tBTM_FAILED_CONTACT_COUNTER_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated or error code
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
+                                         tBTM_CMPL_CB* p_cb) {
+  tACL_CONN* p;
+  tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
+  tBT_DEVICE_TYPE dev_type;
+  tBLE_ADDR_TYPE addr_type;
+
+  /* If someone already waiting on the result, do not allow another */
+  if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
+
+  BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
+  if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
+
+  p = btm_bda_to_acl(remote_bda, transport);
+  if (p != (tACL_CONN*)NULL) {
+    btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
+    alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
+                       BTM_DEV_REPLY_TIMEOUT_MS,
+                       btm_read_failed_contact_counter_timeout, NULL);
+
+    btsnd_hcic_read_failed_contact_counter(p->hci_handle);
+    return (BTM_CMD_STARTED);
+  }
+
+  /* If here, no BD Addr found */
+  return (BTM_UNKNOWN_ADDR);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadAutomaticFlushTimeout
+ *
+ * Description      This function is called to read the automatic flush timeout.
+ *                  The result is returned in the callback.
+ *                  (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated or error code
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
+                                          tBTM_CMPL_CB* p_cb) {
+  tACL_CONN* p;
+  tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
+  tBT_DEVICE_TYPE dev_type;
+  tBLE_ADDR_TYPE addr_type;
+
+  /* If someone already waiting on the result, do not allow another */
+  if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
+
+  BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
+  if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
+
+  p = btm_bda_to_acl(remote_bda, transport);
+  if (!p) return BTM_UNKNOWN_ADDR;
+
+  btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
+  alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
+                     BTM_DEV_REPLY_TIMEOUT_MS,
+                     btm_read_automatic_flush_timeout_timeout, nullptr);
+
+  btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
+  return BTM_CMD_STARTED;
+}
+
+/*******************************************************************************
+ *
  * Function         BTM_ReadLinkQuality
  *
  * Description      This function is called to read the link qulaity.
  *                  The value of the link quality is returned in the callback.
- *                  (tBTM_LINK_QUALITY_RESULTS)
+ *                  (tBTM_LINK_QUALITY_RESULT)
  *
  * Returns          BTM_CMD_STARTED if successfully initiated or error code
  *
  ******************************************************************************/
-tBTM_STATUS BTM_ReadLinkQuality(BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
-  tACL_CONN* p;
-
-  BTM_TRACE_API("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-                remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
-                remote_bda[4], remote_bda[5]);
+tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
+                                tBTM_CMPL_CB* p_cb) {
+  VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
 
   /* If someone already waiting on the version, do not allow another */
   if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
 
-  p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
+  tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
   if (p != (tACL_CONN*)NULL) {
     btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
-    alarm_set_on_queue(btm_cb.devcb.read_link_quality_timer,
+    alarm_set_on_mloop(btm_cb.devcb.read_link_quality_timer,
                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
-                       NULL, btu_general_alarm_queue);
+                       NULL);
 
     btsnd_hcic_get_link_quality(p->hci_handle);
     return (BTM_CMD_STARTED);
@@ -1981,20 +2039,18 @@ tBTM_STATUS BTM_ReadLinkQuality(BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
  * Description      This function is called to read the current
  *                  TX power of the connection. The tx power level results
  *                  are returned in the callback.
- *                  (tBTM_RSSI_RESULTS)
+ *                  (tBTM_RSSI_RESULT)
  *
  * Returns          BTM_CMD_STARTED if successfully initiated or error code
  *
  ******************************************************************************/
-tBTM_STATUS BTM_ReadTxPower(BD_ADDR remote_bda, tBT_TRANSPORT transport,
-                            tBTM_CMPL_CB* p_cb) {
+tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
+                            tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
   tACL_CONN* p;
 #define BTM_READ_RSSI_TYPE_CUR 0x00
 #define BTM_READ_RSSI_TYPE_MAX 0X01
 
-  BTM_TRACE_API("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-                remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
-                remote_bda[4], remote_bda[5]);
+  VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
 
   /* If someone already waiting on the version, do not allow another */
   if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
@@ -2002,12 +2058,12 @@ tBTM_STATUS BTM_ReadTxPower(BD_ADDR remote_bda, tBT_TRANSPORT transport,
   p = btm_bda_to_acl(remote_bda, transport);
   if (p != (tACL_CONN*)NULL) {
     btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
-    alarm_set_on_queue(btm_cb.devcb.read_tx_power_timer,
+    alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
-                       NULL, btu_general_alarm_queue);
+                       NULL);
 
     if (p->transport == BT_TRANSPORT_LE) {
-      memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
+      btm_cb.devcb.read_tx_pwr_addr = remote_bda;
       btsnd_hcic_ble_read_adv_chnl_tx_power();
     } else {
       btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
@@ -2047,10 +2103,8 @@ void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
  ******************************************************************************/
 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
-  tBTM_TX_POWER_RESULTS results;
-  uint16_t handle;
+  tBTM_TX_POWER_RESULT result;
   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
-  uint16_t index;
 
   BTM_TRACE_DEBUG("%s", __func__);
   alarm_cancel(btm_cb.devcb.read_tx_power_timer);
@@ -2058,32 +2112,34 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
 
   /* If there was a registered callback, call it */
   if (p_cb) {
-    STREAM_TO_UINT8(results.hci_status, p);
+    STREAM_TO_UINT8(result.hci_status, p);
 
-    if (results.hci_status == HCI_SUCCESS) {
-      results.status = BTM_SUCCESS;
+    if (result.hci_status == HCI_SUCCESS) {
+      result.status = BTM_SUCCESS;
 
       if (!is_ble) {
+        uint16_t handle;
         STREAM_TO_UINT16(handle, p);
-        STREAM_TO_UINT8(results.tx_power, p);
+        STREAM_TO_UINT8(result.tx_power, p);
 
         /* Search through the list of active channels for the correct BD Addr */
-        for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
+        for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
           if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
-            memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
+            result.rem_bda = p_acl_cb->remote_addr;
             break;
           }
         }
       } else {
-        STREAM_TO_UINT8(results.tx_power, p);
-        memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
+        STREAM_TO_UINT8(result.tx_power, p);
+        result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
       }
       BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
-                      results.tx_power, results.hci_status);
-    } else
-      results.status = BTM_ERR_PROCESSING;
+                      result.tx_power, result.hci_status);
+    } else {
+      result.status = BTM_ERR_PROCESSING;
+    }
 
-    (*p_cb)(&results);
+    (*p_cb)(&result);
   }
 }
 
@@ -2097,12 +2153,11 @@ void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
  *
  ******************************************************************************/
 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
-  tBTM_RSSI_RESULTS  results;
+  tBTM_RSSI_RESULT result;
   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
   btm_cb.devcb.p_rssi_cmpl_cb = NULL;
-  results.status = BTM_DEVICE_TIMEOUT;
-  if (p_cb)
-      (*p_cb)(&results);
+  result.status = BTM_DEVICE_TIMEOUT;
+  if (p_cb) (*p_cb)(&result);
 }
 
 /*******************************************************************************
@@ -2117,10 +2172,8 @@ void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
  ******************************************************************************/
 void btm_read_rssi_complete(uint8_t* p) {
   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
-  tBTM_RSSI_RESULTS results;
-  uint16_t handle;
+  tBTM_RSSI_RESULT result;
   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
-  uint16_t index;
 
   BTM_TRACE_DEBUG("%s", __func__);
   alarm_cancel(btm_cb.devcb.read_rssi_timer);
@@ -2128,28 +2181,164 @@ void btm_read_rssi_complete(uint8_t* p) {
 
   /* If there was a registered callback, call it */
   if (p_cb) {
-    STREAM_TO_UINT8(results.hci_status, p);
+    STREAM_TO_UINT8(result.hci_status, p);
 
-    if (results.hci_status == HCI_SUCCESS) {
-      results.status = BTM_SUCCESS;
+    if (result.hci_status == HCI_SUCCESS) {
+      uint16_t handle;
+      result.status = BTM_SUCCESS;
 
       STREAM_TO_UINT16(handle, p);
 
-      STREAM_TO_UINT8(results.rssi, p);
+      STREAM_TO_UINT8(result.rssi, p);
       BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
-                      results.rssi, results.hci_status);
+                      result.rssi, result.hci_status);
+
+      /* Search through the list of active channels for the correct BD Addr */
+      for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
+        if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
+          result.rem_bda = p_acl_cb->remote_addr;
+          break;
+        }
+      }
+    } else {
+      result.status = BTM_ERR_PROCESSING;
+    }
+
+    (*p_cb)(&result);
+  }
+}
+
+/*******************************************************************************
+ *
+ * Function         btm_read_failed_contact_counter_timeout
+ *
+ * Description      Callback when reading the failed contact counter times out.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
+  tBTM_FAILED_CONTACT_COUNTER_RESULT result;
+  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
+  btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
+  result.status = BTM_DEVICE_TIMEOUT;
+  if (p_cb) (*p_cb)(&result);
+}
+
+/*******************************************************************************
+ *
+ * Function         btm_read_failed_contact_counter_complete
+ *
+ * Description      This function is called when the command complete message
+ *                  is received from the HCI for the read failed contact
+ *                  counter request.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void btm_read_failed_contact_counter_complete(uint8_t* p) {
+  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
+  tBTM_FAILED_CONTACT_COUNTER_RESULT result;
+  tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
+
+  BTM_TRACE_DEBUG("%s", __func__);
+  alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
+  btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
+
+  /* If there was a registered callback, call it */
+  if (p_cb) {
+    uint16_t handle;
+    STREAM_TO_UINT8(result.hci_status, p);
+
+    if (result.hci_status == HCI_SUCCESS) {
+      result.status = BTM_SUCCESS;
+
+      STREAM_TO_UINT16(handle, p);
+
+      STREAM_TO_UINT16(result.failed_contact_counter, p);
+      BTM_TRACE_DEBUG(
+          "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
+          result.failed_contact_counter, result.hci_status);
 
       /* Search through the list of active channels for the correct BD Addr */
-      for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
+      for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
-          memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
+          result.rem_bda = p_acl_cb->remote_addr;
           break;
         }
       }
-    } else
-      results.status = BTM_ERR_PROCESSING;
+    } else {
+      result.status = BTM_ERR_PROCESSING;
+    }
 
-    (*p_cb)(&results);
+    (*p_cb)(&result);
+  }
+}
+
+/*******************************************************************************
+ *
+ * Function         btm_read_automatic_flush_timeout_timeout
+ *
+ * Description      Callback when reading the automatic flush timeout times out.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
+  tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
+  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
+  btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
+  result.status = BTM_DEVICE_TIMEOUT;
+  if (p_cb) (*p_cb)(&result);
+}
+
+/*******************************************************************************
+ *
+ * Function         btm_read_automatic_flush_timeout_complete
+ *
+ * Description      This function is called when the command complete message
+ *                  is received from the HCI for the read automatic flush
+ *                  timeout request.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
+  tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
+  tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
+  tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
+
+  BTM_TRACE_DEBUG("%s", __func__);
+  alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
+  btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
+
+  /* If there was a registered callback, call it */
+  if (p_cb) {
+    uint16_t handle;
+    STREAM_TO_UINT8(result.hci_status, p);
+
+    if (result.hci_status == HCI_SUCCESS) {
+      result.status = BTM_SUCCESS;
+
+      STREAM_TO_UINT16(handle, p);
+
+      STREAM_TO_UINT16(result.automatic_flush_timeout, p);
+      BTM_TRACE_DEBUG(
+          "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
+          result.automatic_flush_timeout, result.hci_status);
+
+      /* Search through the list of active channels for the correct BD Addr */
+      for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
+        if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
+          result.rem_bda = p_acl_cb->remote_addr;
+          break;
+        }
+      }
+    } else {
+      result.status = BTM_ERR_PROCESSING;
+    }
+
+    (*p_cb)(&result);
   }
 }
 
@@ -2180,10 +2369,8 @@ void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
  ******************************************************************************/
 void btm_read_link_quality_complete(uint8_t* p) {
   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
-  tBTM_LINK_QUALITY_RESULTS results;
-  uint16_t handle;
+  tBTM_LINK_QUALITY_RESULT result;
   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
-  uint16_t index;
 
   BTM_TRACE_DEBUG("%s", __func__);
   alarm_cancel(btm_cb.devcb.read_link_quality_timer);
@@ -2191,29 +2378,31 @@ void btm_read_link_quality_complete(uint8_t* p) {
 
   /* If there was a registered callback, call it */
   if (p_cb) {
-    STREAM_TO_UINT8(results.hci_status, p);
+    STREAM_TO_UINT8(result.hci_status, p);
 
-    if (results.hci_status == HCI_SUCCESS) {
-      results.status = BTM_SUCCESS;
+    if (result.hci_status == HCI_SUCCESS) {
+      uint16_t handle;
+      result.status = BTM_SUCCESS;
 
       STREAM_TO_UINT16(handle, p);
 
-      STREAM_TO_UINT8(results.link_quality, p);
+      STREAM_TO_UINT8(result.link_quality, p);
       BTM_TRACE_DEBUG(
           "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
-          results.link_quality, results.hci_status);
+          result.link_quality, result.hci_status);
 
       /* Search through the list of active channels for the correct BD Addr */
-      for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
+      for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
-          memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
+          result.rem_bda = p_acl_cb->remote_addr;
           break;
         }
       }
-    } else
-      results.status = BTM_ERR_PROCESSING;
+    } else {
+      result.status = BTM_ERR_PROCESSING;
+    }
 
-    (*p_cb)(&results);
+    (*p_cb)(&result);
   }
 }
 
@@ -2227,7 +2416,7 @@ void btm_read_link_quality_complete(uint8_t* p) {
  *                  BTM_NO_RESOURCES.
  *
  ******************************************************************************/
-tBTM_STATUS btm_remove_acl(BD_ADDR bd_addr, tBT_TRANSPORT transport) {
+tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
   uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
   tBTM_STATUS status = BTM_SUCCESS;
 
@@ -2244,8 +2433,9 @@ tBTM_STATUS btm_remove_acl(BD_ADDR bd_addr, tBT_TRANSPORT transport) {
     if (hci_handle != 0xFFFF && p_dev_rec &&
         p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
       btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
-    } else
+    } else {
       status = BTM_UNKNOWN_ADDR;
+    }
   }
 
   return status;
@@ -2320,7 +2510,6 @@ void btm_acl_resubmit_page(void) {
   tBTM_SEC_DEV_REC* p_dev_rec;
   BT_HDR* p_buf;
   uint8_t* pp;
-  BD_ADDR bda;
   BTM_TRACE_DEBUG("btm_acl_resubmit_page");
   /* If there were other page request schedule can start the next one */
   p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
@@ -2329,16 +2518,18 @@ void btm_acl_resubmit_page(void) {
      * for both create_conn and rmt_name */
     pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
 
+    RawAddress bda;
     STREAM_TO_BDADDR(bda, pp);
 
     p_dev_rec = btm_find_or_alloc_dev(bda);
 
-    memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
+    btm_cb.connecting_bda = p_dev_rec->bd_addr;
     memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
 
     btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
-  } else
+  } else {
     btm_cb.paging = false;
+  }
 }
 
 /*******************************************************************************
@@ -2366,30 +2557,23 @@ void btm_acl_reset_paging(void) {
  * Description      send a paging command or queue it in btm_cb
  *
  ******************************************************************************/
-void btm_acl_paging(BT_HDR* p, BD_ADDR bda) {
+void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
   tBTM_SEC_DEV_REC* p_dev_rec;
 
-  BTM_TRACE_DEBUG("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
-                  btm_cb.discing, btm_cb.paging,
-                  (bda[0] << 16) + (bda[1] << 8) + bda[2],
-                  (bda[3] << 16) + (bda[4] << 8) + bda[5]);
+  VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
+          << " BDA: " << bda;
+
   if (btm_cb.discing) {
     btm_cb.paging = true;
     fixed_queue_enqueue(btm_cb.page_queue, p);
   } else {
     if (!BTM_ACL_IS_CONNECTED(bda)) {
-      BTM_TRACE_DEBUG(
-          "connecting_bda: %06x%06x",
-          (btm_cb.connecting_bda[0] << 16) + (btm_cb.connecting_bda[1] << 8) +
-              btm_cb.connecting_bda[2],
-          (btm_cb.connecting_bda[3] << 16) + (btm_cb.connecting_bda[4] << 8) +
-              btm_cb.connecting_bda[5]);
-      if (btm_cb.paging &&
-          memcmp(bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0) {
+      VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
+      if (btm_cb.paging && bda != btm_cb.connecting_bda) {
         fixed_queue_enqueue(btm_cb.page_queue, p);
       } else {
         p_dev_rec = btm_find_or_alloc_dev(bda);
-        memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
+        btm_cb.connecting_bda = p_dev_rec->bd_addr;
         memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
 
         btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
@@ -2413,23 +2597,21 @@ void btm_acl_paging(BT_HDR* p, BD_ADDR bda) {
  *                  false if no one needs the notification.
  *
  ******************************************************************************/
-bool btm_acl_notif_conn_collision(BD_ADDR bda) {
-  tBTM_BL_EVENT_DATA evt_data;
-
+bool btm_acl_notif_conn_collision(const RawAddress& bda) {
   /* Report possible collision to the upper layer. */
   if (btm_cb.p_bl_changed_cb) {
-    BTM_TRACE_DEBUG(
-        "btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
-        bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
+    VLOG(1) << __func__ << " RemBdAddr: " << bda;
 
+    tBTM_BL_EVENT_DATA evt_data;
     evt_data.event = BTM_BL_COLLISION_EVT;
-    evt_data.conn.p_bda = bda;
+    evt_data.conn.p_bda = &bda;
     evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
     evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
     (*btm_cb.p_bl_changed_cb)(&evt_data);
     return true;
-  } else
+  } else {
     return false;
+  }
 }
 
 /*******************************************************************************