Merge pull request #271 from zxzxwu/device_typing

Typing transport and relateds
Merge pull request #269 from google/gbg/android_vendor_hci
2023-09-09 00:55:59 +08:00 · 2023-09-08 08:50:49 -07:00 · 2023-09-08 17:32:33 +08:00 · 2023-09-08 16:30:06 +08:00 · 2023-09-08 15:27:01 +08:00 · 2023-09-07 21:13:29 -07:00
89 changed files with 5471 additions and 1001 deletions
--- a/.github/workflows/python-build-test.yml
+++ b/.github/workflows/python-build-test.yml
@@ -45,7 +45,8 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        python-version: [ "3.8", "3.9", "3.10" ]
+        python-version: [ "3.8", "3.9", "3.10", "3.11" ]
+        rust-version: [ "1.70.0", "stable" ]
      fail-fast: false
    steps:
      - name: Check out from Git
@@ -62,9 +63,15 @@ jobs:
        uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
          components: clippy,rustfmt
-      - name: Rust Lints
-        run: cd rust && cargo fmt --check && cargo clippy --all-targets -- --deny warnings
+          toolchain: ${{ matrix.rust-version }}
      - name: Rust Build
-        run: cd rust && cargo build --all-targets
+        run: cd rust && cargo build --all-targets && cargo build --all-features --all-targets
+      # Lints after build so what clippy needs is already built
+      - name: Rust Lints
+        run: cd rust && cargo fmt --check && cargo clippy --all-targets -- --deny warnings && cargo clippy --all-features --all-targets -- --deny warnings
      - name: Rust Tests
-        run: cd rust && cargo test
+        run: cd rust && cargo test
+      # At some point, hook up publishing the binary. For now, just make sure it builds.
+      # Once we're ready to publish binaries, this should be built with `--release`.
+      - name: Build Bumble CLI
+        run: cd rust && cargo build --features bumble-tools --bin bumble
--- a/apps/l2cap_bridge.py
+++ b/apps/l2cap_bridge.py
@@ -105,7 +105,7 @@ class ServerBridge:
                            asyncio.create_task(self.pipe.l2cap_channel.disconnect())

                    def data_received(self, data):
-                        print(f'<<< Received on TCP: {len(data)}')
+                        print(color(f'<<< [TCP DATA]: {len(data)} bytes', 'blue'))
                        self.pipe.l2cap_channel.write(data)

                try:
@@ -123,6 +123,7 @@ class ServerBridge:
                    await self.l2cap_channel.disconnect()

            def on_l2cap_close(self):
+                print(color('*** L2CAP channel closed', 'red'))
                self.l2cap_channel = None
                if self.tcp_transport is not None:
                    self.tcp_transport.close()
--- a/apps/show.py
+++ b/apps/show.py
@@ -102,9 +102,19 @@ class SnoopPacketReader:
    default='h4',
    help='Format of the input file',
 )
+@click.option(
+    '--vendors',
+    type=click.Choice(['android']),
+    multiple=True,
+    help='Support vendor-specific commands (list one or more)',
+)
@click.argument('filename')
 # pylint: disable=redefined-builtin
-def main(format, filename):
+def main(format, vendors, filename):
+    for vendor in vendors:
+        if vendor == 'android':
+            import bumble.vendor.android.hci
+
    input = open(filename, 'rb')
    if format == 'h4':
        packet_reader = PacketReader(input)
@@ -124,7 +134,6 @@ def main(format, filename):
            if packet is None:
                break
            tracer.trace(hci.HCI_Packet.from_bytes(packet), direction)
-
        except Exception as error:
            print(color(f'!!! {error}', 'red'))

--- a/apps/speaker/speaker.css
+++ b/apps/speaker/speaker.css
@@ -56,7 +56,7 @@ body, h1, h2, h3, h4, h5, h6 {
    border-radius: 4px;
    padding: 4px;
    margin: 6px;
-    margin-left: 0px;
+    margin-left: 0;
 }

 th, td {
@@ -65,7 +65,7 @@ th, td {
 }

 .properties td:nth-child(even) {
-    background-color: #D6EEEE;
+    background-color: #d6eeee;
    font-family: monospace;
 }

--- a/apps/speaker/speaker.html
+++ b/apps/speaker/speaker.html
@@ -2,7 +2,7 @@
 <html>
 <head>
  <title>Bumble Speaker</title>
-  <script type="text/javascript" src="speaker.js"></script>
+  <script src="speaker.js"></script>
  <link rel="stylesheet" href="speaker.css">
 </head>
 <body>
--- a/bumble/controller.py
+++ b/bumble/controller.py
@@ -15,6 +15,8 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+from __future__ import annotations
+
 import logging
 import asyncio
 import itertools
@@ -58,8 +60,10 @@ from bumble.hci import (
    HCI_Packet,
    HCI_Role_Change_Event,
 )
-from typing import Optional, Union, Dict
+from typing import Optional, Union, Dict, TYPE_CHECKING

+if TYPE_CHECKING:
+    from bumble.transport.common import TransportSink, TransportSource

 # -----------------------------------------------------------------------------
 # Logging
@@ -104,7 +108,7 @@ class Controller:
        self,
        name,
        host_source=None,
-        host_sink=None,
+        host_sink: Optional[TransportSink] = None,
        link=None,
        public_address: Optional[Union[bytes, str, Address]] = None,
    ):
--- a/bumble/core.py
+++ b/bumble/core.py
@@ -78,7 +78,13 @@ def get_dict_key_by_value(dictionary, value):
 class BaseError(Exception):
    """Base class for errors with an error code, error name and namespace"""

-    def __init__(self, error_code, error_namespace='', error_name='', details=''):
+    def __init__(
+        self,
+        error_code: int | None,
+        error_namespace: str = '',
+        error_name: str = '',
+        details: str = '',
+    ):
        super().__init__()
        self.error_code = error_code
        self.error_namespace = error_namespace
@@ -90,12 +96,14 @@ class BaseError(Exception):
            namespace = f'{self.error_namespace}/'
        else:
            namespace = ''
-        if self.error_name:
-            name = f'{self.error_name} [0x{self.error_code:X}]'
-        else:
-            name = f'0x{self.error_code:X}'
+        error_text = {
+            (True, True): f'{self.error_name} [0x{self.error_code:X}]',
+            (True, False): self.error_name,
+            (False, True): f'0x{self.error_code:X}',
+            (False, False): '',
+        }[(self.error_name != '', self.error_code is not None)]

-        return f'{type(self).__name__}({namespace}{name})'
+        return f'{type(self).__name__}({namespace}{error_text})'


 class ProtocolError(BaseError):
--- a/bumble/crypto.py
+++ b/bumble/crypto.py
@@ -23,22 +23,18 @@
 # -----------------------------------------------------------------------------
 import logging
 import operator
-import platform

-if platform.system() != 'Emscripten':
-    import secrets
-    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-    from cryptography.hazmat.primitives.asymmetric.ec import (
-        generate_private_key,
-        ECDH,
-        EllipticCurvePublicNumbers,
-        EllipticCurvePrivateNumbers,
-        SECP256R1,
-    )
-    from cryptography.hazmat.primitives import cmac
-else:
-    # TODO: implement stubs
-    pass
+import secrets
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    generate_private_key,
+    ECDH,
+    EllipticCurvePublicNumbers,
+    EllipticCurvePrivateNumbers,
+    SECP256R1,
+)
+from cryptography.hazmat.primitives import cmac
+

 # -----------------------------------------------------------------------------
 # Logging
--- a/bumble/device.py
+++ b/bumble/device.py
@@ -23,7 +23,18 @@ import asyncio
 import logging
 from contextlib import asynccontextmanager, AsyncExitStack
 from dataclasses import dataclass
-from typing import Any, Callable, ClassVar, Dict, List, Optional, Tuple, Type, Union
+from typing import (
+    Any,
+    Callable,
+    ClassVar,
+    Dict,
+    List,
+    Optional,
+    Tuple,
+    Type,
+    Union,
+    TYPE_CHECKING,
+)

 from .colors import color
 from .att import ATT_CID, ATT_DEFAULT_MTU, ATT_PDU
@@ -152,6 +163,9 @@ from . import sdp
 from . import l2cap
 from . import core

+if TYPE_CHECKING:
+    from .transport.common import TransportSource, TransportSink
+

 # -----------------------------------------------------------------------------
 # Logging
@@ -652,7 +666,7 @@ class Connection(CompositeEventEmitter):
    def is_incomplete(self) -> bool:
        return self.handle is None

-    def send_l2cap_pdu(self, cid, pdu):
+    def send_l2cap_pdu(self, cid: int, pdu: bytes) -> None:
        self.device.send_l2cap_pdu(self.handle, cid, pdu)

    def create_l2cap_connector(self, psm):
@@ -942,7 +956,13 @@ class Device(CompositeEventEmitter):
            pass

    @classmethod
-    def with_hci(cls, name, address, hci_source, hci_sink):
+    def with_hci(
+        cls,
+        name: str,
+        address: Address,
+        hci_source: TransportSource,
+        hci_sink: TransportSink,
+    ) -> Device:
        '''
        Create a Device instance with a Host configured to communicate with a controller
        through an HCI source/sink
@@ -951,18 +971,25 @@ class Device(CompositeEventEmitter):
        return cls(name=name, address=address, host=host)

    @classmethod
-    def from_config_file(cls, filename):
+    def from_config_file(cls, filename: str) -> Device:
        config = DeviceConfiguration()
        config.load_from_file(filename)
        return cls(config=config)

    @classmethod
-    def from_config_with_hci(cls, config, hci_source, hci_sink):
+    def from_config_with_hci(
+        cls,
+        config: DeviceConfiguration,
+        hci_source: TransportSource,
+        hci_sink: TransportSink,
+    ) -> Device:
        host = Host(controller_source=hci_source, controller_sink=hci_sink)
        return cls(config=config, host=host)

    @classmethod
-    def from_config_file_with_hci(cls, filename, hci_source, hci_sink):
+    def from_config_file_with_hci(
+        cls, filename: str, hci_source: TransportSource, hci_sink: TransportSink
+    ) -> Device:
        config = DeviceConfiguration()
        config.load_from_file(filename)
        return cls.from_config_with_hci(config, hci_source, hci_sink)
@@ -1096,7 +1123,7 @@ class Device(CompositeEventEmitter):
        return self._host

    @host.setter
-    def host(self, host):
+    def host(self, host: Host) -> None:
        # Unsubscribe from events from the current host
        if self._host:
            for event_name in device_host_event_handlers:
@@ -1183,7 +1210,7 @@ class Device(CompositeEventEmitter):
            connection, psm, max_credits, mtu, mps
        )

-    def send_l2cap_pdu(self, connection_handle, cid, pdu):
+    def send_l2cap_pdu(self, connection_handle: int, cid: int, pdu: bytes) -> None:
        self.host.send_l2cap_pdu(connection_handle, cid, pdu)

    async def send_command(self, command, check_result=False):
@@ -2238,9 +2265,11 @@ class Device(CompositeEventEmitter):
    def request_pairing(self, connection):
        return self.smp_manager.request_pairing(connection)

-    async def get_long_term_key(self, connection_handle, rand, ediv):
+    async def get_long_term_key(
+        self, connection_handle: int, rand: bytes, ediv: int
+    ) -> Optional[bytes]:
        if (connection := self.lookup_connection(connection_handle)) is None:
-            return
+            return None

        # Start by looking for the key in an SMP session
        ltk = self.smp_manager.get_long_term_key(connection, rand, ediv)
@@ -2260,19 +2289,24 @@ class Device(CompositeEventEmitter):

                if connection.role == BT_PERIPHERAL_ROLE and keys.ltk_peripheral:
                    return keys.ltk_peripheral.value
+        return None

    async def get_link_key(self, address: Address) -> Optional[bytes]:
-        # Look for the key in the keystore
-        if self.keystore is not None:
-            keys = await self.keystore.get(str(address))
-            if keys is not None:
-                logger.debug('found keys in the key store')
-                if keys.link_key is None:
-                    logger.warning('no link key')
-                    return None
+        if self.keystore is None:
+            return None

-                return keys.link_key.value
-        return None
+        # Look for the key in the keystore
+        keys = await self.keystore.get(str(address))
+        if keys is None:
+            logger.debug(f'no keys found for {address}')
+            return None
+
+        logger.debug('found keys in the key store')
+        if keys.link_key is None:
+            logger.warning('no link key')
+            return None
+
+        return keys.link_key.value

    # [Classic only]
    async def authenticate(self, connection):
@@ -2391,6 +2425,18 @@ class Device(CompositeEventEmitter):
                'connection_encryption_failure', on_encryption_failure
            )

+    async def update_keys(self, address: str, keys: PairingKeys) -> None:
+        if self.keystore is None:
+            return
+
+        try:
+            await self.keystore.update(address, keys)
+            await self.refresh_resolving_list()
+        except Exception as error:
+            logger.warning(f'!!! error while storing keys: {error}')
+        else:
+            self.emit('key_store_update')
+
    # [Classic only]
    async def switch_role(self, connection: Connection, role: int):
        pending_role_change = asyncio.get_running_loop().create_future()
@@ -2485,13 +2531,7 @@ class Device(CompositeEventEmitter):
                value=link_key, authenticated=authenticated
            )

-            async def store_keys():
-                try:
-                    await self.keystore.update(str(bd_addr), pairing_keys)
-                except Exception as error:
-                    logger.warning(f'!!! error while storing keys: {error}')
-
-            self.abort_on('flush', store_keys())
+            self.abort_on('flush', self.update_keys(str(bd_addr), pairing_keys))

        if connection := self.find_connection_by_bd_addr(
            bd_addr, transport=BT_BR_EDR_TRANSPORT
@@ -2743,20 +2783,6 @@ class Device(CompositeEventEmitter):
        )
        connection.emit('connection_authentication_failure', error)

-    @host_event_handler
-    @with_connection_from_address
-    def on_ssp_complete(self, connection):
-        # On Secure Simple Pairing complete, in case:
-        # - Connection isn't already authenticated
-        # - AND we are not the initiator of the authentication
-        # We must trigger authentication to know if we are truly authenticated
-        if not connection.authenticating and not connection.authenticated:
-            logger.debug(
-                f'*** Trigger Connection Authentication: [0x{connection.handle:04X}] '
-                f'{connection.peer_address}'
-            )
-            asyncio.create_task(connection.authenticate())
-
    # [Classic only]
    @host_event_handler
    @with_connection_from_address
@@ -3111,6 +3137,18 @@ class Device(CompositeEventEmitter):
            connection.emit('role_change_failure', error)
        self.emit('role_change_failure', address, error)

+    # [Classic only]
+    @host_event_handler
+    @with_connection_from_address
+    def on_classic_pairing(self, connection: Connection) -> None:
+        connection.emit('classic_pairing')
+
+    # [Classic only]
+    @host_event_handler
+    @with_connection_from_address
+    def on_classic_pairing_failure(self, connection: Connection, status) -> None:
+        connection.emit('classic_pairing_failure', status)
+
    def on_pairing_start(self, connection: Connection) -> None:
        connection.emit('pairing_start')

@@ -3159,7 +3197,7 @@ class Device(CompositeEventEmitter):

    @host_event_handler
    @with_connection_from_handle
-    def on_l2cap_pdu(self, connection, cid, pdu):
+    def on_l2cap_pdu(self, connection: Connection, cid: int, pdu: bytes):
        self.l2cap_channel_manager.on_pdu(connection, cid, pdu)

    def __str__(self):
--- a/bumble/drivers/init.py
+++ b/bumble/drivers/init.py
@@ -21,6 +21,8 @@ like loading firmware after a cold start.
 # -----------------------------------------------------------------------------
 import abc
 import logging
+import pathlib
+import platform
 from . import rtk


@@ -66,3 +68,24 @@ async def get_driver_for_host(host):
        return driver

    return None
+
+
+def project_data_dir() -> pathlib.Path:
+    """
+    Returns:
+        A path to an OS-specific directory for bumble data. The directory is created if
+         it doesn't exist.
+    """
+    import platformdirs
+
+    if platform.system() == 'Darwin':
+        # platformdirs doesn't handle macOS right: it doesn't assemble a bundle id
+        # out of author & project
+        return platformdirs.user_data_path(
+            appname='com.google.bumble', ensure_exists=True
+        )
+    else:
+        # windows and linux don't use the com qualifier
+        return platformdirs.user_data_path(
+            appname='bumble', appauthor='google', ensure_exists=True
+        )
--- a/bumble/drivers/rtk.py
+++ b/bumble/drivers/rtk.py
@@ -34,10 +34,9 @@ import weakref


 from bumble.hci import (
-    hci_command_op_code,
+    hci_vendor_command_op_code,
    STATUS_SPEC,
    HCI_SUCCESS,
-    HCI_COMMAND_NAMES,
    HCI_Command,
    HCI_Reset_Command,
    HCI_Read_Local_Version_Information_Command,
@@ -125,6 +124,7 @@ RTK_USB_PRODUCTS = {
    (0x2550, 0x8761),
    (0x2B89, 0x8761),
    (0x7392, 0xC611),
+    (0x0BDA, 0x877B),
    # Realtek 8821AE
    (0x0B05, 0x17DC),
    (0x13D3, 0x3414),
@@ -178,8 +178,10 @@ RTK_USB_PRODUCTS = {
 # -----------------------------------------------------------------------------
 # HCI Commands
 # -----------------------------------------------------------------------------
-HCI_RTK_READ_ROM_VERSION_COMMAND = hci_command_op_code(0x3F, 0x6D)
-HCI_COMMAND_NAMES[HCI_RTK_READ_ROM_VERSION_COMMAND] = "HCI_RTK_READ_ROM_VERSION_COMMAND"
+HCI_RTK_READ_ROM_VERSION_COMMAND = hci_vendor_command_op_code(0x6D)
+HCI_RTK_DOWNLOAD_COMMAND = hci_vendor_command_op_code(0x20)
+HCI_RTK_DROP_FIRMWARE_COMMAND = hci_vendor_command_op_code(0x66)
+HCI_Command.register_commands(globals())


@HCI_Command.command(return_parameters_fields=[("status", STATUS_SPEC), ("version", 1)])
@@ -187,10 +189,6 @@ class HCI_RTK_Read_ROM_Version_Command(HCI_Command):
    pass


-HCI_RTK_DOWNLOAD_COMMAND = hci_command_op_code(0x3F, 0x20)
-HCI_COMMAND_NAMES[HCI_RTK_DOWNLOAD_COMMAND] = "HCI_RTK_DOWNLOAD_COMMAND"
-
-
@HCI_Command.command(
    fields=[("index", 1), ("payload", RTK_FRAGMENT_LENGTH)],
    return_parameters_fields=[("status", STATUS_SPEC), ("index", 1)],
@@ -199,10 +197,6 @@ class HCI_RTK_Download_Command(HCI_Command):
    pass


-HCI_RTK_DROP_FIRMWARE_COMMAND = hci_command_op_code(0x3F, 0x66)
-HCI_COMMAND_NAMES[HCI_RTK_DROP_FIRMWARE_COMMAND] = "HCI_RTK_DROP_FIRMWARE_COMMAND"
-
-
@HCI_Command.command()
 class HCI_RTK_Drop_Firmware_Command(HCI_Command):
    pass
@@ -445,6 +439,11 @@ class Driver:
            # When the environment variable is set, don't look elsewhere
            return None

+        # Then, look where the firmware download tool writes by default
+        if (path := rtk_firmware_dir() / file_name).is_file():
+            logger.debug(f"{file_name} found in project data dir")
+            return path
+
        # Then, look in the package's driver directory
        if (path := pathlib.Path(__file__).parent / "rtk_fw" / file_name).is_file():
            logger.debug(f"{file_name} found in package dir")
@@ -645,3 +644,16 @@ class Driver:
        await self.download_firmware()
        await self.host.send_command(HCI_Reset_Command(), check_result=True)
        logger.info(f"loaded FW image {self.driver_info.fw_name}")
+
+
+def rtk_firmware_dir() -> pathlib.Path:
+    """
+    Returns:
+        A path to a subdir of the project data dir for Realtek firmware.
+         The directory is created if it doesn't exist.
+    """
+    from bumble.drivers import project_data_dir
+
+    p = project_data_dir() / "firmware" / "realtek"
+    p.mkdir(parents=True, exist_ok=True)
+    return p
--- a/bumble/hci.py
+++ b/bumble/hci.py
@@ -16,11 +16,11 @@
 # Imports
 # -----------------------------------------------------------------------------
 from __future__ import annotations
-import struct
 import collections
-import logging
 import functools
-from typing import Dict, Type, Union
+import logging
+import struct
+from typing import Any, Dict, Callable, Optional, Type, Union

 from .colors import color
 from .core import (
@@ -47,6 +47,10 @@ def hci_command_op_code(ogf, ocf):
    return ogf << 10 | ocf


+def hci_vendor_command_op_code(ocf):
+    return hci_command_op_code(HCI_VENDOR_OGF, ocf)
+
+
 def key_with_value(dictionary, target_value):
    for key, value in dictionary.items():
        if value == target_value:
@@ -101,6 +105,8 @@ def phy_list_to_bits(phys):
 # fmt: off
 # pylint: disable=line-too-long

+HCI_VENDOR_OGF = 0x3F
+
 # HCI Version
 HCI_VERSION_BLUETOOTH_CORE_1_0B    = 0
 HCI_VERSION_BLUETOOTH_CORE_1_1     = 1
@@ -206,10 +212,8 @@ HCI_INQUIRY_RESPONSE_NOTIFICATION_EVENT                          = 0X56
 HCI_AUTHENTICATED_PAYLOAD_TIMEOUT_EXPIRED_EVENT                  = 0X57
 HCI_SAM_STATUS_CHANGE_EVENT                                      = 0X58

-HCI_EVENT_NAMES = {
-    event_code: event_name for (event_name, event_code) in globals().items()
-    if event_name.startswith('HCI_') and event_name.endswith('_EVENT')
-}
+HCI_VENDOR_EVENT = 0xFF
+

 # HCI Subevent Codes
 HCI_LE_CONNECTION_COMPLETE_EVENT                         = 0x01
@@ -248,10 +252,6 @@ HCI_LE_TRANSMIT_POWER_REPORTING_EVENT                    = 0X21
 HCI_LE_BIGINFO_ADVERTISING_REPORT_EVENT                  = 0X22
 HCI_LE_SUBRATE_CHANGE_EVENT                              = 0X23

-HCI_SUBEVENT_NAMES = {
-    event_code: event_name for (event_name, event_code) in globals().items()
-    if event_name.startswith('HCI_LE_') and event_name.endswith('_EVENT') and event_code != HCI_LE_META_EVENT
-}

 # HCI Command
 HCI_INQUIRY_COMMAND                                                      = hci_command_op_code(0x01, 0x0001)
@@ -557,10 +557,6 @@ HCI_LE_SET_DATA_RELATED_ADDRESS_CHANGES_COMMAND                          = hci_c
 HCI_LE_SET_DEFAULT_SUBRATE_COMMAND                                       = hci_command_op_code(0x08, 0x007D)
 HCI_LE_SUBRATE_REQUEST_COMMAND                                           = hci_command_op_code(0x08, 0x007E)

-HCI_COMMAND_NAMES = {
-    command_code: command_name for (command_name, command_code) in globals().items()
-    if command_name.startswith('HCI_') and command_name.endswith('_COMMAND')
-}

 # HCI Error Codes
 # See Bluetooth spec Vol 2, Part D - 1.3 LIST OF ERROR CODES
@@ -1918,7 +1914,7 @@ class HCI_Packet:
    hci_packet_type: int

    @staticmethod
-    def from_bytes(packet):
+    def from_bytes(packet: bytes) -> HCI_Packet:
        packet_type = packet[0]

        if packet_type == HCI_COMMAND_PACKET:
@@ -1960,6 +1956,7 @@ class HCI_Command(HCI_Packet):
    '''

    hci_packet_type = HCI_COMMAND_PACKET
+    command_names: Dict[int, str] = {}
    command_classes: Dict[int, Type[HCI_Command]] = {}

    @staticmethod
@@ -1970,9 +1967,9 @@ class HCI_Command(HCI_Packet):

        def inner(cls):
            cls.name = cls.__name__.upper()
-            cls.op_code = key_with_value(HCI_COMMAND_NAMES, cls.name)
+            cls.op_code = key_with_value(cls.command_names, cls.name)
            if cls.op_code is None:
-                raise KeyError(f'command {cls.name} not found in HCI_COMMAND_NAMES')
+                raise KeyError(f'command {cls.name} not found in command_names')
            cls.fields = fields
            cls.return_parameters_fields = return_parameters_fields

@@ -1992,7 +1989,19 @@ class HCI_Command(HCI_Packet):
        return inner

    @staticmethod
-    def from_bytes(packet):
+    def command_map(symbols: Dict[str, Any]) -> Dict[int, str]:
+        return {
+            command_code: command_name
+            for (command_name, command_code) in symbols.items()
+            if command_name.startswith('HCI_') and command_name.endswith('_COMMAND')
+        }
+
+    @classmethod
+    def register_commands(cls, symbols: Dict[str, Any]) -> None:
+        cls.command_names.update(cls.command_map(symbols))
+
+    @staticmethod
+    def from_bytes(packet: bytes) -> HCI_Command:
        op_code, length = struct.unpack_from('<HB', packet, 1)
        parameters = packet[4:]
        if len(parameters) != length:
@@ -2011,11 +2020,11 @@ class HCI_Command(HCI_Packet):
            HCI_Object.init_from_bytes(self, parameters, 0, fields)
            return self

-        return cls.from_parameters(parameters)
+        return cls.from_parameters(parameters)  # type: ignore

    @staticmethod
    def command_name(op_code):
-        name = HCI_COMMAND_NAMES.get(op_code)
+        name = HCI_Command.command_names.get(op_code)
        if name is not None:
            return name
        return f'[OGF=0x{op_code >> 10:02x}, OCF=0x{op_code & 0x3FF:04x}]'
@@ -2024,6 +2033,16 @@ class HCI_Command(HCI_Packet):
    def create_return_parameters(cls, **kwargs):
        return HCI_Object(cls.return_parameters_fields, **kwargs)

+    @classmethod
+    def parse_return_parameters(cls, parameters):
+        if not cls.return_parameters_fields:
+            return None
+        return_parameters = HCI_Object.from_bytes(
+            parameters, 0, cls.return_parameters_fields
+        )
+        return_parameters.fields = cls.return_parameters_fields
+        return return_parameters
+
    def __init__(self, op_code, parameters=None, **kwargs):
        super().__init__(HCI_Command.command_name(op_code))
        if (fields := getattr(self, 'fields', None)) and kwargs:
@@ -2053,6 +2072,9 @@ class HCI_Command(HCI_Packet):
        return result


+HCI_Command.register_commands(globals())
+
+
 # -----------------------------------------------------------------------------
@HCI_Command.command(
    [
@@ -4308,8 +4330,8 @@ class HCI_Event(HCI_Packet):
    '''

    hci_packet_type = HCI_EVENT_PACKET
+    event_names: Dict[int, str] = {}
    event_classes: Dict[int, Type[HCI_Event]] = {}
-    meta_event_classes: Dict[int, Type[HCI_LE_Meta_Event]] = {}

    @staticmethod
    def event(fields=()):
@@ -4319,9 +4341,9 @@ class HCI_Event(HCI_Packet):

        def inner(cls):
            cls.name = cls.__name__.upper()
-            cls.event_code = key_with_value(HCI_EVENT_NAMES, cls.name)
+            cls.event_code = key_with_value(cls.event_names, cls.name)
            if cls.event_code is None:
-                raise KeyError('event not found in HCI_EVENT_NAMES')
+                raise KeyError(f'event {cls.name} not found in event_names')
            cls.fields = fields

            # Patch the __init__ method to fix the event_code
@@ -4337,12 +4359,30 @@ class HCI_Event(HCI_Packet):

        return inner

+    @staticmethod
+    def event_map(symbols: Dict[str, Any]) -> Dict[int, str]:
+        return {
+            event_code: event_name
+            for (event_name, event_code) in symbols.items()
+            if event_name.startswith('HCI_')
+            and not event_name.startswith('HCI_LE_')
+            and event_name.endswith('_EVENT')
+        }
+
+    @staticmethod
+    def event_name(event_code):
+        return name_or_number(HCI_Event.event_names, event_code)
+
+    @staticmethod
+    def register_events(symbols: Dict[str, Any]) -> None:
+        HCI_Event.event_names.update(HCI_Event.event_map(symbols))
+
    @staticmethod
    def registered(event_class):
        event_class.name = event_class.__name__.upper()
-        event_class.event_code = key_with_value(HCI_EVENT_NAMES, event_class.name)
+        event_class.event_code = key_with_value(HCI_Event.event_names, event_class.name)
        if event_class.event_code is None:
-            raise KeyError('event not found in HCI_EVENT_NAMES')
+            raise KeyError(f'event {event_class.name} not found in event_names')

        # Register a factory for this class
        HCI_Event.event_classes[event_class.event_code] = event_class
@@ -4350,22 +4390,28 @@ class HCI_Event(HCI_Packet):
        return event_class

    @staticmethod
-    def from_bytes(packet):
+    def from_bytes(packet: bytes) -> HCI_Event:
        event_code = packet[1]
        length = packet[2]
        parameters = packet[3:]
        if len(parameters) != length:
            raise ValueError('invalid packet length')

+        cls: Type[HCI_Event | HCI_LE_Meta_Event] | None
        if event_code == HCI_LE_META_EVENT:
            # We do this dispatch here and not in the subclass in order to avoid call
            # loops
            subevent_code = parameters[0]
-            cls = HCI_Event.meta_event_classes.get(subevent_code)
+            cls = HCI_LE_Meta_Event.subevent_classes.get(subevent_code)
            if cls is None:
                # No class registered, just use a generic class instance
                return HCI_LE_Meta_Event(subevent_code, parameters)
-
+        elif event_code == HCI_VENDOR_EVENT:
+            subevent_code = parameters[0]
+            cls = HCI_Vendor_Event.subevent_classes.get(subevent_code)
+            if cls is None:
+                # No class registered, just use a generic class instance
+                return HCI_Vendor_Event(subevent_code, parameters)
        else:
            cls = HCI_Event.event_classes.get(event_code)
            if cls is None:
@@ -4373,7 +4419,7 @@ class HCI_Event(HCI_Packet):
                return HCI_Event(event_code, parameters)

        # Invoke the factory to create a new instance
-        return cls.from_parameters(parameters)
+        return cls.from_parameters(parameters)  # type: ignore

    @classmethod
    def from_parameters(cls, parameters):
@@ -4383,10 +4429,6 @@ class HCI_Event(HCI_Packet):
            HCI_Object.init_from_bytes(self, parameters, 0, fields)
        return self

-    @staticmethod
-    def event_name(event_code):
-        return name_or_number(HCI_EVENT_NAMES, event_code)
-
    def __init__(self, event_code, parameters=None, **kwargs):
        super().__init__(HCI_Event.event_name(event_code))
        if (fields := getattr(self, 'fields', None)) and kwargs:
@@ -4413,71 +4455,111 @@ class HCI_Event(HCI_Packet):
        return result


+HCI_Event.register_events(globals())
+
+
 # -----------------------------------------------------------------------------
-class HCI_LE_Meta_Event(HCI_Event):
+class HCI_Extended_Event(HCI_Event):
    '''
-    See Bluetooth spec @ 7.7.65 LE Meta Event
+    HCI_Event subclass for events that has a subevent code.
    '''

-    @staticmethod
-    def event(fields=()):
+    subevent_names: Dict[int, str] = {}
+    subevent_classes: Dict[int, Type[HCI_Extended_Event]]
+
+    @classmethod
+    def event(cls, fields=()):
        '''
        Decorator used to declare and register subclasses
        '''

        def inner(cls):
            cls.name = cls.__name__.upper()
-            cls.subevent_code = key_with_value(HCI_SUBEVENT_NAMES, cls.name)
+            cls.subevent_code = key_with_value(cls.subevent_names, cls.name)
            if cls.subevent_code is None:
-                raise KeyError('subevent not found in HCI_SUBEVENT_NAMES')
+                raise KeyError(f'subevent {cls.name} not found in subevent_names')
            cls.fields = fields

            # Patch the __init__ method to fix the subevent_code
+            original_init = cls.__init__
+
            def init(self, parameters=None, **kwargs):
-                return HCI_LE_Meta_Event.__init__(
-                    self, cls.subevent_code, parameters, **kwargs
-                )
+                return original_init(self, cls.subevent_code, parameters, **kwargs)

            cls.__init__ = init

            # Register a factory for this class
-            HCI_Event.meta_event_classes[cls.subevent_code] = cls
+            cls.subevent_classes[cls.subevent_code] = cls

            return cls

        return inner

+    @classmethod
+    def subevent_name(cls, subevent_code):
+        subevent_name = cls.subevent_names.get(subevent_code)
+        if subevent_name is not None:
+            return subevent_name
+
+        return f'{cls.__name__.upper()}[0x{subevent_code:02X}]'
+
+    @staticmethod
+    def subevent_map(symbols: Dict[str, Any]) -> Dict[int, str]:
+        return {
+            subevent_code: subevent_name
+            for (subevent_name, subevent_code) in symbols.items()
+            if subevent_name.startswith('HCI_') and subevent_name.endswith('_EVENT')
+        }
+
+    @classmethod
+    def register_subevents(cls, symbols: Dict[str, Any]) -> None:
+        cls.subevent_names.update(cls.subevent_map(symbols))
+
    @classmethod
    def from_parameters(cls, parameters):
        self = cls.__new__(cls)
-        HCI_LE_Meta_Event.__init__(self, self.subevent_code, parameters)
+        HCI_Extended_Event.__init__(self, self.subevent_code, parameters)
        if fields := getattr(self, 'fields', None):
            HCI_Object.init_from_bytes(self, parameters, 1, fields)
        return self

-    @staticmethod
-    def subevent_name(subevent_code):
-        return name_or_number(HCI_SUBEVENT_NAMES, subevent_code)
-
    def __init__(self, subevent_code, parameters, **kwargs):
        self.subevent_code = subevent_code
        if parameters is None and (fields := getattr(self, 'fields', None)) and kwargs:
            parameters = bytes([subevent_code]) + HCI_Object.dict_to_bytes(
                kwargs, fields
            )
-        super().__init__(HCI_LE_META_EVENT, parameters, **kwargs)
+        super().__init__(self.event_code, parameters, **kwargs)

        # Override the name in order to adopt the subevent name instead
        self.name = self.subevent_name(subevent_code)

-    def __str__(self):
-        result = color(self.subevent_name(self.subevent_code), 'magenta')
-        if fields := getattr(self, 'fields', None):
-            result += ':\n' + HCI_Object.format_fields(self.__dict__, fields, '  ')
-        else:
-            if self.parameters:
-                result += f': {self.parameters.hex()}'
-        return result
+
+# -----------------------------------------------------------------------------
+class HCI_LE_Meta_Event(HCI_Extended_Event):
+    '''
+    See Bluetooth spec @ 7.7.65 LE Meta Event
+    '''
+
+    event_code: int = HCI_LE_META_EVENT
+    subevent_classes = {}
+
+    @staticmethod
+    def subevent_map(symbols: Dict[str, Any]) -> Dict[int, str]:
+        return {
+            subevent_code: subevent_name
+            for (subevent_name, subevent_code) in symbols.items()
+            if subevent_name.startswith('HCI_LE_') and subevent_name.endswith('_EVENT')
+        }
+
+
+HCI_LE_Meta_Event.register_subevents(globals())
+
+
+# -----------------------------------------------------------------------------
+class HCI_Vendor_Event(HCI_Extended_Event):
+    event_code: int = HCI_VENDOR_EVENT
+    subevent_classes = {}


 # -----------------------------------------------------------------------------
@@ -4591,7 +4673,7 @@ class HCI_LE_Advertising_Report_Event(HCI_LE_Meta_Event):
        return f'{color(self.subevent_name(self.subevent_code), "magenta")}:\n{reports}'


-HCI_Event.meta_event_classes[
+HCI_LE_Meta_Event.subevent_classes[
    HCI_LE_ADVERTISING_REPORT_EVENT
 ] = HCI_LE_Advertising_Report_Event

@@ -4845,7 +4927,7 @@ class HCI_LE_Extended_Advertising_Report_Event(HCI_LE_Meta_Event):
        return f'{color(self.subevent_name(self.subevent_code), "magenta")}:\n{reports}'


-HCI_Event.meta_event_classes[
+HCI_LE_Meta_Event.subevent_classes[
    HCI_LE_EXTENDED_ADVERTISING_REPORT_EVENT
 ] = HCI_LE_Extended_Advertising_Report_Event

@@ -5086,6 +5168,7 @@ class HCI_Command_Complete_Event(HCI_Event):
    '''

    return_parameters = b''
+    command_opcode: int

    def map_return_parameters(self, return_parameters):
        '''Map simple 'status' return parameters to their named constant form'''
@@ -5118,11 +5201,11 @@ class HCI_Command_Complete_Event(HCI_Event):
            self.return_parameters = self.return_parameters[0]
        else:
            cls = HCI_Command.command_classes.get(self.command_opcode)
-            if cls and cls.return_parameters_fields:
-                self.return_parameters = HCI_Object.from_bytes(
-                    self.return_parameters, 0, cls.return_parameters_fields
-                )
-                self.return_parameters.fields = cls.return_parameters_fields
+            if cls:
+                # Try to parse the return parameters bytes into an object.
+                return_parameters = cls.parse_return_parameters(self.return_parameters)
+                if return_parameters is not None:
+                    self.return_parameters = return_parameters

        return self

@@ -5605,7 +5688,7 @@ class HCI_Remote_Host_Supported_Features_Notification_Event(HCI_Event):


 # -----------------------------------------------------------------------------
-class HCI_AclDataPacket:
+class HCI_AclDataPacket(HCI_Packet):
    '''
    See Bluetooth spec @ 5.4.2 HCI ACL Data Packets
    '''
@@ -5613,7 +5696,7 @@ class HCI_AclDataPacket:
    hci_packet_type = HCI_ACL_DATA_PACKET

    @staticmethod
-    def from_bytes(packet):
+    def from_bytes(packet: bytes) -> HCI_AclDataPacket:
        # Read the header
        h, data_total_length = struct.unpack_from('<HH', packet, 1)
        connection_handle = h & 0xFFF
@@ -5655,12 +5738,14 @@ class HCI_AclDataPacket:

 # -----------------------------------------------------------------------------
 class HCI_AclDataPacketAssembler:
-    def __init__(self, callback):
+    current_data: Optional[bytes]
+
+    def __init__(self, callback: Callable[[bytes], Any]) -> None:
        self.callback = callback
        self.current_data = None
        self.l2cap_pdu_length = 0

-    def feed_packet(self, packet):
+    def feed_packet(self, packet: HCI_AclDataPacket) -> None:
        if packet.pb_flag in (
            HCI_ACL_PB_FIRST_NON_FLUSHABLE,
            HCI_ACL_PB_FIRST_FLUSHABLE,
@@ -5674,6 +5759,7 @@ class HCI_AclDataPacketAssembler:
                return
            self.current_data += packet.data

+        assert self.current_data is not None
        if len(self.current_data) == self.l2cap_pdu_length + 4:
            # The packet is complete, invoke the callback
            logger.debug(f'<<< ACL PDU: {self.current_data.hex()}')
--- a/bumble/hfp.py
+++ b/bumble/hfp.py
@@ -15,16 +15,19 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+import collections.abc
 import logging
 import asyncio
 import dataclasses
 import enum
 import traceback
-from typing import Dict, List, Union, Set
+import warnings
+from typing import Dict, List, Union, Set, TYPE_CHECKING

 from . import at
 from . import rfcomm

+from bumble.colors import color
 from bumble.core import (
    ProtocolError,
    BT_GENERIC_AUDIO_SERVICE,
@@ -48,6 +51,71 @@ from bumble.sdp import (
 # -----------------------------------------------------------------------------
 logger = logging.getLogger(__name__)

+# -----------------------------------------------------------------------------
+# Error
+# -----------------------------------------------------------------------------
+
+
+class HfpProtocolError(ProtocolError):
+    def __init__(self, error_name: str = '', details: str = ''):
+        super().__init__(None, 'hfp', error_name, details)
+
+
+# -----------------------------------------------------------------------------
+# Protocol Support
+# -----------------------------------------------------------------------------
+
+# -----------------------------------------------------------------------------
+class HfpProtocol:
+    dlc: rfcomm.DLC
+    buffer: str
+    lines: collections.deque
+    lines_available: asyncio.Event
+
+    def __init__(self, dlc: rfcomm.DLC) -> None:
+        warnings.warn("See HfProtocol", DeprecationWarning)
+        self.dlc = dlc
+        self.buffer = ''
+        self.lines = collections.deque()
+        self.lines_available = asyncio.Event()
+
+        dlc.sink = self.feed
+
+    def feed(self, data: Union[bytes, str]) -> None:
+        # Convert the data to a string if needed
+        if isinstance(data, bytes):
+            data = data.decode('utf-8')
+
+        logger.debug(f'<<< Data received: {data}')
+
+        # Add to the buffer and look for lines
+        self.buffer += data
+        while (separator := self.buffer.find('\r')) >= 0:
+            line = self.buffer[:separator].strip()
+            self.buffer = self.buffer[separator + 1 :]
+            if len(line) > 0:
+                self.on_line(line)
+
+    def on_line(self, line: str) -> None:
+        self.lines.append(line)
+        self.lines_available.set()
+
+    def send_command_line(self, line: str) -> None:
+        logger.debug(color(f'>>> {line}', 'yellow'))
+        self.dlc.write(line + '\r')
+
+    def send_response_line(self, line: str) -> None:
+        logger.debug(color(f'>>> {line}', 'yellow'))
+        self.dlc.write('\r\n' + line + '\r\n')
+
+    async def next_line(self) -> str:
+        await self.lines_available.wait()
+        line = self.lines.popleft()
+        if not self.lines:
+            self.lines_available.clear()
+        logger.debug(color(f'<<< {line}', 'green'))
+        return line
+

 # -----------------------------------------------------------------------------
 # Normative protocol definitions
@@ -302,8 +370,12 @@ class HfProtocol:

    dlc: rfcomm.DLC
    command_lock: asyncio.Lock
-    response_queue: asyncio.Queue
-    unsolicited_queue: asyncio.Queue
+    if TYPE_CHECKING:
+        response_queue: asyncio.Queue[AtResponse]
+        unsolicited_queue: asyncio.Queue[AtResponse]
+    else:
+        response_queue: asyncio.Queue
+        unsolicited_queue: asyncio.Queue
    read_buffer: bytearray

    def __init__(self, dlc: rfcomm.DLC, configuration: Configuration):
@@ -368,7 +440,7 @@ class HfProtocol:
        else:
            logger.warning(f"dropping unexpected response with code '{response.code}'")

-    # Send an AT command and wait for the peer resposne.
+    # Send an AT command and wait for the peer response.
    # Wait for the AT responses sent by the peer, to the status code.
    # Raises asyncio.TimeoutError if the status is not received
    # after a timeout (default 1 second).
@@ -390,7 +462,7 @@ class HfProtocol:
                )
                if result.code == 'OK':
                    if response_type == AtResponseType.SINGLE and len(responses) != 1:
-                        raise ProtocolError("NO ANSWER")
+                        raise HfpProtocolError("NO ANSWER")

                    if response_type == AtResponseType.MULTIPLE:
                        return responses
@@ -398,7 +470,7 @@ class HfProtocol:
                        return responses[0]
                    return None
                if result.code in STATUS_CODES:
-                    raise ProtocolError(result.code)
+                    raise HfpProtocolError(result.code)
                responses.append(result)

    # 4.2.1 Service Level Connection Initialization.
--- a/bumble/host.py
+++ b/bumble/host.py
@@ -15,12 +15,13 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+from __future__ import annotations
 import asyncio
 import collections
 import logging
 import struct

-from typing import Optional
+from typing import Optional, TYPE_CHECKING, Dict, Callable, Awaitable

 from bumble.colors import color
 from bumble.l2cap import L2CAP_PDU
@@ -30,8 +31,8 @@ from bumble import drivers
 from .hci import (
    Address,
    HCI_ACL_DATA_PACKET,
-    HCI_COMMAND_COMPLETE_EVENT,
    HCI_COMMAND_PACKET,
+    HCI_COMMAND_COMPLETE_EVENT,
    HCI_EVENT_PACKET,
    HCI_LE_READ_BUFFER_SIZE_COMMAND,
    HCI_LE_READ_LOCAL_SUPPORTED_FEATURES_COMMAND,
@@ -45,8 +46,11 @@ from .hci import (
    HCI_VERSION_BLUETOOTH_CORE_4_0,
    HCI_AclDataPacket,
    HCI_AclDataPacketAssembler,
+    HCI_Command,
+    HCI_Command_Complete_Event,
    HCI_Constant,
    HCI_Error,
+    HCI_Event,
    HCI_LE_Long_Term_Key_Request_Negative_Reply_Command,
    HCI_LE_Long_Term_Key_Request_Reply_Command,
    HCI_LE_Read_Buffer_Size_Command,
@@ -69,10 +73,14 @@ from .core import (
    BT_LE_TRANSPORT,
    ConnectionPHY,
    ConnectionParameters,
+    InvalidStateError,
 )
 from .utils import AbortableEventEmitter
 from .transport.common import TransportLostError

+if TYPE_CHECKING:
+    from .transport.common import TransportSink, TransportSource
+

 # -----------------------------------------------------------------------------
 # Logging
@@ -95,27 +103,38 @@ HOST_HC_TOTAL_NUM_ACL_DATA_PACKETS        = 1

 # -----------------------------------------------------------------------------
 class Connection:
-    def __init__(self, host, handle, peer_address, transport):
+    def __init__(self, host: Host, handle: int, peer_address: Address, transport: int):
        self.host = host
        self.handle = handle
        self.peer_address = peer_address
        self.assembler = HCI_AclDataPacketAssembler(self.on_acl_pdu)
        self.transport = transport

-    def on_hci_acl_data_packet(self, packet):
+    def on_hci_acl_data_packet(self, packet: HCI_AclDataPacket) -> None:
        self.assembler.feed_packet(packet)

-    def on_acl_pdu(self, pdu):
+    def on_acl_pdu(self, pdu: bytes) -> None:
        l2cap_pdu = L2CAP_PDU.from_bytes(pdu)
        self.host.on_l2cap_pdu(self, l2cap_pdu.cid, l2cap_pdu.payload)


 # -----------------------------------------------------------------------------
 class Host(AbortableEventEmitter):
-    def __init__(self, controller_source=None, controller_sink=None):
+    connections: Dict[int, Connection]
+    acl_packet_queue: collections.deque[HCI_AclDataPacket]
+    hci_sink: TransportSink
+    long_term_key_provider: Optional[
+        Callable[[int, bytes, int], Awaitable[Optional[bytes]]]
+    ]
+    link_key_provider: Optional[Callable[[Address], Awaitable[Optional[bytes]]]]
+
+    def __init__(
+        self,
+        controller_source: Optional[TransportSource] = None,
+        controller_sink: Optional[TransportSink] = None,
+    ) -> None:
        super().__init__()

-        self.hci_sink = None
        self.hci_metadata = None
        self.ready = False  # True when we can accept incoming packets
        self.reset_done = False
@@ -295,7 +314,7 @@ class Host(AbortableEventEmitter):
        self.reset_done = True

    @property
-    def controller(self):
+    def controller(self) -> TransportSink:
        return self.hci_sink

    @controller.setter
@@ -304,13 +323,12 @@ class Host(AbortableEventEmitter):
        if controller:
            controller.set_packet_sink(self)

-    def set_packet_sink(self, sink):
+    def set_packet_sink(self, sink: TransportSink) -> None:
        self.hci_sink = sink

-    def send_hci_packet(self, packet):
+    def send_hci_packet(self, packet: HCI_Packet) -> None:
        if self.snooper:
            self.snooper.snoop(bytes(packet), Snooper.Direction.HOST_TO_CONTROLLER)
-
        self.hci_sink.on_packet(bytes(packet))

    async def send_command(self, command, check_result=False):
@@ -356,13 +374,13 @@ class Host(AbortableEventEmitter):
                self.pending_response = None

    # Use this method to send a command from a task
-    def send_command_sync(self, command):
-        async def send_command(command):
+    def send_command_sync(self, command: HCI_Command) -> None:
+        async def send_command(command: HCI_Command) -> None:
            await self.send_command(command)

        asyncio.create_task(send_command(command))

-    def send_l2cap_pdu(self, connection_handle, cid, pdu):
+    def send_l2cap_pdu(self, connection_handle: int, cid: int, pdu: bytes) -> None:
        l2cap_pdu = bytes(L2CAP_PDU(cid, pdu))

        # Send the data to the controller via ACL packets
@@ -387,7 +405,7 @@ class Host(AbortableEventEmitter):
            offset += data_total_length
            bytes_remaining -= data_total_length

-    def queue_acl_packet(self, acl_packet):
+    def queue_acl_packet(self, acl_packet: HCI_AclDataPacket) -> None:
        self.acl_packet_queue.appendleft(acl_packet)
        self.check_acl_packet_queue()

@@ -397,7 +415,7 @@ class Host(AbortableEventEmitter):
                f'{len(self.acl_packet_queue)} in queue'
            )

-    def check_acl_packet_queue(self):
+    def check_acl_packet_queue(self) -> None:
        # Send all we can (TODO: support different LE/Classic limits)
        while (
            len(self.acl_packet_queue) > 0
@@ -443,11 +461,10 @@ class Host(AbortableEventEmitter):
        ]

    # Packet Sink protocol (packets coming from the controller via HCI)
-    def on_packet(self, packet):
+    def on_packet(self, packet: bytes) -> None:
        hci_packet = HCI_Packet.from_bytes(packet)
        if self.ready or (
-            hci_packet.hci_packet_type == HCI_EVENT_PACKET
-            and hci_packet.event_code == HCI_COMMAND_COMPLETE_EVENT
+            isinstance(hci_packet, HCI_Command_Complete_Event)
            and hci_packet.command_opcode == HCI_RESET_COMMAND
        ):
            self.on_hci_packet(hci_packet)
@@ -461,36 +478,36 @@ class Host(AbortableEventEmitter):

        self.emit('flush')

-    def on_hci_packet(self, packet):
+    def on_hci_packet(self, packet: HCI_Packet) -> None:
        logger.debug(f'{color("### CONTROLLER -> HOST", "green")}: {packet}')

        if self.snooper:
            self.snooper.snoop(bytes(packet), Snooper.Direction.CONTROLLER_TO_HOST)

        # If the packet is a command, invoke the handler for this packet
-        if packet.hci_packet_type == HCI_COMMAND_PACKET:
+        if isinstance(packet, HCI_Command):
            self.on_hci_command_packet(packet)
-        elif packet.hci_packet_type == HCI_EVENT_PACKET:
+        elif isinstance(packet, HCI_Event):
            self.on_hci_event_packet(packet)
-        elif packet.hci_packet_type == HCI_ACL_DATA_PACKET:
+        elif isinstance(packet, HCI_AclDataPacket):
            self.on_hci_acl_data_packet(packet)
        else:
            logger.warning(f'!!! unknown packet type {packet.hci_packet_type}')

-    def on_hci_command_packet(self, command):
+    def on_hci_command_packet(self, command: HCI_Command) -> None:
        logger.warning(f'!!! unexpected command packet: {command}')

-    def on_hci_event_packet(self, event):
+    def on_hci_event_packet(self, event: HCI_Event) -> None:
        handler_name = f'on_{event.name.lower()}'
        handler = getattr(self, handler_name, self.on_hci_event)
        handler(event)

-    def on_hci_acl_data_packet(self, packet):
+    def on_hci_acl_data_packet(self, packet: HCI_AclDataPacket) -> None:
        # Look for the connection to which this data belongs
        if connection := self.connections.get(packet.connection_handle):
            connection.on_hci_acl_data_packet(packet)

-    def on_l2cap_pdu(self, connection, cid, pdu):
+    def on_l2cap_pdu(self, connection: Connection, cid: int, pdu: bytes) -> None:
        self.emit('l2cap_pdu', connection.handle, cid, pdu)

    def on_command_processed(self, event):
@@ -828,6 +845,10 @@ class Host(AbortableEventEmitter):
            f'simple pairing complete for {event.bd_addr}: '
            f'status={HCI_Constant.status_name(event.status)}'
        )
+        if event.status == HCI_SUCCESS:
+            self.emit('classic_pairing', event.bd_addr)
+        else:
+            self.emit('classic_pairing_failure', event.bd_addr, event.status)

    def on_hci_pin_code_request_event(self, event):
        self.emit('pin_code_request', event.bd_addr)
--- a/bumble/l2cap.py
+++ b/bumble/l2cap.py
@@ -33,6 +33,7 @@ from typing import (
    Union,
    Deque,
    Iterable,
+    SupportsBytes,
    TYPE_CHECKING,
 )

@@ -47,6 +48,7 @@ from .hci import (

 if TYPE_CHECKING:
    from bumble.device import Connection
+    from bumble.host import Host

 # -----------------------------------------------------------------------------
 # Logging
@@ -728,7 +730,7 @@ class Channel(EventEmitter):

    def __init__(
        self,
-        manager: 'ChannelManager',
+        manager: ChannelManager,
        connection: Connection,
        signaling_cid: int,
        psm: int,
@@ -755,13 +757,13 @@ class Channel(EventEmitter):
        )
        self.state = new_state

-    def send_pdu(self, pdu) -> None:
+    def send_pdu(self, pdu: SupportsBytes | bytes) -> None:
        self.manager.send_pdu(self.connection, self.destination_cid, pdu)

-    def send_control_frame(self, frame) -> None:
+    def send_control_frame(self, frame: L2CAP_Control_Frame) -> None:
        self.manager.send_control_frame(self.connection, self.signaling_cid, frame)

-    async def send_request(self, request) -> bytes:
+    async def send_request(self, request: SupportsBytes) -> bytes:
        # Check that there isn't already a request pending
        if self.response:
            raise InvalidStateError('request already pending')
@@ -772,7 +774,7 @@ class Channel(EventEmitter):
        self.send_pdu(request)
        return await self.response

-    def on_pdu(self, pdu) -> None:
+    def on_pdu(self, pdu: bytes) -> None:
        if self.response:
            self.response.set_result(pdu)
            self.response = None
@@ -1041,7 +1043,7 @@ class LeConnectionOrientedChannel(EventEmitter):

    def __init__(
        self,
-        manager: 'ChannelManager',
+        manager: ChannelManager,
        connection: Connection,
        le_psm: int,
        source_cid: int,
@@ -1096,10 +1098,10 @@ class LeConnectionOrientedChannel(EventEmitter):
        elif new_state == self.DISCONNECTED:
            self.emit('close')

-    def send_pdu(self, pdu) -> None:
+    def send_pdu(self, pdu: SupportsBytes | bytes) -> None:
        self.manager.send_pdu(self.connection, self.destination_cid, pdu)

-    def send_control_frame(self, frame) -> None:
+    def send_control_frame(self, frame: L2CAP_Control_Frame) -> None:
        self.manager.send_control_frame(self.connection, L2CAP_LE_SIGNALING_CID, frame)

    async def connect(self) -> LeConnectionOrientedChannel:
@@ -1154,7 +1156,7 @@ class LeConnectionOrientedChannel(EventEmitter):
        if self.state == self.CONNECTED:
            self.change_state(self.DISCONNECTED)

-    def on_pdu(self, pdu) -> None:
+    def on_pdu(self, pdu: bytes) -> None:
        if self.sink is None:
            logger.warning('received pdu without a sink')
            return
@@ -1384,6 +1386,7 @@ class ChannelManager:
    ]
    le_coc_requests: Dict[int, L2CAP_LE_Credit_Based_Connection_Request]
    fixed_channels: Dict[int, Optional[Callable[[int, bytes], Any]]]
+    _host: Optional[Host]

    def __init__(
        self,
@@ -1407,11 +1410,12 @@ class ChannelManager:
        self.connectionless_mtu = connectionless_mtu

    @property
-    def host(self):
+    def host(self) -> Host:
+        assert self._host
        return self._host

    @host.setter
-    def host(self, host):
+    def host(self, host: Host) -> None:
        if self._host is not None:
            self._host.remove_listener('disconnection', self.on_disconnection)
        self._host = host
@@ -1565,7 +1569,7 @@ class ChannelManager:
        if connection_handle in self.identifiers:
            del self.identifiers[connection_handle]

-    def send_pdu(self, connection, cid: int, pdu) -> None:
+    def send_pdu(self, connection, cid: int, pdu: SupportsBytes | bytes) -> None:
        pdu_str = pdu.hex() if isinstance(pdu, bytes) else str(pdu)
        logger.debug(
            f'{color(">>> Sending L2CAP PDU", "blue")} '
@@ -1574,7 +1578,7 @@ class ChannelManager:
        )
        self.host.send_l2cap_pdu(connection.handle, cid, bytes(pdu))

-    def on_pdu(self, connection: Connection, cid: int, pdu) -> None:
+    def on_pdu(self, connection: Connection, cid: int, pdu: bytes) -> None:
        if cid in (L2CAP_SIGNALING_CID, L2CAP_LE_SIGNALING_CID):
            # Parse the L2CAP payload into a Control Frame object
            control_frame = L2CAP_Control_Frame.from_bytes(pdu)
@@ -1596,7 +1600,7 @@ class ChannelManager:
            channel.on_pdu(pdu)

    def send_control_frame(
-        self, connection: Connection, cid: int, control_frame
+        self, connection: Connection, cid: int, control_frame: L2CAP_Control_Frame
    ) -> None:
        logger.debug(
            f'{color(">>> Sending L2CAP Signaling Control Frame", "blue")} '
@@ -1605,7 +1609,9 @@ class ChannelManager:
        )
        self.host.send_l2cap_pdu(connection.handle, cid, bytes(control_frame))

-    def on_control_frame(self, connection: Connection, cid: int, control_frame) -> None:
+    def on_control_frame(
+        self, connection: Connection, cid: int, control_frame: L2CAP_Control_Frame
+    ) -> None:
        logger.debug(
            f'{color("<<< Received L2CAP Signaling Control Frame", "green")} '
            f'on connection [0x{connection.handle:04X}] (CID={cid}) '
@@ -2072,7 +2078,8 @@ class ChannelManager:
        # Connect
        try:
            await channel.connect()
-        except Exception:
+        except Exception as e:
            del connection_channels[source_cid]
+            raise e

        return channel
--- a/bumble/pandora/security.py
+++ b/bumble/pandora/security.py
@@ -423,6 +423,8 @@ class SecurityService(SecurityServicer):
            'pairing': try_set_success,
            'connection_authentication': try_set_success,
            'connection_encryption_change': on_encryption_change,
+            'classic_pairing': try_set_success,
+            'classic_pairing_failure': set_failure('pairing_failure'),
        }

        # register event handlers
--- a/bumble/rfcomm.py
+++ b/bumble/rfcomm.py
@@ -15,15 +15,37 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+from __future__ import annotations
+
 import logging
 import asyncio
+import enum
+from typing import Callable, Dict, List, Optional, Tuple, Union, TYPE_CHECKING

 from pyee import EventEmitter
-from typing import Optional, Tuple, Callable, Dict, Union

 from . import core, l2cap
 from .colors import color
-from .core import BT_BR_EDR_TRANSPORT, InvalidStateError, ProtocolError
+from .core import (
+    UUID,
+    BT_RFCOMM_PROTOCOL_ID,
+    BT_BR_EDR_TRANSPORT,
+    BT_L2CAP_PROTOCOL_ID,
+    InvalidStateError,
+    ProtocolError,
+)
+from .sdp import (
+    SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
+    SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
+    SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
+    SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
+    SDP_PUBLIC_BROWSE_ROOT,
+    DataElement,
+    ServiceAttribute,
+)
+
+if TYPE_CHECKING:
+    from bumble.device import Device, Connection

 # -----------------------------------------------------------------------------
 # Logging
@@ -105,6 +127,50 @@ RFCOMM_DYNAMIC_CHANNEL_NUMBER_END   = 30
 # fmt: on


+# -----------------------------------------------------------------------------
+def make_service_sdp_records(
+    service_record_handle: int, channel: int, uuid: Optional[UUID] = None
+) -> List[ServiceAttribute]:
+    """
+    Create SDP records for an RFComm service given a channel number and an
+    optional UUID. A Service Class Attribute is included only if the UUID is not None.
+    """
+    records = [
+        ServiceAttribute(
+            SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
+            DataElement.unsigned_integer_32(service_record_handle),
+        ),
+        ServiceAttribute(
+            SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
+            DataElement.sequence([DataElement.uuid(SDP_PUBLIC_BROWSE_ROOT)]),
+        ),
+        ServiceAttribute(
+            SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
+            DataElement.sequence(
+                [
+                    DataElement.sequence([DataElement.uuid(BT_L2CAP_PROTOCOL_ID)]),
+                    DataElement.sequence(
+                        [
+                            DataElement.uuid(BT_RFCOMM_PROTOCOL_ID),
+                            DataElement.unsigned_integer_8(channel),
+                        ]
+                    ),
+                ]
+            ),
+        ),
+    ]
+
+    if uuid:
+        records.append(
+            ServiceAttribute(
+                SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
+                DataElement.sequence([DataElement.uuid(uuid)]),
+            )
+        )
+
+    return records
+
+
 # -----------------------------------------------------------------------------
 def compute_fcs(buffer: bytes) -> int:
    result = 0xFF
@@ -149,9 +215,9 @@ class RFCOMM_Frame:
        return RFCOMM_FRAME_TYPE_NAMES[self.type]

    @staticmethod
-    def parse_mcc(data) -> Tuple[int, int, bytes]:
+    def parse_mcc(data) -> Tuple[int, bool, bytes]:
        mcc_type = data[0] >> 2
-        c_r = (data[0] >> 1) & 1
+        c_r = bool((data[0] >> 1) & 1)
        length = data[1]
        if data[1] & 1:
            length >>= 1
@@ -192,7 +258,7 @@ class RFCOMM_Frame:
        )

    @staticmethod
-    def from_bytes(data: bytes):
+    def from_bytes(data: bytes) -> RFCOMM_Frame:
        # Extract fields
        dlci = (data[0] >> 2) & 0x3F
        c_r = (data[0] >> 1) & 0x01
@@ -215,7 +281,7 @@ class RFCOMM_Frame:

        return frame

-    def __bytes__(self):
+    def __bytes__(self) -> bytes:
        return (
            bytes([self.address, self.control])
            + self.length
@@ -223,7 +289,7 @@ class RFCOMM_Frame:
            + bytes([self.fcs])
        )

-    def __str__(self):
+    def __str__(self) -> str:
        return (
            f'{color(self.type_name(), "yellow")}'
            f'(c/r={self.c_r},'
@@ -253,7 +319,7 @@ class RFCOMM_MCC_PN:
        max_frame_size: int,
        max_retransmissions: int,
        window_size: int,
-    ):
+    ) -> None:
        self.dlci = dlci
        self.cl = cl
        self.priority = priority
@@ -263,7 +329,7 @@ class RFCOMM_MCC_PN:
        self.window_size = window_size

    @staticmethod
-    def from_bytes(data: bytes):
+    def from_bytes(data: bytes) -> RFCOMM_MCC_PN:
        return RFCOMM_MCC_PN(
            dlci=data[0],
            cl=data[1],
@@ -274,7 +340,7 @@ class RFCOMM_MCC_PN:
            window_size=data[7],
        )

-    def __bytes__(self):
+    def __bytes__(self) -> bytes:
        return bytes(
            [
                self.dlci & 0xFF,
@@ -288,7 +354,7 @@ class RFCOMM_MCC_PN:
            ]
        )

-    def __str__(self):
+    def __str__(self) -> str:
        return (
            f'PN(dlci={self.dlci},'
            f'cl={self.cl},'
@@ -309,7 +375,9 @@ class RFCOMM_MCC_MSC:
    ic: int
    dv: int

-    def __init__(self, dlci: int, fc: int, rtc: int, rtr: int, ic: int, dv: int):
+    def __init__(
+        self, dlci: int, fc: int, rtc: int, rtr: int, ic: int, dv: int
+    ) -> None:
        self.dlci = dlci
        self.fc = fc
        self.rtc = rtc
@@ -318,7 +386,7 @@ class RFCOMM_MCC_MSC:
        self.dv = dv

    @staticmethod
-    def from_bytes(data: bytes):
+    def from_bytes(data: bytes) -> RFCOMM_MCC_MSC:
        return RFCOMM_MCC_MSC(
            dlci=data[0] >> 2,
            fc=data[1] >> 1 & 1,
@@ -328,7 +396,7 @@ class RFCOMM_MCC_MSC:
            dv=data[1] >> 7 & 1,
        )

-    def __bytes__(self):
+    def __bytes__(self) -> bytes:
        return bytes(
            [
                (self.dlci << 2) | 3,
@@ -341,7 +409,7 @@ class RFCOMM_MCC_MSC:
            ]
        )

-    def __str__(self):
+    def __str__(self) -> str:
        return (
            f'MSC(dlci={self.dlci},'
            f'fc={self.fc},'
@@ -354,29 +422,24 @@ class RFCOMM_MCC_MSC:

 # -----------------------------------------------------------------------------
 class DLC(EventEmitter):
-    # States
-    INIT = 0x00
-    CONNECTING = 0x01
-    CONNECTED = 0x02
-    DISCONNECTING = 0x03
-    DISCONNECTED = 0x04
-    RESET = 0x05
-
-    STATE_NAMES = {
-        INIT: 'INIT',
-        CONNECTING: 'CONNECTING',
-        CONNECTED: 'CONNECTED',
-        DISCONNECTING: 'DISCONNECTING',
-        DISCONNECTED: 'DISCONNECTED',
-        RESET: 'RESET',
-    }
+    class State(enum.IntEnum):
+        INIT = 0x00
+        CONNECTING = 0x01
+        CONNECTED = 0x02
+        DISCONNECTING = 0x03
+        DISCONNECTED = 0x04
+        RESET = 0x05

    connection_result: Optional[asyncio.Future]
    sink: Optional[Callable[[bytes], None]]

    def __init__(
-        self, multiplexer, dlci: int, max_frame_size: int, initial_tx_credits: int
-    ):
+        self,
+        multiplexer: Multiplexer,
+        dlci: int,
+        max_frame_size: int,
+        initial_tx_credits: int,
+    ) -> None:
        super().__init__()
        self.multiplexer = multiplexer
        self.dlci = dlci
@@ -384,9 +447,9 @@ class DLC(EventEmitter):
        self.rx_threshold = self.rx_credits // 2
        self.tx_credits = initial_tx_credits
        self.tx_buffer = b''
-        self.state = DLC.INIT
+        self.state = DLC.State.INIT
        self.role = multiplexer.role
-        self.c_r = 1 if self.role == Multiplexer.INITIATOR else 0
+        self.c_r = 1 if self.role == Multiplexer.Role.INITIATOR else 0
        self.sink = None
        self.connection_result = None

@@ -396,14 +459,8 @@ class DLC(EventEmitter):
            max_frame_size, self.multiplexer.l2cap_channel.mtu - max_overhead
        )

-    @staticmethod
-    def state_name(state: int) -> str:
-        return DLC.STATE_NAMES[state]
-
-    def change_state(self, new_state: int) -> None:
-        logger.debug(
-            f'{self} state change -> {color(self.state_name(new_state), "magenta")}'
-        )
+    def change_state(self, new_state: State) -> None:
+        logger.debug(f'{self} state change -> {color(new_state.name, "magenta")}')
        self.state = new_state

    def send_frame(self, frame: RFCOMM_Frame) -> None:
@@ -413,8 +470,8 @@ class DLC(EventEmitter):
        handler = getattr(self, f'on_{frame.type_name()}_frame'.lower())
        handler(frame)

-    def on_sabm_frame(self, _frame) -> None:
-        if self.state != DLC.CONNECTING:
+    def on_sabm_frame(self, _frame: RFCOMM_Frame) -> None:
+        if self.state != DLC.State.CONNECTING:
            logger.warning(
                color('!!! received SABM when not in CONNECTING state', 'red')
            )
@@ -430,11 +487,11 @@ class DLC(EventEmitter):
        logger.debug(f'>>> MCC MSC Command: {msc}')
        self.send_frame(RFCOMM_Frame.uih(c_r=self.c_r, dlci=0, information=mcc))

-        self.change_state(DLC.CONNECTED)
+        self.change_state(DLC.State.CONNECTED)
        self.emit('open')

-    def on_ua_frame(self, _frame) -> None:
-        if self.state != DLC.CONNECTING:
+    def on_ua_frame(self, _frame: RFCOMM_Frame) -> None:
+        if self.state != DLC.State.CONNECTING:
            logger.warning(
                color('!!! received SABM when not in CONNECTING state', 'red')
            )
@@ -448,14 +505,14 @@ class DLC(EventEmitter):
        logger.debug(f'>>> MCC MSC Command: {msc}')
        self.send_frame(RFCOMM_Frame.uih(c_r=self.c_r, dlci=0, information=mcc))

-        self.change_state(DLC.CONNECTED)
+        self.change_state(DLC.State.CONNECTED)
        self.multiplexer.on_dlc_open_complete(self)

-    def on_dm_frame(self, frame) -> None:
+    def on_dm_frame(self, frame: RFCOMM_Frame) -> None:
        # TODO: handle all states
        pass

-    def on_disc_frame(self, _frame) -> None:
+    def on_disc_frame(self, _frame: RFCOMM_Frame) -> None:
        # TODO: handle all states
        self.send_frame(RFCOMM_Frame.ua(c_r=1 - self.c_r, dlci=self.dlci))

@@ -489,10 +546,10 @@ class DLC(EventEmitter):
        # Check if there's anything to send (including credits)
        self.process_tx()

-    def on_ui_frame(self, frame) -> None:
+    def on_ui_frame(self, frame: RFCOMM_Frame) -> None:
        pass

-    def on_mcc_msc(self, c_r, msc) -> None:
+    def on_mcc_msc(self, c_r: bool, msc: RFCOMM_MCC_MSC) -> None:
        if c_r:
            # Command
            logger.debug(f'<<< MCC MSC Command: {msc}')
@@ -507,15 +564,15 @@ class DLC(EventEmitter):
            logger.debug(f'<<< MCC MSC Response: {msc}')

    def connect(self) -> None:
-        if self.state != DLC.INIT:
+        if self.state != DLC.State.INIT:
            raise InvalidStateError('invalid state')

-        self.change_state(DLC.CONNECTING)
+        self.change_state(DLC.State.CONNECTING)
        self.connection_result = asyncio.get_running_loop().create_future()
        self.send_frame(RFCOMM_Frame.sabm(c_r=self.c_r, dlci=self.dlci))

    def accept(self) -> None:
-        if self.state != DLC.INIT:
+        if self.state != DLC.State.INIT:
            raise InvalidStateError('invalid state')

        pn = RFCOMM_MCC_PN(
@@ -530,7 +587,7 @@ class DLC(EventEmitter):
        mcc = RFCOMM_Frame.make_mcc(mcc_type=RFCOMM_MCC_PN_TYPE, c_r=0, data=bytes(pn))
        logger.debug(f'>>> PN Response: {pn}')
        self.send_frame(RFCOMM_Frame.uih(c_r=self.c_r, dlci=0, information=mcc))
-        self.change_state(DLC.CONNECTING)
+        self.change_state(DLC.State.CONNECTING)

    def rx_credits_needed(self) -> int:
        if self.rx_credits <= self.rx_threshold:
@@ -592,34 +649,24 @@ class DLC(EventEmitter):
        # TODO
        pass

-    def __str__(self):
-        return f'DLC(dlci={self.dlci},state={self.state_name(self.state)})'
+    def __str__(self) -> str:
+        return f'DLC(dlci={self.dlci},state={self.state.name})'


 # -----------------------------------------------------------------------------
 class Multiplexer(EventEmitter):
-    # Roles
-    INITIATOR = 0x00
-    RESPONDER = 0x01
+    class Role(enum.IntEnum):
+        INITIATOR = 0x00
+        RESPONDER = 0x01

-    # States
-    INIT = 0x00
-    CONNECTING = 0x01
-    CONNECTED = 0x02
-    OPENING = 0x03
-    DISCONNECTING = 0x04
-    DISCONNECTED = 0x05
-    RESET = 0x06
-
-    STATE_NAMES = {
-        INIT: 'INIT',
-        CONNECTING: 'CONNECTING',
-        CONNECTED: 'CONNECTED',
-        OPENING: 'OPENING',
-        DISCONNECTING: 'DISCONNECTING',
-        DISCONNECTED: 'DISCONNECTED',
-        RESET: 'RESET',
-    }
+    class State(enum.IntEnum):
+        INIT = 0x00
+        CONNECTING = 0x01
+        CONNECTED = 0x02
+        OPENING = 0x03
+        DISCONNECTING = 0x04
+        DISCONNECTED = 0x05
+        RESET = 0x06

    connection_result: Optional[asyncio.Future]
    disconnection_result: Optional[asyncio.Future]
@@ -627,11 +674,11 @@ class Multiplexer(EventEmitter):
    acceptor: Optional[Callable[[int], bool]]
    dlcs: Dict[int, DLC]

-    def __init__(self, l2cap_channel: l2cap.Channel, role: int) -> None:
+    def __init__(self, l2cap_channel: l2cap.Channel, role: Role) -> None:
        super().__init__()
        self.role = role
        self.l2cap_channel = l2cap_channel
-        self.state = Multiplexer.INIT
+        self.state = Multiplexer.State.INIT
        self.dlcs = {}  # DLCs, by DLCI
        self.connection_result = None
        self.disconnection_result = None
@@ -641,14 +688,8 @@ class Multiplexer(EventEmitter):
        # Become a sink for the L2CAP channel
        l2cap_channel.sink = self.on_pdu

-    @staticmethod
-    def state_name(state: int):
-        return Multiplexer.STATE_NAMES[state]
-
-    def change_state(self, new_state: int) -> None:
-        logger.debug(
-            f'{self} state change -> {color(self.state_name(new_state), "cyan")}'
-        )
+    def change_state(self, new_state: State) -> None:
+        logger.debug(f'{self} state change -> {color(new_state.name, "cyan")}')
        self.state = new_state

    def send_frame(self, frame: RFCOMM_Frame) -> None:
@@ -679,28 +720,28 @@ class Multiplexer(EventEmitter):
        handler = getattr(self, f'on_{frame.type_name()}_frame'.lower())
        handler(frame)

-    def on_sabm_frame(self, _frame) -> None:
-        if self.state != Multiplexer.INIT:
+    def on_sabm_frame(self, _frame: RFCOMM_Frame) -> None:
+        if self.state != Multiplexer.State.INIT:
            logger.debug('not in INIT state, ignoring SABM')
            return
-        self.change_state(Multiplexer.CONNECTED)
+        self.change_state(Multiplexer.State.CONNECTED)
        self.send_frame(RFCOMM_Frame.ua(c_r=1, dlci=0))

-    def on_ua_frame(self, _frame) -> None:
-        if self.state == Multiplexer.CONNECTING:
-            self.change_state(Multiplexer.CONNECTED)
+    def on_ua_frame(self, _frame: RFCOMM_Frame) -> None:
+        if self.state == Multiplexer.State.CONNECTING:
+            self.change_state(Multiplexer.State.CONNECTED)
            if self.connection_result:
                self.connection_result.set_result(0)
                self.connection_result = None
-        elif self.state == Multiplexer.DISCONNECTING:
-            self.change_state(Multiplexer.DISCONNECTED)
+        elif self.state == Multiplexer.State.DISCONNECTING:
+            self.change_state(Multiplexer.State.DISCONNECTED)
            if self.disconnection_result:
                self.disconnection_result.set_result(None)
                self.disconnection_result = None

-    def on_dm_frame(self, _frame) -> None:
-        if self.state == Multiplexer.OPENING:
-            self.change_state(Multiplexer.CONNECTED)
+    def on_dm_frame(self, _frame: RFCOMM_Frame) -> None:
+        if self.state == Multiplexer.State.OPENING:
+            self.change_state(Multiplexer.State.CONNECTED)
            if self.open_result:
                self.open_result.set_exception(
                    core.ConnectionError(
@@ -713,10 +754,12 @@ class Multiplexer(EventEmitter):
        else:
            logger.warning(f'unexpected state for DM: {self}')

-    def on_disc_frame(self, _frame) -> None:
-        self.change_state(Multiplexer.DISCONNECTED)
+    def on_disc_frame(self, _frame: RFCOMM_Frame) -> None:
+        self.change_state(Multiplexer.State.DISCONNECTED)
        self.send_frame(
-            RFCOMM_Frame.ua(c_r=0 if self.role == Multiplexer.INITIATOR else 1, dlci=0)
+            RFCOMM_Frame.ua(
+                c_r=0 if self.role == Multiplexer.Role.INITIATOR else 1, dlci=0
+            )
        )

    def on_uih_frame(self, frame: RFCOMM_Frame) -> None:
@@ -729,11 +772,11 @@ class Multiplexer(EventEmitter):
            mcs = RFCOMM_MCC_MSC.from_bytes(value)
            self.on_mcc_msc(c_r, mcs)

-    def on_ui_frame(self, frame) -> None:
+    def on_ui_frame(self, frame: RFCOMM_Frame) -> None:
        pass

-    def on_mcc_pn(self, c_r, pn) -> None:
-        if c_r == 1:
+    def on_mcc_pn(self, c_r: bool, pn: RFCOMM_MCC_PN) -> None:
+        if c_r:
            # Command
            logger.debug(f'<<< PN Command: {pn}')

@@ -764,14 +807,14 @@ class Multiplexer(EventEmitter):
        else:
            # Response
            logger.debug(f'>>> PN Response: {pn}')
-            if self.state == Multiplexer.OPENING:
+            if self.state == Multiplexer.State.OPENING:
                dlc = DLC(self, pn.dlci, pn.max_frame_size, pn.window_size)
                self.dlcs[pn.dlci] = dlc
                dlc.connect()
            else:
                logger.warning('ignoring PN response')

-    def on_mcc_msc(self, c_r, msc) -> None:
+    def on_mcc_msc(self, c_r: bool, msc: RFCOMM_MCC_MSC) -> None:
        dlc = self.dlcs.get(msc.dlci)
        if dlc is None:
            logger.warning(f'no dlc for DLCI {msc.dlci}')
@@ -779,30 +822,30 @@ class Multiplexer(EventEmitter):
        dlc.on_mcc_msc(c_r, msc)

    async def connect(self) -> None:
-        if self.state != Multiplexer.INIT:
+        if self.state != Multiplexer.State.INIT:
            raise InvalidStateError('invalid state')

-        self.change_state(Multiplexer.CONNECTING)
+        self.change_state(Multiplexer.State.CONNECTING)
        self.connection_result = asyncio.get_running_loop().create_future()
        self.send_frame(RFCOMM_Frame.sabm(c_r=1, dlci=0))
        return await self.connection_result

    async def disconnect(self) -> None:
-        if self.state != Multiplexer.CONNECTED:
+        if self.state != Multiplexer.State.CONNECTED:
            return

        self.disconnection_result = asyncio.get_running_loop().create_future()
-        self.change_state(Multiplexer.DISCONNECTING)
+        self.change_state(Multiplexer.State.DISCONNECTING)
        self.send_frame(
            RFCOMM_Frame.disc(
-                c_r=1 if self.role == Multiplexer.INITIATOR else 0, dlci=0
+                c_r=1 if self.role == Multiplexer.Role.INITIATOR else 0, dlci=0
            )
        )
        await self.disconnection_result

    async def open_dlc(self, channel: int) -> DLC:
-        if self.state != Multiplexer.CONNECTED:
-            if self.state == Multiplexer.OPENING:
+        if self.state != Multiplexer.State.CONNECTED:
+            if self.state == Multiplexer.State.OPENING:
                raise InvalidStateError('open already in progress')

            raise InvalidStateError('not connected')
@@ -819,10 +862,10 @@ class Multiplexer(EventEmitter):
        mcc = RFCOMM_Frame.make_mcc(mcc_type=RFCOMM_MCC_PN_TYPE, c_r=1, data=bytes(pn))
        logger.debug(f'>>> Sending MCC: {pn}')
        self.open_result = asyncio.get_running_loop().create_future()
-        self.change_state(Multiplexer.OPENING)
+        self.change_state(Multiplexer.State.OPENING)
        self.send_frame(
            RFCOMM_Frame.uih(
-                c_r=1 if self.role == Multiplexer.INITIATOR else 0,
+                c_r=1 if self.role == Multiplexer.Role.INITIATOR else 0,
                dlci=0,
                information=mcc,
            )
@@ -831,14 +874,14 @@ class Multiplexer(EventEmitter):
        self.open_result = None
        return result

-    def on_dlc_open_complete(self, dlc: DLC):
+    def on_dlc_open_complete(self, dlc: DLC) -> None:
        logger.debug(f'DLC [{dlc.dlci}] open complete')
-        self.change_state(Multiplexer.CONNECTED)
+        self.change_state(Multiplexer.State.CONNECTED)
        if self.open_result:
            self.open_result.set_result(dlc)

-    def __str__(self):
-        return f'Multiplexer(state={self.state_name(self.state)})'
+    def __str__(self) -> str:
+        return f'Multiplexer(state={self.state.name})'


 # -----------------------------------------------------------------------------
@@ -846,7 +889,7 @@ class Client:
    multiplexer: Optional[Multiplexer]
    l2cap_channel: Optional[l2cap.Channel]

-    def __init__(self, device, connection) -> None:
+    def __init__(self, device: Device, connection: Connection) -> None:
        self.device = device
        self.connection = connection
        self.l2cap_channel = None
@@ -864,7 +907,7 @@ class Client:

        assert self.l2cap_channel is not None
        # Create a mutliplexer to manage DLCs with the server
-        self.multiplexer = Multiplexer(self.l2cap_channel, Multiplexer.INITIATOR)
+        self.multiplexer = Multiplexer(self.l2cap_channel, Multiplexer.Role.INITIATOR)

        # Connect the multiplexer
        await self.multiplexer.connect()
@@ -886,7 +929,7 @@ class Client:
 class Server(EventEmitter):
    acceptors: Dict[int, Callable[[DLC], None]]

-    def __init__(self, device) -> None:
+    def __init__(self, device: Device) -> None:
        super().__init__()
        self.device = device
        self.multiplexer = None
@@ -925,7 +968,7 @@ class Server(EventEmitter):
        logger.debug(f'$$$ L2CAP channel open: {l2cap_channel}')

        # Create a new multiplexer for the channel
-        multiplexer = Multiplexer(l2cap_channel, Multiplexer.RESPONDER)
+        multiplexer = Multiplexer(l2cap_channel, Multiplexer.Role.RESPONDER)
        multiplexer.acceptor = self.accept_dlc
        multiplexer.on('dlc', self.on_dlc)

--- a/bumble/sdp.py
+++ b/bumble/sdp.py
@@ -18,13 +18,16 @@
 from __future__ import annotations
 import logging
 import struct
-from typing import Dict, List, Type
+from typing import Dict, List, Type, Optional, Tuple, Union, NewType, TYPE_CHECKING

-from . import core
+from . import core, l2cap
 from .colors import color
 from .core import InvalidStateError
 from .hci import HCI_Object, name_or_number, key_with_value

+if TYPE_CHECKING:
+    from .device import Device, Connection
+
 # -----------------------------------------------------------------------------
 # Logging
 # -----------------------------------------------------------------------------
@@ -466,7 +469,7 @@ class ServiceAttribute:
        self.value = value

    @staticmethod
-    def list_from_data_elements(elements):
+    def list_from_data_elements(elements: List[DataElement]) -> List[ServiceAttribute]:
        attribute_list = []
        for i in range(0, len(elements) // 2):
            attribute_id, attribute_value = elements[2 * i : 2 * (i + 1)]
@@ -478,7 +481,9 @@ class ServiceAttribute:
        return attribute_list

    @staticmethod
-    def find_attribute_in_list(attribute_list, attribute_id):
+    def find_attribute_in_list(
+        attribute_list: List[ServiceAttribute], attribute_id: int
+    ) -> Optional[DataElement]:
        return next(
            (
                attribute.value
@@ -493,7 +498,7 @@ class ServiceAttribute:
        return name_or_number(SDP_ATTRIBUTE_ID_NAMES, id_code)

    @staticmethod
-    def is_uuid_in_value(uuid, value):
+    def is_uuid_in_value(uuid: core.UUID, value: DataElement) -> bool:
        # Find if a uuid matches a value, either directly or recursing into sequences
        if value.type == DataElement.UUID:
            return value.value == uuid
@@ -547,7 +552,9 @@ class SDP_PDU:
        return self

    @staticmethod
-    def parse_service_record_handle_list_preceded_by_count(data, offset):
+    def parse_service_record_handle_list_preceded_by_count(
+        data: bytes, offset: int
+    ) -> Tuple[int, List[int]]:
        count = struct.unpack_from('>H', data, offset - 2)[0]
        handle_list = [
            struct.unpack_from('>I', data, offset + x * 4)[0] for x in range(count)
@@ -645,6 +652,10 @@ class SDP_ServiceSearchRequest(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.5.1 SDP_ServiceSearchRequest PDU
    '''

+    service_search_pattern: DataElement
+    maximum_service_record_count: int
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
@SDP_PDU.subclass(
@@ -663,6 +674,11 @@ class SDP_ServiceSearchResponse(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.5.2 SDP_ServiceSearchResponse PDU
    '''

+    service_record_handle_list: List[int]
+    total_service_record_count: int
+    current_service_record_count: int
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
@SDP_PDU.subclass(
@@ -678,6 +694,11 @@ class SDP_ServiceAttributeRequest(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.6.1 SDP_ServiceAttributeRequest PDU
    '''

+    service_record_handle: int
+    maximum_attribute_byte_count: int
+    attribute_id_list: DataElement
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
@SDP_PDU.subclass(
@@ -692,6 +713,10 @@ class SDP_ServiceAttributeResponse(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.6.2 SDP_ServiceAttributeResponse PDU
    '''

+    attribute_list_byte_count: int
+    attribute_list: bytes
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
@SDP_PDU.subclass(
@@ -707,6 +732,11 @@ class SDP_ServiceSearchAttributeRequest(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.7.1 SDP_ServiceSearchAttributeRequest PDU
    '''

+    service_search_pattern: DataElement
+    maximum_attribute_byte_count: int
+    attribute_id_list: DataElement
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
@SDP_PDU.subclass(
@@ -721,26 +751,34 @@ class SDP_ServiceSearchAttributeResponse(SDP_PDU):
    See Bluetooth spec @ Vol 3, Part B - 4.7.2 SDP_ServiceSearchAttributeResponse PDU
    '''

+    attribute_list_byte_count: int
+    attribute_list: bytes
+    continuation_state: bytes
+

 # -----------------------------------------------------------------------------
 class Client:
-    def __init__(self, device):
+    channel: Optional[l2cap.Channel]
+
+    def __init__(self, device: Device) -> None:
        self.device = device
        self.pending_request = None
        self.channel = None

-    async def connect(self, connection):
+    async def connect(self, connection: Connection) -> None:
        result = await self.device.l2cap_channel_manager.connect(connection, SDP_PSM)
        self.channel = result

-    async def disconnect(self):
+    async def disconnect(self) -> None:
        if self.channel:
            await self.channel.disconnect()
            self.channel = None

-    async def search_services(self, uuids):
+    async def search_services(self, uuids: List[core.UUID]) -> List[int]:
        if self.pending_request is not None:
            raise InvalidStateError('request already pending')
+        if self.channel is None:
+            raise InvalidStateError('L2CAP not connected')

        service_search_pattern = DataElement.sequence(
            [DataElement.uuid(uuid) for uuid in uuids]
@@ -770,9 +808,13 @@ class Client:

        return service_record_handle_list

-    async def search_attributes(self, uuids, attribute_ids):
+    async def search_attributes(
+        self, uuids: List[core.UUID], attribute_ids: List[Union[int, Tuple[int, int]]]
+    ) -> List[List[ServiceAttribute]]:
        if self.pending_request is not None:
            raise InvalidStateError('request already pending')
+        if self.channel is None:
+            raise InvalidStateError('L2CAP not connected')

        service_search_pattern = DataElement.sequence(
            [DataElement.uuid(uuid) for uuid in uuids]
@@ -823,9 +865,15 @@ class Client:
            if sequence.type == DataElement.SEQUENCE
        ]

-    async def get_attributes(self, service_record_handle, attribute_ids):
+    async def get_attributes(
+        self,
+        service_record_handle: int,
+        attribute_ids: List[Union[int, Tuple[int, int]]],
+    ) -> List[ServiceAttribute]:
        if self.pending_request is not None:
            raise InvalidStateError('request already pending')
+        if self.channel is None:
+            raise InvalidStateError('L2CAP not connected')

        attribute_id_list = DataElement.sequence(
            [
@@ -873,21 +921,25 @@ class Client:
 # -----------------------------------------------------------------------------
 class Server:
    CONTINUATION_STATE = bytes([0x01, 0x43])
+    channel: Optional[l2cap.Channel]
+    Service = NewType('Service', List[ServiceAttribute])
+    service_records: Dict[int, Service]
+    current_response: Union[None, bytes, Tuple[int, List[int]]]

-    def __init__(self, device):
+    def __init__(self, device: Device) -> None:
        self.device = device
        self.service_records = {}  # Service records maps, by record handle
        self.channel = None
        self.current_response = None

-    def register(self, l2cap_channel_manager):
+    def register(self, l2cap_channel_manager: l2cap.ChannelManager) -> None:
        l2cap_channel_manager.register_server(SDP_PSM, self.on_connection)

    def send_response(self, response):
        logger.debug(f'{color(">>> Sending SDP Response", "blue")}: {response}')
        self.channel.send_pdu(response)

-    def match_services(self, search_pattern):
+    def match_services(self, search_pattern: DataElement) -> Dict[int, Service]:
        # Find the services for which the attributes in the pattern is a subset of the
        # service's attribute values (NOTE: the value search recurses into sequences)
        matching_services = {}
@@ -957,7 +1009,9 @@ class Server:
        return (payload, continuation_state)

    @staticmethod
-    def get_service_attributes(service, attribute_ids):
+    def get_service_attributes(
+        service: Service, attribute_ids: List[DataElement]
+    ) -> DataElement:
        attributes = []
        for attribute_id in attribute_ids:
            if attribute_id.value_size == 4:
@@ -982,10 +1036,10 @@ class Server:

        return attribute_list

-    def on_sdp_service_search_request(self, request):
+    def on_sdp_service_search_request(self, request: SDP_ServiceSearchRequest) -> None:
        # Check if this is a continuation
        if len(request.continuation_state) > 1:
-            if not self.current_response:
+            if self.current_response is None:
                self.send_response(
                    SDP_ErrorResponse(
                        transaction_id=request.transaction_id,
@@ -1014,6 +1068,7 @@ class Server:
            )

        # Respond, keeping any unsent handles for later
+        assert isinstance(self.current_response, tuple)
        service_record_handles = self.current_response[1][
            : request.maximum_service_record_count
        ]
@@ -1037,10 +1092,12 @@ class Server:
            )
        )

-    def on_sdp_service_attribute_request(self, request):
+    def on_sdp_service_attribute_request(
+        self, request: SDP_ServiceAttributeRequest
+    ) -> None:
        # Check if this is a continuation
        if len(request.continuation_state) > 1:
-            if not self.current_response:
+            if self.current_response is None:
                self.send_response(
                    SDP_ErrorResponse(
                        transaction_id=request.transaction_id,
@@ -1073,22 +1130,24 @@ class Server:
            self.current_response = bytes(attribute_list)

        # Respond, keeping any pending chunks for later
-        attribute_list, continuation_state = self.get_next_response_payload(
+        attribute_list_response, continuation_state = self.get_next_response_payload(
            request.maximum_attribute_byte_count
        )
        self.send_response(
            SDP_ServiceAttributeResponse(
                transaction_id=request.transaction_id,
-                attribute_list_byte_count=len(attribute_list),
+                attribute_list_byte_count=len(attribute_list_response),
                attribute_list=attribute_list,
                continuation_state=continuation_state,
            )
        )

-    def on_sdp_service_search_attribute_request(self, request):
+    def on_sdp_service_search_attribute_request(
+        self, request: SDP_ServiceSearchAttributeRequest
+    ) -> None:
        # Check if this is a continuation
        if len(request.continuation_state) > 1:
-            if not self.current_response:
+            if self.current_response is None:
                self.send_response(
                    SDP_ErrorResponse(
                        transaction_id=request.transaction_id,
@@ -1118,13 +1177,13 @@ class Server:
            self.current_response = bytes(attribute_lists)

        # Respond, keeping any pending chunks for later
-        attribute_lists, continuation_state = self.get_next_response_payload(
+        attribute_lists_response, continuation_state = self.get_next_response_payload(
            request.maximum_attribute_byte_count
        )
        self.send_response(
            SDP_ServiceSearchAttributeResponse(
                transaction_id=request.transaction_id,
-                attribute_lists_byte_count=len(attribute_lists),
+                attribute_lists_byte_count=len(attribute_lists_response),
                attribute_lists=attribute_lists,
                continuation_state=continuation_state,
            )
--- a/bumble/smp.py
+++ b/bumble/smp.py
@@ -1832,8 +1832,9 @@ class Manager(EventEmitter):
    ) -> None:
        # Store the keys in the key store
        if self.device.keystore and identity_address is not None:
-            await self.device.keystore.update(str(identity_address), keys)
-            await self.device.refresh_resolving_list()
+            self.device.abort_on(
+                'flush', self.device.update_keys(str(identity_address), keys)
+            )

        # Notify the device
        self.device.on_pairing(session.connection, identity_address, keys, session.sc)
--- a/bumble/transport/init.py
+++ b/bumble/transport/init.py
@@ -20,7 +20,6 @@ import logging
 import os

 from .common import Transport, AsyncPipeSink, SnoopingTransport
-from ..controller import Controller
 from ..snoop import create_snooper

 # -----------------------------------------------------------------------------
@@ -69,6 +68,7 @@ async def open_transport(name: str) -> Transport:
      * usb
      * pyusb
      * android-emulator
+      * android-netsim
    """

    return _wrap_transport(await _open_transport(name))
@@ -118,7 +118,8 @@ async def _open_transport(name: str) -> Transport:
    if scheme == 'file':
        from .file import open_file_transport

-        return await open_file_transport(spec[0] if spec else None)
+        assert spec is not None
+        return await open_file_transport(spec[0])

    if scheme == 'vhci':
        from .vhci import open_vhci_transport
@@ -133,12 +134,14 @@ async def _open_transport(name: str) -> Transport:
    if scheme == 'usb':
        from .usb import open_usb_transport

-        return await open_usb_transport(spec[0] if spec else None)
+        assert spec is not None
+        return await open_usb_transport(spec[0])

    if scheme == 'pyusb':
        from .pyusb import open_pyusb_transport

-        return await open_pyusb_transport(spec[0] if spec else None)
+        assert spec is not None
+        return await open_pyusb_transport(spec[0])

    if scheme == 'android-emulator':
        from .android_emulator import open_android_emulator_transport
@@ -167,6 +170,7 @@ async def open_transport_or_link(name: str) -> Transport:

    """
    if name.startswith('link-relay:'):
+        from ..controller import Controller
        from ..link import RemoteLink  # lazy import

        link = RemoteLink(name[11:])
--- a/bumble/transport/android_emulator.py
+++ b/bumble/transport/android_emulator.py
@@ -18,7 +18,7 @@
 import logging
 import grpc.aio

-from .common import PumpedTransport, PumpedPacketSource, PumpedPacketSink
+from .common import PumpedTransport, PumpedPacketSource, PumpedPacketSink, Transport

 # pylint: disable=no-name-in-module
 from .grpc_protobuf.emulated_bluetooth_pb2_grpc import EmulatedBluetoothServiceStub
@@ -33,7 +33,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_android_emulator_transport(spec):
+async def open_android_emulator_transport(spec: str | None) -> Transport:
    '''
    Open a transport connection to an Android emulator via its gRPC interface.
    The parameter string has this syntax:
@@ -66,7 +66,7 @@ async def open_android_emulator_transport(spec):
    # Parse the parameters
    mode = 'host'
    server_host = 'localhost'
-    server_port = 8554
+    server_port = '8554'
    if spec is not None:
        params = spec.split(',')
        for param in params:
@@ -82,6 +82,7 @@ async def open_android_emulator_transport(spec):
    logger.debug(f'connecting to gRPC server at {server_address}')
    channel = grpc.aio.insecure_channel(server_address)

+    service: EmulatedBluetoothServiceStub | VhciForwardingServiceStub
    if mode == 'host':
        # Connect as a host
        service = EmulatedBluetoothServiceStub(channel)
--- a/bumble/transport/android_netsim.py
+++ b/bumble/transport/android_netsim.py
@@ -121,7 +121,9 @@ def publish_grpc_port(grpc_port) -> bool:


 # -----------------------------------------------------------------------------
-async def open_android_netsim_controller_transport(server_host, server_port):
+async def open_android_netsim_controller_transport(
+    server_host: str | None, server_port: int
+) -> Transport:
    if not server_port:
        raise ValueError('invalid port')
    if server_host == '_' or not server_host:
--- a/bumble/transport/common.py
+++ b/bumble/transport/common.py
@@ -20,11 +20,12 @@ import contextlib
 import struct
 import asyncio
 import logging
-from typing import ContextManager
+import io
+from typing import ContextManager, Tuple, Optional, Protocol, Dict

-from .. import hci
-from ..colors import color
-from ..snoop import Snooper
+from bumble import hci
+from bumble.colors import color
+from bumble.snoop import Snooper


 # -----------------------------------------------------------------------------
@@ -36,7 +37,7 @@ logger = logging.getLogger(__name__)
 # Information needed to parse HCI packets with a generic parser:
 # For each packet type, the info represents:
 # (length-size, length-offset, unpack-type)
-HCI_PACKET_INFO = {
+HCI_PACKET_INFO: Dict[int, Tuple[int, int, str]] = {
    hci.HCI_COMMAND_PACKET: (1, 2, 'B'),
    hci.HCI_ACL_DATA_PACKET: (2, 2, 'H'),
    hci.HCI_SYNCHRONOUS_DATA_PACKET: (1, 2, 'B'),
@@ -44,6 +45,8 @@ HCI_PACKET_INFO = {
 }


+# -----------------------------------------------------------------------------
+# Errors
 # -----------------------------------------------------------------------------
 class TransportLostError(Exception):
    """
@@ -51,24 +54,34 @@ class TransportLostError(Exception):
    """


+# -----------------------------------------------------------------------------
+# Typing Protocols
+# -----------------------------------------------------------------------------
+class TransportSink(Protocol):
+    def on_packet(self, packet: bytes) -> None:
+        ...
+
+
+class TransportSource(Protocol):
+    def set_packet_sink(self, sink: TransportSink) -> None:
+        ...
+
+
 # -----------------------------------------------------------------------------
 class PacketPump:
    """
    Pump HCI packets from a reader to a sink.
    """

-    def __init__(self, reader, sink):
+    def __init__(self, reader: AsyncPacketReader, sink: TransportSink) -> None:
        self.reader = reader
        self.sink = sink

-    async def run(self):
+    async def run(self) -> None:
        while True:
            try:
-                # Get a packet from the source
-                packet = hci.HCI_Packet.from_bytes(await self.reader.next_packet())
-
                # Deliver the packet to the sink
-                self.sink.on_packet(packet)
+                self.sink.on_packet(await self.reader.next_packet())
            except Exception as error:
                logger.warning(f'!!! {error}')

@@ -86,18 +99,22 @@ class PacketParser:
    NEED_LENGTH = 1
    NEED_BODY = 2

-    def __init__(self, sink=None):
+    sink: Optional[TransportSink]
+    extended_packet_info: Dict[int, Tuple[int, int, str]]
+    packet_info: Optional[Tuple[int, int, str]] = None
+
+    def __init__(self, sink: Optional[TransportSink] = None) -> None:
        self.sink = sink
        self.extended_packet_info = {}
        self.reset()

-    def reset(self):
+    def reset(self) -> None:
        self.state = PacketParser.NEED_TYPE
        self.bytes_needed = 1
        self.packet = bytearray()
        self.packet_info = None

-    def feed_data(self, data):
+    def feed_data(self, data: bytes) -> None:
        data_offset = 0
        data_left = len(data)
        while data_left and self.bytes_needed:
@@ -118,6 +135,7 @@ class PacketParser:
                    self.state = PacketParser.NEED_LENGTH
                    self.bytes_needed = self.packet_info[0] + self.packet_info[1]
                elif self.state == PacketParser.NEED_LENGTH:
+                    assert self.packet_info is not None
                    body_length = struct.unpack_from(
                        self.packet_info[2], self.packet, 1 + self.packet_info[1]
                    )[0]
@@ -135,7 +153,7 @@ class PacketParser:
                            )
                    self.reset()

-    def set_packet_sink(self, sink):
+    def set_packet_sink(self, sink: TransportSink) -> None:
        self.sink = sink


@@ -145,10 +163,10 @@ class PacketReader:
    Reader that reads HCI packets from a sync source.
    """

-    def __init__(self, source):
+    def __init__(self, source: io.BufferedReader) -> None:
        self.source = source

-    def next_packet(self):
+    def next_packet(self) -> Optional[bytes]:
        # Get the packet type
        packet_type = self.source.read(1)
        if len(packet_type) != 1:
@@ -157,7 +175,7 @@ class PacketReader:
        # Get the packet info based on its type
        packet_info = HCI_PACKET_INFO.get(packet_type[0])
        if packet_info is None:
-            raise ValueError(f'invalid packet type {packet_type} found')
+            raise ValueError(f'invalid packet type {packet_type[0]} found')

        # Read the header (that includes the length)
        header_size = packet_info[0] + packet_info[1]
@@ -180,17 +198,17 @@ class AsyncPacketReader:
    Reader that reads HCI packets from an async source.
    """

-    def __init__(self, source):
+    def __init__(self, source: asyncio.StreamReader) -> None:
        self.source = source

-    async def next_packet(self):
+    async def next_packet(self) -> bytes:
        # Get the packet type
        packet_type = await self.source.readexactly(1)

        # Get the packet info based on its type
        packet_info = HCI_PACKET_INFO.get(packet_type[0])
        if packet_info is None:
-            raise ValueError(f'invalid packet type {packet_type} found')
+            raise ValueError(f'invalid packet type {packet_type[0]} found')

        # Read the header (that includes the length)
        header_size = packet_info[0] + packet_info[1]
@@ -209,11 +227,11 @@ class AsyncPipeSink:
    Sink that forwards packets asynchronously to another sink.
    """

-    def __init__(self, sink):
+    def __init__(self, sink: TransportSink) -> None:
        self.sink = sink
        self.loop = asyncio.get_running_loop()

-    def on_packet(self, packet):
+    def on_packet(self, packet: bytes) -> None:
        self.loop.call_soon(self.sink.on_packet, packet)


@@ -223,50 +241,48 @@ class ParserSource:
    Base class designed to be subclassed by transport-specific source classes
    """

-    terminated: asyncio.Future
+    terminated: asyncio.Future[None]
    parser: PacketParser

-    def __init__(self):
+    def __init__(self) -> None:
        self.parser = PacketParser()
        self.terminated = asyncio.get_running_loop().create_future()

-    def set_packet_sink(self, sink):
+    def set_packet_sink(self, sink: TransportSink) -> None:
        self.parser.set_packet_sink(sink)

-    def on_transport_lost(self):
+    def on_transport_lost(self) -> None:
        self.terminated.set_result(None)
        if self.parser.sink:
-            try:
+            if hasattr(self.parser.sink, 'on_transport_lost'):
                self.parser.sink.on_transport_lost()
-            except AttributeError:
-                pass

-    async def wait_for_termination(self):
+    async def wait_for_termination(self) -> None:
        """
        Convenience method for backward compatibility. Prefer using the `terminated`
        attribute instead.
        """
        return await self.terminated

-    def close(self):
+    def close(self) -> None:
        pass


 # -----------------------------------------------------------------------------
 class StreamPacketSource(asyncio.Protocol, ParserSource):
-    def data_received(self, data):
+    def data_received(self, data: bytes) -> None:
        self.parser.feed_data(data)


 # -----------------------------------------------------------------------------
 class StreamPacketSink:
-    def __init__(self, transport):
+    def __init__(self, transport: asyncio.WriteTransport) -> None:
        self.transport = transport

-    def on_packet(self, packet):
+    def on_packet(self, packet: bytes) -> None:
        self.transport.write(packet)

-    def close(self):
+    def close(self) -> None:
        self.transport.close()


@@ -286,7 +302,7 @@ class Transport:
        ...
    """

-    def __init__(self, source, sink):
+    def __init__(self, source: TransportSource, sink: TransportSink) -> None:
        self.source = source
        self.sink = sink

@@ -300,19 +316,23 @@ class Transport:
        return iter((self.source, self.sink))

    async def close(self) -> None:
-        self.source.close()
-        self.sink.close()
+        if hasattr(self.source, 'close'):
+            self.source.close()
+        if hasattr(self.sink, 'close'):
+            self.sink.close()


 # -----------------------------------------------------------------------------
 class PumpedPacketSource(ParserSource):
-    def __init__(self, receive):
+    pump_task: Optional[asyncio.Task[None]]
+
+    def __init__(self, receive) -> None:
        super().__init__()
        self.receive_function = receive
        self.pump_task = None

-    def start(self):
-        async def pump_packets():
+    def start(self) -> None:
+        async def pump_packets() -> None:
            while True:
                try:
                    packet = await self.receive_function()
@@ -322,12 +342,12 @@ class PumpedPacketSource(ParserSource):
                    break
                except Exception as error:
                    logger.warning(f'exception while waiting for packet: {error}')
-                    self.terminated.set_result(error)
+                    self.terminated.set_exception(error)
                    break

        self.pump_task = asyncio.create_task(pump_packets())

-    def close(self):
+    def close(self) -> None:
        if self.pump_task:
            self.pump_task.cancel()

@@ -339,7 +359,7 @@ class PumpedPacketSink:
        self.packet_queue = asyncio.Queue()
        self.pump_task = None

-    def on_packet(self, packet):
+    def on_packet(self, packet: bytes) -> None:
        self.packet_queue.put_nowait(packet)

    def start(self):
@@ -364,15 +384,23 @@ class PumpedPacketSink:

 # -----------------------------------------------------------------------------
 class PumpedTransport(Transport):
-    def __init__(self, source, sink, close_function):
+    source: PumpedPacketSource
+    sink: PumpedPacketSink
+
+    def __init__(
+        self,
+        source: PumpedPacketSource,
+        sink: PumpedPacketSink,
+        close_function,
+    ) -> None:
        super().__init__(source, sink)
        self.close_function = close_function

-    def start(self):
+    def start(self) -> None:
        self.source.start()
        self.sink.start()

-    async def close(self):
+    async def close(self) -> None:
        await super().close()
        await self.close_function()

@@ -397,31 +425,37 @@ class SnoopingTransport(Transport):
        raise RuntimeError('unexpected code path')  # Satisfy the type checker

    class Source:
-        def __init__(self, source, snooper):
+        sink: TransportSink
+
+        def __init__(self, source: TransportSource, snooper: Snooper):
            self.source = source
            self.snooper = snooper
-            self.sink = None

-        def set_packet_sink(self, sink):
+        def set_packet_sink(self, sink: TransportSink) -> None:
            self.sink = sink
            self.source.set_packet_sink(self)

-        def on_packet(self, packet):
+        def on_packet(self, packet: bytes) -> None:
            self.snooper.snoop(packet, Snooper.Direction.CONTROLLER_TO_HOST)
            if self.sink:
                self.sink.on_packet(packet)

    class Sink:
-        def __init__(self, sink, snooper):
+        def __init__(self, sink: TransportSink, snooper: Snooper) -> None:
            self.sink = sink
            self.snooper = snooper

-        def on_packet(self, packet):
+        def on_packet(self, packet: bytes) -> None:
            self.snooper.snoop(packet, Snooper.Direction.HOST_TO_CONTROLLER)
            if self.sink:
                self.sink.on_packet(packet)

-    def __init__(self, transport, snooper, close_snooper=None):
+    def __init__(
+        self,
+        transport: Transport,
+        snooper: Snooper,
+        close_snooper=None,
+    ) -> None:
        super().__init__(
            self.Source(transport.source, snooper), self.Sink(transport.sink, snooper)
        )
--- a/bumble/transport/file.py
+++ b/bumble/transport/file.py
@@ -28,7 +28,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_file_transport(spec):
+async def open_file_transport(spec: str) -> Transport:
    '''
    Open a File transport (typically not for a real file, but for a PTY or other unix
    virtual files).
--- a/bumble/transport/hci_socket.py
+++ b/bumble/transport/hci_socket.py
@@ -33,7 +33,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_hci_socket_transport(spec):
+async def open_hci_socket_transport(spec: str | None) -> Transport:
    '''
    Open an HCI Socket (only available on some platforms).
    The parameter string is either empty (to use the first/default Bluetooth adapter)
@@ -47,7 +47,7 @@ async def open_hci_socket_transport(spec):
        hci_socket = socket.socket(
            socket.AF_BLUETOOTH,
            socket.SOCK_RAW | socket.SOCK_NONBLOCK,
-            socket.BTPROTO_HCI,
+            socket.BTPROTO_HCI,  # type: ignore
        )
    except AttributeError as error:
        # Not supported on this platform
--- a/bumble/transport/pty.py
+++ b/bumble/transport/pty.py
@@ -32,7 +32,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_pty_transport(spec):
+async def open_pty_transport(spec: str | None) -> Transport:
    '''
    Open a PTY transport.
    The parameter string may be empty, or a path name where a symbolic link
--- a/bumble/transport/pyusb.py
+++ b/bumble/transport/pyusb.py
@@ -35,7 +35,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_pyusb_transport(spec):
+async def open_pyusb_transport(spec: str) -> Transport:
    '''
    Open a USB transport. [Implementation based on PyUSB]
    The parameter string has this syntax:
--- a/bumble/transport/serial.py
+++ b/bumble/transport/serial.py
@@ -28,7 +28,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_serial_transport(spec):
+async def open_serial_transport(spec: str) -> Transport:
    '''
    Open a serial port transport.
    The parameter string has this syntax:
--- a/bumble/transport/tcp_client.py
+++ b/bumble/transport/tcp_client.py
@@ -27,7 +27,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_tcp_client_transport(spec):
+async def open_tcp_client_transport(spec: str) -> Transport:
    '''
    Open a TCP client transport.
    The parameter string has this syntax:
--- a/bumble/transport/tcp_server.py
+++ b/bumble/transport/tcp_server.py
@@ -15,6 +15,7 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+from __future__ import annotations
 import asyncio
 import logging

@@ -27,7 +28,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_tcp_server_transport(spec):
+async def open_tcp_server_transport(spec: str) -> Transport:
    '''
    Open a TCP server transport.
    The parameter string has this syntax:
@@ -42,7 +43,7 @@ async def open_tcp_server_transport(spec):
        async def close(self):
            await super().close()

-    class TcpServerProtocol:
+    class TcpServerProtocol(asyncio.BaseProtocol):
        def __init__(self, packet_source, packet_sink):
            self.packet_source = packet_source
            self.packet_sink = packet_sink
--- a/bumble/transport/udp.py
+++ b/bumble/transport/udp.py
@@ -27,7 +27,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_udp_transport(spec):
+async def open_udp_transport(spec: str) -> Transport:
    '''
    Open a UDP transport.
    The parameter string has this syntax:
--- a/bumble/transport/usb.py
+++ b/bumble/transport/usb.py
@@ -60,7 +60,7 @@ def load_libusb():
            usb1.loadLibrary(libusb_dll)


-async def open_usb_transport(spec):
+async def open_usb_transport(spec: str) -> Transport:
    '''
    Open a USB transport.
    The moniker string has this syntax:
--- a/bumble/transport/vhci.py
+++ b/bumble/transport/vhci.py
@@ -17,6 +17,7 @@
 # -----------------------------------------------------------------------------
 import logging

+from .common import Transport
 from .file import open_file_transport

 # -----------------------------------------------------------------------------
@@ -26,7 +27,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_vhci_transport(spec):
+async def open_vhci_transport(spec: str | None) -> Transport:
    '''
    Open a VHCI transport (only available on some platforms).
    The parameter string is either empty (to use the default VHCI device
@@ -42,15 +43,15 @@ async def open_vhci_transport(spec):
    # Override the source's `data_received` method so that we can
    # filter out the vendor packet that is received just after the
    # initial open
-    def vhci_data_received(data):
+    def vhci_data_received(data: bytes) -> None:
        if len(data) > 0 and data[0] == HCI_VENDOR_PKT:
            if len(data) == 4:
                hci_index = data[2] << 8 | data[3]
                logger.info(f'HCI index {hci_index}')
        else:
-            transport.source.parser.feed_data(data)
+            transport.source.parser.feed_data(data)  # type: ignore

-    transport.source.data_received = vhci_data_received
+    transport.source.data_received = vhci_data_received  # type: ignore

    # Write the initial config
    transport.sink.on_packet(bytes([HCI_VENDOR_PKT, HCI_BREDR]))
--- a/bumble/transport/ws_client.py
+++ b/bumble/transport/ws_client.py
@@ -16,9 +16,9 @@
 # Imports
 # -----------------------------------------------------------------------------
 import logging
-import websockets
+import websockets.client

-from .common import PumpedPacketSource, PumpedPacketSink, PumpedTransport
+from .common import PumpedPacketSource, PumpedPacketSink, PumpedTransport, Transport

 # -----------------------------------------------------------------------------
 # Logging
@@ -27,7 +27,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_ws_client_transport(spec):
+async def open_ws_client_transport(spec: str) -> Transport:
    '''
    Open a WebSocket client transport.
    The parameter string has this syntax:
@@ -38,7 +38,7 @@ async def open_ws_client_transport(spec):

    remote_host, remote_port = spec.split(':')
    uri = f'ws://{remote_host}:{remote_port}'
-    websocket = await websockets.connect(uri)
+    websocket = await websockets.client.connect(uri)

    transport = PumpedTransport(
        PumpedPacketSource(websocket.recv),
--- a/bumble/transport/ws_server.py
+++ b/bumble/transport/ws_server.py
@@ -15,7 +15,6 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
-import asyncio
 import logging
 import websockets

@@ -28,7 +27,7 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-async def open_ws_server_transport(spec):
+async def open_ws_server_transport(spec: str) -> Transport:
    '''
    Open a WebSocket server transport.
    The parameter string has this syntax:
@@ -43,7 +42,7 @@ async def open_ws_server_transport(spec):
        def __init__(self):
            source = ParserSource()
            sink = PumpedPacketSink(self.send_packet)
-            self.connection = asyncio.get_running_loop().create_future()
+            self.connection = None
            self.server = None

            super().__init__(source, sink)
@@ -63,7 +62,7 @@ async def open_ws_server_transport(spec):
                f'new connection on {connection.local_address} '
                f'from {connection.remote_address}'
            )
-            self.connection.set_result(connection)
+            self.connection = connection
            # pylint: disable=no-member
            try:
                async for packet in connection:
@@ -74,12 +73,14 @@ async def open_ws_server_transport(spec):
            except websockets.WebSocketException as error:
                logger.debug(f'exception while receiving packet: {error}')

-            # Wait for a new connection
-            self.connection = asyncio.get_running_loop().create_future()
+            # We're now disconnected
+            self.connection = None

        async def send_packet(self, packet):
-            connection = await self.connection
-            return await connection.send(packet)
+            if self.connection is None:
+                logger.debug('no connection, dropping packet')
+                return
+            return await self.connection.send(packet)

    local_host, local_port = spec.split(':')
    transport = WsServerTransport()
--- a/bumble/vendor/init.py
+++ b/bumble/vendor/init.py
--- a/bumble/vendor/android/init.py
+++ b/bumble/vendor/android/init.py
--- a/bumble/vendor/android/hci.py
+++ b/bumble/vendor/android/hci.py
@@ -0,0 +1,318 @@
+# Copyright 2021-2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# -----------------------------------------------------------------------------
+# Imports
+# -----------------------------------------------------------------------------
+import struct
+
+from bumble.hci import (
+    name_or_number,
+    hci_vendor_command_op_code,
+    Address,
+    HCI_Constant,
+    HCI_Object,
+    HCI_Command,
+    HCI_Vendor_Event,
+    STATUS_SPEC,
+)
+
+
+# -----------------------------------------------------------------------------
+# Constants
+# -----------------------------------------------------------------------------
+
+# Android Vendor Specific Commands and Events.
+# Only a subset of the commands are implemented here currently.
+#
+# pylint: disable-next=line-too-long
+# See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#chip-capabilities-and-configuration
+HCI_LE_GET_VENDOR_CAPABILITIES_COMMAND = hci_vendor_command_op_code(0x153)
+HCI_LE_APCF_COMMAND = hci_vendor_command_op_code(0x157)
+HCI_GET_CONTROLLER_ACTIVITY_ENERGY_INFO_COMMAND = hci_vendor_command_op_code(0x159)
+HCI_A2DP_HARDWARE_OFFLOAD_COMMAND = hci_vendor_command_op_code(0x15D)
+HCI_BLUETOOTH_QUALITY_REPORT_COMMAND = hci_vendor_command_op_code(0x15E)
+HCI_DYNAMIC_AUDIO_BUFFER_COMMAND = hci_vendor_command_op_code(0x15F)
+
+HCI_BLUETOOTH_QUALITY_REPORT_EVENT = 0x58
+
+HCI_Command.register_commands(globals())
+HCI_Vendor_Event.register_subevents(globals())
+
+
+# -----------------------------------------------------------------------------
+@HCI_Command.command(
+    return_parameters_fields=[
+        ('status', STATUS_SPEC),
+        ('max_advt_instances', 1),
+        ('offloaded_resolution_of_private_address', 1),
+        ('total_scan_results_storage', 2),
+        ('max_irk_list_sz', 1),
+        ('filtering_support', 1),
+        ('max_filter', 1),
+        ('activity_energy_info_support', 1),
+        ('version_supported', 2),
+        ('total_num_of_advt_tracked', 2),
+        ('extended_scan_support', 1),
+        ('debug_logging_supported', 1),
+        ('le_address_generation_offloading_support', 1),
+        ('a2dp_source_offload_capability_mask', 4),
+        ('bluetooth_quality_report_support', 1),
+        ('dynamic_audio_buffer_support', 4),
+    ]
+)
+class HCI_LE_Get_Vendor_Capabilities_Command(HCI_Command):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#vendor-specific-capabilities
+    '''
+
+    @classmethod
+    def parse_return_parameters(cls, parameters):
+        # There are many versions of this data structure, so we need to parse until
+        # there are no more bytes to parse, and leave un-signal parameters set to
+        # None (older versions)
+        nones = {field: None for field, _ in cls.return_parameters_fields}
+        return_parameters = HCI_Object(cls.return_parameters_fields, **nones)
+
+        try:
+            offset = 0
+            for field in cls.return_parameters_fields:
+                field_name, field_type = field
+                field_value, field_size = HCI_Object.parse_field(
+                    parameters, offset, field_type
+                )
+                setattr(return_parameters, field_name, field_value)
+                offset += field_size
+        except struct.error:
+            pass
+
+        return return_parameters
+
+
+# -----------------------------------------------------------------------------
+@HCI_Command.command(
+    fields=[
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_LE_APCF_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+    return_parameters_fields=[
+        ('status', STATUS_SPEC),
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_LE_APCF_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+)
+class HCI_LE_APCF_Command(HCI_Command):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#le_apcf_command
+
+    NOTE: the subcommand-specific payloads are left as opaque byte arrays in this
+    implementation. A future enhancement may define subcommand-specific data structures.
+    '''
+
+    # APCF Subcommands
+    # TODO: use the OpenIntEnum class (when upcoming PR is merged)
+    APCF_ENABLE = 0x00
+    APCF_SET_FILTERING_PARAMETERS = 0x01
+    APCF_BROADCASTER_ADDRESS = 0x02
+    APCF_SERVICE_UUID = 0x03
+    APCF_SERVICE_SOLICITATION_UUID = 0x04
+    APCF_LOCAL_NAME = 0x05
+    APCF_MANUFACTURER_DATA = 0x06
+    APCF_SERVICE_DATA = 0x07
+    APCF_TRANSPORT_DISCOVERY_SERVICE = 0x08
+    APCF_AD_TYPE_FILTER = 0x09
+    APCF_READ_EXTENDED_FEATURES = 0xFF
+
+    OPCODE_NAMES = {
+        APCF_ENABLE: 'APCF_ENABLE',
+        APCF_SET_FILTERING_PARAMETERS: 'APCF_SET_FILTERING_PARAMETERS',
+        APCF_BROADCASTER_ADDRESS: 'APCF_BROADCASTER_ADDRESS',
+        APCF_SERVICE_UUID: 'APCF_SERVICE_UUID',
+        APCF_SERVICE_SOLICITATION_UUID: 'APCF_SERVICE_SOLICITATION_UUID',
+        APCF_LOCAL_NAME: 'APCF_LOCAL_NAME',
+        APCF_MANUFACTURER_DATA: 'APCF_MANUFACTURER_DATA',
+        APCF_SERVICE_DATA: 'APCF_SERVICE_DATA',
+        APCF_TRANSPORT_DISCOVERY_SERVICE: 'APCF_TRANSPORT_DISCOVERY_SERVICE',
+        APCF_AD_TYPE_FILTER: 'APCF_AD_TYPE_FILTER',
+        APCF_READ_EXTENDED_FEATURES: 'APCF_READ_EXTENDED_FEATURES',
+    }
+
+    @classmethod
+    def opcode_name(cls, opcode):
+        return name_or_number(cls.OPCODE_NAMES, opcode)
+
+
+# -----------------------------------------------------------------------------
+@HCI_Command.command(
+    return_parameters_fields=[
+        ('status', STATUS_SPEC),
+        ('total_tx_time_ms', 4),
+        ('total_rx_time_ms', 4),
+        ('total_idle_time_ms', 4),
+        ('total_energy_used', 4),
+    ],
+)
+class HCI_Get_Controller_Activity_Energy_Info_Command(HCI_Command):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#le_get_controller_activity_energy_info
+    '''
+
+
+# -----------------------------------------------------------------------------
+@HCI_Command.command(
+    fields=[
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_A2DP_Hardware_Offload_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+    return_parameters_fields=[
+        ('status', STATUS_SPEC),
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_A2DP_Hardware_Offload_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+)
+class HCI_A2DP_Hardware_Offload_Command(HCI_Command):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#a2dp-hardware-offload-support
+
+    NOTE: the subcommand-specific payloads are left as opaque byte arrays in this
+    implementation. A future enhancement may define subcommand-specific data structures.
+    '''
+
+    # A2DP Hardware Offload Subcommands
+    # TODO: use the OpenIntEnum class (when upcoming PR is merged)
+    START_A2DP_OFFLOAD = 0x01
+    STOP_A2DP_OFFLOAD = 0x02
+
+    OPCODE_NAMES = {
+        START_A2DP_OFFLOAD: 'START_A2DP_OFFLOAD',
+        STOP_A2DP_OFFLOAD: 'STOP_A2DP_OFFLOAD',
+    }
+
+    @classmethod
+    def opcode_name(cls, opcode):
+        return name_or_number(cls.OPCODE_NAMES, opcode)
+
+
+# -----------------------------------------------------------------------------
+@HCI_Command.command(
+    fields=[
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_Dynamic_Audio_Buffer_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+    return_parameters_fields=[
+        ('status', STATUS_SPEC),
+        (
+            'opcode',
+            {
+                'size': 1,
+                'mapper': lambda x: HCI_Dynamic_Audio_Buffer_Command.opcode_name(x),
+            },
+        ),
+        ('payload', '*'),
+    ],
+)
+class HCI_Dynamic_Audio_Buffer_Command(HCI_Command):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#dynamic-audio-buffer-command
+
+    NOTE: the subcommand-specific payloads are left as opaque byte arrays in this
+    implementation. A future enhancement may define subcommand-specific data structures.
+    '''
+
+    # Dynamic Audio Buffer Subcommands
+    # TODO: use the OpenIntEnum class (when upcoming PR is merged)
+    GET_AUDIO_BUFFER_TIME_CAPABILITY = 0x01
+
+    OPCODE_NAMES = {
+        GET_AUDIO_BUFFER_TIME_CAPABILITY: 'GET_AUDIO_BUFFER_TIME_CAPABILITY',
+    }
+
+    @classmethod
+    def opcode_name(cls, opcode):
+        return name_or_number(cls.OPCODE_NAMES, opcode)
+
+
+# -----------------------------------------------------------------------------
+@HCI_Vendor_Event.event(
+    fields=[
+        ('quality_report_id', 1),
+        ('packet_types', 1),
+        ('connection_handle', 2),
+        ('connection_role', {'size': 1, 'mapper': HCI_Constant.role_name}),
+        ('tx_power_level', -1),
+        ('rssi', -1),
+        ('snr', 1),
+        ('unused_afh_channel_count', 1),
+        ('afh_select_unideal_channel_count', 1),
+        ('lsto', 2),
+        ('connection_piconet_clock', 4),
+        ('retransmission_count', 4),
+        ('no_rx_count', 4),
+        ('nak_count', 4),
+        ('last_tx_ack_timestamp', 4),
+        ('flow_off_count', 4),
+        ('last_flow_on_timestamp', 4),
+        ('buffer_overflow_bytes', 4),
+        ('buffer_underflow_bytes', 4),
+        ('bdaddr', Address.parse_address),
+        ('cal_failed_item_count', 1),
+        ('tx_total_packets', 4),
+        ('tx_unacked_packets', 4),
+        ('tx_flushed_packets', 4),
+        ('tx_last_subevent_packets', 4),
+        ('crc_error_packets', 4),
+        ('rx_duplicate_packets', 4),
+        ('vendor_specific_parameters', '*'),
+    ]
+)
+class HCI_Bluetooth_Quality_Report_Event(HCI_Vendor_Event):
+    # pylint: disable=line-too-long
+    '''
+    See https://source.android.com/docs/core/connect/bluetooth/hci_requirements#bluetooth-quality-report-sub-event
+    '''
--- a/environment.yml
+++ b/environment.yml
@@ -3,7 +3,7 @@ channels:
  - defaults
  - conda-forge
 dependencies:
-  - pip=20
+  - pip=23
  - python=3.8
  - pip:
    - --editable .[development,documentation,test]
--- a/examples/run_hfp_gateway.py
+++ b/examples/run_hfp_gateway.py
@@ -16,11 +16,9 @@
 # Imports
 # -----------------------------------------------------------------------------
 import asyncio
-import collections
 import sys
 import os
 import logging
-from typing import Union

 from bumble.colors import color

@@ -32,8 +30,7 @@ from bumble.core import (
    BT_RFCOMM_PROTOCOL_ID,
    BT_BR_EDR_TRANSPORT,
 )
-from bumble import rfcomm
-from bumble.rfcomm import Client
+from bumble import rfcomm, hfp
 from bumble.sdp import (
    Client as SDP_Client,
    DataElement,
@@ -47,61 +44,6 @@ from bumble.sdp import (
 logger = logging.getLogger(__name__)


-# -----------------------------------------------------------------------------
-# Protocol Support
-# -----------------------------------------------------------------------------
-
-# -----------------------------------------------------------------------------
-class HfpProtocol:
-    dlc: rfcomm.DLC
-    buffer: str
-    lines: collections.deque
-    lines_available: asyncio.Event
-
-    def __init__(self, dlc: rfcomm.DLC) -> None:
-        self.dlc = dlc
-        self.buffer = ''
-        self.lines = collections.deque()
-        self.lines_available = asyncio.Event()
-
-        dlc.sink = self.feed
-
-    def feed(self, data: Union[bytes, str]) -> None:
-        # Convert the data to a string if needed
-        if isinstance(data, bytes):
-            data = data.decode('utf-8')
-
-        logger.debug(f'<<< Data received: {data}')
-
-        # Add to the buffer and look for lines
-        self.buffer += data
-        while (separator := self.buffer.find('\r')) >= 0:
-            line = self.buffer[:separator].strip()
-            self.buffer = self.buffer[separator + 1 :]
-            if len(line) > 0:
-                self.on_line(line)
-
-    def on_line(self, line: str) -> None:
-        self.lines.append(line)
-        self.lines_available.set()
-
-    def send_command_line(self, line: str) -> None:
-        logger.debug(color(f'>>> {line}', 'yellow'))
-        self.dlc.write(line + '\r')
-
-    def send_response_line(self, line: str) -> None:
-        logger.debug(color(f'>>> {line}', 'yellow'))
-        self.dlc.write('\r\n' + line + '\r\n')
-
-    async def next_line(self) -> str:
-        await self.lines_available.wait()
-        line = self.lines.popleft()
-        if not self.lines:
-            self.lines_available.clear()
-        logger.debug(color(f'<<< {line}', 'green'))
-        return line
-
-
 # -----------------------------------------------------------------------------
 # pylint: disable-next=too-many-nested-blocks
 async def list_rfcomm_channels(device, connection):
@@ -241,7 +183,7 @@ async def main():

        # Create a client and start it
        print('@@@ Starting to RFCOMM client...')
-        rfcomm_client = Client(device, connection)
+        rfcomm_client = rfcomm.Client(device, connection)
        rfcomm_mux = await rfcomm_client.start()
        print('@@@ Started')

@@ -256,7 +198,7 @@ async def main():
            return

        # Protocol loop (just for testing at this point)
-        protocol = HfpProtocol(session)
+        protocol = hfp.HfpProtocol(session)
        while True:
            line = await protocol.next_line()

--- a/examples/run_rfcomm_server.py
+++ b/examples/run_rfcomm_server.py
@@ -20,83 +20,109 @@ import sys
 import os
 import logging

+from bumble.core import UUID
 from bumble.device import Device
 from bumble.transport import open_transport_or_link
-from bumble.core import BT_L2CAP_PROTOCOL_ID, BT_RFCOMM_PROTOCOL_ID, UUID
 from bumble.rfcomm import Server
-from bumble.sdp import (
-    DataElement,
-    ServiceAttribute,
-    SDP_PUBLIC_BROWSE_ROOT,
-    SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
-    SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
-    SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
-    SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
-)
+from bumble.utils import AsyncRunner
+from bumble.rfcomm import make_service_sdp_records


 # -----------------------------------------------------------------------------
-def sdp_records(channel):
+def sdp_records(channel, uuid):
+    service_record_handle = 0x00010001
    return {
-        0x00010001: [
-            ServiceAttribute(
-                SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
-                DataElement.unsigned_integer_32(0x00010001),
-            ),
-            ServiceAttribute(
-                SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
-                DataElement.sequence([DataElement.uuid(SDP_PUBLIC_BROWSE_ROOT)]),
-            ),
-            ServiceAttribute(
-                SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
-                DataElement.sequence(
-                    [DataElement.uuid(UUID('E6D55659-C8B4-4B85-96BB-B1143AF6D3AE'))]
-                ),
-            ),
-            ServiceAttribute(
-                SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
-                DataElement.sequence(
-                    [
-                        DataElement.sequence([DataElement.uuid(BT_L2CAP_PROTOCOL_ID)]),
-                        DataElement.sequence(
-                            [
-                                DataElement.uuid(BT_RFCOMM_PROTOCOL_ID),
-                                DataElement.unsigned_integer_8(channel),
-                            ]
-                        ),
-                    ]
-                ),
-            ),
-        ]
+        service_record_handle: make_service_sdp_records(
+            service_record_handle, channel, UUID(uuid)
+        )
    }


 # -----------------------------------------------------------------------------
-def on_dlc(dlc):
-    print('*** DLC connected', dlc)
-    dlc.sink = lambda data: on_rfcomm_data_received(dlc, data)
+def on_rfcomm_session(rfcomm_session, tcp_server):
+    print('*** RFComm session connected', rfcomm_session)
+    tcp_server.attach_session(rfcomm_session)


 # -----------------------------------------------------------------------------
-def on_rfcomm_data_received(dlc, data):
-    print(f'<<< Data received: {data.hex()}')
-    try:
-        message = data.decode('utf-8')
-        print(f'<<< Message = {message}')
-    except Exception:
-        pass
+class TcpServerProtocol(asyncio.Protocol):
+    def __init__(self, server):
+        self.server = server

-    # Echo everything back
-    dlc.write(data)
+    def connection_made(self, transport):
+        peer_name = transport.get_extra_info('peer_name')
+        print(f'<<< TCP Server: connection from {peer_name}')
+        if self.server:
+            self.server.tcp_transport = transport
+        else:
+            transport.close()
+
+    def connection_lost(self, exc):
+        print('<<< TCP Server: connection lost')
+        if self.server:
+            self.server.tcp_transport = None
+
+    def data_received(self, data):
+        print(f'<<< TCP Server: data received: {len(data)} bytes - {data.hex()}')
+        if self.server:
+            self.server.tcp_data_received(data)
+
+
+# -----------------------------------------------------------------------------
+class TcpServer:
+    def __init__(self, port):
+        self.rfcomm_session = None
+        self.tcp_transport = None
+        AsyncRunner.spawn(self.run(port))
+
+    def attach_session(self, rfcomm_session):
+        if self.rfcomm_session:
+            self.rfcomm_session.sink = None
+
+        self.rfcomm_session = rfcomm_session
+        rfcomm_session.sink = self.rfcomm_data_received
+
+    def rfcomm_data_received(self, data):
+        print(f'<<< RFCOMM Data: {data.hex()}')
+        if self.tcp_transport:
+            self.tcp_transport.write(data)
+        else:
+            print('!!! no TCP connection, dropping data')
+
+    def tcp_data_received(self, data):
+        if self.rfcomm_session:
+            self.rfcomm_session.write(data)
+        else:
+            print('!!! no RFComm session, dropping data')
+
+    async def run(self, port):
+        print(f'$$$ Starting TCP server on port {port}')
+
+        server = await asyncio.get_running_loop().create_server(
+            lambda: TcpServerProtocol(self), '127.0.0.1', port
+        )
+
+        async with server:
+            await server.serve_forever()


 # -----------------------------------------------------------------------------
 async def main():
-    if len(sys.argv) < 3:
-        print('Usage: run_rfcomm_server.py <device-config> <transport-spec>')
-        print('example: run_rfcomm_server.py classic2.json usb:04b4:f901')
+    if len(sys.argv) < 4:
+        print(
+            'Usage: run_rfcomm_server.py <device-config> <transport-spec> '
+            '<tcp-port> [<uuid>]'
+        )
+        print('example: run_rfcomm_server.py classic2.json usb:0 8888')
        return

+    tcp_port = int(sys.argv[3])
+
+    if len(sys.argv) >= 5:
+        uuid = sys.argv[4]
+    else:
+        uuid = 'E6D55659-C8B4-4B85-96BB-B1143AF6D3AE'
+
    print('<<< connecting to HCI...')
    async with await open_transport_or_link(sys.argv[2]) as (hci_source, hci_sink):
        print('<<< connected')
@@ -105,15 +131,20 @@ async def main():
        device = Device.from_config_file_with_hci(sys.argv[1], hci_source, hci_sink)
        device.classic_enabled = True

-        # Create and register a server
+        # Create a TCP server
+        tcp_server = TcpServer(tcp_port)
+
+        # Create and register an RFComm server
        rfcomm_server = Server(device)

        # Listen for incoming DLC connections
-        channel_number = rfcomm_server.listen(on_dlc)
-        print(f'### Listening for connection on channel {channel_number}')
+        channel_number = rfcomm_server.listen(
+            lambda session: on_rfcomm_session(session, tcp_server)
+        )
+        print(f'### Listening for RFComm connections on channel {channel_number}')

        # Setup the SDP to advertise this channel
-        device.sdp_service_records = sdp_records(channel_number)
+        device.sdp_service_records = sdp_records(channel_number, uuid)

        # Start the controller
        await device.power_on()
--- a/mmm.sbc
+++ b/mmm.sbc
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -10,12 +10,12 @@ documentation = "https://docs.rs/crate/bumble"
 authors = ["Marshall Pierce <marshallpierce@google.com>"]
 keywords = ["bluetooth", "ble"]
 categories = ["api-bindings", "network-programming"]
-rust-version = "1.69.0"
+rust-version = "1.70.0"

 [dependencies]
 pyo3 = { version = "0.18.3", features = ["macros"] }
 pyo3-asyncio = { version = "0.18.0", features = ["tokio-runtime"] }
-tokio = { version = "1.28.2" }
+tokio = { version = "1.28.2", features = ["macros", "signal"] }
 nom = "7.1.3"
 strum = "0.25.0"
 strum_macros = "0.25.0"
@@ -23,7 +23,17 @@ hex = "0.4.3"
 itertools = "0.11.0"
 lazy_static = "1.4.0"
 thiserror = "1.0.41"
+
+# CLI
 anyhow = { version = "1.0.71", optional = true }
+clap = { version = "4.3.3", features = ["derive"], optional = true }
+directories = { version = "5.0.1", optional = true }
+env_logger = { version = "0.10.0", optional = true }
+futures = { version = "0.3.28", optional = true }
+log = { version = "0.4.19", optional = true }
+owo-colors = { version = "3.5.0", optional = true }
+reqwest = { version = "0.11.20", features = ["blocking"], optional = true }
+rusb = { version = "0.9.2", optional = true }

 [dev-dependencies]
 tokio = { version = "1.28.2", features = ["full"] }
@@ -32,17 +42,25 @@ nix = "0.26.2"
 anyhow = "1.0.71"
 pyo3 = { version = "0.18.3", features = ["macros", "anyhow"] }
 pyo3-asyncio = { version = "0.18.0", features = ["tokio-runtime", "attributes", "testing"] }
+rusb = "0.9.2"
+rand = "0.8.5"
 clap = { version = "4.3.3", features = ["derive"] }
 owo-colors = "3.5.0"
 log = "0.4.19"
 env_logger = "0.10.0"
-rusb = "0.9.2"
-rand = "0.8.5"
+
+[package.metadata.docs.rs]
+rustdoc-args = ["--generate-link-to-definition"]

 [[bin]]
 name = "gen-assigned-numbers"
 path = "tools/gen_assigned_numbers.rs"
-required-features = ["bumble-dev-tools"]
+required-features = ["bumble-codegen"]
+
+[[bin]]
+name = "bumble"
+path = "src/main.rs"
+required-features = ["bumble-tools"]

 # test entry point that uses pyo3_asyncio's test harness
 [[test]]
@@ -53,4 +71,7 @@ harness = false
 [features]
 anyhow = ["pyo3/anyhow"]
 pyo3-asyncio-attributes = ["pyo3-asyncio/attributes"]
-bumble-dev-tools = ["dep:anyhow"]
+bumble-codegen = ["dep:anyhow"]
+# separate feature for CLI so that dependencies don't spend time building these
+bumble-tools = ["dep:clap", "anyhow", "dep:anyhow", "dep:directories", "pyo3-asyncio-attributes", "dep:owo-colors", "dep:reqwest", "dep:rusb", "dep:log", "dep:env_logger", "dep:futures"]
+default = []
--- a/rust/README.md
+++ b/rust/README.md
@@ -5,7 +5,8 @@ Rust wrappers around the [Bumble](https://github.com/google/bumble) Python API.
 Method calls are mapped to the equivalent Python, and return types adapted where
 relevant.

-See the `examples` directory for usage.
+See the CLI in `src/main.rs` or the `examples` directory for how to use the
+Bumble API.

 # Usage

@@ -27,6 +28,15 @@ PYTHONPATH=..:~/.virtualenvs/bumble/lib/python3.10/site-packages/ \
 Run the corresponding `battery_server` Python example, and launch an emulator in
 Android Studio (currently, Canary is required) to run netsim.

+# CLI
+
+Explore the available subcommands:
+
+```
+PYTHONPATH=..:[virtualenv site-packages] \
+    cargo run --features bumble-tools --bin bumble -- --help
+```
+
 # Development

 Run the tests:
@@ -43,7 +53,7 @@ cargo clippy --all-targets

 ## Code gen

-To have the fastest startup while keeping the build simple, code gen for 
+To have the fastest startup while keeping the build simple, code gen for
 assigned numbers is done with the `gen_assigned_numbers` tool. It should
 be re-run whenever the Python assigned numbers are changed. To ensure that the
 generated code is kept up to date, the Rust data is compared to the Python
@@ -52,5 +62,5 @@ in tests at `pytests/assigned_numbers.rs`.
 To regenerate the assigned number tables based on the Python codebase:

 ```
-PYTHONPATH=.. cargo run --bin gen-assigned-numbers --features bumble-dev-tools
+PYTHONPATH=.. cargo run --bin gen-assigned-numbers --features bumble-codegen
 ```
--- a/rust/pytests/wrapper.rs
+++ b/rust/pytests/wrapper.rs
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.

-use bumble::wrapper::transport::Transport;
+use bumble::wrapper::{drivers::rtk::DriverInfo, transport::Transport};
 use nix::sys::stat::Mode;
 use pyo3::PyResult;

@@ -29,3 +29,9 @@ async fn fifo_transport_can_open() -> PyResult<()> {

    Ok(())
 }
+
+#[pyo3_asyncio::tokio::test]
+async fn realtek_driver_info_all_drivers() -> PyResult<()> {
+    assert_eq!(12, DriverInfo::all_drivers()?.len());
+    Ok(())
+}
--- a/rust/resources/test/firmware/realtek/README.md
+++ b/rust/resources/test/firmware/realtek/README.md
@@ -0,0 +1,4 @@
+This dir contains samples firmware images in the format used for Realtek chips,
+but with repetitions of the length of the section as a little-endian 32-bit int
+for the patch data instead of actual firmware, since we only need the structure
+to test parsing.
--- a/rust/resources/test/firmware/realtek/rtl8723b_fw_structure.bin
+++ b/rust/resources/test/firmware/realtek/rtl8723b_fw_structure.bin
--- a/rust/resources/test/firmware/realtek/rtl8761bu_fw_structure.bin
+++ b/rust/resources/test/firmware/realtek/rtl8761bu_fw_structure.bin
--- a/rust/src/cli/firmware/mod.rs
+++ b/rust/src/cli/firmware/mod.rs
@@ -0,0 +1,15 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub(crate) mod rtk;
--- a/rust/src/cli/firmware/rtk.rs
+++ b/rust/src/cli/firmware/rtk.rs
@@ -0,0 +1,265 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Realtek firmware tools
+
+use crate::{Download, Source};
+use anyhow::anyhow;
+use bumble::wrapper::{
+    drivers::rtk::{Driver, DriverInfo, Firmware},
+    host::{DriverFactory, Host},
+    transport::Transport,
+};
+use owo_colors::{colors::css, OwoColorize};
+use pyo3::PyResult;
+use std::{fs, path};
+
+pub(crate) async fn download(dl: Download) -> PyResult<()> {
+    let data_dir = dl
+        .output_dir
+        .or_else(|| {
+            directories::ProjectDirs::from("com", "google", "bumble")
+                .map(|pd| pd.data_local_dir().join("firmware").join("realtek"))
+        })
+        .unwrap_or_else(|| {
+            eprintln!("Could not determine standard data directory");
+            path::PathBuf::from(".")
+        });
+    fs::create_dir_all(&data_dir)?;
+
+    let (base_url, uses_bin_suffix) = match dl.source {
+        Source::LinuxKernel => ("https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/rtl_bt", true),
+        Source::RealtekOpensource => ("https://github.com/Realtek-OpenSource/android_hardware_realtek/raw/rtk1395/bt/rtkbt/Firmware/BT", false),
+        Source::LinuxFromScratch => ("https://anduin.linuxfromscratch.org/sources/linux-firmware/rtl_bt", true),
+    };
+
+    println!("Downloading");
+    println!("{} {}", "FROM:".green(), base_url);
+    println!("{} {}", "TO:".green(), data_dir.to_string_lossy());
+
+    let url_for_file = |file_name: &str| {
+        let url_suffix = if uses_bin_suffix {
+            file_name
+        } else {
+            file_name.trim_end_matches(".bin")
+        };
+
+        let mut url = base_url.to_string();
+        url.push('/');
+        url.push_str(url_suffix);
+        url
+    };
+
+    let to_download = if let Some(single) = dl.single {
+        vec![(
+            format!("{single}_fw.bin"),
+            Some(format!("{single}_config.bin")),
+            false,
+        )]
+    } else {
+        DriverInfo::all_drivers()?
+            .iter()
+            .map(|di| Ok((di.firmware_name()?, di.config_name()?, di.config_needed()?)))
+            .collect::<PyResult<Vec<_>>>()?
+    };
+
+    let client = SimpleClient::new();
+
+    for (fw_filename, config_filename, config_needed) in to_download {
+        println!("{}", "---".yellow());
+        let fw_path = data_dir.join(&fw_filename);
+        let config_path = config_filename.as_ref().map(|f| data_dir.join(f));
+
+        if fw_path.exists() && !dl.overwrite {
+            println!(
+                "{}",
+                format!("{} already exists, skipping", fw_path.to_string_lossy())
+                    .fg::<css::Orange>()
+            );
+            continue;
+        }
+        if let Some(cp) = config_path.as_ref() {
+            if cp.exists() && !dl.overwrite {
+                println!(
+                    "{}",
+                    format!("{} already exists, skipping", cp.to_string_lossy())
+                        .fg::<css::Orange>()
+                );
+                continue;
+            }
+        }
+
+        let fw_contents = match client.get(&url_for_file(&fw_filename)).await {
+            Ok(data) => {
+                println!("Downloaded {}: {} bytes", fw_filename, data.len());
+                data
+            }
+            Err(e) => {
+                eprintln!(
+                    "{} {} {:?}",
+                    "Failed to download".red(),
+                    fw_filename.red(),
+                    e
+                );
+                continue;
+            }
+        };
+
+        let config_contents = if let Some(cn) = &config_filename {
+            match client.get(&url_for_file(cn)).await {
+                Ok(data) => {
+                    println!("Downloaded {}: {} bytes", cn, data.len());
+                    Some(data)
+                }
+                Err(e) => {
+                    if config_needed {
+                        eprintln!("{} {} {:?}", "Failed to download".red(), cn.red(), e);
+                        continue;
+                    } else {
+                        eprintln!(
+                            "{}",
+                            format!("No config available as {cn}").fg::<css::Orange>()
+                        );
+                        None
+                    }
+                }
+            }
+        } else {
+            None
+        };
+
+        fs::write(&fw_path, &fw_contents)?;
+        if !dl.no_parse && config_filename.is_some() {
+            println!("{} {}", "Parsing:".cyan(), &fw_filename);
+            match Firmware::parse(&fw_contents).map_err(|e| anyhow!("Parse error: {:?}", e)) {
+                Ok(fw) => dump_firmware_desc(&fw),
+                Err(e) => {
+                    eprintln!(
+                        "{} {:?}",
+                        "Could not parse firmware:".fg::<css::Orange>(),
+                        e
+                    );
+                }
+            }
+        }
+        if let Some((cp, cd)) = config_path
+            .as_ref()
+            .and_then(|p| config_contents.map(|c| (p, c)))
+        {
+            fs::write(cp, &cd)?;
+        }
+    }
+
+    Ok(())
+}
+
+pub(crate) fn parse(firmware_path: &path::Path) -> PyResult<()> {
+    let contents = fs::read(firmware_path)?;
+    let fw = Firmware::parse(&contents)
+        // squish the error into a string to avoid the error type requiring that the input be
+        // 'static
+        .map_err(|e| anyhow!("Parse error: {:?}", e))?;
+
+    dump_firmware_desc(&fw);
+
+    Ok(())
+}
+
+pub(crate) async fn info(transport: &str, force: bool) -> PyResult<()> {
+    let transport = Transport::open(transport).await?;
+
+    let mut host = Host::new(transport.source()?, transport.sink()?)?;
+    host.reset(DriverFactory::None).await?;
+
+    if !force && !Driver::check(&host).await? {
+        println!("USB device not supported by this RTK driver");
+    } else if let Some(driver_info) = Driver::driver_info_for_host(&host).await? {
+        println!("Driver:");
+        println!("  {:10} {:04X}", "ROM:", driver_info.rom()?);
+        println!("  {:10} {}", "Firmware:", driver_info.firmware_name()?);
+        println!(
+            "  {:10} {}",
+            "Config:",
+            driver_info.config_name()?.unwrap_or_default()
+        );
+    } else {
+        println!("Firmware already loaded or no supported driver for this device.")
+    }
+
+    Ok(())
+}
+
+pub(crate) async fn load(transport: &str, force: bool) -> PyResult<()> {
+    let transport = Transport::open(transport).await?;
+
+    let mut host = Host::new(transport.source()?, transport.sink()?)?;
+    host.reset(DriverFactory::None).await?;
+
+    match Driver::for_host(&host, force).await? {
+        None => {
+            eprintln!("Firmware already loaded or no supported driver for this device.");
+        }
+        Some(mut d) => d.download_firmware().await?,
+    };
+
+    Ok(())
+}
+
+pub(crate) async fn drop(transport: &str) -> PyResult<()> {
+    let transport = Transport::open(transport).await?;
+
+    let mut host = Host::new(transport.source()?, transport.sink()?)?;
+    host.reset(DriverFactory::None).await?;
+
+    Driver::drop_firmware(&mut host).await?;
+
+    Ok(())
+}
+
+fn dump_firmware_desc(fw: &Firmware) {
+    println!(
+        "Firmware: version=0x{:08X} project_id=0x{:04X}",
+        fw.version(),
+        fw.project_id()
+    );
+    for p in fw.patches() {
+        println!(
+            "  Patch: chip_id=0x{:04X}, {} bytes, SVN Version={:08X}",
+            p.chip_id(),
+            p.contents().len(),
+            p.svn_version()
+        )
+    }
+}
+
+struct SimpleClient {
+    client: reqwest::Client,
+}
+
+impl SimpleClient {
+    fn new() -> Self {
+        Self {
+            client: reqwest::Client::new(),
+        }
+    }
+
+    async fn get(&self, url: &str) -> anyhow::Result<Vec<u8>> {
+        let resp = self.client.get(url).send().await?;
+        if !resp.status().is_success() {
+            return Err(anyhow!("Bad status: {}", resp.status()));
+        }
+        let bytes = resp.bytes().await?;
+        Ok(bytes.as_ref().to_vec())
+    }
+}
--- a/rust/src/cli/l2cap/client_bridge.rs
+++ b/rust/src/cli/l2cap/client_bridge.rs
@@ -0,0 +1,191 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/// L2CAP CoC client bridge: connects to a BLE device, then waits for an inbound
+/// TCP connection on a specified port number. When a TCP client connects, an
+/// L2CAP CoC channel connection to the BLE device is established, and the data
+/// is bridged in both directions, with flow control.
+/// When the TCP connection is closed by the client, the L2CAP CoC channel is
+/// disconnected, but the connection to the BLE device remains, ready for a new
+/// TCP client to connect.
+/// When the L2CAP CoC channel is closed, the TCP connection is closed as well.
+use crate::cli::l2cap::{
+    proxy_l2cap_rx_to_tcp_tx, proxy_tcp_rx_to_l2cap_tx, run_future_with_current_task_locals,
+    BridgeData,
+};
+use bumble::wrapper::{
+    device::{Connection, Device},
+    hci::HciConstant,
+};
+use futures::executor::block_on;
+use owo_colors::OwoColorize;
+use pyo3::{PyResult, Python};
+use std::{net::SocketAddr, sync::Arc};
+use tokio::{
+    join,
+    net::{TcpListener, TcpStream},
+    sync::{mpsc, Mutex},
+};
+
+pub struct Args {
+    pub psm: u16,
+    pub max_credits: Option<u16>,
+    pub mtu: Option<u16>,
+    pub mps: Option<u16>,
+    pub bluetooth_address: String,
+    pub tcp_host: String,
+    pub tcp_port: u16,
+}
+
+pub async fn start(args: &Args, device: &mut Device) -> PyResult<()> {
+    println!(
+        "{}",
+        format!("### Connecting to {}...", args.bluetooth_address).yellow()
+    );
+    let mut ble_connection = device.connect(&args.bluetooth_address).await?;
+    ble_connection.on_disconnection(|_py, reason| {
+        let disconnection_info = match HciConstant::error_name(reason) {
+            Ok(info_string) => info_string,
+            Err(py_err) => format!("failed to get disconnection error name ({})", py_err),
+        };
+        println!(
+            "{} {}",
+            "@@@ Bluetooth disconnection: ".red(),
+            disconnection_info,
+        );
+        Ok(())
+    })?;
+
+    // Start the TCP server.
+    let listener = TcpListener::bind(format!("{}:{}", args.tcp_host, args.tcp_port))
+        .await
+        .expect("failed to bind tcp to address");
+    println!(
+        "{}",
+        format!(
+            "### Listening for TCP connections on port {}",
+            args.tcp_port
+        )
+        .magenta()
+    );
+
+    let psm = args.psm;
+    let max_credits = args.max_credits;
+    let mtu = args.mtu;
+    let mps = args.mps;
+    let ble_connection = Arc::new(Mutex::new(ble_connection));
+    // Ensure Python event loop is available to l2cap `disconnect`
+    let _ = run_future_with_current_task_locals(async move {
+        while let Ok((tcp_stream, addr)) = listener.accept().await {
+            let ble_connection = ble_connection.clone();
+            let _ = run_future_with_current_task_locals(proxy_data_between_tcp_and_l2cap(
+                ble_connection,
+                tcp_stream,
+                addr,
+                psm,
+                max_credits,
+                mtu,
+                mps,
+            ));
+        }
+        Ok(())
+    });
+    Ok(())
+}
+
+async fn proxy_data_between_tcp_and_l2cap(
+    ble_connection: Arc<Mutex<Connection>>,
+    tcp_stream: TcpStream,
+    addr: SocketAddr,
+    psm: u16,
+    max_credits: Option<u16>,
+    mtu: Option<u16>,
+    mps: Option<u16>,
+) -> PyResult<()> {
+    println!("{}", format!("<<< TCP connection from {}", addr).magenta());
+    println!(
+        "{}",
+        format!(">>> Opening L2CAP channel on PSM = {}", psm).yellow()
+    );
+
+    let mut l2cap_channel = match ble_connection
+        .lock()
+        .await
+        .open_l2cap_channel(psm, max_credits, mtu, mps)
+        .await
+    {
+        Ok(channel) => channel,
+        Err(e) => {
+            println!("{}", format!("!!! Connection failed: {e}").red());
+            // TCP stream will get dropped after returning, automatically shutting it down.
+            return Err(e);
+        }
+    };
+    let channel_info = l2cap_channel
+        .debug_string()
+        .unwrap_or_else(|e| format!("failed to get l2cap channel info ({e})"));
+
+    println!("{}{}", "*** L2CAP channel: ".cyan(), channel_info);
+
+    let (l2cap_to_tcp_tx, l2cap_to_tcp_rx) = mpsc::channel::<BridgeData>(10);
+
+    // Set l2cap callback (`set_sink`) for when data is received.
+    let l2cap_to_tcp_tx_clone = l2cap_to_tcp_tx.clone();
+    l2cap_channel
+        .set_sink(move |_py, sdu| {
+            block_on(l2cap_to_tcp_tx_clone.send(BridgeData::Data(sdu.into())))
+                .expect("failed to channel data to tcp");
+            Ok(())
+        })
+        .expect("failed to set sink for l2cap connection");
+
+    // Set l2cap callback for when the channel is closed.
+    l2cap_channel
+        .on_close(move |_py| {
+            println!("{}", "*** L2CAP channel closed".red());
+            block_on(l2cap_to_tcp_tx.send(BridgeData::CloseSignal))
+                .expect("failed to channel close signal to tcp");
+            Ok(())
+        })
+        .expect("failed to set on_close callback for l2cap channel");
+
+    let l2cap_channel = Arc::new(Mutex::new(Some(l2cap_channel)));
+    let (tcp_reader, tcp_writer) = tcp_stream.into_split();
+
+    // Do tcp stuff when something happens on the l2cap channel.
+    let handle_l2cap_data_future =
+        proxy_l2cap_rx_to_tcp_tx(l2cap_to_tcp_rx, tcp_writer, l2cap_channel.clone());
+
+    // Do l2cap stuff when something happens on tcp.
+    let handle_tcp_data_future = proxy_tcp_rx_to_l2cap_tx(tcp_reader, l2cap_channel.clone(), true);
+
+    let (handle_l2cap_result, handle_tcp_result) =
+        join!(handle_l2cap_data_future, handle_tcp_data_future);
+
+    if let Err(e) = handle_l2cap_result {
+        println!("!!! Error: {e}");
+    }
+
+    if let Err(e) = handle_tcp_result {
+        println!("!!! Error: {e}");
+    }
+
+    Python::with_gil(|_| {
+        // Must hold GIL at least once while/after dropping for Python heap object to ensure
+        // de-allocation.
+        drop(l2cap_channel);
+    });
+
+    Ok(())
+}
--- a/rust/src/cli/l2cap/mod.rs
+++ b/rust/src/cli/l2cap/mod.rs
@@ -0,0 +1,190 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Rust version of the Python `l2cap_bridge.py` found under the `apps` folder.
+
+use crate::L2cap;
+use anyhow::anyhow;
+use bumble::wrapper::{device::Device, l2cap::LeConnectionOrientedChannel, transport::Transport};
+use owo_colors::{colors::css::Orange, OwoColorize};
+use pyo3::{PyObject, PyResult, Python};
+use std::{future::Future, path::PathBuf, sync::Arc};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    net::tcp::{OwnedReadHalf, OwnedWriteHalf},
+    sync::{mpsc::Receiver, Mutex},
+};
+
+mod client_bridge;
+mod server_bridge;
+
+pub(crate) async fn run(
+    command: L2cap,
+    device_config: PathBuf,
+    transport: String,
+    psm: u16,
+    max_credits: Option<u16>,
+    mtu: Option<u16>,
+    mps: Option<u16>,
+) -> PyResult<()> {
+    println!("<<< connecting to HCI...");
+    let transport = Transport::open(transport).await?;
+    println!("<<< connected");
+
+    let mut device =
+        Device::from_config_file_with_hci(&device_config, transport.source()?, transport.sink()?)?;
+
+    device.power_on().await?;
+
+    match command {
+        L2cap::Server { tcp_host, tcp_port } => {
+            let args = server_bridge::Args {
+                psm,
+                max_credits,
+                mtu,
+                mps,
+                tcp_host,
+                tcp_port,
+            };
+
+            server_bridge::start(&args, &mut device).await?
+        }
+        L2cap::Client {
+            bluetooth_address,
+            tcp_host,
+            tcp_port,
+        } => {
+            let args = client_bridge::Args {
+                psm,
+                max_credits,
+                mtu,
+                mps,
+                bluetooth_address,
+                tcp_host,
+                tcp_port,
+            };
+
+            client_bridge::start(&args, &mut device).await?
+        }
+    };
+
+    // wait until user kills the process
+    tokio::signal::ctrl_c().await?;
+
+    Ok(())
+}
+
+/// Used for channeling data from Python callbacks to a Rust consumer.
+enum BridgeData {
+    Data(Vec<u8>),
+    CloseSignal,
+}
+
+async fn proxy_l2cap_rx_to_tcp_tx(
+    mut l2cap_data_receiver: Receiver<BridgeData>,
+    mut tcp_writer: OwnedWriteHalf,
+    l2cap_channel: Arc<Mutex<Option<LeConnectionOrientedChannel>>>,
+) -> anyhow::Result<()> {
+    while let Some(bridge_data) = l2cap_data_receiver.recv().await {
+        match bridge_data {
+            BridgeData::Data(sdu) => {
+                println!("{}", format!("<<< [L2CAP SDU]: {} bytes", sdu.len()).cyan());
+                tcp_writer
+                    .write_all(sdu.as_ref())
+                    .await
+                    .map_err(|_| anyhow!("Failed to write to tcp stream"))?;
+                tcp_writer
+                    .flush()
+                    .await
+                    .map_err(|_| anyhow!("Failed to flush tcp stream"))?;
+            }
+            BridgeData::CloseSignal => {
+                l2cap_channel.lock().await.take();
+                tcp_writer
+                    .shutdown()
+                    .await
+                    .map_err(|_| anyhow!("Failed to shut down write half of tcp stream"))?;
+                return Ok(());
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn proxy_tcp_rx_to_l2cap_tx(
+    mut tcp_reader: OwnedReadHalf,
+    l2cap_channel: Arc<Mutex<Option<LeConnectionOrientedChannel>>>,
+    drain_l2cap_after_write: bool,
+) -> PyResult<()> {
+    let mut buf = [0; 4096];
+    loop {
+        match tcp_reader.read(&mut buf).await {
+            Ok(len) => {
+                if len == 0 {
+                    println!("{}", "!!! End of stream".fg::<Orange>());
+
+                    if let Some(mut channel) = l2cap_channel.lock().await.take() {
+                        channel.disconnect().await.map_err(|e| {
+                            eprintln!("Failed to call disconnect on l2cap channel: {e}");
+                            e
+                        })?;
+                    }
+                    return Ok(());
+                }
+
+                println!("{}", format!("<<< [TCP DATA]: {len} bytes").blue());
+                match l2cap_channel.lock().await.as_mut() {
+                    None => {
+                        println!("{}", "!!! L2CAP channel not connected, dropping".red());
+                        return Ok(());
+                    }
+                    Some(channel) => {
+                        channel.write(&buf[..len])?;
+                        if drain_l2cap_after_write {
+                            channel.drain().await?;
+                        }
+                    }
+                }
+            }
+            Err(e) => {
+                println!("{}", format!("!!! TCP connection lost: {}", e).red());
+                if let Some(mut channel) = l2cap_channel.lock().await.take() {
+                    let _ = channel.disconnect().await.map_err(|e| {
+                        eprintln!("Failed to call disconnect on l2cap channel: {e}");
+                    });
+                }
+                return Err(e.into());
+            }
+        }
+    }
+}
+
+/// Copies the current thread's TaskLocals into a Python "awaitable" and encapsulates it in a Rust
+/// future, running it as a Python Task.
+/// `TaskLocals` stores the current event loop, and allows the user to copy the current Python
+/// context if necessary. In this case, the python event loop is used when calling `disconnect` on
+/// an l2cap connection, or else the call will fail.
+pub fn run_future_with_current_task_locals<F>(
+    fut: F,
+) -> PyResult<impl Future<Output = PyResult<PyObject>> + Send>
+where
+    F: Future<Output = PyResult<()>> + Send + 'static,
+{
+    Python::with_gil(|py| {
+        let locals = pyo3_asyncio::tokio::get_current_locals(py)?;
+        let future = pyo3_asyncio::tokio::scope(locals.clone(), fut);
+        pyo3_asyncio::tokio::future_into_py_with_locals(py, locals, future)
+            .and_then(pyo3_asyncio::tokio::into_future)
+    })
+}
--- a/rust/src/cli/l2cap/server_bridge.rs
+++ b/rust/src/cli/l2cap/server_bridge.rs
@@ -0,0 +1,205 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/// L2CAP CoC server bridge: waits for a peer to connect an L2CAP CoC channel
+/// on a specified PSM. When the connection is made, the bridge connects a TCP
+/// socket to a remote host and bridges the data in both directions, with flow
+/// control.
+/// When the L2CAP CoC channel is closed, the bridge disconnects the TCP socket
+/// and waits for a new L2CAP CoC channel to be connected.
+/// When the TCP connection is closed by the TCP server, the L2CAP connection is closed as well.
+use crate::cli::l2cap::{
+    proxy_l2cap_rx_to_tcp_tx, proxy_tcp_rx_to_l2cap_tx, run_future_with_current_task_locals,
+    BridgeData,
+};
+use bumble::wrapper::{device::Device, hci::HciConstant, l2cap::LeConnectionOrientedChannel};
+use futures::executor::block_on;
+use owo_colors::OwoColorize;
+use pyo3::{PyResult, Python};
+use std::{sync::Arc, time::Duration};
+use tokio::{
+    join,
+    net::TcpStream,
+    select,
+    sync::{mpsc, Mutex},
+};
+
+pub struct Args {
+    pub psm: u16,
+    pub max_credits: Option<u16>,
+    pub mtu: Option<u16>,
+    pub mps: Option<u16>,
+    pub tcp_host: String,
+    pub tcp_port: u16,
+}
+
+pub async fn start(args: &Args, device: &mut Device) -> PyResult<()> {
+    let host = args.tcp_host.clone();
+    let port = args.tcp_port;
+    device.register_l2cap_channel_server(
+        args.psm,
+        move |_py, l2cap_channel| {
+            let channel_info = l2cap_channel
+                .debug_string()
+                .unwrap_or_else(|e| format!("failed to get l2cap channel info ({e})"));
+            println!("{} {channel_info}", "*** L2CAP channel:".cyan());
+
+            let host = host.clone();
+            // Ensure Python event loop is available to l2cap `disconnect`
+            let _ = run_future_with_current_task_locals(proxy_data_between_l2cap_and_tcp(
+                l2cap_channel,
+                host,
+                port,
+            ));
+            Ok(())
+        },
+        args.max_credits,
+        args.mtu,
+        args.mps,
+    )?;
+
+    println!(
+        "{}",
+        format!("### Listening for CoC connection on PSM {}", args.psm).yellow()
+    );
+
+    device.on_connection(|_py, mut connection| {
+        let connection_info = connection
+            .debug_string()
+            .unwrap_or_else(|e| format!("failed to get connection info ({e})"));
+        println!(
+            "{} {}",
+            "@@@ Bluetooth connection: ".green(),
+            connection_info,
+        );
+        connection.on_disconnection(|_py, reason| {
+            let disconnection_info = match HciConstant::error_name(reason) {
+                Ok(info_string) => info_string,
+                Err(py_err) => format!("failed to get disconnection error name ({})", py_err),
+            };
+            println!(
+                "{} {}",
+                "@@@ Bluetooth disconnection: ".red(),
+                disconnection_info,
+            );
+            Ok(())
+        })?;
+        Ok(())
+    })?;
+
+    device.start_advertising(false).await?;
+
+    Ok(())
+}
+
+async fn proxy_data_between_l2cap_and_tcp(
+    mut l2cap_channel: LeConnectionOrientedChannel,
+    tcp_host: String,
+    tcp_port: u16,
+) -> PyResult<()> {
+    let (l2cap_to_tcp_tx, mut l2cap_to_tcp_rx) = mpsc::channel::<BridgeData>(10);
+
+    // Set callback (`set_sink`) for when l2cap data is received.
+    let l2cap_to_tcp_tx_clone = l2cap_to_tcp_tx.clone();
+    l2cap_channel
+        .set_sink(move |_py, sdu| {
+            block_on(l2cap_to_tcp_tx_clone.send(BridgeData::Data(sdu.into())))
+                .expect("failed to channel data to tcp");
+            Ok(())
+        })
+        .expect("failed to set sink for l2cap connection");
+
+    // Set l2cap callback for when the channel is closed.
+    l2cap_channel
+        .on_close(move |_py| {
+            println!("{}", "*** L2CAP channel closed".red());
+            block_on(l2cap_to_tcp_tx.send(BridgeData::CloseSignal))
+                .expect("failed to channel close signal to tcp");
+            Ok(())
+        })
+        .expect("failed to set on_close callback for l2cap channel");
+
+    println!(
+        "{}",
+        format!("### Connecting to TCP {tcp_host}:{tcp_port}...").yellow()
+    );
+
+    let l2cap_channel = Arc::new(Mutex::new(Some(l2cap_channel)));
+    let tcp_stream = match TcpStream::connect(format!("{tcp_host}:{tcp_port}")).await {
+        Ok(stream) => {
+            println!("{}", "### Connected".green());
+            Some(stream)
+        }
+        Err(err) => {
+            println!("{}", format!("!!! Connection failed: {err}").red());
+            if let Some(mut channel) = l2cap_channel.lock().await.take() {
+                // Bumble might enter an invalid state if disconnection request is received from
+                // l2cap client before receiving a disconnection response from the same client,
+                // blocking this async call from returning.
+                // See: https://github.com/google/bumble/issues/257
+                select! {
+                    res = channel.disconnect() => {
+                        let _ = res.map_err(|e| eprintln!("Failed to call disconnect on l2cap channel: {e}"));
+                    },
+                    _ = tokio::time::sleep(Duration::from_secs(1)) => eprintln!("Timed out while calling disconnect on l2cap channel."),
+                }
+            }
+            None
+        }
+    };
+
+    match tcp_stream {
+        None => {
+            while let Some(bridge_data) = l2cap_to_tcp_rx.recv().await {
+                match bridge_data {
+                    BridgeData::Data(sdu) => {
+                        println!("{}", format!("<<< [L2CAP SDU]: {} bytes", sdu.len()).cyan());
+                        println!("{}", "!!! TCP socket not open, dropping".red())
+                    }
+                    BridgeData::CloseSignal => break,
+                }
+            }
+        }
+        Some(tcp_stream) => {
+            let (tcp_reader, tcp_writer) = tcp_stream.into_split();
+
+            // Do tcp stuff when something happens on the l2cap channel.
+            let handle_l2cap_data_future =
+                proxy_l2cap_rx_to_tcp_tx(l2cap_to_tcp_rx, tcp_writer, l2cap_channel.clone());
+
+            // Do l2cap stuff when something happens on tcp.
+            let handle_tcp_data_future =
+                proxy_tcp_rx_to_l2cap_tx(tcp_reader, l2cap_channel.clone(), false);
+
+            let (handle_l2cap_result, handle_tcp_result) =
+                join!(handle_l2cap_data_future, handle_tcp_data_future);
+
+            if let Err(e) = handle_l2cap_result {
+                println!("!!! Error: {e}");
+            }
+
+            if let Err(e) = handle_tcp_result {
+                println!("!!! Error: {e}");
+            }
+        }
+    };
+
+    Python::with_gil(|_| {
+        // Must hold GIL at least once while/after dropping for Python heap object to ensure
+        // de-allocation.
+        drop(l2cap_channel);
+    });
+
+    Ok(())
+}
--- a/rust/src/cli/mod.rs
+++ b/rust/src/cli/mod.rs
@@ -0,0 +1,19 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub(crate) mod firmware;
+
+pub(crate) mod usb;
+
+pub(crate) mod l2cap;
--- a/rust/examples/usb_probe.rs
+++ b/rust/examples/usb_probe.rs
@@ -23,7 +23,6 @@
 //! whether it is a Bluetooth device that uses a non-standard Class, or some other
 //! type of device (there's no way to tell).

-use clap::Parser as _;
 use itertools::Itertools as _;
 use owo_colors::{OwoColorize, Style};
 use rusb::{Device, DeviceDescriptor, Direction, TransferType, UsbContext};
@@ -31,15 +30,12 @@ use std::{
    collections::{HashMap, HashSet},
    time::Duration,
 };
-
 const USB_DEVICE_CLASS_DEVICE: u8 = 0x00;
 const USB_DEVICE_CLASS_WIRELESS_CONTROLLER: u8 = 0xE0;
 const USB_DEVICE_SUBCLASS_RF_CONTROLLER: u8 = 0x01;
 const USB_DEVICE_PROTOCOL_BLUETOOTH_PRIMARY_CONTROLLER: u8 = 0x01;

-fn main() -> anyhow::Result<()> {
-    let cli = Cli::parse();
-
+pub(crate) fn probe(verbose: bool) -> anyhow::Result<()> {
    let mut bt_dev_count = 0;
    let mut device_serials_by_id: HashMap<(u16, u16), HashSet<String>> = HashMap::new();
    for device in rusb::devices()?.iter() {
@@ -159,7 +155,7 @@ fn main() -> anyhow::Result<()> {
            println!("{:26}{}", "  Product:".green(), p);
        }

-        if cli.verbose {
+        if verbose {
            print_device_details(&device, &device_desc)?;
        }

@@ -332,11 +328,3 @@ impl From<&DeviceDescriptor> for ClassInfo {
        )
    }
 }
-
-#[derive(clap::Parser)]
-#[command(author, version, about, long_about = None)]
-struct Cli {
-    /// Show additional info for each USB device
-    #[arg(long, default_value_t = false)]
-    verbose: bool,
-}
--- a/rust/src/internal/drivers/mod.rs
+++ b/rust/src/internal/drivers/mod.rs
@@ -0,0 +1,17 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Device drivers
+
+pub(crate) mod rtk;
--- a/rust/src/internal/drivers/rtk.rs
+++ b/rust/src/internal/drivers/rtk.rs
@@ -0,0 +1,253 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Drivers for Realtek controllers
+
+use nom::{bytes, combinator, error, multi, number, sequence};
+
+/// Realtek firmware file contents
+pub struct Firmware {
+    version: u32,
+    project_id: u8,
+    patches: Vec<Patch>,
+}
+
+impl Firmware {
+    /// Parse a `*_fw.bin` file
+    pub fn parse(input: &[u8]) -> Result<Self, nom::Err<error::Error<&[u8]>>> {
+        let extension_sig = [0x51, 0x04, 0xFD, 0x77];
+
+        let (_rem, (_tag, fw_version, patch_count, payload)) =
+            combinator::all_consuming(combinator::map_parser(
+                // ignore the sig suffix
+                sequence::terminated(
+                    bytes::complete::take(
+                        // underflow will show up as parse failure
+                        input.len().saturating_sub(extension_sig.len()),
+                    ),
+                    bytes::complete::tag(extension_sig.as_slice()),
+                ),
+                sequence::tuple((
+                    bytes::complete::tag(b"Realtech"),
+                    // version
+                    number::complete::le_u32,
+                    // patch count
+                    combinator::map(number::complete::le_u16, |c| c as usize),
+                    // everything else except suffix
+                    combinator::rest,
+                )),
+            ))(input)?;
+
+        // ignore remaining input, since patch offsets are relative to the complete input
+        let (_rem, (chip_ids, patch_lengths, patch_offsets)) = sequence::tuple((
+            // chip id
+            multi::many_m_n(patch_count, patch_count, number::complete::le_u16),
+            // patch length
+            multi::many_m_n(patch_count, patch_count, number::complete::le_u16),
+            // patch offset
+            multi::many_m_n(patch_count, patch_count, number::complete::le_u32),
+        ))(payload)?;
+
+        let patches = chip_ids
+            .into_iter()
+            .zip(patch_lengths.into_iter())
+            .zip(patch_offsets.into_iter())
+            .map(|((chip_id, patch_length), patch_offset)| {
+                combinator::map(
+                    sequence::preceded(
+                        bytes::complete::take(patch_offset),
+                        // ignore trailing 4-byte suffix
+                        sequence::terminated(
+                            // patch including svn version, but not suffix
+                            combinator::consumed(sequence::preceded(
+                                // patch before svn version or version suffix
+                                // prefix length underflow will show up as parse failure
+                                bytes::complete::take(patch_length.saturating_sub(8)),
+                                // svn version
+                                number::complete::le_u32,
+                            )),
+                            // dummy suffix, overwritten with firmware version
+                            bytes::complete::take(4_usize),
+                        ),
+                    ),
+                    |(patch_contents_before_version, svn_version): (&[u8], u32)| {
+                        let mut contents = patch_contents_before_version.to_vec();
+                        // replace what would have been the trailing dummy suffix with fw version
+                        contents.extend_from_slice(&fw_version.to_le_bytes());
+
+                        Patch {
+                            contents,
+                            svn_version,
+                            chip_id,
+                        }
+                    },
+                )(input)
+                .map(|(_rem, output)| output)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+
+        // look for project id from the end
+        let mut offset = payload.len();
+        let mut project_id: Option<u8> = None;
+        while offset >= 2 {
+            // Won't panic, since offset >= 2
+            let chunk = &payload[offset - 2..offset];
+            let length: usize = chunk[0].into();
+            let opcode = chunk[1];
+            offset -= 2;
+
+            if opcode == 0xFF {
+                break;
+            }
+            if length == 0 {
+                // report what nom likely would have done, if nom was good at parsing backwards
+                return Err(nom::Err::Error(error::Error::new(
+                    chunk,
+                    error::ErrorKind::Verify,
+                )));
+            }
+            if opcode == 0 && length == 1 {
+                project_id = offset
+                    .checked_sub(1)
+                    .and_then(|index| payload.get(index))
+                    .copied();
+                break;
+            }
+
+            offset -= length;
+        }
+
+        match project_id {
+            Some(project_id) => Ok(Firmware {
+                project_id,
+                version: fw_version,
+                patches,
+            }),
+            None => {
+                // we ran out of file without finding a project id
+                Err(nom::Err::Error(error::Error::new(
+                    payload,
+                    error::ErrorKind::Eof,
+                )))
+            }
+        }
+    }
+
+    /// Patch version
+    pub fn version(&self) -> u32 {
+        self.version
+    }
+
+    /// Project id
+    pub fn project_id(&self) -> u8 {
+        self.project_id
+    }
+
+    /// Patches
+    pub fn patches(&self) -> &[Patch] {
+        &self.patches
+    }
+}
+
+/// Patch in a [Firmware}
+pub struct Patch {
+    chip_id: u16,
+    contents: Vec<u8>,
+    svn_version: u32,
+}
+
+impl Patch {
+    /// Chip id
+    pub fn chip_id(&self) -> u16 {
+        self.chip_id
+    }
+    /// Contents of the patch, including the 4-byte firmware version suffix
+    pub fn contents(&self) -> &[u8] {
+        &self.contents
+    }
+    /// SVN version
+    pub fn svn_version(&self) -> u32 {
+        self.svn_version
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use anyhow::anyhow;
+    use std::{fs, io, path};
+
+    #[test]
+    fn parse_firmware_rtl8723b() -> anyhow::Result<()> {
+        let fw = Firmware::parse(&firmware_contents("rtl8723b_fw_structure.bin")?)
+            .map_err(|e| anyhow!("{:?}", e))?;
+
+        let fw_version = 0x0E2F9F73;
+        assert_eq!(fw_version, fw.version());
+        assert_eq!(0x0001, fw.project_id());
+        assert_eq!(
+            vec![(0x0001, 0x00002BBF, 22368,), (0x0002, 0x00002BBF, 22496,),],
+            patch_summaries(fw, fw_version)
+        );
+
+        Ok(())
+    }
+
+    #[test]
+    fn parse_firmware_rtl8761bu() -> anyhow::Result<()> {
+        let fw = Firmware::parse(&firmware_contents("rtl8761bu_fw_structure.bin")?)
+            .map_err(|e| anyhow!("{:?}", e))?;
+
+        let fw_version = 0xDFC6D922;
+        assert_eq!(fw_version, fw.version());
+        assert_eq!(0x000E, fw.project_id());
+        assert_eq!(
+            vec![(0x0001, 0x00005060, 14048,), (0x0002, 0xD6D525A4, 30204,),],
+            patch_summaries(fw, fw_version)
+        );
+
+        Ok(())
+    }
+
+    fn firmware_contents(filename: &str) -> io::Result<Vec<u8>> {
+        fs::read(
+            path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                .join("resources/test/firmware/realtek")
+                .join(filename),
+        )
+    }
+
+    /// Return a tuple of (chip id, svn version, contents len, contents sha256)
+    fn patch_summaries(fw: Firmware, fw_version: u32) -> Vec<(u16, u32, usize)> {
+        fw.patches()
+            .iter()
+            .map(|p| {
+                let contents = p.contents();
+                let mut dummy_contents = dummy_contents(contents.len());
+                dummy_contents.extend_from_slice(&p.svn_version().to_le_bytes());
+                dummy_contents.extend_from_slice(&fw_version.to_le_bytes());
+                assert_eq!(&dummy_contents, contents);
+                (p.chip_id(), p.svn_version(), contents.len())
+            })
+            .collect::<Vec<_>>()
+    }
+
+    fn dummy_contents(len: usize) -> Vec<u8> {
+        let mut vec = (len as u32).to_le_bytes().as_slice().repeat(len / 4 + 1);
+        assert!(vec.len() >= len);
+        // leave room for svn version and firmware version
+        vec.truncate(len - 8);
+        vec
+    }
+}
--- a/rust/src/internal/mod.rs
+++ b/rust/src/internal/mod.rs
@@ -0,0 +1,20 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! It's not clear where to put Rust code that isn't simply a wrapper around Python. Until we have
+//! a good answer for what to do there, the idea is to put it in this (non-public) module, and
+//! `pub use` it into the relevant areas of the `wrapper` module so that it's still easy for users
+//! to discover.
+
+pub(crate) mod drivers;
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -29,3 +29,5 @@
 pub mod wrapper;

 pub mod adv;
+
+pub(crate) mod internal;
--- a/rust/src/main.rs
+++ b/rust/src/main.rs
@@ -0,0 +1,271 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! CLI tools for Bumble
+
+#![deny(missing_docs, unsafe_code)]
+
+use bumble::wrapper::logging::{bumble_env_logging_level, py_logging_basic_config};
+use clap::Parser as _;
+use pyo3::PyResult;
+use std::{fmt, path};
+
+mod cli;
+
+#[pyo3_asyncio::tokio::main]
+async fn main() -> PyResult<()> {
+    env_logger::builder()
+        .filter_level(log::LevelFilter::Info)
+        .init();
+
+    py_logging_basic_config(bumble_env_logging_level("INFO"))?;
+
+    let cli: Cli = Cli::parse();
+
+    match cli.subcommand {
+        Subcommand::Firmware { subcommand: fw } => match fw {
+            Firmware::Realtek { subcommand: rtk } => match rtk {
+                Realtek::Download(dl) => {
+                    cli::firmware::rtk::download(dl).await?;
+                }
+                Realtek::Drop { transport } => cli::firmware::rtk::drop(&transport).await?,
+                Realtek::Info { transport, force } => {
+                    cli::firmware::rtk::info(&transport, force).await?;
+                }
+                Realtek::Load { transport, force } => {
+                    cli::firmware::rtk::load(&transport, force).await?
+                }
+                Realtek::Parse { firmware_path } => cli::firmware::rtk::parse(&firmware_path)?,
+            },
+        },
+        Subcommand::L2cap {
+            subcommand,
+            device_config,
+            transport,
+            psm,
+            l2cap_coc_max_credits,
+            l2cap_coc_mtu,
+            l2cap_coc_mps,
+        } => {
+            cli::l2cap::run(
+                subcommand,
+                device_config,
+                transport,
+                psm,
+                l2cap_coc_max_credits,
+                l2cap_coc_mtu,
+                l2cap_coc_mps,
+            )
+            .await?
+        }
+        Subcommand::Usb { subcommand } => match subcommand {
+            Usb::Probe(probe) => cli::usb::probe(probe.verbose)?,
+        },
+    }
+
+    Ok(())
+}
+
+#[derive(clap::Parser)]
+struct Cli {
+    #[clap(subcommand)]
+    subcommand: Subcommand,
+}
+
+#[derive(clap::Subcommand, Debug, Clone)]
+enum Subcommand {
+    /// Manage device firmware
+    Firmware {
+        #[clap(subcommand)]
+        subcommand: Firmware,
+    },
+    /// L2cap client/server operations
+    L2cap {
+        #[command(subcommand)]
+        subcommand: L2cap,
+
+        /// Device configuration file.
+        ///
+        /// See, for instance, `examples/device1.json` in the Python project.
+        #[arg(long)]
+        device_config: path::PathBuf,
+        /// Bumble transport spec.
+        ///
+        /// <https://google.github.io/bumble/transports/index.html>
+        #[arg(long)]
+        transport: String,
+
+        /// PSM for L2CAP Connection-oriented Channel.
+        ///
+        /// Must be in the range [0, 65535].
+        #[arg(long)]
+        psm: u16,
+
+        /// Maximum L2CAP CoC Credits. When not specified, lets Bumble set the default.
+        ///
+        /// Must be in the range [1, 65535].
+        #[arg(long, value_parser = clap::value_parser!(u16).range(1..))]
+        l2cap_coc_max_credits: Option<u16>,
+
+        /// L2CAP CoC MTU. When not specified, lets Bumble set the default.
+        ///
+        /// Must be in the range [23, 65535].
+        #[arg(long, value_parser = clap::value_parser!(u16).range(23..))]
+        l2cap_coc_mtu: Option<u16>,
+
+        /// L2CAP CoC MPS. When not specified, lets Bumble set the default.
+        ///
+        /// Must be in the range [23, 65535].
+        #[arg(long, value_parser = clap::value_parser!(u16).range(23..))]
+        l2cap_coc_mps: Option<u16>,
+    },
+    /// USB operations
+    Usb {
+        #[clap(subcommand)]
+        subcommand: Usb,
+    },
+}
+
+#[derive(clap::Subcommand, Debug, Clone)]
+enum Firmware {
+    /// Manage Realtek chipset firmware
+    Realtek {
+        #[clap(subcommand)]
+        subcommand: Realtek,
+    },
+}
+
+#[derive(clap::Subcommand, Debug, Clone)]
+
+enum Realtek {
+    /// Download Realtek firmware
+    Download(Download),
+    /// Drop firmware from a USB device
+    Drop {
+        /// Bumble transport spec. Must be for a USB device.
+        ///
+        /// <https://google.github.io/bumble/transports/index.html>
+        #[arg(long)]
+        transport: String,
+    },
+    /// Show driver info for a USB device
+    Info {
+        /// Bumble transport spec. Must be for a USB device.
+        ///
+        /// <https://google.github.io/bumble/transports/index.html>
+        #[arg(long)]
+        transport: String,
+        /// Try to resolve driver info even if USB info is not available, or if the USB
+        /// (vendor,product) tuple is not in the list of known compatible RTK USB dongles.
+        #[arg(long, default_value_t = false)]
+        force: bool,
+    },
+    /// Load firmware onto a USB device
+    Load {
+        /// Bumble transport spec. Must be for a USB device.
+        ///
+        /// <https://google.github.io/bumble/transports/index.html>
+        #[arg(long)]
+        transport: String,
+        /// Load firmware even if the USB info doesn't match.
+        #[arg(long, default_value_t = false)]
+        force: bool,
+    },
+    /// Parse a firmware file
+    Parse {
+        /// Firmware file to parse
+        firmware_path: path::PathBuf,
+    },
+}
+
+#[derive(clap::Args, Debug, Clone)]
+struct Download {
+    /// Directory to download to. Defaults to an OS-specific path specific to the Bumble tool.
+    #[arg(long)]
+    output_dir: Option<path::PathBuf>,
+    /// Source to download from
+    #[arg(long, default_value_t = Source::LinuxKernel)]
+    source: Source,
+    /// Only download a single image
+    #[arg(long, value_name = "base name")]
+    single: Option<String>,
+    /// Overwrite existing files
+    #[arg(long, default_value_t = false)]
+    overwrite: bool,
+    /// Don't print the parse results for the downloaded file names
+    #[arg(long)]
+    no_parse: bool,
+}
+
+#[derive(Debug, Clone, clap::ValueEnum)]
+enum Source {
+    LinuxKernel,
+    RealtekOpensource,
+    LinuxFromScratch,
+}
+
+impl fmt::Display for Source {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Source::LinuxKernel => write!(f, "linux-kernel"),
+            Source::RealtekOpensource => write!(f, "realtek-opensource"),
+            Source::LinuxFromScratch => write!(f, "linux-from-scratch"),
+        }
+    }
+}
+
+#[derive(clap::Subcommand, Debug, Clone)]
+enum L2cap {
+    /// Starts an L2CAP server
+    Server {
+        /// TCP host that the l2cap server will connect to.
+        /// Data is bridged like so:
+        ///     TCP server <-> (TCP client / **L2CAP server**) <-> (L2CAP client / TCP server) <-> TCP client
+        #[arg(long, default_value = "localhost")]
+        tcp_host: String,
+        /// TCP port that the server will connect to.
+        ///
+        /// Must be in the range [1, 65535].
+        #[arg(long, default_value_t = 9544)]
+        tcp_port: u16,
+    },
+    /// Starts an L2CAP client
+    Client {
+        /// L2cap server address that this l2cap client will connect to.
+        bluetooth_address: String,
+        /// TCP host that the l2cap client will bind to and listen for incoming TCP connections.
+        /// Data is bridged like so:
+        ///     TCP client <-> (TCP server / **L2CAP client**) <-> (L2CAP server / TCP client) <-> TCP server
+        #[arg(long, default_value = "localhost")]
+        tcp_host: String,
+        /// TCP port that the client will connect to.
+        ///
+        /// Must be in the range [1, 65535].
+        #[arg(long, default_value_t = 9543)]
+        tcp_port: u16,
+    },
+}
+
+#[derive(clap::Subcommand, Debug, Clone)]
+enum Usb {
+    /// Probe the USB bus for Bluetooth devices
+    Probe(Probe),
+}
+
+#[derive(clap::Args, Debug, Clone)]
+struct Probe {
+    /// Show additional info for each USB device
+    #[arg(long, default_value_t = false)]
+    verbose: bool,
+}
--- a/rust/src/wrapper/device.rs
+++ b/rust/src/wrapper/device.rs
@@ -19,13 +19,19 @@ use crate::{
    wrapper::{
        core::AdvertisingData,
        gatt_client::{ProfileServiceProxy, ServiceProxy},
-        hci::Address,
+        hci::{Address, HciErrorCode},
+        host::Host,
+        l2cap::LeConnectionOrientedChannel,
        transport::{Sink, Source},
-        ClosureCallback,
+        ClosureCallback, PyDictExt, PyObjectExt,
    },
 };
-use pyo3::types::PyDict;
-use pyo3::{intern, types::PyModule, PyObject, PyResult, Python, ToPyObject};
+use pyo3::{
+    intern,
+    types::{PyDict, PyModule},
+    IntoPy, PyObject, PyResult, Python, ToPyObject,
+};
+use pyo3_asyncio::tokio::into_future;
 use std::path;

 /// A device that can send/receive HCI frames.
@@ -65,7 +71,7 @@ impl Device {
        Python::with_gil(|py| {
            self.0
                .call_method0(py, intern!(py, "power_on"))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .map(|_| ())
@@ -76,12 +82,28 @@ impl Device {
        Python::with_gil(|py| {
            self.0
                .call_method1(py, intern!(py, "connect"), (peer_addr,))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .map(Connection)
    }

+    /// Register a callback to be called for each incoming connection.
+    pub fn on_connection(
+        &mut self,
+        callback: impl Fn(Python, Connection) -> PyResult<()> + Send + 'static,
+    ) -> PyResult<()> {
+        let boxed = ClosureCallback::new(move |py, args, _kwargs| {
+            callback(py, Connection(args.get_item(0)?.into()))
+        });
+
+        Python::with_gil(|py| {
+            self.0
+                .call_method1(py, intern!(py, "add_listener"), ("connection", boxed))
+        })
+        .map(|_| ())
+    }
+
    /// Start scanning
    pub async fn start_scanning(&self, filter_duplicates: bool) -> PyResult<()> {
        Python::with_gil(|py| {
@@ -89,7 +111,7 @@ impl Device {
            kwargs.set_item("filter_duplicates", filter_duplicates)?;
            self.0
                .call_method(py, intern!(py, "start_scanning"), (), Some(kwargs))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .map(|_| ())
@@ -123,6 +145,15 @@ impl Device {
        .map(|_| ())
    }

+    /// Returns the host used by the device, if any
+    pub fn host(&mut self) -> PyResult<Option<Host>> {
+        Python::with_gil(|py| {
+            self.0
+                .getattr(py, intern!(py, "host"))
+                .map(|obj| obj.into_option(Host::from))
+        })
+    }
+
    /// Start advertising the data set with [Device.set_advertisement].
    pub async fn start_advertising(&mut self, auto_restart: bool) -> PyResult<()> {
        Python::with_gil(|py| {
@@ -131,7 +162,7 @@ impl Device {

            self.0
                .call_method(py, intern!(py, "start_advertising"), (), Some(kwargs))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .map(|_| ())
@@ -142,16 +173,114 @@ impl Device {
        Python::with_gil(|py| {
            self.0
                .call_method0(py, intern!(py, "stop_advertising"))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .map(|_| ())
    }
+
+    /// Registers an L2CAP connection oriented channel server. When a client connects to the server,
+    /// the `server` callback is passed a handle to the established channel. When optional arguments
+    /// are not specified, the Python module specifies the defaults.
+    pub fn register_l2cap_channel_server(
+        &mut self,
+        psm: u16,
+        server: impl Fn(Python, LeConnectionOrientedChannel) -> PyResult<()> + Send + 'static,
+        max_credits: Option<u16>,
+        mtu: Option<u16>,
+        mps: Option<u16>,
+    ) -> PyResult<()> {
+        Python::with_gil(|py| {
+            let boxed = ClosureCallback::new(move |py, args, _kwargs| {
+                server(
+                    py,
+                    LeConnectionOrientedChannel::from(args.get_item(0)?.into()),
+                )
+            });
+
+            let kwargs = PyDict::new(py);
+            kwargs.set_item("psm", psm)?;
+            kwargs.set_item("server", boxed.into_py(py))?;
+            kwargs.set_opt_item("max_credits", max_credits)?;
+            kwargs.set_opt_item("mtu", mtu)?;
+            kwargs.set_opt_item("mps", mps)?;
+            self.0.call_method(
+                py,
+                intern!(py, "register_l2cap_channel_server"),
+                (),
+                Some(kwargs),
+            )
+        })?;
+        Ok(())
+    }
 }

 /// A connection to a remote device.
 pub struct Connection(PyObject);

+impl Connection {
+    /// Open an L2CAP channel using this connection. When optional arguments are not specified, the
+    /// Python module specifies the defaults.
+    pub async fn open_l2cap_channel(
+        &mut self,
+        psm: u16,
+        max_credits: Option<u16>,
+        mtu: Option<u16>,
+        mps: Option<u16>,
+    ) -> PyResult<LeConnectionOrientedChannel> {
+        Python::with_gil(|py| {
+            let kwargs = PyDict::new(py);
+            kwargs.set_item("psm", psm)?;
+            kwargs.set_opt_item("max_credits", max_credits)?;
+            kwargs.set_opt_item("mtu", mtu)?;
+            kwargs.set_opt_item("mps", mps)?;
+            self.0
+                .call_method(py, intern!(py, "open_l2cap_channel"), (), Some(kwargs))
+                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(LeConnectionOrientedChannel::from)
+    }
+
+    /// Disconnect from device with provided reason. When optional arguments are not specified, the
+    /// Python module specifies the defaults.
+    pub async fn disconnect(&mut self, reason: Option<HciErrorCode>) -> PyResult<()> {
+        Python::with_gil(|py| {
+            let kwargs = PyDict::new(py);
+            kwargs.set_opt_item("reason", reason)?;
+            self.0
+                .call_method(py, intern!(py, "disconnect"), (), Some(kwargs))
+                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(|_| ())
+    }
+
+    /// Register a callback to be called on disconnection.
+    pub fn on_disconnection(
+        &mut self,
+        callback: impl Fn(Python, HciErrorCode) -> PyResult<()> + Send + 'static,
+    ) -> PyResult<()> {
+        let boxed = ClosureCallback::new(move |py, args, _kwargs| {
+            callback(py, args.get_item(0)?.extract()?)
+        });
+
+        Python::with_gil(|py| {
+            self.0
+                .call_method1(py, intern!(py, "add_listener"), ("disconnection", boxed))
+        })
+        .map(|_| ())
+    }
+
+    /// Returns some information about the connection as a [String].
+    pub fn debug_string(&self) -> PyResult<String> {
+        Python::with_gil(|py| {
+            let str_obj = self.0.call_method0(py, intern!(py, "__str__"))?;
+            str_obj.gil_ref(py).extract()
+        })
+    }
+}
+
 /// The other end of a connection
 pub struct Peer(PyObject);

@@ -173,7 +302,7 @@ impl Peer {
        Python::with_gil(|py| {
            self.0
                .call_method0(py, intern!(py, "discover_services"))
-                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
        })?
        .await
        .and_then(|list| {
@@ -207,13 +336,7 @@ impl Peer {
            let class = module.getattr(P::PROXY_CLASS_NAME)?;
            self.0
                .call_method1(py, intern!(py, "create_service_proxy"), (class,))
-                .map(|obj| {
-                    if obj.is_none(py) {
-                        None
-                    } else {
-                        Some(P::wrap(obj))
-                    }
-                })
+                .map(|obj| obj.into_option(P::wrap))
        })
    }
 }
--- a/rust/src/wrapper/drivers/mod.rs
+++ b/rust/src/wrapper/drivers/mod.rs
@@ -0,0 +1,17 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Device drivers
+
+pub mod rtk;
--- a/rust/src/wrapper/drivers/rtk.rs
+++ b/rust/src/wrapper/drivers/rtk.rs
@@ -0,0 +1,141 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Drivers for Realtek controllers
+
+use crate::wrapper::{host::Host, PyObjectExt};
+use pyo3::{intern, types::PyModule, PyObject, PyResult, Python, ToPyObject};
+use pyo3_asyncio::tokio::into_future;
+
+pub use crate::internal::drivers::rtk::{Firmware, Patch};
+
+/// Driver for a Realtek controller
+pub struct Driver(PyObject);
+
+impl Driver {
+    /// Locate the driver for the provided host.
+    pub async fn for_host(host: &Host, force: bool) -> PyResult<Option<Self>> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.drivers.rtk"))?
+                .getattr(intern!(py, "Driver"))?
+                .call_method1(intern!(py, "for_host"), (&host.obj, force))
+                .and_then(into_future)
+        })?
+        .await
+        .map(|obj| obj.into_option(Self))
+    }
+
+    /// Check if the host has a known driver.
+    pub async fn check(host: &Host) -> PyResult<bool> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.drivers.rtk"))?
+                .getattr(intern!(py, "Driver"))?
+                .call_method1(intern!(py, "check"), (&host.obj,))
+                .and_then(|obj| obj.extract::<bool>())
+        })
+    }
+
+    /// Find the [DriverInfo] for the host, if one matches
+    pub async fn driver_info_for_host(host: &Host) -> PyResult<Option<DriverInfo>> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.drivers.rtk"))?
+                .getattr(intern!(py, "Driver"))?
+                .call_method1(intern!(py, "driver_info_for_host"), (&host.obj,))
+                .and_then(into_future)
+        })?
+        .await
+        .map(|obj| obj.into_option(DriverInfo))
+    }
+
+    /// Send a command to the device to drop firmware
+    pub async fn drop_firmware(host: &mut Host) -> PyResult<()> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.drivers.rtk"))?
+                .getattr(intern!(py, "Driver"))?
+                .call_method1(intern!(py, "drop_firmware"), (&host.obj,))
+                .and_then(into_future)
+        })?
+        .await
+        .map(|_| ())
+    }
+
+    /// Load firmware onto the device.
+    pub async fn download_firmware(&mut self) -> PyResult<()> {
+        Python::with_gil(|py| {
+            self.0
+                .call_method0(py, intern!(py, "download_firmware"))
+                .and_then(|coroutine| into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(|_| ())
+    }
+}
+
+/// Metadata about a known driver & applicable device
+pub struct DriverInfo(PyObject);
+
+impl DriverInfo {
+    /// Returns a list of all drivers that Bumble knows how to handle.
+    pub fn all_drivers() -> PyResult<Vec<DriverInfo>> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.drivers.rtk"))?
+                .getattr(intern!(py, "Driver"))?
+                .getattr(intern!(py, "DRIVER_INFOS"))?
+                .iter()?
+                .map(|r| r.map(|h| DriverInfo(h.to_object(py))))
+                .collect::<PyResult<Vec<_>>>()
+        })
+    }
+
+    /// The firmware file name to load from the filesystem, e.g. `foo_fw.bin`.
+    pub fn firmware_name(&self) -> PyResult<String> {
+        Python::with_gil(|py| {
+            self.0
+                .getattr(py, intern!(py, "fw_name"))?
+                .as_ref(py)
+                .extract::<String>()
+        })
+    }
+
+    /// The config file name, if any, to load from the filesystem, e.g. `foo_config.bin`.
+    pub fn config_name(&self) -> PyResult<Option<String>> {
+        Python::with_gil(|py| {
+            let obj = self.0.getattr(py, intern!(py, "config_name"))?;
+            let handle = obj.as_ref(py);
+
+            if handle.is_none() {
+                Ok(None)
+            } else {
+                handle
+                    .extract::<String>()
+                    .map(|s| if s.is_empty() { None } else { Some(s) })
+            }
+        })
+    }
+
+    /// Whether or not config is required.
+    pub fn config_needed(&self) -> PyResult<bool> {
+        Python::with_gil(|py| {
+            self.0
+                .getattr(py, intern!(py, "config_needed"))?
+                .as_ref(py)
+                .extract::<bool>()
+        })
+    }
+
+    /// ROM id
+    pub fn rom(&self) -> PyResult<u32> {
+        Python::with_gil(|py| self.0.getattr(py, intern!(py, "rom"))?.as_ref(py).extract())
+    }
+}
--- a/rust/src/wrapper/hci.rs
+++ b/rust/src/wrapper/hci.rs
@@ -15,7 +15,40 @@
 //! HCI

 use itertools::Itertools as _;
-use pyo3::{exceptions::PyException, intern, types::PyModule, PyErr, PyObject, PyResult, Python};
+use pyo3::{
+    exceptions::PyException, intern, types::PyModule, FromPyObject, PyAny, PyErr, PyObject,
+    PyResult, Python, ToPyObject,
+};
+
+/// HCI error code.
+pub struct HciErrorCode(u8);
+
+impl<'source> FromPyObject<'source> for HciErrorCode {
+    fn extract(ob: &'source PyAny) -> PyResult<Self> {
+        Ok(HciErrorCode(ob.extract()?))
+    }
+}
+
+impl ToPyObject for HciErrorCode {
+    fn to_object(&self, py: Python<'_>) -> PyObject {
+        self.0.to_object(py)
+    }
+}
+
+/// Provides helpers for interacting with HCI
+pub struct HciConstant;
+
+impl HciConstant {
+    /// Human-readable error name
+    pub fn error_name(status: HciErrorCode) -> PyResult<String> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.hci"))?
+                .getattr(intern!(py, "HCI_Constant"))?
+                .call_method1(intern!(py, "error_name"), (status.0,))?
+                .extract()
+        })
+    }
+}

 /// A Bluetooth address
 pub struct Address(pub(crate) PyObject);
--- a/rust/src/wrapper/host.rs
+++ b/rust/src/wrapper/host.rs
@@ -0,0 +1,71 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Host-side types
+
+use crate::wrapper::transport::{Sink, Source};
+use pyo3::{intern, prelude::PyModule, types::PyDict, PyObject, PyResult, Python};
+
+/// Host HCI commands
+pub struct Host {
+    pub(crate) obj: PyObject,
+}
+
+impl Host {
+    /// Create a Host that wraps the provided obj
+    pub(crate) fn from(obj: PyObject) -> Self {
+        Self { obj }
+    }
+
+    /// Create a new Host
+    pub fn new(source: Source, sink: Sink) -> PyResult<Self> {
+        Python::with_gil(|py| {
+            PyModule::import(py, intern!(py, "bumble.host"))?
+                .getattr(intern!(py, "Host"))?
+                .call((source.0, sink.0), None)
+                .map(|any| Self { obj: any.into() })
+        })
+    }
+
+    /// Send a reset command and perform other reset tasks.
+    pub async fn reset(&mut self, driver_factory: DriverFactory) -> PyResult<()> {
+        Python::with_gil(|py| {
+            let kwargs = match driver_factory {
+                DriverFactory::None => {
+                    let kw = PyDict::new(py);
+                    kw.set_item("driver_factory", py.None())?;
+                    Some(kw)
+                }
+                DriverFactory::Auto => {
+                    // leave the default in place
+                    None
+                }
+            };
+            self.obj
+                .call_method(py, intern!(py, "reset"), (), kwargs)
+                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(|_| ())
+    }
+}
+
+/// Driver factory to use when initializing a host
+#[derive(Debug, Clone)]
+pub enum DriverFactory {
+    /// Do not load drivers
+    None,
+    /// Load appropriate driver, if any is found
+    Auto,
+}
--- a/rust/src/wrapper/l2cap.rs
+++ b/rust/src/wrapper/l2cap.rs
@@ -0,0 +1,92 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! L2CAP
+
+use crate::wrapper::{ClosureCallback, PyObjectExt};
+use pyo3::{intern, PyObject, PyResult, Python};
+
+/// L2CAP connection-oriented channel
+pub struct LeConnectionOrientedChannel(PyObject);
+
+impl LeConnectionOrientedChannel {
+    /// Create a LeConnectionOrientedChannel that wraps the provided obj.
+    pub(crate) fn from(obj: PyObject) -> Self {
+        Self(obj)
+    }
+
+    /// Queues data to be automatically sent across this channel.
+    pub fn write(&mut self, data: &[u8]) -> PyResult<()> {
+        Python::with_gil(|py| self.0.call_method1(py, intern!(py, "write"), (data,))).map(|_| ())
+    }
+
+    /// Wait for queued data to be sent on this channel.
+    pub async fn drain(&mut self) -> PyResult<()> {
+        Python::with_gil(|py| {
+            self.0
+                .call_method0(py, intern!(py, "drain"))
+                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(|_| ())
+    }
+
+    /// Register a callback to be called when the channel is closed.
+    pub fn on_close(
+        &mut self,
+        callback: impl Fn(Python) -> PyResult<()> + Send + 'static,
+    ) -> PyResult<()> {
+        let boxed = ClosureCallback::new(move |py, _args, _kwargs| callback(py));
+
+        Python::with_gil(|py| {
+            self.0
+                .call_method1(py, intern!(py, "add_listener"), ("close", boxed))
+        })
+        .map(|_| ())
+    }
+
+    /// Register a callback to be called when the channel receives data.
+    pub fn set_sink(
+        &mut self,
+        callback: impl Fn(Python, &[u8]) -> PyResult<()> + Send + 'static,
+    ) -> PyResult<()> {
+        let boxed = ClosureCallback::new(move |py, args, _kwargs| {
+            callback(py, args.get_item(0)?.extract()?)
+        });
+        Python::with_gil(|py| self.0.setattr(py, intern!(py, "sink"), boxed)).map(|_| ())
+    }
+
+    /// Disconnect the l2cap channel.
+    /// Must be called from a thread with a Python event loop, which should be true on
+    /// `tokio::main` and `async_std::main`.
+    ///
+    /// For more info, see https://awestlake87.github.io/pyo3-asyncio/master/doc/pyo3_asyncio/#event-loop-references-and-contextvars.
+    pub async fn disconnect(&mut self) -> PyResult<()> {
+        Python::with_gil(|py| {
+            self.0
+                .call_method0(py, intern!(py, "disconnect"))
+                .and_then(|coroutine| pyo3_asyncio::tokio::into_future(coroutine.as_ref(py)))
+        })?
+        .await
+        .map(|_| ())
+    }
+
+    /// Returns some information about the channel as a [String].
+    pub fn debug_string(&self) -> PyResult<String> {
+        Python::with_gil(|py| {
+            let str_obj = self.0.call_method0(py, intern!(py, "__str__"))?;
+            str_obj.gil_ref(py).extract()
+        })
+    }
+}
--- a/rust/src/wrapper/mod.rs
+++ b/rust/src/wrapper/mod.rs
@@ -31,14 +31,17 @@ pub use pyo3_asyncio;
 pub mod assigned_numbers;
 pub mod core;
 pub mod device;
+pub mod drivers;
 pub mod gatt_client;
 pub mod hci;
+pub mod host;
+pub mod l2cap;
 pub mod logging;
 pub mod profile;
 pub mod transport;

 /// Convenience extensions to [PyObject]
-pub trait PyObjectExt {
+pub trait PyObjectExt: Sized {
    /// Get a GIL-bound reference
    fn gil_ref<'py>(&'py self, py: Python<'py>) -> &'py PyAny;

@@ -49,6 +52,17 @@ pub trait PyObjectExt {
    {
        Python::with_gil(|py| self.gil_ref(py).extract::<T>())
    }
+
+    /// If the Python object is a Python `None`, return a Rust `None`, otherwise `Some` with the mapped type
+    fn into_option<T>(self, map_obj: impl Fn(Self) -> T) -> Option<T> {
+        Python::with_gil(|py| {
+            if self.gil_ref(py).is_none() {
+                None
+            } else {
+                Some(map_obj(self))
+            }
+        })
+    }
 }

 impl PyObjectExt for PyObject {
@@ -57,6 +71,21 @@ impl PyObjectExt for PyObject {
    }
 }

+/// Convenience extensions to [PyDict]
+pub trait PyDictExt {
+    /// Set item in dict only if value is Some, otherwise do nothing.
+    fn set_opt_item<K: ToPyObject, V: ToPyObject>(&self, key: K, value: Option<V>) -> PyResult<()>;
+}
+
+impl PyDictExt for PyDict {
+    fn set_opt_item<K: ToPyObject, V: ToPyObject>(&self, key: K, value: Option<V>) -> PyResult<()> {
+        if let Some(value) = value {
+            self.set_item(key, value)?
+        }
+        Ok(())
+    }
+}
+
 /// Wrapper to make Rust closures ([Fn] implementations) callable from Python.
 ///
 /// The Python callable form returns a Python `None`.
--- a/rust/src/wrapper/profile.rs
+++ b/rust/src/wrapper/profile.rs
@@ -14,7 +14,10 @@

 //! GATT profiles

-use crate::wrapper::gatt_client::{CharacteristicProxy, ProfileServiceProxy};
+use crate::wrapper::{
+    gatt_client::{CharacteristicProxy, ProfileServiceProxy},
+    PyObjectExt,
+};
 use pyo3::{intern, PyObject, PyResult, Python};

 /// Exposes the battery GATT service
@@ -26,13 +29,7 @@ impl BatteryServiceProxy {
        Python::with_gil(|py| {
            self.0
                .getattr(py, intern!(py, "battery_level"))
-                .map(|level| {
-                    if level.is_none(py) {
-                        None
-                    } else {
-                        Some(CharacteristicProxy(level))
-                    }
-                })
+                .map(|level| level.into_option(CharacteristicProxy))
        })
    }
 }
--- a/setup.cfg
+++ b/setup.cfg
@@ -32,17 +32,18 @@ package_dir =
 include_package_data = True
 install_requires =
    aiohttp ~= 3.8; platform_system!='Emscripten'
-    appdirs >= 1.4
-    bt-test-interfaces >= 0.0.2
+    appdirs >= 1.4; platform_system!='Emscripten'
+    bt-test-interfaces >= 0.0.2; platform_system!='Emscripten'
    click == 8.1.3; platform_system!='Emscripten'
-    cryptography == 35; platform_system!='Emscripten'
-    grpcio == 1.51.1; platform_system!='Emscripten'
-    humanize >= 4.6.0
+    cryptography == 39; platform_system!='Emscripten'
+    grpcio == 1.57.0; platform_system!='Emscripten'
+    humanize >= 4.6.0; platform_system!='Emscripten'
    libusb1 >= 2.0.1; platform_system!='Emscripten'
    libusb-package == 1.0.26.1; platform_system!='Emscripten'
+    platformdirs == 3.10.0; platform_system!='Emscripten'
    prompt_toolkit >= 3.0.16; platform_system!='Emscripten'
-    prettytable >= 3.6.0
-    protobuf >= 3.12.4
+    prettytable >= 3.6.0; platform_system!='Emscripten'
+    protobuf >= 3.12.4; platform_system!='Emscripten'
    pyee >= 8.2.2
    pyserial-asyncio >= 0.5; platform_system!='Emscripten'
    pyserial >= 3.5; platform_system!='Emscripten'
@@ -81,7 +82,7 @@ test =
    coverage >= 6.4
 development =
    black == 22.10
-    grpcio-tools >= 1.51.1
+    grpcio-tools >= 1.57.0
    invoke >= 1.7.3
    mypy == 1.2.0
    nox >= 2022
--- a/speaker.html
+++ b/speaker.html
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>Audio WAV Player</title>
-  </head>
-  <body>
-    <h1>Audio WAV Player</h1>
-    <audio id="audioPlayer" controls>
-      <source src="" type="audio/wav">
-    </audio>
-
-    <script>
-      const audioPlayer = document.getElementById('audioPlayer');
-      const ws = new WebSocket('ws://localhost:8080');
-
-      let mediaSource = new MediaSource();
-      audioPlayer.src = URL.createObjectURL(mediaSource);
-
-      mediaSource.addEventListener('sourceopen', function(event) {
-        const sourceBuffer = mediaSource.addSourceBuffer('audio/wav');
-
-        ws.onmessage = function(event) {
-          sourceBuffer.appendBuffer(event.data);
-        };
-      });
-    </script>
-  </body>
-</html>
--- a/tasks.py
+++ b/tasks.py
@@ -177,3 +177,33 @@ project_tasks.add_task(lint)
 project_tasks.add_task(format_code, name="format")
 project_tasks.add_task(check_types, name="check-types")
 project_tasks.add_task(pre_commit)
+
+
+# -----------------------------------------------------------------------------
+# Web
+# -----------------------------------------------------------------------------
+web_tasks = Collection()
+ns.add_collection(web_tasks, name="web")
+
+
+# -----------------------------------------------------------------------------
+@task
+def serve(ctx, port=8000):
+    """
+    Run a simple HTTP server for the examples under the `web` directory.
+    """
+    import http.server
+
+    address = ("", port)
+
+    class Handler(http.server.SimpleHTTPRequestHandler):
+        def __init__(self, *args, **kwargs):
+            super().__init__(*args, directory="web", **kwargs)
+
+    server = http.server.HTTPServer(address, Handler)
+    print(f"Now serving on port {port} 🕸️")
+    server.serve_forever()
+
+
+# -----------------------------------------------------------------------------
+web_tasks.add_task(serve)
--- a/tests/init.py
+++ b/tests/init.py
@@ -0,0 +1,13 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
--- a/tests/hfp_test.py
+++ b/tests/hfp_test.py
@@ -0,0 +1,100 @@
+# Copyright 2021-2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# -----------------------------------------------------------------------------
+# Imports
+# -----------------------------------------------------------------------------
+import asyncio
+import logging
+import os
+import pytest
+
+from typing import Tuple
+
+from .test_utils import TwoDevices
+from bumble import hfp
+from bumble import rfcomm
+
+
+# -----------------------------------------------------------------------------
+# Logging
+# -----------------------------------------------------------------------------
+logger = logging.getLogger(__name__)
+
+
+# -----------------------------------------------------------------------------
+async def make_hfp_connections(
+    hf_config: hfp.Configuration,
+) -> Tuple[hfp.HfProtocol, hfp.HfpProtocol]:
+    # Setup devices
+    devices = TwoDevices()
+    await devices.setup_connection()
+
+    # Setup RFCOMM channel
+    wait_dlc = asyncio.get_running_loop().create_future()
+    rfcomm_channel = rfcomm.Server(devices.devices[0]).listen(
+        lambda dlc: wait_dlc.set_result(dlc)
+    )
+    assert devices.connections[0]
+    assert devices.connections[1]
+    client_mux = await rfcomm.Client(devices.devices[1], devices.connections[1]).start()
+
+    client_dlc = await client_mux.open_dlc(rfcomm_channel)
+    server_dlc = await wait_dlc
+
+    # Setup HFP connnection
+    hf = hfp.HfProtocol(client_dlc, hf_config)
+    ag = hfp.HfpProtocol(server_dlc)
+    return hf, ag
+
+
+# -----------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_slc():
+    hf_config = hfp.Configuration(
+        supported_hf_features=[], supported_hf_indicators=[], supported_audio_codecs=[]
+    )
+    hf, ag = await make_hfp_connections(hf_config)
+
+    async def ag_loop():
+        while line := await ag.next_line():
+            if line.startswith('AT+BRSF'):
+                ag.send_response_line('+BRSF: 0')
+            elif line.startswith('AT+CIND=?'):
+                ag.send_response_line(
+                    '+CIND: ("call",(0,1)),("callsetup",(0-3)),("service",(0-1)),'
+                    '("signal",(0-5)),("roam",(0,1)),("battchg",(0-5)),'
+                    '("callheld",(0-2))'
+                )
+            elif line.startswith('AT+CIND?'):
+                ag.send_response_line('+CIND: 0,0,1,4,1,5,0')
+            ag.send_response_line('OK')
+
+    ag_task = asyncio.create_task(ag_loop())
+
+    await hf.initiate_slc()
+    ag_task.cancel()
+
+
+# -----------------------------------------------------------------------------
+async def run():
+    await test_slc()
+
+
+# -----------------------------------------------------------------------------
+if __name__ == '__main__':
+    logging.basicConfig(level=os.environ.get('BUMBLE_LOGLEVEL', 'INFO').upper())
+    asyncio.run(run())
--- a/tests/l2cap_test.py
+++ b/tests/l2cap_test.py
@@ -21,13 +21,9 @@ import os
 import random
 import pytest

-from bumble.controller import Controller
-from bumble.link import LocalLink
-from bumble.device import Device
-from bumble.host import Host
-from bumble.transport import AsyncPipeSink
 from bumble.core import ProtocolError
 from bumble.l2cap import L2CAP_Connection_Request
+from .test_utils import TwoDevices


 # -----------------------------------------------------------------------------
@@ -37,60 +33,6 @@ logger = logging.getLogger(__name__)


 # -----------------------------------------------------------------------------
-class TwoDevices:
-    def __init__(self):
-        self.connections = [None, None]
-
-        self.link = LocalLink()
-        self.controllers = [
-            Controller('C1', link=self.link),
-            Controller('C2', link=self.link),
-        ]
-        self.devices = [
-            Device(
-                address='F0:F1:F2:F3:F4:F5',
-                host=Host(self.controllers[0], AsyncPipeSink(self.controllers[0])),
-            ),
-            Device(
-                address='F5:F4:F3:F2:F1:F0',
-                host=Host(self.controllers[1], AsyncPipeSink(self.controllers[1])),
-            ),
-        ]
-
-        self.paired = [None, None]
-
-    def on_connection(self, which, connection):
-        self.connections[which] = connection
-
-    def on_paired(self, which, keys):
-        self.paired[which] = keys
-
-
-# -----------------------------------------------------------------------------
-async def setup_connection():
-    # Create two devices, each with a controller, attached to the same link
-    two_devices = TwoDevices()
-
-    # Attach listeners
-    two_devices.devices[0].on(
-        'connection', lambda connection: two_devices.on_connection(0, connection)
-    )
-    two_devices.devices[1].on(
-        'connection', lambda connection: two_devices.on_connection(1, connection)
-    )
-
-    # Start
-    await two_devices.devices[0].power_on()
-    await two_devices.devices[1].power_on()
-
-    # Connect the two devices
-    await two_devices.devices[0].connect(two_devices.devices[1].random_address)
-
-    # Check the post conditions
-    assert two_devices.connections[0] is not None
-    assert two_devices.connections[1] is not None
-
-    return two_devices


 # -----------------------------------------------------------------------------
@@ -132,7 +74,8 @@ def test_helpers():
 # -----------------------------------------------------------------------------
@pytest.mark.asyncio
 async def test_basic_connection():
-    devices = await setup_connection()
+    devices = TwoDevices()
+    await devices.setup_connection()
    psm = 1234

    # Check that if there's no one listening, we can't connect
@@ -184,7 +127,8 @@ async def test_basic_connection():

 # -----------------------------------------------------------------------------
 async def transfer_payload(max_credits, mtu, mps):
-    devices = await setup_connection()
+    devices = TwoDevices()
+    await devices.setup_connection()

    received = []

@@ -226,7 +170,8 @@ async def test_transfer():
 # -----------------------------------------------------------------------------
@pytest.mark.asyncio
 async def test_bidirectional_transfer():
-    devices = await setup_connection()
+    devices = TwoDevices()
+    await devices.setup_connection()

    client_received = []
    server_received = []
--- a/tests/sdp_test.py
+++ b/tests/sdp_test.py
@@ -15,15 +15,30 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
-from bumble.core import UUID
-from bumble.sdp import DataElement
+import asyncio
+import logging
+import os
+
+from bumble.core import UUID, BT_L2CAP_PROTOCOL_ID, BT_RFCOMM_PROTOCOL_ID
+from bumble.sdp import (
+    DataElement,
+    ServiceAttribute,
+    Client,
+    Server,
+    SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
+    SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
+    SDP_PUBLIC_BROWSE_ROOT,
+    SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
+    SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
+)
+from .test_utils import TwoDevices

 # -----------------------------------------------------------------------------
 # pylint: disable=invalid-name
 # -----------------------------------------------------------------------------

 # -----------------------------------------------------------------------------
-def basic_check(x):
+def basic_check(x: DataElement) -> None:
    serialized = bytes(x)
    if len(serialized) < 500:
        print('Original:', x)
@@ -41,7 +56,7 @@ def basic_check(x):


 # -----------------------------------------------------------------------------
-def test_data_elements():
+def test_data_elements() -> None:
    e = DataElement(DataElement.NIL, None)
    basic_check(e)

@@ -157,5 +172,108 @@ def test_data_elements():


 # -----------------------------------------------------------------------------
-if __name__ == '__main__':
+def sdp_records():
+    return {
+        0x00010001: [
+            ServiceAttribute(
+                SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID,
+                DataElement.unsigned_integer_32(0x00010001),
+            ),
+            ServiceAttribute(
+                SDP_BROWSE_GROUP_LIST_ATTRIBUTE_ID,
+                DataElement.sequence([DataElement.uuid(SDP_PUBLIC_BROWSE_ROOT)]),
+            ),
+            ServiceAttribute(
+                SDP_SERVICE_CLASS_ID_LIST_ATTRIBUTE_ID,
+                DataElement.sequence(
+                    [DataElement.uuid(UUID('E6D55659-C8B4-4B85-96BB-B1143AF6D3AE'))]
+                ),
+            ),
+            ServiceAttribute(
+                SDP_PROTOCOL_DESCRIPTOR_LIST_ATTRIBUTE_ID,
+                DataElement.sequence(
+                    [
+                        DataElement.sequence([DataElement.uuid(BT_L2CAP_PROTOCOL_ID)]),
+                    ]
+                ),
+            ),
+        ]
+    }
+
+
+# -----------------------------------------------------------------------------
+async def test_service_search():
+    # Setup connections
+    devices = TwoDevices()
+    await devices.setup_connection()
+    assert devices.connections[0]
+    assert devices.connections[1]
+
+    # Register SDP service
+    devices.devices[0].sdp_server.service_records.update(sdp_records())
+
+    # Search for service
+    client = Client(devices.devices[1])
+    await client.connect(devices.connections[1])
+    services = await client.search_services(
+        [UUID('E6D55659-C8B4-4B85-96BB-B1143AF6D3AE')]
+    )
+
+    # Then
+    assert services[0] == 0x00010001
+
+
+# -----------------------------------------------------------------------------
+async def test_service_attribute():
+    # Setup connections
+    devices = TwoDevices()
+    await devices.setup_connection()
+
+    # Register SDP service
+    devices.devices[0].sdp_server.service_records.update(sdp_records())
+
+    # Search for service
+    client = Client(devices.devices[1])
+    await client.connect(devices.connections[1])
+    attributes = await client.get_attributes(
+        0x00010001, [SDP_SERVICE_RECORD_HANDLE_ATTRIBUTE_ID]
+    )
+
+    # Then
+    assert attributes[0].value.value == sdp_records()[0x00010001][0].value.value
+
+
+# -----------------------------------------------------------------------------
+async def test_service_search_attribute():
+    # Setup connections
+    devices = TwoDevices()
+    await devices.setup_connection()
+
+    # Register SDP service
+    devices.devices[0].sdp_server.service_records.update(sdp_records())
+
+    # Search for service
+    client = Client(devices.devices[1])
+    await client.connect(devices.connections[1])
+    attributes = await client.search_attributes(
+        [UUID('E6D55659-C8B4-4B85-96BB-B1143AF6D3AE')], [(0x0000FFFF, 8)]
+    )
+
+    # Then
+    for expect, actual in zip(attributes, sdp_records().values()):
+        assert expect.id == actual.id
+        assert expect.value == actual.value
+
+
+# -----------------------------------------------------------------------------
+async def run():
    test_data_elements()
+    await test_service_attribute()
+    await test_service_search()
+    await test_service_search_attribute()
+
+
+# -----------------------------------------------------------------------------
+if __name__ == '__main__':
+    logging.basicConfig(level=os.environ.get('BUMBLE_LOGLEVEL', 'INFO').upper())
+    asyncio.run(run())
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -0,0 +1,73 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from typing import List, Optional
+
+from bumble.controller import Controller
+from bumble.link import LocalLink
+from bumble.device import Device, Connection
+from bumble.host import Host
+from bumble.transport import AsyncPipeSink
+from bumble.hci import Address
+
+
+class TwoDevices:
+    connections: List[Optional[Connection]]
+
+    def __init__(self) -> None:
+        self.connections = [None, None]
+
+        self.link = LocalLink()
+        self.controllers = [
+            Controller('C1', link=self.link),
+            Controller('C2', link=self.link),
+        ]
+        self.devices = [
+            Device(
+                address=Address('F0:F1:F2:F3:F4:F5'),
+                host=Host(self.controllers[0], AsyncPipeSink(self.controllers[0])),
+            ),
+            Device(
+                address=Address('F5:F4:F3:F2:F1:F0'),
+                host=Host(self.controllers[1], AsyncPipeSink(self.controllers[1])),
+            ),
+        ]
+
+        self.paired = [None, None]
+
+    def on_connection(self, which, connection):
+        self.connections[which] = connection
+
+    def on_paired(self, which, keys):
+        self.paired[which] = keys
+
+    async def setup_connection(self) -> None:
+        # Attach listeners
+        self.devices[0].on(
+            'connection', lambda connection: self.on_connection(0, connection)
+        )
+        self.devices[1].on(
+            'connection', lambda connection: self.on_connection(1, connection)
+        )
+
+        # Start
+        await self.devices[0].power_on()
+        await self.devices[1].power_on()
+
+        # Connect the two devices
+        await self.devices[0].connect(self.devices[1].random_address)
+
+        # Check the post conditions
+        assert self.connections[0] is not None
+        assert self.connections[1] is not None
--- a/tools/rtk_fw_download.py
+++ b/tools/rtk_fw_download.py
@@ -67,8 +67,9 @@ def download_file(base_url, name, remove_suffix):
@click.command
@click.option(
    "--output-dir",
-    default=".",
-    help="Output directory where the files will be saved",
+    default="",
+    help="Output directory where the files will be saved. Defaults to the OS-specific"
+    "app data dir, which the driver will check when trying to find firmware",
    show_default=True,
 )
@click.option(
@@ -84,7 +85,10 @@ def main(output_dir, source, single, force, parse):
    """Download RTK firmware images and configs."""

    # Check that the output dir exists
-    output_dir = pathlib.Path(output_dir)
+    if output_dir == '':
+        output_dir = rtk.rtk_firmware_dir()
+    else:
+        output_dir = pathlib.Path(output_dir)
    if not output_dir.is_dir():
        print("Output dir does not exist or is not a directory")
        return
--- a/tools/rtk_util.py
+++ b/tools/rtk_util.py
@@ -61,9 +61,8 @@ async def do_load(usb_transport, force):
        # Get the driver.
        driver = await rtk.Driver.for_host(host, force)
        if driver is None:
-            if not force:
-                print("Firmware already loaded or no supported driver for this device.")
-                return
+            print("Firmware already loaded or no supported driver for this device.")
+            return

        await driver.download_firmware()

--- a/web/README.md
+++ b/web/README.md
@@ -0,0 +1,48 @@
+Bumble For Web Browsers
+=======================
+
+Early prototype the consists of running the Bumble stack in a web browser
+environment, using [pyodide](https://pyodide.org/)
+
+Two examples are included here:
+ 
+  * scanner - a simple scanner
+  * speaker - a pure-web-based version of the Speaker app
+
+Both examples rely on the shared code in `bumble.js`.
+
+Running The Examples
+--------------------
+
+To run the examples, you will need an HTTP server to serve the HTML and JS files, and
+and a WebSocket server serving an HCI transport.
+
+For HCI over WebSocket, recent versions of the `netsim` virtual controller support it,
+or you may use the Bumble HCI Bridge app to bridge a WebSocket server to a virtual
+controller using some other transport (ex: `python apps/hci_bridge.py ws-server:_:9999 usb:0`).
+
+For HTTP, start an HTTP server with the `web` directory as its
+root. You can use the invoke task `inv web.serve` for convenience.
+
+In a browser, open either `scanner/scanner.html` or `speaker/speaker.html`.
+You can pass optional query parameters:
+
+  * `package` may be set to point to a local build of Bumble (`.whl` files).
+     The filename must be URL-encoded of course, and must be located under
+     the `web` directory (the HTTP server won't serve files not under its
+     root directory).
+  * `hci` may be set to specify a non-default WebSocket URL to use as the HCI
+     transport (the default is: `"ws://localhost:9922/hci`). This also needs
+     to be URL-encoded.
+
+Example:
+    With a local HTTP server running on port 8000, to run the `scanner` example
+    with a locally-built Bumble package `../bumble-0.0.163.dev5+g6f832b6.d20230812-py3-none-any.whl` 
+    (assuming that `bumble-0.0.163.dev5+g6f832b6.d20230812-py3-none-any.whl` exists under the `web`
+    directory and the HCI WebSocket transport at `ws://localhost:9999/hci`, the URL with the 
+    URL-encoded query parameters would be:
+    `http://localhost:8000/scanner/scanner.html?hci=ws%3A%2F%2Flocalhost%3A9999%2Fhci&package=..%2Fbumble-0.0.163.dev5%2Bg6f832b6.d20230812-py3-none-any.whl`
+
+
+NOTE: to get a local build of the Bumble package, use `inv build`, the built `.whl` file can be found in the `dist` directory. 
+Make a copy of the built `.whl` file in the `web` directory.
--- a/web/bumble.js
+++ b/web/bumble.js
@@ -0,0 +1,92 @@
+function bufferToHex(buffer) {
+    return [...new Uint8Array(buffer)].map(x => x.toString(16).padStart(2, '0')).join('');
+}
+
+class PacketSource {
+    constructor(pyodide) {
+        this.parser = pyodide.runPython(`
+        from bumble.transport.common import PacketParser
+        class ProxiedPacketParser(PacketParser):
+            def feed_data(self, js_data):
+                super().feed_data(bytes(js_data.to_py()))
+        ProxiedPacketParser()
+      `);
+    }
+
+    set_packet_sink(sink) {
+        this.parser.set_packet_sink(sink);
+    }
+
+    data_received(data) {
+        console.log(`HCI[controller->host]: ${bufferToHex(data)}`);
+        this.parser.feed_data(data);
+    }
+}
+
+class PacketSink {
+    constructor(writer) {
+        this.writer = writer;
+    }
+
+    on_packet(packet) {
+        const buffer = packet.toJs({create_proxies : false});
+        packet.destroy();
+        console.log(`HCI[host->controller]: ${bufferToHex(buffer)}`);
+        // TODO: create an async queue here instead of blindly calling write without awaiting
+        this.writer(buffer);
+    }
+}
+
+export async function connectWebSocketTransport(pyodide, hciWsUrl) {
+    return new Promise((resolve, reject) => {
+        let resolved = false;
+
+        let ws = new WebSocket(hciWsUrl);
+        ws.binaryType = "arraybuffer";
+
+        ws.onopen = () => {
+            console.log("WebSocket open");
+            resolve({
+                packet_source,
+                packet_sink
+            });
+            resolved = true;
+        }
+
+        ws.onclose = () => {
+            console.log("WebSocket close");
+            if (!resolved) {
+                reject(`Failed to connect to ${hciWsUrl}`)
+            }
+        }
+
+        ws.onmessage = (event) => {
+            packet_source.data_received(event.data);
+        }
+
+        const packet_source = new PacketSource(pyodide);
+        const packet_sink = new PacketSink((packet) => ws.send(packet));
+    })
+}
+
+export async function loadBumble(pyodide, bumblePackage) {
+    // Load the Bumble module
+    await pyodide.loadPackage("micropip");
+    await pyodide.runPythonAsync(`
+        import micropip
+        await micropip.install("cryptography")
+        await micropip.install("${bumblePackage}")
+        package_list = micropip.list()
+        print(package_list)
+    `)
+
+    // Mount a filesystem so that we can persist data like the Key Store
+    let mountDir = "/bumble";
+    pyodide.FS.mkdir(mountDir);
+    pyodide.FS.mount(pyodide.FS.filesystems.IDBFS, { root: "." }, mountDir);
+
+    // Sync previously persisted filesystem data into memory
+    pyodide.FS.syncfs(true, () => {
+        console.log("FS synced in")
+    });
+}
--- a/web/index.html
+++ b/web/index.html
@@ -1,131 +0,0 @@
-<html>
-  <head>
-    <script src="https://cdn.jsdelivr.net/pyodide/v0.19.1/full/pyodide.js"></script>
-  </head>
-
-  <body>
-    <button onclick="runUSB()">USB</button>
-    <button onclick="runSerial()">Serial</button>
-    <br />
-    <br />
-    <div>Output:</div>
-    <textarea id="output" style="width: 100%;" rows="30" disabled></textarea>
-
-    <script>
-        function bufferToHex(buffer) {
-            return [...new Uint8Array(buffer)].map(x => x.toString(16).padStart(2, '0')).join('');
-        }
-
-        const output = document.getElementById("output");
-        const code = document.getElementById("code");
-
-        function addToOutput(s) {
-            output.value += s + "\n";
-        }
-
-      output.value = "Initializing...\n";
-
-      async function main() {
-          let pyodide = await loadPyodide({
-              indexURL: "https://cdn.jsdelivr.net/pyodide/v0.19.1/full/",
-          })
-          output.value += "Ready!\n"
-
-          return pyodide;
-      }
-
-      let pyodideReadyPromise = main();
-
-      async function readLoop(port, packet_source) {
-        const reader = port.readable.getReader()
-            try {
-                while (true) {
-                    console.log('@@@ Reading...')
-                    const { done, value } = await reader.read()
-                    if (done) {
-                        console.log("--- DONE!")
-                        break
-                    }
-
-                    console.log('@@@ Serial data:', bufferToHex(value))
-                    if (packet_source.delegate !== undefined) {
-                        packet_source.delegate.data_received(value)
-                    } else {
-                        console.warn('@@@ delegate not set yet, dropping data')
-                    }
-                }
-            } catch (error) {
-                console.error(error)
-            } finally {
-                reader.releaseLock()
-            }
-      }
-
-      async function runUSB() {
-        const device = await navigator.usb.requestDevice({
-          filters: [
-            {
-                classCode: 0xE0,
-                subclassCode: 0x01
-            }
-          ]
-        });
-
-        if (device.configuration === null) {
-          await device.selectConfiguration(1);
-        }
-        await device.claimInterface(0)
-      }
-
-      async function runSerial() {
-        const ports = await navigator.serial.getPorts()
-          console.log('Paired ports:', ports)
-
-          const port = await navigator.serial.requestPort()
-          await port.open({ baudRate: 1000000 })
-          const writer = port.writable.getWriter()
-      }
-
-      async function run() {
-
-          let pyodide = await pyodideReadyPromise;
-          try {
-              const script = await(await fetch('scanner.py')).text()
-              await pyodide.loadPackage('micropip')
-              await pyodide.runPythonAsync(`
-                  import micropip
-                  await micropip.install('../dist/bumble-0.0.36.dev0+g3adbfe7.d20210807-py3-none-any.whl')
-              `)
-              let output = await pyodide.runPythonAsync(script)
-              addToOutput(output)
-
-              const pythonMain = pyodide.globals.get('main')
-              const packet_source = {}
-              const packet_sink = {
-                  on_packet: (packet) => {
-                    // Variant A, with the conversion done in Javascript
-                      const buffer = packet.toJs()
-                      console.log(`$$$ on_packet: ${bufferToHex(buffer)}`)
-                      // TODO: create an sync queue here instead of blindly calling write without awaiting
-                      /*await*/ writer.write(buffer)
-                      packet.destroy()
-
-                    // Variant B, with the conversion `to_js` done at the Python layer
-                    // console.log(`$$$ on_packet: ${bufferToHex(packet)}`)
-                    //   /*await*/ writer.write(packet)
-                }
-              }
-              serialLooper = readLoop(port, packet_source)
-              pythonResult = await pythonMain(packet_source, packet_sink)
-              console.log(pythonResult)
-              serialResult = await serialLooper
-              writer.releaseLock()
-              await port.close()
-              console.log('### done')
-        } catch (err) {
-          addToOutput(err);
-        }
-      }
-    </script>
-  </body>
-</html>
--- a/web/scanner/scanner.html
+++ b/web/scanner/scanner.html
@@ -0,0 +1,129 @@
+<html>
+
+<head>
+  <script src="https://cdn.jsdelivr.net/pyodide/v0.23.2/full/pyodide.js"></script>
+  <style>
+    body {
+      font-family: monospace;
+    }
+
+    table, th, td {
+      padding: 2px;
+      white-space: pre;
+      border: 1px solid black;
+      border-collapse: collapse;
+    }
+  </style>
+</head>
+
+<body>
+  <button id="connectButton" disabled>Connect</button>
+  <br />
+  <br />
+  <div>Log Output</div><br>
+  <textarea id="output" style="width: 100%;" rows="10" disabled></textarea>
+  <div id="scanTableContainer"><table></table></div>
+
+  <script type="module">
+    import { loadBumble, connectWebSocketTransport } from "../bumble.js"
+    let pyodide;
+    let output;
+
+    function logToOutput(s) {
+      output.value += s + "\n";
+      console.log(s);
+    }
+
+    async function run() {
+      const params = (new URL(document.location)).searchParams;
+      const hciWsUrl = params.get("hci") || "ws://localhost:9922/hci";
+
+      try {
+        // Create a WebSocket HCI transport
+        let transport
+        try {
+          transport = await connectWebSocketTransport(pyodide, hciWsUrl);
+        } catch (error) {
+          logToOutput(error);
+          return;
+        }
+
+        // Run the scanner example
+        const script = await (await fetch("scanner.py")).text();
+        await pyodide.runPythonAsync(script);
+        const pythonMain = pyodide.globals.get("main");
+        logToOutput("Starting scanner...");
+        await pythonMain(transport.packet_source, transport.packet_sink, onScanUpdate);
+        logToOutput("Scanner running");
+      } catch (err) {
+        logToOutput(err);
+      }
+    }
+
+    function onScanUpdate(scanEntries) {
+      scanEntries = scanEntries.toJs();
+
+      const scanTable = document.createElement("table");
+
+      const tableHeader = document.createElement("tr");
+      for (const name of ["Address", "Address Type", "RSSI", "Data"]) {
+        const header = document.createElement("th");
+        header.appendChild(document.createTextNode(name));
+        tableHeader.appendChild(header);
+      }
+      scanTable.appendChild(tableHeader);
+
+      scanEntries.forEach(entry => {
+        const row = document.createElement("tr");
+
+        const addressCell = document.createElement("td");
+        addressCell.appendChild(document.createTextNode(entry.address));
+        row.appendChild(addressCell);
+
+        const addressTypeCell = document.createElement("td");
+        addressTypeCell.appendChild(document.createTextNode(entry.address_type));
+        row.appendChild(addressTypeCell);
+
+        const rssiCell = document.createElement("td");
+        rssiCell.appendChild(document.createTextNode(entry.rssi));
+        row.appendChild(rssiCell);
+
+        const dataCell = document.createElement("td");
+        dataCell.appendChild(document.createTextNode(entry.data));
+        row.appendChild(dataCell);
+
+        scanTable.appendChild(row);
+      });
+
+      const scanTableContainer = document.getElementById("scanTableContainer");
+      scanTableContainer.replaceChild(scanTable, scanTableContainer.firstChild);
+
+      return true;
+    }
+
+    async function main() {
+      output = document.getElementById("output");
+
+      // Load pyodide
+      logToOutput("Loading Pyodide");
+      pyodide = await loadPyodide();
+
+      // Load Bumble
+      logToOutput("Loading Bumble");
+      const params = (new URL(document.location)).searchParams;
+      const bumblePackage = params.get("package") || "bumble";
+      await loadBumble(pyodide, bumblePackage);
+
+      logToOutput("Ready!")
+
+      // Enable the Connect button
+      const connectButton = document.getElementById("connectButton");
+      connectButton.disabled = false
+      connectButton.addEventListener("click", run)
+    }
+
+    main();
+  </script>
+</body>
+
+</html>
--- a/web/scanner/scanner.py
+++ b/web/scanner/scanner.py
@@ -15,50 +15,38 @@
 # -----------------------------------------------------------------------------
 # Imports
 # -----------------------------------------------------------------------------
+import time
+
 from bumble.device import Device
-from bumble.transport.common import PacketParser
+
+
+# -----------------------------------------------------------------------------
+class ScanEntry:
+    def __init__(self, advertisement):
+        self.address = str(advertisement.address).replace("/P", "")
+        self.address_type = ('Public', 'Random', 'Public Identity', 'Random Identity')[
+            advertisement.address.address_type
+        ]
+        self.rssi = advertisement.rssi
+        self.data = advertisement.data.to_string("\n")


 # -----------------------------------------------------------------------------
 class ScannerListener(Device.Listener):
+    def __init__(self, callback):
+        self.callback = callback
+        self.entries = {}
+
    def on_advertisement(self, advertisement):
-        address_type_string = ('P', 'R', 'PI', 'RI')[advertisement.address.address_type]
-        print(
-            f'>>> {advertisement.address} [{address_type_string}]: RSSI={advertisement.rssi}, {advertisement.ad_data}'
-        )
-
-
-class HciSource:
-    def __init__(self, host_source):
-        self.parser = PacketParser()
-        host_source.delegate = self
-
-    def set_packet_sink(self, sink):
-        self.parser.set_packet_sink(sink)
-
-    # host source delegation
-    def data_received(self, data):
-        print('*** DATA from JS:', data)
-        buffer = bytes(data.to_py())
-        self.parser.feed_data(buffer)
-
-
-# class HciSink:
-#     def __init__(self, host_sink):
-#         self.host_sink = host_sink
-
-#     def on_packet(self, packet):
-#         print(f'>>> PACKET from Python: {packet}')
-#         self.host_sink.on_packet(packet)
+        self.entries[advertisement.address] = ScanEntry(advertisement)
+        self.callback(list(self.entries.values()))


 # -----------------------------------------------------------------------------
-async def main(host_source, host_sink):
+async def main(hci_source, hci_sink, callback):
    print('### Starting Scanner')
-    hci_source = HciSource(host_source)
-    hci_sink = host_sink
    device = Device.with_hci('Bumble', 'F0:F1:F2:F3:F4:F5', hci_source, hci_sink)
-    device.listener = ScannerListener()
+    device.listener = ScannerListener(callback)
    await device.power_on()
    await device.start_scanning()

--- a/web/speaker/logo.svg
+++ b/web/speaker/logo.svg
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?> <!-- Created with Vectornator for iOS (http://vectornator.io/) --><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg height="100%" style="fill-rule:nonzero;clip-rule:evenodd;stroke-linecap:round;stroke-linejoin:round;" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="100%" xmlns:vectornator="http://vectornator.io" version="1.1" viewBox="0 0 745 744.634">
+<metadata>
+<vectornator:setting key="DimensionsVisible" value="1"/>
+<vectornator:setting key="PencilOnly" value="0"/>
+<vectornator:setting key="SnapToPoints" value="0"/>
+<vectornator:setting key="OutlineMode" value="0"/>
+<vectornator:setting key="CMYKEnabledKey" value="0"/>
+<vectornator:setting key="RulersVisible" value="1"/>
+<vectornator:setting key="SnapToEdges" value="0"/>
+<vectornator:setting key="GuidesVisible" value="1"/>
+<vectornator:setting key="DisplayWhiteBackground" value="0"/>
+<vectornator:setting key="doHistoryDisabled" value="0"/>
+<vectornator:setting key="SnapToGuides" value="1"/>
+<vectornator:setting key="TimeLapseWatermarkDisabled" value="0"/>
+<vectornator:setting key="Units" value="Pixels"/>
+<vectornator:setting key="DynamicGuides" value="0"/>
+<vectornator:setting key="IsolateActiveLayer" value="0"/>
+<vectornator:setting key="SnapToGrid" value="0"/>
+</metadata>
+<defs/>
+<g id="Layer 1" vectornator:layerName="Layer 1">
+<path stroke="#000000" stroke-width="18.6464" d="M368.753+729.441L58.8847+550.539L58.8848+192.734L368.753+13.8313L678.621+192.734L678.621+550.539L368.753+729.441Z" fill="#0082fc" stroke-linecap="butt" fill-opacity="0.307489" opacity="1" stroke-linejoin="round"/>
+<g opacity="1">
+<g opacity="1">
+<path stroke="#000000" stroke-width="20" d="M292.873+289.256L442.872+289.256L442.872+539.254L292.873+539.254L292.873+289.256Z" fill="#fcd100" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="20" d="M292.873+289.256C292.873+247.835+326.452+214.257+367.873+214.257C409.294+214.257+442.872+247.835+442.872+289.256C442.872+330.677+409.294+364.256+367.873+364.256C326.452+364.256+292.873+330.677+292.873+289.256Z" fill="#fcd100" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="20" d="M292.873+539.254C292.873+497.833+326.452+464.255+367.873+464.255C409.294+464.255+442.872+497.833+442.872+539.254C442.872+580.675+409.294+614.254+367.873+614.254C326.452+614.254+292.873+580.675+292.873+539.254Z" fill="#fcd100" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<path stroke="#0082fc" stroke-width="0.1" d="M302.873+289.073L432.872+289.073L432.872+539.072L302.873+539.072L302.873+289.073Z" fill="#fcd100" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+</g>
+<path stroke="#000000" stroke-width="0.1" d="M103.161+309.167L226.956+443.903L366.671+309.604L103.161+309.167Z" fill="#0082fc" stroke-linecap="round" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="0.1" d="M383.411+307.076L508.887+440.112L650.5+307.507L383.411+307.076Z" fill="#0082fc" stroke-linecap="round" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="20" d="M522.045+154.808L229.559+448.882L83.8397+300.104L653.666+302.936L511.759+444.785L223.101+156.114" fill="none" stroke-linecap="round" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="61.8698" d="M295.857+418.738L438.9+418.738" fill="none" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<path stroke="#000000" stroke-width="61.8698" d="M295.857+521.737L438.9+521.737" fill="none" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<g opacity="1">
+<path stroke="#0082fc" stroke-width="0.1" d="M367.769+667.024L367.821+616.383L403.677+616.336C383.137+626.447+368.263+638.69+367.769+667.024Z" fill="#000000" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+<path stroke="#0082fc" stroke-width="0.1" d="M367.836+667.024L367.784+616.383L331.928+616.336C352.468+626.447+367.341+638.69+367.836+667.024Z" fill="#000000" stroke-linecap="butt" opacity="1" stroke-linejoin="round"/>
+</g>
+</g>
+</g>
+</svg>
--- a/web/speaker/speaker.css
+++ b/web/speaker/speaker.css
@@ -0,0 +1,76 @@
+body, h1, h2, h3, h4, h5, h6 {
+    font-family: sans-serif;
+}
+
+#controlsDiv {
+    margin: 6px;
+}
+
+#errorText {
+    background-color: rgb(239, 89, 75);
+    border: none;
+    border-radius: 4px;
+    padding: 8px;
+    display: inline-block;
+    margin: 4px;
+}
+
+#startButton {
+    padding: 4px;
+    margin: 6px;
+}
+
+#fftCanvas {
+    border-radius: 16px;
+    margin: 6px;
+}
+
+#bandwidthCanvas {
+    border: grey;
+    border-style: solid;
+    border-radius: 8px;
+    margin: 6px;
+}
+
+#streamStateText {
+    background-color: rgb(93, 165, 93);
+    border: none;
+    border-radius: 8px;
+    padding: 10px 20px;
+    display: inline-block;
+    margin: 6px;
+}
+
+#connectionStateText {
+    background-color: rgb(112, 146, 206);
+    border: none;
+    border-radius: 8px;
+    padding: 10px 20px;
+    display: inline-block;
+    margin: 6px;
+}
+
+#propertiesTable {
+    border: grey;
+    border-style: solid;
+    border-radius: 4px;
+    padding: 4px;
+    margin: 6px;
+    margin-left: 0px;
+}
+
+th, td {
+    padding-left: 6px;
+    padding-right: 6px;
+}
+
+.properties td:nth-child(even) {
+    background-color: #D6EEEE;
+    font-family: monospace;
+}
+
+.properties td:nth-child(odd) {
+    font-weight: bold;
+}
+
+.properties tr td:nth-child(2) { width: 150px; }
--- a/web/speaker/speaker.html
+++ b/web/speaker/speaker.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Bumble Speaker</title>
+  <script src="https://cdn.jsdelivr.net/pyodide/v0.23.2/full/pyodide.js"></script>
+  <script type="module" src="speaker.js"></script>
+  <link rel="stylesheet" href="speaker.css">
+</head>
+<body>
+  <h1><img src="logo.svg" width=100 height=100 style="vertical-align:middle" alt=""/>Bumble Virtual Speaker</h1>
+  <div id="errorText"></div>
+  <div id="speaker">
+    <table><tr>
+      <td>
+        <table id="propertiesTable" class="properties">
+          <tr><td>Codec</td><td><span id="codecText"></span></td></tr>
+          <tr><td>Packets</td><td><span id="packetsReceivedText"></span></td></tr>
+          <tr><td>Bytes</td><td><span id="bytesReceivedText"></span></td></tr>
+        </table>
+      </td>
+      <td>
+        <canvas id="bandwidthCanvas" width="500", height="100">Bandwidth Graph</canvas>
+      </td>
+    </tr></table>
+    <span id="streamStateText">IDLE</span>
+    <span id="connectionStateText">NOT CONNECTED</span>
+    <div id="controlsDiv">
+        <button id="audioOnButton">Audio On</button>
+    </div>
+    <canvas id="fftCanvas" width="1024", height="300">Audio Frequencies Animation</canvas>
+    <audio id="audio"></audio>
+  </div>
+</body>
+</html>
--- a/web/speaker/speaker.js
+++ b/web/speaker/speaker.js
@@ -0,0 +1,289 @@
+import { loadBumble, connectWebSocketTransport } from "../bumble.js";
+
+(function () {
+    'use strict';
+
+    let codecText;
+    let packetsReceivedText;
+    let bytesReceivedText;
+    let streamStateText;
+    let connectionStateText;
+    let errorText;
+    let audioOnButton;
+    let mediaSource;
+    let sourceBuffer;
+    let audioElement;
+    let audioContext;
+    let audioAnalyzer;
+    let audioFrequencyBinCount;
+    let audioFrequencyData;
+    let packetsReceived = 0;
+    let bytesReceived = 0;
+    let audioState = "stopped";
+    let streamState = "IDLE";
+    let fftCanvas;
+    let fftCanvasContext;
+    let bandwidthCanvas;
+    let bandwidthCanvasContext;
+    let bandwidthBinCount;
+    let bandwidthBins = [];
+    let pyodide;
+
+    const FFT_WIDTH = 800;
+    const FFT_HEIGHT = 256;
+    const BANDWIDTH_WIDTH = 500;
+    const BANDWIDTH_HEIGHT = 100;
+
+
+    function init() {
+        initUI();
+        initMediaSource();
+        initAudioElement();
+        initAnalyzer();
+        initBumble();
+    }
+
+    function initUI() {
+        audioOnButton = document.getElementById("audioOnButton");
+        codecText = document.getElementById("codecText");
+        packetsReceivedText = document.getElementById("packetsReceivedText");
+        bytesReceivedText = document.getElementById("bytesReceivedText");
+        streamStateText = document.getElementById("streamStateText");
+        errorText = document.getElementById("errorText");
+        connectionStateText = document.getElementById("connectionStateText");
+
+        audioOnButton.onclick = () => startAudio();
+
+        codecText.innerText = "AAC";
+        setErrorText("");
+
+        requestAnimationFrame(onAnimationFrame);
+    }
+
+    function initMediaSource() {
+        mediaSource = new MediaSource();
+        mediaSource.onsourceopen = onMediaSourceOpen;
+        mediaSource.onsourceclose = onMediaSourceClose;
+        mediaSource.onsourceended = onMediaSourceEnd;
+    }
+
+    function initAudioElement() {
+        audioElement = document.getElementById("audio");
+        audioElement.src = URL.createObjectURL(mediaSource);
+        // audioElement.controls = true;
+    }
+
+    function initAnalyzer() {
+        fftCanvas = document.getElementById("fftCanvas");
+        fftCanvas.width = FFT_WIDTH
+        fftCanvas.height = FFT_HEIGHT
+        fftCanvasContext = fftCanvas.getContext('2d');
+        fftCanvasContext.fillStyle = "rgb(0, 0, 0)";
+        fftCanvasContext.fillRect(0, 0, FFT_WIDTH, FFT_HEIGHT);
+
+        bandwidthCanvas = document.getElementById("bandwidthCanvas");
+        bandwidthCanvas.width = BANDWIDTH_WIDTH
+        bandwidthCanvas.height = BANDWIDTH_HEIGHT
+        bandwidthCanvasContext = bandwidthCanvas.getContext('2d');
+        bandwidthCanvasContext.fillStyle = "rgb(255, 255, 255)";
+        bandwidthCanvasContext.fillRect(0, 0, BANDWIDTH_WIDTH, BANDWIDTH_HEIGHT);
+    }
+
+    async function initBumble() {
+        // Load pyodide
+        console.log("Loading Pyodide");
+        pyodide = await loadPyodide();
+
+        // Load Bumble
+        console.log("Loading Bumble");
+        const params = (new URL(document.location)).searchParams;
+        const bumblePackage = params.get("package") || "bumble";
+        await loadBumble(pyodide, bumblePackage);
+
+        console.log("Ready!")
+
+        const hciWsUrl = params.get("hci") || "ws://localhost:9922/hci";
+        try {
+            // Create a WebSocket HCI transport
+            let transport
+            try {
+                transport = await connectWebSocketTransport(pyodide, hciWsUrl);
+            } catch (error) {
+                console.error(error);
+                setErrorText(error);
+                return;
+            }
+
+            // Run the scanner example
+            const script = await (await fetch("speaker.py")).text();
+            await pyodide.runPythonAsync(script);
+            const pythonMain = pyodide.globals.get("main");
+            console.log("Starting speaker...");
+            await pythonMain(transport.packet_source, transport.packet_sink, onEvent);
+            console.log("Speaker running");
+        } catch (err) {
+            console.log(err);
+        }
+    }
+
+    function startAnalyzer() {
+        // FFT
+        if (audioElement.captureStream !== undefined) {
+            audioContext = new AudioContext();
+            audioAnalyzer = audioContext.createAnalyser();
+            audioAnalyzer.fftSize = 128;
+            audioFrequencyBinCount = audioAnalyzer.frequencyBinCount;
+            audioFrequencyData = new Uint8Array(audioFrequencyBinCount);
+            const stream = audioElement.captureStream();
+            const source = audioContext.createMediaStreamSource(stream);
+            source.connect(audioAnalyzer);
+        }
+
+        // Bandwidth
+        bandwidthBinCount = BANDWIDTH_WIDTH / 2;
+        bandwidthBins = [];
+    }
+
+    function setErrorText(message) {
+        errorText.innerText = message;
+        if (message.length == 0) {
+            errorText.style.display = "none";
+        } else {
+            errorText.style.display = "inline-block";
+        }
+    }
+
+    function setStreamState(state) {
+        streamState = state;
+        streamStateText.innerText = streamState;
+    }
+
+    function onAnimationFrame() {
+        // FFT
+        if (audioAnalyzer !== undefined) {
+            audioAnalyzer.getByteFrequencyData(audioFrequencyData);
+            fftCanvasContext.fillStyle = "rgb(0, 0, 0)";
+            fftCanvasContext.fillRect(0, 0, FFT_WIDTH, FFT_HEIGHT);
+            const barCount = audioFrequencyBinCount;
+            const barWidth = (FFT_WIDTH / audioFrequencyBinCount) - 1;
+            for (let bar = 0; bar < barCount; bar++) {
+                const barHeight = audioFrequencyData[bar];
+                fftCanvasContext.fillStyle = `rgb(${barHeight / 256 * 200 + 50}, 50, ${50 + 2 * bar})`;
+                fftCanvasContext.fillRect(bar * (barWidth + 1), FFT_HEIGHT - barHeight, barWidth, barHeight);
+            }
+        }
+
+        // Bandwidth
+        bandwidthCanvasContext.fillStyle = "rgb(255, 255, 255)";
+        bandwidthCanvasContext.fillRect(0, 0, BANDWIDTH_WIDTH, BANDWIDTH_HEIGHT);
+        bandwidthCanvasContext.fillStyle = `rgb(100, 100, 100)`;
+        for (let t = 0; t < bandwidthBins.length; t++) {
+            const lineHeight = (bandwidthBins[t] / 1000) * BANDWIDTH_HEIGHT;
+            bandwidthCanvasContext.fillRect(t * 2, BANDWIDTH_HEIGHT - lineHeight, 2, lineHeight);
+        }
+
+        // Display again at the next frame
+        requestAnimationFrame(onAnimationFrame);
+    }
+
+    function onMediaSourceOpen() {
+        console.log(this.readyState);
+        sourceBuffer = mediaSource.addSourceBuffer("audio/aac");
+    }
+
+    function onMediaSourceClose() {
+        console.log(this.readyState);
+    }
+
+    function onMediaSourceEnd() {
+        console.log(this.readyState);
+    }
+
+    async function startAudio() {
+        try {
+            console.log("starting audio...");
+            audioOnButton.disabled = true;
+            audioState = "starting";
+            await audioElement.play();
+            console.log("audio started");
+            audioState = "playing";
+            startAnalyzer();
+        } catch (error) {
+            console.error(`play failed: ${error}`);
+            audioState = "stopped";
+            audioOnButton.disabled = false;
+        }
+    }
+
+    async function onEvent(name, params) {
+        // Dispatch the message.
+        const handlerName = `on${name.charAt(0).toUpperCase()}${name.slice(1)}`
+        const handler = eventHandlers[handlerName];
+        if (handler !== undefined) {
+            handler(params);
+        } else {
+            console.warn(`unhandled event: ${name}`)
+        }
+    }
+
+    function onStart() {
+        setStreamState("STARTED");
+    }
+
+    function onStop() {
+        setStreamState("STOPPED");
+    }
+
+    function onSuspend() {
+        setStreamState("SUSPENDED");
+    }
+
+    function onConnection(params) {
+        connectionStateText.innerText = `CONNECTED: ${params.get('peer_name')} (${params.get('peer_address')})`;
+    }
+
+    function onDisconnection(params) {
+        connectionStateText.innerText = "DISCONNECTED";
+    }
+
+    function onAudio(python_packet) {
+        const packet = python_packet.toJs({create_proxies : false});
+        python_packet.destroy();
+        if (audioState != "stopped") {
+            // Queue the audio packet.
+            sourceBuffer.appendBuffer(packet);
+        }
+
+        packetsReceived += 1;
+        packetsReceivedText.innerText = packetsReceived;
+        bytesReceived += packet.byteLength;
+        bytesReceivedText.innerText = bytesReceived;
+
+        bandwidthBins[bandwidthBins.length] = packet.byteLength;
+        if (bandwidthBins.length > bandwidthBinCount) {
+            bandwidthBins.shift();
+        }
+    }
+
+    function onKeystoreupdate() {
+        // Sync the FS
+        pyodide.FS.syncfs(() => {
+            console.log("FS synced out")
+        });
+    }
+
+    const eventHandlers = {
+        onStart,
+        onStop,
+        onSuspend,
+        onConnection,
+        onDisconnection,
+        onAudio,
+        onKeystoreupdate
+    }
+
+    window.onload = (event) => {
+        init();
+    }
+
+}());
--- a/web/speaker/speaker.py
+++ b/web/speaker/speaker.py
@@ -0,0 +1,321 @@
+# Copyright 2021-2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# -----------------------------------------------------------------------------
+# Imports
+# -----------------------------------------------------------------------------
+from __future__ import annotations
+import enum
+import logging
+from typing import Dict, List
+
+from bumble.core import BT_BR_EDR_TRANSPORT, CommandTimeoutError
+from bumble.device import Device, DeviceConfiguration
+from bumble.pairing import PairingConfig
+from bumble.sdp import ServiceAttribute
+from bumble.avdtp import (
+    AVDTP_AUDIO_MEDIA_TYPE,
+    Listener,
+    MediaCodecCapabilities,
+    MediaPacket,
+    Protocol,
+)
+from bumble.a2dp import (
+    make_audio_sink_service_sdp_records,
+    MPEG_2_AAC_LC_OBJECT_TYPE,
+    A2DP_SBC_CODEC_TYPE,
+    A2DP_MPEG_2_4_AAC_CODEC_TYPE,
+    SBC_MONO_CHANNEL_MODE,
+    SBC_DUAL_CHANNEL_MODE,
+    SBC_SNR_ALLOCATION_METHOD,
+    SBC_LOUDNESS_ALLOCATION_METHOD,
+    SBC_STEREO_CHANNEL_MODE,
+    SBC_JOINT_STEREO_CHANNEL_MODE,
+    SbcMediaCodecInformation,
+    AacMediaCodecInformation,
+)
+from bumble.utils import AsyncRunner
+from bumble.codecs import AacAudioRtpPacket
+
+
+# -----------------------------------------------------------------------------
+# Logging
+# -----------------------------------------------------------------------------
+logger = logging.getLogger(__name__)
+
+
+# -----------------------------------------------------------------------------
+class AudioExtractor:
+    @staticmethod
+    def create(codec: str):
+        if codec == 'aac':
+            return AacAudioExtractor()
+        if codec == 'sbc':
+            return SbcAudioExtractor()
+
+    def extract_audio(self, packet: MediaPacket) -> bytes:
+        raise NotImplementedError()
+
+
+# -----------------------------------------------------------------------------
+class AacAudioExtractor:
+    def extract_audio(self, packet: MediaPacket) -> bytes:
+        return AacAudioRtpPacket(packet.payload).to_adts()
+
+
+# -----------------------------------------------------------------------------
+class SbcAudioExtractor:
+    def extract_audio(self, packet: MediaPacket) -> bytes:
+        # header = packet.payload[0]
+        # fragmented = header >> 7
+        # start = (header >> 6) & 0x01
+        # last = (header >> 5) & 0x01
+        # number_of_frames = header & 0x0F
+
+        # TODO: support fragmented payloads
+        return packet.payload[1:]
+
+
+# -----------------------------------------------------------------------------
+class Speaker:
+    class StreamState(enum.Enum):
+        IDLE = 0
+        STOPPED = 1
+        STARTED = 2
+        SUSPENDED = 3
+
+    def __init__(self, hci_source, hci_sink, emit_event, codec, discover):
+        self.hci_source = hci_source
+        self.hci_sink = hci_sink
+        self.emit_event = emit_event
+        self.codec = codec
+        self.discover = discover
+        self.device = None
+        self.connection = None
+        self.listener = None
+        self.packets_received = 0
+        self.bytes_received = 0
+        self.stream_state = Speaker.StreamState.IDLE
+        self.audio_extractor = AudioExtractor.create(codec)
+
+    def sdp_records(self) -> Dict[int, List[ServiceAttribute]]:
+        service_record_handle = 0x00010001
+        return {
+            service_record_handle: make_audio_sink_service_sdp_records(
+                service_record_handle
+            )
+        }
+
+    def codec_capabilities(self) -> MediaCodecCapabilities:
+        if self.codec == 'aac':
+            return self.aac_codec_capabilities()
+
+        if self.codec == 'sbc':
+            return self.sbc_codec_capabilities()
+
+        raise RuntimeError('unsupported codec')
+
+    def aac_codec_capabilities(self) -> MediaCodecCapabilities:
+        return MediaCodecCapabilities(
+            media_type=AVDTP_AUDIO_MEDIA_TYPE,
+            media_codec_type=A2DP_MPEG_2_4_AAC_CODEC_TYPE,
+            media_codec_information=AacMediaCodecInformation.from_lists(
+                object_types=[MPEG_2_AAC_LC_OBJECT_TYPE],
+                sampling_frequencies=[48000, 44100],
+                channels=[1, 2],
+                vbr=1,
+                bitrate=256000,
+            ),
+        )
+
+    def sbc_codec_capabilities(self) -> MediaCodecCapabilities:
+        return MediaCodecCapabilities(
+            media_type=AVDTP_AUDIO_MEDIA_TYPE,
+            media_codec_type=A2DP_SBC_CODEC_TYPE,
+            media_codec_information=SbcMediaCodecInformation.from_lists(
+                sampling_frequencies=[48000, 44100, 32000, 16000],
+                channel_modes=[
+                    SBC_MONO_CHANNEL_MODE,
+                    SBC_DUAL_CHANNEL_MODE,
+                    SBC_STEREO_CHANNEL_MODE,
+                    SBC_JOINT_STEREO_CHANNEL_MODE,
+                ],
+                block_lengths=[4, 8, 12, 16],
+                subbands=[4, 8],
+                allocation_methods=[
+                    SBC_LOUDNESS_ALLOCATION_METHOD,
+                    SBC_SNR_ALLOCATION_METHOD,
+                ],
+                minimum_bitpool_value=2,
+                maximum_bitpool_value=53,
+            ),
+        )
+
+    def on_key_store_update(self):
+        print("Key Store updated")
+        self.emit_event('keystoreupdate', None)
+
+    def on_bluetooth_connection(self, connection):
+        print(f'Connection: {connection}')
+        self.connection = connection
+        connection.on('disconnection', self.on_bluetooth_disconnection)
+        peer_name = '' if connection.peer_name is None else connection.peer_name
+        peer_address = str(connection.peer_address).replace('/P', '')
+        self.emit_event(
+            'connection', {'peer_name': peer_name, 'peer_address': peer_address}
+        )
+
+    def on_bluetooth_disconnection(self, reason):
+        print(f'Disconnection ({reason})')
+        self.connection = None
+        AsyncRunner.spawn(self.advertise())
+        self.emit_event('disconnection', None)
+
+    def on_avdtp_connection(self, protocol):
+        print('Audio Stream Open')
+
+        # Add a sink endpoint to the server
+        sink = protocol.add_sink(self.codec_capabilities())
+        sink.on('start', self.on_sink_start)
+        sink.on('stop', self.on_sink_stop)
+        sink.on('suspend', self.on_sink_suspend)
+        sink.on('configuration', lambda: self.on_sink_configuration(sink.configuration))
+        sink.on('rtp_packet', self.on_rtp_packet)
+        sink.on('rtp_channel_open', self.on_rtp_channel_open)
+        sink.on('rtp_channel_close', self.on_rtp_channel_close)
+
+        # Listen for close events
+        protocol.on('close', self.on_avdtp_close)
+
+        # Discover all endpoints on the remote device is requested
+        if self.discover:
+            AsyncRunner.spawn(self.discover_remote_endpoints(protocol))
+
+    def on_avdtp_close(self):
+        print("Audio Stream Closed")
+
+    def on_sink_start(self):
+        print("Sink Started")
+        self.stream_state = self.StreamState.STARTED
+        self.emit_event('start', None)
+
+    def on_sink_stop(self):
+        print("Sink Stopped")
+        self.stream_state = self.StreamState.STOPPED
+        self.emit_event('stop', None)
+
+    def on_sink_suspend(self):
+        print("Sink Suspended")
+        self.stream_state = self.StreamState.SUSPENDED
+        self.emit_event('suspend', None)
+
+    def on_sink_configuration(self, config):
+        print("Sink Configuration:")
+        print('\n'.join(["  " + str(capability) for capability in config]))
+
+    def on_rtp_channel_open(self):
+        print("RTP Channel Open")
+
+    def on_rtp_channel_close(self):
+        print("RTP Channel Closed")
+        self.stream_state = self.StreamState.IDLE
+
+    def on_rtp_packet(self, packet):
+        self.packets_received += 1
+        self.bytes_received += len(packet.payload)
+        self.emit_event("audio", self.audio_extractor.extract_audio(packet))
+
+    async def advertise(self):
+        await self.device.set_discoverable(True)
+        await self.device.set_connectable(True)
+
+    async def connect(self, address):
+        # Connect to the source
+        print(f'=== Connecting to {address}...')
+        connection = await self.device.connect(address, transport=BT_BR_EDR_TRANSPORT)
+        print(f'=== Connected to {connection.peer_address}')
+
+        # Request authentication
+        print('*** Authenticating...')
+        await connection.authenticate()
+        print('*** Authenticated')
+
+        # Enable encryption
+        print('*** Enabling encryption...')
+        await connection.encrypt()
+        print('*** Encryption on')
+
+        protocol = await Protocol.connect(connection)
+        self.listener.set_server(connection, protocol)
+        self.on_avdtp_connection(protocol)
+
+    async def discover_remote_endpoints(self, protocol):
+        endpoints = await protocol.discover_remote_endpoints()
+        print(f'@@@ Found {len(endpoints)} endpoints')
+        for endpoint in endpoints:
+            print('@@@', endpoint)
+
+    async def run(self, connect_address):
+        # Create a device
+        device_config = DeviceConfiguration()
+        device_config.name = "Bumble Speaker"
+        device_config.class_of_device = 0x240414
+        device_config.keystore = "JsonKeyStore:/bumble/keystore.json"
+        device_config.classic_enabled = True
+        device_config.le_enabled = False
+        self.device = Device.from_config_with_hci(
+            device_config, self.hci_source, self.hci_sink
+        )
+
+        # Setup the SDP to expose the sink service
+        self.device.sdp_service_records = self.sdp_records()
+
+        # Don't require MITM when pairing.
+        self.device.pairing_config_factory = lambda connection: PairingConfig(
+            mitm=False
+        )
+
+        # Start the controller
+        await self.device.power_on()
+
+        # Listen for Bluetooth connections
+        self.device.on('connection', self.on_bluetooth_connection)
+
+        # Listen for changes to the key store
+        self.device.on('key_store_update', self.on_key_store_update)
+
+        # Create a listener to wait for AVDTP connections
+        self.listener = Listener(Listener.create_registrar(self.device))
+        self.listener.on('connection', self.on_avdtp_connection)
+
+        print(f'Speaker ready to play, codec={self.codec}')
+
+        if connect_address:
+            # Connect to the source
+            try:
+                await self.connect(connect_address)
+            except CommandTimeoutError:
+                print("Connection timed out")
+                return
+        else:
+            # Start being discoverable and connectable
+            print("Waiting for connection...")
+            await self.advertise()
+
+
+# -----------------------------------------------------------------------------
+async def main(hci_source, hci_sink, emit_event):
+    # logging.basicConfig(level='DEBUG')
+    speaker = Speaker(hci_source, hci_sink, emit_event, "aac", False)
+    await speaker.run(None)
Author	SHA1	Message	Date
zxzxwu	01603ca9e4	Merge pull request #271 from zxzxwu/device_typing Typing transport and relateds	2023-09-09 00:55:59 +08:00
Gilles Boccon-Gibod	a1b6eb61f2	Merge pull request #269 from google/gbg/android_vendor_hci add support for vendor HCI commands and events	2023-09-08 08:50:49 -07:00
zxzxwu	25f300d3ec	Merge pull request #270 from zxzxwu/typo Fix typos	2023-09-08 17:32:33 +08:00
Josh Wu	41fe63df06	Fix typos	2023-09-08 16:30:06 +08:00
Josh Wu	b312170d5f	Typing transport	2023-09-08 15:27:01 +08:00
David Duarte	cf7f2e8f44	Make platformdirs import lazy platformdirs is not available in Android	2023-09-07 21:13:29 -07:00
Gilles Boccon-Gibod	d292083ed1	Merge pull request #272 from zxzxwu/gfp Bring HfpProtocol back	2023-09-07 13:03:36 -07:00
Gilles Boccon-Gibod	9b11142b45	Merge pull request #267 from google/gbg/rfcomm-with-uuid rfcomm with UUID	2023-09-07 13:01:56 -07:00
Hui Peng	acdbc4d7b9	Raise an exception when an L2cap connection fails	2023-09-07 19:24:38 +02:00
Josh Wu	838d10a09d	Add HFP tests	2023-09-07 23:20:16 +08:00
Josh Wu	3852aa056b	Bring HfpProtocol back	2023-09-07 23:20:09 +08:00
Gilles Boccon-Gibod	ae77e4528f	add support for vendor HCI commands and events	2023-09-06 20:00:15 -07:00
Gilles Boccon-Gibod	9303f4fc5b	Merge pull request #262 from whitevegagabriel/l2cap Port l2cap_bridge sample to Rust	2023-09-06 17:13:12 -07:00
Gilles Boccon-Gibod	8be9f4cb0e	add doc and fix types	2023-09-06 17:05:30 -07:00
Gilles Boccon-Gibod	1ea12b1bf7	rebase	2023-09-06 17:05:24 -07:00
Gilles Boccon-Gibod	65e6d68355	add tcp server	2023-09-06 16:49:21 -07:00
Gabriel White-Vega	9732eb8836	Address PR feedback	2023-09-06 09:47:08 -04:00
Gabriel White-Vega	5ae668bc70	Port l2cap_bridge sample to Rust - Added Rust wrappers where relevant - Edited a couple logs in python l2cap_bridge to be more symmetrical - Created cli subcommand for running the rustified l2cap bridge	2023-09-05 16:03:02 -04:00
Gilles Boccon-Gibod	fd4d1bcca3	Merge pull request #261 from marshallpierce/mp/rust-realtek-tools Rust tools for working with Realtek firmware	2023-09-05 10:55:29 -07:00
Gilles Boccon-Gibod	0a251c9f8e	Merge pull request #265 from mogenson/grpcio-update Update grpcio and pip package versions	2023-08-31 14:53:54 -07:00
Michael Mogenson	351d77be59	Update grpcio and pip package versions The current grpcio version 1.51.1 fails to build on aarch64 based MacOS computers. Update the version of the grpcio and grpcio-tools packages to the latest 1.57.0 version. There are binary wheels available for this version from PyPi for aarch64 MacOS. Also update the pip version for the Conda environment. It seems a newer version of pip is required to detect and install these wheels. Testing: invoke test passes and I can start the bumble-pandora-server successfully.	2023-08-31 14:01:14 -04:00
Marshall Pierce	0e2fc80509	Rust tools for working with Realtek firmware Further adventures in porting tools to Rust to flesh out the supported API. These tools didn't feel like `example`s, so I made a top level `bumble` CLI tool that hosts them all as subcommands. I also moved the usb probe not-really-an-`example` into it as well. I'm open to suggestions on how best to organize the subcommands to make them intuitive to explore with `--help`, and how to leave room for other future tools. I also adopted the per-OS project data dir for a default firmware location so that users can download once and then use those .bin files from anywhere without having to sprinkle .bin files in project directories or reaching inside the python package dir hierarchy.	2023-08-30 15:37:35 -06:00
Gilles Boccon-Gibod	8f3fdecb93	Merge pull request #263 from zxzxwu/pdu Typing packet transmission flow	2023-08-30 11:15:12 -07:00
Josh Wu	249a205d8e	Typing packet transmission flow	2023-08-30 01:47:46 +08:00
Gilles Boccon-Gibod	7485801222	Merge pull request #256 from zxzxwu/sdp-type-fix Typing SDP and add tests	2023-08-28 08:41:02 -07:00
Gilles Boccon-Gibod	4678e59737	Merge pull request #250 from google/gbg/new-rtk-dongles add entry to the list of supported USB devices	2023-08-28 08:40:40 -07:00
Gilles Boccon-Gibod	952d351c00	Merge pull request #247 from google/gbg/wasm-with-ws wasm with ws	2023-08-28 08:40:18 -07:00
Josh Wu	901eb55b0e	Add SDP self tests	2023-08-24 01:27:07 +08:00
Josh Wu	727586e40e	Typing SDP	2023-08-23 14:52:44 +08:00
Gilles Boccon-Gibod	3aa678a58e	Merge pull request #253 from zxzxwu/rfcomm_type_fix Adding more typing in rfcomm.py	2023-08-22 09:47:38 -07:00
Gilles Boccon-Gibod	fc7c1a8113	Merge pull request #255 from zxzxwu/player Remove accidentally added files	2023-08-22 07:34:31 -07:00
Josh Wu	f62a0bbe75	Remove accidentally added files	2023-08-22 22:12:41 +08:00
Josh Wu	7341172739	Use __future__.annotations for typing	2023-08-22 14:44:15 +08:00
Gilles Boccon-Gibod	91b9fbe450	Merge pull request #240 from zxzxwu/ssp Handle SSP Complete events	2023-08-21 18:01:28 -07:00
Josh Wu	e6b566b848	RFCOMM: Refactor role to enum	2023-08-21 15:16:34 +08:00
Josh Wu	2527a711dc	Refactor RFCOMM states to enum	2023-08-21 15:12:52 +08:00
Josh Wu	5fba6b1cae	Complete typing in RFCOMM	2023-08-21 15:12:52 +08:00
Gilles Boccon-Gibod	85a61dc39d	add entry to the list of supported USB devices	2023-08-18 09:56:06 -07:00
Gilles Boccon-Gibod	6226bfd196	fix typo after refactor	2023-08-17 09:51:56 -07:00
Gilles Boccon-Gibod	71e11b7cf8	format	2023-08-15 15:20:48 -07:00
Gilles Boccon-Gibod	800c62fdb6	add readme for web examples	2023-08-15 15:17:38 -07:00
Gilles Boccon-Gibod	640b9cd53a	refactor pyiodide support and add examples	2023-08-15 13:36:58 -07:00
Josh Wu	2af3494d8c	Handle SSP Complete events	2023-08-10 10:58:41 +08:00