Merge "Optimize offscreen layer management" into sc-dev
diff --git a/include/input/Input.h b/include/input/Input.h
index e8678d2..f3369e8 100644
--- a/include/input/Input.h
+++ b/include/input/Input.h
@@ -43,6 +43,13 @@
  * Additional private constants not defined in ndk/ui/input.h.
  */
 enum {
+#ifdef __linux__
+    /* This event was generated or modified by accessibility service. */
+    AKEY_EVENT_FLAG_IS_ACCESSIBILITY_EVENT =
+            android::os::IInputConstants::INPUT_EVENT_FLAG_IS_ACCESSIBILITY_EVENT, // 0x800,
+#else
+    AKEY_EVENT_FLAG_IS_ACCESSIBILITY_EVENT = 0x800;
+#endif
     /* Signifies that the key is being predispatched */
     AKEY_EVENT_FLAG_PREDISPATCH = 0x20000000,
 
@@ -81,6 +88,16 @@
      */
     AMOTION_EVENT_FLAG_NO_FOCUS_CHANGE = 0x40,
 
+#ifdef __linux__
+    /**
+     * This event was generated or modified by accessibility service.
+     */
+    AMOTION_EVENT_FLAG_IS_ACCESSIBILITY_EVENT =
+            android::os::IInputConstants::INPUT_EVENT_FLAG_IS_ACCESSIBILITY_EVENT, // 0x800,
+#else
+    AMOTION_EVENT_FLAG_IS_ACCESSIBILITY_EVENT = 0x800;
+#endif
+
     /* Motion event is inconsistent with previously sent motion events. */
     AMOTION_EVENT_FLAG_TAINTED = 0x80000000,
 };
@@ -89,14 +106,15 @@
  * Allowed VerifiedKeyEvent flags. All other flags from KeyEvent do not get verified.
  * These values must be kept in sync with VerifiedKeyEvent.java
  */
-constexpr int32_t VERIFIED_KEY_EVENT_FLAGS = AKEY_EVENT_FLAG_CANCELED;
+constexpr int32_t VERIFIED_KEY_EVENT_FLAGS =
+        AKEY_EVENT_FLAG_CANCELED | AKEY_EVENT_FLAG_IS_ACCESSIBILITY_EVENT;
 
 /**
  * Allowed VerifiedMotionEventFlags. All other flags from MotionEvent do not get verified.
  * These values must be kept in sync with VerifiedMotionEvent.java
  */
-constexpr int32_t VERIFIED_MOTION_EVENT_FLAGS =
-        AMOTION_EVENT_FLAG_WINDOW_IS_OBSCURED | AMOTION_EVENT_FLAG_WINDOW_IS_PARTIALLY_OBSCURED;
+constexpr int32_t VERIFIED_MOTION_EVENT_FLAGS = AMOTION_EVENT_FLAG_WINDOW_IS_OBSCURED |
+        AMOTION_EVENT_FLAG_WINDOW_IS_PARTIALLY_OBSCURED | AMOTION_EVENT_FLAG_IS_ACCESSIBILITY_EVENT;
 
 /**
  * This flag indicates that the point up event has been canceled.
@@ -222,16 +240,14 @@
     POLICY_FLAG_GESTURE = 0x00000008,
 
     POLICY_FLAG_RAW_MASK = 0x0000ffff,
-#ifdef __linux__
-    POLICY_FLAG_INPUTFILTER_TRUSTED = android::os::IInputConstants::POLICY_FLAG_INPUTFILTER_TRUSTED,
 
+#ifdef __linux__
     POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY =
             android::os::IInputConstants::POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY,
 #else
-    POLICY_FLAG_INPUTFILTER_TRUSTED = 0x10000,
-
     POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY = 0x20000,
 #endif
+
     /* These flags are set by the input dispatcher. */
 
     // Indicates that the input event was injected.
diff --git a/include/input/InputDevice.h b/include/input/InputDevice.h
index 1955104..7f0324a 100644
--- a/include/input/InputDevice.h
+++ b/include/input/InputDevice.h
@@ -318,8 +318,6 @@
         const std::string& name, InputDeviceConfigurationFileType type);
 
 enum ReservedInputDeviceId : int32_t {
-    // Device id assigned to input events generated inside accessibility service
-    ACCESSIBILITY_DEVICE_ID = -2,
     // Device id of a special "virtual" keyboard that is always present.
     VIRTUAL_KEYBOARD_ID = -1,
     // Device id of the "built-in" keyboard if there is one.
diff --git a/libs/binder/LazyServiceRegistrar.cpp b/libs/binder/LazyServiceRegistrar.cpp
index 6165911..f66993f 100644
--- a/libs/binder/LazyServiceRegistrar.cpp
+++ b/libs/binder/LazyServiceRegistrar.cpp
@@ -40,9 +40,9 @@
 
     void setActiveServicesCallback(const std::function<bool(bool)>& activeServicesCallback);
 
-    bool tryUnregister();
+    bool tryUnregisterLocked();
 
-    void reRegister();
+    void reRegisterLocked();
 
 protected:
     Status onClients(const sp<IBinder>& service, bool clients) override;
@@ -59,6 +59,9 @@
         bool registered = true;
     };
 
+    bool registerServiceLocked(const sp<IBinder>& service, const std::string& name,
+                               bool allowIsolated, int dumpFlags);
+
     /**
      * Looks up a service guaranteed to be registered (service from onClients).
      */
@@ -68,7 +71,7 @@
      * Unregisters all services that we can. If we can't unregister all, re-register other
      * services.
      */
-    void tryShutdown();
+    void tryShutdownLocked();
 
     /**
      * Try to shutdown the process, unless:
@@ -76,7 +79,10 @@
      * - The active services count callback returns 'true', or
      * - Some services have clients.
      */
-    void maybeTryShutdown();
+    void maybeTryShutdownLocked();
+
+    // for below
+    std::mutex mMutex;
 
     // count of services with clients
     size_t mNumConnectedServices;
@@ -117,6 +123,13 @@
 
 bool ClientCounterCallbackImpl::registerService(const sp<IBinder>& service, const std::string& name,
                                             bool allowIsolated, int dumpFlags) {
+    std::lock_guard<std::mutex> lock(mMutex);
+    return registerServiceLocked(service, name, allowIsolated, dumpFlags);
+}
+
+bool ClientCounterCallbackImpl::registerServiceLocked(const sp<IBinder>& service,
+                                                      const std::string& name, bool allowIsolated,
+                                                      int dumpFlags) {
     auto manager = interface_cast<AidlServiceManager>(asBinder(defaultServiceManager()));
 
     bool reRegister = mRegisteredServices.count(name) > 0;
@@ -164,14 +177,15 @@
 }
 
 void ClientCounterCallbackImpl::forcePersist(bool persist) {
+    std::lock_guard<std::mutex> lock(mMutex);
     mForcePersist = persist;
     if (!mForcePersist) {
         // Attempt a shutdown in case the number of clients hit 0 while the flag was on
-        maybeTryShutdown();
+        maybeTryShutdownLocked();
     }
 }
 
-bool ClientCounterCallbackImpl::tryUnregister() {
+bool ClientCounterCallbackImpl::tryUnregisterLocked() {
     auto manager = interface_cast<AidlServiceManager>(asBinder(defaultServiceManager()));
 
     for (auto& [name, entry] : mRegisteredServices) {
@@ -187,15 +201,14 @@
     return true;
 }
 
-void ClientCounterCallbackImpl::reRegister() {
+void ClientCounterCallbackImpl::reRegisterLocked() {
     for (auto& [name, entry] : mRegisteredServices) {
         // re-register entry if not already registered
         if (entry.registered) {
             continue;
         }
 
-        if (!registerService(entry.service, name, entry.allowIsolated,
-                             entry.dumpFlags)) {
+        if (!registerServiceLocked(entry.service, name, entry.allowIsolated, entry.dumpFlags)) {
             // Must restart. Otherwise, clients will never be able to get a hold of this service.
             LOG_ALWAYS_FATAL("Bad state: could not re-register services");
         }
@@ -204,7 +217,7 @@
     }
 }
 
-void ClientCounterCallbackImpl::maybeTryShutdown() {
+void ClientCounterCallbackImpl::maybeTryShutdownLocked() {
     if (mForcePersist) {
         ALOGI("Shutdown prevented by forcePersist override flag.");
         return;
@@ -223,15 +236,12 @@
     // client count change event, try to shutdown the process if its services
     // have no clients.
     if (!handledInCallback && mNumConnectedServices == 0) {
-        tryShutdown();
+        tryShutdownLocked();
     }
 }
 
-/**
- * onClients is oneway, so no need to worry about multi-threading. Note that this means multiple
- * invocations could occur on different threads however.
- */
 Status ClientCounterCallbackImpl::onClients(const sp<IBinder>& service, bool clients) {
+    std::lock_guard<std::mutex> lock(mMutex);
     auto & [name, registered] = *assertRegisteredService(service);
     if (registered.clients == clients) {
         LOG_ALWAYS_FATAL("Process already thought %s had clients: %d but servicemanager has "
@@ -252,23 +262,24 @@
     ALOGI("Process has %zu (of %zu available) client(s) in use after notification %s has clients: %d",
           mNumConnectedServices, mRegisteredServices.size(), name.c_str(), clients);
 
-    maybeTryShutdown();
+    maybeTryShutdownLocked();
     return Status::ok();
 }
 
- void ClientCounterCallbackImpl::tryShutdown() {
-     ALOGI("Trying to shut down the service. No clients in use for any service in process.");
+void ClientCounterCallbackImpl::tryShutdownLocked() {
+    ALOGI("Trying to shut down the service. No clients in use for any service in process.");
 
-    if (tryUnregister()) {
-         ALOGI("Unregistered all clients and exiting");
-         exit(EXIT_SUCCESS);
-     }
+    if (tryUnregisterLocked()) {
+        ALOGI("Unregistered all clients and exiting");
+        exit(EXIT_SUCCESS);
+    }
 
-    reRegister();
+    reRegisterLocked();
 }
 
 void ClientCounterCallbackImpl::setActiveServicesCallback(const std::function<bool(bool)>&
                                                           activeServicesCallback) {
+    std::lock_guard<std::mutex> lock(mMutex);
     mActiveServicesCallback = activeServicesCallback;
 }
 
@@ -291,11 +302,15 @@
 }
 
 bool ClientCounterCallback::tryUnregister() {
-    return mImpl->tryUnregister();
+    // see comments in header, this should only be called from the active
+    // services callback, see also b/191781736
+    return mImpl->tryUnregisterLocked();
 }
 
 void ClientCounterCallback::reRegister() {
-    mImpl->reRegister();
+    // see comments in header, this should only be called from the active
+    // services callback, see also b/191781736
+    mImpl->reRegisterLocked();
 }
 
 }  // namespace internal
diff --git a/libs/binder/include/binder/LazyServiceRegistrar.h b/libs/binder/include/binder/LazyServiceRegistrar.h
index f3ba830..2e22b84 100644
--- a/libs/binder/include/binder/LazyServiceRegistrar.h
+++ b/libs/binder/include/binder/LazyServiceRegistrar.h
@@ -79,9 +79,10 @@
       */
      void setActiveServicesCallback(const std::function<bool(bool)>& activeServicesCallback);
 
-    /**
+     /**
       * Try to unregister all services previously registered with 'registerService'.
-      * Returns 'true' if successful.
+      * Returns 'true' if successful. This should only be called within the callback registered by
+      * setActiveServicesCallback.
       */
      bool tryUnregister();
 
diff --git a/libs/binder/libbinder.arm32.map b/libs/binder/libbinder.arm32.map
index 64fdd91..c8aebb3 100644
--- a/libs/binder/libbinder.arm32.map
+++ b/libs/binder/libbinder.arm32.map
@@ -389,15 +389,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_jj;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1076,7 +1067,6 @@
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ENS_6vectorIxNS_9allocatorIxEEEEEENS_19__map_value_compareIS3_S8_NS_4lessIS3_EELb1EEENS5_IS8_EEE4findIS3_EENS_21__tree_const_iteratorIS8_PNS_11__tree_nodeIS8_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
-    _ZNKSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE14__count_uniqueIS7_EEjRKT_;
     _ZNSt3__111__sift_downIRNS_4lessIN7android8RpcState10BinderNode9AsyncTodoEEENS_11__wrap_iterIPS5_EEEEvT0_SB_T_NS_15iterator_traitsISB_E15difference_typeESB_;
     _ZNSt3__111unique_lockINS_5mutexEE6unlockEv;
     _ZNSt3__112__hash_tableINS_17__hash_value_typeIijEENS_22__unordered_map_hasherIiS2_NS_4hashIiEELb1EEENS_21__unordered_map_equalIiS2_NS_8equal_toIiEELb1EEENS_9allocatorIS2_EEE14__erase_uniqueIiEEjRKT_;
@@ -1223,9 +1213,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_15__tree_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEEiEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1353,12 +1340,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE4_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1447,7 +1428,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1581,7 +1561,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm32.vendor.map b/libs/binder/libbinder.arm32.vendor.map
index 8d5a323..2aa65de 100644
--- a/libs/binder/libbinder.arm32.vendor.map
+++ b/libs/binder/libbinder.arm32.vendor.map
@@ -359,15 +359,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_jj;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1022,7 +1013,6 @@
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ENS_6vectorIxNS_9allocatorIxEEEEEENS_19__map_value_compareIS3_S8_NS_4lessIS3_EELb1EEENS5_IS8_EEE4findIS3_EENS_21__tree_const_iteratorIS8_PNS_11__tree_nodeIS8_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
-    _ZNKSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE14__count_uniqueIS7_EEjRKT_;
     _ZNSt3__111__sift_downIRNS_4lessIN7android8RpcState10BinderNode9AsyncTodoEEENS_11__wrap_iterIPS5_EEEEvT0_SB_T_NS_15iterator_traitsISB_E15difference_typeESB_;
     _ZNSt3__111unique_lockINS_5mutexEE6unlockEv;
     _ZNSt3__112__hash_tableINS_17__hash_value_typeIijEENS_22__unordered_map_hasherIiS2_NS_4hashIiEELb1EEENS_21__unordered_map_equalIiS2_NS_8equal_toIiEELb1EEENS_9allocatorIS2_EEE14__erase_uniqueIiEEjRKT_;
@@ -1169,9 +1159,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_15__tree_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEEiEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1289,12 +1276,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE4_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1379,7 +1360,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1506,7 +1486,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm64.map b/libs/binder/libbinder.arm64.map
index dc34de8..538fc1f 100644
--- a/libs/binder/libbinder.arm64.map
+++ b/libs/binder/libbinder.arm64.map
@@ -390,15 +390,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_mm;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1213,9 +1204,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE5eraseENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEElEE;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEElEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1339,12 +1327,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE8_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1433,7 +1415,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1565,7 +1546,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm64.vendor.map b/libs/binder/libbinder.arm64.vendor.map
index 971ba92..044cc82 100644
--- a/libs/binder/libbinder.arm64.vendor.map
+++ b/libs/binder/libbinder.arm64.vendor.map
@@ -359,15 +359,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_mm;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1158,9 +1149,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE5eraseENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEElEE;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEElEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1274,12 +1262,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE8_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1364,7 +1346,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1489,7 +1470,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/input/android/os/IInputConstants.aidl b/libs/input/android/os/IInputConstants.aidl
index 3038d9d..474a1e4 100644
--- a/libs/input/android/os/IInputConstants.aidl
+++ b/libs/input/android/os/IInputConstants.aidl
@@ -42,16 +42,15 @@
     const int INVALID_INPUT_EVENT_ID = 0;
 
     /**
-     * The injected event was originally sent from InputDispatcher. Most likely, the journey of the
-     * event looked as follows:
-     * InputDispatcherPolicyInterface::filterInputEvent -> InputFilter.java::onInputEvent ->
-     * InputFilter.java::sendInputEvent -> InputDispatcher::injectInputEvent, without being modified
-     * along the way.
-     */
-    const int POLICY_FLAG_INPUTFILTER_TRUSTED = 0x10000;
-
-    /**
-     * The input event was injected from accessibility
+     * The input event was injected from accessibility. Used in policyFlags for input event
+     * injection.
      */
     const int POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY = 0x20000;
+
+    /**
+     * The input event was generated or modified by accessibility service.
+     * Shared by both KeyEvent and MotionEvent flags, so this value should not overlap with either
+     * set of flags, including in input/Input.h and in android/input.h.
+     */
+    const int INPUT_EVENT_FLAG_IS_ACCESSIBILITY_EVENT = 0x800;
 }
diff --git a/libs/renderengine/skia/Cache.cpp b/libs/renderengine/skia/Cache.cpp
index 725f57b..d9d2496 100644
--- a/libs/renderengine/skia/Cache.cpp
+++ b/libs/renderengine/skia/Cache.cpp
@@ -99,6 +99,9 @@
     LayerSettings layer{
             .geometry =
                     Geometry{
+                            // The position transform doesn't matter when the reduced shader mode
+                            // in in effect. A matrix transform stage is always included.
+                            .positionTransform = mat4(),
                             .boundaries = rect,
                             .roundedCornersCrop = rect,
                     },
@@ -109,29 +112,18 @@
                                           }},
     };
 
-    auto threeCornerRadii = {0.0f, 0.05f, 50.f};
-    auto oneCornerRadius = {50.f};
-
-    // Test both drawRect and drawRRect
     auto layers = std::vector<const LayerSettings*>{&layer};
     for (auto dataspace : {kDestDataSpace, kOtherDataSpace}) {
         layer.sourceDataspace = dataspace;
-        for (bool identity : {true, false}) {
-            layer.geometry.positionTransform = identity ? mat4() : kScaleAndTranslate;
-            // Corner radii less than 0.5 creates a special shader. This likely occurs in real usage
-            // due to animating corner radius.
-            // For the non-idenity matrix, only the large corner radius will create a new shader.
-            for (float roundedCornersRadius : identity ? threeCornerRadii : oneCornerRadius) {
-                // roundedCornersCrop is always set, but it is this radius that triggers the
-                // behavior
-                layer.geometry.roundedCornersRadius = roundedCornersRadius;
-                for (bool isOpaque : {true, false}) {
-                    layer.source.buffer.isOpaque = isOpaque;
-                    for (auto alpha : {half(.23999f), half(1.0f)}) {
-                        layer.alpha = alpha;
-                        renderengine->drawLayers(display, layers, dstTexture, kUseFrameBufferCache,
-                                                 base::unique_fd(), nullptr);
-                    }
+        for (float roundedCornersRadius : {0.0f, 50.0f}) {
+            // roundedCornersCrop is always set, but the radius triggers the behavior
+            layer.geometry.roundedCornersRadius = roundedCornersRadius;
+            for (bool isOpaque : {true, false}) {
+                layer.source.buffer.isOpaque = isOpaque;
+                for (auto alpha : {half(.2f), half(1.0f)}) {
+                    layer.alpha = alpha;
+                    renderengine->drawLayers(display, layers, dstTexture, kUseFrameBufferCache,
+                                             base::unique_fd(), nullptr);
                 }
             }
         }
@@ -157,7 +149,7 @@
     auto layers = std::vector<const LayerSettings*>{&layer};
     for (auto transform : {mat4(), kScaleAndTranslate}) {
         layer.geometry.positionTransform = transform;
-        for (float roundedCornersRadius : {0.0f, 0.05f, 50.f}) {
+        for (float roundedCornersRadius : {0.0f, 50.f}) {
             layer.geometry.roundedCornersRadius = roundedCornersRadius;
             renderengine->drawLayers(display, layers, dstTexture, kUseFrameBufferCache,
                                      base::unique_fd(), nullptr);
@@ -295,34 +287,43 @@
                                                   ExternalTexture::Usage::READABLE |
                                                           ExternalTexture::Usage::WRITEABLE);
 
-        // 6 shaders
         drawSolidLayers(renderengine, display, dstTexture);
-        // 8 shaders
         drawShadowLayers(renderengine, display, srcTexture);
 
         if (renderengine->supportsBackgroundBlur()) {
-            // 2 shaders
             drawBlurLayers(renderengine, display, dstTexture);
         }
 
-        // The majority of shaders are related to sampling images.
-        drawImageLayers(renderengine, display, dstTexture, srcTexture);
-
         // should be the same as AHARDWAREBUFFER_USAGE_GPU_SAMPLED_IMAGE;
         const int64_t usageExternal = GRALLOC_USAGE_HW_TEXTURE;
-
         sp<GraphicBuffer> externalBuffer =
                 new GraphicBuffer(displayRect.width(), displayRect.height(), PIXEL_FORMAT_RGBA_8888,
                                   1, usageExternal, "primeShaderCache_external");
         const auto externalTexture =
                 std::make_shared<ExternalTexture>(externalBuffer, *renderengine,
                                                   ExternalTexture::Usage::READABLE);
-        // TODO(b/184665179) doubles number of image shader compilations, but only somewhere
-        // between 6 and 8 will occur in real uses.
-        drawImageLayers(renderengine, display, dstTexture, externalTexture);
 
-        // Draw layers for b/185569240.
-        drawClippedLayers(renderengine, display, dstTexture, externalTexture);
+        // Another external texture with a different pixel format triggers useIsOpaqueWorkaround
+        sp<GraphicBuffer> f16ExternalBuffer =
+                new GraphicBuffer(displayRect.width(), displayRect.height(), PIXEL_FORMAT_RGBA_FP16,
+                                  1, usageExternal, "primeShaderCache_external_f16");
+        const auto f16ExternalTexture =
+                std::make_shared<ExternalTexture>(f16ExternalBuffer, *renderengine,
+                                                  ExternalTexture::Usage::READABLE);
+
+        // The majority of shaders are related to sampling images.
+        // These need to be generated with various source textures
+        // The F16 texture may not be usable on all devices, so check first that it was created with
+        // the requested usage bit.
+        auto textures = {srcTexture, externalTexture};
+        auto texturesWithF16 = {srcTexture, externalTexture, f16ExternalTexture};
+        bool canUsef16 = f16ExternalBuffer->getUsage() & GRALLOC_USAGE_HW_TEXTURE;
+
+        for (auto texture : canUsef16 ? texturesWithF16 : textures) {
+            drawImageLayers(renderengine, display, dstTexture, texture);
+            // Draw layers for b/185569240.
+            drawClippedLayers(renderengine, display, dstTexture, texture);
+        }
 
         const nsecs_t timeAfter = systemTime();
         const float compileTimeMs = static_cast<float>(timeAfter - timeBefore) / 1.0E6;
diff --git a/libs/renderengine/skia/filters/LinearEffect.cpp b/libs/renderengine/skia/filters/LinearEffect.cpp
index 9b044e1..fc45af9 100644
--- a/libs/renderengine/skia/filters/LinearEffect.cpp
+++ b/libs/renderengine/skia/filters/LinearEffect.cpp
@@ -167,13 +167,12 @@
 
                                 float nits = xyz.y;
 
-                                // clamp to max input luminance
-                                nits = clamp(nits, 0.0, maxInLumi);
-
-                                // scale [0.0, maxInLumi] to [0.0, maxOutLumi]
+                                // if the max input luminance is less than what we can output then
+                                // no tone mapping is needed as all color values will be in range.
                                 if (maxInLumi <= maxOutLumi) {
-                                    return xyz * (maxOutLumi / maxInLumi);
+                                    return xyz;
                                 } else {
+
                                     // three control points
                                     const float x0 = 10.0;
                                     const float y0 = 17.0;
diff --git a/services/inputflinger/TEST_MAPPING b/services/inputflinger/TEST_MAPPING
index dc0e60c..6fdb046 100644
--- a/services/inputflinger/TEST_MAPPING
+++ b/services/inputflinger/TEST_MAPPING
@@ -32,6 +32,15 @@
       ]
     },
     {
+      "name": "FrameworksCoreTests",
+      "options": [
+        {
+          "include-filter": "android.view.VerifiedKeyEventTest",
+          "include-filter": "android.view.VerifiedMotionEventTest"
+        }
+      ]
+    },
+    {
       "name": "CtsSecurityTestCases",
       "options": [
         {
diff --git a/services/inputflinger/dispatcher/InputDispatcher.cpp b/services/inputflinger/dispatcher/InputDispatcher.cpp
index c0010ab..1899c5f 100644
--- a/services/inputflinger/dispatcher/InputDispatcher.cpp
+++ b/services/inputflinger/dispatcher/InputDispatcher.cpp
@@ -3787,7 +3787,7 @@
         if (shouldSendKeyToInputFilterLocked(args)) {
             mLock.unlock();
 
-            policyFlags |= POLICY_FLAG_FILTERED | POLICY_FLAG_INPUTFILTER_TRUSTED;
+            policyFlags |= POLICY_FLAG_FILTERED;
             if (!mPolicy->filterInputEvent(&event, policyFlags)) {
                 return; // event was consumed by the filter
             }
@@ -4010,16 +4010,14 @@
     }
 
     // For all injected events, set device id = VIRTUAL_KEYBOARD_ID. The only exception is events
-    // that have gone through the InputFilter. If the event passed through the InputFilter,
-    // but did not get modified, assign the provided device id. If the InputFilter modifies the
-    // events in any way, it is responsible for removing this flag.
-    // If the injected event originated from accessibility, assign the accessibility device id,
-    // so that it can be distinguished from regular injected events.
+    // that have gone through the InputFilter. If the event passed through the InputFilter, assign
+    // the provided device id. If the InputFilter is accessibility, and it modifies or synthesizes
+    // the injected event, it is responsible for setting POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY.
+    // For those events, we will set FLAG_IS_ACCESSIBILITY_EVENT to allow apps to distinguish them
+    // from events that originate from actual hardware.
     int32_t resolvedDeviceId = VIRTUAL_KEYBOARD_ID;
-    if (policyFlags & POLICY_FLAG_INPUTFILTER_TRUSTED) {
+    if (policyFlags & POLICY_FLAG_FILTERED) {
         resolvedDeviceId = event->getDeviceId();
-    } else if (policyFlags & POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY) {
-        resolvedDeviceId = ACCESSIBILITY_DEVICE_ID;
     }
 
     std::queue<std::unique_ptr<EventEntry>> injectedEntries;
@@ -4032,6 +4030,9 @@
             }
 
             int32_t flags = incomingKey.getFlags();
+            if (policyFlags & POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY) {
+                flags |= AKEY_EVENT_FLAG_IS_ACCESSIBILITY_EVENT;
+            }
             int32_t keyCode = incomingKey.getKeyCode();
             int32_t metaState = incomingKey.getMetaState();
             accelerateMetaShortcuts(resolvedDeviceId, action,
@@ -4073,6 +4074,7 @@
             size_t pointerCount = motionEvent.getPointerCount();
             const PointerProperties* pointerProperties = motionEvent.getPointerProperties();
             int32_t actionButton = motionEvent.getActionButton();
+            int32_t flags = motionEvent.getFlags();
             int32_t displayId = motionEvent.getDisplayId();
             if (!validateMotionEvent(action, actionButton, pointerCount, pointerProperties)) {
                 return InputEventInjectionResult::FAILED;
@@ -4088,6 +4090,10 @@
                 }
             }
 
+            if (policyFlags & POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY) {
+                flags |= AMOTION_EVENT_FLAG_IS_ACCESSIBILITY_EVENT;
+            }
+
             mLock.lock();
             const nsecs_t* sampleEventTimes = motionEvent.getSampleEventTimes();
             const PointerCoords* samplePointerCoords = motionEvent.getSamplePointerCoords();
@@ -4095,8 +4101,7 @@
                     std::make_unique<MotionEntry>(motionEvent.getId(), *sampleEventTimes,
                                                   resolvedDeviceId, motionEvent.getSource(),
                                                   motionEvent.getDisplayId(), policyFlags, action,
-                                                  actionButton, motionEvent.getFlags(),
-                                                  motionEvent.getMetaState(),
+                                                  actionButton, flags, motionEvent.getMetaState(),
                                                   motionEvent.getButtonState(),
                                                   motionEvent.getClassification(),
                                                   motionEvent.getEdgeFlags(),
@@ -4116,7 +4121,7 @@
                         std::make_unique<MotionEntry>(motionEvent.getId(), *sampleEventTimes,
                                                       resolvedDeviceId, motionEvent.getSource(),
                                                       motionEvent.getDisplayId(), policyFlags,
-                                                      action, actionButton, motionEvent.getFlags(),
+                                                      action, actionButton, flags,
                                                       motionEvent.getMetaState(),
                                                       motionEvent.getButtonState(),
                                                       motionEvent.getClassification(),
diff --git a/services/inputflinger/tests/InputDispatcher_test.cpp b/services/inputflinger/tests/InputDispatcher_test.cpp
index 77ca12c..3a9dede 100644
--- a/services/inputflinger/tests/InputDispatcher_test.cpp
+++ b/services/inputflinger/tests/InputDispatcher_test.cpp
@@ -3171,7 +3171,8 @@
         mWindow->consumeFocusEvent(true);
     }
 
-    void testInjectedKey(int32_t policyFlags, int32_t injectedDeviceId, int32_t resolvedDeviceId) {
+    void testInjectedKey(int32_t policyFlags, int32_t injectedDeviceId, int32_t resolvedDeviceId,
+                         int32_t flags) {
         KeyEvent event;
 
         const nsecs_t eventTime = systemTime(SYSTEM_TIME_MONOTONIC);
@@ -3188,6 +3189,45 @@
         InputEvent* received = mWindow->consume();
         ASSERT_NE(nullptr, received);
         ASSERT_EQ(resolvedDeviceId, received->getDeviceId());
+        ASSERT_EQ(received->getType(), AINPUT_EVENT_TYPE_KEY);
+        KeyEvent& keyEvent = static_cast<KeyEvent&>(*received);
+        ASSERT_EQ(flags, keyEvent.getFlags());
+    }
+
+    void testInjectedMotion(int32_t policyFlags, int32_t injectedDeviceId, int32_t resolvedDeviceId,
+                            int32_t flags) {
+        MotionEvent event;
+        PointerProperties pointerProperties[1];
+        PointerCoords pointerCoords[1];
+        pointerProperties[0].clear();
+        pointerProperties[0].id = 0;
+        pointerCoords[0].clear();
+        pointerCoords[0].setAxisValue(AMOTION_EVENT_AXIS_X, 300);
+        pointerCoords[0].setAxisValue(AMOTION_EVENT_AXIS_Y, 400);
+
+        ui::Transform identityTransform;
+        const nsecs_t eventTime = systemTime(SYSTEM_TIME_MONOTONIC);
+        event.initialize(InputEvent::nextId(), injectedDeviceId, AINPUT_SOURCE_TOUCHSCREEN,
+                         DISPLAY_ID, INVALID_HMAC, AMOTION_EVENT_ACTION_DOWN, 0, 0,
+                         AMOTION_EVENT_EDGE_FLAG_NONE, AMETA_NONE, 0, MotionClassification::NONE,
+                         identityTransform, 0, 0, AMOTION_EVENT_INVALID_CURSOR_POSITION,
+                         AMOTION_EVENT_INVALID_CURSOR_POSITION,
+                         0 /*AMOTION_EVENT_INVALID_DISPLAY_SIZE*/,
+                         0 /*AMOTION_EVENT_INVALID_DISPLAY_SIZE*/, eventTime, eventTime,
+                         /*pointerCount*/ 1, pointerProperties, pointerCoords);
+
+        const int32_t additionalPolicyFlags = POLICY_FLAG_PASS_TO_USER;
+        ASSERT_EQ(InputEventInjectionResult::SUCCEEDED,
+                  mDispatcher->injectInputEvent(&event, INJECTOR_PID, INJECTOR_UID,
+                                                InputEventInjectionSync::WAIT_FOR_RESULT, 10ms,
+                                                policyFlags | additionalPolicyFlags));
+
+        InputEvent* received = mWindow->consume();
+        ASSERT_NE(nullptr, received);
+        ASSERT_EQ(resolvedDeviceId, received->getDeviceId());
+        ASSERT_EQ(received->getType(), AINPUT_EVENT_TYPE_MOTION);
+        MotionEvent& motionEvent = static_cast<MotionEvent&>(*received);
+        ASSERT_EQ(flags, motionEvent.getFlags());
     }
 
 private:
@@ -3195,20 +3235,29 @@
 };
 
 TEST_F(InputFilterInjectionPolicyTest, TrustedFilteredEvents_KeepOriginalDeviceId) {
-    // We don't need POLICY_FLAG_FILTERED here, but it will be set in practice, so keep it to make
-    // the test more closely resemble the real usage
-    testInjectedKey(POLICY_FLAG_FILTERED | POLICY_FLAG_INPUTFILTER_TRUSTED, 3 /*injectedDeviceId*/,
-                    3 /*resolvedDeviceId*/);
+    // Must have POLICY_FLAG_FILTERED here to indicate that the event has gone through the input
+    // filter. Without it, the event will no different from a regularly injected event, and the
+    // injected device id will be overwritten.
+    testInjectedKey(POLICY_FLAG_FILTERED, 3 /*injectedDeviceId*/, 3 /*resolvedDeviceId*/,
+                    0 /*flags*/);
 }
 
-TEST_F(InputFilterInjectionPolicyTest, EventsInjectedFromAccessibility_HaveAccessibilityDeviceId) {
+TEST_F(InputFilterInjectionPolicyTest, KeyEventsInjectedFromAccessibility_HaveAccessibilityFlag) {
     testInjectedKey(POLICY_FLAG_FILTERED | POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY,
-                    3 /*injectedDeviceId*/, ACCESSIBILITY_DEVICE_ID /*resolvedDeviceId*/);
+                    3 /*injectedDeviceId*/, 3 /*resolvedDeviceId*/,
+                    AKEY_EVENT_FLAG_IS_ACCESSIBILITY_EVENT);
+}
+
+TEST_F(InputFilterInjectionPolicyTest,
+       MotionEventsInjectedFromAccessibility_HaveAccessibilityFlag) {
+    testInjectedMotion(POLICY_FLAG_FILTERED | POLICY_FLAG_INJECTED_FROM_ACCESSIBILITY,
+                       3 /*injectedDeviceId*/, 3 /*resolvedDeviceId*/,
+                       AMOTION_EVENT_FLAG_IS_ACCESSIBILITY_EVENT);
 }
 
 TEST_F(InputFilterInjectionPolicyTest, RegularInjectedEvents_ReceiveVirtualDeviceId) {
     testInjectedKey(0 /*policyFlags*/, 3 /*injectedDeviceId*/,
-                    VIRTUAL_KEYBOARD_ID /*resolvedDeviceId*/);
+                    VIRTUAL_KEYBOARD_ID /*resolvedDeviceId*/, 0 /*flags*/);
 }
 
 class InputDispatcherOnPointerDownOutsideFocus : public InputDispatcherTest {
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 7fe8525..af71b09 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1189,6 +1189,10 @@
     updatePhaseConfiguration(refreshRate);
     ATRACE_INT("ActiveConfigFPS", refreshRate.getValue());
 
+    if (mRefreshRateOverlay) {
+        mRefreshRateOverlay->changeRefreshRate(upcomingMode->getFps());
+    }
+
     if (mUpcomingActiveMode.event != Scheduler::ModeEvent::None) {
         const nsecs_t vsyncPeriod = refreshRate.getPeriodNsecs();
         const auto physicalId = display->getPhysicalId();
@@ -1271,9 +1275,6 @@
     }
 
     mScheduler->onNewVsyncPeriodChangeTimeline(outTimeline);
-    if (mRefreshRateOverlay) {
-        mRefreshRateOverlay->changeRefreshRate(desiredMode->getFps());
-    }
 
     // Scheduler will submit an empty frame to HWC if needed.
     mSetActiveModePending = true;