Merge "Updated MediaDrm API based on review input." into jb-mr2-dev
diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index 26c2d1c..29838e4 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -117,6 +117,7 @@
 static bool g_compress = false;
 static bool g_nohup = false;
 static int g_initialSleepSecs = 0;
+static const char* g_kernelTraceFuncs = NULL;
 
 /* Global state */
 static bool g_traceAborted = false;
@@ -132,6 +133,30 @@
 static const char* k_tracingOverwriteEnablePath =
     "/sys/kernel/debug/tracing/options/overwrite";
 
+static const char* k_currentTracerPath =
+    "/sys/kernel/debug/tracing/current_tracer";
+
+static const char* k_printTgidPath =
+    "/sys/kernel/debug/tracing/options/print-tgid";
+
+static const char* k_funcgraphAbsTimePath =
+    "/sys/kernel/debug/tracing/options/funcgraph-abstime";
+
+static const char* k_funcgraphCpuPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-cpu";
+
+static const char* k_funcgraphProcPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-proc";
+
+static const char* k_funcgraphFlatPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-flat";
+
+static const char* k_funcgraphDurationPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-duration";
+
+static const char* k_ftraceFilterPath =
+    "/sys/kernel/debug/tracing/set_ftrace_filter";
+
 static const char* k_tracingOnPath =
     "/sys/kernel/debug/tracing/tracing_on";
 
@@ -148,10 +173,22 @@
     return access(filename, W_OK) != -1;
 }
 
-// Write a string to a file, returning true if the write was successful.
-static bool writeStr(const char* filename, const char* str)
+// Truncate a file.
+static bool truncateFile(const char* path)
 {
-    int fd = open(filename, O_WRONLY);
+    int err = truncate(path, 0);
+    if (err != 0) {
+        fprintf(stderr, "error truncating %s: %s (%d)\n", path,
+                strerror(errno), errno);
+        return false;
+    }
+
+    return true;
+}
+
+static bool _writeStr(const char* filename, const char* str, int flags)
+{
+    int fd = open(filename, flags);
     if (fd == -1) {
         fprintf(stderr, "error opening %s: %s (%d)\n", filename,
                 strerror(errno), errno);
@@ -171,6 +208,18 @@
     return ok;
 }
 
+// Write a string to a file, returning true if the write was successful.
+static bool writeStr(const char* filename, const char* str)
+{
+    return _writeStr(filename, str, O_WRONLY);
+}
+
+// Append a string to a file, returning true if the write was successful.
+static bool appendStr(const char* filename, const char* str)
+{
+    return _writeStr(filename, str, O_APPEND|O_WRONLY);
+}
+
 // Enable or disable a kernel option by writing a "1" or a "0" into a /sys
 // file.
 static bool setKernelOptionEnable(const char* filename, bool enable)
@@ -244,16 +293,7 @@
 // Clear the contents of the kernel trace.
 static bool clearTrace()
 {
-    int traceFD = creat(k_tracePath, 0);
-    if (traceFD == -1) {
-        fprintf(stderr, "error truncating %s: %s (%d)\n", k_tracePath,
-                strerror(errno), errno);
-        return false;
-    }
-
-    close(traceFD);
-
-    return true;
+    return truncateFile(k_tracePath);
 }
 
 // Set the size of the kernel's trace buffer in kilobytes.
@@ -275,6 +315,14 @@
     return writeStr(k_traceClockPath, enable ? "global" : "local");
 }
 
+static bool setPrintTgidEnableIfPresent(bool enable)
+{
+    if (fileExists(k_printTgidPath)) {
+        return setKernelOptionEnable(k_printTgidPath, enable);
+    }
+    return true;
+}
+
 // Poke all the binder-enabled processes in the system to get them to re-read
 // their system properties.
 static bool pokeBinderServices()
@@ -330,8 +378,90 @@
     return ok;
 }
 
-// Enable tracing in the kernel.
-static bool startTrace()
+// Verify that the comma separated list of functions are being traced by the
+// kernel.
+static bool verifyKernelTraceFuncs(const char* funcs)
+{
+    int fd = open(k_ftraceFilterPath, O_RDONLY);
+    if (fd == -1) {
+        fprintf(stderr, "error opening %s: %s (%d)\n", k_ftraceFilterPath,
+            strerror(errno), errno);
+        return false;
+    }
+
+    char buf[4097];
+    ssize_t n = read(fd, buf, 4096);
+    close(fd);
+    if (n == -1) {
+        fprintf(stderr, "error reading %s: %s (%d)\n", k_ftraceFilterPath,
+            strerror(errno), errno);
+        return false;
+    }
+
+    buf[n] = '\0';
+    String8 funcList = String8::format("\n%s", buf);
+
+    // Make sure that every function listed in funcs is in the list we just
+    // read from the kernel.
+    bool ok = true;
+    char* myFuncs = strdup(funcs);
+    char* func = strtok(myFuncs, ",");
+    while (func) {
+        String8 fancyFunc = String8::format("\n%s\n", func);
+        bool found = funcList.find(fancyFunc.string(), 0) >= 0;
+        if (!found || func[0] == '\0') {
+            fprintf(stderr, "error: \"%s\" is not a valid kernel function "
+                "to trace.\n", func);
+            ok = false;
+        }
+        func = strtok(NULL, ",");
+    }
+    free(myFuncs);
+
+    return ok;
+}
+
+// Set the comma separated list of functions that the kernel is to trace.
+static bool setKernelTraceFuncs(const char* funcs)
+{
+    bool ok = true;
+
+    if (funcs == NULL || funcs[0] == '\0') {
+        // Disable kernel function tracing.
+        ok &= writeStr(k_currentTracerPath, "nop");
+        if (fileExists(k_ftraceFilterPath)) {
+            ok &= truncateFile(k_ftraceFilterPath);
+        }
+    } else {
+        // Enable kernel function tracing.
+        ok &= writeStr(k_currentTracerPath, "function_graph");
+        ok &= setKernelOptionEnable(k_funcgraphAbsTimePath, true);
+        ok &= setKernelOptionEnable(k_funcgraphCpuPath, true);
+        ok &= setKernelOptionEnable(k_funcgraphProcPath, true);
+        ok &= setKernelOptionEnable(k_funcgraphFlatPath, true);
+
+        // Set the requested filter functions.
+        ok &= truncateFile(k_ftraceFilterPath);
+        char* myFuncs = strdup(funcs);
+        char* func = strtok(myFuncs, ",");
+        while (func) {
+            ok &= appendStr(k_ftraceFilterPath, func);
+            func = strtok(NULL, ",");
+        }
+        free(myFuncs);
+
+        // Verify that the set functions are being traced.
+        if (ok) {
+            ok &= verifyKernelTraceFuncs(funcs);
+        }
+    }
+
+    return ok;
+}
+
+// Set all the kernel tracing settings to the desired state for this trace
+// capture.
+static bool setUpTrace()
 {
     bool ok = true;
 
@@ -339,6 +469,8 @@
     ok &= setTraceOverwriteEnable(g_traceOverwrite);
     ok &= setTraceBufferSizeKB(g_traceBufferSizeKB);
     ok &= setGlobalClockEnable(true);
+    ok &= setPrintTgidEnableIfPresent(true);
+    ok &= setKernelTraceFuncs(g_kernelTraceFuncs);
 
     // Set up the tags property.
     uint64_t tags = 0;
@@ -373,18 +505,12 @@
         }
     }
 
-    // Enable tracing.
-    ok &= setTracingEnabled(true);
-
     return ok;
 }
 
-// Disable tracing in the kernel.
-static void stopTrace()
+// Reset all the kernel tracing settings to their default state.
+static void cleanUpTrace()
 {
-    // Disable tracing.
-    setTracingEnabled(false);
-
     // Disable all tracing that we're able to.
     disableKernelTraceEvents();
 
@@ -393,10 +519,23 @@
 
     // Set the options back to their defaults.
     setTraceOverwriteEnable(true);
+    setTraceBufferSizeKB(1);
     setGlobalClockEnable(false);
+    setPrintTgidEnableIfPresent(false);
+    setKernelTraceFuncs(NULL);
+}
 
-    // Note that we can't reset the trace buffer size here because that would
-    // clear the trace before we've read it.
+
+// Enable tracing in the kernel.
+static bool startTrace()
+{
+    return setTracingEnabled(true);
+}
+
+// Disable tracing in the kernel.
+static void stopTrace()
+{
+    setTracingEnabled(false);
 }
 
 // Read the current kernel trace and write it to stdout.
@@ -556,6 +695,7 @@
     fprintf(stderr, "options include:\n"
                     "  -b N            use a trace buffer size of N KB\n"
                     "  -c              trace into a circular buffer\n"
+                    "  -k fname,...    trace the listed kernel functions\n"
                     "  -n              ignore signals\n"
                     "  -s N            sleep for N seconds before tracing [default 0]\n"
                     "  -t N            trace for N seconds [defualt 5]\n"
@@ -592,7 +732,7 @@
             {           0,                0, 0,  0 }
         };
 
-        ret = getopt_long(argc, argv, "b:cns:t:z",
+        ret = getopt_long(argc, argv, "b:ck:ns:t:z",
                           long_options, &option_index);
 
         if (ret < 0) {
@@ -614,6 +754,10 @@
                 g_traceOverwrite = true;
             break;
 
+            case 'k':
+                g_kernelTraceFuncs = optarg;
+                break;
+
             case 'n':
                 g_nohup = true;
                 break;
@@ -663,7 +807,9 @@
         sleep(g_initialSleepSecs);
     }
 
-    bool ok = startTrace();
+    bool ok = true;
+    ok &= setUpTrace();
+    ok &= startTrace();
 
     if (ok && traceStart) {
         printf("capturing trace...");
@@ -709,7 +855,7 @@
 
     // Reset the trace buffer size to 1.
     if (traceStop)
-        setTraceBufferSizeKB(1);
+        cleanUpTrace();
 
     return g_traceAborted ? 1 : 0;
 }
diff --git a/cmds/dumpstate/dumpstate.c b/cmds/dumpstate/dumpstate.c
index 9a1839d..b3a4cc6 100644
--- a/cmds/dumpstate/dumpstate.c
+++ b/cmds/dumpstate/dumpstate.c
@@ -161,7 +161,7 @@
 
     if (screenshot_path[0]) {
         ALOGI("taking screenshot\n");
-        run_command(NULL, 5, SU_PATH, "root", "screenshot", screenshot_path, NULL);
+        run_command(NULL, 10, "/system/bin/screencap", "-p", screenshot_path, NULL);
         ALOGI("wrote screenshot: %s\n", screenshot_path);
     }
 
@@ -311,6 +311,7 @@
             "  -b: play sound file instead of vibrate, at beginning of job\n"
             "  -e: play sound file instead of vibrate, at end of job\n"
             "  -q: disable vibrate\n"
+            "  -B: send broadcast when finished (requires -o and -p)\n"
 		);
 }
 
@@ -323,6 +324,7 @@
     char* end_sound = 0;
     int use_socket = 0;
     int do_fb = 0;
+    int do_broadcast = 0;
 
     if (getuid() != 0) {
         // Old versions of the adb client would call the
@@ -348,7 +350,7 @@
     dump_traces_path = dump_traces();
 
     int c;
-    while ((c = getopt(argc, argv, "b:de:ho:svqzp")) != -1) {
+    while ((c = getopt(argc, argv, "b:de:ho:svqzpB")) != -1) {
         switch (c) {
             case 'b': begin_sound = optarg;  break;
             case 'd': do_add_date = 1;       break;
@@ -359,6 +361,7 @@
             case 'q': do_vibrate = 0;        break;
             case 'z': do_compress = 6;       break;
             case 'p': do_fb = 1;             break;
+            case 'B': do_broadcast = 1;      break;
             case '?': printf("\n");
             case 'h':
                 usage();
@@ -474,6 +477,14 @@
         fprintf(stderr, "rename(%s, %s): %s\n", tmp_path, path, strerror(errno));
     }
 
+    if (do_broadcast && use_outfile && do_fb) {
+        run_command(NULL, 5, "/system/bin/am", "broadcast",
+                "-a", "android.intent.action.BUGREPORT_FINISHED",
+                "--es", "android.intent.extra.BUGREPORT", path,
+                "--es", "android.intent.extra.SCREENSHOT", screenshot_path,
+                "--receiver-permission", "android.permission.DUMP", NULL);
+    }
+
     ALOGI("done\n");
 
     return 0;
diff --git a/cmds/dumpstate/utils.c b/cmds/dumpstate/utils.c
index d081590..9b0013e 100644
--- a/cmds/dumpstate/utils.c
+++ b/cmds/dumpstate/utils.c
@@ -379,7 +379,7 @@
         chp = strchr(chp, '/');
         if (chp) {
             *chp = 0;
-            mkdir(path, 0775);  /* drwxrwxr-x */
+            mkdir(path, 0770);  /* drwxrwx--- */
             *chp++ = '/';
         }
     }
diff --git a/include/gui/BufferQueue.h b/include/gui/BufferQueue.h
index c59e00e..6a86db6 100644
--- a/include/gui/BufferQueue.h
+++ b/include/gui/BufferQueue.h
@@ -128,7 +128,7 @@
     // GL_MAX_VIEWPORT_DIMS and GL_MAX_TEXTURE_SIZE (see: glGetIntegerv).
     // An error due to invalid dimensions might not be reported until
     // updateTexImage() is called.
-    virtual status_t dequeueBuffer(int *buf, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *buf, sp<Fence>* fence,
             uint32_t width, uint32_t height, uint32_t format, uint32_t usage);
 
     // queueBuffer returns a filled buffer to the BufferQueue. In addition, a
@@ -139,7 +139,7 @@
     virtual status_t queueBuffer(int buf,
             const QueueBufferInput& input, QueueBufferOutput* output);
 
-    virtual void cancelBuffer(int buf, sp<Fence> fence);
+    virtual void cancelBuffer(int buf, const sp<Fence>& fence);
 
     // setSynchronousMode set whether dequeueBuffer is synchronous or
     // asynchronous. In synchronous mode, dequeueBuffer blocks until
diff --git a/include/gui/ConsumerBase.h b/include/gui/ConsumerBase.h
index 49a764f..78a3608 100644
--- a/include/gui/ConsumerBase.h
+++ b/include/gui/ConsumerBase.h
@@ -69,10 +69,9 @@
     // ConsumerBase is connected.
     sp<BufferQueue> getBufferQueue() const;
 
-    // dump writes the current state to a string.  These methods should NOT be
-    // overridden by child classes.  Instead they should override the
-    // dumpLocked method, which is called by these methods after locking the
-    // mutex.
+    // dump writes the current state to a string. Child classes should add
+    // their state to the dump by overriding the dumpLocked method, which is
+    // called by these methods after locking the mutex.
     void dump(String8& result) const;
     void dump(String8& result, const char* prefix, char* buffer, size_t SIZE) const;
 
diff --git a/include/gui/IGraphicBufferProducer.h b/include/gui/IGraphicBufferProducer.h
index a3e258d..29c7ff3 100644
--- a/include/gui/IGraphicBufferProducer.h
+++ b/include/gui/IGraphicBufferProducer.h
@@ -84,7 +84,7 @@
     // the buffer. The contents of the buffer must not be overwritten until the
     // fence signals. If the fence is NULL, the buffer may be written
     // immediately.
-    virtual status_t dequeueBuffer(int *slot, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *slot, sp<Fence>* fence,
             uint32_t w, uint32_t h, uint32_t format, uint32_t usage) = 0;
 
     // queueBuffer indicates that the client has finished filling in the
@@ -165,7 +165,7 @@
     // cancelBuffer indicates that the client does not wish to fill in the
     // buffer associated with slot and transfers ownership of the slot back to
     // the server.
-    virtual void cancelBuffer(int slot, sp<Fence> fence) = 0;
+    virtual void cancelBuffer(int slot, const sp<Fence>& fence) = 0;
 
     // query retrieves some information for this surface
     // 'what' tokens allowed are that of android_natives.h
diff --git a/include/gui/ISurface.h b/include/gui/ISurface.h
deleted file mode 100644
index 5a928f2..0000000
--- a/include/gui/ISurface.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/*
- * Copyright (C) 2007 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_GUI_ISURFACE_H
-#define ANDROID_GUI_ISURFACE_H
-
-#include <stdint.h>
-#include <sys/types.h>
-
-#include <utils/Errors.h>
-#include <utils/RefBase.h>
-
-#include <binder/IInterface.h>
-
-#include <ui/PixelFormat.h>
-
-namespace android {
-
-class IGraphicBufferProducer;
-
-class ISurface : public IInterface
-{
-protected:
-    enum {
-        GET_SURFACE_TEXTURE = IBinder::FIRST_CALL_TRANSACTION,
-    };
-
-public: 
-    DECLARE_META_INTERFACE(Surface);
-
-    virtual sp<IGraphicBufferProducer> getSurfaceTexture() const = 0;
-};
-
-// ----------------------------------------------------------------------------
-
-class BnSurface : public BnInterface<ISurface>
-{
-public:
-    virtual status_t    onTransact( uint32_t code,
-                                    const Parcel& data,
-                                    Parcel* reply,
-                                    uint32_t flags = 0);
-};
-
-// ----------------------------------------------------------------------------
-
-}; // namespace android
-
-#endif // ANDROID_GUI_ISURFACE_H
diff --git a/include/gui/ISurfaceComposer.h b/include/gui/ISurfaceComposer.h
index 08eddcb..47f9552 100644
--- a/include/gui/ISurfaceComposer.h
+++ b/include/gui/ISurfaceComposer.h
@@ -103,16 +103,23 @@
             uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ) = 0;
 
-    /* triggers screen off and waits for it to complete */
+    /* triggers screen off and waits for it to complete
+     * requires ACCESS_SURFACE_FLINGER permission.
+     */
     virtual void blank(const sp<IBinder>& display) = 0;
 
-    /* triggers screen on and waits for it to complete */
+    /* triggers screen on and waits for it to complete
+     * requires ACCESS_SURFACE_FLINGER permission.
+     */
     virtual void unblank(const sp<IBinder>& display) = 0;
 
     /* returns information about a display
      * intended to be used to get information about built-in displays */
     virtual status_t getDisplayInfo(const sp<IBinder>& display, DisplayInfo* info) = 0;
 
+    /* Capture the specified screen. requires READ_FRAME_BUFFER permission
+     * This function will fail if there is a secure window on screen.
+     */
     virtual status_t captureScreen(const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
             uint32_t reqWidth, uint32_t reqHeight,
diff --git a/include/gui/ISurfaceComposerClient.h b/include/gui/ISurfaceComposerClient.h
index 4afc860..cb9816f 100644
--- a/include/gui/ISurfaceComposerClient.h
+++ b/include/gui/ISurfaceComposerClient.h
@@ -27,11 +27,11 @@
 
 #include <ui/PixelFormat.h>
 
-#include <gui/ISurface.h>
-
 namespace android {
 // ----------------------------------------------------------------------------
 
+class IGraphicBufferProducer;
+
 class ISurfaceComposerClient : public IInterface
 {
 public:
@@ -55,9 +55,11 @@
     /*
      * Requires ACCESS_SURFACE_FLINGER permission
      */
-    virtual sp<ISurface> createSurface(
+    virtual status_t createSurface(
             const String8& name, uint32_t w, uint32_t h,
-            PixelFormat format, uint32_t flags) = 0;
+            PixelFormat format, uint32_t flags,
+            sp<IBinder>* handle,
+            sp<IGraphicBufferProducer>* gbp) = 0;
 
     /*
      * Requires ACCESS_SURFACE_FLINGER permission
diff --git a/include/gui/Surface.h b/include/gui/Surface.h
index 18e57ed..c25847c 100644
--- a/include/gui/Surface.h
+++ b/include/gui/Surface.h
@@ -76,24 +76,13 @@
         return surface != NULL && surface->getIGraphicBufferProducer() != NULL;
     }
 
-    /* writes the given Surface into a Parcel */
-    static status_t writeToParcel(const sp<Surface>& surface, Parcel* parcel);
-
-    /* constructs a Surface from a Parcel. see Surface::writeToParcel()
-     * and SurfaceControl::writeToParcel() */
-    static sp<Surface> readFromParcel(const Parcel& data);
-
-
 protected:
-    Surface();
     virtual ~Surface();
-    void setIGraphicBufferProducer(const sp<IGraphicBufferProducer>& bufferProducer);
 
 private:
     // can't be copied
     Surface& operator = (const Surface& rhs);
     Surface(const Surface& rhs);
-    void init();
 
     // ANativeWindow hooks
     static int hook_cancelBuffer(ANativeWindow* window,
diff --git a/include/gui/SurfaceControl.h b/include/gui/SurfaceControl.h
index f70888d..fe8eb6f 100644
--- a/include/gui/SurfaceControl.h
+++ b/include/gui/SurfaceControl.h
@@ -27,7 +27,6 @@
 #include <ui/PixelFormat.h>
 #include <ui/Region.h>
 
-#include <gui/ISurface.h>
 #include <gui/ISurfaceComposerClient.h>
 
 namespace android {
@@ -46,9 +45,11 @@
     static bool isValid(const sp<SurfaceControl>& surface) {
         return (surface != 0) && surface->isValid();
     }
+
     bool isValid() {
-        return mSurface!=0 && mClient!=0;
+        return mHandle!=0 && mClient!=0;
     }
+
     static bool isSameSurface(
             const sp<SurfaceControl>& lhs, const sp<SurfaceControl>& rhs);
         
@@ -82,7 +83,8 @@
 
     SurfaceControl(
             const sp<SurfaceComposerClient>& client,
-            const sp<ISurface>& surface);
+            const sp<IBinder>& handle,
+            const sp<IGraphicBufferProducer>& gbp);
 
     ~SurfaceControl();
 
@@ -90,7 +92,7 @@
     void destroy();
     
     sp<SurfaceComposerClient>   mClient;
-    sp<IBinder>                 mSurface;
+    sp<IBinder>                 mHandle;
     sp<IGraphicBufferProducer>  mGraphicBufferProducer;
     mutable Mutex               mLock;
     mutable sp<Surface>         mSurfaceData;
diff --git a/include/private/gui/LayerState.h b/include/private/gui/LayerState.h
index 0798e17..bf4bf03 100644
--- a/include/private/gui/LayerState.h
+++ b/include/private/gui/LayerState.h
@@ -24,7 +24,6 @@
 
 #include <ui/Region.h>
 #include <ui/Rect.h>
-#include <gui/ISurface.h>
 
 namespace android {
 
diff --git a/include/utils/RefBase.h b/include/utils/RefBase.h
index 0a8e10a..033fe67 100644
--- a/include/utils/RefBase.h
+++ b/include/utils/RefBase.h
@@ -52,12 +52,16 @@
 }
 
 // ---------------------------------------------------------------------------
-class ReferenceMover;
-class ReferenceConverterBase {
+
+class ReferenceRenamer {
+protected:
+    // destructor is purposedly not virtual so we avoid code overhead from
+    // subclasses; we have to make it protected to guarantee that it
+    // cannot be called from this base class (and to make strict compilers
+    // happy).
+    ~ReferenceRenamer() { }
 public:
-    virtual size_t getReferenceTypeSize() const = 0;
-    virtual void* getReferenceBase(void const*) const = 0;
-    inline virtual ~ReferenceConverterBase() { }
+    virtual void operator()(size_t i) const = 0;
 };
 
 // ---------------------------------------------------------------------------
@@ -144,17 +148,23 @@
     virtual void            onLastWeakRef(const void* id);
 
 private:
-    friend class ReferenceMover;
-    static void moveReferences(void* d, void const* s, size_t n,
-            const ReferenceConverterBase& caster);
-
-private:
     friend class weakref_type;
     class weakref_impl;
     
                             RefBase(const RefBase& o);
             RefBase&        operator=(const RefBase& o);
 
+private:
+    friend class ReferenceMover;
+
+    static void renameRefs(size_t n, const ReferenceRenamer& renamer);
+
+    static void renameRefId(weakref_type* ref,
+            const void* old_id, const void* new_id);
+
+    static void renameRefId(RefBase* ref,
+            const void* old_id, const void* new_id);
+
         weakref_impl* const mRefs;
 };
 
@@ -185,8 +195,9 @@
 
 private:
     friend class ReferenceMover;
-    inline static void moveReferences(void* d, void const* s, size_t n,
-            const ReferenceConverterBase& caster) { }
+    inline static void renameRefs(size_t n, const ReferenceRenamer& renamer) { }
+    inline static void renameRefId(T* ref,
+            const void* old_id, const void* new_id) { }
 
 private:
     mutable volatile int32_t mCount;
@@ -455,42 +466,48 @@
 
 // this class just serves as a namespace so TYPE::moveReferences can stay
 // private.
-
 class ReferenceMover {
-    // StrongReferenceCast and WeakReferenceCast do the impedance matching
-    // between the generic (void*) implementation in Refbase and the strongly typed
-    // template specializations below.
-
-    template <typename TYPE>
-    struct StrongReferenceCast : public ReferenceConverterBase {
-        virtual size_t getReferenceTypeSize() const { return sizeof( sp<TYPE> ); }
-        virtual void* getReferenceBase(void const* p) const {
-            sp<TYPE> const* sptr(reinterpret_cast<sp<TYPE> const*>(p));
-            return static_cast<typename TYPE::basetype *>(sptr->get());
-        }
-    };
-
-    template <typename TYPE>
-    struct WeakReferenceCast : public ReferenceConverterBase {
-        virtual size_t getReferenceTypeSize() const { return sizeof( wp<TYPE> ); }
-        virtual void* getReferenceBase(void const* p) const {
-            wp<TYPE> const* sptr(reinterpret_cast<wp<TYPE> const*>(p));
-            return static_cast<typename TYPE::basetype *>(sptr->unsafe_get());
-        }
-    };
-
 public:
+    // it would be nice if we could make sure no extra code is generated
+    // for sp<TYPE> or wp<TYPE> when TYPE is a descendant of RefBase:
+    // Using a sp<RefBase> override doesn't work; it's a bit like we wanted
+    // a template<typename TYPE inherits RefBase> template...
+
     template<typename TYPE> static inline
     void move_references(sp<TYPE>* d, sp<TYPE> const* s, size_t n) {
+
+        class Renamer : public ReferenceRenamer {
+            sp<TYPE>* d;
+            sp<TYPE> const* s;
+            virtual void operator()(size_t i) const {
+                // The id are known to be the sp<>'s this pointer
+                TYPE::renameRefId(d[i].get(), &s[i], &d[i]);
+            }
+        public:
+            Renamer(sp<TYPE>* d, sp<TYPE> const* s) : s(s), d(d) { }
+        };
+
         memmove(d, s, n*sizeof(sp<TYPE>));
-        StrongReferenceCast<TYPE> caster;
-        TYPE::moveReferences(d, s, n, caster);
+        TYPE::renameRefs(n, Renamer(d, s));
     }
+
+
     template<typename TYPE> static inline
     void move_references(wp<TYPE>* d, wp<TYPE> const* s, size_t n) {
+
+        class Renamer : public ReferenceRenamer {
+            wp<TYPE>* d;
+            wp<TYPE> const* s;
+            virtual void operator()(size_t i) const {
+                // The id are known to be the wp<>'s this pointer
+                TYPE::renameRefId(d[i].get_refs(), &s[i], &d[i]);
+            }
+        public:
+            Renamer(wp<TYPE>* d, wp<TYPE> const* s) : s(s), d(d) { }
+        };
+
         memmove(d, s, n*sizeof(wp<TYPE>));
-        WeakReferenceCast<TYPE> caster;
-        TYPE::moveReferences(d, s, n, caster);
+        TYPE::renameRefs(n, Renamer(d, s));
     }
 };
 
diff --git a/include/utils/Vector.h b/include/utils/Vector.h
index f3020d6..ed7b725 100644
--- a/include/utils/Vector.h
+++ b/include/utils/Vector.h
@@ -80,7 +80,13 @@
     //! sets the capacity. capacity can never be reduced less than size()
     inline  ssize_t         setCapacity(size_t size)    { return VectorImpl::setCapacity(size); }
 
-    /*! 
+    /*!
+     * set the size of the vector. items are appended with the default
+     * constructor, or removed from the end as needed.
+     */
+    inline  ssize_t         resize(size_t size)         { return VectorImpl::resize(size); }
+
+    /*!
      * C-style array access
      */
      
diff --git a/include/utils/VectorImpl.h b/include/utils/VectorImpl.h
index c4ec2ff..9bc50e6 100644
--- a/include/utils/VectorImpl.h
+++ b/include/utils/VectorImpl.h
@@ -64,6 +64,7 @@
     inline  bool            isEmpty() const     { return mCount == 0; }
             size_t          capacity() const;
             ssize_t         setCapacity(size_t size);
+            ssize_t         resize(size_t size);
 
             /*! append/insert another vector or array */
             ssize_t         insertVectorAt(const VectorImpl& vector, size_t index);
diff --git a/libs/binder/MemoryBase.cpp b/libs/binder/MemoryBase.cpp
index 033066b..5c82330 100644
--- a/libs/binder/MemoryBase.cpp
+++ b/libs/binder/MemoryBase.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "MemoryBase"
 
 #include <stdlib.h>
 #include <stdint.h>
@@ -44,3 +45,11 @@
 
 // ---------------------------------------------------------------------------
 }; // namespace android
+
+// Backwards compatibility for libdatabase_sqlcipher (http://b/8253769).
+extern "C" void _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEEij(void*, void*, ssize_t, size_t);
+extern "C" void _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEElj(void* obj, void* h, long o, unsigned int size) {
+    _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEEij(obj, h, o, size);
+    ALOGW("Using temporary compatibility workaround for usage of MemoryBase "
+          "private API. Please fix your application!");
+}
diff --git a/libs/gui/Android.mk b/libs/gui/Android.mk
index 544b664..5c7bb4c 100644
--- a/libs/gui/Android.mk
+++ b/libs/gui/Android.mk
@@ -17,7 +17,6 @@
 	IGraphicBufferProducer.cpp \
 	ISensorEventConnection.cpp \
 	ISensorServer.cpp \
-	ISurface.cpp \
 	ISurfaceComposer.cpp \
 	ISurfaceComposerClient.cpp \
 	LayerState.cpp \
diff --git a/libs/gui/BufferQueue.cpp b/libs/gui/BufferQueue.cpp
index 41ee1be..75a0296 100644
--- a/libs/gui/BufferQueue.cpp
+++ b/libs/gui/BufferQueue.cpp
@@ -254,7 +254,7 @@
     return NO_ERROR;
 }
 
-status_t BufferQueue::dequeueBuffer(int *outBuf, sp<Fence>& outFence,
+status_t BufferQueue::dequeueBuffer(int *outBuf, sp<Fence>* outFence,
         uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
     ATRACE_CALL();
     ST_LOGV("dequeueBuffer: w=%d h=%d fmt=%#x usage=%#x", w, h, format, usage);
@@ -393,7 +393,7 @@
 
         dpy = mSlots[buf].mEglDisplay;
         eglFence = mSlots[buf].mEglFence;
-        outFence = mSlots[buf].mFence;
+        *outFence = mSlots[buf].mFence;
         mSlots[buf].mEglFence = EGL_NO_SYNC_KHR;
         mSlots[buf].mFence = Fence::NO_FENCE;
     }  // end lock scope
@@ -590,7 +590,7 @@
     return OK;
 }
 
-void BufferQueue::cancelBuffer(int buf, sp<Fence> fence) {
+void BufferQueue::cancelBuffer(int buf, const sp<Fence>& fence) {
     ATRACE_CALL();
     ST_LOGV("cancelBuffer: slot=%d", buf);
     Mutex::Autolock lock(mMutex);
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 54860d7..63d7628 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -81,7 +81,7 @@
         return result;
     }
 
-    virtual status_t dequeueBuffer(int *buf, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *buf, sp<Fence>* fence,
             uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
         Parcel data, reply;
         data.writeInterfaceToken(IGraphicBufferProducer::getInterfaceDescriptor());
@@ -99,8 +99,8 @@
             // If the fence was written by the callee, then overwrite the
             // caller's fence here.  If it wasn't written then don't touch the
             // caller's fence.
-            fence = new Fence();
-            reply.read(*fence.get());
+            *fence = new Fence();
+            reply.read(*(fence->get()));
         }
         result = reply.readInt32();
         return result;
@@ -121,7 +121,7 @@
         return result;
     }
 
-    virtual void cancelBuffer(int buf, sp<Fence> fence) {
+    virtual void cancelBuffer(int buf, const sp<Fence>& fence) {
         Parcel data, reply;
         data.writeInterfaceToken(IGraphicBufferProducer::getInterfaceDescriptor());
         data.writeInt32(buf);
@@ -215,7 +215,7 @@
             uint32_t usage  = data.readInt32();
             int buf;
             sp<Fence> fence;
-            int result = dequeueBuffer(&buf, fence, w, h, format, usage);
+            int result = dequeueBuffer(&buf, &fence, w, h, format, usage);
             reply->writeInt32(buf);
             reply->writeInt32(fence != NULL);
             if (fence != NULL) {
diff --git a/libs/gui/ISurface.cpp b/libs/gui/ISurface.cpp
deleted file mode 100644
index 8c25f45..0000000
--- a/libs/gui/ISurface.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2007 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "ISurface"
-
-#include <stdio.h>
-#include <stdint.h>
-#include <sys/types.h>
-
-#include <binder/Parcel.h>
-
-#include <gui/ISurface.h>
-#include <gui/IGraphicBufferProducer.h>
-
-namespace android {
-
-// ----------------------------------------------------------------------
-
-class BpSurface : public BpInterface<ISurface>
-{
-public:
-    BpSurface(const sp<IBinder>& impl)
-        : BpInterface<ISurface>(impl)
-    {
-    }
-
-    virtual sp<IGraphicBufferProducer> getSurfaceTexture() const {
-        Parcel data, reply;
-        data.writeInterfaceToken(ISurface::getInterfaceDescriptor());
-        remote()->transact(GET_SURFACE_TEXTURE, data, &reply);
-        return interface_cast<IGraphicBufferProducer>(reply.readStrongBinder());
-    }
-};
-
-IMPLEMENT_META_INTERFACE(Surface, "android.ui.ISurface");
-
-// ----------------------------------------------------------------------
-
-status_t BnSurface::onTransact(
-    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
-{
-    switch(code) {
-        case GET_SURFACE_TEXTURE: {
-            CHECK_INTERFACE(ISurface, data, reply);
-            reply->writeStrongBinder( getSurfaceTexture()->asBinder() );
-            return NO_ERROR;
-        }
-        default:
-            return BBinder::onTransact(code, data, reply, flags);
-    }
-}
-
-}; // namespace android
diff --git a/libs/gui/ISurfaceComposerClient.cpp b/libs/gui/ISurfaceComposerClient.cpp
index 101292d..1adc134 100644
--- a/libs/gui/ISurfaceComposerClient.cpp
+++ b/libs/gui/ISurfaceComposerClient.cpp
@@ -29,7 +29,7 @@
 #include <ui/Point.h>
 #include <ui/Rect.h>
 
-#include <gui/ISurface.h>
+#include <gui/IGraphicBufferProducer.h>
 #include <gui/ISurfaceComposerClient.h>
 #include <private/gui/LayerState.h>
 
@@ -46,16 +46,13 @@
 {
 public:
     BpSurfaceComposerClient(const sp<IBinder>& impl)
-        : BpInterface<ISurfaceComposerClient>(impl)
-    {
+        : BpInterface<ISurfaceComposerClient>(impl) {
     }
 
-    virtual sp<ISurface> createSurface( const String8& name,
-                                        uint32_t w,
-                                        uint32_t h,
-                                        PixelFormat format,
-                                        uint32_t flags)
-    {
+    virtual status_t createSurface(const String8& name, uint32_t w,
+            uint32_t h, PixelFormat format, uint32_t flags,
+            sp<IBinder>* handle,
+            sp<IGraphicBufferProducer>* gbp) {
         Parcel data, reply;
         data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor());
         data.writeString8(name);
@@ -64,11 +61,12 @@
         data.writeInt32(format);
         data.writeInt32(flags);
         remote()->transact(CREATE_SURFACE, data, &reply);
-        return interface_cast<ISurface>(reply.readStrongBinder());
+        *handle = reply.readStrongBinder();
+        *gbp = interface_cast<IGraphicBufferProducer>(reply.readStrongBinder());
+        return reply.readInt32();
     }
 
-    virtual status_t destroySurface(const sp<IBinder>& handle)
-    {
+    virtual status_t destroySurface(const sp<IBinder>& handle) {
         Parcel data, reply;
         data.writeInterfaceToken(ISurfaceComposerClient::getInterfaceDescriptor());
         data.writeStrongBinder(handle);
@@ -92,8 +90,13 @@
             uint32_t h = data.readInt32();
             PixelFormat format = data.readInt32();
             uint32_t flags = data.readInt32();
-            sp<ISurface> s = createSurface(name, w, h, format, flags);
-            reply->writeStrongBinder(s->asBinder());
+            sp<IBinder> handle;
+            sp<IGraphicBufferProducer> gbp;
+            status_t result = createSurface(name, w, h, format, flags,
+                    &handle, &gbp);
+            reply->writeStrongBinder(handle);
+            reply->writeStrongBinder(gbp->asBinder());
+            reply->writeInt32(result);
             return NO_ERROR;
         } break;
         case DESTROY_SURFACE: {
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 950d16a..4a58023 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -38,22 +38,8 @@
 
 Surface::Surface(
         const sp<IGraphicBufferProducer>& bufferProducer)
+    : mGraphicBufferProducer(bufferProducer)
 {
-    Surface::init();
-    Surface::setIGraphicBufferProducer(bufferProducer);
-}
-
-Surface::Surface() {
-    Surface::init();
-}
-
-Surface::~Surface() {
-    if (mConnectedToCpu) {
-        Surface::disconnect(NATIVE_WINDOW_API_CPU);
-    }
-}
-
-void Surface::init() {
     // Initialize the ANativeWindow function pointers.
     ANativeWindow::setSwapInterval  = hook_setSwapInterval;
     ANativeWindow::dequeueBuffer    = hook_dequeueBuffer;
@@ -87,10 +73,10 @@
     mConnectedToCpu = false;
 }
 
-void Surface::setIGraphicBufferProducer(
-        const sp<IGraphicBufferProducer>& bufferProducer)
-{
-    mGraphicBufferProducer = bufferProducer;
+Surface::~Surface() {
+    if (mConnectedToCpu) {
+        Surface::disconnect(NATIVE_WINDOW_API_CPU);
+    }
 }
 
 sp<IGraphicBufferProducer> Surface::getIGraphicBufferProducer() const {
@@ -196,8 +182,8 @@
     int reqW = mReqWidth ? mReqWidth : mUserWidth;
     int reqH = mReqHeight ? mReqHeight : mUserHeight;
     sp<Fence> fence;
-    status_t result = mGraphicBufferProducer->dequeueBuffer(&buf, fence, reqW, reqH,
-            mReqFormat, mReqUsage);
+    status_t result = mGraphicBufferProducer->dequeueBuffer(&buf, &fence,
+            reqW, reqH, mReqFormat, mReqUsage);
     if (result < 0) {
         ALOGV("dequeueBuffer: IGraphicBufferProducer::dequeueBuffer(%d, %d, %d, %d)"
              "failed: %d", mReqWidth, mReqHeight, mReqFormat, mReqUsage,
@@ -723,23 +709,6 @@
 
 // ----------------------------------------------------------------------------
 
-status_t Surface::writeToParcel(
-        const sp<Surface>& surface, Parcel* parcel) {
-    sp<IGraphicBufferProducer> bp;
-    if (surface != NULL) {
-        bp = surface->mGraphicBufferProducer;
-    }
-    return parcel->writeStrongBinder(bp->asBinder());
-}
-
-sp<Surface> Surface::readFromParcel(const Parcel& data) {
-    sp<IBinder> binder(data.readStrongBinder());
-    sp<IGraphicBufferProducer> bp(interface_cast<IGraphicBufferProducer>(binder));
-    return bp != NULL ? new Surface(bp): NULL;
-}
-
-// ----------------------------------------------------------------------------
-
 status_t Surface::lock(
         ANativeWindow_Buffer* outBuffer, ARect* inOutDirtyBounds)
 {
diff --git a/libs/gui/SurfaceComposerClient.cpp b/libs/gui/SurfaceComposerClient.cpp
index edfa78a..4a4c0c8 100644
--- a/libs/gui/SurfaceComposerClient.cpp
+++ b/libs/gui/SurfaceComposerClient.cpp
@@ -32,7 +32,6 @@
 #include <ui/DisplayInfo.h>
 
 #include <gui/IGraphicBufferProducer.h>
-#include <gui/ISurface.h>
 #include <gui/ISurfaceComposer.h>
 #include <gui/ISurfaceComposerClient.h>
 #include <gui/SurfaceComposerClient.h>
@@ -471,14 +470,18 @@
         PixelFormat format,
         uint32_t flags)
 {
-    sp<SurfaceControl> result;
+    sp<SurfaceControl> sur;
     if (mStatus == NO_ERROR) {
-        sp<ISurface> surface = mClient->createSurface(name, w, h, format, flags);
-        if (surface != 0) {
-            result = new SurfaceControl(this, surface);
+        sp<IBinder> handle;
+        sp<IGraphicBufferProducer> gbp;
+        status_t err = mClient->createSurface(name, w, h, format, flags,
+                &handle, &gbp);
+        ALOGE_IF(err, "SurfaceComposerClient::createSurface error %s", strerror(-err));
+        if (err == NO_ERROR) {
+            sur = new SurfaceControl(this, handle, gbp);
         }
     }
-    return result;
+    return sur;
 }
 
 sp<IBinder> SurfaceComposerClient::createDisplay(const String8& displayName,
diff --git a/libs/gui/SurfaceControl.cpp b/libs/gui/SurfaceControl.cpp
index ef52269..bb57948 100644
--- a/libs/gui/SurfaceControl.cpp
+++ b/libs/gui/SurfaceControl.cpp
@@ -34,7 +34,6 @@
 #include <ui/GraphicBuffer.h>
 #include <ui/Rect.h>
 
-#include <gui/ISurface.h>
 #include <gui/ISurfaceComposer.h>
 #include <gui/Surface.h>
 #include <gui/SurfaceComposerClient.h>
@@ -48,13 +47,10 @@
 
 SurfaceControl::SurfaceControl(
         const sp<SurfaceComposerClient>& client, 
-        const sp<ISurface>& surface)
-    : mClient(client)
+        const sp<IBinder>& handle,
+        const sp<IGraphicBufferProducer>& gbp)
+    : mClient(client), mHandle(handle), mGraphicBufferProducer(gbp)
 {
-    if (surface != 0) {
-        mSurface = surface->asBinder();
-        mGraphicBufferProducer = surface->getSurfaceTexture();
-    }
 }
         
 SurfaceControl::~SurfaceControl()
@@ -65,12 +61,12 @@
 void SurfaceControl::destroy()
 {
     if (isValid()) {
-        mClient->destroySurface(mSurface);
+        mClient->destroySurface(mHandle);
     }
     // clear all references and trigger an IPC now, to make sure things
     // happen without delay, since these resources are quite heavy.
     mClient.clear();
-    mSurface.clear();
+    mHandle.clear();
     mGraphicBufferProducer.clear();
     IPCThreadState::self()->flushCommands();
 }
@@ -91,81 +87,81 @@
 {
     if (lhs == 0 || rhs == 0)
         return false;
-    return lhs->mSurface == rhs->mSurface;
+    return lhs->mHandle == rhs->mHandle;
 }
 
 status_t SurfaceControl::setLayerStack(int32_t layerStack) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setLayerStack(mSurface, layerStack);
+    return client->setLayerStack(mHandle, layerStack);
 }
 status_t SurfaceControl::setLayer(int32_t layer) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setLayer(mSurface, layer);
+    return client->setLayer(mHandle, layer);
 }
 status_t SurfaceControl::setPosition(int32_t x, int32_t y) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setPosition(mSurface, x, y);
+    return client->setPosition(mHandle, x, y);
 }
 status_t SurfaceControl::setSize(uint32_t w, uint32_t h) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setSize(mSurface, w, h);
+    return client->setSize(mHandle, w, h);
 }
 status_t SurfaceControl::hide() {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->hide(mSurface);
+    return client->hide(mHandle);
 }
 status_t SurfaceControl::show() {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->show(mSurface);
+    return client->show(mHandle);
 }
 status_t SurfaceControl::setFlags(uint32_t flags, uint32_t mask) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setFlags(mSurface, flags, mask);
+    return client->setFlags(mHandle, flags, mask);
 }
 status_t SurfaceControl::setTransparentRegionHint(const Region& transparent) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setTransparentRegionHint(mSurface, transparent);
+    return client->setTransparentRegionHint(mHandle, transparent);
 }
 status_t SurfaceControl::setAlpha(float alpha) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setAlpha(mSurface, alpha);
+    return client->setAlpha(mHandle, alpha);
 }
 status_t SurfaceControl::setMatrix(float dsdx, float dtdx, float dsdy, float dtdy) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setMatrix(mSurface, dsdx, dtdx, dsdy, dtdy);
+    return client->setMatrix(mHandle, dsdx, dtdx, dsdy, dtdy);
 }
 status_t SurfaceControl::setCrop(const Rect& crop) {
     status_t err = validate();
     if (err < 0) return err;
     const sp<SurfaceComposerClient>& client(mClient);
-    return client->setCrop(mSurface, crop);
+    return client->setCrop(mHandle, crop);
 }
 
 status_t SurfaceControl::validate() const
 {
-    if (mSurface==0 || mClient==0) {
-        ALOGE("invalid ISurface (%p) or client (%p)",
-                mSurface.get(), mClient.get());
+    if (mHandle==0 || mClient==0) {
+        ALOGE("invalid handle (%p) or client (%p)",
+                mHandle.get(), mClient.get());
         return NO_INIT;
     }
     return NO_ERROR;
diff --git a/libs/gui/tests/BufferQueue_test.cpp b/libs/gui/tests/BufferQueue_test.cpp
index 93f8faf..62d215b 100644
--- a/libs/gui/tests/BufferQueue_test.cpp
+++ b/libs/gui/tests/BufferQueue_test.cpp
@@ -76,7 +76,7 @@
 
     for (int i = 0; i < 2; i++) {
         ASSERT_EQ(IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION,
-                mBQ->dequeueBuffer(&slot, fence, 1, 1, 0,
+                mBQ->dequeueBuffer(&slot, &fence, 1, 1, 0,
                     GRALLOC_USAGE_SW_READ_OFTEN));
         ASSERT_EQ(OK, mBQ->requestBuffer(slot, &buf));
         ASSERT_EQ(OK, mBQ->queueBuffer(slot, qbi, &qbo));
@@ -84,7 +84,7 @@
     }
 
     ASSERT_EQ(IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION,
-            mBQ->dequeueBuffer(&slot, fence, 1, 1, 0,
+            mBQ->dequeueBuffer(&slot, &fence, 1, 1, 0,
                 GRALLOC_USAGE_SW_READ_OFTEN));
     ASSERT_EQ(OK, mBQ->requestBuffer(slot, &buf));
     ASSERT_EQ(OK, mBQ->queueBuffer(slot, qbi, &qbo));
diff --git a/libs/utils/RefBase.cpp b/libs/utils/RefBase.cpp
index 3dac89e..3d3a595 100644
--- a/libs/utils/RefBase.cpp
+++ b/libs/utils/RefBase.cpp
@@ -15,7 +15,7 @@
  */
 
 #define LOG_TAG "RefBase"
-#define LOG_NDEBUG 0
+// #define LOG_NDEBUG 0
 
 #include <utils/RefBase.h>
 
@@ -35,10 +35,18 @@
 
 // compile with refcounting debugging enabled
 #define DEBUG_REFS                      0
-#define DEBUG_REFS_FATAL_SANITY_CHECKS  0
-#define DEBUG_REFS_ENABLED_BY_DEFAULT   1
+
+// whether ref-tracking is enabled by default, if not, trackMe(true, false)
+// needs to be called explicitly
+#define DEBUG_REFS_ENABLED_BY_DEFAULT   0
+
+// whether callstack are collected (significantly slows things down)
 #define DEBUG_REFS_CALLSTACK_ENABLED    1
 
+// folder where stack traces are saved when DEBUG_REFS is enabled
+// this folder needs to exist and be writable
+#define DEBUG_REFS_CALLSTACK_PATH       "/data/debug"
+
 // log all reference counting operations
 #define PRINT_REFS                      0
 
@@ -96,11 +104,7 @@
         bool dumpStack = false;
         if (!mRetain && mStrongRefs != NULL) {
             dumpStack = true;
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("Strong references remain!");
-#else
             ALOGE("Strong references remain:");
-#endif
             ref_entry* refs = mStrongRefs;
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
@@ -114,11 +118,7 @@
 
         if (!mRetain && mWeakRefs != NULL) {
             dumpStack = true;
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("Weak references remain:");
-#else
             ALOGE("Weak references remain!");
-#endif
             ref_entry* refs = mWeakRefs;
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
@@ -199,7 +199,7 @@
 
         {
             char name[100];
-            snprintf(name, 100, "/data/%p.stack", this);
+            snprintf(name, 100, DEBUG_REFS_CALLSTACK_PATH "/%p.stack", this);
             int rc = open(name, O_RDWR | O_CREAT | O_APPEND, 644);
             if (rc >= 0) {
                 write(rc, text.string(), text.length());
@@ -258,12 +258,6 @@
                 ref = *refs;
             }
 
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("RefBase: removing id %p on RefBase %p"
-                    "(weakref_type %p) that doesn't exist!",
-                    id, mBase, this);
-#endif
-
             ALOGE("RefBase: removing id %p on RefBase %p"
                     "(weakref_type %p) that doesn't exist!",
                     id, mBase, this);
@@ -441,39 +435,68 @@
     incWeak(id);
     
     weakref_impl* const impl = static_cast<weakref_impl*>(this);
-    
     int32_t curCount = impl->mStrong;
-    ALOG_ASSERT(curCount >= 0, "attemptIncStrong called on %p after underflow",
-               this);
+
+    ALOG_ASSERT(curCount >= 0,
+            "attemptIncStrong called on %p after underflow", this);
+
     while (curCount > 0 && curCount != INITIAL_STRONG_VALUE) {
+        // we're in the easy/common case of promoting a weak-reference
+        // from an existing strong reference.
         if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mStrong) == 0) {
             break;
         }
+        // the strong count has changed on us, we need to re-assert our
+        // situation.
         curCount = impl->mStrong;
     }
     
     if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
-        bool allow;
-        if (curCount == INITIAL_STRONG_VALUE) {
-            // Attempting to acquire first strong reference...  this is allowed
-            // if the object does NOT have a longer lifetime (meaning the
-            // implementation doesn't need to see this), or if the implementation
-            // allows it to happen.
-            allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) != OBJECT_LIFETIME_WEAK
-                  || impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
+        // we're now in the harder case of either:
+        // - there never was a strong reference on us
+        // - or, all strong references have been released
+        if ((impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_STRONG) {
+            // this object has a "normal" life-time, i.e.: it gets destroyed
+            // when the last strong reference goes away
+            if (curCount <= 0) {
+                // the last strong-reference got released, the object cannot
+                // be revived.
+                decWeak(id);
+                return false;
+            }
+
+            // here, curCount == INITIAL_STRONG_VALUE, which means
+            // there never was a strong-reference, so we can try to
+            // promote this object; we need to do that atomically.
+            while (curCount > 0) {
+                if (android_atomic_cmpxchg(curCount, curCount + 1,
+                        &impl->mStrong) == 0) {
+                    break;
+                }
+                // the strong count has changed on us, we need to re-assert our
+                // situation (e.g.: another thread has inc/decStrong'ed us)
+                curCount = impl->mStrong;
+            }
+
+            if (curCount <= 0) {
+                // promote() failed, some other thread destroyed us in the
+                // meantime (i.e.: strong count reached zero).
+                decWeak(id);
+                return false;
+            }
         } else {
-            // Attempting to revive the object...  this is allowed
-            // if the object DOES have a longer lifetime (so we can safely
-            // call the object with only a weak ref) and the implementation
-            // allows it to happen.
-            allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_WEAK
-                  && impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
+            // this object has an "extended" life-time, i.e.: it can be
+            // revived from a weak-reference only.
+            // Ask the object's implementation if it agrees to be revived
+            if (!impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id)) {
+                // it didn't so give-up.
+                decWeak(id);
+                return false;
+            }
+            // grab a strong-reference, which is always safe due to the
+            // extended life-time.
+            curCount = android_atomic_inc(&impl->mStrong);
         }
-        if (!allow) {
-            decWeak(id);
-            return false;
-        }
-        curCount = android_atomic_inc(&impl->mStrong);
 
         // If the strong reference count has already been incremented by
         // someone else, the implementor of onIncStrongAttempted() is holding
@@ -491,11 +514,23 @@
     ALOGD("attemptIncStrong of %p from %p: cnt=%d\n", this, id, curCount);
 #endif
 
-    if (curCount == INITIAL_STRONG_VALUE) {
-        android_atomic_add(-INITIAL_STRONG_VALUE, &impl->mStrong);
-        impl->mBase->onFirstRef();
+    // now we need to fix-up the count if it was INITIAL_STRONG_VALUE
+    // this must be done safely, i.e.: handle the case where several threads
+    // were here in attemptIncStrong().
+    curCount = impl->mStrong;
+    while (curCount >= INITIAL_STRONG_VALUE) {
+        ALOG_ASSERT(curCount > INITIAL_STRONG_VALUE,
+                "attemptIncStrong in %p underflowed to INITIAL_STRONG_VALUE",
+                this);
+        if (android_atomic_cmpxchg(curCount, curCount-INITIAL_STRONG_VALUE,
+                &impl->mStrong) == 0) {
+            break;
+        }
+        // the strong-count changed on us, we need to re-assert the situation,
+        // for e.g.: it's possible the fix-up happened in another thread.
+        curCount = impl->mStrong;
     }
-    
+
     return true;
 }
 
@@ -596,21 +631,27 @@
 
 // ---------------------------------------------------------------------------
 
-void RefBase::moveReferences(void* dst, void const* src, size_t n,
-        const ReferenceConverterBase& caster)
-{
+void RefBase::renameRefs(size_t n, const ReferenceRenamer& renamer) {
 #if DEBUG_REFS
-    const size_t itemSize = caster.getReferenceTypeSize();
     for (size_t i=0 ; i<n ; i++) {
-        void*       d = reinterpret_cast<void      *>(intptr_t(dst) + i*itemSize);
-        void const* s = reinterpret_cast<void const*>(intptr_t(src) + i*itemSize);
-        RefBase* ref(reinterpret_cast<RefBase*>(caster.getReferenceBase(d)));
-        ref->mRefs->renameStrongRefId(s, d);
-        ref->mRefs->renameWeakRefId(s, d);
+        renamer(i);
     }
 #endif
 }
 
+void RefBase::renameRefId(weakref_type* ref,
+        const void* old_id, const void* new_id) {
+    weakref_impl* const impl = static_cast<weakref_impl*>(ref);
+    impl->renameStrongRefId(old_id, new_id);
+    impl->renameWeakRefId(old_id, new_id);
+}
+
+void RefBase::renameRefId(RefBase* ref,
+        const void* old_id, const void* new_id) {
+    ref->mRefs->renameStrongRefId(old_id, new_id);
+    ref->mRefs->renameWeakRefId(old_id, new_id);
+}
+
 // ---------------------------------------------------------------------------
 
 TextOutput& printStrongPointer(TextOutput& to, const void* val)
diff --git a/libs/utils/VectorImpl.cpp b/libs/utils/VectorImpl.cpp
index c3257bb..70f49de 100644
--- a/libs/utils/VectorImpl.cpp
+++ b/libs/utils/VectorImpl.cpp
@@ -343,6 +343,16 @@
     return new_capacity;
 }
 
+ssize_t VectorImpl::resize(size_t size) {
+    ssize_t result = NO_ERROR;
+    if (size > mCount) {
+        result = insertAt(mCount, size - mCount);
+    } else if (size < mCount) {
+        result = removeItemsAt(size, mCount - size);
+    }
+    return result < 0 ? result : size;
+}
+
 void VectorImpl::release_storage()
 {
     if (mStorage) {
diff --git a/services/surfaceflinger/Android.mk b/services/surfaceflinger/Android.mk
index 5ff8154..30a01be 100644
--- a/services/surfaceflinger/Android.mk
+++ b/services/surfaceflinger/Android.mk
@@ -2,22 +2,23 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES:= \
-    Client.cpp                              \
-    DisplayDevice.cpp                       \
-    EventThread.cpp                         \
-    FrameTracker.cpp                        \
-    Layer.cpp                               \
-    LayerDim.cpp                            \
-    DisplayHardware/FramebufferSurface.cpp  \
-    DisplayHardware/HWComposer.cpp          \
-    DisplayHardware/PowerHAL.cpp            \
-    GLExtensions.cpp                        \
-    MessageQueue.cpp                        \
-    SurfaceFlinger.cpp                      \
-    SurfaceFlingerConsumer.cpp              \
-    SurfaceTextureLayer.cpp                 \
-    Transform.cpp                           \
-    
+    Client.cpp \
+    DisplayDevice.cpp \
+    EventThread.cpp \
+    FrameTracker.cpp \
+    GLExtensions.cpp \
+    Layer.cpp \
+    LayerDim.cpp \
+    MessageQueue.cpp \
+    SurfaceFlinger.cpp \
+    SurfaceFlingerConsumer.cpp \
+    SurfaceTextureLayer.cpp \
+    Transform.cpp \
+    DisplayHardware/BufferQueueInterposer.cpp \
+    DisplayHardware/FramebufferSurface.cpp \
+    DisplayHardware/HWComposer.cpp \
+    DisplayHardware/PowerHAL.cpp \
+    DisplayHardware/VirtualDisplaySurface.cpp \
 
 LOCAL_CFLAGS:= -DLOG_TAG=\"SurfaceFlinger\"
 LOCAL_CFLAGS += -DGL_GLEXT_PROTOTYPES -DEGL_EGLEXT_PROTOTYPES
diff --git a/services/surfaceflinger/Client.cpp b/services/surfaceflinger/Client.cpp
index 0575e35..dd65348 100644
--- a/services/surfaceflinger/Client.cpp
+++ b/services/surfaceflinger/Client.cpp
@@ -105,10 +105,11 @@
 }
 
 
-sp<ISurface> Client::createSurface(
+status_t Client::createSurface(
         const String8& name,
-        uint32_t w, uint32_t h, PixelFormat format,
-        uint32_t flags)
+        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
+        sp<IBinder>* handle,
+        sp<IGraphicBufferProducer>* gbp)
 {
     /*
      * createSurface must be called from the GL thread so that it can
@@ -116,9 +117,11 @@
      */
 
     class MessageCreateLayer : public MessageBase {
-        sp<ISurface> result;
         SurfaceFlinger* flinger;
         Client* client;
+        sp<IBinder>* handle;
+        sp<IGraphicBufferProducer>* gbp;
+        status_t result;
         const String8& name;
         uint32_t w, h;
         PixelFormat format;
@@ -126,21 +129,23 @@
     public:
         MessageCreateLayer(SurfaceFlinger* flinger,
                 const String8& name, Client* client,
-                uint32_t w, uint32_t h, PixelFormat format,
-                uint32_t flags)
-            : flinger(flinger), client(client), name(name),
-              w(w), h(h), format(format), flags(flags)
-        {
+                uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
+                sp<IBinder>* handle,
+                sp<IGraphicBufferProducer>* gbp)
+            : flinger(flinger), client(client),
+              handle(handle), gbp(gbp),
+              name(name), w(w), h(h), format(format), flags(flags) {
         }
-        sp<ISurface> getResult() const { return result; }
+        status_t getResult() const { return result; }
         virtual bool handler() {
-            result = flinger->createLayer(name, client, w, h, format, flags);
+            result = flinger->createLayer(name, client, w, h, format, flags,
+                    handle, gbp);
             return true;
         }
     };
 
     sp<MessageBase> msg = new MessageCreateLayer(mFlinger.get(),
-            name, this, w, h, format, flags);
+            name, this, w, h, format, flags, handle, gbp);
     mFlinger->postMessageSync(msg);
     return static_cast<MessageCreateLayer*>( msg.get() )->getResult();
 }
diff --git a/services/surfaceflinger/Client.h b/services/surfaceflinger/Client.h
index 4f34b86..84e649f 100644
--- a/services/surfaceflinger/Client.h
+++ b/services/surfaceflinger/Client.h
@@ -52,10 +52,11 @@
 
 private:
     // ISurfaceComposerClient interface
-    virtual sp<ISurface> createSurface(
+    virtual status_t createSurface(
             const String8& name,
-            uint32_t w, uint32_t h,PixelFormat format,
-            uint32_t flags);
+            uint32_t w, uint32_t h,PixelFormat format, uint32_t flags,
+            sp<IBinder>* handle,
+            sp<IGraphicBufferProducer>* gbp);
 
     virtual status_t destroySurface(const sp<IBinder>& handle);
 
diff --git a/services/surfaceflinger/DisplayDevice.cpp b/services/surfaceflinger/DisplayDevice.cpp
index 2bbe49c..ecd12d0 100644
--- a/services/surfaceflinger/DisplayDevice.cpp
+++ b/services/surfaceflinger/DisplayDevice.cpp
@@ -35,7 +35,7 @@
 
 #include <hardware/gralloc.h>
 
-#include "DisplayHardware/FramebufferSurface.h"
+#include "DisplayHardware/DisplaySurface.h"
 #include "DisplayHardware/HWComposer.h"
 
 #include "clz.h"
@@ -72,14 +72,12 @@
         DisplayType type,
         bool isSecure,
         const wp<IBinder>& displayToken,
-        const sp<ANativeWindow>& nativeWindow,
-        const sp<FramebufferSurface>& framebufferSurface,
+        const sp<DisplaySurface>& displaySurface,
         EGLConfig config)
     : mFlinger(flinger),
       mType(type), mHwcDisplayId(-1),
       mDisplayToken(displayToken),
-      mNativeWindow(nativeWindow),
-      mFramebufferSurface(framebufferSurface),
+      mDisplaySurface(displaySurface),
       mDisplay(EGL_NO_DISPLAY),
       mSurface(EGL_NO_SURFACE),
       mContext(EGL_NO_CONTEXT),
@@ -92,6 +90,7 @@
       mLayerStack(NO_LAYER_STACK),
       mOrientation()
 {
+    mNativeWindow = new Surface(mDisplaySurface->getIGraphicBufferProducer());
     init(config);
 }
 
@@ -183,10 +182,7 @@
 }
 
 status_t DisplayDevice::compositionComplete() const {
-    if (mFramebufferSurface == NULL) {
-        return NO_ERROR;
-    }
-    return mFramebufferSurface->compositionComplete();
+    return mDisplaySurface->compositionComplete();
 }
 
 void DisplayDevice::flip(const Region& dirty) const
@@ -209,45 +205,38 @@
 }
 
 void DisplayDevice::swapBuffers(HWComposer& hwc) const {
-    EGLBoolean success = EGL_TRUE;
-    if (hwc.initCheck() != NO_ERROR) {
-        // no HWC, we call eglSwapBuffers()
-        success = eglSwapBuffers(mDisplay, mSurface);
-    } else {
-        // We have a valid HWC, but not all displays can use it, in particular
-        // the virtual displays are on their own.
-        // TODO: HWC 1.2 will allow virtual displays
-        if (mType >= DisplayDevice::DISPLAY_VIRTUAL) {
-            // always call eglSwapBuffers() for virtual displays
-            success = eglSwapBuffers(mDisplay, mSurface);
-        } else if (hwc.supportsFramebufferTarget()) {
-            // as of hwc 1.1 we always call eglSwapBuffers if we have some
-            // GLES layers
-            if (hwc.hasGlesComposition(mType)) {
-                success = eglSwapBuffers(mDisplay, mSurface);
+    // We need to call eglSwapBuffers() unless:
+    // (a) there was no GLES composition this frame, or
+    // (b) we're using a legacy HWC with no framebuffer target support (in
+    //     which case HWComposer::commit() handles things).
+    if (hwc.initCheck() != NO_ERROR ||
+            (hwc.hasGlesComposition(mHwcDisplayId) &&
+             hwc.supportsFramebufferTarget())) {
+        EGLBoolean success = eglSwapBuffers(mDisplay, mSurface);
+        if (!success) {
+            EGLint error = eglGetError();
+            if (error == EGL_CONTEXT_LOST ||
+                    mType == DisplayDevice::DISPLAY_PRIMARY) {
+                LOG_ALWAYS_FATAL("eglSwapBuffers(%p, %p) failed with 0x%08x",
+                        mDisplay, mSurface, error);
+            } else {
+                ALOGE("eglSwapBuffers(%p, %p) failed with 0x%08x",
+                        mDisplay, mSurface, error);
             }
-        } else {
-            // HWC doesn't have the framebuffer target, we don't call
-            // eglSwapBuffers(), since this is handled by HWComposer::commit().
         }
     }
 
-    if (!success) {
-        EGLint error = eglGetError();
-        if (error == EGL_CONTEXT_LOST ||
-                mType == DisplayDevice::DISPLAY_PRIMARY) {
-            LOG_ALWAYS_FATAL("eglSwapBuffers(%p, %p) failed with 0x%08x",
-                    mDisplay, mSurface, error);
-        }
+    status_t result = mDisplaySurface->advanceFrame();
+    if (result != NO_ERROR) {
+        ALOGE("[%s] failed pushing new frame to HWC: %d",
+                mDisplayName.string(), result);
     }
 }
 
 void DisplayDevice::onSwapBuffersCompleted(HWComposer& hwc) const {
     if (hwc.initCheck() == NO_ERROR) {
-        if (hwc.supportsFramebufferTarget()) {
-            int fd = hwc.getAndResetReleaseFenceFd(mType);
-            mFramebufferSurface->setReleaseFenceFd(fd);
-        }
+        int fd = hwc.getAndResetReleaseFenceFd(mType);
+        mDisplaySurface->setReleaseFenceFd(fd);
     }
 }
 
@@ -455,9 +444,7 @@
 
     result.append(buffer);
 
-    String8 fbtargetDump;
-    if (mFramebufferSurface != NULL) {
-        mFramebufferSurface->dump(fbtargetDump);
-        result.append(fbtargetDump);
-    }
+    String8 surfaceDump;
+    mDisplaySurface->dump(surfaceDump);
+    result.append(surfaceDump);
 }
diff --git a/services/surfaceflinger/DisplayDevice.h b/services/surfaceflinger/DisplayDevice.h
index f671017..d8f55b4 100644
--- a/services/surfaceflinger/DisplayDevice.h
+++ b/services/surfaceflinger/DisplayDevice.h
@@ -37,7 +37,7 @@
 namespace android {
 
 class DisplayInfo;
-class FramebufferSurface;
+class DisplaySurface;
 class Layer;
 class SurfaceFlinger;
 class HWComposer;
@@ -74,8 +74,7 @@
             DisplayType type,
             bool isSecure,
             const wp<IBinder>& displayToken,
-            const sp<ANativeWindow>& nativeWindow,
-            const sp<FramebufferSurface>& framebufferSurface,
+            const sp<DisplaySurface>& displaySurface,
             EGLConfig config);
 
     ~DisplayDevice();
@@ -165,9 +164,7 @@
 
     // ANativeWindow this display is rendering into
     sp<ANativeWindow> mNativeWindow;
-
-    // set if mNativeWindow is a FramebufferSurface
-    sp<FramebufferSurface> mFramebufferSurface;
+    sp<DisplaySurface> mDisplaySurface;
 
     EGLDisplay      mDisplay;
     EGLSurface      mSurface;
diff --git a/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp
new file mode 100644
index 0000000..d8ad224
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#undef LOG_TAG
+#define LOG_TAG "BQInterposer"
+
+#include "BufferQueueInterposer.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+#define BQI_LOGV(x, ...) ALOGV("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGD(x, ...) ALOGD("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGI(x, ...) ALOGI("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGW(x, ...) ALOGW("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGE(x, ...) ALOGE("[%s] "x, mName.string(), ##__VA_ARGS__)
+
+// Get an ID that's unique within this process.
+static int32_t createProcessUniqueId() {
+    static volatile int32_t globalCounter = 0;
+    return android_atomic_inc(&globalCounter);
+}
+
+BufferQueueInterposer::BufferQueueInterposer(
+        const sp<IGraphicBufferProducer>& sink, const String8& name)
+:   mSink(sink),
+    mName(name),
+    mAcquired(false)
+{
+    BQI_LOGV("BufferQueueInterposer sink=%p", sink.get());
+
+    // We need one additional dequeued buffer beyond what the source needs.
+    // To have more than one (the default), we must call setBufferCount. But
+    // we have no way of knowing what the sink has set as the minimum buffer
+    // count, so if we just call setBufferCount(3) it may fail (and does, on
+    // one device using a video encoder sink). So far on the devices we care
+    // about, this is the smallest value that works.
+    //
+    // TODO: Change IGraphicBufferProducer and implementations to support this.
+    // Maybe change it so both the consumer and producer declare how many
+    // buffers they need, and the IGBP adds them? Then BQInterposer would just
+    // add 1 to the source's buffer count.
+    mSink->setBufferCount(6);
+}
+
+BufferQueueInterposer::~BufferQueueInterposer() {
+    Mutex::Autolock lock(mMutex);
+    flushQueuedBuffersLocked();
+    BQI_LOGV("~BufferQueueInterposer");
+}
+
+status_t BufferQueueInterposer::requestBuffer(int slot,
+        sp<GraphicBuffer>* outBuf) {
+    BQI_LOGV("requestBuffer slot=%d", slot);
+    Mutex::Autolock lock(mMutex);
+
+    if (size_t(slot) >= mBuffers.size()) {
+        size_t size = mBuffers.size();
+        mBuffers.insertAt(size, size - slot + 1);
+    }
+    sp<GraphicBuffer>& buf = mBuffers.editItemAt(slot);
+
+    status_t result = mSink->requestBuffer(slot, &buf);
+    *outBuf = buf;
+    return result;
+}
+
+status_t BufferQueueInterposer::setBufferCount(int bufferCount) {
+    BQI_LOGV("setBufferCount count=%d", bufferCount);
+    Mutex::Autolock lock(mMutex);
+
+    bufferCount += 1;
+
+    status_t result = flushQueuedBuffersLocked();
+    if (result != NO_ERROR)
+        return result;
+
+    result = mSink->setBufferCount(bufferCount);
+    if (result != NO_ERROR)
+        return result;
+
+    for (size_t i = 0; i < mBuffers.size(); i++)
+        mBuffers.editItemAt(i).clear();
+    ssize_t n = mBuffers.resize(bufferCount);
+    result = (n < 0) ? n : result;
+
+    return result;
+}
+
+status_t BufferQueueInterposer::dequeueBuffer(int* slot, sp<Fence>* fence,
+            uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
+    BQI_LOGV("dequeueBuffer %ux%u fmt=%u usage=%#x", w, h, format, usage);
+    return mSink->dequeueBuffer(slot, fence, w, h, format, usage);
+}
+
+status_t BufferQueueInterposer::queueBuffer(int slot,
+            const QueueBufferInput& input, QueueBufferOutput* output) {
+    BQI_LOGV("queueBuffer slot=%d", slot);
+    Mutex::Autolock lock(mMutex);
+    mQueue.push(QueuedBuffer(slot, input));
+    *output = mQueueBufferOutput;
+    return NO_ERROR;
+}
+
+void BufferQueueInterposer::cancelBuffer(int slot, const sp<Fence>& fence) {
+    BQI_LOGV("cancelBuffer slot=%d", slot);
+    mSink->cancelBuffer(slot, fence);
+}
+
+int BufferQueueInterposer::query(int what, int* value) {
+    BQI_LOGV("query what=%d", what);
+    return mSink->query(what, value);
+}
+
+status_t BufferQueueInterposer::setSynchronousMode(bool enabled) {
+    BQI_LOGV("setSynchronousMode %s", enabled ? "true" : "false");
+    return mSink->setSynchronousMode(enabled);
+}
+
+status_t BufferQueueInterposer::connect(int api, QueueBufferOutput* output) {
+    BQI_LOGV("connect api=%d", api);
+    Mutex::Autolock lock(mMutex);
+    status_t result = mSink->connect(api, &mQueueBufferOutput);
+    if (result == NO_ERROR) {
+        *output = mQueueBufferOutput;
+    }
+    return result;
+}
+
+status_t BufferQueueInterposer::disconnect(int api) {
+    BQI_LOGV("disconnect: api=%d", api);
+    Mutex::Autolock lock(mMutex);
+    flushQueuedBuffersLocked();
+    return mSink->disconnect(api);
+}
+
+status_t BufferQueueInterposer::pullEmptyBuffer() {
+    status_t result;
+
+    int slot;
+    sp<Fence> fence;
+    result = dequeueBuffer(&slot, &fence, 0, 0, 0, 0);
+    if (result == IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION) {
+        sp<GraphicBuffer> buffer;
+        result = requestBuffer(slot, &buffer);
+    } else if (result != NO_ERROR) {
+        return result;
+    }
+
+    uint32_t w, h, transformHint, numPendingBuffers;
+    mQueueBufferOutput.deflate(&w, &h, &transformHint, &numPendingBuffers);
+
+    IGraphicBufferProducer::QueueBufferInput qbi(0, Rect(w, h),
+            NATIVE_WINDOW_SCALING_MODE_FREEZE, 0, fence);
+    IGraphicBufferProducer::QueueBufferOutput qbo;
+    result = queueBuffer(slot, qbi, &qbo);
+    if (result != NO_ERROR)
+        return result;
+
+    return NO_ERROR;
+}
+
+status_t BufferQueueInterposer::acquireBuffer(sp<GraphicBuffer>* buf,
+        sp<Fence>* fence) {
+    Mutex::Autolock lock(mMutex);
+    if (mQueue.empty()) {
+        BQI_LOGV("acquireBuffer: no buffers available");
+        return NO_BUFFER_AVAILABLE;
+    }
+    if (mAcquired) {
+        BQI_LOGE("acquireBuffer: buffer already acquired");
+        return BUFFER_ALREADY_ACQUIRED;
+    }
+    BQI_LOGV("acquireBuffer: acquiring slot %d", mQueue[0].slot);
+
+    *buf = mBuffers[mQueue[0].slot];
+    *fence = mQueue[0].fence;
+    mAcquired = true;
+    return NO_ERROR;
+}
+
+status_t BufferQueueInterposer::releaseBuffer(const sp<Fence>& fence) {
+    Mutex::Autolock lock(mMutex);
+    if (!mAcquired) {
+        BQI_LOGE("releaseBuffer: releasing a non-acquired buffer");
+        return BUFFER_NOT_ACQUIRED;
+    }
+    BQI_LOGV("releaseBuffer: releasing slot %d to sink", mQueue[0].slot);
+
+    const QueuedBuffer& b = mQueue[0];
+    status_t result = mSink->queueBuffer(b.slot,
+            QueueBufferInput(b.timestamp, b.crop, b.scalingMode,
+                b.transform, b.fence),
+            &mQueueBufferOutput);
+    mQueue.removeAt(0);
+    mAcquired = false;
+
+    return result;
+}
+
+status_t BufferQueueInterposer::flushQueuedBuffersLocked() {
+    if (mAcquired) {
+        BQI_LOGE("flushQueuedBuffersLocked: buffer acquired, can't flush");
+        return INVALID_OPERATION;
+    }
+
+    status_t result = NO_ERROR;
+    for (size_t i = 0; i < mQueue.size(); i++) {
+        const QueuedBuffer& b = mQueue[i];
+        BQI_LOGV("flushing queued slot %d to sink", b.slot);
+        status_t err = mSink->queueBuffer(b.slot,
+                QueueBufferInput(b.timestamp, b.crop, b.scalingMode,
+                    b.transform, b.fence),
+                &mQueueBufferOutput);
+        if (err != NO_ERROR && result == NO_ERROR) // latch first error
+            result = err;
+    }
+    mQueue.clear();
+    return result;
+}
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h
new file mode 100644
index 0000000..7208630
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_BUFFERQUEUEINTERPOSER_H
+#define ANDROID_SF_BUFFERQUEUEINTERPOSER_H
+
+#include <gui/IGraphicBufferProducer.h>
+#include <utils/Mutex.h>
+#include <utils/Vector.h>
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+// BufferQueueInterposers introduce an extra stage between a buffer producer
+// (the source) and a buffer consumer (the sink), which communicate via the
+// IGraphicBufferProducer interface. It is designed to be as transparent as
+// possible to both endpoints, so that they can work the same whether an
+// interposer is present or not.
+//
+// When the interpose is present, the source queues buffers to the
+// IGraphicBufferProducer implemented by BufferQueueInterposer. A client of
+// the BufferQueueInterposer can acquire each buffer in turn and read or
+// modify it, releasing the buffer when finished. When the buffer is released,
+// the BufferQueueInterposer queues it to the original IGraphicBufferProducer
+// interface representing the sink.
+//
+// A BufferQueueInterposer can be used to do additional rendering to a buffer
+// before it is consumed -- essentially pipelining two producers. As an
+// example, SurfaceFlinger uses this to implement mixed GLES and HWC
+// compositing to the same buffer for virtual displays. If it used two separate
+// buffer queues, then in GLES-only or mixed GLES+HWC compositing, the HWC
+// would have to copy the GLES output buffer to the HWC output buffer, using
+// more bandwidth than having HWC do additional composition "in place" on the
+// GLES output buffer.
+//
+// The goal for this class is to be usable in a variety of situations and be
+// part of libgui. But both the interface and implementation need some
+// iteration before then, so for now it should only be used by
+// VirtualDisplaySurface, which is why it's currently in SurfaceFlinger.
+//
+// Some of the problems that still need to be solved are:
+//
+// - Refactor the interposer interface along with BufferQueue and ConsumerBase,
+//   so that there is a common interface for the consumer end of a queue. The
+//   existing interfaces have some problems when the implementation isn't the
+//   final consumer.
+//
+// - The interposer needs at least one buffer in addition to those used by the
+//   source and sink. setBufferCount and QueueBufferOutput both need to
+//   account for this. It's not possible currently to do this generically,
+//   since we can't find out how many buffers the source and sink need. (See
+//   the horrible hack in the BufferQueueInterposer constructor).
+//
+// - Abandoning, disconnecting, and connecting need to pass through somehow.
+//   There needs to be a way to tell the interposer client to release its
+//   buffer immediately so it can be queued/released, e.g. when the source
+//   calls disconnect().
+//
+// - Right now the source->BQI queue is synchronous even if the BQI->sink
+//   queue is asynchronous. Need to figure out how asynchronous should behave
+//   and implement that.
+
+class BufferQueueInterposer : public BnGraphicBufferProducer {
+public:
+    BufferQueueInterposer(const sp<IGraphicBufferProducer>& sink,
+            const String8& name);
+
+    //
+    // IGraphicBufferProducer interface
+    //
+    virtual status_t requestBuffer(int slot, sp<GraphicBuffer>* outBuf);
+    virtual status_t setBufferCount(int bufferCount);
+    virtual status_t dequeueBuffer(int* slot, sp<Fence>* fence,
+            uint32_t w, uint32_t h, uint32_t format, uint32_t usage);
+    virtual status_t queueBuffer(int slot,
+            const QueueBufferInput& input, QueueBufferOutput* output);
+    virtual void cancelBuffer(int slot, const sp<Fence>& fence);
+    virtual int query(int what, int* value);
+    virtual status_t setSynchronousMode(bool enabled);
+    virtual status_t connect(int api, QueueBufferOutput* output);
+    virtual status_t disconnect(int api);
+
+    //
+    // Interposer interface
+    //
+
+    enum {
+        NO_BUFFER_AVAILABLE = 2,    // matches BufferQueue
+        BUFFER_NOT_ACQUIRED,
+        BUFFER_ALREADY_ACQUIRED,
+    };
+
+    // Acquire the oldest queued buffer. If no buffers are pending, returns
+    // NO_BUFFER_AVAILABLE. If a buffer is currently acquired, returns
+    // BUFFER_ALREADY_ACQUIRED.
+    status_t acquireBuffer(sp<GraphicBuffer>* buf, sp<Fence>* fence);
+
+    // Release the currently acquired buffer, queueing it to the sink. If the
+    // current buffer hasn't been acquired, returns BUFFER_NOT_ACQUIRED.
+    status_t releaseBuffer(const sp<Fence>& fence);
+
+    // pullEmptyBuffer dequeues a buffer from the sink, then immediately
+    // queues it to the interposer. This makes a buffer available for the
+    // client to acquire even if the source hasn't queued one.
+    status_t pullEmptyBuffer();
+
+private:
+    struct QueuedBuffer {
+        QueuedBuffer(): slot(-1) {}
+        QueuedBuffer(int slot, const QueueBufferInput& qbi): slot(slot) {
+            qbi.deflate(&timestamp, &crop, &scalingMode, &transform, &fence);
+        }
+        int slot;
+        int64_t timestamp;
+        Rect crop;
+        int scalingMode;
+        uint32_t transform;
+        sp<Fence> fence;
+    };
+
+    virtual ~BufferQueueInterposer();
+    status_t flushQueuedBuffersLocked();
+
+    const sp<IGraphicBufferProducer> mSink;
+    String8 mName;
+
+    Mutex mMutex;
+    Vector<sp<GraphicBuffer> > mBuffers;
+    Vector<QueuedBuffer> mQueue;
+    bool mAcquired;
+    QueueBufferOutput mQueueBufferOutput;
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_BUFFERQUEUEINTERPOSER_H
diff --git a/services/surfaceflinger/DisplayHardware/DisplaySurface.h b/services/surfaceflinger/DisplayHardware/DisplaySurface.h
new file mode 100644
index 0000000..2de6b4c
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/DisplaySurface.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_DISPLAY_SURFACE_H
+#define ANDROID_SF_DISPLAY_SURFACE_H
+
+#include <utils/Errors.h>
+#include <utils/RefBase.h>
+#include <utils/StrongPointer.h>
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+class IGraphicBufferProducer;
+class String8;
+
+class DisplaySurface : public virtual RefBase {
+public:
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const = 0;
+
+    // Should be called when composition rendering is complete for a frame (but
+    // eglSwapBuffers hasn't necessarily been called). Required by certain
+    // older drivers for synchronization.
+    // TODO: Remove this when we drop support for HWC 1.0.
+    virtual status_t compositionComplete() = 0;
+
+    // Inform the surface that GLES composition is complete for this frame, and
+    // the surface should make sure that HWComposer has the correct buffer for
+    // this frame. Some implementations may only push a new buffer to
+    // HWComposer if GLES composition took place, others need to push a new
+    // buffer on every frame.
+    virtual status_t advanceFrame() = 0;
+
+    // setReleaseFenceFd stores a fence file descriptor that will signal when
+    // the current buffer is no longer being read. This fence will be returned
+    // to the producer when the current buffer is released by updateTexImage().
+    // Multiple fences can be set for a given buffer; they will be merged into
+    // a single union fence. The GLConsumer will close the file descriptor
+    // when finished with it.
+    virtual status_t setReleaseFenceFd(int fenceFd) = 0;
+
+    virtual void dump(String8& result) const = 0;
+
+protected:
+    DisplaySurface() {}
+    virtual ~DisplaySurface() {}
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_DISPLAY_SURFACE_H
+
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
index 7557e3f..b5abaac 100644
--- a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
@@ -68,6 +68,17 @@
     mBufferQueue->setDefaultMaxBufferCount(NUM_FRAMEBUFFER_SURFACE_BUFFERS);
 }
 
+sp<IGraphicBufferProducer> FramebufferSurface::getIGraphicBufferProducer() const {
+    return getBufferQueue();
+}
+
+status_t FramebufferSurface::advanceFrame() {
+    // Once we remove FB HAL support, we can call nextBuffer() from here
+    // instead of using onFrameAvailable(). No real benefit, except it'll be
+    // more like VirtualDisplaySurface.
+    return NO_ERROR;
+}
+
 status_t FramebufferSurface::nextBuffer(sp<GraphicBuffer>& outBuffer, sp<Fence>& outFence) {
     Mutex::Autolock lock(mMutex);
 
@@ -134,7 +145,7 @@
     if (fenceFd >= 0) {
         sp<Fence> fence(new Fence(fenceFd));
         if (mCurrentBufferSlot != BufferQueue::INVALID_BUFFER_SLOT) {
-            status_t err = addReleaseFence(mCurrentBufferSlot, fence);
+            err = addReleaseFence(mCurrentBufferSlot, fence);
             ALOGE_IF(err, "setReleaseFenceFd: failed to add the fence: %s (%d)",
                     strerror(-err), err);
         }
@@ -142,21 +153,38 @@
     return err;
 }
 
-status_t FramebufferSurface::setUpdateRectangle(const Rect& r)
-{
-    return INVALID_OPERATION;
-}
-
 status_t FramebufferSurface::compositionComplete()
 {
     return mHwc.fbCompositionComplete();
 }
 
-void FramebufferSurface::dump(String8& result) {
-    mHwc.fbDump(result);
+// Since DisplaySurface and ConsumerBase both have a method with this
+// signature, results will vary based on the static pointer type the caller is
+// using:
+//   void dump(FrameBufferSurface* fbs, String8& s) {
+//       // calls FramebufferSurface::dump()
+//       fbs->dump(s);
+//
+//       // calls ConsumerBase::dump() since it is non-virtual
+//       static_cast<ConsumerBase*>(fbs)->dump(s);
+//
+//       // calls FramebufferSurface::dump() since it is virtual
+//       static_cast<DisplaySurface*>(fbs)->dump(s);
+//   }
+// To make sure that all of these end up doing the same thing, we just redirect
+// to ConsumerBase::dump() here. It will take the internal lock, and then call
+// virtual dumpLocked(), which is where the real work happens.
+void FramebufferSurface::dump(String8& result) const {
     ConsumerBase::dump(result);
 }
 
+void FramebufferSurface::dumpLocked(String8& result, const char* prefix,
+            char* buffer, size_t SIZE) const
+{
+    mHwc.fbDump(result);
+    ConsumerBase::dumpLocked(result, prefix, buffer, SIZE);
+}
+
 // ----------------------------------------------------------------------------
 }; // namespace android
 // ----------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.h b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
index b61b7f5..0aab742 100644
--- a/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
@@ -22,6 +22,8 @@
 
 #include <gui/ConsumerBase.h>
 
+#include "DisplaySurface.h"
+
 // ---------------------------------------------------------------------------
 namespace android {
 // ---------------------------------------------------------------------------
@@ -32,23 +34,20 @@
 
 // ---------------------------------------------------------------------------
 
-class FramebufferSurface : public ConsumerBase {
+class FramebufferSurface : public ConsumerBase,
+                           public DisplaySurface {
 public:
     FramebufferSurface(HWComposer& hwc, int disp);
 
-    bool isUpdateOnDemand() const { return false; }
-    status_t setUpdateRectangle(const Rect& updateRect);
-    status_t compositionComplete();
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const;
 
-    virtual void dump(String8& result);
+    virtual status_t compositionComplete();
+    virtual status_t advanceFrame();
+    virtual status_t setReleaseFenceFd(int fenceFd);
 
-    // setReleaseFenceFd stores a fence file descriptor that will signal when the
-    // current buffer is no longer being read. This fence will be returned to
-    // the producer when the current buffer is released by updateTexImage().
-    // Multiple fences can be set for a given buffer; they will be merged into
-    // a single union fence. The GLConsumer will close the file descriptor
-    // when finished with it.
-    status_t setReleaseFenceFd(int fenceFd);
+    // Implementation of DisplaySurface::dump(). Note that ConsumerBase also
+    // has a non-virtual dump() with the same signature.
+    virtual void dump(String8& result) const;
 
 private:
     virtual ~FramebufferSurface() { }; // this class cannot be overloaded
@@ -56,6 +55,9 @@
     virtual void onFrameAvailable();
     virtual void freeBufferLocked(int slotIndex);
 
+    virtual void dumpLocked(String8& result, const char* prefix,
+            char* buffer, size_t SIZE) const;
+
     // nextBuffer waits for and then latches the next buffer from the
     // BufferQueue and releases the previously latched buffer to the
     // BufferQueue.  The new buffer is returned in the 'buffer' argument.
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index bb567e2..96cfc14 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -99,7 +99,7 @@
     bool needVSyncThread = true;
 
     // Note: some devices may insist that the FB HAL be opened before HWC.
-    loadFbHalModule();
+    int fberr = loadFbHalModule();
     loadHwcModule();
 
     if (mFbDev && mHwc && hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) {
@@ -113,7 +113,8 @@
     // If we have no HWC, or a pre-1.1 HWC, an FB dev is mandatory.
     if ((!mHwc || !hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1))
             && !mFbDev) {
-        ALOGE("ERROR: failed to open framebuffer, aborting");
+        ALOGE("ERROR: failed to open framebuffer (%s), aborting",
+                strerror(-fberr));
         abort();
     }
 
@@ -234,20 +235,17 @@
 }
 
 // Load and prepare the FB HAL, which uses the gralloc module.  Sets mFbDev.
-void HWComposer::loadFbHalModule()
+int HWComposer::loadFbHalModule()
 {
     hw_module_t const* module;
 
-    if (hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module) != 0) {
+    int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
+    if (err != 0) {
         ALOGE("%s module not found", GRALLOC_HARDWARE_MODULE_ID);
-        return;
+        return err;
     }
 
-    int err = framebuffer_open(module, &mFbDev);
-    if (err) {
-        ALOGE("framebuffer_open failed (%s)", strerror(-err));
-        return;
-    }
+    return framebuffer_open(module, &mFbDev);
 }
 
 status_t HWComposer::initCheck() const {
@@ -380,6 +378,7 @@
     }
     int32_t id = mAllocatedDisplayIDs.firstUnmarkedBit();
     mAllocatedDisplayIDs.markBit(id);
+    mDisplayData[id].connected = true;
     return id;
 }
 
@@ -392,6 +391,7 @@
         return BAD_INDEX;
     }
     mAllocatedDisplayIDs.clearBit(id);
+    mDisplayData[id].connected = false;
     return NO_ERROR;
 }
 
@@ -615,14 +615,14 @@
 }
 
 bool HWComposer::hasHwcComposition(int32_t id) const {
-    if (uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
+    if (!mHwc || uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
         return false;
     return mDisplayData[id].hasOvComp;
 }
 
 bool HWComposer::hasGlesComposition(int32_t id) const {
-    if (uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
-        return false;
+    if (!mHwc || uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
+        return true;
     return mDisplayData[id].hasFbComp;
 }
 
@@ -653,6 +653,18 @@
             mLists[0]->sur = eglGetCurrentSurface(EGL_DRAW);
         }
 
+        // For virtual displays, the framebufferTarget buffer also serves as
+        // the HWC output buffer, so we need to copy the buffer handle and
+        // dup() the acquire fence.
+        for (size_t i=HWC_NUM_DISPLAY_TYPES; i<mNumDisplays; i++) {
+            DisplayData& disp(mDisplayData[i]);
+            if (disp.framebufferTarget) {
+                mLists[i]->outbuf = disp.framebufferTarget->handle;
+                mLists[i]->outbufAcquireFenceFd =
+                        dup(disp.framebufferTarget->acquireFenceFd);
+            }
+        }
+
         err = mHwc->set(mHwc, mNumDisplays, mLists);
 
         for (size_t i=0 ; i<mNumDisplays ; i++) {
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.h b/services/surfaceflinger/DisplayHardware/HWComposer.h
index 9816a45..fdbd2d9 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.h
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.h
@@ -112,7 +112,7 @@
     // does this display have layers handled by GLES
     bool hasGlesComposition(int32_t id) const;
 
-    // get the releaseFence file descriptor for the given display
+    // get the releaseFence file descriptor for a display's framebuffer layer.
     // the release fence is only valid after commit()
     int getAndResetReleaseFenceFd(int32_t id);
 
@@ -265,7 +265,7 @@
 
 private:
     void loadHwcModule();
-    void loadFbHalModule();
+    int loadFbHalModule();
 
     LayerListIterator getLayerIterator(int32_t id, size_t index);
 
diff --git a/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp
new file mode 100644
index 0000000..433e1eb
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "VirtualDisplaySurface.h"
+#include "HWComposer.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+VirtualDisplaySurface::VirtualDisplaySurface(HWComposer& hwc, int disp,
+        const sp<IGraphicBufferProducer>& sink, const String8& name)
+:   mHwc(hwc),
+    mDisplayId(disp),
+    mSource(new BufferQueueInterposer(sink, name)),
+    mName(name),
+    mReleaseFence(Fence::NO_FENCE)
+{}
+
+VirtualDisplaySurface::~VirtualDisplaySurface() {
+    if (mAcquiredBuffer != NULL) {
+        status_t result = mSource->releaseBuffer(mReleaseFence);
+        ALOGE_IF(result != NO_ERROR, "VirtualDisplaySurface \"%s\": "
+                "failed to release previous buffer: %d",
+                mName.string(), result);
+    }
+}
+
+sp<IGraphicBufferProducer> VirtualDisplaySurface::getIGraphicBufferProducer() const {
+    return mSource;
+}
+
+status_t VirtualDisplaySurface::compositionComplete() {
+    return NO_ERROR;
+}
+
+status_t VirtualDisplaySurface::advanceFrame() {
+    Mutex::Autolock lock(mMutex);
+    status_t result = NO_ERROR;
+
+    if (mAcquiredBuffer != NULL) {
+        result = mSource->releaseBuffer(mReleaseFence);
+        ALOGE_IF(result != NO_ERROR, "VirtualDisplaySurface \"%s\": "
+                "failed to release previous buffer: %d",
+                mName.string(), result);
+        mAcquiredBuffer.clear();
+        mReleaseFence = Fence::NO_FENCE;
+    }
+
+    sp<Fence> fence;
+    result = mSource->acquireBuffer(&mAcquiredBuffer, &fence);
+    if (result == BufferQueueInterposer::NO_BUFFER_AVAILABLE) {
+        result = mSource->pullEmptyBuffer();
+        if (result != NO_ERROR)
+            return result;
+        result = mSource->acquireBuffer(&mAcquiredBuffer, &fence);
+    }
+    if (result != NO_ERROR)
+        return result;
+
+    return mHwc.fbPost(mDisplayId, fence, mAcquiredBuffer);
+}
+
+status_t VirtualDisplaySurface::setReleaseFenceFd(int fenceFd) {
+    if (fenceFd >= 0) {
+        sp<Fence> fence(new Fence(fenceFd));
+        Mutex::Autolock lock(mMutex);
+        sp<Fence> mergedFence = Fence::merge(
+                String8::format("VirtualDisplaySurface \"%s\"",
+                        mName.string()),
+                mReleaseFence, fence);
+        if (!mergedFence->isValid()) {
+            ALOGE("VirtualDisplaySurface \"%s\": failed to merge release fence",
+                    mName.string());
+            // synchronization is broken, the best we can do is hope fences
+            // signal in order so the new fence will act like a union
+            mReleaseFence = fence;
+            return BAD_VALUE;
+        }
+        mReleaseFence = mergedFence;
+    }
+    return NO_ERROR;
+}
+
+void VirtualDisplaySurface::dump(String8& result) const {
+}
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h
new file mode 100644
index 0000000..66f8580
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+#define ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+
+#include "BufferQueueInterposer.h"
+#include "DisplaySurface.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+class HWComposer;
+
+/* This DisplaySurface implementation uses a BufferQueueInterposer to pass
+ * partially- or fully-composited buffers from the OpenGL ES driver to
+ * HWComposer to use as the output buffer for virtual displays. Allowing HWC
+ * to compose into the same buffer that contains GLES results saves bandwidth
+ * compared to having two separate BufferQueues for frames with at least some
+ * GLES composition.
+ *
+ * The alternative would be to have two complete BufferQueues, one from GLES
+ * to HWC and one from HWC to the virtual display sink (e.g. video encoder).
+ * For GLES-only frames, the same bandwidth saving could be achieved if buffers
+ * could be acquired from the GLES->HWC queue and inserted into the HWC->sink
+ * queue. That would be complicated and doesn't help the mixed GLES+HWC case.
+ *
+ * On frames with no GLES composition, the VirtualDisplaySurface dequeues a
+ * buffer directly from the sink IGraphicBufferProducer and passes it to HWC,
+ * bypassing the GLES driver. This is only guaranteed to work if
+ * eglSwapBuffers doesn't immediately dequeue a buffer for the next frame,
+ * since we can't rely on being able to dequeue more than one buffer at a time.
+ *
+ * TODO(jessehall): Add a libgui test that ensures that EGL/GLES do lazy
+ * dequeBuffers; we've wanted to require that for other reasons anyway.
+ */
+class VirtualDisplaySurface : public DisplaySurface {
+public:
+    VirtualDisplaySurface(HWComposer& hwc, int disp,
+            const sp<IGraphicBufferProducer>& sink,
+            const String8& name);
+
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const;
+
+    virtual status_t compositionComplete();
+    virtual status_t advanceFrame();
+    virtual status_t setReleaseFenceFd(int fenceFd);
+    virtual void dump(String8& result) const;
+
+private:
+    virtual ~VirtualDisplaySurface();
+
+    // immutable after construction
+    HWComposer& mHwc;
+    int mDisplayId;
+    sp<BufferQueueInterposer> mSource;
+    String8 mName;
+
+    // mutable, must be synchronized with mMutex
+    Mutex mMutex;
+    sp<GraphicBuffer> mAcquiredBuffer;
+    sp<Fence> mReleaseFence;
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+
diff --git a/services/surfaceflinger/EventThread.cpp b/services/surfaceflinger/EventThread.cpp
index edb9fa5..4d0fc79 100644
--- a/services/surfaceflinger/EventThread.cpp
+++ b/services/surfaceflinger/EventThread.cpp
@@ -41,7 +41,7 @@
       mUseSoftwareVSync(false),
       mDebugVsyncEnabled(false) {
 
-    for (int32_t i=0 ; i<HWC_DISPLAY_TYPES_SUPPORTED ; i++) {
+    for (int32_t i=0 ; i<HWC_NUM_DISPLAY_TYPES ; i++) {
         mVSyncEvent[i].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
         mVSyncEvent[i].header.id = 0;
         mVSyncEvent[i].header.timestamp = 0;
@@ -112,11 +112,11 @@
 
 
 void EventThread::onVSyncReceived(int type, nsecs_t timestamp) {
-    ALOGE_IF(type >= HWC_DISPLAY_TYPES_SUPPORTED,
-            "received event for an invalid display (id=%d)", type);
+    ALOGE_IF(type >= HWC_NUM_DISPLAY_TYPES,
+            "received vsync event for an invalid display (id=%d)", type);
 
     Mutex::Autolock _l(mLock);
-    if (type < HWC_DISPLAY_TYPES_SUPPORTED) {
+    if (type < HWC_NUM_DISPLAY_TYPES) {
         mVSyncEvent[type].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
         mVSyncEvent[type].header.id = type;
         mVSyncEvent[type].header.timestamp = timestamp;
@@ -126,11 +126,11 @@
 }
 
 void EventThread::onHotplugReceived(int type, bool connected) {
-    ALOGE_IF(type >= HWC_DISPLAY_TYPES_SUPPORTED,
-            "received event for an invalid display (id=%d)", type);
+    ALOGE_IF(type >= HWC_NUM_DISPLAY_TYPES,
+            "received hotplug event for an invalid display (id=%d)", type);
 
     Mutex::Autolock _l(mLock);
-    if (type < HWC_DISPLAY_TYPES_SUPPORTED) {
+    if (type < HWC_NUM_DISPLAY_TYPES) {
         DisplayEventReceiver::Event event;
         event.header.type = DisplayEventReceiver::DISPLAY_EVENT_HOTPLUG;
         event.header.id = type;
@@ -184,7 +184,7 @@
 
         size_t vsyncCount = 0;
         nsecs_t timestamp = 0;
-        for (int32_t i=0 ; i<HWC_DISPLAY_TYPES_SUPPORTED ; i++) {
+        for (int32_t i=0 ; i<HWC_NUM_DISPLAY_TYPES ; i++) {
             timestamp = mVSyncEvent[i].header.timestamp;
             if (timestamp) {
                 // we have a vsync event to dispatch
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 44ef0b8..1677c76 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -52,7 +52,8 @@
 
 int32_t Layer::sSequence = 1;
 
-Layer::Layer(SurfaceFlinger* flinger, const sp<Client>& client)
+Layer::Layer(SurfaceFlinger* flinger, const sp<Client>& client,
+        const String8& name, uint32_t w, uint32_t h, uint32_t flags)
     :   contentDirty(false),
         sequence(uint32_t(android_atomic_inc(&sSequence))),
         mFlinger(flinger),
@@ -79,18 +80,42 @@
 {
     mCurrentCrop.makeInvalid();
     glGenTextures(1, &mTextureName);
+
+    uint32_t layerFlags = 0;
+    if (flags & ISurfaceComposerClient::eHidden)
+        layerFlags = layer_state_t::eLayerHidden;
+
+    if (flags & ISurfaceComposerClient::eNonPremultiplied)
+        mPremultipliedAlpha = false;
+
+    mName = name;
+
+    mCurrentState.active.w = w;
+    mCurrentState.active.h = h;
+    mCurrentState.active.crop.makeInvalid();
+    mCurrentState.z = 0;
+    mCurrentState.alpha = 0xFF;
+    mCurrentState.layerStack = 0;
+    mCurrentState.flags = layerFlags;
+    mCurrentState.sequence = 0;
+    mCurrentState.transform.set(0, 0);
+    mCurrentState.requested = mCurrentState.active;
+
+    // drawing state & current state are identical
+    mDrawingState = mCurrentState;
 }
 
 void Layer::onFirstRef()
 {
     // Creates a custom BufferQueue for SurfaceFlingerConsumer to use
-    sp<BufferQueue> bq = new SurfaceTextureLayer();
+    sp<BufferQueue> bq = new SurfaceTextureLayer(mFlinger);
     mSurfaceFlingerConsumer = new SurfaceFlingerConsumer(mTextureName, true,
             GL_TEXTURE_EXTERNAL_OES, false, bq);
 
     mSurfaceFlingerConsumer->setConsumerUsageBits(getEffectiveUsage(0));
     mSurfaceFlingerConsumer->setFrameAvailableListener(this);
     mSurfaceFlingerConsumer->setSynchronousMode(true);
+    mSurfaceFlingerConsumer->setName(mName);
 
 #ifdef TARGET_DISABLE_TRIPLE_BUFFERING
 #warning "disabling triple buffering"
@@ -103,8 +128,7 @@
     updateTransformHint(hw);
 }
 
-Layer::~Layer()
-{
+Layer::~Layer() {
     sp<Client> c(mClientRef.promote());
     if (c != 0) {
         c->detachLayer(this);
@@ -129,8 +153,9 @@
     mFlinger->signalLayerUpdate();
 }
 
-// called with SurfaceFlinger::mStateLock as soon as the layer is entered
-// in the purgatory list
+// called with SurfaceFlinger::mStateLock from the drawing thread after
+// the layer has been remove from the current state list (and just before
+// it's removed from the drawing state list)
 void Layer::onRemoved() {
     mSurfaceFlingerConsumer->abandon();
 }
@@ -139,39 +164,10 @@
 // set-up
 // ---------------------------------------------------------------------------
 
-void Layer::setName(const String8& name) {
-    mName = name;
-    mSurfaceFlingerConsumer->setName(name);
-}
-
 String8 Layer::getName() const {
     return mName;
 }
 
-void Layer::initStates(uint32_t w, uint32_t h, uint32_t flags)
-{
-    uint32_t layerFlags = 0;
-    if (flags & ISurfaceComposerClient::eHidden)
-        layerFlags = layer_state_t::eLayerHidden;
-
-    if (flags & ISurfaceComposerClient::eNonPremultiplied)
-        mPremultipliedAlpha = false;
-
-    mCurrentState.active.w = w;
-    mCurrentState.active.h = h;
-    mCurrentState.active.crop.makeInvalid();
-    mCurrentState.z = 0;
-    mCurrentState.alpha = 0xFF;
-    mCurrentState.layerStack = 0;
-    mCurrentState.flags = layerFlags;
-    mCurrentState.sequence = 0;
-    mCurrentState.transform.set(0, 0);
-    mCurrentState.requested = mCurrentState.active;
-
-    // drawing state & current state are identical
-    mDrawingState = mCurrentState;
-}
-
 status_t Layer::setBuffers( uint32_t w, uint32_t h,
                             PixelFormat format, uint32_t flags)
 {
@@ -207,59 +203,47 @@
     return NO_ERROR;
 }
 
-sp<ISurface> Layer::createSurface() {
-    /*
-     * This class provides an implementation of BnSurface (the "native" or
-     * "remote" side of the Binder IPC interface ISurface), and mixes in
-     * LayerCleaner to ensure that mFlinger->onLayerDestroyed() is called for
-     * this layer when the BSurface is destroyed.
-     *
-     * The idea is to provide a handle to the Layer through ISurface that
-     * is cleaned up automatically when the last reference to the ISurface
-     * goes away.  (The references will be held on the "proxy" side, while
-     * the Layer exists on the "native" side.)
-     *
-     * The Layer has a reference to an instance of SurfaceFlinger's variant
-     * of GLConsumer, which holds a reference to the BufferQueue.  The
-     * getSurfaceTexture() call returns a Binder interface reference for
-     * the producer interface of the buffer queue associated with the Layer.
-     */
-    class BSurface : public BnSurface, public LayerCleaner {
-        wp<const Layer> mOwner;
-        virtual sp<IGraphicBufferProducer> getSurfaceTexture() const {
-            sp<IGraphicBufferProducer> res;
-            sp<const Layer> that( mOwner.promote() );
-            if (that != NULL) {
-                res = that->mSurfaceFlingerConsumer->getBufferQueue();
-            }
-            return res;
-        }
-    public:
-        BSurface(const sp<SurfaceFlinger>& flinger,
-                const sp<Layer>& layer)
-            : LayerCleaner(flinger, layer), mOwner(layer) { }
-    };
-    sp<ISurface> sur(new BSurface(mFlinger, this));
-    return sur;
-}
-
-wp<IBinder> Layer::getSurfaceTextureBinder() const {
-    return mSurfaceFlingerConsumer->getBufferQueue()->asBinder();
-}
-
-sp<ISurface> Layer::getSurface()
-{
-    sp<ISurface> s;
+sp<IBinder> Layer::getHandle() {
     Mutex::Autolock _l(mLock);
 
     LOG_ALWAYS_FATAL_IF(mHasSurface,
-            "Layer::getSurface() has already been called");
+            "Layer::getHandle() has already been called");
 
     mHasSurface = true;
-    s = createSurface();
-    return s;
+
+    /*
+     * The layer handle is just a BBinder object passed to the client
+     * (remote process) -- we don't keep any reference on our side such that
+     * the dtor is called when the remote side let go of its reference.
+     *
+     * LayerCleaner ensures that mFlinger->onLayerDestroyed() is called for
+     * this layer when the handle is destroyed.
+     */
+
+    class Handle : public BBinder, public LayerCleaner {
+        wp<const Layer> mOwner;
+    public:
+        Handle(const sp<SurfaceFlinger>& flinger, const sp<Layer>& layer)
+            : LayerCleaner(flinger, layer), mOwner(layer) {
+        }
+    };
+
+    return new Handle(mFlinger, this);
 }
 
+sp<BufferQueue> Layer::getBufferQueue() const {
+    return mSurfaceFlingerConsumer->getBufferQueue();
+}
+
+//virtual sp<IGraphicBufferProducer> getSurfaceTexture() const {
+//    sp<IGraphicBufferProducer> res;
+//    sp<const Layer> that( mOwner.promote() );
+//    if (that != NULL) {
+//        res = that->mSurfaceFlingerConsumer->getBufferQueue();
+//    }
+//    return res;
+//}
+
 // ---------------------------------------------------------------------------
 // h/w composer set-up
 // ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/Layer.h b/services/surfaceflinger/Layer.h
index 5fb6d8b..6bca941 100644
--- a/services/surfaceflinger/Layer.h
+++ b/services/surfaceflinger/Layer.h
@@ -124,16 +124,12 @@
 
     // -----------------------------------------------------------------------
 
-    Layer(SurfaceFlinger* flinger, const sp<Client>& client);
+    Layer(SurfaceFlinger* flinger, const sp<Client>& client,
+            const String8& name, uint32_t w, uint32_t h, uint32_t flags);
     virtual ~Layer();
 
     // the this layer's size and format
-    status_t setBuffers(uint32_t w, uint32_t h, 
-            PixelFormat format, uint32_t flags=0);
-
-    // Creates an ISurface associated with this object.  This may only be
-    // called once. to provide your own ISurface, override createSurface().
-    sp<ISurface> getSurface();
+    status_t setBuffers(uint32_t w, uint32_t h, PixelFormat format, uint32_t flags);
 
     // modify current state
     bool setPosition(float x, float y);
@@ -154,18 +150,14 @@
     void computeGeometry(const sp<const DisplayDevice>& hw, LayerMesh* mesh) const;
     Rect computeBounds() const;
 
+    sp<IBinder> getHandle();
+    sp<BufferQueue> getBufferQueue() const;
+    String8 getName() const;
+
     // -----------------------------------------------------------------------
 
-    /*
-     * initStates - called just after construction
-     */
-    virtual void initStates(uint32_t w, uint32_t h, uint32_t flags);
-
     virtual const char* getTypeId() const { return "Layer"; }
 
-    virtual void setName(const String8& name);
-    String8 getName() const;
-
     virtual void setGeometry(const sp<const DisplayDevice>& hw,
             HWComposer::HWCLayerInterface& layer);
     virtual void setPerFrameData(const sp<const DisplayDevice>& hw,
@@ -277,8 +269,6 @@
     virtual void onRemoved();
 
 
-    virtual wp<IBinder> getSurfaceTextureBinder() const;
-
     // Updates the transform hint in our SurfaceFlingerConsumer to match
     // the current orientation of the display device.
     virtual void updateTransformHint(const sp<const DisplayDevice>& hw) const;
@@ -336,9 +326,6 @@
 
 
 private:
-    // Creates an instance of ISurface for this Layer.
-    virtual sp<ISurface> createSurface();
-
     // Interface implementation for SurfaceFlingerConsumer::FrameAvailableListener
     virtual void onFrameAvailable();
 
@@ -394,7 +381,7 @@
 
     // protected by mLock
     mutable Mutex mLock;
-    // Set to true if an ISurface has been associated with this object.
+    // Set to true once we've returned this surface's handle
     mutable bool mHasSurface;
     const wp<Client> mClientRef;
 };
diff --git a/services/surfaceflinger/LayerDim.cpp b/services/surfaceflinger/LayerDim.cpp
index 23decff..36bafdb 100644
--- a/services/surfaceflinger/LayerDim.cpp
+++ b/services/surfaceflinger/LayerDim.cpp
@@ -33,8 +33,9 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-LayerDim::LayerDim(SurfaceFlinger* flinger, const sp<Client>& client)
-    : Layer(flinger, client) {
+LayerDim::LayerDim(SurfaceFlinger* flinger, const sp<Client>& client,
+        const String8& name, uint32_t w, uint32_t h, uint32_t flags)
+    : Layer(flinger, client, name, w, h, flags) {
 }
 
 LayerDim::~LayerDim() {
@@ -69,19 +70,6 @@
     }
 }
 
-sp<ISurface> LayerDim::createSurface()
-{
-    class BSurface : public BnSurface, public LayerCleaner {
-        virtual sp<IGraphicBufferProducer> getSurfaceTexture() const { return 0; }
-    public:
-        BSurface(const sp<SurfaceFlinger>& flinger,
-                const sp<Layer>& layer)
-            : LayerCleaner(flinger, layer) { }
-    };
-    sp<ISurface> sur(new BSurface(mFlinger, this));
-    return sur;
-}
-
 bool LayerDim::isVisible() const {
     const Layer::State& s(drawingState());
     return !(s.flags & layer_state_t::eLayerHidden) && s.alpha;
diff --git a/services/surfaceflinger/LayerDim.h b/services/surfaceflinger/LayerDim.h
index e1ea9bd..e19bf52 100644
--- a/services/surfaceflinger/LayerDim.h
+++ b/services/surfaceflinger/LayerDim.h
@@ -32,7 +32,8 @@
 class LayerDim : public Layer
 {
 public:    
-                LayerDim(SurfaceFlinger* flinger, const sp<Client>& client);
+                LayerDim(SurfaceFlinger* flinger, const sp<Client>& client,
+                        const String8& name, uint32_t w, uint32_t h, uint32_t flags);
         virtual ~LayerDim();
 
     virtual void onDraw(const sp<const DisplayDevice>& hw, const Region& clip) const;
@@ -44,7 +45,6 @@
 
     virtual bool isFixedSize() const      { return true; }
     virtual bool isVisible() const;
-    virtual sp<ISurface> createSurface();
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 184f47e..7fcbd2e 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -66,6 +66,7 @@
 
 #include "DisplayHardware/FramebufferSurface.h"
 #include "DisplayHardware/HWComposer.h"
+#include "DisplayHardware/VirtualDisplaySurface.h"
 
 
 #define EGL_VERSION_HW_ANDROID  0x3143
@@ -501,11 +502,9 @@
             createBuiltinDisplayLocked(type);
             wp<IBinder> token = mBuiltinDisplays[i];
 
-            sp<FramebufferSurface> fbs = new FramebufferSurface(*mHwc, i);
-            sp<Surface> stc = new Surface(
-                        static_cast< sp<IGraphicBufferProducer> >(fbs->getBufferQueue()));
             sp<DisplayDevice> hw = new DisplayDevice(this,
-                    type, isSecure, token, stc, fbs, mEGLConfig);
+                    type, isSecure, token, new FramebufferSurface(*mHwc, i),
+                    mEGLConfig);
             if (i > DisplayDevice::DISPLAY_PRIMARY) {
                 // FIXME: currently we don't get blank/unblank requests
                 // for displays other than the main display, so we always
@@ -574,40 +573,7 @@
         const sp<IGraphicBufferProducer>& bufferProducer) const {
     Mutex::Autolock _l(mStateLock);
     sp<IBinder> surfaceTextureBinder(bufferProducer->asBinder());
-
-    // We want to determine whether the IGraphicBufferProducer was created by
-    // SurfaceFlinger.  Check to see if we can find it in the layer list.
-    const LayerVector& currentLayers = mCurrentState.layersSortedByZ;
-    size_t count = currentLayers.size();
-    for (size_t i=0 ; i<count ; i++) {
-        const sp<Layer>& layer(currentLayers[i]);
-        // If this is an instance of Layer (as opposed to, say, LayerDim),
-        // we will get the consumer interface of SurfaceFlingerConsumer's
-        // BufferQueue.  If it's the same Binder object as the graphic
-        // buffer producer interface, return success.
-        wp<IBinder> lbcBinder = layer->getSurfaceTextureBinder();
-        if (lbcBinder == surfaceTextureBinder) {
-            return true;
-        }
-    }
-
-    // Check the layers in the purgatory.  This check is here so that if a
-    // GLConsumer gets destroyed before all the clients are done using it,
-    // the error will not be reported as "surface XYZ is not authenticated", but
-    // will instead fail later on when the client tries to use the surface,
-    // which should be reported as "surface XYZ returned an -ENODEV".  The
-    // purgatorized layers are no less authentic than the visible ones, so this
-    // should not cause any harm.
-    size_t purgatorySize =  mLayerPurgatory.size();
-    for (size_t i=0 ; i<purgatorySize ; i++) {
-        const sp<Layer>& layer(mLayerPurgatory.itemAt(i));
-        wp<IBinder> lbcBinder = layer->getSurfaceTextureBinder();
-        if (lbcBinder == surfaceTextureBinder) {
-            return true;
-        }
-    }
-
-    return false;
+    return mGraphicBufferProducerList.indexOf(surfaceTextureBinder) >= 0;
 }
 
 status_t SurfaceFlinger::getDisplayInfo(const sp<IBinder>& display, DisplayInfo* info) {
@@ -1132,7 +1098,8 @@
                         DisplayDevice::makeCurrent(mEGLDisplay, hw, mEGLContext);
                         mDisplays.removeItem(draw.keyAt(i));
                         getHwComposer().disconnectDisplay(draw[i].type);
-                        mEventThread->onHotplugReceived(draw[i].type, false);
+                        if (draw[i].type < DisplayDevice::NUM_DISPLAY_TYPES)
+                            mEventThread->onHotplugReceived(draw[i].type, false);
                     } else {
                         ALOGW("trying to remove the main display");
                     }
@@ -1174,10 +1141,14 @@
                 if (draw.indexOfKey(curr.keyAt(i)) < 0) {
                     const DisplayDeviceState& state(curr[i]);
 
-                    sp<FramebufferSurface> fbs;
-                    sp<Surface> stc;
-                    if (!state.isVirtualDisplay()) {
-
+                    sp<DisplaySurface> dispSurface;
+                    if (state.isVirtualDisplay()) {
+                        if (state.surface != NULL) {
+                            dispSurface = new VirtualDisplaySurface(
+                                    *mHwc, state.type, state.surface,
+                                    state.displayName);
+                        }
+                    } else {
                         ALOGE_IF(state.surface!=NULL,
                                 "adding a supported display, but rendering "
                                 "surface is provided (%p), ignoring it",
@@ -1185,27 +1156,21 @@
 
                         // for supported (by hwc) displays we provide our
                         // own rendering surface
-                        fbs = new FramebufferSurface(*mHwc, state.type);
-                        stc = new Surface(
-                                static_cast< sp<IGraphicBufferProducer> >(
-                                        fbs->getBufferQueue()));
-                    } else {
-                        if (state.surface != NULL) {
-                            stc = new Surface(state.surface);
-                        }
+                        dispSurface = new FramebufferSurface(*mHwc, state.type);
                     }
 
                     const wp<IBinder>& display(curr.keyAt(i));
-                    if (stc != NULL) {
+                    if (dispSurface != NULL) {
                         sp<DisplayDevice> hw = new DisplayDevice(this,
-                                state.type, state.isSecure, display, stc, fbs,
-                                mEGLConfig);
+                                state.type, state.isSecure, display,
+                                dispSurface, mEGLConfig);
                         hw->setLayerStack(state.layerStack);
                         hw->setProjection(state.orientation,
                                 state.viewport, state.frame);
                         hw->setDisplayName(state.displayName);
                         mDisplays.add(display, hw);
-                        mEventThread->onHotplugReceived(state.type, true);
+                        if (state.type < DisplayDevice::NUM_DISPLAY_TYPES)
+                            mEventThread->onHotplugReceived(state.type, true);
                     }
                 }
             }
@@ -1677,6 +1642,7 @@
 
 void SurfaceFlinger::addClientLayer(const sp<Client>& client,
         const sp<IBinder>& handle,
+        const sp<IGraphicBufferProducer>& gbc,
         const sp<Layer>& lbc)
 {
     // attach this layer to the client
@@ -1685,45 +1651,22 @@
     // add this layer to the current state list
     Mutex::Autolock _l(mStateLock);
     mCurrentState.layersSortedByZ.add(lbc);
+    mGraphicBufferProducerList.add(gbc->asBinder());
 }
 
 status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer)
 {
     Mutex::Autolock _l(mStateLock);
-    status_t err = purgatorizeLayer_l(layer);
-    if (err == NO_ERROR)
-        setTransactionFlags(eTransactionNeeded);
-    return err;
-}
-
-status_t SurfaceFlinger::removeLayer_l(const sp<Layer>& layer)
-{
     ssize_t index = mCurrentState.layersSortedByZ.remove(layer);
     if (index >= 0) {
+        mLayersPendingRemoval.push(layer);
         mLayersRemoved = true;
+        setTransactionFlags(eTransactionNeeded);
         return NO_ERROR;
     }
     return status_t(index);
 }
 
-status_t SurfaceFlinger::purgatorizeLayer_l(const sp<Layer>& layer)
-{
-    // First add the layer to the purgatory list, which makes sure it won't
-    // go away, then remove it from the main list (through a transaction).
-    ssize_t err = removeLayer_l(layer);
-    if (err >= 0) {
-        mLayerPurgatory.add(layer);
-    }
-
-    mLayersPendingRemoval.push(layer);
-
-    // it's possible that we don't find a layer, because it might
-    // have been destroyed already -- this is not technically an error
-    // from the user because there is a race between Client::destroySurface(),
-    // ~Client() and ~ISurface().
-    return (err == NAME_NOT_FOUND) ? status_t(NO_ERROR) : err;
-}
-
 uint32_t SurfaceFlinger::peekTransactionFlags(uint32_t flags)
 {
     return android_atomic_release_load(&mTransactionFlags);
@@ -1924,48 +1867,49 @@
     return flags;
 }
 
-sp<ISurface> SurfaceFlinger::createLayer(
+status_t SurfaceFlinger::createLayer(
         const String8& name,
         const sp<Client>& client,
-        uint32_t w, uint32_t h, PixelFormat format,
-        uint32_t flags)
+        uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
+        sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp)
 {
-    sp<Layer> layer;
-    sp<ISurface> surfaceHandle;
-
+    //ALOGD("createLayer for (%d x %d), name=%s", w, h, name.string());
     if (int32_t(w|h) < 0) {
         ALOGE("createLayer() failed, w or h is negative (w=%d, h=%d)",
                 int(w), int(h));
-        return surfaceHandle;
+        return BAD_VALUE;
     }
 
-    //ALOGD("createLayer for (%d x %d), name=%s", w, h, name.string());
+    status_t result = NO_ERROR;
+
+    sp<Layer> layer;
+
     switch (flags & ISurfaceComposerClient::eFXSurfaceMask) {
         case ISurfaceComposerClient::eFXSurfaceNormal:
-            layer = createNormalLayer(client, w, h, flags, format);
+            result = createNormalLayer(client,
+                    name, w, h, flags, format,
+                    handle, gbp, &layer);
             break;
         case ISurfaceComposerClient::eFXSurfaceDim:
-            layer = createDimLayer(client, w, h, flags);
+            result = createDimLayer(client,
+                    name, w, h, flags,
+                    handle, gbp, &layer);
+            break;
+        default:
+            result = BAD_VALUE;
             break;
     }
 
-    if (layer != 0) {
-        layer->initStates(w, h, flags);
-        layer->setName(name);
-        surfaceHandle = layer->getSurface();
-        if (surfaceHandle != 0) {
-            addClientLayer(client, surfaceHandle->asBinder(), layer);
-        }
+    if (result == NO_ERROR) {
+        addClientLayer(client, *handle, *gbp, layer);
         setTransactionFlags(eTransactionNeeded);
     }
-
-    return surfaceHandle;
+    return result;
 }
 
-sp<Layer> SurfaceFlinger::createNormalLayer(
-        const sp<Client>& client,
-        uint32_t w, uint32_t h, uint32_t flags,
-        PixelFormat& format)
+status_t SurfaceFlinger::createNormalLayer(const sp<Client>& client,
+        const String8& name, uint32_t w, uint32_t h, uint32_t flags, PixelFormat& format,
+        sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp, sp<Layer>* outLayer)
 {
     // initialize the surfaces
     switch (format) {
@@ -1987,63 +1931,48 @@
         format = PIXEL_FORMAT_RGBA_8888;
 #endif
 
-    sp<Layer> layer = new Layer(this, client);
-    status_t err = layer->setBuffers(w, h, format, flags);
-    if (CC_LIKELY(err != NO_ERROR)) {
-        ALOGE("createNormalLayer() failed (%s)", strerror(-err));
-        layer.clear();
+    *outLayer = new Layer(this, client, name, w, h, flags);
+    status_t err = (*outLayer)->setBuffers(w, h, format, flags);
+    if (err == NO_ERROR) {
+        *handle = (*outLayer)->getHandle();
+        *gbp = (*outLayer)->getBufferQueue();
     }
-    return layer;
+
+    ALOGE_IF(err, "createNormalLayer() failed (%s)", strerror(-err));
+    return err;
 }
 
-sp<LayerDim> SurfaceFlinger::createDimLayer(
-        const sp<Client>& client,
-        uint32_t w, uint32_t h, uint32_t flags)
+status_t SurfaceFlinger::createDimLayer(const sp<Client>& client,
+        const String8& name, uint32_t w, uint32_t h, uint32_t flags,
+        sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp, sp<Layer>* outLayer)
 {
-    sp<LayerDim> layer = new LayerDim(this, client);
-    return layer;
+    *outLayer = new LayerDim(this, client, name, w, h, flags);
+    *handle = (*outLayer)->getHandle();
+    *gbp = (*outLayer)->getBufferQueue();
+    return NO_ERROR;
 }
 
 status_t SurfaceFlinger::onLayerRemoved(const sp<Client>& client, const sp<IBinder>& handle)
 {
-    /*
-     * called by the window manager, when a surface should be marked for
-     * destruction.
-     *
-     * The surface is removed from the current and drawing lists, but placed
-     * in the purgatory queue, so it's not destroyed right-away (we need
-     * to wait for all client's references to go away first).
-     */
-
-    status_t err = NAME_NOT_FOUND;
-    Mutex::Autolock _l(mStateLock);
-    sp<Layer> layer = client->getLayerUser(handle);
-
-    if (layer != 0) {
-        err = purgatorizeLayer_l(layer);
-        if (err == NO_ERROR) {
-            setTransactionFlags(eTransactionNeeded);
-        }
+    // called by the window manager when it wants to remove a Layer
+    status_t err = NO_ERROR;
+    sp<Layer> l(client->getLayerUser(handle));
+    if (l != NULL) {
+        err = removeLayer(l);
+        ALOGE_IF(err<0 && err != NAME_NOT_FOUND,
+                "error removing layer=%p (%s)", l.get(), strerror(-err));
     }
     return err;
 }
 
 status_t SurfaceFlinger::onLayerDestroyed(const wp<Layer>& layer)
 {
-    // called by ~ISurface() when all references are gone
+    // called by ~LayerCleaner() when all references to the IBinder (handle)
+    // are gone
     status_t err = NO_ERROR;
     sp<Layer> l(layer.promote());
     if (l != NULL) {
-        Mutex::Autolock _l(mStateLock);
-        err = removeLayer_l(l);
-        if (err == NAME_NOT_FOUND) {
-            // The surface wasn't in the current list, which means it was
-            // removed already, which means it is in the purgatory,
-            // and need to be removed from there.
-            ssize_t idx = mLayerPurgatory.remove(l);
-            ALOGE_IF(idx < 0,
-                    "layer=%p is not in the purgatory list", l.get());
-        }
+        err = removeLayer(l);
         ALOGE_IF(err<0 && err != NAME_NOT_FOUND,
                 "error removing layer=%p (%s)", l.get(), strerror(-err));
     }
@@ -2355,18 +2284,6 @@
     }
 
     /*
-     * Dump the layers in the purgatory
-     */
-
-    const size_t purgatorySize = mLayerPurgatory.size();
-    snprintf(buffer, SIZE, "Purgatory state (%d entries)\n", purgatorySize);
-    result.append(buffer);
-    for (size_t i=0 ; i<purgatorySize ; i++) {
-        const sp<Layer>& layer(mLayerPurgatory.itemAt(i));
-        layer->shortDump(result, buffer, SIZE);
-    }
-
-    /*
      * Dump Display state
      */
 
@@ -2480,6 +2397,7 @@
 {
     switch (code) {
         case CREATE_CONNECTION:
+        case CREATE_DISPLAY:
         case SET_TRANSACTION_STATE:
         case BOOT_FINISHED:
         case BLANK:
@@ -2498,6 +2416,7 @@
             break;
         }
         case CAPTURE_SCREEN:
+        case CAPTURE_SCREEN_DEPRECATED:
         {
             // codes that require permission check
             IPCThreadState* ipc = IPCThreadState::self();
@@ -2715,9 +2634,11 @@
         const Layer::State& state(layer->drawingState());
         if (state.layerStack == hw->getLayerStack()) {
             if (state.z >= minLayerZ && state.z <= maxLayerZ) {
-                if (filtering) layer->setFiltering(true);
-                layer->draw(hw);
-                if (filtering) layer->setFiltering(false);
+                if (layer->isVisible()) {
+                    if (filtering) layer->setFiltering(true);
+                    layer->draw(hw);
+                    if (filtering) layer->setFiltering(false);
+                }
             }
         }
     }
@@ -2783,7 +2704,7 @@
             sp<GraphicBuffer> buf(consumer->getCurrentBuffer());
             sw = buf->getWidth();
             sh = buf->getHeight();
-            size_t size = buf->getStride() * sh * 4;
+            size_t size = sw * sh * 4;
 
             // allocate shared memory large enough to hold the
             // screen capture
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index 241a7d6..e6734d2 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -128,6 +128,7 @@
     friend class Client;
     friend class DisplayEventConnection;
     friend class Layer;
+    friend class SurfaceTextureLayer;
 
     // We're reference counted, never destroy SurfaceFlinger directly
     virtual ~SurfaceFlinger();
@@ -257,19 +258,21 @@
     /* ------------------------------------------------------------------------
      * Layer management
      */
-    sp<ISurface> createLayer(const String8& name, const sp<Client>& client,
-            uint32_t w, uint32_t h, PixelFormat format, uint32_t flags);
+    status_t createLayer(const String8& name, const sp<Client>& client,
+            uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
+            sp<IBinder>* handle, sp<IGraphicBufferProducer>* gbp);
 
-    sp<Layer> createNormalLayer(const sp<Client>& client,
-            uint32_t w, uint32_t h, uint32_t flags, PixelFormat& format);
+    status_t createNormalLayer(const sp<Client>& client, const String8& name,
+            uint32_t w, uint32_t h, uint32_t flags, PixelFormat& format,
+            sp<IBinder>* outHandle, sp<IGraphicBufferProducer>* outGbp,
+            sp<Layer>* outLayer);
 
-    sp<LayerDim> createDimLayer(const sp<Client>& client,
-            uint32_t w, uint32_t h, uint32_t flags);
+    status_t createDimLayer(const sp<Client>& client, const String8& name,
+            uint32_t w, uint32_t h, uint32_t flags, sp<IBinder>* outHandle,
+            sp<IGraphicBufferProducer>* outGbp, sp<Layer>* outLayer);
 
     // called in response to the window-manager calling
     // ISurfaceComposerClient::destroySurface()
-    // The specified layer is first placed in a purgatory list
-    // until all references from the client are released.
     status_t onLayerRemoved(const sp<Client>& client, const sp<IBinder>& handle);
 
     // called when all clients have released all their references to
@@ -281,11 +284,10 @@
     status_t removeLayer(const sp<Layer>& layer);
 
     // add a layer to SurfaceFlinger
-    void addClientLayer(const sp<Client>& client, const sp<IBinder>& handle,
-        const sp<Layer>& lbc);
-
-    status_t removeLayer_l(const sp<Layer>& layer);
-    status_t purgatorizeLayer_l(const sp<Layer>& layer);
+    void addClientLayer(const sp<Client>& client,
+            const sp<IBinder>& handle,
+            const sp<IGraphicBufferProducer>& gbc,
+            const sp<Layer>& lbc);
 
     /* ------------------------------------------------------------------------
      * Boot animation, on/off animations and screen capture
@@ -399,10 +401,10 @@
     State mCurrentState;
     volatile int32_t mTransactionFlags;
     Condition mTransactionCV;
-    SortedVector< sp<Layer> > mLayerPurgatory;
     bool mTransactionPending;
     bool mAnimTransactionPending;
     Vector< sp<Layer> > mLayersPendingRemoval;
+    SortedVector< wp<IBinder> > mGraphicBufferProducerList;
 
     // protected by mStateLock (but we could use another lock)
     bool mLayersRemoved;
diff --git a/services/surfaceflinger/SurfaceTextureLayer.cpp b/services/surfaceflinger/SurfaceTextureLayer.cpp
index 395c8c8..d0f0dae 100644
--- a/services/surfaceflinger/SurfaceTextureLayer.cpp
+++ b/services/surfaceflinger/SurfaceTextureLayer.cpp
@@ -20,17 +20,35 @@
 
 #include <utils/Errors.h>
 
+#include "SurfaceFlinger.h"
 #include "SurfaceTextureLayer.h"
 
 namespace android {
 // ---------------------------------------------------------------------------
 
 
-SurfaceTextureLayer::SurfaceTextureLayer()
-    : BufferQueue(true) {
+SurfaceTextureLayer::SurfaceTextureLayer(const sp<SurfaceFlinger>& flinger)
+    : BufferQueue(true), flinger(flinger) {
 }
 
 SurfaceTextureLayer::~SurfaceTextureLayer() {
+    // remove ourselves from SurfaceFlinger's list. We do this asynchronously
+    // because we don't know where this dtor is called from, it could be
+    // called with the mStateLock held, leading to a dead-lock (it actually
+    // happens).
+    class MessageCleanUpList : public MessageBase {
+        sp<SurfaceFlinger> flinger;
+        wp<IBinder> gbp;
+    public:
+        MessageCleanUpList(const sp<SurfaceFlinger>& flinger, const wp<IBinder>& gbp)
+            : flinger(flinger), gbp(gbp) { }
+        virtual bool handler() {
+            Mutex::Autolock _l(flinger->mStateLock);
+            flinger->mGraphicBufferProducerList.remove(gbp);
+            return true;
+        }
+    };
+    flinger->postMessageAsync( new MessageCleanUpList(flinger, this) );
 }
 
 status_t SurfaceTextureLayer::connect(int api, QueueBufferOutput* output) {
diff --git a/services/surfaceflinger/SurfaceTextureLayer.h b/services/surfaceflinger/SurfaceTextureLayer.h
index a75ccf4..13cff2f 100644
--- a/services/surfaceflinger/SurfaceTextureLayer.h
+++ b/services/surfaceflinger/SurfaceTextureLayer.h
@@ -28,15 +28,16 @@
 // ---------------------------------------------------------------------------
 
 class Layer;
+class SurfaceFlinger;
 
 /*
  * This is a thin wrapper around BufferQueue, used by the Layer class.
  */
-class SurfaceTextureLayer : public BufferQueue
-{
+class SurfaceTextureLayer : public BufferQueue {
+    sp<SurfaceFlinger> flinger;
 public:
-    SurfaceTextureLayer();
-    ~SurfaceTextureLayer();
+    SurfaceTextureLayer(const sp<SurfaceFlinger>& flinger);
+    virtual ~SurfaceTextureLayer();
 
     // After calling the superclass connect(), set or clear synchronous
     // mode appropriately for the specified API.
diff --git a/services/surfaceflinger/tests/surface/Android.mk b/services/surfaceflinger/tests/surface/Android.mk
deleted file mode 100644
index c59060e..0000000
--- a/services/surfaceflinger/tests/surface/Android.mk
+++ /dev/null
@@ -1,18 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES:= \
-	surface.cpp
-
-LOCAL_SHARED_LIBRARIES := \
-	libcutils \
-	libutils \
-	libbinder \
-    libui \
-    libgui
-
-LOCAL_MODULE:= test-surface
-
-LOCAL_MODULE_TAGS := tests
-
-include $(BUILD_EXECUTABLE)
diff --git a/services/surfaceflinger/tests/surface/surface.cpp b/services/surfaceflinger/tests/surface/surface.cpp
deleted file mode 100644
index 9c41cc3..0000000
--- a/services/surfaceflinger/tests/surface/surface.cpp
+++ /dev/null
@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <cutils/memory.h>
-
-#include <utils/Log.h>
-
-#include <binder/IPCThreadState.h>
-#include <binder/ProcessState.h>
-#include <binder/IServiceManager.h>
-
-#include <gui/Surface.h>
-#include <gui/SurfaceComposerClient.h>
-
-using namespace android;
-
-int main(int argc, char** argv)
-{
-    // set up the thread-pool
-    sp<ProcessState> proc(ProcessState::self());
-    ProcessState::self()->startThreadPool();
-
-    // create a client to surfaceflinger
-    sp<SurfaceComposerClient> client = new SurfaceComposerClient();
-    
-    sp<SurfaceControl> surfaceControl = client->createSurface(
-            String8("surface"), 160, 240, PIXEL_FORMAT_RGB_565, 0);
-    SurfaceComposerClient::openGlobalTransaction();
-    surfaceControl->setLayer(100000);
-    SurfaceComposerClient::closeGlobalTransaction();
-
-    // pretend it went cross-process
-    Parcel parcel;
-    SurfaceControl::writeSurfaceToParcel(surfaceControl, &parcel);
-    parcel.setDataPosition(0);
-    sp<Surface> surface = Surface::readFromParcel(parcel);
-    ANativeWindow* window = surface.get();
-
-    printf("window=%p\n", window);
-
-    int err = native_window_set_buffer_count(window, 8);
-    ANativeWindowBuffer* buffer;
-
-    for (int i=0 ; i<8 ; i++) {
-        window->dequeueBuffer(window, &buffer);
-        printf("buffer %d: %p\n", i, buffer);
-    }
-
-    printf("test complete. CTRL+C to finish.\n");
-
-    IPCThreadState::self()->joinThreadPool();
-    return 0;
-}