Merge "update enum for renamed api"
diff --git a/cmds/dumpstate/dumpstate.cpp b/cmds/dumpstate/dumpstate.cpp
index 0cf2df0..738c20f 100644
--- a/cmds/dumpstate/dumpstate.cpp
+++ b/cmds/dumpstate/dumpstate.cpp
@@ -131,6 +131,19 @@
 // TODO: temporary variables and functions used during C++ refactoring
 static Dumpstate& ds = Dumpstate::GetInstance();
 
+#define RETURN_IF_USER_DENIED_CONSENT()                                                        \
+    if (ds.IsUserConsentDenied()) {                                                            \
+        MYLOGE("Returning early as user denied consent to share bugreport with calling app."); \
+        return Dumpstate::RunStatus::USER_CONSENT_DENIED;                                      \
+    }
+
+// Runs func_ptr, but checks user consent before and after running it. Returns USER_CONSENT_DENIED
+// if consent is found to be denied.
+#define RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(func_ptr, ...) \
+    RETURN_IF_USER_DENIED_CONSENT();                        \
+    func_ptr(__VA_ARGS__);                                  \
+    RETURN_IF_USER_DENIED_CONSENT();
+
 namespace android {
 namespace os {
 namespace {
@@ -1054,9 +1067,9 @@
     RunCommand("IP RULES v6", {"ip", "-6", "rule", "show"});
 }
 
-static void RunDumpsysTextByPriority(const std::string& title, int priority,
-                                     std::chrono::milliseconds timeout,
-                                     std::chrono::milliseconds service_timeout) {
+static Dumpstate::RunStatus RunDumpsysTextByPriority(const std::string& title, int priority,
+                                                     std::chrono::milliseconds timeout,
+                                                     std::chrono::milliseconds service_timeout) {
     auto start = std::chrono::steady_clock::now();
     sp<android::IServiceManager> sm = defaultServiceManager();
     Dumpsys dumpsys(sm.get());
@@ -1064,6 +1077,7 @@
     Dumpsys::setServiceArgs(args, /* asProto = */ false, priority);
     Vector<String16> services = dumpsys.listServices(priority, /* supports_proto = */ false);
     for (const String16& service : services) {
+        RETURN_IF_USER_DENIED_CONSENT();
         std::string path(title);
         path.append(" - ").append(String8(service).c_str());
         DumpstateSectionReporter section_reporter(path, ds.listener_, ds.report_section_);
@@ -1089,6 +1103,7 @@
             break;
         }
     }
+    return Dumpstate::RunStatus::OK;
 }
 
 static void RunDumpsysText(const std::string& title, int priority,
@@ -1101,24 +1116,27 @@
 }
 
 /* Dump all services registered with Normal or Default priority. */
-static void RunDumpsysTextNormalPriority(const std::string& title,
-                                         std::chrono::milliseconds timeout,
-                                         std::chrono::milliseconds service_timeout) {
+static Dumpstate::RunStatus RunDumpsysTextNormalPriority(const std::string& title,
+                                                         std::chrono::milliseconds timeout,
+                                                         std::chrono::milliseconds service_timeout) {
     DurationReporter duration_reporter(title);
     dprintf(STDOUT_FILENO, "------ %s (/system/bin/dumpsys) ------\n", title.c_str());
     fsync(STDOUT_FILENO);
     RunDumpsysTextByPriority(title, IServiceManager::DUMP_FLAG_PRIORITY_NORMAL, timeout,
                              service_timeout);
-    RunDumpsysTextByPriority(title, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT, timeout,
-                             service_timeout);
+
+    RETURN_IF_USER_DENIED_CONSENT();
+
+    return RunDumpsysTextByPriority(title, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT, timeout,
+                                    service_timeout);
 }
 
-static void RunDumpsysProto(const std::string& title, int priority,
-                            std::chrono::milliseconds timeout,
-                            std::chrono::milliseconds service_timeout) {
+static Dumpstate::RunStatus RunDumpsysProto(const std::string& title, int priority,
+                                            std::chrono::milliseconds timeout,
+                                            std::chrono::milliseconds service_timeout) {
     if (!ds.IsZipping()) {
         MYLOGD("Not dumping %s because it's not a zipped bugreport\n", title.c_str());
-        return;
+        return Dumpstate::RunStatus::OK;
     }
     sp<android::IServiceManager> sm = defaultServiceManager();
     Dumpsys dumpsys(sm.get());
@@ -1129,6 +1147,7 @@
     auto start = std::chrono::steady_clock::now();
     Vector<String16> services = dumpsys.listServices(priority, /* supports_proto = */ true);
     for (const String16& service : services) {
+        RETURN_IF_USER_DENIED_CONSENT();
         std::string path(kProtoPath);
         path.append(String8(service).c_str());
         if (priority == IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL) {
@@ -1157,32 +1176,42 @@
             break;
         }
     }
+    return Dumpstate::RunStatus::OK;
 }
 
 // Runs dumpsys on services that must dump first and will take less than 100ms to dump.
-static void RunDumpsysCritical() {
+static Dumpstate::RunStatus RunDumpsysCritical() {
     RunDumpsysText("DUMPSYS CRITICAL", IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL,
                    /* timeout= */ 5s, /* service_timeout= */ 500ms);
-    RunDumpsysProto("DUMPSYS CRITICAL PROTO", IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL,
-                    /* timeout= */ 5s, /* service_timeout= */ 500ms);
+
+    RETURN_IF_USER_DENIED_CONSENT();
+
+    return RunDumpsysProto("DUMPSYS CRITICAL PROTO", IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL,
+                           /* timeout= */ 5s, /* service_timeout= */ 500ms);
 }
 
 // Runs dumpsys on services that must dump first but can take up to 250ms to dump.
-static void RunDumpsysHigh() {
+static Dumpstate::RunStatus RunDumpsysHigh() {
     // TODO meminfo takes ~10s, connectivity takes ~5sec to dump. They are both
     // high priority. Reduce timeout once they are able to dump in a shorter time or
     // moved to a parallel task.
     RunDumpsysText("DUMPSYS HIGH", IServiceManager::DUMP_FLAG_PRIORITY_HIGH,
                    /* timeout= */ 90s, /* service_timeout= */ 30s);
-    RunDumpsysProto("DUMPSYS HIGH PROTO", IServiceManager::DUMP_FLAG_PRIORITY_HIGH,
-                    /* timeout= */ 5s, /* service_timeout= */ 1s);
+
+    RETURN_IF_USER_DENIED_CONSENT();
+
+    return RunDumpsysProto("DUMPSYS HIGH PROTO", IServiceManager::DUMP_FLAG_PRIORITY_HIGH,
+                           /* timeout= */ 5s, /* service_timeout= */ 1s);
 }
 
 // Runs dumpsys on services that must dump but can take up to 10s to dump.
-static void RunDumpsysNormal() {
+static Dumpstate::RunStatus RunDumpsysNormal() {
     RunDumpsysTextNormalPriority("DUMPSYS", /* timeout= */ 90s, /* service_timeout= */ 10s);
-    RunDumpsysProto("DUMPSYS PROTO", IServiceManager::DUMP_FLAG_PRIORITY_NORMAL,
-                    /* timeout= */ 90s, /* service_timeout= */ 10s);
+
+    RETURN_IF_USER_DENIED_CONSENT();
+
+    return RunDumpsysProto("DUMPSYS PROTO", IServiceManager::DUMP_FLAG_PRIORITY_NORMAL,
+                           /* timeout= */ 90s, /* service_timeout= */ 10s);
 }
 
 static void DumpHals() {
@@ -1244,9 +1273,16 @@
     }
 }
 
-static void dumpstate() {
+// Dumps various things. Returns early with status USER_CONSENT_DENIED if user denies consent
+// via the consent they are shown. Ignores other errors that occur while running various
+// commands. The consent checking is currently done around long running tasks, which happen to
+// be distributed fairly evenly throughout the function.
+static Dumpstate::RunStatus dumpstate() {
     DurationReporter duration_reporter("DUMPSTATE");
 
+    // Dump various things. Note that anything that takes "long" (i.e. several seconds) should
+    // check intermittently (if it's intrerruptable like a foreach on pids) and/or should be wrapped
+    // in a consent check (via RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK).
     dump_dev_files("TRUSTY VERSION", "/sys/bus/platform/drivers/trusty", "trusty_version");
     RunCommand("UPTIME", {"uptime"});
     DumpBlockStatFiles();
@@ -1254,7 +1290,9 @@
     DumpFile("MEMORY INFO", "/proc/meminfo");
     RunCommand("CPU INFO", {"top", "-b", "-n", "1", "-H", "-s", "6", "-o",
                             "pid,tid,user,pr,ni,%cpu,s,virt,res,pcy,cmd,name"});
-    RunCommand("PROCRANK", {"procrank"}, AS_ROOT_20);
+
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunCommand, "PROCRANK", {"procrank"}, AS_ROOT_20);
+
     DumpFile("VIRTUAL MEMORY STATS", "/proc/vmstat");
     DumpFile("VMALLOC INFO", "/proc/vmallocinfo");
     DumpFile("SLAB INFO", "/proc/slabinfo");
@@ -1269,7 +1307,9 @@
 
     RunCommand("PROCESSES AND THREADS",
                {"ps", "-A", "-T", "-Z", "-O", "pri,nice,rtprio,sched,pcy,time"});
-    RunCommand("LIBRANK", {"librank"}, CommandOptions::AS_ROOT);
+
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunCommand, "LIBRANK", {"librank"},
+                                         CommandOptions::AS_ROOT);
 
     DumpHals();
 
@@ -1290,7 +1330,9 @@
     }
 
     RunCommand("LIST OF OPEN FILES", {"lsof"}, CommandOptions::AS_ROOT);
-    for_each_pid(do_showmap, "SMAPS OF ALL PROCESSES");
+
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(for_each_pid, do_showmap, "SMAPS OF ALL PROCESSES");
+
     for_each_tid(show_wchan, "BLOCKED PROCESS WAIT-CHANNELS");
     for_each_pid(show_showtime, "PROCESS TIMES (pid cmd user system iowait+percentage)");
 
@@ -1328,7 +1370,7 @@
     RunCommand("IPv6 ND CACHE", {"ip", "-6", "neigh", "show"});
     RunCommand("MULTICAST ADDRESSES", {"ip", "maddr"});
 
-    RunDumpsysHigh();
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunDumpsysHigh);
 
     RunCommand("SYSTEM PROPERTIES", {"getprop"});
 
@@ -1351,7 +1393,7 @@
         ds.AddDir(WMTRACE_DATA_DIR, false);
     }
 
-    ds.DumpstateBoard();
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(ds.DumpstateBoard);
 
     /* Migrate the ril_dumpstate to a device specific dumpstate? */
     int rilDumpstateTimeout = android::base::GetIntProperty("ril.dumpstate.timeout", 0);
@@ -1371,14 +1413,16 @@
     printf("== Android Framework Services\n");
     printf("========================================================\n");
 
-    RunDumpsysNormal();
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunDumpsysNormal);
 
     printf("========================================================\n");
     printf("== Checkins\n");
     printf("========================================================\n");
 
     RunDumpsys("CHECKIN BATTERYSTATS", {"batterystats", "-c"});
-    RunDumpsys("CHECKIN MEMINFO", {"meminfo", "--checkin"});
+
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunDumpsys, "CHECKIN MEMINFO", {"meminfo", "--checkin"});
+
     RunDumpsys("CHECKIN NETSTATS", {"netstats", "--checkin"});
     RunDumpsys("CHECKIN PROCSTATS", {"procstats", "-c"});
     RunDumpsys("CHECKIN USAGESTATS", {"usagestats", "-c"});
@@ -1442,19 +1486,27 @@
     printf("========================================================\n");
     // This differs from the usual dumpsys stats, which is the stats report data.
     RunDumpsys("STATSDSTATS", {"stats", "--metadata"});
+    return Dumpstate::RunStatus::OK;
 }
 
-/* Dumps state for the default case. Returns true if everything went fine. */
-static bool DumpstateDefault() {
+/*
+ * Dumps state for the default case; drops root after it's no longer necessary.
+ *
+ * Returns RunStatus::OK if everything went fine.
+ * Returns RunStatus::ERROR if there was an error.
+ * Returns RunStatus::USER_DENIED_CONSENT if user explicitly denied consent to sharing the bugreport
+ * with the caller.
+ */
+static Dumpstate::RunStatus DumpstateDefault() {
     // Try to dump anrd trace if the daemon is running.
     dump_anrd_trace();
 
-    // Invoking the following dumpsys calls before dump_traces() to try and
+    // Invoking the following dumpsys calls before DumpTraces() to try and
     // keep the system stats as close to its initial state as possible.
-    RunDumpsysCritical();
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunDumpsysCritical);
 
     /* collect stack traces from Dalvik and native processes (needs root) */
-    dump_traces_path = ds.DumpTraces();
+    RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(ds.DumpTraces, &dump_traces_path);
 
     /* Run some operations that require root. */
     ds.tombstone_data_ = GetDumpFds(TOMBSTONE_DIR, TOMBSTONE_FILE_PREFIX, !ds.IsZipping());
@@ -1490,11 +1542,11 @@
     }
 
     if (!DropRootUser()) {
-        return false;
+        return Dumpstate::RunStatus::ERROR;
     }
 
-    dumpstate();
-    return true;
+    RETURN_IF_USER_DENIED_CONSENT();
+    return dumpstate();
 }
 
 // This method collects common dumpsys for telephony and wifi
@@ -1584,7 +1636,7 @@
     printf("========================================================\n");
 }
 
-const char* Dumpstate::DumpTraces() {
+Dumpstate::RunStatus Dumpstate::DumpTraces(const char** path) {
     DurationReporter duration_reporter("DUMP TRACES");
 
     const std::string temp_file_pattern = "/data/anr/dumptrace_XXXXXX";
@@ -1600,7 +1652,7 @@
     android::base::unique_fd fd(mkostemp(file_name_buf.get(), O_APPEND | O_CLOEXEC));
     if (fd < 0) {
         MYLOGE("mkostemp on pattern %s: %s\n", file_name_buf.get(), strerror(errno));
-        return nullptr;
+        return RunStatus::OK;
     }
 
     // Nobody should have access to this temporary file except dumpstate, but we
@@ -1610,13 +1662,13 @@
     const int chmod_ret = fchmod(fd, 0666);
     if (chmod_ret < 0) {
         MYLOGE("fchmod on %s failed: %s\n", file_name_buf.get(), strerror(errno));
-        return nullptr;
+        return RunStatus::OK;
     }
 
     std::unique_ptr<DIR, decltype(&closedir)> proc(opendir("/proc"), closedir);
     if (proc.get() == nullptr) {
         MYLOGE("opendir /proc failed: %s\n", strerror(errno));
-        return nullptr;
+        return RunStatus::OK;
     }
 
     // Number of times process dumping has timed out. If we encounter too many
@@ -1628,6 +1680,7 @@
 
     struct dirent* d;
     while ((d = readdir(proc.get()))) {
+        RETURN_IF_USER_DENIED_CONSENT();
         int pid = atoi(d->d_name);
         if (pid <= 0) {
             continue;
@@ -1689,7 +1742,8 @@
         MYLOGE("Warning: no Dalvik processes found to dump stacks\n");
     }
 
-    return file_name_buf.release();
+    *path = file_name_buf.release();
+    return RunStatus::OK;
 }
 
 void Dumpstate::DumpstateBoard() {
@@ -1730,6 +1784,7 @@
         return;
     }
 
+    // TODO(128270426): Check for consent in between?
     for (size_t i = 0; i < paths.size(); i++) {
         MYLOGI("Calling IDumpstateDevice implementation using path %s\n", paths[i].c_str());
 
@@ -2587,9 +2642,12 @@
         DumpstateWifiOnly();
     } else {
         // Dump state for the default case. This also drops root.
-        if (!DumpstateDefault()) {
-            // Something went wrong.
-            return RunStatus::ERROR;
+        RunStatus s = DumpstateDefault();
+        if (s != RunStatus::OK) {
+            if (s == RunStatus::USER_CONSENT_TIMED_OUT) {
+                HandleUserConsentDenied();
+            }
+            return s;
         }
     }
 
@@ -2626,9 +2684,7 @@
             MYLOGI(
                 "Did not receive user consent yet."
                 " Will not copy the bugreport artifacts to caller.\n");
-            // TODO(b/111441001):
-            // 1. cancel outstanding requests
-            // 2. check for result more frequently
+            // TODO(b/111441001): cancel outstanding requests
         }
     }
 
@@ -2683,6 +2739,11 @@
     }
 }
 
+bool Dumpstate::IsUserConsentDenied() const {
+    return ds.consent_callback_ != nullptr &&
+           ds.consent_callback_->getResult() == UserConsentResult::DENIED;
+}
+
 void Dumpstate::CleanupFiles() {
     android::os::UnlinkAndLogOnError(tmp_path_);
     android::os::UnlinkAndLogOnError(screenshot_path_);
diff --git a/cmds/dumpstate/dumpstate.h b/cmds/dumpstate/dumpstate.h
index 603af71..d02ec75 100644
--- a/cmds/dumpstate/dumpstate.h
+++ b/cmds/dumpstate/dumpstate.h
@@ -291,8 +291,11 @@
     // TODO: temporary method until Dumpstate object is properly set
     void SetProgress(std::unique_ptr<Progress> progress);
 
-    // Dumps Dalvik and native stack traces, return the trace file location (nullptr if none).
-    const char* DumpTraces();
+    // Dumps Dalvik and native stack traces, sets the trace file location to path
+    // if it succeeded.
+    // Note that it returns early if user consent is denied with status USER_CONSENT_DENIED.
+    // Returns OK in all other cases.
+    RunStatus DumpTraces(const char** path);
 
     void DumpstateBoard();
 
@@ -331,6 +334,13 @@
     void SetOptions(std::unique_ptr<DumpOptions> options);
 
     /*
+     * Returns true if user consent is necessary and has been denied.
+     * Consent is only necessary if the caller has asked to copy over the bugreport to a file they
+     * provided.
+     */
+    bool IsUserConsentDenied() const;
+
+    /*
      * Structure to hold options that determine the behavior of dumpstate.
      */
     struct DumpOptions {
diff --git a/cmds/dumpstate/utils.cpp b/cmds/dumpstate/utils.cpp
index 8b92988..0bb80dc 100644
--- a/cmds/dumpstate/utils.cpp
+++ b/cmds/dumpstate/utils.cpp
@@ -102,14 +102,16 @@
 
 DurationReporter::~DurationReporter() {
     if (!title_.empty()) {
-        uint64_t elapsed = Nanotime() - started_;
-        MYLOGD("Duration of '%s': %.3fs\n", title_.c_str(), (float)elapsed / NANOS_PER_SEC);
+        float elapsed = (float)(Nanotime() - started_) / NANOS_PER_SEC;
+        if (elapsed < .5f) {
+            return;
+        }
+        MYLOGD("Duration of '%s': %.2fs\n", title_.c_str(), elapsed);
         if (logcat_only_) {
             return;
         }
         // Use "Yoda grammar" to make it easier to grep|sort sections.
-        printf("------ %.3fs was the duration of '%s' ------\n", (float)elapsed / NANOS_PER_SEC,
-               title_.c_str());
+        printf("------ %.3fs was the duration of '%s' ------\n", elapsed, title_.c_str());
     }
 }
 
@@ -278,6 +280,12 @@
 
     if (header) printf("\n------ %s ------\n", header);
     while ((de = readdir(d))) {
+        if (ds.IsUserConsentDenied()) {
+            MYLOGE(
+                "Returning early because user denied consent to share bugreport with calling app.");
+            closedir(d);
+            return;
+        }
         int pid;
         int fd;
         char cmdpath[255];
@@ -350,6 +358,12 @@
     func(pid, pid, cmdline);
 
     while ((de = readdir(d))) {
+        if (ds.IsUserConsentDenied()) {
+            MYLOGE(
+                "Returning early because user denied consent to share bugreport with calling app.");
+            closedir(d);
+            return;
+        }
         int tid;
         int fd;
         char commpath[255];
diff --git a/cmds/installd/dexopt.cpp b/cmds/installd/dexopt.cpp
index ffd1191..72571cf 100644
--- a/cmds/installd/dexopt.cpp
+++ b/cmds/installd/dexopt.cpp
@@ -608,7 +608,7 @@
     // the app uid. If we cannot do that, there's no point in returning the fd
     // since dex2oat/profman will fail with SElinux denials.
     if (fchown(fd.get(), uid, uid) < 0) {
-        PLOG(ERROR) << "Could not chwon profile " << profile;
+        PLOG(ERROR) << "Could not chown profile " << profile;
         return invalid_unique_fd();
     }
     return fd;
diff --git a/cmds/installd/otapreopt_chroot.cpp b/cmds/installd/otapreopt_chroot.cpp
index 670abea..0fdc9d6 100644
--- a/cmds/installd/otapreopt_chroot.cpp
+++ b/cmds/installd/otapreopt_chroot.cpp
@@ -41,23 +41,6 @@
 namespace android {
 namespace installd {
 
-// Configuration for bind-mounted Bionic artifacts.
-
-static constexpr const char* kLinkerMountPoint = "/bionic/bin/linker";
-static constexpr const char* kRuntimeLinkerPath = "/apex/com.android.runtime/bin/linker";
-
-static constexpr const char* kBionicLibsMountPointDir = "/bionic/lib/";
-static constexpr const char* kRuntimeBionicLibsDir = "/apex/com.android.runtime/lib/bionic/";
-
-static constexpr const char* kLinkerMountPoint64 = "/bionic/bin/linker64";
-static constexpr const char* kRuntimeLinkerPath64 = "/apex/com.android.runtime/bin/linker64";
-
-static constexpr const char* kBionicLibsMountPointDir64 = "/bionic/lib64/";
-static constexpr const char* kRuntimeBionicLibsDir64 = "/apex/com.android.runtime/lib64/bionic/";
-
-static const std::vector<std::string> kBionicLibFileNames = {"libc.so", "libm.so", "libdl.so"};
-
-
 static void CloseDescriptor(int fd) {
     if (fd >= 0) {
         int result = close(fd);
@@ -94,43 +77,6 @@
     }
 }
 
-// Copied from system/core/init/mount_namespace.cpp.
-static bool BindMount(const std::string& source, const std::string& mount_point,
-                      bool recursive = false) {
-    unsigned long mountflags = MS_BIND;
-    if (recursive) {
-        mountflags |= MS_REC;
-    }
-    if (mount(source.c_str(), mount_point.c_str(), nullptr, mountflags, nullptr) == -1) {
-        PLOG(ERROR) << "Could not bind-mount " << source << " to " << mount_point;
-        return false;
-    }
-    return true;
-}
-
-// Copied from system/core/init/mount_namespace.cpp and and adjusted (bind
-// mounts are not made private, as the /postinstall is already private (see
-// `android::installd::otapreopt_chroot`).
-static bool BindMountBionic(const std::string& linker_source, const std::string& lib_dir_source,
-                            const std::string& linker_mount_point,
-                            const std::string& lib_mount_dir) {
-    if (access(linker_source.c_str(), F_OK) != 0) {
-        PLOG(INFO) << linker_source << " does not exist. Skipping mounting Bionic there.";
-        return true;
-    }
-    if (!BindMount(linker_source, linker_mount_point)) {
-        return false;
-    }
-    for (const auto& libname : kBionicLibFileNames) {
-        std::string mount_point = lib_mount_dir + libname;
-        std::string source = lib_dir_source + libname;
-        if (!BindMount(source, mount_point)) {
-            return false;
-        }
-    }
-    return true;
-}
-
 // Entry for otapreopt_chroot. Expected parameters are:
 //   [cmd] [status-fd] [target-slot] "dexopt" [dexopt-params]
 // The file descriptor denoted by status-fd will be closed. The rest of the parameters will
@@ -274,23 +220,6 @@
     // the Android Runtime APEX, as it is required by otapreopt to run dex2oat.
     std::vector<apex::ApexFile> active_packages = ActivateApexPackages();
 
-    // Bind-mount Bionic artifacts from the Runtime APEX.
-    // This logic is copied and adapted from system/core/init/mount_namespace.cpp.
-    if (!BindMountBionic(kRuntimeLinkerPath, kRuntimeBionicLibsDir, kLinkerMountPoint,
-                         kBionicLibsMountPointDir)) {
-        LOG(ERROR) << "Failed to mount 32-bit Bionic artifacts from the Runtime APEX.";
-        // Clean up and exit.
-        DeactivateApexPackages(active_packages);
-        exit(215);
-    }
-    if (!BindMountBionic(kRuntimeLinkerPath64, kRuntimeBionicLibsDir64, kLinkerMountPoint64,
-                         kBionicLibsMountPointDir64)) {
-        LOG(ERROR) << "Failed to mount 64-bit Bionic artifacts from the Runtime APEX.";
-        // Clean up and exit.
-        DeactivateApexPackages(active_packages);
-        exit(216);
-    }
-
     // Now go on and run otapreopt.
 
     // Incoming:  cmd + status-fd + target-slot + cmd...      | Incoming | = argc
diff --git a/libs/graphicsenv/IGpuService.cpp b/libs/graphicsenv/IGpuService.cpp
index 0b0bf44..1dc1c0e 100644
--- a/libs/graphicsenv/IGpuService.cpp
+++ b/libs/graphicsenv/IGpuService.cpp
@@ -67,6 +67,29 @@
         outStats->clear();
         return reply.readParcelableVector(outStats);
     }
+
+    virtual status_t getGpuStatsAppInfo(std::vector<GpuStatsAppInfo>* outStats) const {
+        if (!outStats) return UNEXPECTED_NULL;
+
+        Parcel data, reply;
+        status_t status;
+
+        if ((status = data.writeInterfaceToken(IGpuService::getInterfaceDescriptor())) != OK) {
+            return status;
+        }
+
+        if ((status = remote()->transact(BnGpuService::GET_GPU_STATS_APP_INFO, data, &reply)) !=
+            OK) {
+            return status;
+        }
+
+        int32_t result = 0;
+        if ((status = reply.readInt32(&result)) != OK) return status;
+        if (result != OK) return result;
+
+        outStats->clear();
+        return reply.readParcelableVector(outStats);
+    }
 };
 
 IMPLEMENT_META_INTERFACE(GpuService, "android.graphicsenv.IGpuService");
@@ -123,6 +146,19 @@
 
             return OK;
         }
+        case GET_GPU_STATS_APP_INFO: {
+            CHECK_INTERFACE(IGpuService, data, reply);
+
+            std::vector<GpuStatsAppInfo> stats;
+            const status_t result = getGpuStatsAppInfo(&stats);
+
+            if ((status = reply->writeInt32(result)) != OK) return status;
+            if (result != OK) return result;
+
+            if ((status = reply->writeParcelableVector(stats)) != OK) return status;
+
+            return OK;
+        }
         case SHELL_COMMAND_TRANSACTION: {
             int in = data.readFileDescriptor();
             int out = data.readFileDescriptor();
diff --git a/libs/graphicsenv/include/graphicsenv/IGpuService.h b/libs/graphicsenv/include/graphicsenv/IGpuService.h
index e7cdb38..ac022b5 100644
--- a/libs/graphicsenv/include/graphicsenv/IGpuService.h
+++ b/libs/graphicsenv/include/graphicsenv/IGpuService.h
@@ -42,6 +42,9 @@
 
     // get GPU global stats from GpuStats module.
     virtual status_t getGpuStatsGlobalInfo(std::vector<GpuStatsGlobalInfo>* outStats) const = 0;
+
+    // get GPU app stats from GpuStats module.
+    virtual status_t getGpuStatsAppInfo(std::vector<GpuStatsAppInfo>* outStats) const = 0;
 };
 
 class BnGpuService : public BnInterface<IGpuService> {
@@ -49,6 +52,7 @@
     enum IGpuServiceTag {
         SET_GPU_STATS = IBinder::FIRST_CALL_TRANSACTION,
         GET_GPU_STATS_GLOBAL_INFO,
+        GET_GPU_STATS_APP_INFO,
         // Always append new enum to the end.
     };
 
diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp
index 400daf0..247dc8d 100644
--- a/libs/gui/ISurfaceComposer.cpp
+++ b/libs/gui/ISurfaceComposer.cpp
@@ -860,6 +860,59 @@
         }
         return reply.readInt32();
     }
+
+    virtual status_t getDisplayBrightnessSupport(const sp<IBinder>& displayToken,
+                                                 bool* outSupport) const {
+        Parcel data, reply;
+        status_t error = data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
+        if (error != NO_ERROR) {
+            ALOGE("getDisplayBrightnessSupport: failed to write interface token: %d", error);
+            return error;
+        }
+        error = data.writeStrongBinder(displayToken);
+        if (error != NO_ERROR) {
+            ALOGE("getDisplayBrightnessSupport: failed to write display token: %d", error);
+            return error;
+        }
+        error = remote()->transact(BnSurfaceComposer::GET_DISPLAY_BRIGHTNESS_SUPPORT, data, &reply);
+        if (error != NO_ERROR) {
+            ALOGE("getDisplayBrightnessSupport: failed to transact: %d", error);
+            return error;
+        }
+        bool support;
+        error = reply.readBool(&support);
+        if (error != NO_ERROR) {
+            ALOGE("getDisplayBrightnessSupport: failed to read support: %d", error);
+            return error;
+        }
+        *outSupport = support;
+        return NO_ERROR;
+    }
+
+    virtual status_t setDisplayBrightness(const sp<IBinder>& displayToken, float brightness) const {
+        Parcel data, reply;
+        status_t error = data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
+        if (error != NO_ERROR) {
+            ALOGE("setDisplayBrightness: failed to write interface token: %d", error);
+            return error;
+        }
+        error = data.writeStrongBinder(displayToken);
+        if (error != NO_ERROR) {
+            ALOGE("setDisplayBrightness: failed to write display token: %d", error);
+            return error;
+        }
+        error = data.writeFloat(brightness);
+        if (error != NO_ERROR) {
+            ALOGE("setDisplayBrightness: failed to write brightness: %d", error);
+            return error;
+        }
+        error = remote()->transact(BnSurfaceComposer::SET_DISPLAY_BRIGHTNESS, data, &reply);
+        if (error != NO_ERROR) {
+            ALOGE("setDisplayBrightness: failed to transact: %d", error);
+            return error;
+        }
+        return NO_ERROR;
+    }
 };
 
 // Out-of-line virtual method definition to trigger vtable emission in this
@@ -1390,6 +1443,35 @@
             reply->writeInt32(result);
             return result;
         }
+        case GET_DISPLAY_BRIGHTNESS_SUPPORT: {
+            CHECK_INTERFACE(ISurfaceComposer, data, reply);
+            sp<IBinder> displayToken;
+            status_t error = data.readNullableStrongBinder(&displayToken);
+            if (error != NO_ERROR) {
+                ALOGE("getDisplayBrightnessSupport: failed to read display token: %d", error);
+                return error;
+            }
+            bool support = false;
+            error = getDisplayBrightnessSupport(displayToken, &support);
+            reply->writeBool(support);
+            return error;
+        }
+        case SET_DISPLAY_BRIGHTNESS: {
+            CHECK_INTERFACE(ISurfaceComposer, data, reply);
+            sp<IBinder> displayToken;
+            status_t error = data.readNullableStrongBinder(&displayToken);
+            if (error != NO_ERROR) {
+                ALOGE("setDisplayBrightness: failed to read display token: %d", error);
+                return error;
+            }
+            float brightness = -1.0f;
+            error = data.readFloat(&brightness);
+            if (error != NO_ERROR) {
+                ALOGE("setDisplayBrightness: failed to read brightness: %d", error);
+                return error;
+            }
+            return setDisplayBrightness(displayToken, brightness);
+        }
         default: {
             return BBinder::onTransact(code, data, reply, flags);
         }
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index 6460325..93b4191 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -816,7 +816,7 @@
         // The consumer doesn't send it back to prevent us from having two
         // file descriptors of the same fence.
         mFrameEventHistory->updateAcquireFence(mNextFrameNumber,
-                std::make_shared<FenceTime>(std::move(fence)));
+                std::make_shared<FenceTime>(fence));
 
         // Cache timestamps of signaled fences so we can close their file
         // descriptors.
diff --git a/libs/gui/SurfaceComposerClient.cpp b/libs/gui/SurfaceComposerClient.cpp
index d6708ab..b0e8275 100644
--- a/libs/gui/SurfaceComposerClient.cpp
+++ b/libs/gui/SurfaceComposerClient.cpp
@@ -1503,6 +1503,17 @@
     return ComposerService::getComposerService()->removeRegionSamplingListener(listener);
 }
 
+bool SurfaceComposerClient::getDisplayBrightnessSupport(const sp<IBinder>& displayToken) {
+    bool support = false;
+    ComposerService::getComposerService()->getDisplayBrightnessSupport(displayToken, &support);
+    return support;
+}
+
+status_t SurfaceComposerClient::setDisplayBrightness(const sp<IBinder>& displayToken,
+                                                     float brightness) {
+    return ComposerService::getComposerService()->setDisplayBrightness(displayToken, brightness);
+}
+
 // ----------------------------------------------------------------------------
 
 status_t ScreenshotClient::capture(const sp<IBinder>& display, const ui::Dataspace reqDataSpace,
diff --git a/libs/gui/include/gui/ISurfaceComposer.h b/libs/gui/include/gui/ISurfaceComposer.h
index 0e576ca..3dffa8f 100644
--- a/libs/gui/include/gui/ISurfaceComposer.h
+++ b/libs/gui/include/gui/ISurfaceComposer.h
@@ -376,6 +376,37 @@
      */
     virtual status_t getAllowedDisplayConfigs(const sp<IBinder>& displayToken,
                                               std::vector<int32_t>* outAllowedConfigs) = 0;
+    /*
+     * Gets whether brightness operations are supported on a display.
+     *
+     * displayToken
+     *      The token of the display.
+     * outSupport
+     *      An output parameter for whether brightness operations are supported.
+     *
+     * Returns NO_ERROR upon success. Otherwise,
+     *      NAME_NOT_FOUND if the display is invalid, or
+     *      BAD_VALUE      if the output parameter is invalid.
+     */
+    virtual status_t getDisplayBrightnessSupport(const sp<IBinder>& displayToken,
+                                                 bool* outSupport) const = 0;
+
+    /*
+     * Sets the brightness of a display.
+     *
+     * displayToken
+     *      The token of the display whose brightness is set.
+     * brightness
+     *      A number between 0.0f (minimum brightness) and 1.0 (maximum brightness), or -1.0f to
+     *      turn the backlight off.
+     *
+     * Returns NO_ERROR upon success. Otherwise,
+     *      NAME_NOT_FOUND    if the display is invalid, or
+     *      BAD_VALUE         if the brightness is invalid, or
+     *      INVALID_OPERATION if brightness operations are not supported.
+     */
+    virtual status_t setDisplayBrightness(const sp<IBinder>& displayToken,
+                                          float brightness) const = 0;
 };
 
 // ----------------------------------------------------------------------------
@@ -425,6 +456,8 @@
         REMOVE_REGION_SAMPLING_LISTENER,
         SET_ALLOWED_DISPLAY_CONFIGS,
         GET_ALLOWED_DISPLAY_CONFIGS,
+        GET_DISPLAY_BRIGHTNESS_SUPPORT,
+        SET_DISPLAY_BRIGHTNESS,
         // Always append new enum to the end.
     };
 
diff --git a/libs/gui/include/gui/SurfaceComposerClient.h b/libs/gui/include/gui/SurfaceComposerClient.h
index 48c978f..39d6d13 100644
--- a/libs/gui/include/gui/SurfaceComposerClient.h
+++ b/libs/gui/include/gui/SurfaceComposerClient.h
@@ -168,6 +168,32 @@
     // Queries whether a given display is wide color display.
     static status_t isWideColorDisplay(const sp<IBinder>& display, bool* outIsWideColorDisplay);
 
+    /*
+     * Returns whether brightness operations are supported on a display.
+     *
+     * displayToken
+     *      The token of the display.
+     *
+     * Returns whether brightness operations are supported on a display or not.
+     */
+    static bool getDisplayBrightnessSupport(const sp<IBinder>& displayToken);
+
+    /*
+     * Sets the brightness of a display.
+     *
+     * displayToken
+     *      The token of the display whose brightness is set.
+     * brightness
+     *      A number between 0.0 (minimum brightness) and 1.0 (maximum brightness), or -1.0f to
+     *      turn the backlight off.
+     *
+     * Returns NO_ERROR upon success. Otherwise,
+     *      NAME_NOT_FOUND    if the display handle is invalid, or
+     *      BAD_VALUE         if the brightness value is invalid, or
+     *      INVALID_OPERATION if brightness operaetions are not supported.
+     */
+    static status_t setDisplayBrightness(const sp<IBinder>& displayToken, float brightness);
+
     // ------------------------------------------------------------------------
     // surface creation / destruction
 
diff --git a/libs/gui/tests/Surface_test.cpp b/libs/gui/tests/Surface_test.cpp
index a7599e0..06fe86c 100644
--- a/libs/gui/tests/Surface_test.cpp
+++ b/libs/gui/tests/Surface_test.cpp
@@ -669,6 +669,14 @@
     status_t getProtectedContentSupport(bool* /*outSupported*/) const override { return NO_ERROR; }
 
     status_t isWideColorDisplay(const sp<IBinder>&, bool*) const override { return NO_ERROR; }
+    status_t getDisplayBrightnessSupport(const sp<IBinder>& /*displayToken*/,
+                                         bool* /*outSupport*/) const override {
+        return NO_ERROR;
+    }
+    status_t setDisplayBrightness(const sp<IBinder>& /*displayToken*/,
+                                  float /*brightness*/) const override {
+        return NO_ERROR;
+    }
 
     status_t addRegionSamplingListener(const Rect& /*samplingArea*/,
                                        const sp<IBinder>& /*stopLayerHandle*/,
diff --git a/services/gpuservice/GpuService.cpp b/services/gpuservice/GpuService.cpp
index 5e5cf35..59fa1c0 100644
--- a/services/gpuservice/GpuService.cpp
+++ b/services/gpuservice/GpuService.cpp
@@ -67,6 +67,14 @@
     return OK;
 }
 
+status_t GpuService::getGpuStatsAppInfo(std::vector<GpuStatsAppInfo>* outStats) const {
+    ATRACE_CALL();
+
+    mGpuStats->pullAppStats(outStats);
+
+    return OK;
+}
+
 status_t GpuService::shellCommand(int /*in*/, int out, int err, std::vector<String16>& args) {
     ATRACE_CALL();
 
diff --git a/services/gpuservice/GpuService.h b/services/gpuservice/GpuService.h
index b984e0f..7a9b2d4 100644
--- a/services/gpuservice/GpuService.h
+++ b/services/gpuservice/GpuService.h
@@ -48,6 +48,7 @@
                      const std::string& appPackageName, GraphicsEnv::Driver driver,
                      bool isDriverLoaded, int64_t driverLoadingTime) override;
     status_t getGpuStatsGlobalInfo(std::vector<GpuStatsGlobalInfo>* outStats) const override;
+    status_t getGpuStatsAppInfo(std::vector<GpuStatsAppInfo>* outStats) const override;
 
     /*
      * IBinder interface
diff --git a/services/gpuservice/gpustats/GpuStats.cpp b/services/gpuservice/gpustats/GpuStats.cpp
index 146e2c2..6185305 100644
--- a/services/gpuservice/gpustats/GpuStats.cpp
+++ b/services/gpuservice/gpustats/GpuStats.cpp
@@ -53,10 +53,12 @@
     switch (driver) {
         case GraphicsEnv::Driver::GL:
         case GraphicsEnv::Driver::GL_UPDATED:
+            if (outAppInfo->glDriverLoadingTime.size() >= GpuStats::MAX_NUM_LOADING_TIMES) break;
             outAppInfo->glDriverLoadingTime.emplace_back(driverLoadingTime);
             break;
         case GraphicsEnv::Driver::VULKAN:
         case GraphicsEnv::Driver::VULKAN_UPDATED:
+            if (outAppInfo->vkDriverLoadingTime.size() >= GpuStats::MAX_NUM_LOADING_TIMES) break;
             outAppInfo->vkDriverLoadingTime.emplace_back(driverLoadingTime);
             break;
         default:
@@ -198,4 +200,18 @@
     mGlobalStats.clear();
 }
 
+void GpuStats::pullAppStats(std::vector<GpuStatsAppInfo>* outStats) {
+    ATRACE_CALL();
+
+    std::lock_guard<std::mutex> lock(mLock);
+    outStats->clear();
+    outStats->reserve(mAppStats.size());
+
+    for (const auto& ele : mAppStats) {
+        outStats->emplace_back(ele.second);
+    }
+
+    mAppStats.clear();
+}
+
 } // namespace android
diff --git a/services/gpuservice/gpustats/GpuStats.h b/services/gpuservice/gpustats/GpuStats.h
index 9cdcd95..d942154 100644
--- a/services/gpuservice/gpustats/GpuStats.h
+++ b/services/gpuservice/gpustats/GpuStats.h
@@ -41,6 +41,11 @@
     void dump(const Vector<String16>& args, std::string* result);
     // Pull gpu global stats
     void pullGlobalStats(std::vector<GpuStatsGlobalInfo>* outStats);
+    // Pull gpu app stats
+    void pullAppStats(std::vector<GpuStatsAppInfo>* outStats);
+
+    // This limits the worst case number of loading times tracked.
+    static const size_t MAX_NUM_LOADING_TIMES = 50;
 
 private:
     // Dump global stats
@@ -48,9 +53,9 @@
     // Dump app stats
     void dumpAppLocked(std::string* result);
 
-    // This limits the memory usage of GpuStats to be less than 30KB. This is
-    // the maximum atom size statsd could afford.
-    static const size_t MAX_NUM_APP_RECORDS = 300;
+    // Below limits the memory usage of GpuStats to be less than 10KB. This is
+    // the preferred number for statsd while maintaining nice data quality.
+    static const size_t MAX_NUM_APP_RECORDS = 100;
     // GpuStats access should be guarded by mLock.
     std::mutex mLock;
     // Key is driver version code.
diff --git a/services/inputflinger/InputClassifier.cpp b/services/inputflinger/InputClassifier.cpp
index 3905ed0..b4db338 100644
--- a/services/inputflinger/InputClassifier.cpp
+++ b/services/inputflinger/InputClassifier.cpp
@@ -40,6 +40,7 @@
 using android::base::StringPrintf;
 using android::hardware::hidl_bitfield;
 using android::hardware::hidl_vec;
+using android::hardware::Return;
 using namespace android::hardware::input;
 
 namespace android {
@@ -548,23 +549,28 @@
     ensureHalThread(__func__);
     while (true) {
         ClassifierEvent event = mEvents.pop();
+        bool halResponseOk = true;
         switch (event.type) {
             case ClassifierEventType::MOTION: {
                 NotifyMotionArgs* motionArgs = static_cast<NotifyMotionArgs*>(event.args.get());
                 common::V1_0::MotionEvent motionEvent = getMotionEvent(*motionArgs);
-                common::V1_0::Classification halClassification = mService->classify(motionEvent);
-                updateClassification(motionArgs->deviceId, motionArgs->eventTime,
-                        getMotionClassification(halClassification));
+                Return<common::V1_0::Classification> response = mService->classify(motionEvent);
+                halResponseOk = response.isOk();
+                if (halResponseOk) {
+                    common::V1_0::Classification halClassification = response;
+                    updateClassification(motionArgs->deviceId, motionArgs->eventTime,
+                            getMotionClassification(halClassification));
+                }
                 break;
             }
             case ClassifierEventType::DEVICE_RESET: {
                 const int32_t deviceId = *(event.getDeviceId());
-                mService->resetDevice(deviceId);
+                halResponseOk = mService->resetDevice(deviceId).isOk();
                 setClassification(deviceId, MotionClassification::NONE);
                 break;
             }
             case ClassifierEventType::HAL_RESET: {
-                mService->reset();
+                halResponseOk = mService->reset().isOk();
                 clearClassifications();
                 break;
             }
@@ -573,6 +579,21 @@
                 return;
             }
         }
+        if (!halResponseOk) {
+            ALOGE("Error communicating with InputClassifier HAL. "
+                    "Exiting MotionClassifier HAL thread");
+            clearClassifications();
+            return;
+        }
+    }
+}
+
+void MotionClassifier::enqueueEvent(ClassifierEvent&& event) {
+    bool eventAdded = mEvents.push(std::move(event));
+    if (!eventAdded) {
+        // If the queue is full, suspect the HAL is slow in processing the events.
+        ALOGE("Dropped event with eventTime %" PRId64, event.args->eventTime);
+        reset();
     }
 }
 
@@ -617,22 +638,12 @@
 }
 
 MotionClassification MotionClassifier::classify(const NotifyMotionArgs& args) {
-    if (!mService) {
-        // If HAL is not present, do nothing
-        return MotionClassification::NONE;
-    }
     if ((args.action & AMOTION_EVENT_ACTION_MASK) == AMOTION_EVENT_ACTION_DOWN) {
         updateLastDownTime(args.deviceId, args.downTime);
     }
 
     ClassifierEvent event(std::make_unique<NotifyMotionArgs>(args));
-    bool elementAdded = mEvents.push(std::move(event));
-    if (!elementAdded) {
-        // Queue should not ever overfill. Suspect HAL is slow.
-        ALOGE("Dropped element with eventTime %" PRIu64, args.eventTime);
-        reset();
-        return MotionClassification::NONE;
-    }
+    enqueueEvent(std::move(event));
     return getClassification(args.deviceId);
 }
 
@@ -652,7 +663,7 @@
             std::optional<int32_t> eventDeviceId = event.getDeviceId();
             return eventDeviceId && (*eventDeviceId == deviceId);
     });
-    mEvents.push(std::make_unique<NotifyDeviceResetArgs>(args));
+    enqueueEvent(std::make_unique<NotifyDeviceResetArgs>(args));
 }
 
 void MotionClassifier::dump(std::string& dump) {
@@ -679,20 +690,39 @@
     }
 }
 
+
 // --- InputClassifier ---
 
 InputClassifier::InputClassifier(const sp<InputListenerInterface>& listener) :
         mListener(listener) {
-    if (deepPressEnabled()) {
-        sp<android::hardware::input::classifier::V1_0::IInputClassifier> service =
-                classifier::V1_0::IInputClassifier::getService();
-        if (service) {
-            mMotionClassifier = std::make_unique<MotionClassifier>(service);
-        } else {
-            ALOGI("Could not obtain InputClassifier HAL");
-        }
+    // The rest of the initialization is done in onFirstRef, because we need to obtain
+    // an sp to 'this' in order to register for HAL death notifications
+}
+
+void InputClassifier::onFirstRef() {
+    std::scoped_lock lock(mLock);
+    if (!deepPressEnabled()) {
+        // If feature is not enabled, the InputClassifier will just be in passthrough
+        // mode, and will forward all events to the next InputListener, unmodified
+        return;
     }
-};
+
+    sp<android::hardware::input::classifier::V1_0::IInputClassifier> service =
+            classifier::V1_0::IInputClassifier::getService();
+    if (!service) {
+        // Not really an error, maybe the device does not have this HAL,
+        // but somehow the feature flag is flipped
+        ALOGI("Could not obtain InputClassifier HAL");
+        return;
+    }
+    const bool linked = service->linkToDeath(this, 0 /* cookie */).withDefault(false);
+    if (!linked) {
+        ALOGE("Could not link android::InputClassifier to the HAL death");
+        return;
+    }
+
+    mMotionClassifier = std::make_unique<MotionClassifier>(service);
+}
 
 void InputClassifier::notifyConfigurationChanged(const NotifyConfigurationChangedArgs* args) {
     // pass through
@@ -705,12 +735,17 @@
 }
 
 void InputClassifier::notifyMotion(const NotifyMotionArgs* args) {
-    NotifyMotionArgs copyArgs = NotifyMotionArgs(*args);
-    if (mMotionClassifier && isTouchEvent(*args)) {
-        // We only cover touch events, for now.
-        copyArgs.classification = mMotionClassifier->classify(copyArgs);
+    std::scoped_lock lock(mLock);
+    // MotionClassifier is only used for touch events, for now
+    const bool sendToMotionClassifier = mMotionClassifier && isTouchEvent(*args);
+    if (!sendToMotionClassifier) {
+        mListener->notifyMotion(args);
+        return;
     }
-    mListener->notifyMotion(&copyArgs);
+
+    NotifyMotionArgs newArgs(*args);
+    newArgs.classification = mMotionClassifier->classify(newArgs);
+    mListener->notifyMotion(&newArgs);
 }
 
 void InputClassifier::notifySwitch(const NotifySwitchArgs* args) {
@@ -719,6 +754,7 @@
 }
 
 void InputClassifier::notifyDeviceReset(const NotifyDeviceResetArgs* args) {
+    std::scoped_lock lock(mLock);
     if (mMotionClassifier) {
         mMotionClassifier->reset(*args);
     }
@@ -726,7 +762,19 @@
     mListener->notifyDeviceReset(args);
 }
 
+void InputClassifier::serviceDied(uint64_t /*cookie*/,
+        const wp<android::hidl::base::V1_0::IBase>& who) {
+    std::scoped_lock lock(mLock);
+    ALOGE("InputClassifier HAL has died. Setting mMotionClassifier to null");
+    mMotionClassifier = nullptr;
+    sp<android::hidl::base::V1_0::IBase> service = who.promote();
+    if (service) {
+        service->unlinkToDeath(this);
+    }
+}
+
 void InputClassifier::dump(std::string& dump) {
+    std::scoped_lock lock(mLock);
     dump += "Input Classifier State:\n";
 
     dump += INDENT1 "Motion Classifier:\n";
diff --git a/services/inputflinger/InputClassifier.h b/services/inputflinger/InputClassifier.h
index b97357d..0b1483f 100644
--- a/services/inputflinger/InputClassifier.h
+++ b/services/inputflinger/InputClassifier.h
@@ -69,7 +69,13 @@
      * provide a MotionClassification for the current gesture.
      */
     virtual MotionClassification classify(const NotifyMotionArgs& args) = 0;
+    /**
+     * Reset all internal HAL state.
+     */
     virtual void reset() = 0;
+    /**
+     * Reset HAL state for a specific device.
+     */
     virtual void reset(const NotifyDeviceResetArgs& args) = 0;
 
     /**
@@ -107,6 +113,9 @@
  */
 class MotionClassifier final : public MotionClassifierInterface {
 public:
+    /**
+     * The provided pointer to the service cannot be null.
+     */
     MotionClassifier(sp<android::hardware::input::classifier::V1_0::IInputClassifier> service);
     ~MotionClassifier();
     /**
@@ -128,6 +137,10 @@
     // The events that need to be sent to the HAL.
     BlockingQueue<ClassifierEvent> mEvents;
     /**
+     * Add an event to the queue mEvents.
+     */
+    void enqueueEvent(ClassifierEvent&& event);
+    /**
      * Thread that will communicate with InputClassifier HAL.
      * This should be the only thread that communicates with InputClassifier HAL,
      * because this thread is allowed to block on the HAL calls.
@@ -143,9 +156,9 @@
      */
     void callInputClassifierHal();
     /**
-     * Access to the InputClassifier HAL
+     * Access to the InputClassifier HAL. Can always be safely dereferenced.
      */
-    sp<android::hardware::input::classifier::V1_0::IInputClassifier> mService;
+    const sp<android::hardware::input::classifier::V1_0::IInputClassifier> mService;
     std::mutex mLock;
     /**
      * Per-device input classifications. Should only be accessed using the
@@ -184,15 +197,19 @@
     void requestExit();
 };
 
+
 /**
  * Implementation of the InputClassifierInterface.
  * Represents a separate stage of input processing. All of the input events go through this stage.
  * Acts as a passthrough for all input events except for motion events.
  * The events of motion type are sent to MotionClassifier.
  */
-class InputClassifier : public InputClassifierInterface {
+class InputClassifier : public InputClassifierInterface,
+        public android::hardware::hidl_death_recipient {
 public:
     explicit InputClassifier(const sp<InputListenerInterface>& listener);
+    // Some of the constructor logic is finished in onFirstRef
+    virtual void onFirstRef() override;
 
     virtual void notifyConfigurationChanged(const NotifyConfigurationChangedArgs* args) override;
     virtual void notifyKey(const NotifyKeyArgs* args) override;
@@ -200,10 +217,15 @@
     virtual void notifySwitch(const NotifySwitchArgs* args) override;
     virtual void notifyDeviceReset(const NotifyDeviceResetArgs* args) override;
 
+    virtual void serviceDied(uint64_t cookie,
+            const wp<android::hidl::base::V1_0::IBase>& who) override;
+
     virtual void dump(std::string& dump) override;
 
 private:
-    std::unique_ptr<MotionClassifierInterface> mMotionClassifier = nullptr;
+    // Protect access to mMotionClassifier, since it may become null via a hidl callback
+    std::mutex mLock;
+    std::unique_ptr<MotionClassifierInterface> mMotionClassifier GUARDED_BY(mLock);
     // The next stage to pass input events to
     sp<InputListenerInterface> mListener;
 };
diff --git a/services/surfaceflinger/BufferLayer.cpp b/services/surfaceflinger/BufferLayer.cpp
index 7884362..bb18aa1 100644
--- a/services/surfaceflinger/BufferLayer.cpp
+++ b/services/surfaceflinger/BufferLayer.cpp
@@ -204,8 +204,16 @@
         }
 
         const Rect win{getBounds()};
-        const float bufferWidth = getBufferSize(s).getWidth();
-        const float bufferHeight = getBufferSize(s).getHeight();
+        float bufferWidth = getBufferSize(s).getWidth();
+        float bufferHeight = getBufferSize(s).getHeight();
+
+        // BufferStateLayers can have a "buffer size" of [0, 0, -1, -1] when no display frame has
+        // been set and there is no parent layer bounds. In that case, the scale is meaningless so
+        // ignore them.
+        if (!getBufferSize(s).isValid()) {
+            bufferWidth = float(win.right) - float(win.left);
+            bufferHeight = float(win.bottom) - float(win.top);
+        }
 
         const float scaleHeight = (float(win.bottom) - float(win.top)) / bufferHeight;
         const float scaleWidth = (float(win.right) - float(win.left)) / bufferWidth;
diff --git a/services/surfaceflinger/BufferLayer.h b/services/surfaceflinger/BufferLayer.h
index 8149cba..4f3ad41 100644
--- a/services/surfaceflinger/BufferLayer.h
+++ b/services/surfaceflinger/BufferLayer.h
@@ -181,6 +181,8 @@
     // main thread.
     bool mBufferLatched{false}; // TODO: Use mActiveBuffer?
 
+    // BufferStateLayers can return Rect::INVALID_RECT if the layer does not have a display frame
+    // and its parent layer is not bounded
     Rect getBufferSize(const State& s) const override;
 
     std::shared_ptr<compositionengine::Layer> mCompositionLayer;
diff --git a/services/surfaceflinger/BufferStateLayer.cpp b/services/surfaceflinger/BufferStateLayer.cpp
index 3713121..1ca0b02 100644
--- a/services/surfaceflinger/BufferStateLayer.cpp
+++ b/services/surfaceflinger/BufferStateLayer.cpp
@@ -156,9 +156,22 @@
 }
 
 bool BufferStateLayer::setCrop(const Rect& crop) {
-    if (mCurrentState.crop == crop) return false;
+    Rect c = crop;
+    if (c.left < 0) {
+        c.left = 0;
+    }
+    if (c.top < 0) {
+        c.top = 0;
+    }
+    // If the width and/or height are < 0, make it [0, 0, -1, -1] so the equality comparision below
+    // treats all invalid rectangles the same.
+    if (!c.isValid()) {
+        c.makeInvalid();
+    }
+
+    if (mCurrentState.crop == c) return false;
     mCurrentState.sequence++;
-    mCurrentState.crop = crop;
+    mCurrentState.crop = c;
     mCurrentState.modified = true;
     setTransactionFlags(eTransactionNeeded);
     return true;
@@ -327,10 +340,6 @@
         }
     }
 
-    // if there is no parent layer, use the buffer's bounds as the buffer size
-    if (s.buffer) {
-        return s.buffer->getBounds();
-    }
     return Rect::INVALID_RECT;
 }
 
diff --git a/services/surfaceflinger/CompositionEngine/tests/MockHWComposer.h b/services/surfaceflinger/CompositionEngine/tests/MockHWComposer.h
index 885cdd4..94349de 100644
--- a/services/surfaceflinger/CompositionEngine/tests/MockHWComposer.h
+++ b/services/surfaceflinger/CompositionEngine/tests/MockHWComposer.h
@@ -65,6 +65,8 @@
     MOCK_METHOD4(setDisplayContentSamplingEnabled, status_t(DisplayId, bool, uint8_t, uint64_t));
     MOCK_METHOD4(getDisplayedContentSample,
                  status_t(DisplayId, uint64_t, uint64_t, DisplayedFrameStats*));
+    MOCK_METHOD2(setDisplayBrightness, status_t(DisplayId, float));
+    MOCK_METHOD2(getDisplayBrightnessSupport, status_t(DisplayId, bool*));
 
     MOCK_METHOD2(onHotplug,
                  std::optional<DisplayIdentificationInfo>(hwc2_display_t, HWC2::Connection));
diff --git a/services/surfaceflinger/DisplayHardware/ComposerHal.cpp b/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
index 8343e5a..9cb43bc 100644
--- a/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
+++ b/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
@@ -214,7 +214,6 @@
             [&](const auto& tmpCapabilities) {
                 capabilities = tmpCapabilities;
             });
-
     return capabilities;
 }
 
@@ -1159,6 +1158,30 @@
     return Error::NONE;
 }
 
+Error Composer::getDisplayBrightnessSupport(Display display, bool* outSupport) {
+    if (!mClient_2_3) {
+        return Error::UNSUPPORTED;
+    }
+    Error error = kDefaultError;
+    mClient_2_3->getDisplayBrightnessSupport(display,
+                                             [&](const auto& tmpError, const auto& tmpSupport) {
+                                                 error = tmpError;
+                                                 if (error != Error::NONE) {
+                                                     return;
+                                                 }
+
+                                                 *outSupport = tmpSupport;
+                                             });
+    return error;
+}
+
+Error Composer::setDisplayBrightness(Display display, float brightness) {
+    if (!mClient_2_3) {
+        return Error::UNSUPPORTED;
+    }
+    return mClient_2_3->setDisplayBrightness(display, brightness);
+}
+
 CommandReader::~CommandReader()
 {
     resetData();
diff --git a/services/surfaceflinger/DisplayHardware/ComposerHal.h b/services/surfaceflinger/DisplayHardware/ComposerHal.h
index 542e840..e24db15 100644
--- a/services/surfaceflinger/DisplayHardware/ComposerHal.h
+++ b/services/surfaceflinger/DisplayHardware/ComposerHal.h
@@ -203,6 +203,8 @@
                                          std::vector<DisplayCapability>* outCapabilities) = 0;
     virtual Error setLayerPerFrameMetadataBlobs(
             Display display, Layer layer, const std::vector<PerFrameMetadataBlob>& metadata) = 0;
+    virtual Error getDisplayBrightnessSupport(Display display, bool* outSupport) = 0;
+    virtual Error setDisplayBrightness(Display display, float brightness) = 0;
 };
 
 namespace impl {
@@ -414,6 +416,8 @@
     Error setLayerPerFrameMetadataBlobs(
             Display display, Layer layer,
             const std::vector<IComposerClient::PerFrameMetadataBlob>& metadata) override;
+    Error getDisplayBrightnessSupport(Display display, bool* outSupport) override;
+    Error setDisplayBrightness(Display display, float brightness) override;
 
 private:
     class CommandWriter : public CommandWriterBase {
diff --git a/services/surfaceflinger/DisplayHardware/HWC2.cpp b/services/surfaceflinger/DisplayHardware/HWC2.cpp
index 910a527..62073b6 100644
--- a/services/surfaceflinger/DisplayHardware/HWC2.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWC2.cpp
@@ -277,6 +277,11 @@
         if (error == Error::None && dozeSupport) {
             mDisplayCapabilities.emplace(DisplayCapability::Doze);
         }
+        bool brightnessSupport = false;
+        error = static_cast<Error>(mComposer.getDisplayBrightnessSupport(mId, &brightnessSupport));
+        if (error == Error::None && brightnessSupport) {
+            mDisplayCapabilities.emplace(DisplayCapability::Brightness);
+        }
     }
     ALOGV("Created display %" PRIu64, id);
 }
@@ -710,6 +715,11 @@
     return error;
 }
 
+Error Display::setDisplayBrightness(float brightness) const {
+    auto intError = mComposer.setDisplayBrightness(mId, brightness);
+    return static_cast<Error>(intError);
+}
+
 // For use by Device
 
 void Display::setConnected(bool connected) {
diff --git a/services/surfaceflinger/DisplayHardware/HWC2.h b/services/surfaceflinger/DisplayHardware/HWC2.h
index f96614f..4209e45 100644
--- a/services/surfaceflinger/DisplayHardware/HWC2.h
+++ b/services/surfaceflinger/DisplayHardware/HWC2.h
@@ -264,6 +264,7 @@
     [[clang::warn_unused_result]] virtual Error presentOrValidate(
             uint32_t* outNumTypes, uint32_t* outNumRequests,
             android::sp<android::Fence>* outPresentFence, uint32_t* state) = 0;
+    [[clang::warn_unused_result]] virtual Error setDisplayBrightness(float brightness) const = 0;
 };
 
 namespace impl {
@@ -322,6 +323,7 @@
     Error validate(uint32_t* outNumTypes, uint32_t* outNumRequests) override;
     Error presentOrValidate(uint32_t* outNumTypes, uint32_t* outNumRequests,
                             android::sp<android::Fence>* outPresentFence, uint32_t* state) override;
+    Error setDisplayBrightness(float brightness) const override;
 
     // Other Display methods
     hwc2_display_t getId() const override { return mId; }
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index 3b9e0e6..1099041 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -784,6 +784,19 @@
     return NO_ERROR;
 }
 
+status_t HWComposer::setDisplayBrightness(DisplayId displayId, float brightness) {
+    RETURN_IF_INVALID_DISPLAY(displayId, BAD_INDEX);
+    const auto error = mDisplayData[displayId].hwcDisplay->setDisplayBrightness(brightness);
+    if (error == HWC2::Error::Unsupported) {
+        RETURN_IF_HWC_ERROR(error, displayId, INVALID_OPERATION);
+    }
+    if (error == HWC2::Error::BadParameter) {
+        RETURN_IF_HWC_ERROR(error, displayId, BAD_VALUE);
+    }
+    RETURN_IF_HWC_ERROR(error, displayId, UNKNOWN_ERROR);
+    return NO_ERROR;
+}
+
 bool HWComposer::isUsingVrComposer() const {
     return getComposer()->isUsingVrComposer();
 }
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.h b/services/surfaceflinger/DisplayHardware/HWComposer.h
index ca59a26..de863b8 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.h
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.h
@@ -140,6 +140,9 @@
                                                uint64_t timestamp,
                                                DisplayedFrameStats* outStats) = 0;
 
+    // Sets the brightness of a display.
+    virtual status_t setDisplayBrightness(DisplayId displayId, float brightness) = 0;
+
     // Events handling ---------------------------------------------------------
 
     // Returns stable display ID (and display name on connection of new or previously disconnected
@@ -271,6 +274,7 @@
                                               uint8_t componentMask, uint64_t maxFrames) override;
     status_t getDisplayedContentSample(DisplayId displayId, uint64_t maxFrames, uint64_t timestamp,
                                        DisplayedFrameStats* outStats) override;
+    status_t setDisplayBrightness(DisplayId displayId, float brightness) override;
 
     // Events handling ---------------------------------------------------------
 
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 5c3fb05..bdc2fa9 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -286,6 +286,14 @@
         return mEffectiveTransform;
     }
 
+    // If the layer is a buffer state layer, the active width and height
+    // could be infinite. In that case, return the effective transform.
+    const uint32_t activeWidth = getActiveWidth(getDrawingState());
+    const uint32_t activeHeight = getActiveHeight(getDrawingState());
+    if (activeWidth >= UINT32_MAX && activeHeight >= UINT32_MAX) {
+        return mEffectiveTransform;
+    }
+
     int bufferWidth;
     int bufferHeight;
     if ((mCurrentTransform & NATIVE_WINDOW_TRANSFORM_ROT_90) == 0) {
@@ -295,8 +303,9 @@
         bufferHeight = mActiveBuffer->getWidth();
         bufferWidth = mActiveBuffer->getHeight();
     }
-    float sx = getActiveWidth(getDrawingState()) / static_cast<float>(bufferWidth);
-    float sy = getActiveHeight(getDrawingState()) / static_cast<float>(bufferHeight);
+    float sx = activeWidth / static_cast<float>(bufferWidth);
+    float sy = activeHeight / static_cast<float>(bufferHeight);
+
     ui::Transform extraParentScaling;
     extraParentScaling.set(sx, 0, 0, sy);
     return mEffectiveTransform * extraParentScaling;
@@ -400,6 +409,15 @@
     Rect activeCrop = computeInitialCrop(display);
     Rect bufferSize = getBufferSize(s);
 
+    int32_t winWidth = bufferSize.getWidth();
+    int32_t winHeight = bufferSize.getHeight();
+
+    // The bufferSize for buffer state layers can be unbounded ([0, 0, -1, -1]) if display frame
+    // hasn't been set and the parent is an unbounded layer.
+    if (winWidth < 0 && winHeight < 0) {
+        return crop;
+    }
+
     // Transform the window crop to match the buffer coordinate system,
     // which means using the inverse of the current transform set on the
     // SurfaceFlingerConsumer.
@@ -419,8 +437,6 @@
                         ui::Transform(invTransform)).getOrientation();
     }
 
-    int winWidth = bufferSize.getWidth();
-    int winHeight = bufferSize.getHeight();
     if (invTransform & NATIVE_WINDOW_TRANSFORM_ROT_90) {
         // If the activeCrop has been rotate the ends are rotated but not
         // the space itself so when transforming ends back we can't rely on
diff --git a/services/surfaceflinger/LayerProtoHelper.cpp b/services/surfaceflinger/LayerProtoHelper.cpp
index 04e8796..c25c418 100644
--- a/services/surfaceflinger/LayerProtoHelper.cpp
+++ b/services/surfaceflinger/LayerProtoHelper.cpp
@@ -95,6 +95,9 @@
     const uint32_t type = transform.getType() | (transform.getOrientation() << 8);
     transformProto->set_type(type);
 
+    // Rotations that are 90/180/270 have their own type so the transform matrix can be
+    // reconstructed later. All other rotation have the type UKNOWN so we need to save the transform
+    // values in that case.
     if (type & (ui::Transform::SCALE | ui::Transform::UNKNOWN)) {
         transformProto->set_dsdx(transform[0][0]);
         transformProto->set_dtdx(transform[0][1]);
diff --git a/services/surfaceflinger/RegionSamplingThread.cpp b/services/surfaceflinger/RegionSamplingThread.cpp
index 4f0b3bb..718e996 100644
--- a/services/surfaceflinger/RegionSamplingThread.cpp
+++ b/services/surfaceflinger/RegionSamplingThread.cpp
@@ -101,7 +101,7 @@
 
         mPhaseIntervalSetting = Phase::ZERO;
         mScheduler.withPrimaryDispSync([this](android::DispSync& sync) {
-            sync.addEventListener("SamplingThreadDispSyncListener", 0, this);
+            sync.addEventListener("SamplingThreadDispSyncListener", 0, this, mLastCallbackTime);
         });
         mVsyncListening = true;
     }
@@ -115,8 +115,9 @@
     void stopVsyncListenerLocked() /*REQUIRES(mMutex)*/ {
         if (!mVsyncListening) return;
 
-        mScheduler.withPrimaryDispSync(
-                [this](android::DispSync& sync) { sync.removeEventListener(this); });
+        mScheduler.withPrimaryDispSync([this](android::DispSync& sync) {
+            sync.removeEventListener(this, &mLastCallbackTime);
+        });
         mVsyncListening = false;
     }
 
@@ -147,6 +148,7 @@
     Scheduler& mScheduler;
     const std::chrono::nanoseconds mTargetSamplingOffset;
     mutable std::mutex mMutex;
+    nsecs_t mLastCallbackTime = 0;
     enum class Phase {
         ZERO,
         SAMPLING
diff --git a/services/surfaceflinger/Scheduler/DispSync.cpp b/services/surfaceflinger/Scheduler/DispSync.cpp
index 1eccf9a..5296da9 100644
--- a/services/surfaceflinger/Scheduler/DispSync.cpp
+++ b/services/surfaceflinger/Scheduler/DispSync.cpp
@@ -76,9 +76,18 @@
     void updateModel(nsecs_t period, nsecs_t phase, nsecs_t referenceTime) {
         if (mTraceDetailedInfo) ATRACE_CALL();
         Mutex::Autolock lock(mMutex);
-        mPeriod = period;
+
         mPhase = phase;
         mReferenceTime = referenceTime;
+        if (mPeriod != 0 && mPeriod != period && mReferenceTime != 0) {
+            // Inflate the reference time to be the most recent predicted
+            // vsync before the current time.
+            const nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
+            const nsecs_t baseTime = now - mReferenceTime;
+            const nsecs_t numOldPeriods = baseTime / mPeriod;
+            mReferenceTime = mReferenceTime + (numOldPeriods)*mPeriod;
+        }
+        mPeriod = period;
         if (mTraceDetailedInfo) {
             ATRACE_INT64("DispSync:Period", mPeriod);
             ATRACE_INT64("DispSync:Phase", mPhase + mPeriod / 2);
@@ -176,7 +185,8 @@
         return false;
     }
 
-    status_t addEventListener(const char* name, nsecs_t phase, DispSync::Callback* callback) {
+    status_t addEventListener(const char* name, nsecs_t phase, DispSync::Callback* callback,
+                              nsecs_t lastCallbackTime) {
         if (mTraceDetailedInfo) ATRACE_CALL();
         Mutex::Autolock lock(mMutex);
 
@@ -192,8 +202,34 @@
         listener.mCallback = callback;
 
         // We want to allow the firstmost future event to fire without
-        // allowing any past events to fire
-        listener.mLastEventTime = systemTime() - mPeriod / 2 + mPhase - mWakeupLatency;
+        // allowing any past events to fire. To do this extrapolate from
+        // mReferenceTime the most recent hardware vsync, and pin the
+        // last event time there.
+        const nsecs_t now = systemTime(SYSTEM_TIME_MONOTONIC);
+        if (mPeriod != 0) {
+            const nsecs_t baseTime = now - mReferenceTime;
+            const nsecs_t numPeriodsSinceReference = baseTime / mPeriod;
+            const nsecs_t predictedReference = mReferenceTime + numPeriodsSinceReference * mPeriod;
+            const nsecs_t phaseCorrection = mPhase + listener.mPhase;
+            const nsecs_t predictedLastEventTime = predictedReference + phaseCorrection;
+            if (predictedLastEventTime >= now) {
+                // Make sure that the last event time does not exceed the current time.
+                // If it would, then back the last event time by a period.
+                listener.mLastEventTime = predictedLastEventTime - mPeriod;
+            } else {
+                listener.mLastEventTime = predictedLastEventTime;
+            }
+        } else {
+            listener.mLastEventTime = now + mPhase - mWakeupLatency;
+        }
+
+        if (lastCallbackTime <= 0) {
+            // If there is no prior callback time, try to infer one based on the
+            // logical last event time.
+            listener.mLastCallbackTime = listener.mLastEventTime + mWakeupLatency;
+        } else {
+            listener.mLastCallbackTime = lastCallbackTime;
+        }
 
         mEventListeners.push_back(listener);
 
@@ -202,13 +238,14 @@
         return NO_ERROR;
     }
 
-    status_t removeEventListener(DispSync::Callback* callback) {
+    status_t removeEventListener(DispSync::Callback* callback, nsecs_t* outLastCallback) {
         if (mTraceDetailedInfo) ATRACE_CALL();
         Mutex::Autolock lock(mMutex);
 
         for (std::vector<EventListener>::iterator it = mEventListeners.begin();
              it != mEventListeners.end(); ++it) {
             if (it->mCallback == callback) {
+                *outLastCallback = it->mLastCallbackTime;
                 mEventListeners.erase(it);
                 mCond.signal();
                 return NO_ERROR;
@@ -250,6 +287,7 @@
         const char* mName;
         nsecs_t mPhase;
         nsecs_t mLastEventTime;
+        nsecs_t mLastCallbackTime;
         DispSync::Callback* mCallback;
     };
 
@@ -274,6 +312,13 @@
         return nextEventTime;
     }
 
+    // Sanity check that the duration is close enough in length to a period without
+    // falling into double-rate vsyncs.
+    bool isCloseToPeriod(nsecs_t duration) {
+        // Ratio of 3/5 is arbitrary, but it must be greater than 1/2.
+        return duration < (3 * mPeriod) / 5;
+    }
+
     std::vector<CallbackInvocation> gatherCallbackInvocationsLocked(nsecs_t now) {
         if (mTraceDetailedInfo) ATRACE_CALL();
         ALOGV("[%s] gatherCallbackInvocationsLocked @ %" PRId64, mName, ns2us(now));
@@ -285,12 +330,21 @@
             nsecs_t t = computeListenerNextEventTimeLocked(eventListener, onePeriodAgo);
 
             if (t < now) {
+                if (isCloseToPeriod(now - eventListener.mLastCallbackTime)) {
+                    eventListener.mLastEventTime = t;
+                    eventListener.mLastCallbackTime = now;
+                    ALOGV("[%s] [%s] Skipping event due to model error", mName,
+                          eventListener.mName);
+                    continue;
+                }
                 CallbackInvocation ci;
                 ci.mCallback = eventListener.mCallback;
                 ci.mEventTime = t;
-                ALOGV("[%s] [%s] Preparing to fire", mName, eventListener.mName);
+                ALOGV("[%s] [%s] Preparing to fire, latency: %" PRId64, mName, eventListener.mName,
+                      t - eventListener.mLastEventTime);
                 callbackInvocations.push_back(ci);
                 eventListener.mLastEventTime = t;
+                eventListener.mLastCallbackTime = now;
             }
         }
 
@@ -337,7 +391,7 @@
 
         // Check that it's been slightly more than half a period since the last
         // event so that we don't accidentally fall into double-rate vsyncs
-        if (t - listener.mLastEventTime < (3 * mPeriod / 5)) {
+        if (isCloseToPeriod(t - listener.mLastEventTime)) {
             t += mPeriod;
             ALOGV("[%s] Modifying t -> %" PRId64, mName, ns2us(t));
         }
@@ -399,7 +453,10 @@
     mThread = new DispSyncThread(name, mTraceDetailedInfo);
 }
 
-DispSync::~DispSync() {}
+DispSync::~DispSync() {
+    mThread->stop();
+    mThread->requestExitAndWait();
+}
 
 void DispSync::init(bool hasSyncFramework, int64_t dispSyncPresentTimeOffset) {
     mIgnorePresentFences = !hasSyncFramework;
@@ -418,7 +475,7 @@
 
     if (mTraceDetailedInfo && kEnableZeroPhaseTracer) {
         mZeroPhaseTracer = std::make_unique<ZeroPhaseTracer>();
-        addEventListener("ZeroPhaseTracer", 0, mZeroPhaseTracer.get());
+        addEventListener("ZeroPhaseTracer", 0, mZeroPhaseTracer.get(), 0);
     }
 }
 
@@ -429,8 +486,16 @@
 
 void DispSync::resetLocked() {
     mPhase = 0;
-    mReferenceTime = 0;
+    const size_t lastSampleIdx = (mFirstResyncSample + mNumResyncSamples - 1) % MAX_RESYNC_SAMPLES;
+    // Keep the most recent sample, when we resync to hardware we'll overwrite this
+    // with a more accurate signal
+    if (mResyncSamples[lastSampleIdx] != 0) {
+        mReferenceTime = mResyncSamples[lastSampleIdx];
+    }
     mModelUpdated = false;
+    for (size_t i = 0; i < MAX_RESYNC_SAMPLES; i++) {
+        mResyncSamples[i] = 0;
+    }
     mNumResyncSamples = 0;
     mFirstResyncSample = 0;
     mNumResyncSamplesSincePresent = 0;
@@ -504,9 +569,10 @@
 
 void DispSync::endResync() {}
 
-status_t DispSync::addEventListener(const char* name, nsecs_t phase, Callback* callback) {
+status_t DispSync::addEventListener(const char* name, nsecs_t phase, Callback* callback,
+                                    nsecs_t lastCallbackTime) {
     Mutex::Autolock lock(mMutex);
-    return mThread->addEventListener(name, phase, callback);
+    return mThread->addEventListener(name, phase, callback, lastCallbackTime);
 }
 
 void DispSync::setRefreshSkipCount(int count) {
@@ -516,9 +582,9 @@
     updateModelLocked();
 }
 
-status_t DispSync::removeEventListener(Callback* callback) {
+status_t DispSync::removeEventListener(Callback* callback, nsecs_t* outLastCallbackTime) {
     Mutex::Autolock lock(mMutex);
-    return mThread->removeEventListener(callback);
+    return mThread->removeEventListener(callback, outLastCallbackTime);
 }
 
 status_t DispSync::changePhaseOffset(Callback* callback, nsecs_t phase) {
@@ -530,7 +596,6 @@
     Mutex::Autolock lock(mMutex);
     mPeriod = period;
     mPhase = 0;
-    mReferenceTime = 0;
     mThread->updateModel(mPeriod, mPhase, mReferenceTime);
 }
 
diff --git a/services/surfaceflinger/Scheduler/DispSync.h b/services/surfaceflinger/Scheduler/DispSync.h
index f629697..de2b874 100644
--- a/services/surfaceflinger/Scheduler/DispSync.h
+++ b/services/surfaceflinger/Scheduler/DispSync.h
@@ -54,8 +54,9 @@
     virtual void setPeriod(nsecs_t period) = 0;
     virtual nsecs_t getPeriod() = 0;
     virtual void setRefreshSkipCount(int count) = 0;
-    virtual status_t addEventListener(const char* name, nsecs_t phase, Callback* callback) = 0;
-    virtual status_t removeEventListener(Callback* callback) = 0;
+    virtual status_t addEventListener(const char* name, nsecs_t phase, Callback* callback,
+                                      nsecs_t lastCallbackTime) = 0;
+    virtual status_t removeEventListener(Callback* callback, nsecs_t* outLastCallback) = 0;
     virtual status_t changePhaseOffset(Callback* callback, nsecs_t phase) = 0;
     virtual nsecs_t computeNextRefresh(int periodOffset) const = 0;
     virtual void setIgnorePresentFences(bool ignore) = 0;
@@ -139,12 +140,21 @@
     // given phase offset from the hardware vsync events.  The callback is
     // called from a separate thread and it should return reasonably quickly
     // (i.e. within a few hundred microseconds).
-    status_t addEventListener(const char* name, nsecs_t phase, Callback* callback) override;
+    // If the callback was previously registered, and the last clock time the
+    // callback was invoked was known to the caller (e.g. via removeEventListener),
+    // then the caller may pass that through to lastCallbackTime, so that
+    // callbacks do not accidentally double-fire if they are unregistered and
+    // reregistered in rapid succession.
+    status_t addEventListener(const char* name, nsecs_t phase, Callback* callback,
+                              nsecs_t lastCallbackTime) override;
 
     // removeEventListener removes an already-registered event callback.  Once
     // this method returns that callback will no longer be called by the
     // DispSync object.
-    status_t removeEventListener(Callback* callback) override;
+    // outLastCallbackTime will contain the last time that the callback was invoked.
+    // If the caller wishes to reregister the same callback, they should pass the
+    // callback time back into lastCallbackTime (see addEventListener).
+    status_t removeEventListener(Callback* callback, nsecs_t* outLastCallbackTime) override;
 
     // changePhaseOffset changes the phase offset of an already-registered event callback. The
     // method will make sure that there is no skipping or double-firing on the listener per frame,
@@ -213,7 +223,7 @@
     // These member variables are the state used during the resynchronization
     // process to store information about the hardware vsync event times used
     // to compute the model.
-    nsecs_t mResyncSamples[MAX_RESYNC_SAMPLES];
+    nsecs_t mResyncSamples[MAX_RESYNC_SAMPLES] = {0};
     size_t mFirstResyncSample;
     size_t mNumResyncSamples;
     int mNumResyncSamplesSincePresent;
diff --git a/services/surfaceflinger/Scheduler/DispSyncSource.cpp b/services/surfaceflinger/Scheduler/DispSyncSource.cpp
index d848c97..6e89648 100644
--- a/services/surfaceflinger/Scheduler/DispSyncSource.cpp
+++ b/services/surfaceflinger/Scheduler/DispSyncSource.cpp
@@ -40,13 +40,15 @@
     std::lock_guard lock(mVsyncMutex);
     if (enable) {
         status_t err = mDispSync->addEventListener(mName, mPhaseOffset,
-                                                   static_cast<DispSync::Callback*>(this));
+                                                   static_cast<DispSync::Callback*>(this),
+                                                   mLastCallbackTime);
         if (err != NO_ERROR) {
             ALOGE("error registering vsync callback: %s (%d)", strerror(-err), err);
         }
         // ATRACE_INT(mVsyncOnLabel.c_str(), 1);
     } else {
-        status_t err = mDispSync->removeEventListener(static_cast<DispSync::Callback*>(this));
+        status_t err = mDispSync->removeEventListener(static_cast<DispSync::Callback*>(this),
+                                                      &mLastCallbackTime);
         if (err != NO_ERROR) {
             ALOGE("error unregistering vsync callback: %s (%d)", strerror(-err), err);
         }
diff --git a/services/surfaceflinger/Scheduler/DispSyncSource.h b/services/surfaceflinger/Scheduler/DispSyncSource.h
index 5e3d181..2858678 100644
--- a/services/surfaceflinger/Scheduler/DispSyncSource.h
+++ b/services/surfaceflinger/Scheduler/DispSyncSource.h
@@ -45,6 +45,7 @@
     const bool mTraceVsync;
     const std::string mVsyncOnLabel;
     const std::string mVsyncEventLabel;
+    nsecs_t mLastCallbackTime GUARDED_BY(mVsyncMutex) = 0;
 
     DispSync* mDispSync;
 
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index b605cb2..5b11c4f 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -274,6 +274,7 @@
         mDebugInTransaction(0),
         mLastTransactionTime(0),
         mForceFullDamage(false),
+        mTracing(*this),
         mTimeStats(factory.createTimeStats()),
         mRefreshStartTime(0),
         mHasPoweredOff(false),
@@ -1307,6 +1308,33 @@
     mRegionSamplingThread->removeListener(listener);
     return NO_ERROR;
 }
+
+status_t SurfaceFlinger::getDisplayBrightnessSupport(const sp<IBinder>& displayToken,
+                                                     bool* outSupport) const {
+    if (!displayToken || !outSupport) {
+        return BAD_VALUE;
+    }
+    const auto displayId = getPhysicalDisplayIdLocked(displayToken);
+    if (!displayId) {
+        return NAME_NOT_FOUND;
+    }
+    *outSupport =
+            getHwComposer().hasDisplayCapability(displayId, HWC2::DisplayCapability::Brightness);
+    return NO_ERROR;
+}
+
+status_t SurfaceFlinger::setDisplayBrightness(const sp<IBinder>& displayToken,
+                                              float brightness) const {
+    if (!displayToken) {
+        return BAD_VALUE;
+    }
+    const auto displayId = getPhysicalDisplayIdLocked(displayToken);
+    if (!displayId) {
+        return NAME_NOT_FOUND;
+    }
+    return getHwComposer().setDisplayBrightness(*displayId, brightness);
+}
+
 // ----------------------------------------------------------------------------
 
 sp<IDisplayEventConnection> SurfaceFlinger::createDisplayEventConnection(
@@ -1588,6 +1616,14 @@
                 mTimeStats->incrementMissedFrames();
             }
 
+            if (hwcFrameMissed) {
+                mHwcFrameMissedCount++;
+            }
+
+            if (gpuFrameMissed) {
+                mGpuFrameMissedCount++;
+            }
+
             if (mUseSmart90ForVideo) {
                 // This call is made each time SF wakes up and creates a new frame. It is part
                 // of video detection feature.
@@ -1671,7 +1707,6 @@
         doComposition(display, repaintEverything);
     }
 
-    doTracing("handleRefresh");
     logLayerStats();
 
     postFrame();
@@ -1700,6 +1735,9 @@
 
     if (mVisibleRegionsDirty) {
         computeLayerBounds();
+        if (mTracingEnabled) {
+            mTracing.notify("visibleRegionsDirty");
+        }
     }
 
     for (auto& layer : mLayersPendingRefresh) {
@@ -1838,14 +1876,6 @@
     prepareFrame(displayDevice);
 }
 
-void SurfaceFlinger::doTracing(const char* where) {
-    ATRACE_CALL();
-    ATRACE_NAME(where);
-    if (CC_UNLIKELY(mTracing.isEnabled())) {
-        mTracing.traceLayers(where, dumpProtoInfo(LayerVector::StateSet::Drawing));
-    }
-}
-
 void SurfaceFlinger::logLayerStats() {
     ATRACE_CALL();
     if (CC_UNLIKELY(mLayerStats.isEnabled())) {
@@ -2920,18 +2950,39 @@
     // we composite should be considered an animation as well.
     mAnimCompositionPending = mAnimTransactionPending;
 
-    mDrawingState = mCurrentState;
-    // clear the "changed" flags in current state
-    mCurrentState.colorMatrixChanged = false;
+    withTracingLock([&]() {
+        mDrawingState = mCurrentState;
+        // clear the "changed" flags in current state
+        mCurrentState.colorMatrixChanged = false;
 
-    mDrawingState.traverseInZOrder([](Layer* layer) {
-        layer->commitChildList();
+        mDrawingState.traverseInZOrder([](Layer* layer) { layer->commitChildList(); });
     });
+
     mTransactionPending = false;
     mAnimTransactionPending = false;
     mTransactionCV.broadcast();
 }
 
+void SurfaceFlinger::withTracingLock(std::function<void()> lockedOperation) {
+    if (mTracingEnabledChanged) {
+        mTracingEnabled = mTracing.isEnabled();
+        mTracingEnabledChanged = false;
+    }
+
+    // Synchronize with Tracing thread
+    std::unique_lock<std::mutex> lock;
+    if (mTracingEnabled) {
+        lock = std::unique_lock<std::mutex>(mDrawingStateLock);
+    }
+
+    lockedOperation();
+
+    // Synchronize with Tracing thread
+    if (mTracingEnabled) {
+        lock.unlock();
+    }
+}
+
 void SurfaceFlinger::computeVisibleRegions(const sp<const DisplayDevice>& displayDevice,
                                            Region& outDirtyRegion, Region& outOpaqueRegion) {
     ATRACE_CALL();
@@ -4636,7 +4687,9 @@
     dumpStaticScreenStats(result);
     result.append("\n");
 
-    StringAppendF(&result, "Missed frame count: %u\n\n", mFrameMissedCount.load());
+    StringAppendF(&result, "Total missed frame count: %u\n", mFrameMissedCount.load());
+    StringAppendF(&result, "HWC missed frame count: %u\n", mHwcFrameMissedCount.load());
+    StringAppendF(&result, "GPU missed frame count: %u\n\n", mGpuFrameMissedCount.load());
 
     dumpBufferingStats(result);
 
@@ -4807,7 +4860,6 @@
         case CREATE_DISPLAY:
         case DESTROY_DISPLAY:
         case ENABLE_VSYNC_INJECTIONS:
-        case GET_ACTIVE_COLOR_MODE:
         case GET_ANIMATION_FRAME_STATS:
         case GET_HDR_CAPABILITIES:
         case SET_ACTIVE_CONFIG:
@@ -4843,6 +4895,7 @@
         // request necessary permissions. However, they do not expose any secret
         // information, so it is OK to pass them.
         case AUTHENTICATE_SURFACE:
+        case GET_ACTIVE_COLOR_MODE:
         case GET_ACTIVE_CONFIG:
         case GET_PHYSICAL_DISPLAY_IDS:
         case GET_PHYSICAL_DISPLAY_TOKEN:
@@ -4858,7 +4911,9 @@
         case GET_COLOR_MANAGEMENT:
         case GET_COMPOSITION_PREFERENCE:
         case GET_PROTECTED_CONTENT_SUPPORT:
-        case IS_WIDE_COLOR_DISPLAY: {
+        case IS_WIDE_COLOR_DISPLAY:
+        case GET_DISPLAY_BRIGHTNESS_SUPPORT:
+        case SET_DISPLAY_BRIGHTNESS: {
             return OK;
         }
         case CAPTURE_LAYERS:
@@ -5090,13 +5145,24 @@
                 n = data.readInt32();
                 if (n) {
                     ALOGD("LayerTracing enabled");
+                    Mutex::Autolock lock(mStateLock);
+                    mTracingEnabledChanged = true;
                     mTracing.enable();
-                    doTracing("tracing.enable");
                     reply->writeInt32(NO_ERROR);
                 } else {
                     ALOGD("LayerTracing disabled");
-                    status_t err = mTracing.disable();
-                    reply->writeInt32(err);
+                    bool writeFile = false;
+                    {
+                        Mutex::Autolock lock(mStateLock);
+                        mTracingEnabledChanged = true;
+                        writeFile = mTracing.disable();
+                    }
+
+                    if (writeFile) {
+                        reply->writeInt32(mTracing.writeToFile());
+                    } else {
+                        reply->writeInt32(NO_ERROR);
+                    }
                 }
                 return NO_ERROR;
             }
@@ -5135,6 +5201,20 @@
                 reply->writeBool(getHwComposer().isUsingVrComposer());
                 return NO_ERROR;
             }
+            // Set buffer size for SF tracing (value in KB)
+            case 1029: {
+                n = data.readInt32();
+                if (n <= 0 || n > MAX_TRACING_MEMORY) {
+                    ALOGW("Invalid buffer size: %d KB", n);
+                    reply->writeInt32(BAD_VALUE);
+                    return BAD_VALUE;
+                }
+
+                ALOGD("Updating trace buffer to %d KB", n);
+                mTracing.setBufferSize(n * 1024);
+                reply->writeInt32(NO_ERROR);
+                return NO_ERROR;
+            }
             // Is device color managed?
             case 1030: {
                 reply->writeBool(useColorManagement);
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index e79c4ee..118253f 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -367,6 +367,7 @@
     friend class BufferStateLayer;
     friend class MonitoredProducer;
     friend class RegionSamplingThread;
+    friend class SurfaceTracing;
 
     // For unit tests
     friend class TestableSurfaceFlinger;
@@ -376,6 +377,7 @@
     enum { LOG_FRAME_STATS_PERIOD =  30*60*60 };
 
     static const size_t MAX_LAYERS = 4096;
+    static const int MAX_TRACING_MEMORY = 100 * 1024 * 1024; // 100MB
 
     // We're reference counted, never destroy SurfaceFlinger directly
     virtual ~SurfaceFlinger();
@@ -492,6 +494,9 @@
                                       const std::vector<int32_t>& allowedConfigs) override;
     status_t getAllowedDisplayConfigs(const sp<IBinder>& displayToken,
                                       std::vector<int32_t>* outAllowedConfigs) override;
+    status_t getDisplayBrightnessSupport(const sp<IBinder>& displayToken,
+                                         bool* outSupport) const override;
+    status_t setDisplayBrightness(const sp<IBinder>& displayToken, float brightness) const override;
 
     /* ------------------------------------------------------------------------
      * DeathRecipient interface
@@ -581,7 +586,7 @@
     uint32_t setTransactionFlags(uint32_t flags);
     uint32_t setTransactionFlags(uint32_t flags, Scheduler::TransactionStart transactionStart);
     void latchAndReleaseBuffer(const sp<Layer>& layer);
-    void commitTransaction();
+    void commitTransaction() REQUIRES(mStateLock);
     bool containsAnyInvalidClientState(const Vector<ComposerState>& states);
     bool transactionIsReadyToBeApplied(int64_t desiredPresentTime,
                                        const Vector<ComposerState>& states);
@@ -775,7 +780,6 @@
     void prepareFrame(const sp<DisplayDevice>& display);
     void doComposition(const sp<DisplayDevice>& display, bool repainEverything);
     void doDebugFlashRegions(const sp<DisplayDevice>& display, bool repaintEverything);
-    void doTracing(const char* where);
     void logLayerStats();
     void doDisplayComposition(const sp<DisplayDevice>& display, const Region& dirtyRegion);
 
@@ -892,6 +896,7 @@
     void dumpDisplayIdentificationData(std::string& result) const;
     void dumpWideColorInfo(std::string& result) const;
     LayersProto dumpProtoInfo(LayerVector::StateSet stateSet) const;
+    void withTracingLock(std::function<void()> operation) REQUIRES(mStateLock);
     LayersProto dumpVisibleLayersProtoInfo(const sp<DisplayDevice>& display) const;
 
     bool isLayerTripleBufferingDisabled() const {
@@ -933,6 +938,9 @@
     bool mAnimTransactionPending;
     SortedVector< sp<Layer> > mLayersPendingRemoval;
 
+    // guards access to the mDrawing state if tracing is enabled.
+    mutable std::mutex mDrawingStateLock;
+
     // global color transform states
     Daltonizer mDaltonizer;
     float mGlobalSaturationFactor = 1.0f;
@@ -1011,10 +1019,14 @@
     bool mPropagateBackpressure = true;
     std::unique_ptr<SurfaceInterceptor> mInterceptor{mFactory.createSurfaceInterceptor(this)};
     SurfaceTracing mTracing;
+    bool mTracingEnabled = false;
+    bool mTracingEnabledChanged GUARDED_BY(mStateLock) = false;
     LayerStats mLayerStats;
     std::shared_ptr<TimeStats> mTimeStats;
     bool mUseHwcVirtualDisplays = false;
     std::atomic<uint32_t> mFrameMissedCount{0};
+    std::atomic<uint32_t> mHwcFrameMissedCount{0};
+    std::atomic<uint32_t> mGpuFrameMissedCount{0};
 
     TransactionCompletedThread mTransactionCompletedThread;
 
diff --git a/services/surfaceflinger/SurfaceTracing.cpp b/services/surfaceflinger/SurfaceTracing.cpp
index b7e9a91..f1c4347 100644
--- a/services/surfaceflinger/SurfaceTracing.cpp
+++ b/services/surfaceflinger/SurfaceTracing.cpp
@@ -18,6 +18,7 @@
 #define ATRACE_TAG ATRACE_TAG_GRAPHICS
 
 #include "SurfaceTracing.h"
+#include <SurfaceFlinger.h>
 
 #include <android-base/file.h>
 #include <android-base/stringprintf.h>
@@ -27,6 +28,48 @@
 
 namespace android {
 
+void SurfaceTracing::mainLoop() {
+    bool enabled = true;
+    // Upon activation, logs the first frame
+    traceLayers("tracing.enable");
+    do {
+        std::unique_lock<std::mutex> sfLock(mFlinger.mDrawingStateLock);
+        mConditionalVariable.wait(sfLock);
+        LayersTraceProto entry = traceLayersLocked(mWhere);
+        sfLock.unlock();
+        {
+            std::scoped_lock bufferLock(mTraceLock);
+            mBuffer.emplace(std::move(entry));
+            if (mWriteToFile) {
+                writeProtoFileLocked();
+                mWriteToFile = false;
+            }
+
+            enabled = mEnabled;
+        }
+    } while (enabled);
+}
+
+void SurfaceTracing::traceLayers(const char* where) {
+    std::unique_lock<std::mutex> sfLock(mFlinger.mDrawingStateLock);
+    LayersTraceProto entry = traceLayersLocked(where);
+    sfLock.unlock();
+    std::scoped_lock bufferLock(mTraceLock);
+    mBuffer.emplace(std::move(entry));
+}
+
+void SurfaceTracing::notify(const char* where) {
+    std::lock_guard<std::mutex> sfLock(mFlinger.mDrawingStateLock);
+    mWhere = strdup(where);
+    mConditionalVariable.notify_one();
+}
+
+void SurfaceTracing::writeToFileAsync() {
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
+    mWriteToFile = true;
+    mConditionalVariable.notify_one();
+}
+
 void SurfaceTracing::LayersTraceBuffer::reset(size_t newSize) {
     // use the swap trick to make sure memory is released
     std::queue<LayersTraceProto>().swap(mStorage);
@@ -58,50 +101,60 @@
     }
 }
 
-void SurfaceTracing::enable(size_t bufferSizeInByte) {
-    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
+void SurfaceTracing::enable() {
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
 
     if (mEnabled) {
         return;
     }
+
+    mBuffer.reset(mBufferSize);
     mEnabled = true;
-    mBuffer.reset(bufferSizeInByte);
+    mThread = std::thread(&SurfaceTracing::mainLoop, this);
 }
 
-status_t SurfaceTracing::disable() {
-    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
+status_t SurfaceTracing::writeToFile() {
+    mThread.join();
+    return mLastErr;
+}
+
+bool SurfaceTracing::disable() {
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
 
     if (!mEnabled) {
-        return NO_ERROR;
+        return false;
     }
+
     mEnabled = false;
-    status_t err(writeProtoFileLocked());
-    ALOGE_IF(err == PERMISSION_DENIED, "Could not save the proto file! Permission denied");
-    ALOGE_IF(err == NOT_ENOUGH_DATA, "Could not save the proto file! There are missing fields");
-    mBuffer.reset(0);
-    return err;
+    mWriteToFile = true;
+    mConditionalVariable.notify_all();
+    return true;
 }
 
 bool SurfaceTracing::isEnabled() const {
-    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
     return mEnabled;
 }
 
-void SurfaceTracing::traceLayers(const char* where, LayersProto layers) {
-    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
-    if (!mEnabled) {
-        return;
-    }
+void SurfaceTracing::setBufferSize(size_t bufferSizeInByte) {
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
+    mBufferSize = bufferSizeInByte;
+    mBuffer.setSize(bufferSizeInByte);
+}
+
+LayersTraceProto SurfaceTracing::traceLayersLocked(const char* where) {
+    ATRACE_CALL();
 
     LayersTraceProto entry;
     entry.set_elapsed_realtime_nanos(elapsedRealtimeNano());
     entry.set_where(where);
+    LayersProto layers(mFlinger.dumpProtoInfo(LayerVector::StateSet::Drawing));
     entry.mutable_layers()->Swap(&layers);
 
-    mBuffer.emplace(std::move(entry));
+    return entry;
 }
 
-status_t SurfaceTracing::writeProtoFileLocked() {
+void SurfaceTracing::writeProtoFileLocked() {
     ATRACE_CALL();
 
     LayersTraceFileProto fileProto;
@@ -110,19 +163,23 @@
     fileProto.set_magic_number(uint64_t(LayersTraceFileProto_MagicNumber_MAGIC_NUMBER_H) << 32 |
                                LayersTraceFileProto_MagicNumber_MAGIC_NUMBER_L);
     mBuffer.flush(&fileProto);
+    mBuffer.reset(mBufferSize);
 
     if (!fileProto.SerializeToString(&output)) {
-        return PERMISSION_DENIED;
+        ALOGE("Could not save the proto file! Permission denied");
+        mLastErr = PERMISSION_DENIED;
     }
-    if (!android::base::WriteStringToFile(output, kDefaultFileName, true)) {
-        return PERMISSION_DENIED;
+    if (!android::base::WriteStringToFile(output, kDefaultFileName, S_IRWXU | S_IRGRP, getuid(),
+                                          getgid(), true)) {
+        ALOGE("Could not save the proto file! There are missing fields");
+        mLastErr = PERMISSION_DENIED;
     }
 
-    return NO_ERROR;
+    mLastErr = NO_ERROR;
 }
 
 void SurfaceTracing::dump(std::string& result) const {
-    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
+    std::lock_guard<std::mutex> bufferLock(mTraceLock);
 
     base::StringAppendF(&result, "Tracing state: %s\n", mEnabled ? "enabled" : "disabled");
     base::StringAppendF(&result, "  number of entries: %zu (%.2fMB / %.2fMB)\n",
diff --git a/services/surfaceflinger/SurfaceTracing.h b/services/surfaceflinger/SurfaceTracing.h
index fd919af..a75ac61 100644
--- a/services/surfaceflinger/SurfaceTracing.h
+++ b/services/surfaceflinger/SurfaceTracing.h
@@ -18,30 +18,38 @@
 
 #include <layerproto/LayerProtoHeader.h>
 #include <utils/Errors.h>
+#include <utils/StrongPointer.h>
 
+#include <android-base/thread_annotations.h>
+#include <condition_variable>
 #include <memory>
 #include <mutex>
 #include <queue>
+#include <thread>
 
 using namespace android::surfaceflinger;
 
 namespace android {
 
+class SurfaceFlinger;
+
 constexpr auto operator""_MB(unsigned long long const num) {
     return num * 1024 * 1024;
 }
-
 /*
  * SurfaceTracing records layer states during surface flinging.
  */
 class SurfaceTracing {
 public:
-    void enable() { enable(kDefaultBufferCapInByte); }
-    void enable(size_t bufferSizeInByte);
-    status_t disable();
-    void traceLayers(const char* where, LayersProto);
-
+    SurfaceTracing(SurfaceFlinger& flinger) : mFlinger(flinger) {}
+    void enable();
+    bool disable();
+    status_t writeToFile();
     bool isEnabled() const;
+    void notify(const char* where);
+
+    void setBufferSize(size_t bufferSizeInByte);
+    void writeToFileAsync();
     void dump(std::string& result) const;
 
 private:
@@ -54,6 +62,7 @@
         size_t used() const { return mUsedInBytes; }
         size_t frameCount() const { return mStorage.size(); }
 
+        void setSize(size_t newSize) { mSizeInBytes = newSize; }
         void reset(size_t newSize);
         void emplace(LayersTraceProto&& proto);
         void flush(LayersTraceFileProto* fileProto);
@@ -64,11 +73,23 @@
         std::queue<LayersTraceProto> mStorage;
     };
 
-    status_t writeProtoFileLocked();
+    void mainLoop();
+    void traceLayers(const char* where);
+    LayersTraceProto traceLayersLocked(const char* where);
+    void writeProtoFileLocked() REQUIRES(mTraceLock);
 
-    bool mEnabled = false;
-    mutable std::mutex mTraceMutex;
-    LayersTraceBuffer mBuffer;
+    const SurfaceFlinger& mFlinger;
+
+    char* mWhere;
+    status_t mLastErr = NO_ERROR;
+    std::thread mThread;
+    std::condition_variable mConditionalVariable;
+    mutable std::mutex mTraceLock;
+
+    LayersTraceBuffer mBuffer GUARDED_BY(mTraceLock);
+    size_t mBufferSize GUARDED_BY(mTraceLock) = kDefaultBufferCapInByte;
+    bool mEnabled GUARDED_BY(mTraceLock) = false;
+    bool mWriteToFile GUARDED_BY(mTraceLock) = false;
 };
 
 } // namespace android
diff --git a/services/surfaceflinger/tests/Credentials_test.cpp b/services/surfaceflinger/tests/Credentials_test.cpp
index 61d09da..b667a74 100644
--- a/services/surfaceflinger/tests/Credentials_test.cpp
+++ b/services/surfaceflinger/tests/Credentials_test.cpp
@@ -12,7 +12,6 @@
 
 #include <private/android_filesystem_config.h>
 #include <private/gui/ComposerService.h>
-
 #include <ui/DisplayInfo.h>
 #include <utils/String8.h>
 
@@ -356,4 +355,11 @@
     ASSERT_NO_FATAL_FAILURE(checkWithPrivileges<status_t>(condition, NO_ERROR, NO_ERROR));
 }
 
+TEST_F(CredentialsTest, GetActiveColorModeBasicCorrectness) {
+    const auto display = SurfaceComposerClient::getInternalDisplayToken();
+    ASSERT_FALSE(display == nullptr);
+    ColorMode colorMode = SurfaceComposerClient::getActiveColorMode(display);
+    ASSERT_NE(static_cast<ColorMode>(BAD_VALUE), colorMode);
+}
+
 } // namespace android
diff --git a/services/surfaceflinger/tests/Transaction_test.cpp b/services/surfaceflinger/tests/Transaction_test.cpp
index 319e01c..bc5642e 100644
--- a/services/surfaceflinger/tests/Transaction_test.cpp
+++ b/services/surfaceflinger/tests/Transaction_test.cpp
@@ -32,8 +32,9 @@
 #include <gui/LayerState.h>
 #include <gui/Surface.h>
 #include <gui/SurfaceComposerClient.h>
-#include <private/gui/ComposerService.h>
+#include <hardware/hwcomposer_defs.h>
 #include <private/android_filesystem_config.h>
+#include <private/gui/ComposerService.h>
 
 #include <ui/ColorSpace.h>
 #include <ui/DisplayInfo.h>
@@ -2022,8 +2023,8 @@
 
     Transaction().setCrop(layer, crop).apply();
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetCropEmpty_BufferQueue) {
@@ -2053,13 +2054,13 @@
     {
         SCOPED_TRACE("empty rect");
         Transaction().setCrop(layer, Rect(8, 8, 8, 8)).apply();
-        getScreenCapture()->expectColor(Rect(0, 0, 32, 32), Color::RED);
+        getScreenCapture()->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
     }
 
     {
         SCOPED_TRACE("negative rect");
         Transaction().setCrop(layer, Rect(8, 8, 0, 0)).apply();
-        getScreenCapture()->expectColor(Rect(0, 0, 32, 32), Color::RED);
+        getScreenCapture()->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
     }
 }
 
@@ -2076,37 +2077,36 @@
 
 TEST_P(LayerRenderTypeTransactionTest, SetCropOutOfBounds_BufferState) {
     sp<SurfaceControl> layer;
-    ASSERT_NO_FATAL_FAILURE(layer = createLayer("test", mDisplayWidth, mDisplayHeight / 2,
-                                                ISurfaceComposerClient::eFXSurfaceBufferState));
+    ASSERT_NO_FATAL_FAILURE(
+            layer = createLayer("test", 32, 64, ISurfaceComposerClient::eFXSurfaceBufferState));
     sp<GraphicBuffer> buffer =
-            new GraphicBuffer(mDisplayWidth, mDisplayHeight / 2, PIXEL_FORMAT_RGBA_8888, 1,
+            new GraphicBuffer(32, 64, PIXEL_FORMAT_RGBA_8888, 1,
                               BufferUsage::CPU_READ_OFTEN | BufferUsage::CPU_WRITE_OFTEN |
                                       BufferUsage::COMPOSER_OVERLAY,
                               "test");
-    fillGraphicBufferColor(buffer, Rect(0, 0, mDisplayWidth, mDisplayHeight / 4), Color::BLUE);
-    fillGraphicBufferColor(buffer, Rect(0, mDisplayHeight / 4, mDisplayWidth, mDisplayHeight / 2),
-                           Color::RED);
+    fillGraphicBufferColor(buffer, Rect(0, 0, 32, 16), Color::BLUE);
+    fillGraphicBufferColor(buffer, Rect(0, 16, 32, 64), Color::RED);
+
+    Transaction().setFrame(layer, Rect(0, 0, 64, 64)).apply();
 
     Transaction().setBuffer(layer, buffer).apply();
 
     // Partially out of bounds in the negative (upper left) direction
-    Transaction().setCrop(layer, Rect(-128, -128, mDisplayWidth, mDisplayHeight / 4)).apply();
+    Transaction().setCrop(layer, Rect(-128, -128, 32, 16)).apply();
     {
         SCOPED_TRACE("out of bounds, negative (upper left) direction");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight / 2), Color::BLUE);
-        shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight / 2), Color::BLACK);
+        shot->expectColor(Rect(0, 0, 64, 64), Color::BLUE);
+        shot->expectBorder(Rect(0, 0, 64, 64), Color::BLACK);
     }
 
     // Partially out of bounds in the positive (lower right) direction
-    Transaction()
-            .setCrop(layer, Rect(0, mDisplayHeight / 4, mDisplayWidth + 1, mDisplayHeight))
-            .apply();
+    Transaction().setCrop(layer, Rect(0, 16, 128, 128)).apply();
     {
         SCOPED_TRACE("out of bounds, positive (lower right) direction");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight / 2), Color::RED);
-        shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight / 2), Color::BLACK);
+        shot->expectColor(Rect(0, 0, 64, 64), Color::RED);
+        shot->expectBorder(Rect(0, 0, 64, 64), Color::BLACK);
     }
 
     // Fully out of buffer space bounds
@@ -2114,9 +2114,9 @@
     {
         SCOPED_TRACE("Fully out of bounds");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight / 4), Color::BLUE);
-        shot->expectColor(Rect(0, mDisplayHeight / 4, mDisplayWidth, mDisplayHeight / 2),
-                          Color::RED);
+        shot->expectColor(Rect(0, 0, 64, 16), Color::BLUE);
+        shot->expectColor(Rect(0, 16, 64, 64), Color::RED);
+        shot->expectBorder(Rect(0, 0, 64, 64), Color::BLACK);
     }
 }
 
@@ -2293,8 +2293,8 @@
 
     // A parentless layer will default to a frame with the same size as the buffer
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 10, 10), Color::RED);
-    shot->expectBorder(Rect(0, 0, 10, 10), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetFrameDefaultBSParent_BufferState) {
@@ -2377,8 +2377,8 @@
     ASSERT_NO_FATAL_FAILURE(fillBufferStateLayerColor(layer, Color::RED, 32, 32));
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetBufferMultipleBuffers_BufferState) {
@@ -2391,8 +2391,8 @@
     {
         SCOPED_TRACE("set buffer 1");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-        shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+        shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
     }
 
     ASSERT_NO_FATAL_FAILURE(fillBufferStateLayerColor(layer, Color::BLUE, 32, 32));
@@ -2400,8 +2400,8 @@
     {
         SCOPED_TRACE("set buffer 2");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, 32, 32), Color::BLUE);
-        shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLUE);
+        shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
     }
 
     ASSERT_NO_FATAL_FAILURE(fillBufferStateLayerColor(layer, Color::RED, 32, 32));
@@ -2409,8 +2409,8 @@
     {
         SCOPED_TRACE("set buffer 3");
         auto shot = getScreenCapture();
-        shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-        shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+        shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+        shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
     }
 }
 
@@ -2492,8 +2492,8 @@
 
             Color color = colors[idx % colors.size()];
             auto shot = screenshot();
-            shot->expectColor(Rect(0, 0, 32, 32), color);
-            shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+            shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), color);
+            shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
         }
         idx++;
     }
@@ -2528,8 +2528,8 @@
 
             Color color = colors[idx % colors.size()];
             auto shot = screenshot();
-            shot->expectColor(Rect(0, 0, 32, 32), color);
-            shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+            shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), color);
+            shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
         }
         idx++;
     }
@@ -2564,8 +2564,8 @@
 
             Color color = colors[idx % colors.size()];
             auto shot = screenshot();
-            shot->expectColor(Rect(0, 0, 32, 32), color);
-            shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+            shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), color);
+            shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
         }
         if (idx == 0) {
             buffers[0].clear();
@@ -2663,8 +2663,8 @@
     std::this_thread::sleep_for(200ms);
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetFenceNull_BufferState) {
@@ -2687,8 +2687,8 @@
             .apply();
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetDataspaceBasic_BufferState) {
@@ -2709,8 +2709,8 @@
             .apply();
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetHdrMetadataBasic_BufferState) {
@@ -2733,8 +2733,8 @@
             .apply();
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetSurfaceDamageRegionBasic_BufferState) {
@@ -2757,8 +2757,8 @@
             .apply();
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_P(LayerRenderTypeTransactionTest, SetApiBasic_BufferState) {
@@ -2779,8 +2779,8 @@
             .apply();
 
     auto shot = getScreenCapture();
-    shot->expectColor(Rect(0, 0, 32, 32), Color::RED);
-    shot->expectBorder(Rect(0, 0, 32, 32), Color::BLACK);
+    shot->expectColor(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::RED);
+    shot->expectBorder(Rect(0, 0, mDisplayWidth, mDisplayHeight), Color::BLACK);
 }
 
 TEST_F(LayerTransactionTest, SetSidebandStreamNull_BufferState) {
@@ -5523,4 +5523,64 @@
     sc->expectColor(Rect(0, 0, 9, 9), {0, 0, 0, 255});
 }
 
+class DisplayActiveConfigTest : public ::testing::Test {
+protected:
+    void SetUp() override {
+        mDisplayToken = SurfaceComposerClient::getInternalDisplayToken();
+        SurfaceComposerClient::getDisplayConfigs(mDisplayToken, &mDisplayconfigs);
+        EXPECT_GT(mDisplayconfigs.size(), 0);
+
+        // set display power to on to make sure config can be changed
+        SurfaceComposerClient::setDisplayPowerMode(mDisplayToken, HWC_POWER_MODE_NORMAL);
+    }
+
+    sp<IBinder> mDisplayToken;
+    Vector<DisplayInfo> mDisplayconfigs;
+};
+
+TEST_F(DisplayActiveConfigTest, allConfigsAllowed) {
+    std::vector<int32_t> allowedConfigs;
+
+    // Add all configs to the allowed configs
+    for (int i = 0; i < mDisplayconfigs.size(); i++) {
+        allowedConfigs.push_back(i);
+    }
+
+    status_t res = SurfaceComposerClient::setAllowedDisplayConfigs(mDisplayToken, allowedConfigs);
+    EXPECT_EQ(res, NO_ERROR);
+
+    std::vector<int32_t> outConfigs;
+    res = SurfaceComposerClient::getAllowedDisplayConfigs(mDisplayToken, &outConfigs);
+    EXPECT_EQ(res, NO_ERROR);
+    EXPECT_EQ(allowedConfigs, outConfigs);
+}
+
+TEST_F(DisplayActiveConfigTest, changeAllowedConfig) {
+    // we need at least 2 configs available for this test
+    if (mDisplayconfigs.size() <= 1) return;
+
+    int activeConfig = SurfaceComposerClient::getActiveConfig(mDisplayToken);
+
+    // We want to set the allowed config to everything but the active config
+    std::vector<int32_t> allowedConfigs;
+    for (int i = 0; i < mDisplayconfigs.size(); i++) {
+        if (i != activeConfig) {
+            allowedConfigs.push_back(i);
+        }
+    }
+
+    status_t res = SurfaceComposerClient::setAllowedDisplayConfigs(mDisplayToken, allowedConfigs);
+    EXPECT_EQ(res, NO_ERROR);
+
+    // Allow some time for the config change
+    std::this_thread::sleep_for(200ms);
+
+    int newActiveConfig = SurfaceComposerClient::getActiveConfig(mDisplayToken);
+    EXPECT_NE(activeConfig, newActiveConfig);
+
+    // Make sure the new config is part of allowed config
+    EXPECT_TRUE(std::find(allowedConfigs.begin(), allowedConfigs.end(), newActiveConfig) !=
+                allowedConfigs.end());
+}
+
 } // namespace android
diff --git a/services/surfaceflinger/tests/unittests/AllowedDisplayConfigsTest.cpp b/services/surfaceflinger/tests/unittests/AllowedDisplayConfigsTest.cpp
new file mode 100644
index 0000000..4274254
--- /dev/null
+++ b/services/surfaceflinger/tests/unittests/AllowedDisplayConfigsTest.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#undef LOG_TAG
+#define LOG_TAG "LibSurfaceFlingerUnittests"
+#define LOG_NDEBUG 0
+
+#include <memory>
+#include <vector>
+
+#include <gtest/gtest.h>
+
+#include <log/log.h>
+
+#include "AllowedDisplayConfigs.h"
+
+namespace android {
+namespace {
+
+class AllowedDisplayConfigsTest : public testing::Test {
+protected:
+    AllowedDisplayConfigsTest();
+    ~AllowedDisplayConfigsTest() override;
+
+    void buildAllowedConfigs();
+
+    const std::vector<int32_t> expectedConfigs = {0, 2, 7, 129};
+    constexpr static int32_t notAllowedConfig = 5;
+    std::unique_ptr<const AllowedDisplayConfigs> mAllowedConfigs;
+};
+
+AllowedDisplayConfigsTest::AllowedDisplayConfigsTest() {
+    const ::testing::TestInfo* const test_info =
+            ::testing::UnitTest::GetInstance()->current_test_info();
+    ALOGD("**** Setting up for %s.%s\n", test_info->test_case_name(), test_info->name());
+}
+
+AllowedDisplayConfigsTest::~AllowedDisplayConfigsTest() {
+    const ::testing::TestInfo* const test_info =
+            ::testing::UnitTest::GetInstance()->current_test_info();
+    ALOGD("**** Tearing down after %s.%s\n", test_info->test_case_name(), test_info->name());
+}
+
+void AllowedDisplayConfigsTest::buildAllowedConfigs() {
+    AllowedDisplayConfigs::Builder builder;
+    for (int config : expectedConfigs) {
+        builder.addConfig(config);
+    }
+    mAllowedConfigs = builder.build();
+}
+
+/* ------------------------------------------------------------------------
+ * Test cases
+ */
+
+TEST_F(AllowedDisplayConfigsTest, checkConfigs) {
+    buildAllowedConfigs();
+
+    // Check that all expected configs are allowed
+    for (int config : expectedConfigs) {
+        EXPECT_TRUE(mAllowedConfigs->isConfigAllowed(config));
+    }
+
+    // Check that all the allowed configs are expected
+    std::vector<int32_t> allowedConfigVector;
+    mAllowedConfigs->getAllowedConfigs(&allowedConfigVector);
+    EXPECT_EQ(allowedConfigVector, expectedConfigs);
+
+    // Check that notAllowedConfig is indeed not allowed
+    EXPECT_TRUE(std::find(expectedConfigs.begin(), expectedConfigs.end(), notAllowedConfig) ==
+                expectedConfigs.end());
+    EXPECT_FALSE(mAllowedConfigs->isConfigAllowed(notAllowedConfig));
+}
+
+TEST_F(AllowedDisplayConfigsTest, getAllowedConfigsNullptr) {
+    buildAllowedConfigs();
+
+    // No other expectations rather than no crash
+    mAllowedConfigs->getAllowedConfigs(nullptr);
+}
+
+} // namespace
+} // namespace android
diff --git a/services/surfaceflinger/tests/unittests/Android.bp b/services/surfaceflinger/tests/unittests/Android.bp
index b1d45f39..25ce4ac 100644
--- a/services/surfaceflinger/tests/unittests/Android.bp
+++ b/services/surfaceflinger/tests/unittests/Android.bp
@@ -35,7 +35,9 @@
     srcs: [
         ":libsurfaceflinger_sources",
         "libsurfaceflinger_unittest_main.cpp",
+        "AllowedDisplayConfigsTest.cpp",
         "CompositionTest.cpp",
+        "DispSyncSourceTest.cpp",
         "DisplayIdentificationTest.cpp",
         "DisplayTransactionTest.cpp",
         "EventControlThreadTest.cpp",
diff --git a/services/surfaceflinger/tests/unittests/DispSyncSourceTest.cpp b/services/surfaceflinger/tests/unittests/DispSyncSourceTest.cpp
new file mode 100644
index 0000000..92bdebd
--- /dev/null
+++ b/services/surfaceflinger/tests/unittests/DispSyncSourceTest.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#undef LOG_TAG
+#define LOG_TAG "LibSurfaceFlingerUnittests"
+#define LOG_NDEBUG 0
+
+#include <inttypes.h>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <log/log.h>
+
+#include "AsyncCallRecorder.h"
+#include "Scheduler/DispSyncSource.h"
+#include "mock/MockDispSync.h"
+
+namespace android {
+namespace {
+
+using namespace std::chrono_literals;
+using testing::Return;
+
+class DispSyncSourceTest : public testing::Test, private VSyncSource::Callback {
+protected:
+    DispSyncSourceTest();
+    ~DispSyncSourceTest() override;
+
+    void createDispSync();
+    void createDispSyncSource();
+
+    void onVSyncEvent(nsecs_t when) override;
+
+    std::unique_ptr<mock::DispSync> mDispSync;
+    std::unique_ptr<DispSyncSource> mDispSyncSource;
+
+    AsyncCallRecorder<void (*)(nsecs_t)> mVSyncEventCallRecorder;
+
+    static constexpr std::chrono::nanoseconds mPhaseOffset = 6ms;
+    static constexpr int mIterations = 100;
+};
+
+DispSyncSourceTest::DispSyncSourceTest() {
+    const ::testing::TestInfo* const test_info =
+            ::testing::UnitTest::GetInstance()->current_test_info();
+    ALOGD("**** Setting up for %s.%s\n", test_info->test_case_name(), test_info->name());
+}
+
+DispSyncSourceTest::~DispSyncSourceTest() {
+    const ::testing::TestInfo* const test_info =
+            ::testing::UnitTest::GetInstance()->current_test_info();
+    ALOGD("**** Tearing down after %s.%s\n", test_info->test_case_name(), test_info->name());
+}
+
+void DispSyncSourceTest::onVSyncEvent(nsecs_t when) {
+    ALOGD("onVSyncEvent: %" PRId64, when);
+
+    mVSyncEventCallRecorder.recordCall(when);
+}
+
+void DispSyncSourceTest::createDispSync() {
+    mDispSync = std::make_unique<mock::DispSync>();
+}
+
+void DispSyncSourceTest::createDispSyncSource() {
+    createDispSync();
+    mDispSyncSource = std::make_unique<DispSyncSource>(mDispSync.get(), mPhaseOffset.count(), true,
+                                                       "DispSyncSourceTest");
+    mDispSyncSource->setCallback(this);
+}
+
+/* ------------------------------------------------------------------------
+ * Test cases
+ */
+
+TEST_F(DispSyncSourceTest, createDispSync) {
+    createDispSync();
+    EXPECT_TRUE(mDispSync);
+}
+
+TEST_F(DispSyncSourceTest, createDispSyncSource) {
+    createDispSyncSource();
+    EXPECT_TRUE(mDispSyncSource);
+}
+
+TEST_F(DispSyncSourceTest, noCallbackAfterInit) {
+    createDispSyncSource();
+    EXPECT_TRUE(mDispSyncSource);
+
+    // DispSyncSource starts with Vsync disabled
+    mDispSync->triggerCallback();
+    EXPECT_FALSE(mVSyncEventCallRecorder.waitForUnexpectedCall().has_value());
+}
+
+TEST_F(DispSyncSourceTest, waitForCallbacks) {
+    createDispSyncSource();
+    EXPECT_TRUE(mDispSyncSource);
+
+    mDispSyncSource->setVSyncEnabled(true);
+    EXPECT_EQ(mDispSync->getCallbackPhase(), mPhaseOffset.count());
+
+    for (int i = 0; i < mIterations; i++) {
+        mDispSync->triggerCallback();
+        EXPECT_TRUE(mVSyncEventCallRecorder.waitForCall().has_value());
+    }
+}
+
+TEST_F(DispSyncSourceTest, waitForCallbacksWithPhaseChange) {
+    createDispSyncSource();
+    EXPECT_TRUE(mDispSyncSource);
+
+    mDispSyncSource->setVSyncEnabled(true);
+    EXPECT_EQ(mDispSync->getCallbackPhase(), mPhaseOffset.count());
+
+    for (int i = 0; i < mIterations; i++) {
+        mDispSync->triggerCallback();
+        EXPECT_TRUE(mVSyncEventCallRecorder.waitForCall().has_value());
+    }
+
+    EXPECT_CALL(*mDispSync, getPeriod()).Times(1).WillOnce(Return(16666666));
+    mDispSyncSource->setPhaseOffset((mPhaseOffset / 2).count());
+
+    EXPECT_EQ(mDispSync->getCallbackPhase(), (mPhaseOffset / 2).count());
+
+    for (int i = 0; i < mIterations; i++) {
+        mDispSync->triggerCallback();
+        EXPECT_TRUE(mVSyncEventCallRecorder.waitForCall().has_value());
+    }
+}
+
+TEST_F(DispSyncSourceTest, pauseCallbacks) {
+    createDispSyncSource();
+    EXPECT_TRUE(mDispSyncSource);
+
+    mDispSyncSource->setVSyncEnabled(true);
+    EXPECT_EQ(mDispSync->getCallbackPhase(), mPhaseOffset.count());
+    mDispSync->triggerCallback();
+    EXPECT_TRUE(mVSyncEventCallRecorder.waitForCall().has_value());
+
+    mDispSyncSource->pauseVsyncCallback(true);
+    mDispSync->triggerCallback();
+    EXPECT_FALSE(mVSyncEventCallRecorder.waitForUnexpectedCall().has_value());
+
+    mDispSyncSource->pauseVsyncCallback(false);
+    mDispSync->triggerCallback();
+    EXPECT_TRUE(mVSyncEventCallRecorder.waitForUnexpectedCall().has_value());
+}
+
+} // namespace
+} // namespace android
diff --git a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
index e6f1a06..bb92020 100644
--- a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
+++ b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
@@ -121,6 +121,8 @@
     MOCK_METHOD2(getDisplayCapabilities, Error(Display, std::vector<DisplayCapability>*));
     MOCK_METHOD3(setLayerPerFrameMetadataBlobs,
                  Error(Display, Layer, const std::vector<IComposerClient::PerFrameMetadataBlob>&));
+    MOCK_METHOD2(setDisplayBrightness, Error(Display, float));
+    MOCK_METHOD2(getDisplayBrightnessSupport, Error(Display, bool*));
 };
 
 } // namespace mock
diff --git a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockDisplay.h b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockDisplay.h
index d7e20c4..6dc28bc 100644
--- a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockDisplay.h
+++ b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockDisplay.h
@@ -79,8 +79,9 @@
     MOCK_METHOD2(validate, Error(uint32_t*, uint32_t*));
     MOCK_METHOD4(presentOrValidate,
                  Error(uint32_t*, uint32_t*, android::sp<android::Fence>*, uint32_t*));
+    MOCK_CONST_METHOD1(setDisplayBrightness, Error(float));
 };
 
 } // namespace mock
 } // namespace Hwc2
-} // namespace android
\ No newline at end of file
+} // namespace android
diff --git a/services/surfaceflinger/tests/unittests/mock/MockDispSync.cpp b/services/surfaceflinger/tests/unittests/mock/MockDispSync.cpp
index 2f7e5ea..f6c4f62 100644
--- a/services/surfaceflinger/tests/unittests/mock/MockDispSync.cpp
+++ b/services/surfaceflinger/tests/unittests/mock/MockDispSync.cpp
@@ -15,6 +15,7 @@
  */
 
 #include "mock/MockDispSync.h"
+#include <thread>
 
 namespace android {
 namespace mock {
@@ -23,5 +24,39 @@
 DispSync::DispSync() = default;
 DispSync::~DispSync() = default;
 
+status_t DispSync::addEventListener(const char* /*name*/, nsecs_t phase, Callback* callback,
+                                    nsecs_t /*lastCallbackTime*/) {
+    if (mCallback.callback != nullptr) {
+        return BAD_VALUE;
+    }
+
+    mCallback = {callback, phase};
+    return NO_ERROR;
+}
+status_t DispSync::removeEventListener(Callback* callback, nsecs_t* /*outLastCallback*/) {
+    if (mCallback.callback != callback) {
+        return BAD_VALUE;
+    }
+
+    mCallback = {nullptr, 0};
+    return NO_ERROR;
+}
+
+status_t DispSync::changePhaseOffset(Callback* callback, nsecs_t phase) {
+    if (mCallback.callback != callback) {
+        return BAD_VALUE;
+    }
+
+    mCallback.phase = phase;
+    return NO_ERROR;
+}
+
+void DispSync::triggerCallback() {
+    if (mCallback.callback == nullptr) return;
+
+    mCallback.callback->onDispSyncEvent(
+            std::chrono::steady_clock::now().time_since_epoch().count());
+}
+
 } // namespace mock
 } // namespace android
diff --git a/services/surfaceflinger/tests/unittests/mock/MockDispSync.h b/services/surfaceflinger/tests/unittests/mock/MockDispSync.h
index 9213ae5..afcda5b 100644
--- a/services/surfaceflinger/tests/unittests/mock/MockDispSync.h
+++ b/services/surfaceflinger/tests/unittests/mock/MockDispSync.h
@@ -36,14 +36,27 @@
     MOCK_METHOD1(setPeriod, void(nsecs_t));
     MOCK_METHOD0(getPeriod, nsecs_t());
     MOCK_METHOD1(setRefreshSkipCount, void(int));
-    MOCK_METHOD3(addEventListener, status_t(const char*, nsecs_t, Callback*));
-    MOCK_METHOD1(removeEventListener, status_t(Callback*));
-    MOCK_METHOD2(changePhaseOffset, status_t(Callback*, nsecs_t));
     MOCK_CONST_METHOD1(computeNextRefresh, nsecs_t(int));
     MOCK_METHOD1(setIgnorePresentFences, void(bool));
     MOCK_METHOD0(expectedPresentTime, nsecs_t());
 
     MOCK_CONST_METHOD1(dump, void(std::string&));
+
+    status_t addEventListener(const char* name, nsecs_t phase, Callback* callback,
+                              nsecs_t lastCallbackTime) override;
+    status_t removeEventListener(Callback* callback, nsecs_t* outLastCallback) override;
+    status_t changePhaseOffset(Callback* callback, nsecs_t phase) override;
+
+    nsecs_t getCallbackPhase() { return mCallback.phase; }
+
+    void triggerCallback();
+
+private:
+    struct CallbackType {
+        Callback* callback = nullptr;
+        nsecs_t phase;
+    };
+    CallbackType mCallback;
 };
 
 } // namespace mock