diff --git a/include/gui/DisplayEventReceiver.h b/include/gui/DisplayEventReceiver.h
index 6d1ab5d..9557b4f 100644
--- a/include/gui/DisplayEventReceiver.h
+++ b/include/gui/DisplayEventReceiver.h
@@ -111,15 +111,13 @@
      * should be destroyed and getEvents() shouldn't be called again.
      */
     ssize_t getEvents(Event* events, size_t count);
-    static ssize_t getEvents(const sp<gui::BitTube>& dataChannel,
-            Event* events, size_t count);
+    static ssize_t getEvents(gui::BitTube* dataChannel, Event* events, size_t count);
 
     /*
      * sendEvents write events to the queue and returns how many events were
      * written.
      */
-    static ssize_t sendEvents(const sp<gui::BitTube>& dataChannel,
-            Event const* events, size_t count);
+    static ssize_t sendEvents(gui::BitTube* dataChannel, Event const* events, size_t count);
 
     /*
      * setVsyncRate() sets the Event::VSync delivery rate. A value of
@@ -137,7 +135,7 @@
 
 private:
     sp<IDisplayEventConnection> mEventConnection;
-    sp<gui::BitTube> mDataChannel;
+    std::unique_ptr<gui::BitTube> mDataChannel;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/include/gui/IDisplayEventConnection.h b/include/gui/IDisplayEventConnection.h
index 21b53fe..0779448 100644
--- a/include/gui/IDisplayEventConnection.h
+++ b/include/gui/IDisplayEventConnection.h
@@ -34,9 +34,11 @@
     DECLARE_META_INTERFACE(DisplayEventConnection)
 
     /*
-     * getDataChannel() returns a BitTube where to receive the events from
+     * stealReceiveChannel() returns a BitTube to receive events from. Only the receive file
+     * descriptor of outChannel will be initialized, and this effectively "steals" the receive
+     * channel from the remote end (such that the remote end can only use its send channel).
      */
-    virtual status_t getDataChannel(sp<gui::BitTube>* outChannel) const = 0;
+    virtual status_t stealReceiveChannel(gui::BitTube* outChannel) = 0;
 
     /*
      * setVsyncRate() sets the vsync event delivery rate. A value of 1 returns every vsync event.
diff --git a/libs/gui/BitTube.cpp b/libs/gui/BitTube.cpp
index c023711..ef7a6f5 100644
--- a/libs/gui/BitTube.cpp
+++ b/libs/gui/BitTube.cpp
@@ -78,6 +78,14 @@
     return mSendFd;
 }
 
+base::unique_fd BitTube::moveReceiveFd() {
+    return std::move(mReceiveFd);
+}
+
+void BitTube::setReceiveFd(base::unique_fd&& receiveFd) {
+    mReceiveFd = std::move(receiveFd);
+}
+
 ssize_t BitTube::write(void const* vaddr, size_t size) {
     ssize_t err, len;
     do {
@@ -121,8 +129,7 @@
     return NO_ERROR;
 }
 
-ssize_t BitTube::sendObjects(const sp<BitTube>& tube, void const* events, size_t count,
-                             size_t objSize) {
+ssize_t BitTube::sendObjects(BitTube* tube, void const* events, size_t count, size_t objSize) {
     const char* vaddr = reinterpret_cast<const char*>(events);
     ssize_t size = tube->write(vaddr, count * objSize);
 
@@ -136,7 +143,7 @@
     return size < 0 ? size : size / static_cast<ssize_t>(objSize);
 }
 
-ssize_t BitTube::recvObjects(const sp<BitTube>& tube, void* events, size_t count, size_t objSize) {
+ssize_t BitTube::recvObjects(BitTube* tube, void* events, size_t count, size_t objSize) {
     char* vaddr = reinterpret_cast<char*>(events);
     ssize_t size = tube->read(vaddr, count * objSize);
 
diff --git a/libs/gui/DisplayEventReceiver.cpp b/libs/gui/DisplayEventReceiver.cpp
index a3ae68c..1507d51 100644
--- a/libs/gui/DisplayEventReceiver.cpp
+++ b/libs/gui/DisplayEventReceiver.cpp
@@ -37,7 +37,8 @@
     if (sf != NULL) {
         mEventConnection = sf->createDisplayEventConnection();
         if (mEventConnection != NULL) {
-            mEventConnection->getDataChannel(&mDataChannel);
+            mDataChannel = std::make_unique<gui::BitTube>();
+            mEventConnection->stealReceiveChannel(mDataChannel.get());
         }
     }
 }
@@ -80,16 +81,16 @@
 
 ssize_t DisplayEventReceiver::getEvents(DisplayEventReceiver::Event* events,
         size_t count) {
-    return DisplayEventReceiver::getEvents(mDataChannel, events, count);
+    return DisplayEventReceiver::getEvents(mDataChannel.get(), events, count);
 }
 
-ssize_t DisplayEventReceiver::getEvents(const sp<gui::BitTube>& dataChannel,
+ssize_t DisplayEventReceiver::getEvents(gui::BitTube* dataChannel,
         Event* events, size_t count)
 {
     return gui::BitTube::recvObjects(dataChannel, events, count);
 }
 
-ssize_t DisplayEventReceiver::sendEvents(const sp<gui::BitTube>& dataChannel,
+ssize_t DisplayEventReceiver::sendEvents(gui::BitTube* dataChannel,
         Event const* events, size_t count)
 {
     return gui::BitTube::sendObjects(dataChannel, events, count);
diff --git a/libs/gui/IDisplayEventConnection.cpp b/libs/gui/IDisplayEventConnection.cpp
index d3ee39c..a197426 100644
--- a/libs/gui/IDisplayEventConnection.cpp
+++ b/libs/gui/IDisplayEventConnection.cpp
@@ -22,7 +22,11 @@
 
 namespace android {
 
-enum { GET_DATA_CHANNEL = IBinder::FIRST_CALL_TRANSACTION, SET_VSYNC_RATE, REQUEST_NEXT_VSYNC };
+enum {
+    STEAL_RECEIVE_CHANNEL = IBinder::FIRST_CALL_TRANSACTION,
+    SET_VSYNC_RATE,
+    REQUEST_NEXT_VSYNC
+};
 
 class BpDisplayEventConnection : public BpInterface<IDisplayEventConnection> {
 public:
@@ -31,11 +35,11 @@
 
     ~BpDisplayEventConnection() override;
 
-    status_t getDataChannel(sp<gui::BitTube>* outChannel) const override {
+    status_t stealReceiveChannel(gui::BitTube* outChannel) override {
         Parcel data, reply;
         data.writeInterfaceToken(IDisplayEventConnection::getInterfaceDescriptor());
-        remote()->transact(GET_DATA_CHANNEL, data, &reply);
-        *outChannel = new gui::BitTube(reply);
+        remote()->transact(STEAL_RECEIVE_CHANNEL, data, &reply);
+        outChannel->readFromParcel(&reply);
         return NO_ERROR;
     }
 
@@ -63,11 +67,11 @@
 status_t BnDisplayEventConnection::onTransact(uint32_t code, const Parcel& data, Parcel* reply,
                                               uint32_t flags) {
     switch (code) {
-        case GET_DATA_CHANNEL: {
+        case STEAL_RECEIVE_CHANNEL: {
             CHECK_INTERFACE(IDisplayEventConnection, data, reply);
-            sp<gui::BitTube> channel;
-            getDataChannel(&channel);
-            channel->writeToParcel(reply);
+            gui::BitTube channel;
+            stealReceiveChannel(&channel);
+            channel.writeToParcel(reply);
             return NO_ERROR;
         }
         case SET_VSYNC_RATE: {
diff --git a/libs/gui/include/private/gui/BitTube.h b/libs/gui/include/private/gui/BitTube.h
index e93dc5f..13c0162 100644
--- a/libs/gui/include/private/gui/BitTube.h
+++ b/libs/gui/include/private/gui/BitTube.h
@@ -16,14 +16,9 @@
 
 #pragma once
 
-#include <stdint.h>
-#include <sys/types.h>
-
-#include <android/log.h>
 #include <android-base/unique_fd.h>
 #include <binder/Parcelable.h>
 #include <utils/Errors.h>
-#include <utils/RefBase.h>
 
 namespace android {
 
@@ -31,7 +26,7 @@
 
 namespace gui {
 
-class BitTube : public RefBase, public Parcelable {
+class BitTube : public Parcelable {
 public:
     // creates an uninitialized BitTube (to unparcel into)
     BitTube() = default;
@@ -57,16 +52,22 @@
     // get the send file-descriptor.
     int getSendFd() const;
 
+    // moves the receive file descriptor out of this BitTube
+    base::unique_fd moveReceiveFd();
+
+    // resets this BitTube's receive file descriptor to receiveFd
+    void setReceiveFd(base::unique_fd&& receiveFd);
+
     // send objects (sized blobs). All objects are guaranteed to be written or the call fails.
     template <typename T>
-    static ssize_t sendObjects(const sp<BitTube>& tube, T const* events, size_t count) {
+    static ssize_t sendObjects(BitTube* tube, T const* events, size_t count) {
         return sendObjects(tube, events, count, sizeof(T));
     }
 
     // receive objects (sized blobs). If the receiving buffer isn't large enough, excess messages
     // are silently discarded.
     template <typename T>
-    static ssize_t recvObjects(const sp<BitTube>& tube, T* events, size_t count) {
+    static ssize_t recvObjects(BitTube* tube, T* events, size_t count) {
         return recvObjects(tube, events, count, sizeof(T));
     }
 
@@ -87,10 +88,9 @@
     base::unique_fd mSendFd;
     mutable base::unique_fd mReceiveFd;
 
-    static ssize_t sendObjects(const sp<BitTube>& tube, void const* events, size_t count,
-                               size_t objSize);
+    static ssize_t sendObjects(BitTube* tube, void const* events, size_t count, size_t objSize);
 
-    static ssize_t recvObjects(const sp<BitTube>& tube, void* events, size_t count, size_t objSize);
+    static ssize_t recvObjects(BitTube* tube, void* events, size_t count, size_t objSize);
 };
 
 } // namespace gui
diff --git a/services/surfaceflinger/EventThread.cpp b/services/surfaceflinger/EventThread.cpp
index 2d3515e..a9bb2ba 100644
--- a/services/surfaceflinger/EventThread.cpp
+++ b/services/surfaceflinger/EventThread.cpp
@@ -21,7 +21,6 @@
 
 #include <cutils/compiler.h>
 
-#include <private/gui/BitTube.h>
 #include <gui/IDisplayEventConnection.h>
 #include <gui/DisplayEventReceiver.h>
 
@@ -389,7 +388,7 @@
 
 EventThread::Connection::Connection(
         const sp<EventThread>& eventThread)
-    : count(-1), mEventThread(eventThread), mChannel(new gui::BitTube(gui::BitTube::DefaultSize))
+    : count(-1), mEventThread(eventThread), mChannel(gui::BitTube::DefaultSize)
 {
 }
 
@@ -403,8 +402,8 @@
     mEventThread->registerDisplayEventConnection(this);
 }
 
-status_t EventThread::Connection::getDataChannel(sp<gui::BitTube>* outChannel) const {
-    *outChannel = mChannel;
+status_t EventThread::Connection::stealReceiveChannel(gui::BitTube* outChannel) {
+    outChannel->setReceiveFd(mChannel.moveReceiveFd());
     return NO_ERROR;
 }
 
@@ -419,7 +418,7 @@
 
 status_t EventThread::Connection::postEvent(
         const DisplayEventReceiver::Event& event) {
-    ssize_t size = DisplayEventReceiver::sendEvents(mChannel, &event, 1);
+    ssize_t size = DisplayEventReceiver::sendEvents(&mChannel, &event, 1);
     return size < 0 ? status_t(size) : status_t(NO_ERROR);
 }
 
diff --git a/services/surfaceflinger/EventThread.h b/services/surfaceflinger/EventThread.h
index 3e05749..6a59fbb 100644
--- a/services/surfaceflinger/EventThread.h
+++ b/services/surfaceflinger/EventThread.h
@@ -20,6 +20,7 @@
 #include <stdint.h>
 #include <sys/types.h>
 
+#include <private/gui/BitTube.h>
 #include <gui/DisplayEventReceiver.h>
 #include <gui/IDisplayEventConnection.h>
 
@@ -68,11 +69,11 @@
     private:
         virtual ~Connection();
         virtual void onFirstRef();
-        status_t getDataChannel(sp<gui::BitTube>* outChannel) const override;
+        status_t stealReceiveChannel(gui::BitTube* outChannel) override;
         status_t setVsyncRate(uint32_t count) override;
         void requestNextVsync() override;    // asynchronous
         sp<EventThread> const mEventThread;
-        sp<gui::BitTube> const mChannel;
+        gui::BitTube mChannel;
     };
 
 public:
diff --git a/services/surfaceflinger/MessageQueue.cpp b/services/surfaceflinger/MessageQueue.cpp
index 6ef26fe..bca3430 100644
--- a/services/surfaceflinger/MessageQueue.cpp
+++ b/services/surfaceflinger/MessageQueue.cpp
@@ -25,7 +25,6 @@
 #include <utils/Log.h>
 
 #include <gui/IDisplayEventConnection.h>
-#include <private/gui/BitTube.h>
 
 #include "MessageQueue.h"
 #include "EventThread.h"
@@ -94,8 +93,8 @@
 {
     mEventThread = eventThread;
     mEvents = eventThread->createEventConnection();
-    mEvents->getDataChannel(&mEventTube);
-    mLooper->addFd(mEventTube->getFd(), 0, Looper::EVENT_INPUT,
+    mEvents->stealReceiveChannel(&mEventTube);
+    mLooper->addFd(mEventTube.getFd(), 0, Looper::EVENT_INPUT,
             MessageQueue::cb_eventReceiver, this);
 }
 
@@ -150,7 +149,7 @@
 int MessageQueue::eventReceiver(int /*fd*/, int /*events*/) {
     ssize_t n;
     DisplayEventReceiver::Event buffer[8];
-    while ((n = DisplayEventReceiver::getEvents(mEventTube, buffer, 8)) > 0) {
+    while ((n = DisplayEventReceiver::getEvents(&mEventTube, buffer, 8)) > 0) {
         for (int i=0 ; i<n ; i++) {
             if (buffer[i].header.type == DisplayEventReceiver::DISPLAY_EVENT_VSYNC) {
                 mHandler->dispatchInvalidate();
diff --git a/services/surfaceflinger/MessageQueue.h b/services/surfaceflinger/MessageQueue.h
index 2bb5fa6..85a33c8 100644
--- a/services/surfaceflinger/MessageQueue.h
+++ b/services/surfaceflinger/MessageQueue.h
@@ -25,6 +25,7 @@
 #include <utils/Timers.h>
 #include <utils/Looper.h>
 
+#include <private/gui/BitTube.h>
 #include <gui/DisplayEventReceiver.h>
 
 #include "Barrier.h"
@@ -81,7 +82,7 @@
     sp<Looper> mLooper;
     sp<EventThread> mEventThread;
     sp<IDisplayEventConnection> mEvents;
-    sp<gui::BitTube> mEventTube;
+    gui::BitTube mEventTube;
     sp<Handler> mHandler;