diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index 26c2d1c..29838e4 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -117,6 +117,7 @@
 static bool g_compress = false;
 static bool g_nohup = false;
 static int g_initialSleepSecs = 0;
+static const char* g_kernelTraceFuncs = NULL;
 
 /* Global state */
 static bool g_traceAborted = false;
@@ -132,6 +133,30 @@
 static const char* k_tracingOverwriteEnablePath =
     "/sys/kernel/debug/tracing/options/overwrite";
 
+static const char* k_currentTracerPath =
+    "/sys/kernel/debug/tracing/current_tracer";
+
+static const char* k_printTgidPath =
+    "/sys/kernel/debug/tracing/options/print-tgid";
+
+static const char* k_funcgraphAbsTimePath =
+    "/sys/kernel/debug/tracing/options/funcgraph-abstime";
+
+static const char* k_funcgraphCpuPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-cpu";
+
+static const char* k_funcgraphProcPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-proc";
+
+static const char* k_funcgraphFlatPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-flat";
+
+static const char* k_funcgraphDurationPath =
+    "/sys/kernel/debug/tracing/options/funcgraph-duration";
+
+static const char* k_ftraceFilterPath =
+    "/sys/kernel/debug/tracing/set_ftrace_filter";
+
 static const char* k_tracingOnPath =
     "/sys/kernel/debug/tracing/tracing_on";
 
@@ -148,10 +173,22 @@
     return access(filename, W_OK) != -1;
 }
 
-// Write a string to a file, returning true if the write was successful.
-static bool writeStr(const char* filename, const char* str)
+// Truncate a file.
+static bool truncateFile(const char* path)
 {
-    int fd = open(filename, O_WRONLY);
+    int err = truncate(path, 0);
+    if (err != 0) {
+        fprintf(stderr, "error truncating %s: %s (%d)\n", path,
+                strerror(errno), errno);
+        return false;
+    }
+
+    return true;
+}
+
+static bool _writeStr(const char* filename, const char* str, int flags)
+{
+    int fd = open(filename, flags);
     if (fd == -1) {
         fprintf(stderr, "error opening %s: %s (%d)\n", filename,
                 strerror(errno), errno);
@@ -171,6 +208,18 @@
     return ok;
 }
 
+// Write a string to a file, returning true if the write was successful.
+static bool writeStr(const char* filename, const char* str)
+{
+    return _writeStr(filename, str, O_WRONLY);
+}
+
+// Append a string to a file, returning true if the write was successful.
+static bool appendStr(const char* filename, const char* str)
+{
+    return _writeStr(filename, str, O_APPEND|O_WRONLY);
+}
+
 // Enable or disable a kernel option by writing a "1" or a "0" into a /sys
 // file.
 static bool setKernelOptionEnable(const char* filename, bool enable)
@@ -244,16 +293,7 @@
 // Clear the contents of the kernel trace.
 static bool clearTrace()
 {
-    int traceFD = creat(k_tracePath, 0);
-    if (traceFD == -1) {
-        fprintf(stderr, "error truncating %s: %s (%d)\n", k_tracePath,
-                strerror(errno), errno);
-        return false;
-    }
-
-    close(traceFD);
-
-    return true;
+    return truncateFile(k_tracePath);
 }
 
 // Set the size of the kernel's trace buffer in kilobytes.
@@ -275,6 +315,14 @@
     return writeStr(k_traceClockPath, enable ? "global" : "local");
 }
 
+static bool setPrintTgidEnableIfPresent(bool enable)
+{
+    if (fileExists(k_printTgidPath)) {
+        return setKernelOptionEnable(k_printTgidPath, enable);
+    }
+    return true;
+}
+
 // Poke all the binder-enabled processes in the system to get them to re-read
 // their system properties.
 static bool pokeBinderServices()
@@ -330,8 +378,90 @@
     return ok;
 }
 
-// Enable tracing in the kernel.
-static bool startTrace()
+// Verify that the comma separated list of functions are being traced by the
+// kernel.
+static bool verifyKernelTraceFuncs(const char* funcs)
+{
+    int fd = open(k_ftraceFilterPath, O_RDONLY);
+    if (fd == -1) {
+        fprintf(stderr, "error opening %s: %s (%d)\n", k_ftraceFilterPath,
+            strerror(errno), errno);
+        return false;
+    }
+
+    char buf[4097];
+    ssize_t n = read(fd, buf, 4096);
+    close(fd);
+    if (n == -1) {
+        fprintf(stderr, "error reading %s: %s (%d)\n", k_ftraceFilterPath,
+            strerror(errno), errno);
+        return false;
+    }
+
+    buf[n] = '\0';
+    String8 funcList = String8::format("\n%s", buf);
+
+    // Make sure that every function listed in funcs is in the list we just
+    // read from the kernel.
+    bool ok = true;
+    char* myFuncs = strdup(funcs);
+    char* func = strtok(myFuncs, ",");
+    while (func) {
+        String8 fancyFunc = String8::format("\n%s\n", func);
+        bool found = funcList.find(fancyFunc.string(), 0) >= 0;
+        if (!found || func[0] == '\0') {
+            fprintf(stderr, "error: \"%s\" is not a valid kernel function "
+                "to trace.\n", func);
+            ok = false;
+        }
+        func = strtok(NULL, ",");
+    }
+    free(myFuncs);
+
+    return ok;
+}
+
+// Set the comma separated list of functions that the kernel is to trace.
+static bool setKernelTraceFuncs(const char* funcs)
+{
+    bool ok = true;
+
+    if (funcs == NULL || funcs[0] == '\0') {
+        // Disable kernel function tracing.
+        ok &= writeStr(k_currentTracerPath, "nop");
+        if (fileExists(k_ftraceFilterPath)) {
+            ok &= truncateFile(k_ftraceFilterPath);
+        }
+    } else {
+        // Enable kernel function tracing.
+        ok &= writeStr(k_currentTracerPath, "function_graph");
+        ok &= setKernelOptionEnable(k_funcgraphAbsTimePath, true);
+        ok &= setKernelOptionEnable(k_funcgraphCpuPath, true);
+        ok &= setKernelOptionEnable(k_funcgraphProcPath, true);
+        ok &= setKernelOptionEnable(k_funcgraphFlatPath, true);
+
+        // Set the requested filter functions.
+        ok &= truncateFile(k_ftraceFilterPath);
+        char* myFuncs = strdup(funcs);
+        char* func = strtok(myFuncs, ",");
+        while (func) {
+            ok &= appendStr(k_ftraceFilterPath, func);
+            func = strtok(NULL, ",");
+        }
+        free(myFuncs);
+
+        // Verify that the set functions are being traced.
+        if (ok) {
+            ok &= verifyKernelTraceFuncs(funcs);
+        }
+    }
+
+    return ok;
+}
+
+// Set all the kernel tracing settings to the desired state for this trace
+// capture.
+static bool setUpTrace()
 {
     bool ok = true;
 
@@ -339,6 +469,8 @@
     ok &= setTraceOverwriteEnable(g_traceOverwrite);
     ok &= setTraceBufferSizeKB(g_traceBufferSizeKB);
     ok &= setGlobalClockEnable(true);
+    ok &= setPrintTgidEnableIfPresent(true);
+    ok &= setKernelTraceFuncs(g_kernelTraceFuncs);
 
     // Set up the tags property.
     uint64_t tags = 0;
@@ -373,18 +505,12 @@
         }
     }
 
-    // Enable tracing.
-    ok &= setTracingEnabled(true);
-
     return ok;
 }
 
-// Disable tracing in the kernel.
-static void stopTrace()
+// Reset all the kernel tracing settings to their default state.
+static void cleanUpTrace()
 {
-    // Disable tracing.
-    setTracingEnabled(false);
-
     // Disable all tracing that we're able to.
     disableKernelTraceEvents();
 
@@ -393,10 +519,23 @@
 
     // Set the options back to their defaults.
     setTraceOverwriteEnable(true);
+    setTraceBufferSizeKB(1);
     setGlobalClockEnable(false);
+    setPrintTgidEnableIfPresent(false);
+    setKernelTraceFuncs(NULL);
+}
 
-    // Note that we can't reset the trace buffer size here because that would
-    // clear the trace before we've read it.
+
+// Enable tracing in the kernel.
+static bool startTrace()
+{
+    return setTracingEnabled(true);
+}
+
+// Disable tracing in the kernel.
+static void stopTrace()
+{
+    setTracingEnabled(false);
 }
 
 // Read the current kernel trace and write it to stdout.
@@ -556,6 +695,7 @@
     fprintf(stderr, "options include:\n"
                     "  -b N            use a trace buffer size of N KB\n"
                     "  -c              trace into a circular buffer\n"
+                    "  -k fname,...    trace the listed kernel functions\n"
                     "  -n              ignore signals\n"
                     "  -s N            sleep for N seconds before tracing [default 0]\n"
                     "  -t N            trace for N seconds [defualt 5]\n"
@@ -592,7 +732,7 @@
             {           0,                0, 0,  0 }
         };
 
-        ret = getopt_long(argc, argv, "b:cns:t:z",
+        ret = getopt_long(argc, argv, "b:ck:ns:t:z",
                           long_options, &option_index);
 
         if (ret < 0) {
@@ -614,6 +754,10 @@
                 g_traceOverwrite = true;
             break;
 
+            case 'k':
+                g_kernelTraceFuncs = optarg;
+                break;
+
             case 'n':
                 g_nohup = true;
                 break;
@@ -663,7 +807,9 @@
         sleep(g_initialSleepSecs);
     }
 
-    bool ok = startTrace();
+    bool ok = true;
+    ok &= setUpTrace();
+    ok &= startTrace();
 
     if (ok && traceStart) {
         printf("capturing trace...");
@@ -709,7 +855,7 @@
 
     // Reset the trace buffer size to 1.
     if (traceStop)
-        setTraceBufferSizeKB(1);
+        cleanUpTrace();
 
     return g_traceAborted ? 1 : 0;
 }
diff --git a/include/gui/BufferQueue.h b/include/gui/BufferQueue.h
index c59e00e..6a86db6 100644
--- a/include/gui/BufferQueue.h
+++ b/include/gui/BufferQueue.h
@@ -128,7 +128,7 @@
     // GL_MAX_VIEWPORT_DIMS and GL_MAX_TEXTURE_SIZE (see: glGetIntegerv).
     // An error due to invalid dimensions might not be reported until
     // updateTexImage() is called.
-    virtual status_t dequeueBuffer(int *buf, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *buf, sp<Fence>* fence,
             uint32_t width, uint32_t height, uint32_t format, uint32_t usage);
 
     // queueBuffer returns a filled buffer to the BufferQueue. In addition, a
@@ -139,7 +139,7 @@
     virtual status_t queueBuffer(int buf,
             const QueueBufferInput& input, QueueBufferOutput* output);
 
-    virtual void cancelBuffer(int buf, sp<Fence> fence);
+    virtual void cancelBuffer(int buf, const sp<Fence>& fence);
 
     // setSynchronousMode set whether dequeueBuffer is synchronous or
     // asynchronous. In synchronous mode, dequeueBuffer blocks until
diff --git a/include/gui/ConsumerBase.h b/include/gui/ConsumerBase.h
index 49a764f..78a3608 100644
--- a/include/gui/ConsumerBase.h
+++ b/include/gui/ConsumerBase.h
@@ -69,10 +69,9 @@
     // ConsumerBase is connected.
     sp<BufferQueue> getBufferQueue() const;
 
-    // dump writes the current state to a string.  These methods should NOT be
-    // overridden by child classes.  Instead they should override the
-    // dumpLocked method, which is called by these methods after locking the
-    // mutex.
+    // dump writes the current state to a string. Child classes should add
+    // their state to the dump by overriding the dumpLocked method, which is
+    // called by these methods after locking the mutex.
     void dump(String8& result) const;
     void dump(String8& result, const char* prefix, char* buffer, size_t SIZE) const;
 
diff --git a/include/gui/IGraphicBufferProducer.h b/include/gui/IGraphicBufferProducer.h
index a3e258d..29c7ff3 100644
--- a/include/gui/IGraphicBufferProducer.h
+++ b/include/gui/IGraphicBufferProducer.h
@@ -84,7 +84,7 @@
     // the buffer. The contents of the buffer must not be overwritten until the
     // fence signals. If the fence is NULL, the buffer may be written
     // immediately.
-    virtual status_t dequeueBuffer(int *slot, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *slot, sp<Fence>* fence,
             uint32_t w, uint32_t h, uint32_t format, uint32_t usage) = 0;
 
     // queueBuffer indicates that the client has finished filling in the
@@ -165,7 +165,7 @@
     // cancelBuffer indicates that the client does not wish to fill in the
     // buffer associated with slot and transfers ownership of the slot back to
     // the server.
-    virtual void cancelBuffer(int slot, sp<Fence> fence) = 0;
+    virtual void cancelBuffer(int slot, const sp<Fence>& fence) = 0;
 
     // query retrieves some information for this surface
     // 'what' tokens allowed are that of android_natives.h
diff --git a/include/gui/ISurfaceComposer.h b/include/gui/ISurfaceComposer.h
index 08eddcb..47f9552 100644
--- a/include/gui/ISurfaceComposer.h
+++ b/include/gui/ISurfaceComposer.h
@@ -103,16 +103,23 @@
             uint32_t reqWidth, uint32_t reqHeight,
             uint32_t minLayerZ, uint32_t maxLayerZ) = 0;
 
-    /* triggers screen off and waits for it to complete */
+    /* triggers screen off and waits for it to complete
+     * requires ACCESS_SURFACE_FLINGER permission.
+     */
     virtual void blank(const sp<IBinder>& display) = 0;
 
-    /* triggers screen on and waits for it to complete */
+    /* triggers screen on and waits for it to complete
+     * requires ACCESS_SURFACE_FLINGER permission.
+     */
     virtual void unblank(const sp<IBinder>& display) = 0;
 
     /* returns information about a display
      * intended to be used to get information about built-in displays */
     virtual status_t getDisplayInfo(const sp<IBinder>& display, DisplayInfo* info) = 0;
 
+    /* Capture the specified screen. requires READ_FRAME_BUFFER permission
+     * This function will fail if there is a secure window on screen.
+     */
     virtual status_t captureScreen(const sp<IBinder>& display,
             const sp<IGraphicBufferProducer>& producer,
             uint32_t reqWidth, uint32_t reqHeight,
diff --git a/include/media/drm/DrmAPI.h b/include/media/drm/DrmAPI.h
new file mode 100644
index 0000000..77da0bf
--- /dev/null
+++ b/include/media/drm/DrmAPI.h
@@ -0,0 +1,205 @@
+ /*
+ * Copyright (C) 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef DRM_API_H_
+#define DRM_API_H_
+
+#include <utils/List.h>
+#include <utils/String8.h>
+#include <utils/Vector.h>
+#include <utils/KeyedVector.h>
+#include <utils/RefBase.h>
+#include <media/stagefright/foundation/ABase.h>
+
+//  Loadable DrmEngine shared libraries should define the entry points
+//  createDrmFactory and createCryptoFactory as shown below:
+//
+//  extern "C" {
+//      extern android::DrmFactory *createDrmFactory();
+//      extern android::CryptoFactory *createCryptoFactory();
+//  }
+
+namespace android {
+
+    struct DrmPlugin;
+
+    // DRMs are implemented in DrmEngine plugins, which are dynamically
+    // loadable shared libraries that implement the entry points
+    // createDrmFactory and createCryptoFactory.  createDrmFactory
+    // constructs and returns an instance of a DrmFactory object.  Similarly,
+    // createCryptoFactory creates an instance of a CryptoFactory object.
+    // When a MediaCrypto or MediaDrm object needs to be constructed, all
+    // available DrmEngines present in the plugins directory on the device
+    // are scanned for a matching DrmEngine that can support the crypto
+    // scheme.  When a match is found, the DrmEngine's createCryptoPlugin and
+    // createDrmPlugin methods are used to create CryptoPlugin or
+    // DrmPlugin instances to support that DRM scheme.
+
+    class DrmFactory {
+    public:
+        DrmFactory() {}
+        virtual ~DrmFactory() {}
+
+        // DrmFactory::isCryptoSchemeSupported can be called to determine
+        // if the plugin factory is able to construct plugins that support a
+        // given crypto scheme, which is specified by a UUID.
+        virtual bool isCryptoSchemeSupported(const uint8_t uuid[16]) = 0;
+
+        // Construct a DrmPlugin for the crypto scheme specified by UUID.
+        virtual status_t createDrmPlugin(
+                const uint8_t uuid[16], DrmPlugin **plugin) = 0;
+
+    private:
+        DrmFactory(const DrmFactory &);
+        DrmFactory &operator=(const DrmFactory &);
+    };
+
+    class DrmPlugin {
+    public:
+        enum EventType {
+            kDrmPluginEventProvisionRequired,
+            kDrmPluginEventLicenseNeeded,
+            kDrmPluginEventLicenseExpired,
+            kDrmPluginEventVendorDefined
+        };
+
+        // A license can be for offline content or for online streaming.
+        // Offline licenses are persisted on the device and may be used when the device
+        // is disconnected from the network.
+        enum LicenseType {
+            kLicenseType_Offline,
+            kLicenseType_Streaming
+        };
+
+        DrmPlugin() {}
+        virtual ~DrmPlugin() {}
+
+        // Open a new session with the DrmPlugin object.  A session ID is returned
+        // in the sessionId parameter.
+        virtual status_t openSession(Vector<uint8_t> &sessionId) = 0;
+
+        // Close a session on the DrmPlugin object.
+        virtual status_t closeSession(Vector<uint8_t> const &sessionId) = 0;
+
+        // A license request/response exchange occurs between the app and a License
+        // Server to obtain the keys required to decrypt the content.  getLicenseRequest()
+        // is used to obtain an opaque license request blob that is delivered to the
+        // license server.
+        //
+        // The init data passed to getLicenseRequest is container-specific and its
+        // meaning is interpreted based on the mime type provided in the mimeType
+        // parameter to getLicenseRequest.  It could contain, for example, the content
+        // ID, key ID or other data obtained from the content metadata that is required
+        // in generating the license request.
+        //
+        // licenseType specifes if the license is for streaming or offline content
+        //
+        // optionalParameters are included in the license server request message to
+        // allow a client application to provide additional message parameters to the
+        // server.
+        //
+        // If successful, the opaque license request blob is returned to the caller.
+        virtual status_t
+            getLicenseRequest(Vector<uint8_t> const &sessionId,
+                              Vector<uint8_t> const &initData,
+                              String8 const &mimeType, LicenseType licenseType,
+                              KeyedVector<String8, String8> const &optionalParameters,
+                              Vector<uint8_t> &request, String8 &defaultUrl) = 0;
+
+        // After a license response is received by the app, it is provided to the
+        // Drm plugin using provideLicenseResponse.
+        virtual status_t provideLicenseResponse(Vector<uint8_t> const &sessionId,
+                                                Vector<uint8_t> const &response) = 0;
+
+        // Remove the keys associated with a license.
+        virtual status_t removeLicense(Vector<uint8_t> const &sessionId) = 0;
+
+        // Request an informative description of the license for the session.  The status
+        // is in the form of {name, value} pairs.  Since DRM license policies vary by
+        // vendor, the specific status field names are determined by each DRM vendor.
+        // Refer to your DRM provider documentation for definitions of the field names
+        // for a particular DrmEngine.
+        virtual status_t
+            queryLicenseStatus(Vector<uint8_t> const &sessionId,
+                               KeyedVector<String8, String8> &infoMap) const = 0;
+
+        // A provision request/response exchange occurs between the app and a
+        // provisioning server to retrieve a device certificate.  getProvisionRequest
+        // is used to obtain an opaque license request blob that is delivered to the
+        // provisioning server.
+        //
+        // If successful, the opaque provision request blob is returned to the caller.
+        virtual status_t getProvisionRequest(Vector<uint8_t> &request,
+                                             String8 &defaultUrl) = 0;
+
+        // After a provision response is received by the app, it is provided to the
+        // Drm plugin using provideProvisionResponse.
+        virtual status_t provideProvisionResponse(Vector<uint8_t> const &response) = 0;
+
+        // A means of enforcing the contractual requirement for a concurrent stream
+        // limit per subscriber across devices is provided via SecureStop.  SecureStop
+        // is a means of securely monitoring the lifetime of sessions. Since playback
+        // on a device can be interrupted due to reboot, power failure, etc. a means
+        // of persisting the lifetime information on the device is needed.
+        //
+        // A signed version of the sessionID is written to persistent storage on the
+        // device when each MediaCrypto object is created. The sessionID is signed by
+        // the device private key to prevent tampering.
+        //
+        // In the normal case, playback will be completed, the session destroyed and
+        // the Secure Stops will be queried. The App queries secure stops and forwards
+        // the secure stop message to the server which verifies the signature and
+        // notifies the server side database that the session destruction has been
+        // confirmed. The persisted record on the client is only removed after positive
+        // confirmation that the server received the message using releaseSecureStops().
+        virtual status_t getSecureStops(List<Vector<uint8_t> > &secureStops) = 0;
+        virtual status_t releaseSecureStops(Vector<uint8_t> const &ssRelease) = 0;
+
+        // Read a property value given the device property string.  There are a few forms
+        // of property access methods, depending on the data type returned.
+        // Since DRM plugin properties may vary, additional field names may be defined
+        // by each DRM vendor.  Refer to your DRM provider documentation for definitions
+        // of its additional field names.
+        //
+        // Standard values are:
+        //   "vendor" [string] identifies the maker of the plugin
+        //   "version" [string] identifies the version of the plugin
+        //   "description" [string] describes the plugin
+        //   'deviceUniqueId' [byte array] The device unique identifier is established
+        //   during device provisioning and provides a means of uniquely identifying
+        //   each device.
+        virtual status_t getPropertyString(String8 const &name, String8 &value ) const = 0;
+        virtual status_t getPropertyByteArray(String8 const &name,
+                                              Vector<uint8_t> &value ) const = 0;
+
+        // Write  a property value given the device property string.  There are a few forms
+        // of property setting methods, depending on the data type.
+        // Since DRM plugin properties may vary, additional field names may be defined
+        // by each DRM vendor.  Refer to your DRM provider documentation for definitions
+        // of its field names.
+        virtual status_t setPropertyString(String8 const &name,
+                                           String8 const &value ) = 0;
+        virtual status_t setPropertyByteArray(String8 const &name,
+                                              Vector<uint8_t> const &value ) = 0;
+
+        // TODO: provide way to send an event
+    private:
+        DISALLOW_EVIL_CONSTRUCTORS(DrmPlugin);
+    };
+
+}  // namespace android
+
+#endif // DRM_API_H_
diff --git a/include/media/drm/DrmClientAPI.h b/include/media/drm/DrmClientAPI.h
deleted file mode 100644
index 6a08933..0000000
--- a/include/media/drm/DrmClientAPI.h
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2012 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef DRM_CLIENT_API_H_
-#define DRM_CLIENT_API_H_
-
-#include <utils/String8.h>
-#include <utils/Vector.h>
-#include <utils/List.h>
-#include <media/stagefright/foundation/ABase.h>
-
-namespace android {
-
-    // A DrmMessageStatus object aggregates a sessionId, which uniquely
-    // identifies a playback context with a status code and opaque message
-    // data.
-    struct DrmMessageStatus {
-        Vector<uint8_t> mSessionId;
-        status_t mStatus;
-        Vector<uint8_t> mData;
-    };
-
-    class DrmClientPlugin {
-    public:
-
-        // A license can be for downloaded, offline content or for online streaming
-        // Offline licenses are persisted on the device and may be used when the device
-        // is disconnected from the network.
-        enum LicenseType {
-            kLicenseType_Offline,
-            kLicenseType_Streaming
-        };
-
-        DrmClientPlugin() {}
-        virtual ~DrmClientPlugin() {}
-
-        // A license request/response exchange occurs between the app and a License
-        // Server to obtain the keys required to decrypt the content.  getLicenseRequest()
-        // is used to obtain an opaque license request blob that is delivered to the
-        // license server.
-        //
-        // The init data passed to getLicenseRequest is container-specific and its
-        // meaning is interpreted based on the mime type provided in the mimeType
-        // parameter to getLicenseRequest.  It could contain, for example, the content
-        // ID, key ID or other data obtained from the content metadata that is required
-        // in generating the license request.
-        //
-        // The DrmMessageStatus returned from getLicenseRequest contains a sessionId for
-        // the new session, a status code indicating whether the operation was successful
-        // and if so, the request blob is placed into the mData field.
-        virtual DrmMessageStatus getLicenseRequest(Vector<uint8_t> const &initData,
-                String8 const &mimeType, LicenseType licenseType) = 0;
-
-        // After a license response is received by the app, it is provided to the
-        // DrmClient plugin using provideLicenseResponse.  The response data is provided
-        // in the mData field of the response parameter.
-        virtual status_t provideLicenseResponse(DrmMessageStatus const &response) = 0;
-
-        // Remove the keys associated with a license and release the session
-        virtual status_t clearLicense(Vector<uint8_t> const &sessionId) = 0;
-
-        // A provision request/response exchange occurs between the app and a
-        // provisioning server to retrieve a device certificate.  getProvisionRequest
-        // is used to obtain an opaque license request blob that is delivered to the
-        // provisioning server.
-        //
-        // The DrmMessageStatus returned from getLicenseRequest contains a status code
-        // indicating whether the operation was successful and if so, the request blob
-        // is placed into the mData field.
-        virtual DrmMessageStatus getProvisionRequest() = 0;
-
-        // After a provision response is received by the app, it is provided to the
-        // DrmClient plugin using provideProvisionResponse.  The response data is
-        // provided in the mData field of the response parameter.
-        virtual status_t provideProvisionResponse(DrmMessageStatus const &response) = 0;
-
-        // A means of enforcing the contractual requirement for a concurrent stream
-        // limit per subscriber across devices is provided via SecureStop.  SecureStop
-        // is a means of securely monitoring the lifetime of sessions. Since playback
-        // on a device can be interrupted due to reboot, power failure, etc. a means
-        // of persisting the lifetime information on the device is needed.
-        //
-        // A signed version of the sessionID is written to persistent storage on the
-        // device when each MediaCrypto object is created. The sessionID is signed by
-        // the device private key to prevent tampering.
-        //
-        // In the normal case, playback will be completed, the session destroyed and
-        // the Secure Stops will be queried. The App queries secure stops and forwards
-        // the secure stop message to the server which verifies the signature and
-        // notifies the server side database that the session destruction has been
-        // confirmed. The persisted record on the client is only removed after positive
-        // confirmation that the server received the message using releaseSecureStops().
-        virtual List<DrmMessageStatus> getSecureStops() = 0;
-        virtual status_t releaseSecureStops(DrmMessageStatus const &ssRelease) = 0;
-
-        // Retrieve the device unique identifier for this device.  The device unique
-        // identifier is established during device provisioning.
-        virtual Vector<uint8_t> getDeviceUniqueId() const = 0;
-
-    private:
-        DISALLOW_EVIL_CONSTRUCTORS(DrmClientPlugin);
-    };
-
-}  // namespace android
-
-#endif // DRM_CLIENT_API_H_
diff --git a/include/media/drm/DrmEngineAPI.h b/include/media/drm/DrmEngineAPI.h
deleted file mode 100644
index 25bd34a..0000000
--- a/include/media/drm/DrmEngineAPI.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2012 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef DRM_ENGINE_API_H_
-#define DRM_ENGINE_API_H_
-
-#include <utils/Errors.h>
-#include <media/stagefright/foundation/ABase.h>
-
-
-namespace android {
-
-    class CryptoPlugin;
-    class DrmClientPlugin;
-
-     // DRMs are implemented in DrmEngine plugins, which are dynamically
-     // loadable shared libraries that implement the entry point
-     // createDrmPluginFactory.  createDrmPluginFactory constructs and returns
-     // an instance of a DrmPluginFactory object.  When a MediaCrypto or
-     // DrmClient object needs to be constructed, all available
-     // DrmEngines present in the plugins directory on the device are scanned
-     // for a matching DrmEngine that can support the crypto scheme.  When a
-     // match is found, the DrmEngine’s createCryptoPlugin or
-     // createDrmClientPlugin methods are used to create CryptoPlugin or
-     // DrmClientPlugin instances to support that DRM scheme.
-
-    class DrmPluginFactory {
-    public:
-        DrmPluginFactory() {}
-        virtual ~DrmPluginFactory() {}
-
-         // DrmPluginFactory::isCryptoSchemeSupported can be called to determine
-         // if the plugin factory is able to construct plugins that support a
-         // given crypto scheme, which is specified by a UUID.
-        virtual bool isCryptoSchemeSupported(const uint8_t uuid[16]) const = 0;
-
-        // Construct a CryptoPlugin for the crypto scheme specified by UUID.
-        // {data, size} provide scheme-specific initialization data.
-        virtual status_t createCryptoPlugin(
-                const uint8_t uuid[16], const void *data, size_t size,
-                CryptoPlugin **plugin) = 0;
-
-        // Construct a DrmClientPlugin for the crypto scheme specified by UUID.
-        // {data, size} provide scheme-specific initialization data.
-        virtual status_t createDrmClientPlugin(
-                const uint8_t uuid[16], const void *data, size_t size,
-                DrmClientPlugin **plugin) = 0;
-
-    private:
-        DISALLOW_EVIL_CONSTRUCTORS(DrmPluginFactory);
-    };
-
-}  // namespace android
-
- //  Loadable DrmEngine shared libraries should define the entry point
- //  createDrmPluginFactory as shown below:
- //
- //  extern "C" {
- //      extern android::DrmPluginFactory *createDrmPluginFactory();
- //  }
-
-#endif // DRM_ENGINE_API_H_
diff --git a/include/utils/RefBase.h b/include/utils/RefBase.h
index 0a8e10a..033fe67 100644
--- a/include/utils/RefBase.h
+++ b/include/utils/RefBase.h
@@ -52,12 +52,16 @@
 }
 
 // ---------------------------------------------------------------------------
-class ReferenceMover;
-class ReferenceConverterBase {
+
+class ReferenceRenamer {
+protected:
+    // destructor is purposedly not virtual so we avoid code overhead from
+    // subclasses; we have to make it protected to guarantee that it
+    // cannot be called from this base class (and to make strict compilers
+    // happy).
+    ~ReferenceRenamer() { }
 public:
-    virtual size_t getReferenceTypeSize() const = 0;
-    virtual void* getReferenceBase(void const*) const = 0;
-    inline virtual ~ReferenceConverterBase() { }
+    virtual void operator()(size_t i) const = 0;
 };
 
 // ---------------------------------------------------------------------------
@@ -144,17 +148,23 @@
     virtual void            onLastWeakRef(const void* id);
 
 private:
-    friend class ReferenceMover;
-    static void moveReferences(void* d, void const* s, size_t n,
-            const ReferenceConverterBase& caster);
-
-private:
     friend class weakref_type;
     class weakref_impl;
     
                             RefBase(const RefBase& o);
             RefBase&        operator=(const RefBase& o);
 
+private:
+    friend class ReferenceMover;
+
+    static void renameRefs(size_t n, const ReferenceRenamer& renamer);
+
+    static void renameRefId(weakref_type* ref,
+            const void* old_id, const void* new_id);
+
+    static void renameRefId(RefBase* ref,
+            const void* old_id, const void* new_id);
+
         weakref_impl* const mRefs;
 };
 
@@ -185,8 +195,9 @@
 
 private:
     friend class ReferenceMover;
-    inline static void moveReferences(void* d, void const* s, size_t n,
-            const ReferenceConverterBase& caster) { }
+    inline static void renameRefs(size_t n, const ReferenceRenamer& renamer) { }
+    inline static void renameRefId(T* ref,
+            const void* old_id, const void* new_id) { }
 
 private:
     mutable volatile int32_t mCount;
@@ -455,42 +466,48 @@
 
 // this class just serves as a namespace so TYPE::moveReferences can stay
 // private.
-
 class ReferenceMover {
-    // StrongReferenceCast and WeakReferenceCast do the impedance matching
-    // between the generic (void*) implementation in Refbase and the strongly typed
-    // template specializations below.
-
-    template <typename TYPE>
-    struct StrongReferenceCast : public ReferenceConverterBase {
-        virtual size_t getReferenceTypeSize() const { return sizeof( sp<TYPE> ); }
-        virtual void* getReferenceBase(void const* p) const {
-            sp<TYPE> const* sptr(reinterpret_cast<sp<TYPE> const*>(p));
-            return static_cast<typename TYPE::basetype *>(sptr->get());
-        }
-    };
-
-    template <typename TYPE>
-    struct WeakReferenceCast : public ReferenceConverterBase {
-        virtual size_t getReferenceTypeSize() const { return sizeof( wp<TYPE> ); }
-        virtual void* getReferenceBase(void const* p) const {
-            wp<TYPE> const* sptr(reinterpret_cast<wp<TYPE> const*>(p));
-            return static_cast<typename TYPE::basetype *>(sptr->unsafe_get());
-        }
-    };
-
 public:
+    // it would be nice if we could make sure no extra code is generated
+    // for sp<TYPE> or wp<TYPE> when TYPE is a descendant of RefBase:
+    // Using a sp<RefBase> override doesn't work; it's a bit like we wanted
+    // a template<typename TYPE inherits RefBase> template...
+
     template<typename TYPE> static inline
     void move_references(sp<TYPE>* d, sp<TYPE> const* s, size_t n) {
+
+        class Renamer : public ReferenceRenamer {
+            sp<TYPE>* d;
+            sp<TYPE> const* s;
+            virtual void operator()(size_t i) const {
+                // The id are known to be the sp<>'s this pointer
+                TYPE::renameRefId(d[i].get(), &s[i], &d[i]);
+            }
+        public:
+            Renamer(sp<TYPE>* d, sp<TYPE> const* s) : s(s), d(d) { }
+        };
+
         memmove(d, s, n*sizeof(sp<TYPE>));
-        StrongReferenceCast<TYPE> caster;
-        TYPE::moveReferences(d, s, n, caster);
+        TYPE::renameRefs(n, Renamer(d, s));
     }
+
+
     template<typename TYPE> static inline
     void move_references(wp<TYPE>* d, wp<TYPE> const* s, size_t n) {
+
+        class Renamer : public ReferenceRenamer {
+            wp<TYPE>* d;
+            wp<TYPE> const* s;
+            virtual void operator()(size_t i) const {
+                // The id are known to be the wp<>'s this pointer
+                TYPE::renameRefId(d[i].get_refs(), &s[i], &d[i]);
+            }
+        public:
+            Renamer(wp<TYPE>* d, wp<TYPE> const* s) : s(s), d(d) { }
+        };
+
         memmove(d, s, n*sizeof(wp<TYPE>));
-        WeakReferenceCast<TYPE> caster;
-        TYPE::moveReferences(d, s, n, caster);
+        TYPE::renameRefs(n, Renamer(d, s));
     }
 };
 
diff --git a/include/utils/Vector.h b/include/utils/Vector.h
index f3020d6..ed7b725 100644
--- a/include/utils/Vector.h
+++ b/include/utils/Vector.h
@@ -80,7 +80,13 @@
     //! sets the capacity. capacity can never be reduced less than size()
     inline  ssize_t         setCapacity(size_t size)    { return VectorImpl::setCapacity(size); }
 
-    /*! 
+    /*!
+     * set the size of the vector. items are appended with the default
+     * constructor, or removed from the end as needed.
+     */
+    inline  ssize_t         resize(size_t size)         { return VectorImpl::resize(size); }
+
+    /*!
      * C-style array access
      */
      
diff --git a/include/utils/VectorImpl.h b/include/utils/VectorImpl.h
index c4ec2ff..9bc50e6 100644
--- a/include/utils/VectorImpl.h
+++ b/include/utils/VectorImpl.h
@@ -64,6 +64,7 @@
     inline  bool            isEmpty() const     { return mCount == 0; }
             size_t          capacity() const;
             ssize_t         setCapacity(size_t size);
+            ssize_t         resize(size_t size);
 
             /*! append/insert another vector or array */
             ssize_t         insertVectorAt(const VectorImpl& vector, size_t index);
diff --git a/libs/binder/MemoryBase.cpp b/libs/binder/MemoryBase.cpp
index 033066b..5c82330 100644
--- a/libs/binder/MemoryBase.cpp
+++ b/libs/binder/MemoryBase.cpp
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#define LOG_TAG "MemoryBase"
 
 #include <stdlib.h>
 #include <stdint.h>
@@ -44,3 +45,11 @@
 
 // ---------------------------------------------------------------------------
 }; // namespace android
+
+// Backwards compatibility for libdatabase_sqlcipher (http://b/8253769).
+extern "C" void _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEEij(void*, void*, ssize_t, size_t);
+extern "C" void _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEElj(void* obj, void* h, long o, unsigned int size) {
+    _ZN7android10MemoryBaseC1ERKNS_2spINS_11IMemoryHeapEEEij(obj, h, o, size);
+    ALOGW("Using temporary compatibility workaround for usage of MemoryBase "
+          "private API. Please fix your application!");
+}
diff --git a/libs/gui/BufferQueue.cpp b/libs/gui/BufferQueue.cpp
index 41ee1be..75a0296 100644
--- a/libs/gui/BufferQueue.cpp
+++ b/libs/gui/BufferQueue.cpp
@@ -254,7 +254,7 @@
     return NO_ERROR;
 }
 
-status_t BufferQueue::dequeueBuffer(int *outBuf, sp<Fence>& outFence,
+status_t BufferQueue::dequeueBuffer(int *outBuf, sp<Fence>* outFence,
         uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
     ATRACE_CALL();
     ST_LOGV("dequeueBuffer: w=%d h=%d fmt=%#x usage=%#x", w, h, format, usage);
@@ -393,7 +393,7 @@
 
         dpy = mSlots[buf].mEglDisplay;
         eglFence = mSlots[buf].mEglFence;
-        outFence = mSlots[buf].mFence;
+        *outFence = mSlots[buf].mFence;
         mSlots[buf].mEglFence = EGL_NO_SYNC_KHR;
         mSlots[buf].mFence = Fence::NO_FENCE;
     }  // end lock scope
@@ -590,7 +590,7 @@
     return OK;
 }
 
-void BufferQueue::cancelBuffer(int buf, sp<Fence> fence) {
+void BufferQueue::cancelBuffer(int buf, const sp<Fence>& fence) {
     ATRACE_CALL();
     ST_LOGV("cancelBuffer: slot=%d", buf);
     Mutex::Autolock lock(mMutex);
diff --git a/libs/gui/IGraphicBufferProducer.cpp b/libs/gui/IGraphicBufferProducer.cpp
index 54860d7..63d7628 100644
--- a/libs/gui/IGraphicBufferProducer.cpp
+++ b/libs/gui/IGraphicBufferProducer.cpp
@@ -81,7 +81,7 @@
         return result;
     }
 
-    virtual status_t dequeueBuffer(int *buf, sp<Fence>& fence,
+    virtual status_t dequeueBuffer(int *buf, sp<Fence>* fence,
             uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
         Parcel data, reply;
         data.writeInterfaceToken(IGraphicBufferProducer::getInterfaceDescriptor());
@@ -99,8 +99,8 @@
             // If the fence was written by the callee, then overwrite the
             // caller's fence here.  If it wasn't written then don't touch the
             // caller's fence.
-            fence = new Fence();
-            reply.read(*fence.get());
+            *fence = new Fence();
+            reply.read(*(fence->get()));
         }
         result = reply.readInt32();
         return result;
@@ -121,7 +121,7 @@
         return result;
     }
 
-    virtual void cancelBuffer(int buf, sp<Fence> fence) {
+    virtual void cancelBuffer(int buf, const sp<Fence>& fence) {
         Parcel data, reply;
         data.writeInterfaceToken(IGraphicBufferProducer::getInterfaceDescriptor());
         data.writeInt32(buf);
@@ -215,7 +215,7 @@
             uint32_t usage  = data.readInt32();
             int buf;
             sp<Fence> fence;
-            int result = dequeueBuffer(&buf, fence, w, h, format, usage);
+            int result = dequeueBuffer(&buf, &fence, w, h, format, usage);
             reply->writeInt32(buf);
             reply->writeInt32(fence != NULL);
             if (fence != NULL) {
diff --git a/libs/gui/Surface.cpp b/libs/gui/Surface.cpp
index ec55b57..4a58023 100644
--- a/libs/gui/Surface.cpp
+++ b/libs/gui/Surface.cpp
@@ -182,8 +182,8 @@
     int reqW = mReqWidth ? mReqWidth : mUserWidth;
     int reqH = mReqHeight ? mReqHeight : mUserHeight;
     sp<Fence> fence;
-    status_t result = mGraphicBufferProducer->dequeueBuffer(&buf, fence, reqW, reqH,
-            mReqFormat, mReqUsage);
+    status_t result = mGraphicBufferProducer->dequeueBuffer(&buf, &fence,
+            reqW, reqH, mReqFormat, mReqUsage);
     if (result < 0) {
         ALOGV("dequeueBuffer: IGraphicBufferProducer::dequeueBuffer(%d, %d, %d, %d)"
              "failed: %d", mReqWidth, mReqHeight, mReqFormat, mReqUsage,
diff --git a/libs/gui/tests/BufferQueue_test.cpp b/libs/gui/tests/BufferQueue_test.cpp
index 93f8faf..62d215b 100644
--- a/libs/gui/tests/BufferQueue_test.cpp
+++ b/libs/gui/tests/BufferQueue_test.cpp
@@ -76,7 +76,7 @@
 
     for (int i = 0; i < 2; i++) {
         ASSERT_EQ(IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION,
-                mBQ->dequeueBuffer(&slot, fence, 1, 1, 0,
+                mBQ->dequeueBuffer(&slot, &fence, 1, 1, 0,
                     GRALLOC_USAGE_SW_READ_OFTEN));
         ASSERT_EQ(OK, mBQ->requestBuffer(slot, &buf));
         ASSERT_EQ(OK, mBQ->queueBuffer(slot, qbi, &qbo));
@@ -84,7 +84,7 @@
     }
 
     ASSERT_EQ(IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION,
-            mBQ->dequeueBuffer(&slot, fence, 1, 1, 0,
+            mBQ->dequeueBuffer(&slot, &fence, 1, 1, 0,
                 GRALLOC_USAGE_SW_READ_OFTEN));
     ASSERT_EQ(OK, mBQ->requestBuffer(slot, &buf));
     ASSERT_EQ(OK, mBQ->queueBuffer(slot, qbi, &qbo));
diff --git a/libs/utils/RefBase.cpp b/libs/utils/RefBase.cpp
index 3dac89e..3d3a595 100644
--- a/libs/utils/RefBase.cpp
+++ b/libs/utils/RefBase.cpp
@@ -15,7 +15,7 @@
  */
 
 #define LOG_TAG "RefBase"
-#define LOG_NDEBUG 0
+// #define LOG_NDEBUG 0
 
 #include <utils/RefBase.h>
 
@@ -35,10 +35,18 @@
 
 // compile with refcounting debugging enabled
 #define DEBUG_REFS                      0
-#define DEBUG_REFS_FATAL_SANITY_CHECKS  0
-#define DEBUG_REFS_ENABLED_BY_DEFAULT   1
+
+// whether ref-tracking is enabled by default, if not, trackMe(true, false)
+// needs to be called explicitly
+#define DEBUG_REFS_ENABLED_BY_DEFAULT   0
+
+// whether callstack are collected (significantly slows things down)
 #define DEBUG_REFS_CALLSTACK_ENABLED    1
 
+// folder where stack traces are saved when DEBUG_REFS is enabled
+// this folder needs to exist and be writable
+#define DEBUG_REFS_CALLSTACK_PATH       "/data/debug"
+
 // log all reference counting operations
 #define PRINT_REFS                      0
 
@@ -96,11 +104,7 @@
         bool dumpStack = false;
         if (!mRetain && mStrongRefs != NULL) {
             dumpStack = true;
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("Strong references remain!");
-#else
             ALOGE("Strong references remain:");
-#endif
             ref_entry* refs = mStrongRefs;
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
@@ -114,11 +118,7 @@
 
         if (!mRetain && mWeakRefs != NULL) {
             dumpStack = true;
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("Weak references remain:");
-#else
             ALOGE("Weak references remain!");
-#endif
             ref_entry* refs = mWeakRefs;
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
@@ -199,7 +199,7 @@
 
         {
             char name[100];
-            snprintf(name, 100, "/data/%p.stack", this);
+            snprintf(name, 100, DEBUG_REFS_CALLSTACK_PATH "/%p.stack", this);
             int rc = open(name, O_RDWR | O_CREAT | O_APPEND, 644);
             if (rc >= 0) {
                 write(rc, text.string(), text.length());
@@ -258,12 +258,6 @@
                 ref = *refs;
             }
 
-#if DEBUG_REFS_FATAL_SANITY_CHECKS
-            LOG_ALWAYS_FATAL("RefBase: removing id %p on RefBase %p"
-                    "(weakref_type %p) that doesn't exist!",
-                    id, mBase, this);
-#endif
-
             ALOGE("RefBase: removing id %p on RefBase %p"
                     "(weakref_type %p) that doesn't exist!",
                     id, mBase, this);
@@ -441,39 +435,68 @@
     incWeak(id);
     
     weakref_impl* const impl = static_cast<weakref_impl*>(this);
-    
     int32_t curCount = impl->mStrong;
-    ALOG_ASSERT(curCount >= 0, "attemptIncStrong called on %p after underflow",
-               this);
+
+    ALOG_ASSERT(curCount >= 0,
+            "attemptIncStrong called on %p after underflow", this);
+
     while (curCount > 0 && curCount != INITIAL_STRONG_VALUE) {
+        // we're in the easy/common case of promoting a weak-reference
+        // from an existing strong reference.
         if (android_atomic_cmpxchg(curCount, curCount+1, &impl->mStrong) == 0) {
             break;
         }
+        // the strong count has changed on us, we need to re-assert our
+        // situation.
         curCount = impl->mStrong;
     }
     
     if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
-        bool allow;
-        if (curCount == INITIAL_STRONG_VALUE) {
-            // Attempting to acquire first strong reference...  this is allowed
-            // if the object does NOT have a longer lifetime (meaning the
-            // implementation doesn't need to see this), or if the implementation
-            // allows it to happen.
-            allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) != OBJECT_LIFETIME_WEAK
-                  || impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
+        // we're now in the harder case of either:
+        // - there never was a strong reference on us
+        // - or, all strong references have been released
+        if ((impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_STRONG) {
+            // this object has a "normal" life-time, i.e.: it gets destroyed
+            // when the last strong reference goes away
+            if (curCount <= 0) {
+                // the last strong-reference got released, the object cannot
+                // be revived.
+                decWeak(id);
+                return false;
+            }
+
+            // here, curCount == INITIAL_STRONG_VALUE, which means
+            // there never was a strong-reference, so we can try to
+            // promote this object; we need to do that atomically.
+            while (curCount > 0) {
+                if (android_atomic_cmpxchg(curCount, curCount + 1,
+                        &impl->mStrong) == 0) {
+                    break;
+                }
+                // the strong count has changed on us, we need to re-assert our
+                // situation (e.g.: another thread has inc/decStrong'ed us)
+                curCount = impl->mStrong;
+            }
+
+            if (curCount <= 0) {
+                // promote() failed, some other thread destroyed us in the
+                // meantime (i.e.: strong count reached zero).
+                decWeak(id);
+                return false;
+            }
         } else {
-            // Attempting to revive the object...  this is allowed
-            // if the object DOES have a longer lifetime (so we can safely
-            // call the object with only a weak ref) and the implementation
-            // allows it to happen.
-            allow = (impl->mFlags&OBJECT_LIFETIME_WEAK) == OBJECT_LIFETIME_WEAK
-                  && impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id);
+            // this object has an "extended" life-time, i.e.: it can be
+            // revived from a weak-reference only.
+            // Ask the object's implementation if it agrees to be revived
+            if (!impl->mBase->onIncStrongAttempted(FIRST_INC_STRONG, id)) {
+                // it didn't so give-up.
+                decWeak(id);
+                return false;
+            }
+            // grab a strong-reference, which is always safe due to the
+            // extended life-time.
+            curCount = android_atomic_inc(&impl->mStrong);
         }
-        if (!allow) {
-            decWeak(id);
-            return false;
-        }
-        curCount = android_atomic_inc(&impl->mStrong);
 
         // If the strong reference count has already been incremented by
         // someone else, the implementor of onIncStrongAttempted() is holding
@@ -491,11 +514,23 @@
     ALOGD("attemptIncStrong of %p from %p: cnt=%d\n", this, id, curCount);
 #endif
 
-    if (curCount == INITIAL_STRONG_VALUE) {
-        android_atomic_add(-INITIAL_STRONG_VALUE, &impl->mStrong);
-        impl->mBase->onFirstRef();
+    // now we need to fix-up the count if it was INITIAL_STRONG_VALUE
+    // this must be done safely, i.e.: handle the case where several threads
+    // were here in attemptIncStrong().
+    curCount = impl->mStrong;
+    while (curCount >= INITIAL_STRONG_VALUE) {
+        ALOG_ASSERT(curCount > INITIAL_STRONG_VALUE,
+                "attemptIncStrong in %p underflowed to INITIAL_STRONG_VALUE",
+                this);
+        if (android_atomic_cmpxchg(curCount, curCount-INITIAL_STRONG_VALUE,
+                &impl->mStrong) == 0) {
+            break;
+        }
+        // the strong-count changed on us, we need to re-assert the situation,
+        // for e.g.: it's possible the fix-up happened in another thread.
+        curCount = impl->mStrong;
     }
-    
+
     return true;
 }
 
@@ -596,21 +631,27 @@
 
 // ---------------------------------------------------------------------------
 
-void RefBase::moveReferences(void* dst, void const* src, size_t n,
-        const ReferenceConverterBase& caster)
-{
+void RefBase::renameRefs(size_t n, const ReferenceRenamer& renamer) {
 #if DEBUG_REFS
-    const size_t itemSize = caster.getReferenceTypeSize();
     for (size_t i=0 ; i<n ; i++) {
-        void*       d = reinterpret_cast<void      *>(intptr_t(dst) + i*itemSize);
-        void const* s = reinterpret_cast<void const*>(intptr_t(src) + i*itemSize);
-        RefBase* ref(reinterpret_cast<RefBase*>(caster.getReferenceBase(d)));
-        ref->mRefs->renameStrongRefId(s, d);
-        ref->mRefs->renameWeakRefId(s, d);
+        renamer(i);
     }
 #endif
 }
 
+void RefBase::renameRefId(weakref_type* ref,
+        const void* old_id, const void* new_id) {
+    weakref_impl* const impl = static_cast<weakref_impl*>(ref);
+    impl->renameStrongRefId(old_id, new_id);
+    impl->renameWeakRefId(old_id, new_id);
+}
+
+void RefBase::renameRefId(RefBase* ref,
+        const void* old_id, const void* new_id) {
+    ref->mRefs->renameStrongRefId(old_id, new_id);
+    ref->mRefs->renameWeakRefId(old_id, new_id);
+}
+
 // ---------------------------------------------------------------------------
 
 TextOutput& printStrongPointer(TextOutput& to, const void* val)
diff --git a/libs/utils/VectorImpl.cpp b/libs/utils/VectorImpl.cpp
index c3257bb..70f49de 100644
--- a/libs/utils/VectorImpl.cpp
+++ b/libs/utils/VectorImpl.cpp
@@ -343,6 +343,16 @@
     return new_capacity;
 }
 
+ssize_t VectorImpl::resize(size_t size) {
+    ssize_t result = NO_ERROR;
+    if (size > mCount) {
+        result = insertAt(mCount, size - mCount);
+    } else if (size < mCount) {
+        result = removeItemsAt(size, mCount - size);
+    }
+    return result < 0 ? result : size;
+}
+
 void VectorImpl::release_storage()
 {
     if (mStorage) {
diff --git a/services/surfaceflinger/Android.mk b/services/surfaceflinger/Android.mk
index 5ff8154..30a01be 100644
--- a/services/surfaceflinger/Android.mk
+++ b/services/surfaceflinger/Android.mk
@@ -2,22 +2,23 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES:= \
-    Client.cpp                              \
-    DisplayDevice.cpp                       \
-    EventThread.cpp                         \
-    FrameTracker.cpp                        \
-    Layer.cpp                               \
-    LayerDim.cpp                            \
-    DisplayHardware/FramebufferSurface.cpp  \
-    DisplayHardware/HWComposer.cpp          \
-    DisplayHardware/PowerHAL.cpp            \
-    GLExtensions.cpp                        \
-    MessageQueue.cpp                        \
-    SurfaceFlinger.cpp                      \
-    SurfaceFlingerConsumer.cpp              \
-    SurfaceTextureLayer.cpp                 \
-    Transform.cpp                           \
-    
+    Client.cpp \
+    DisplayDevice.cpp \
+    EventThread.cpp \
+    FrameTracker.cpp \
+    GLExtensions.cpp \
+    Layer.cpp \
+    LayerDim.cpp \
+    MessageQueue.cpp \
+    SurfaceFlinger.cpp \
+    SurfaceFlingerConsumer.cpp \
+    SurfaceTextureLayer.cpp \
+    Transform.cpp \
+    DisplayHardware/BufferQueueInterposer.cpp \
+    DisplayHardware/FramebufferSurface.cpp \
+    DisplayHardware/HWComposer.cpp \
+    DisplayHardware/PowerHAL.cpp \
+    DisplayHardware/VirtualDisplaySurface.cpp \
 
 LOCAL_CFLAGS:= -DLOG_TAG=\"SurfaceFlinger\"
 LOCAL_CFLAGS += -DGL_GLEXT_PROTOTYPES -DEGL_EGLEXT_PROTOTYPES
diff --git a/services/surfaceflinger/DisplayDevice.cpp b/services/surfaceflinger/DisplayDevice.cpp
index 2bbe49c..ecd12d0 100644
--- a/services/surfaceflinger/DisplayDevice.cpp
+++ b/services/surfaceflinger/DisplayDevice.cpp
@@ -35,7 +35,7 @@
 
 #include <hardware/gralloc.h>
 
-#include "DisplayHardware/FramebufferSurface.h"
+#include "DisplayHardware/DisplaySurface.h"
 #include "DisplayHardware/HWComposer.h"
 
 #include "clz.h"
@@ -72,14 +72,12 @@
         DisplayType type,
         bool isSecure,
         const wp<IBinder>& displayToken,
-        const sp<ANativeWindow>& nativeWindow,
-        const sp<FramebufferSurface>& framebufferSurface,
+        const sp<DisplaySurface>& displaySurface,
         EGLConfig config)
     : mFlinger(flinger),
       mType(type), mHwcDisplayId(-1),
       mDisplayToken(displayToken),
-      mNativeWindow(nativeWindow),
-      mFramebufferSurface(framebufferSurface),
+      mDisplaySurface(displaySurface),
       mDisplay(EGL_NO_DISPLAY),
       mSurface(EGL_NO_SURFACE),
       mContext(EGL_NO_CONTEXT),
@@ -92,6 +90,7 @@
       mLayerStack(NO_LAYER_STACK),
       mOrientation()
 {
+    mNativeWindow = new Surface(mDisplaySurface->getIGraphicBufferProducer());
     init(config);
 }
 
@@ -183,10 +182,7 @@
 }
 
 status_t DisplayDevice::compositionComplete() const {
-    if (mFramebufferSurface == NULL) {
-        return NO_ERROR;
-    }
-    return mFramebufferSurface->compositionComplete();
+    return mDisplaySurface->compositionComplete();
 }
 
 void DisplayDevice::flip(const Region& dirty) const
@@ -209,45 +205,38 @@
 }
 
 void DisplayDevice::swapBuffers(HWComposer& hwc) const {
-    EGLBoolean success = EGL_TRUE;
-    if (hwc.initCheck() != NO_ERROR) {
-        // no HWC, we call eglSwapBuffers()
-        success = eglSwapBuffers(mDisplay, mSurface);
-    } else {
-        // We have a valid HWC, but not all displays can use it, in particular
-        // the virtual displays are on their own.
-        // TODO: HWC 1.2 will allow virtual displays
-        if (mType >= DisplayDevice::DISPLAY_VIRTUAL) {
-            // always call eglSwapBuffers() for virtual displays
-            success = eglSwapBuffers(mDisplay, mSurface);
-        } else if (hwc.supportsFramebufferTarget()) {
-            // as of hwc 1.1 we always call eglSwapBuffers if we have some
-            // GLES layers
-            if (hwc.hasGlesComposition(mType)) {
-                success = eglSwapBuffers(mDisplay, mSurface);
+    // We need to call eglSwapBuffers() unless:
+    // (a) there was no GLES composition this frame, or
+    // (b) we're using a legacy HWC with no framebuffer target support (in
+    //     which case HWComposer::commit() handles things).
+    if (hwc.initCheck() != NO_ERROR ||
+            (hwc.hasGlesComposition(mHwcDisplayId) &&
+             hwc.supportsFramebufferTarget())) {
+        EGLBoolean success = eglSwapBuffers(mDisplay, mSurface);
+        if (!success) {
+            EGLint error = eglGetError();
+            if (error == EGL_CONTEXT_LOST ||
+                    mType == DisplayDevice::DISPLAY_PRIMARY) {
+                LOG_ALWAYS_FATAL("eglSwapBuffers(%p, %p) failed with 0x%08x",
+                        mDisplay, mSurface, error);
+            } else {
+                ALOGE("eglSwapBuffers(%p, %p) failed with 0x%08x",
+                        mDisplay, mSurface, error);
             }
-        } else {
-            // HWC doesn't have the framebuffer target, we don't call
-            // eglSwapBuffers(), since this is handled by HWComposer::commit().
         }
     }
 
-    if (!success) {
-        EGLint error = eglGetError();
-        if (error == EGL_CONTEXT_LOST ||
-                mType == DisplayDevice::DISPLAY_PRIMARY) {
-            LOG_ALWAYS_FATAL("eglSwapBuffers(%p, %p) failed with 0x%08x",
-                    mDisplay, mSurface, error);
-        }
+    status_t result = mDisplaySurface->advanceFrame();
+    if (result != NO_ERROR) {
+        ALOGE("[%s] failed pushing new frame to HWC: %d",
+                mDisplayName.string(), result);
     }
 }
 
 void DisplayDevice::onSwapBuffersCompleted(HWComposer& hwc) const {
     if (hwc.initCheck() == NO_ERROR) {
-        if (hwc.supportsFramebufferTarget()) {
-            int fd = hwc.getAndResetReleaseFenceFd(mType);
-            mFramebufferSurface->setReleaseFenceFd(fd);
-        }
+        int fd = hwc.getAndResetReleaseFenceFd(mType);
+        mDisplaySurface->setReleaseFenceFd(fd);
     }
 }
 
@@ -455,9 +444,7 @@
 
     result.append(buffer);
 
-    String8 fbtargetDump;
-    if (mFramebufferSurface != NULL) {
-        mFramebufferSurface->dump(fbtargetDump);
-        result.append(fbtargetDump);
-    }
+    String8 surfaceDump;
+    mDisplaySurface->dump(surfaceDump);
+    result.append(surfaceDump);
 }
diff --git a/services/surfaceflinger/DisplayDevice.h b/services/surfaceflinger/DisplayDevice.h
index f671017..d8f55b4 100644
--- a/services/surfaceflinger/DisplayDevice.h
+++ b/services/surfaceflinger/DisplayDevice.h
@@ -37,7 +37,7 @@
 namespace android {
 
 class DisplayInfo;
-class FramebufferSurface;
+class DisplaySurface;
 class Layer;
 class SurfaceFlinger;
 class HWComposer;
@@ -74,8 +74,7 @@
             DisplayType type,
             bool isSecure,
             const wp<IBinder>& displayToken,
-            const sp<ANativeWindow>& nativeWindow,
-            const sp<FramebufferSurface>& framebufferSurface,
+            const sp<DisplaySurface>& displaySurface,
             EGLConfig config);
 
     ~DisplayDevice();
@@ -165,9 +164,7 @@
 
     // ANativeWindow this display is rendering into
     sp<ANativeWindow> mNativeWindow;
-
-    // set if mNativeWindow is a FramebufferSurface
-    sp<FramebufferSurface> mFramebufferSurface;
+    sp<DisplaySurface> mDisplaySurface;
 
     EGLDisplay      mDisplay;
     EGLSurface      mSurface;
diff --git a/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp
new file mode 100644
index 0000000..d8ad224
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.cpp
@@ -0,0 +1,238 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#undef LOG_TAG
+#define LOG_TAG "BQInterposer"
+
+#include "BufferQueueInterposer.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+#define BQI_LOGV(x, ...) ALOGV("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGD(x, ...) ALOGD("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGI(x, ...) ALOGI("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGW(x, ...) ALOGW("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define BQI_LOGE(x, ...) ALOGE("[%s] "x, mName.string(), ##__VA_ARGS__)
+
+// Get an ID that's unique within this process.
+static int32_t createProcessUniqueId() {
+    static volatile int32_t globalCounter = 0;
+    return android_atomic_inc(&globalCounter);
+}
+
+BufferQueueInterposer::BufferQueueInterposer(
+        const sp<IGraphicBufferProducer>& sink, const String8& name)
+:   mSink(sink),
+    mName(name),
+    mAcquired(false)
+{
+    BQI_LOGV("BufferQueueInterposer sink=%p", sink.get());
+
+    // We need one additional dequeued buffer beyond what the source needs.
+    // To have more than one (the default), we must call setBufferCount. But
+    // we have no way of knowing what the sink has set as the minimum buffer
+    // count, so if we just call setBufferCount(3) it may fail (and does, on
+    // one device using a video encoder sink). So far on the devices we care
+    // about, this is the smallest value that works.
+    //
+    // TODO: Change IGraphicBufferProducer and implementations to support this.
+    // Maybe change it so both the consumer and producer declare how many
+    // buffers they need, and the IGBP adds them? Then BQInterposer would just
+    // add 1 to the source's buffer count.
+    mSink->setBufferCount(6);
+}
+
+BufferQueueInterposer::~BufferQueueInterposer() {
+    Mutex::Autolock lock(mMutex);
+    flushQueuedBuffersLocked();
+    BQI_LOGV("~BufferQueueInterposer");
+}
+
+status_t BufferQueueInterposer::requestBuffer(int slot,
+        sp<GraphicBuffer>* outBuf) {
+    BQI_LOGV("requestBuffer slot=%d", slot);
+    Mutex::Autolock lock(mMutex);
+
+    if (size_t(slot) >= mBuffers.size()) {
+        size_t size = mBuffers.size();
+        mBuffers.insertAt(size, size - slot + 1);
+    }
+    sp<GraphicBuffer>& buf = mBuffers.editItemAt(slot);
+
+    status_t result = mSink->requestBuffer(slot, &buf);
+    *outBuf = buf;
+    return result;
+}
+
+status_t BufferQueueInterposer::setBufferCount(int bufferCount) {
+    BQI_LOGV("setBufferCount count=%d", bufferCount);
+    Mutex::Autolock lock(mMutex);
+
+    bufferCount += 1;
+
+    status_t result = flushQueuedBuffersLocked();
+    if (result != NO_ERROR)
+        return result;
+
+    result = mSink->setBufferCount(bufferCount);
+    if (result != NO_ERROR)
+        return result;
+
+    for (size_t i = 0; i < mBuffers.size(); i++)
+        mBuffers.editItemAt(i).clear();
+    ssize_t n = mBuffers.resize(bufferCount);
+    result = (n < 0) ? n : result;
+
+    return result;
+}
+
+status_t BufferQueueInterposer::dequeueBuffer(int* slot, sp<Fence>* fence,
+            uint32_t w, uint32_t h, uint32_t format, uint32_t usage) {
+    BQI_LOGV("dequeueBuffer %ux%u fmt=%u usage=%#x", w, h, format, usage);
+    return mSink->dequeueBuffer(slot, fence, w, h, format, usage);
+}
+
+status_t BufferQueueInterposer::queueBuffer(int slot,
+            const QueueBufferInput& input, QueueBufferOutput* output) {
+    BQI_LOGV("queueBuffer slot=%d", slot);
+    Mutex::Autolock lock(mMutex);
+    mQueue.push(QueuedBuffer(slot, input));
+    *output = mQueueBufferOutput;
+    return NO_ERROR;
+}
+
+void BufferQueueInterposer::cancelBuffer(int slot, const sp<Fence>& fence) {
+    BQI_LOGV("cancelBuffer slot=%d", slot);
+    mSink->cancelBuffer(slot, fence);
+}
+
+int BufferQueueInterposer::query(int what, int* value) {
+    BQI_LOGV("query what=%d", what);
+    return mSink->query(what, value);
+}
+
+status_t BufferQueueInterposer::setSynchronousMode(bool enabled) {
+    BQI_LOGV("setSynchronousMode %s", enabled ? "true" : "false");
+    return mSink->setSynchronousMode(enabled);
+}
+
+status_t BufferQueueInterposer::connect(int api, QueueBufferOutput* output) {
+    BQI_LOGV("connect api=%d", api);
+    Mutex::Autolock lock(mMutex);
+    status_t result = mSink->connect(api, &mQueueBufferOutput);
+    if (result == NO_ERROR) {
+        *output = mQueueBufferOutput;
+    }
+    return result;
+}
+
+status_t BufferQueueInterposer::disconnect(int api) {
+    BQI_LOGV("disconnect: api=%d", api);
+    Mutex::Autolock lock(mMutex);
+    flushQueuedBuffersLocked();
+    return mSink->disconnect(api);
+}
+
+status_t BufferQueueInterposer::pullEmptyBuffer() {
+    status_t result;
+
+    int slot;
+    sp<Fence> fence;
+    result = dequeueBuffer(&slot, &fence, 0, 0, 0, 0);
+    if (result == IGraphicBufferProducer::BUFFER_NEEDS_REALLOCATION) {
+        sp<GraphicBuffer> buffer;
+        result = requestBuffer(slot, &buffer);
+    } else if (result != NO_ERROR) {
+        return result;
+    }
+
+    uint32_t w, h, transformHint, numPendingBuffers;
+    mQueueBufferOutput.deflate(&w, &h, &transformHint, &numPendingBuffers);
+
+    IGraphicBufferProducer::QueueBufferInput qbi(0, Rect(w, h),
+            NATIVE_WINDOW_SCALING_MODE_FREEZE, 0, fence);
+    IGraphicBufferProducer::QueueBufferOutput qbo;
+    result = queueBuffer(slot, qbi, &qbo);
+    if (result != NO_ERROR)
+        return result;
+
+    return NO_ERROR;
+}
+
+status_t BufferQueueInterposer::acquireBuffer(sp<GraphicBuffer>* buf,
+        sp<Fence>* fence) {
+    Mutex::Autolock lock(mMutex);
+    if (mQueue.empty()) {
+        BQI_LOGV("acquireBuffer: no buffers available");
+        return NO_BUFFER_AVAILABLE;
+    }
+    if (mAcquired) {
+        BQI_LOGE("acquireBuffer: buffer already acquired");
+        return BUFFER_ALREADY_ACQUIRED;
+    }
+    BQI_LOGV("acquireBuffer: acquiring slot %d", mQueue[0].slot);
+
+    *buf = mBuffers[mQueue[0].slot];
+    *fence = mQueue[0].fence;
+    mAcquired = true;
+    return NO_ERROR;
+}
+
+status_t BufferQueueInterposer::releaseBuffer(const sp<Fence>& fence) {
+    Mutex::Autolock lock(mMutex);
+    if (!mAcquired) {
+        BQI_LOGE("releaseBuffer: releasing a non-acquired buffer");
+        return BUFFER_NOT_ACQUIRED;
+    }
+    BQI_LOGV("releaseBuffer: releasing slot %d to sink", mQueue[0].slot);
+
+    const QueuedBuffer& b = mQueue[0];
+    status_t result = mSink->queueBuffer(b.slot,
+            QueueBufferInput(b.timestamp, b.crop, b.scalingMode,
+                b.transform, b.fence),
+            &mQueueBufferOutput);
+    mQueue.removeAt(0);
+    mAcquired = false;
+
+    return result;
+}
+
+status_t BufferQueueInterposer::flushQueuedBuffersLocked() {
+    if (mAcquired) {
+        BQI_LOGE("flushQueuedBuffersLocked: buffer acquired, can't flush");
+        return INVALID_OPERATION;
+    }
+
+    status_t result = NO_ERROR;
+    for (size_t i = 0; i < mQueue.size(); i++) {
+        const QueuedBuffer& b = mQueue[i];
+        BQI_LOGV("flushing queued slot %d to sink", b.slot);
+        status_t err = mSink->queueBuffer(b.slot,
+                QueueBufferInput(b.timestamp, b.crop, b.scalingMode,
+                    b.transform, b.fence),
+                &mQueueBufferOutput);
+        if (err != NO_ERROR && result == NO_ERROR) // latch first error
+            result = err;
+    }
+    mQueue.clear();
+    return result;
+}
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h
new file mode 100644
index 0000000..7208630
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/BufferQueueInterposer.h
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_BUFFERQUEUEINTERPOSER_H
+#define ANDROID_SF_BUFFERQUEUEINTERPOSER_H
+
+#include <gui/IGraphicBufferProducer.h>
+#include <utils/Mutex.h>
+#include <utils/Vector.h>
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+// BufferQueueInterposers introduce an extra stage between a buffer producer
+// (the source) and a buffer consumer (the sink), which communicate via the
+// IGraphicBufferProducer interface. It is designed to be as transparent as
+// possible to both endpoints, so that they can work the same whether an
+// interposer is present or not.
+//
+// When the interpose is present, the source queues buffers to the
+// IGraphicBufferProducer implemented by BufferQueueInterposer. A client of
+// the BufferQueueInterposer can acquire each buffer in turn and read or
+// modify it, releasing the buffer when finished. When the buffer is released,
+// the BufferQueueInterposer queues it to the original IGraphicBufferProducer
+// interface representing the sink.
+//
+// A BufferQueueInterposer can be used to do additional rendering to a buffer
+// before it is consumed -- essentially pipelining two producers. As an
+// example, SurfaceFlinger uses this to implement mixed GLES and HWC
+// compositing to the same buffer for virtual displays. If it used two separate
+// buffer queues, then in GLES-only or mixed GLES+HWC compositing, the HWC
+// would have to copy the GLES output buffer to the HWC output buffer, using
+// more bandwidth than having HWC do additional composition "in place" on the
+// GLES output buffer.
+//
+// The goal for this class is to be usable in a variety of situations and be
+// part of libgui. But both the interface and implementation need some
+// iteration before then, so for now it should only be used by
+// VirtualDisplaySurface, which is why it's currently in SurfaceFlinger.
+//
+// Some of the problems that still need to be solved are:
+//
+// - Refactor the interposer interface along with BufferQueue and ConsumerBase,
+//   so that there is a common interface for the consumer end of a queue. The
+//   existing interfaces have some problems when the implementation isn't the
+//   final consumer.
+//
+// - The interposer needs at least one buffer in addition to those used by the
+//   source and sink. setBufferCount and QueueBufferOutput both need to
+//   account for this. It's not possible currently to do this generically,
+//   since we can't find out how many buffers the source and sink need. (See
+//   the horrible hack in the BufferQueueInterposer constructor).
+//
+// - Abandoning, disconnecting, and connecting need to pass through somehow.
+//   There needs to be a way to tell the interposer client to release its
+//   buffer immediately so it can be queued/released, e.g. when the source
+//   calls disconnect().
+//
+// - Right now the source->BQI queue is synchronous even if the BQI->sink
+//   queue is asynchronous. Need to figure out how asynchronous should behave
+//   and implement that.
+
+class BufferQueueInterposer : public BnGraphicBufferProducer {
+public:
+    BufferQueueInterposer(const sp<IGraphicBufferProducer>& sink,
+            const String8& name);
+
+    //
+    // IGraphicBufferProducer interface
+    //
+    virtual status_t requestBuffer(int slot, sp<GraphicBuffer>* outBuf);
+    virtual status_t setBufferCount(int bufferCount);
+    virtual status_t dequeueBuffer(int* slot, sp<Fence>* fence,
+            uint32_t w, uint32_t h, uint32_t format, uint32_t usage);
+    virtual status_t queueBuffer(int slot,
+            const QueueBufferInput& input, QueueBufferOutput* output);
+    virtual void cancelBuffer(int slot, const sp<Fence>& fence);
+    virtual int query(int what, int* value);
+    virtual status_t setSynchronousMode(bool enabled);
+    virtual status_t connect(int api, QueueBufferOutput* output);
+    virtual status_t disconnect(int api);
+
+    //
+    // Interposer interface
+    //
+
+    enum {
+        NO_BUFFER_AVAILABLE = 2,    // matches BufferQueue
+        BUFFER_NOT_ACQUIRED,
+        BUFFER_ALREADY_ACQUIRED,
+    };
+
+    // Acquire the oldest queued buffer. If no buffers are pending, returns
+    // NO_BUFFER_AVAILABLE. If a buffer is currently acquired, returns
+    // BUFFER_ALREADY_ACQUIRED.
+    status_t acquireBuffer(sp<GraphicBuffer>* buf, sp<Fence>* fence);
+
+    // Release the currently acquired buffer, queueing it to the sink. If the
+    // current buffer hasn't been acquired, returns BUFFER_NOT_ACQUIRED.
+    status_t releaseBuffer(const sp<Fence>& fence);
+
+    // pullEmptyBuffer dequeues a buffer from the sink, then immediately
+    // queues it to the interposer. This makes a buffer available for the
+    // client to acquire even if the source hasn't queued one.
+    status_t pullEmptyBuffer();
+
+private:
+    struct QueuedBuffer {
+        QueuedBuffer(): slot(-1) {}
+        QueuedBuffer(int slot, const QueueBufferInput& qbi): slot(slot) {
+            qbi.deflate(&timestamp, &crop, &scalingMode, &transform, &fence);
+        }
+        int slot;
+        int64_t timestamp;
+        Rect crop;
+        int scalingMode;
+        uint32_t transform;
+        sp<Fence> fence;
+    };
+
+    virtual ~BufferQueueInterposer();
+    status_t flushQueuedBuffersLocked();
+
+    const sp<IGraphicBufferProducer> mSink;
+    String8 mName;
+
+    Mutex mMutex;
+    Vector<sp<GraphicBuffer> > mBuffers;
+    Vector<QueuedBuffer> mQueue;
+    bool mAcquired;
+    QueueBufferOutput mQueueBufferOutput;
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_BUFFERQUEUEINTERPOSER_H
diff --git a/services/surfaceflinger/DisplayHardware/DisplaySurface.h b/services/surfaceflinger/DisplayHardware/DisplaySurface.h
new file mode 100644
index 0000000..2de6b4c
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/DisplaySurface.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_DISPLAY_SURFACE_H
+#define ANDROID_SF_DISPLAY_SURFACE_H
+
+#include <utils/Errors.h>
+#include <utils/RefBase.h>
+#include <utils/StrongPointer.h>
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+class IGraphicBufferProducer;
+class String8;
+
+class DisplaySurface : public virtual RefBase {
+public:
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const = 0;
+
+    // Should be called when composition rendering is complete for a frame (but
+    // eglSwapBuffers hasn't necessarily been called). Required by certain
+    // older drivers for synchronization.
+    // TODO: Remove this when we drop support for HWC 1.0.
+    virtual status_t compositionComplete() = 0;
+
+    // Inform the surface that GLES composition is complete for this frame, and
+    // the surface should make sure that HWComposer has the correct buffer for
+    // this frame. Some implementations may only push a new buffer to
+    // HWComposer if GLES composition took place, others need to push a new
+    // buffer on every frame.
+    virtual status_t advanceFrame() = 0;
+
+    // setReleaseFenceFd stores a fence file descriptor that will signal when
+    // the current buffer is no longer being read. This fence will be returned
+    // to the producer when the current buffer is released by updateTexImage().
+    // Multiple fences can be set for a given buffer; they will be merged into
+    // a single union fence. The GLConsumer will close the file descriptor
+    // when finished with it.
+    virtual status_t setReleaseFenceFd(int fenceFd) = 0;
+
+    virtual void dump(String8& result) const = 0;
+
+protected:
+    DisplaySurface() {}
+    virtual ~DisplaySurface() {}
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_DISPLAY_SURFACE_H
+
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
index 7557e3f..b5abaac 100644
--- a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
@@ -68,6 +68,17 @@
     mBufferQueue->setDefaultMaxBufferCount(NUM_FRAMEBUFFER_SURFACE_BUFFERS);
 }
 
+sp<IGraphicBufferProducer> FramebufferSurface::getIGraphicBufferProducer() const {
+    return getBufferQueue();
+}
+
+status_t FramebufferSurface::advanceFrame() {
+    // Once we remove FB HAL support, we can call nextBuffer() from here
+    // instead of using onFrameAvailable(). No real benefit, except it'll be
+    // more like VirtualDisplaySurface.
+    return NO_ERROR;
+}
+
 status_t FramebufferSurface::nextBuffer(sp<GraphicBuffer>& outBuffer, sp<Fence>& outFence) {
     Mutex::Autolock lock(mMutex);
 
@@ -134,7 +145,7 @@
     if (fenceFd >= 0) {
         sp<Fence> fence(new Fence(fenceFd));
         if (mCurrentBufferSlot != BufferQueue::INVALID_BUFFER_SLOT) {
-            status_t err = addReleaseFence(mCurrentBufferSlot, fence);
+            err = addReleaseFence(mCurrentBufferSlot, fence);
             ALOGE_IF(err, "setReleaseFenceFd: failed to add the fence: %s (%d)",
                     strerror(-err), err);
         }
@@ -142,21 +153,38 @@
     return err;
 }
 
-status_t FramebufferSurface::setUpdateRectangle(const Rect& r)
-{
-    return INVALID_OPERATION;
-}
-
 status_t FramebufferSurface::compositionComplete()
 {
     return mHwc.fbCompositionComplete();
 }
 
-void FramebufferSurface::dump(String8& result) {
-    mHwc.fbDump(result);
+// Since DisplaySurface and ConsumerBase both have a method with this
+// signature, results will vary based on the static pointer type the caller is
+// using:
+//   void dump(FrameBufferSurface* fbs, String8& s) {
+//       // calls FramebufferSurface::dump()
+//       fbs->dump(s);
+//
+//       // calls ConsumerBase::dump() since it is non-virtual
+//       static_cast<ConsumerBase*>(fbs)->dump(s);
+//
+//       // calls FramebufferSurface::dump() since it is virtual
+//       static_cast<DisplaySurface*>(fbs)->dump(s);
+//   }
+// To make sure that all of these end up doing the same thing, we just redirect
+// to ConsumerBase::dump() here. It will take the internal lock, and then call
+// virtual dumpLocked(), which is where the real work happens.
+void FramebufferSurface::dump(String8& result) const {
     ConsumerBase::dump(result);
 }
 
+void FramebufferSurface::dumpLocked(String8& result, const char* prefix,
+            char* buffer, size_t SIZE) const
+{
+    mHwc.fbDump(result);
+    ConsumerBase::dumpLocked(result, prefix, buffer, SIZE);
+}
+
 // ----------------------------------------------------------------------------
 }; // namespace android
 // ----------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.h b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
index b61b7f5..0aab742 100644
--- a/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
@@ -22,6 +22,8 @@
 
 #include <gui/ConsumerBase.h>
 
+#include "DisplaySurface.h"
+
 // ---------------------------------------------------------------------------
 namespace android {
 // ---------------------------------------------------------------------------
@@ -32,23 +34,20 @@
 
 // ---------------------------------------------------------------------------
 
-class FramebufferSurface : public ConsumerBase {
+class FramebufferSurface : public ConsumerBase,
+                           public DisplaySurface {
 public:
     FramebufferSurface(HWComposer& hwc, int disp);
 
-    bool isUpdateOnDemand() const { return false; }
-    status_t setUpdateRectangle(const Rect& updateRect);
-    status_t compositionComplete();
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const;
 
-    virtual void dump(String8& result);
+    virtual status_t compositionComplete();
+    virtual status_t advanceFrame();
+    virtual status_t setReleaseFenceFd(int fenceFd);
 
-    // setReleaseFenceFd stores a fence file descriptor that will signal when the
-    // current buffer is no longer being read. This fence will be returned to
-    // the producer when the current buffer is released by updateTexImage().
-    // Multiple fences can be set for a given buffer; they will be merged into
-    // a single union fence. The GLConsumer will close the file descriptor
-    // when finished with it.
-    status_t setReleaseFenceFd(int fenceFd);
+    // Implementation of DisplaySurface::dump(). Note that ConsumerBase also
+    // has a non-virtual dump() with the same signature.
+    virtual void dump(String8& result) const;
 
 private:
     virtual ~FramebufferSurface() { }; // this class cannot be overloaded
@@ -56,6 +55,9 @@
     virtual void onFrameAvailable();
     virtual void freeBufferLocked(int slotIndex);
 
+    virtual void dumpLocked(String8& result, const char* prefix,
+            char* buffer, size_t SIZE) const;
+
     // nextBuffer waits for and then latches the next buffer from the
     // BufferQueue and releases the previously latched buffer to the
     // BufferQueue.  The new buffer is returned in the 'buffer' argument.
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index bb567e2..96cfc14 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -99,7 +99,7 @@
     bool needVSyncThread = true;
 
     // Note: some devices may insist that the FB HAL be opened before HWC.
-    loadFbHalModule();
+    int fberr = loadFbHalModule();
     loadHwcModule();
 
     if (mFbDev && mHwc && hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1)) {
@@ -113,7 +113,8 @@
     // If we have no HWC, or a pre-1.1 HWC, an FB dev is mandatory.
     if ((!mHwc || !hwcHasApiVersion(mHwc, HWC_DEVICE_API_VERSION_1_1))
             && !mFbDev) {
-        ALOGE("ERROR: failed to open framebuffer, aborting");
+        ALOGE("ERROR: failed to open framebuffer (%s), aborting",
+                strerror(-fberr));
         abort();
     }
 
@@ -234,20 +235,17 @@
 }
 
 // Load and prepare the FB HAL, which uses the gralloc module.  Sets mFbDev.
-void HWComposer::loadFbHalModule()
+int HWComposer::loadFbHalModule()
 {
     hw_module_t const* module;
 
-    if (hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module) != 0) {
+    int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
+    if (err != 0) {
         ALOGE("%s module not found", GRALLOC_HARDWARE_MODULE_ID);
-        return;
+        return err;
     }
 
-    int err = framebuffer_open(module, &mFbDev);
-    if (err) {
-        ALOGE("framebuffer_open failed (%s)", strerror(-err));
-        return;
-    }
+    return framebuffer_open(module, &mFbDev);
 }
 
 status_t HWComposer::initCheck() const {
@@ -380,6 +378,7 @@
     }
     int32_t id = mAllocatedDisplayIDs.firstUnmarkedBit();
     mAllocatedDisplayIDs.markBit(id);
+    mDisplayData[id].connected = true;
     return id;
 }
 
@@ -392,6 +391,7 @@
         return BAD_INDEX;
     }
     mAllocatedDisplayIDs.clearBit(id);
+    mDisplayData[id].connected = false;
     return NO_ERROR;
 }
 
@@ -615,14 +615,14 @@
 }
 
 bool HWComposer::hasHwcComposition(int32_t id) const {
-    if (uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
+    if (!mHwc || uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
         return false;
     return mDisplayData[id].hasOvComp;
 }
 
 bool HWComposer::hasGlesComposition(int32_t id) const {
-    if (uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
-        return false;
+    if (!mHwc || uint32_t(id)>31 || !mAllocatedDisplayIDs.hasBit(id))
+        return true;
     return mDisplayData[id].hasFbComp;
 }
 
@@ -653,6 +653,18 @@
             mLists[0]->sur = eglGetCurrentSurface(EGL_DRAW);
         }
 
+        // For virtual displays, the framebufferTarget buffer also serves as
+        // the HWC output buffer, so we need to copy the buffer handle and
+        // dup() the acquire fence.
+        for (size_t i=HWC_NUM_DISPLAY_TYPES; i<mNumDisplays; i++) {
+            DisplayData& disp(mDisplayData[i]);
+            if (disp.framebufferTarget) {
+                mLists[i]->outbuf = disp.framebufferTarget->handle;
+                mLists[i]->outbufAcquireFenceFd =
+                        dup(disp.framebufferTarget->acquireFenceFd);
+            }
+        }
+
         err = mHwc->set(mHwc, mNumDisplays, mLists);
 
         for (size_t i=0 ; i<mNumDisplays ; i++) {
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.h b/services/surfaceflinger/DisplayHardware/HWComposer.h
index 9816a45..fdbd2d9 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.h
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.h
@@ -112,7 +112,7 @@
     // does this display have layers handled by GLES
     bool hasGlesComposition(int32_t id) const;
 
-    // get the releaseFence file descriptor for the given display
+    // get the releaseFence file descriptor for a display's framebuffer layer.
     // the release fence is only valid after commit()
     int getAndResetReleaseFenceFd(int32_t id);
 
@@ -265,7 +265,7 @@
 
 private:
     void loadHwcModule();
-    void loadFbHalModule();
+    int loadFbHalModule();
 
     LayerListIterator getLayerIterator(int32_t id, size_t index);
 
diff --git a/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp
new file mode 100644
index 0000000..433e1eb
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "VirtualDisplaySurface.h"
+#include "HWComposer.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+VirtualDisplaySurface::VirtualDisplaySurface(HWComposer& hwc, int disp,
+        const sp<IGraphicBufferProducer>& sink, const String8& name)
+:   mHwc(hwc),
+    mDisplayId(disp),
+    mSource(new BufferQueueInterposer(sink, name)),
+    mName(name),
+    mReleaseFence(Fence::NO_FENCE)
+{}
+
+VirtualDisplaySurface::~VirtualDisplaySurface() {
+    if (mAcquiredBuffer != NULL) {
+        status_t result = mSource->releaseBuffer(mReleaseFence);
+        ALOGE_IF(result != NO_ERROR, "VirtualDisplaySurface \"%s\": "
+                "failed to release previous buffer: %d",
+                mName.string(), result);
+    }
+}
+
+sp<IGraphicBufferProducer> VirtualDisplaySurface::getIGraphicBufferProducer() const {
+    return mSource;
+}
+
+status_t VirtualDisplaySurface::compositionComplete() {
+    return NO_ERROR;
+}
+
+status_t VirtualDisplaySurface::advanceFrame() {
+    Mutex::Autolock lock(mMutex);
+    status_t result = NO_ERROR;
+
+    if (mAcquiredBuffer != NULL) {
+        result = mSource->releaseBuffer(mReleaseFence);
+        ALOGE_IF(result != NO_ERROR, "VirtualDisplaySurface \"%s\": "
+                "failed to release previous buffer: %d",
+                mName.string(), result);
+        mAcquiredBuffer.clear();
+        mReleaseFence = Fence::NO_FENCE;
+    }
+
+    sp<Fence> fence;
+    result = mSource->acquireBuffer(&mAcquiredBuffer, &fence);
+    if (result == BufferQueueInterposer::NO_BUFFER_AVAILABLE) {
+        result = mSource->pullEmptyBuffer();
+        if (result != NO_ERROR)
+            return result;
+        result = mSource->acquireBuffer(&mAcquiredBuffer, &fence);
+    }
+    if (result != NO_ERROR)
+        return result;
+
+    return mHwc.fbPost(mDisplayId, fence, mAcquiredBuffer);
+}
+
+status_t VirtualDisplaySurface::setReleaseFenceFd(int fenceFd) {
+    if (fenceFd >= 0) {
+        sp<Fence> fence(new Fence(fenceFd));
+        Mutex::Autolock lock(mMutex);
+        sp<Fence> mergedFence = Fence::merge(
+                String8::format("VirtualDisplaySurface \"%s\"",
+                        mName.string()),
+                mReleaseFence, fence);
+        if (!mergedFence->isValid()) {
+            ALOGE("VirtualDisplaySurface \"%s\": failed to merge release fence",
+                    mName.string());
+            // synchronization is broken, the best we can do is hope fences
+            // signal in order so the new fence will act like a union
+            mReleaseFence = fence;
+            return BAD_VALUE;
+        }
+        mReleaseFence = mergedFence;
+    }
+    return NO_ERROR;
+}
+
+void VirtualDisplaySurface::dump(String8& result) const {
+}
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h
new file mode 100644
index 0000000..66f8580
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/VirtualDisplaySurface.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2013 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+#define ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+
+#include "BufferQueueInterposer.h"
+#include "DisplaySurface.h"
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+class HWComposer;
+
+/* This DisplaySurface implementation uses a BufferQueueInterposer to pass
+ * partially- or fully-composited buffers from the OpenGL ES driver to
+ * HWComposer to use as the output buffer for virtual displays. Allowing HWC
+ * to compose into the same buffer that contains GLES results saves bandwidth
+ * compared to having two separate BufferQueues for frames with at least some
+ * GLES composition.
+ *
+ * The alternative would be to have two complete BufferQueues, one from GLES
+ * to HWC and one from HWC to the virtual display sink (e.g. video encoder).
+ * For GLES-only frames, the same bandwidth saving could be achieved if buffers
+ * could be acquired from the GLES->HWC queue and inserted into the HWC->sink
+ * queue. That would be complicated and doesn't help the mixed GLES+HWC case.
+ *
+ * On frames with no GLES composition, the VirtualDisplaySurface dequeues a
+ * buffer directly from the sink IGraphicBufferProducer and passes it to HWC,
+ * bypassing the GLES driver. This is only guaranteed to work if
+ * eglSwapBuffers doesn't immediately dequeue a buffer for the next frame,
+ * since we can't rely on being able to dequeue more than one buffer at a time.
+ *
+ * TODO(jessehall): Add a libgui test that ensures that EGL/GLES do lazy
+ * dequeBuffers; we've wanted to require that for other reasons anyway.
+ */
+class VirtualDisplaySurface : public DisplaySurface {
+public:
+    VirtualDisplaySurface(HWComposer& hwc, int disp,
+            const sp<IGraphicBufferProducer>& sink,
+            const String8& name);
+
+    virtual sp<IGraphicBufferProducer> getIGraphicBufferProducer() const;
+
+    virtual status_t compositionComplete();
+    virtual status_t advanceFrame();
+    virtual status_t setReleaseFenceFd(int fenceFd);
+    virtual void dump(String8& result) const;
+
+private:
+    virtual ~VirtualDisplaySurface();
+
+    // immutable after construction
+    HWComposer& mHwc;
+    int mDisplayId;
+    sp<BufferQueueInterposer> mSource;
+    String8 mName;
+
+    // mutable, must be synchronized with mMutex
+    Mutex mMutex;
+    sp<GraphicBuffer> mAcquiredBuffer;
+    sp<Fence> mReleaseFence;
+};
+
+// ---------------------------------------------------------------------------
+} // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_VIRTUAL_DISPLAY_SURFACE_H
+
diff --git a/services/surfaceflinger/EventThread.cpp b/services/surfaceflinger/EventThread.cpp
index edb9fa5..4d0fc79 100644
--- a/services/surfaceflinger/EventThread.cpp
+++ b/services/surfaceflinger/EventThread.cpp
@@ -41,7 +41,7 @@
       mUseSoftwareVSync(false),
       mDebugVsyncEnabled(false) {
 
-    for (int32_t i=0 ; i<HWC_DISPLAY_TYPES_SUPPORTED ; i++) {
+    for (int32_t i=0 ; i<HWC_NUM_DISPLAY_TYPES ; i++) {
         mVSyncEvent[i].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
         mVSyncEvent[i].header.id = 0;
         mVSyncEvent[i].header.timestamp = 0;
@@ -112,11 +112,11 @@
 
 
 void EventThread::onVSyncReceived(int type, nsecs_t timestamp) {
-    ALOGE_IF(type >= HWC_DISPLAY_TYPES_SUPPORTED,
-            "received event for an invalid display (id=%d)", type);
+    ALOGE_IF(type >= HWC_NUM_DISPLAY_TYPES,
+            "received vsync event for an invalid display (id=%d)", type);
 
     Mutex::Autolock _l(mLock);
-    if (type < HWC_DISPLAY_TYPES_SUPPORTED) {
+    if (type < HWC_NUM_DISPLAY_TYPES) {
         mVSyncEvent[type].header.type = DisplayEventReceiver::DISPLAY_EVENT_VSYNC;
         mVSyncEvent[type].header.id = type;
         mVSyncEvent[type].header.timestamp = timestamp;
@@ -126,11 +126,11 @@
 }
 
 void EventThread::onHotplugReceived(int type, bool connected) {
-    ALOGE_IF(type >= HWC_DISPLAY_TYPES_SUPPORTED,
-            "received event for an invalid display (id=%d)", type);
+    ALOGE_IF(type >= HWC_NUM_DISPLAY_TYPES,
+            "received hotplug event for an invalid display (id=%d)", type);
 
     Mutex::Autolock _l(mLock);
-    if (type < HWC_DISPLAY_TYPES_SUPPORTED) {
+    if (type < HWC_NUM_DISPLAY_TYPES) {
         DisplayEventReceiver::Event event;
         event.header.type = DisplayEventReceiver::DISPLAY_EVENT_HOTPLUG;
         event.header.id = type;
@@ -184,7 +184,7 @@
 
         size_t vsyncCount = 0;
         nsecs_t timestamp = 0;
-        for (int32_t i=0 ; i<HWC_DISPLAY_TYPES_SUPPORTED ; i++) {
+        for (int32_t i=0 ; i<HWC_NUM_DISPLAY_TYPES ; i++) {
             timestamp = mVSyncEvent[i].header.timestamp;
             if (timestamp) {
                 // we have a vsync event to dispatch
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 5996c90..1677c76 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -108,7 +108,7 @@
 void Layer::onFirstRef()
 {
     // Creates a custom BufferQueue for SurfaceFlingerConsumer to use
-    sp<BufferQueue> bq = new SurfaceTextureLayer();
+    sp<BufferQueue> bq = new SurfaceTextureLayer(mFlinger);
     mSurfaceFlingerConsumer = new SurfaceFlingerConsumer(mTextureName, true,
             GL_TEXTURE_EXTERNAL_OES, false, bq);
 
@@ -153,8 +153,9 @@
     mFlinger->signalLayerUpdate();
 }
 
-// called with SurfaceFlinger::mStateLock as soon as the layer is entered
-// in the purgatory list
+// called with SurfaceFlinger::mStateLock from the drawing thread after
+// the layer has been remove from the current state list (and just before
+// it's removed from the drawing state list)
 void Layer::onRemoved() {
     mSurfaceFlingerConsumer->abandon();
 }
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 98f6ded..7fcbd2e 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -66,6 +66,7 @@
 
 #include "DisplayHardware/FramebufferSurface.h"
 #include "DisplayHardware/HWComposer.h"
+#include "DisplayHardware/VirtualDisplaySurface.h"
 
 
 #define EGL_VERSION_HW_ANDROID  0x3143
@@ -501,11 +502,9 @@
             createBuiltinDisplayLocked(type);
             wp<IBinder> token = mBuiltinDisplays[i];
 
-            sp<FramebufferSurface> fbs = new FramebufferSurface(*mHwc, i);
-            sp<Surface> stc = new Surface(
-                        static_cast< sp<IGraphicBufferProducer> >(fbs->getBufferQueue()));
             sp<DisplayDevice> hw = new DisplayDevice(this,
-                    type, isSecure, token, stc, fbs, mEGLConfig);
+                    type, isSecure, token, new FramebufferSurface(*mHwc, i),
+                    mEGLConfig);
             if (i > DisplayDevice::DISPLAY_PRIMARY) {
                 // FIXME: currently we don't get blank/unblank requests
                 // for displays other than the main display, so we always
@@ -574,39 +573,7 @@
         const sp<IGraphicBufferProducer>& bufferProducer) const {
     Mutex::Autolock _l(mStateLock);
     sp<IBinder> surfaceTextureBinder(bufferProducer->asBinder());
-
-    // We want to determine whether the IGraphicBufferProducer was created by
-    // SurfaceFlinger.  Check to see if we can find it in the layer list.
-    const LayerVector& currentLayers = mCurrentState.layersSortedByZ;
-    size_t count = currentLayers.size();
-    for (size_t i=0 ; i<count ; i++) {
-        const sp<Layer>& layer(currentLayers[i]);
-        // Get the consumer interface of SurfaceFlingerConsumer's
-        // BufferQueue.  If it's the same Binder object as the graphic
-        // buffer producer interface, return success.
-        sp<IBinder> lbcBinder = layer->getBufferQueue()->asBinder();
-        if (lbcBinder == surfaceTextureBinder) {
-            return true;
-        }
-    }
-
-    // Check the layers in the purgatory.  This check is here so that if a
-    // GLConsumer gets destroyed before all the clients are done using it,
-    // the error will not be reported as "surface XYZ is not authenticated", but
-    // will instead fail later on when the client tries to use the surface,
-    // which should be reported as "surface XYZ returned an -ENODEV".  The
-    // purgatorized layers are no less authentic than the visible ones, so this
-    // should not cause any harm.
-    size_t purgatorySize =  mLayerPurgatory.size();
-    for (size_t i=0 ; i<purgatorySize ; i++) {
-        const sp<Layer>& layer(mLayerPurgatory.itemAt(i));
-        sp<IBinder> lbcBinder = layer->getBufferQueue()->asBinder();
-        if (lbcBinder == surfaceTextureBinder) {
-            return true;
-        }
-    }
-
-    return false;
+    return mGraphicBufferProducerList.indexOf(surfaceTextureBinder) >= 0;
 }
 
 status_t SurfaceFlinger::getDisplayInfo(const sp<IBinder>& display, DisplayInfo* info) {
@@ -1131,7 +1098,8 @@
                         DisplayDevice::makeCurrent(mEGLDisplay, hw, mEGLContext);
                         mDisplays.removeItem(draw.keyAt(i));
                         getHwComposer().disconnectDisplay(draw[i].type);
-                        mEventThread->onHotplugReceived(draw[i].type, false);
+                        if (draw[i].type < DisplayDevice::NUM_DISPLAY_TYPES)
+                            mEventThread->onHotplugReceived(draw[i].type, false);
                     } else {
                         ALOGW("trying to remove the main display");
                     }
@@ -1173,10 +1141,14 @@
                 if (draw.indexOfKey(curr.keyAt(i)) < 0) {
                     const DisplayDeviceState& state(curr[i]);
 
-                    sp<FramebufferSurface> fbs;
-                    sp<Surface> stc;
-                    if (!state.isVirtualDisplay()) {
-
+                    sp<DisplaySurface> dispSurface;
+                    if (state.isVirtualDisplay()) {
+                        if (state.surface != NULL) {
+                            dispSurface = new VirtualDisplaySurface(
+                                    *mHwc, state.type, state.surface,
+                                    state.displayName);
+                        }
+                    } else {
                         ALOGE_IF(state.surface!=NULL,
                                 "adding a supported display, but rendering "
                                 "surface is provided (%p), ignoring it",
@@ -1184,27 +1156,21 @@
 
                         // for supported (by hwc) displays we provide our
                         // own rendering surface
-                        fbs = new FramebufferSurface(*mHwc, state.type);
-                        stc = new Surface(
-                                static_cast< sp<IGraphicBufferProducer> >(
-                                        fbs->getBufferQueue()));
-                    } else {
-                        if (state.surface != NULL) {
-                            stc = new Surface(state.surface);
-                        }
+                        dispSurface = new FramebufferSurface(*mHwc, state.type);
                     }
 
                     const wp<IBinder>& display(curr.keyAt(i));
-                    if (stc != NULL) {
+                    if (dispSurface != NULL) {
                         sp<DisplayDevice> hw = new DisplayDevice(this,
-                                state.type, state.isSecure, display, stc, fbs,
-                                mEGLConfig);
+                                state.type, state.isSecure, display,
+                                dispSurface, mEGLConfig);
                         hw->setLayerStack(state.layerStack);
                         hw->setProjection(state.orientation,
                                 state.viewport, state.frame);
                         hw->setDisplayName(state.displayName);
                         mDisplays.add(display, hw);
-                        mEventThread->onHotplugReceived(state.type, true);
+                        if (state.type < DisplayDevice::NUM_DISPLAY_TYPES)
+                            mEventThread->onHotplugReceived(state.type, true);
                     }
                 }
             }
@@ -1676,6 +1642,7 @@
 
 void SurfaceFlinger::addClientLayer(const sp<Client>& client,
         const sp<IBinder>& handle,
+        const sp<IGraphicBufferProducer>& gbc,
         const sp<Layer>& lbc)
 {
     // attach this layer to the client
@@ -1684,45 +1651,22 @@
     // add this layer to the current state list
     Mutex::Autolock _l(mStateLock);
     mCurrentState.layersSortedByZ.add(lbc);
+    mGraphicBufferProducerList.add(gbc->asBinder());
 }
 
 status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer)
 {
     Mutex::Autolock _l(mStateLock);
-    status_t err = purgatorizeLayer_l(layer);
-    if (err == NO_ERROR)
-        setTransactionFlags(eTransactionNeeded);
-    return err;
-}
-
-status_t SurfaceFlinger::removeLayer_l(const sp<Layer>& layer)
-{
     ssize_t index = mCurrentState.layersSortedByZ.remove(layer);
     if (index >= 0) {
+        mLayersPendingRemoval.push(layer);
         mLayersRemoved = true;
+        setTransactionFlags(eTransactionNeeded);
         return NO_ERROR;
     }
     return status_t(index);
 }
 
-status_t SurfaceFlinger::purgatorizeLayer_l(const sp<Layer>& layer)
-{
-    // First add the layer to the purgatory list, which makes sure it won't
-    // go away, then remove it from the main list (through a transaction).
-    ssize_t err = removeLayer_l(layer);
-    if (err >= 0) {
-        mLayerPurgatory.add(layer);
-    }
-
-    mLayersPendingRemoval.push(layer);
-
-    // it's possible that we don't find a layer, because it might
-    // have been destroyed already -- this is not technically an error
-    // from the user because there is a race between Client::destroySurface(),
-    // ~Client() and ~LayerCleaner().
-    return (err == NAME_NOT_FOUND) ? status_t(NO_ERROR) : err;
-}
-
 uint32_t SurfaceFlinger::peekTransactionFlags(uint32_t flags)
 {
     return android_atomic_release_load(&mTransactionFlags);
@@ -1957,7 +1901,7 @@
     }
 
     if (result == NO_ERROR) {
-        addClientLayer(client, *handle, layer);
+        addClientLayer(client, *handle, *gbp, layer);
         setTransactionFlags(eTransactionNeeded);
     }
     return result;
@@ -2010,44 +1954,25 @@
 
 status_t SurfaceFlinger::onLayerRemoved(const sp<Client>& client, const sp<IBinder>& handle)
 {
-    /*
-     * called by the window manager, when a surface should be marked for
-     * destruction.
-     *
-     * The surface is removed from the current and drawing lists, but placed
-     * in the purgatory queue, so it's not destroyed right-away (we need
-     * to wait for all client's references to go away first).
-     */
-
-    status_t err = NAME_NOT_FOUND;
-    Mutex::Autolock _l(mStateLock);
-    sp<Layer> layer = client->getLayerUser(handle);
-
-    if (layer != 0) {
-        err = purgatorizeLayer_l(layer);
-        if (err == NO_ERROR) {
-            setTransactionFlags(eTransactionNeeded);
-        }
+    // called by the window manager when it wants to remove a Layer
+    status_t err = NO_ERROR;
+    sp<Layer> l(client->getLayerUser(handle));
+    if (l != NULL) {
+        err = removeLayer(l);
+        ALOGE_IF(err<0 && err != NAME_NOT_FOUND,
+                "error removing layer=%p (%s)", l.get(), strerror(-err));
     }
     return err;
 }
 
 status_t SurfaceFlinger::onLayerDestroyed(const wp<Layer>& layer)
 {
-    // called by ~LayerCleaner() when all references are gone
+    // called by ~LayerCleaner() when all references to the IBinder (handle)
+    // are gone
     status_t err = NO_ERROR;
     sp<Layer> l(layer.promote());
     if (l != NULL) {
-        Mutex::Autolock _l(mStateLock);
-        err = removeLayer_l(l);
-        if (err == NAME_NOT_FOUND) {
-            // The surface wasn't in the current list, which means it was
-            // removed already, which means it is in the purgatory,
-            // and need to be removed from there.
-            ssize_t idx = mLayerPurgatory.remove(l);
-            ALOGE_IF(idx < 0,
-                    "layer=%p is not in the purgatory list", l.get());
-        }
+        err = removeLayer(l);
         ALOGE_IF(err<0 && err != NAME_NOT_FOUND,
                 "error removing layer=%p (%s)", l.get(), strerror(-err));
     }
@@ -2359,18 +2284,6 @@
     }
 
     /*
-     * Dump the layers in the purgatory
-     */
-
-    const size_t purgatorySize = mLayerPurgatory.size();
-    snprintf(buffer, SIZE, "Purgatory state (%d entries)\n", purgatorySize);
-    result.append(buffer);
-    for (size_t i=0 ; i<purgatorySize ; i++) {
-        const sp<Layer>& layer(mLayerPurgatory.itemAt(i));
-        layer->shortDump(result, buffer, SIZE);
-    }
-
-    /*
      * Dump Display state
      */
 
@@ -2484,6 +2397,7 @@
 {
     switch (code) {
         case CREATE_CONNECTION:
+        case CREATE_DISPLAY:
         case SET_TRANSACTION_STATE:
         case BOOT_FINISHED:
         case BLANK:
@@ -2502,6 +2416,7 @@
             break;
         }
         case CAPTURE_SCREEN:
+        case CAPTURE_SCREEN_DEPRECATED:
         {
             // codes that require permission check
             IPCThreadState* ipc = IPCThreadState::self();
@@ -2719,9 +2634,11 @@
         const Layer::State& state(layer->drawingState());
         if (state.layerStack == hw->getLayerStack()) {
             if (state.z >= minLayerZ && state.z <= maxLayerZ) {
-                if (filtering) layer->setFiltering(true);
-                layer->draw(hw);
-                if (filtering) layer->setFiltering(false);
+                if (layer->isVisible()) {
+                    if (filtering) layer->setFiltering(true);
+                    layer->draw(hw);
+                    if (filtering) layer->setFiltering(false);
+                }
             }
         }
     }
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index f124347..e6734d2 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -128,6 +128,7 @@
     friend class Client;
     friend class DisplayEventConnection;
     friend class Layer;
+    friend class SurfaceTextureLayer;
 
     // We're reference counted, never destroy SurfaceFlinger directly
     virtual ~SurfaceFlinger();
@@ -272,8 +273,6 @@
 
     // called in response to the window-manager calling
     // ISurfaceComposerClient::destroySurface()
-    // The specified layer is first placed in a purgatory list
-    // until all references from the client are released.
     status_t onLayerRemoved(const sp<Client>& client, const sp<IBinder>& handle);
 
     // called when all clients have released all their references to
@@ -285,11 +284,10 @@
     status_t removeLayer(const sp<Layer>& layer);
 
     // add a layer to SurfaceFlinger
-    void addClientLayer(const sp<Client>& client, const sp<IBinder>& handle,
-        const sp<Layer>& lbc);
-
-    status_t removeLayer_l(const sp<Layer>& layer);
-    status_t purgatorizeLayer_l(const sp<Layer>& layer);
+    void addClientLayer(const sp<Client>& client,
+            const sp<IBinder>& handle,
+            const sp<IGraphicBufferProducer>& gbc,
+            const sp<Layer>& lbc);
 
     /* ------------------------------------------------------------------------
      * Boot animation, on/off animations and screen capture
@@ -403,10 +401,10 @@
     State mCurrentState;
     volatile int32_t mTransactionFlags;
     Condition mTransactionCV;
-    SortedVector< sp<Layer> > mLayerPurgatory;
     bool mTransactionPending;
     bool mAnimTransactionPending;
     Vector< sp<Layer> > mLayersPendingRemoval;
+    SortedVector< wp<IBinder> > mGraphicBufferProducerList;
 
     // protected by mStateLock (but we could use another lock)
     bool mLayersRemoved;
diff --git a/services/surfaceflinger/SurfaceTextureLayer.cpp b/services/surfaceflinger/SurfaceTextureLayer.cpp
index 395c8c8..d0f0dae 100644
--- a/services/surfaceflinger/SurfaceTextureLayer.cpp
+++ b/services/surfaceflinger/SurfaceTextureLayer.cpp
@@ -20,17 +20,35 @@
 
 #include <utils/Errors.h>
 
+#include "SurfaceFlinger.h"
 #include "SurfaceTextureLayer.h"
 
 namespace android {
 // ---------------------------------------------------------------------------
 
 
-SurfaceTextureLayer::SurfaceTextureLayer()
-    : BufferQueue(true) {
+SurfaceTextureLayer::SurfaceTextureLayer(const sp<SurfaceFlinger>& flinger)
+    : BufferQueue(true), flinger(flinger) {
 }
 
 SurfaceTextureLayer::~SurfaceTextureLayer() {
+    // remove ourselves from SurfaceFlinger's list. We do this asynchronously
+    // because we don't know where this dtor is called from, it could be
+    // called with the mStateLock held, leading to a dead-lock (it actually
+    // happens).
+    class MessageCleanUpList : public MessageBase {
+        sp<SurfaceFlinger> flinger;
+        wp<IBinder> gbp;
+    public:
+        MessageCleanUpList(const sp<SurfaceFlinger>& flinger, const wp<IBinder>& gbp)
+            : flinger(flinger), gbp(gbp) { }
+        virtual bool handler() {
+            Mutex::Autolock _l(flinger->mStateLock);
+            flinger->mGraphicBufferProducerList.remove(gbp);
+            return true;
+        }
+    };
+    flinger->postMessageAsync( new MessageCleanUpList(flinger, this) );
 }
 
 status_t SurfaceTextureLayer::connect(int api, QueueBufferOutput* output) {
diff --git a/services/surfaceflinger/SurfaceTextureLayer.h b/services/surfaceflinger/SurfaceTextureLayer.h
index a75ccf4..13cff2f 100644
--- a/services/surfaceflinger/SurfaceTextureLayer.h
+++ b/services/surfaceflinger/SurfaceTextureLayer.h
@@ -28,15 +28,16 @@
 // ---------------------------------------------------------------------------
 
 class Layer;
+class SurfaceFlinger;
 
 /*
  * This is a thin wrapper around BufferQueue, used by the Layer class.
  */
-class SurfaceTextureLayer : public BufferQueue
-{
+class SurfaceTextureLayer : public BufferQueue {
+    sp<SurfaceFlinger> flinger;
 public:
-    SurfaceTextureLayer();
-    ~SurfaceTextureLayer();
+    SurfaceTextureLayer(const sp<SurfaceFlinger>& flinger);
+    virtual ~SurfaceTextureLayer();
 
     // After calling the superclass connect(), set or clear synchronous
     // mode appropriately for the specified API.