diff --git a/include/GLES/eglnatives.h b/include/GLES/eglnatives.h
index f9e544c..1cd57d0 100644
--- a/include/GLES/eglnatives.h
+++ b/include/GLES/eglnatives.h
@@ -33,7 +33,7 @@
 typedef void*                           NativeDisplayType;
 
 /* 
- * This a conveniance function to create a NativeWindowType surface
+ * This a convenience function to create a NativeWindowType surface
  * that maps to the whole screen
  * This function is actually implemented in libui.so
  */
@@ -50,6 +50,7 @@
 {
     NATIVE_PIXEL_FORMAT_RGBA_8888   = 1,
     NATIVE_PIXEL_FORMAT_RGB_565     = 4,
+    NATIVE_PIXEL_FORMAT_BGRA_8888   = 5,
     NATIVE_PIXEL_FORMAT_RGBA_5551   = 6,
     NATIVE_PIXEL_FORMAT_RGBA_4444   = 7,
     NATIVE_PIXEL_FORMAT_YCbCr_422_SP= 0x10,
diff --git a/include/private/opengles/gl_context.h b/include/private/opengles/gl_context.h
index 67d50fd..2aa78d8 100644
--- a/include/private/opengles/gl_context.h
+++ b/include/private/opengles/gl_context.h
@@ -532,6 +532,10 @@
             vertex_t const* v1,
             vertex_t const* v2);
 
+    void initLine(
+            vertex_t const* v0,
+            vertex_t const* v1);
+
     inline void initLerp(vertex_t const* v0, uint32_t enables);
 
     int iteratorsScale(int32_t it[3],
@@ -543,6 +547,9 @@
     void iterators0032(int32_t it[3],
             int32_t c0, int32_t c1, int32_t c2) const;
 
+    void iterators0032(int64_t it[3],
+            int32_t c0, int32_t c1, int32_t c2) const;
+
     GGLcoord area() const { return m_area; }
 
 private:
diff --git a/include/ui/BlitHardware.h b/include/ui/BlitHardware.h
deleted file mode 100644
index 4de1c12..0000000
--- a/include/ui/BlitHardware.h
+++ /dev/null
@@ -1,143 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_BLIT_HARDWARE_H
-#define ANDROID_BLIT_HARDWARE_H
-
-#include <stdint.h>
-#include <sys/types.h>
-
-#if __cplusplus
-extern "C" {
-#endif
-
-/******************************************************************************/
-
-/* supported pixel-formats. these must be compatible with
- * graphics/PixelFormat.java, ui/PixelFormat.h, pixelflinger/format.h
- */
-
-enum
-{
-    COPYBIT_RGBA_8888    = 1,
-    COPYBIT_RGB_565      = 4,
-    COPYBIT_RGBA_5551    = 6,
-    COPYBIT_RGBA_4444    = 7,
-    COPYBIT_YCbCr_422_SP = 0x10,
-    COPYBIT_YCbCr_420_SP = 0x11
-};
-
-/* name for copybit_set_parameter */
-enum 
-{
-    /* rotation of the source image in degrees (0 to 359) */
-    COPYBIT_ROTATION_DEG    = 1,
-    /* plane alpha value */
-    COPYBIT_PLANE_ALPHA     = 2,
-    /* enable or disable dithering */
-    COPYBIT_DITHER          = 3,
-    /* transformation applied (this is a superset of COPYBIT_ROTATION_DEG) */
-    COPYBIT_TRANSFORM       = 4,
-};
-
-/* values for copybit_set_parameter(COPYBIT_TRANSFORM) */
-enum {
-    /* flip source image horizontally */
-    COPYBIT_TRANSFORM_FLIP_H    = 0x01,
-    /* flip source image vertically */
-    COPYBIT_TRANSFORM_FLIP_V    = 0x02,
-    /* rotate source image 90 degres */
-    COPYBIT_TRANSFORM_ROT_90    = 0x04,
-    /* rotate source image 180 degres */
-    COPYBIT_TRANSFORM_ROT_180   = 0x03,
-    /* rotate source image 270 degres */
-    COPYBIT_TRANSFORM_ROT_270   = 0x07,
-};
-
-/* enable/disable value copybit_set_parameter */
-enum {
-    COPYBIT_DISABLE = 0,
-    COPYBIT_ENABLE  = 1
-};
-
-/* use get() to query static informations about the hardware */
-enum {
-    /* Maximum amount of minification supported by the hardware*/
-    COPYBIT_MINIFICATION_LIMIT  = 1,
-    /* Maximum amount of magnification supported by the hardware */
-    COPYBIT_MAGNIFICATION_LIMIT = 2,
-    /* Number of fractional bits support by the scaling engine */
-    COPYBIT_SCALING_FRAC_BITS   = 3,
-    /* Supported rotation step in degres. */
-    COPYBIT_ROTATION_STEP_DEG   = 4,
-};
-
-struct copybit_image_t {
-    uint32_t    w;
-    uint32_t    h;
-    int32_t     format;
-    uint32_t    offset;
-    void*       base;
-    int         fd;
-};
-
-
-struct copybit_rect_t {
-    int l;
-    int t;
-    int r;
-    int b;
-};
-
-struct copybit_region_t {
-    int (*next)(copybit_region_t const*, copybit_rect_t* rect); 
-};
-
-struct copybit_t
-{
-    int (*set_parameter)(struct copybit_t* handle, int name, int value);
-
-    int (*get)(struct copybit_t* handle, int name);
-    
-    int (*blit)(
-            struct copybit_t* handle, 
-            struct copybit_image_t const* dst, 
-            struct copybit_image_t const* src,
-            struct copybit_region_t const* region);
-
-    int (*stretch)(
-            struct copybit_t* handle, 
-            struct copybit_image_t const* dst, 
-            struct copybit_image_t const* src, 
-            struct copybit_rect_t const* dst_rect,
-            struct copybit_rect_t const* src_rect,
-            struct copybit_region_t const* region);
-};
-
-/******************************************************************************/
-
-struct copybit_t* copybit_init();
-
-int copybit_term(struct copybit_t* handle);
-
-
-/******************************************************************************/
-
-#if __cplusplus
-} // extern "C"
-#endif
-
-#endif // ANDROID_BLIT_HARDWARE_H
diff --git a/include/ui/Camera.h b/include/ui/Camera.h
index 562a0a2..124f07f 100644
--- a/include/ui/Camera.h
+++ b/include/ui/Camera.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 The Android Open Source Project
+ * Copyright (C) 2008 HTC Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +22,39 @@
 
 namespace android {
 
+/*
+ * A set of bit masks for specifying how the received frames from preview are
+ * handled before the frame callback call.
+ *
+ * The least significant 3 bits of an "int" value are used for this purpose:
+ *
+ * ..... 0 0 0
+ *       ^ ^ ^
+ *       | | |---------> determine whether the callback is enabled or not
+ *       | |-----------> determine whether the callback is one-shot or not
+ *       |-------------> determine whether the frame is copied out or not
+ *
+ * For instance,
+ * 1. 0x00 disables the callback. In this case, copy out and one shot bits
+ *    are ignored.
+ * 2. 0x01 enables a callback without copying out the recievied frames. A
+ *    typical use case is the Camcorder application to avoid making costly
+ *    frame copies.
+ * 3. 0x05 is enabling a callback with frame copied out repeatedly. A typical
+ *    use case is the Camera application.
+ * 4. 0x07 is enabling a callback with frame copied out only once. A typical use
+ *    case is the Barcode scanner application.
+ */
+#define FRAME_CALLBACK_FLAG_ENABLE_MASK              0x01
+#define FRAME_CALLBACK_FLAG_ONE_SHOT_MASK            0x02
+#define FRAME_CALLBACK_FLAG_COPY_OUT_MASK            0x04
+
+// Typical use cases
+#define FRAME_CALLBACK_FLAG_NOOP                     0x00
+#define FRAME_CALLBACK_FLAG_CAMCORDER                0x01
+#define FRAME_CALLBACK_FLAG_CAMERA                   0x05
+#define FRAME_CALLBACK_FLAG_BARCODE_SCANNER          0x07
+
 class ICameraService;
 class ICamera;
 class Surface;
@@ -35,15 +69,21 @@
 class Camera : public BnCameraClient, public IBinder::DeathRecipient
 {
 public:
+            // construct a camera client from an existing remote
+            Camera(const sp<ICamera>& camera);
+
     static  sp<Camera>  connect();
                         ~Camera();
+            void        init();
 
+            status_t    reconnect();
             void        disconnect();
 
             status_t    getStatus() { return mStatus; }
 
             // pass the buffered ISurface to the camera service
             status_t    setPreviewDisplay(const sp<Surface>& surface);
+            status_t    setPreviewDisplay(const sp<ISurface>& surface);
 
             // start preview mode, must call setPreviewDisplay first
             status_t    startPreview();
@@ -66,7 +106,11 @@
             void        setShutterCallback(shutter_callback cb, void *cookie);
             void        setRawCallback(frame_callback cb, void *cookie);
             void        setJpegCallback(frame_callback cb, void *cookie);
-            void        setFrameCallback(frame_callback cb, void *cookie);
+
+            void        setFrameCallback(frame_callback cb,
+                            void *cookie,
+                            int frame_callback_flag = FRAME_CALLBACK_FLAG_NOOP);
+
             void        setErrorCallback(error_callback cb, void *cookie);
             void        setAutoFocusCallback(autofocus_callback cb, void *cookie);
     // ICameraClient interface
@@ -77,7 +121,8 @@
     virtual void        errorCallback(status_t error);
     virtual void        autoFocusCallback(bool focused);
 
-    
+    sp<ICamera>         remote();
+
 private:
                         Camera();
                         virtual void binderDied(const wp<IBinder>& who);
@@ -85,14 +130,14 @@
             class DeathNotifier: public IBinder::DeathRecipient
             {
             public:
-                DeathNotifier() {      
+                DeathNotifier() {
                 }
-                
+
                 virtual void binderDied(const wp<IBinder>& who);
             };
-        
+
             static sp<DeathNotifier> mDeathNotifier;
-        
+
             // helper function to obtain camera service handle
             static const sp<ICameraService>& getCameraService();
 
@@ -111,12 +156,12 @@
             void                *mErrorCallbackCookie;
             autofocus_callback  mAutoFocusCallback;
             void                *mAutoFocusCallbackCookie;
-            
+
             friend class DeathNotifier;
 
             static  Mutex               mLock;
             static  sp<ICameraService>  mCameraService;
-            
+
 };
 
 }; // namespace android
diff --git a/include/ui/CameraHardwareInterface.h b/include/ui/CameraHardwareInterface.h
index 5fa933f..14ac96e 100644
--- a/include/ui/CameraHardwareInterface.h
+++ b/include/ui/CameraHardwareInterface.h
@@ -39,48 +39,42 @@
 typedef void (*autofocus_callback)(bool focused, void* user);
 
 /**
- * This defines the interface to the camera hardware abstraction
- * layer. It supports setting and getting parameters, live
- * previewing and taking pictures. It is a referenced counted
- * interface with RefBase as its base class.
+ * CameraHardwareInterface.h defines the interface to the
+ * camera hardware abstraction layer, used for setting and getting
+ * parameters, live previewing, and taking pictures.
  *
- * The openCameraHardware function is used to
- * retrieve a strong pointer to the instance of this interface
- * and may be called multiple times.
+ * It is a referenced counted interface with RefBase as its base class.
+ * CameraService calls openCameraHardware() to retrieve a strong pointer to the
+ * instance of this interface and may be called multiple times. The
+ * following steps describe a typical sequence:
  *
- * After calling openCameraHardware the getParameters and
- * setParameters are used to initialize the camera instance.
+ *   -# After CameraService calls openCameraHardware(), getParameters() and
+ *      setParameters() are used to initialize the camera instance.
+ *      CameraService calls getPreviewHeap() to establish access to the
+ *      preview heap so it can be registered with SurfaceFlinger for
+ *      efficient display updating while in preview mode.
+ *   -# startPreview() is called, which is passed a preview_callback()
+ *      function and a user parameter. The camera instance then periodically
+ *      calls preview_callback() each time a new preview frame is available.
+ *      The callback routine has two parameters: the first is a pointer to
+ *      the IMemory containing the frame and the second a user parameter. If
+ *      the preview_callback code needs to use this memory after returning,
+ *      it must copy the data.
  *
- * Then getPreviewHeap is called to get access to the preview
- * heap so it can be registered with the SurfaceFlinger for efficient
- * display updating while in the preview mode.
+ * Prior to taking a picture, CameraService calls autofocus() with
+ * autofocus_callback() and a user parameter. When auto focusing has
+ * completed, the camera instance calls autofocus_callback(), which informs
+ * the application whether focusing was successful. The camera instance
+ * only calls autofocus_callback() once and it is up to the application to
+ * call autoFocus() again if refocusing is desired.
  *
- * Next startPreview is called which is passed a preview_callback
- * function and a user parameter. The camera instance then
- * periodically calls preview_callback each time a new
- * preview frame is available. The call back routine has
- * two parameters, the first is a pointer to the the IMemory containing
- * the frame and the other is the user parameter. If the preview_callback
- * code needs to use this memory after returning it must copy
- * the data.
- *
- * Prior to taking a picture the autoFocus method is usually called with a
- * autofocus_callback and a user parameter. When auto focusing
- * has completed the camera instance calls autofocus_callback which
- * informs the application if focusing was successful or not.
- * The camera instance only calls the autofocus_callback once and it
- * is up to the application to call autoFocus again if refocusing is desired.
- *
- * The method takePicture is called to request that the camera instance take a
- * picture. This method has three callbacks: shutter_callback, raw_callback,
- * and jpeg_callback. As soon as the shutter snaps and it is safe to move the
- * camera, shutter_callback is called.  Typically, you would want to play the
- * shutter sound at this moment. Later, when the raw image is available the
- * raw_callback is called with a pointer to the IMemory containing the raw
- * image.  Finally, when the encoded jpeg image is available the jpeg_callback
- * will be called with a pointer to the IMemory containing the jpeg image.  As
- * with the preview_callback the memory must be copied if it's needed after
- * returning.
+ * CameraService calls takePicture() to request the camera instance take a
+ * picture. This method has two callbacks: raw_callback() and jpeg_callback().
+ * When the raw image is available, raw_callback() is called with a pointer
+ * to the IMemory containing the raw image. When the jpeg image is available,
+ * jpeg_callback() is called with a pointer to the IMemory containing the
+ * jpeg image. As with preview_callback(), the memory must be copied if it's
+ * needed after returning.
  */
 class CameraHardwareInterface : public virtual RefBase {
 public:
@@ -104,7 +98,7 @@
     /**
      * Start auto focus, the callback routine is called
      * once when focusing is complete. autoFocus() will
-     * be called agained if another auto focus is needed.
+     * be called again if another auto focus is needed.
      */
     virtual status_t    autoFocus(autofocus_callback,
                                   void* user) = 0;
diff --git a/include/ui/EGLDisplaySurface.h b/include/ui/EGLDisplaySurface.h
index a9cfd5a..0190e09 100644
--- a/include/ui/EGLDisplaySurface.h
+++ b/include/ui/EGLDisplaySurface.h
@@ -23,11 +23,12 @@
 #include <utils/Timers.h>
 
 #include <ui/EGLNativeSurface.h>
-#include <ui/BlitHardware.h>
 
 #include <pixelflinger/pixelflinger.h>
 #include <linux/fb.h>
 
+struct copybit_device_t;
+
 // ---------------------------------------------------------------------------
 namespace android {
 // ---------------------------------------------------------------------------
@@ -71,7 +72,7 @@
     int32_t             mSwapCount;
     nsecs_t             mSleep;
     uint32_t            mFeatureFlags;
-    copybit_t*          mBlitEngine;
+    copybit_device_t*   mBlitEngine;
 };
 
 // ---------------------------------------------------------------------------
diff --git a/include/ui/ICamera.h b/include/ui/ICamera.h
index 6aa3940..99c0d86 100644
--- a/include/ui/ICamera.h
+++ b/include/ui/ICamera.h
@@ -20,13 +20,15 @@
 #include <utils/RefBase.h>
 #include <utils/IInterface.h>
 #include <utils/Parcel.h>
-
 #include <ui/ISurface.h>
 #include <utils/IMemory.h>
 #include <utils/String8.h>
+#include <ui/Camera.h>
 
 namespace android {
 
+class ICameraClient;
+
 class ICamera: public IInterface
 {
 public:
@@ -34,11 +36,15 @@
 
     virtual void            disconnect() = 0;
 
+    // connect new client with existing camera remote
+    virtual status_t        connect(const sp<ICameraClient>& client) = 0;
+
     // pass the buffered ISurface to the camera service
     virtual status_t        setPreviewDisplay(const sp<ISurface>& surface) = 0;
-    
-    // tell the service whether to callback with each preview frame
-    virtual void            setHasFrameCallback(bool installed) = 0;
+
+    // set the frame callback flag to affect how the received frames from
+    // preview are handled.
+    virtual void            setFrameCallbackFlag(int frame_callback_flag) = 0;
 
     // start preview mode, must call setPreviewDisplay first
     virtual status_t        startPreview() = 0;
diff --git a/include/ui/IOverlay.h b/include/ui/IOverlay.h
new file mode 100644
index 0000000..323ff07
--- /dev/null
+++ b/include/ui/IOverlay.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_IOVERLAY_H
+#define ANDROID_IOVERLAY_H
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <utils/Errors.h>
+#include <utils/IInterface.h>
+#include <utils/RefBase.h>
+#include <ui/PixelFormat.h>
+
+namespace android {
+
+class IOverlay : public IInterface
+{
+public: 
+    DECLARE_META_INTERFACE(Overlay);
+
+    virtual void destroy() = 0; // one-way
+    
+    virtual ssize_t swapBuffers() = 0;
+};
+
+// ----------------------------------------------------------------------------
+
+class BnOverlay : public BnInterface<IOverlay>
+{
+public:
+    virtual status_t    onTransact( uint32_t code,
+                                    const Parcel& data,
+                                    Parcel* reply,
+                                    uint32_t flags = 0);
+};
+
+// ----------------------------------------------------------------------------
+
+}; // namespace android
+
+#endif // ANDROID_IOVERLAY_H
diff --git a/include/ui/ISurface.h b/include/ui/ISurface.h
index ca691f5..ff031d5 100644
--- a/include/ui/ISurface.h
+++ b/include/ui/ISurface.h
@@ -30,6 +30,7 @@
 typedef int32_t    SurfaceID;
 
 class IMemoryHeap;
+class Overlay;
 
 class ISurface : public IInterface
 {
@@ -42,6 +43,9 @@
     virtual void postBuffer(ssize_t offset) = 0; // one-way
 
     virtual void unregisterBuffers() = 0;
+    
+    virtual sp<Overlay> createOverlay(
+            uint32_t w, uint32_t h, int32_t format) = 0;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/include/ui/ISurfaceFlingerClient.h b/include/ui/ISurfaceFlingerClient.h
index bb2d39f..5b9361d 100644
--- a/include/ui/ISurfaceFlingerClient.h
+++ b/include/ui/ISurfaceFlingerClient.h
@@ -52,7 +52,6 @@
     struct surface_data_t {
         int32_t             token;
         int32_t             identity;
-        int32_t             type;
         sp<IMemoryHeap>     heap[2];
         status_t readFromParcel(const Parcel& parcel);
         status_t writeToParcel(Parcel* parcel) const;
diff --git a/include/ui/KeycodeLabels.h b/include/ui/KeycodeLabels.h
index 747925d..53c1188 100644
--- a/include/ui/KeycodeLabels.h
+++ b/include/ui/KeycodeLabels.h
@@ -107,12 +107,18 @@
     { "MENU", 82 },
     { "NOTIFICATION", 83 },
     { "SEARCH", 84 },
+    { "PLAYPAUSE", 85 },
+    { "STOP", 86 },
+    { "NEXTSONG", 87 },
+    { "PREVIOUSSONG", 88 },
+    { "REWIND", 89 },
+    { "FORWARD", 90 },
 
     // NOTE: If you add a new keycode here you must also add it to:
     //   (enum KeyCode, in this file)
-    //   java/android/android/view/KeyEvent.java
+    //   frameworks/base/core/java/android/view/KeyEvent.java
     //   tools/puppet_master/PuppetMaster.nav_keys.py
-    //   apps/common/res/values/attrs.xml
+    //   frameworks/base/core/res/res/values/attrs.xml
 
     { NULL, 0 }
 };
@@ -204,7 +210,13 @@
     kKeyCodePlus = 81,
     kKeyCodeMenu = 82,
     kKeyCodeNotification = 83,
-    kKeyCodeSearch = 84
+    kKeyCodeSearch = 84,
+    kKeyCodePlayPause = 85,
+    kKeyCodeStop = 86,
+    kKeyCodeNextSong = 87,
+    kKeyCodePreviousSong = 88,
+    kKeyCodeRewind = 89,
+    kKeyCodeForward = 90
 } KeyCode;
 
 static const KeycodeLabel FLAGS[] = {
diff --git a/include/ui/Overlay.h b/include/ui/Overlay.h
new file mode 100644
index 0000000..f24780f
--- /dev/null
+++ b/include/ui/Overlay.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2007 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_OVERLAY_H
+#define ANDROID_OVERLAY_H
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <utils/Errors.h>
+#include <utils/IInterface.h>
+#include <utils/RefBase.h>
+#include <ui/PixelFormat.h>
+
+#include <hardware/overlay.h>
+
+namespace android {
+
+class IOverlay;
+class IMemory;
+class IMemoryHeap;
+
+class Overlay : public virtual RefBase
+{
+public:
+    Overlay(overlay_t* overlay, 
+            const sp<IOverlay>& o, const sp<IMemoryHeap>& heap);
+
+    /* destroys this overlay */
+    void destroy();
+    
+    /* post/swaps buffers */
+    status_t swapBuffers();
+    
+    /* get the HAL handle for this overlay */
+    overlay_handle_t const* getHandleRef() const;
+    
+    /* returns the offset of the current buffer */
+    size_t getBufferOffset() const;
+    
+    /* returns a heap to this overlay. this may not be supported. */
+    sp<IMemoryHeap> getHeap() const;
+    
+    /* get physical informations about the overlay */
+    uint32_t getWidth() const;
+    uint32_t getHeight() const;
+    int32_t getFormat() const;
+    int32_t getWidthStride() const;
+    int32_t getHeightStride() const;
+
+    static sp<Overlay> readFromParcel(const Parcel& data);
+    static status_t writeToParcel(Parcel* reply, const sp<Overlay>& o);
+
+private:
+    Overlay(overlay_handle_t*, const sp<IOverlay>&, const sp<IMemoryHeap>&,  
+            uint32_t w, uint32_t h, int32_t f, uint32_t ws, uint32_t hs);
+
+    virtual ~Overlay();
+
+    sp<IOverlay>        mOverlay;
+    sp<IMemoryHeap>     mHeap;
+    size_t              mCurrentBufferOffset;
+    overlay_handle_t const *mOverlayHandle;
+    uint32_t            mWidth;
+    uint32_t            mHeight;
+    int32_t             mFormat;
+    int32_t             mWidthStride;
+    int32_t             mHeightStride;
+};
+
+// ----------------------------------------------------------------------------
+
+}; // namespace android
+
+#endif // ANDROID_OVERLAY_H
diff --git a/include/ui/PixelFormat.h b/include/ui/PixelFormat.h
index d56a4a7..c61df32 100644
--- a/include/ui/PixelFormat.h
+++ b/include/ui/PixelFormat.h
@@ -61,6 +61,7 @@
     PIXEL_FORMAT_RGBX_8888   = GGL_PIXEL_FORMAT_RGBX_8888,  // 4x8-bit RGB0
     PIXEL_FORMAT_RGB_888     = GGL_PIXEL_FORMAT_RGB_888,    // 3x8-bit RGB
     PIXEL_FORMAT_RGB_565     = GGL_PIXEL_FORMAT_RGB_565,    // 16-bit RGB
+    PIXEL_FORMAT_BGRA_8888   = GGL_PIXEL_FORMAT_BGRA_8888,  // 4x8-bit BGRA
     PIXEL_FORMAT_RGBA_5551   = GGL_PIXEL_FORMAT_RGBA_5551,  // 16-bit ARGB
     PIXEL_FORMAT_RGBA_4444   = GGL_PIXEL_FORMAT_RGBA_4444,  // 16-bit ARGB
     PIXEL_FORMAT_A_8         = GGL_PIXEL_FORMAT_A_8,        // 8-bit A
diff --git a/include/ui/Region.h b/include/ui/Region.h
index a86e630..a0c4608 100644
--- a/include/ui/Region.h
+++ b/include/ui/Region.h
@@ -24,7 +24,8 @@
 #include <utils/Parcel.h>
 
 #include <ui/Rect.h>
-#include <ui/BlitHardware.h>
+
+#include <hardware/copybit.h>
 
 #include <corecg/SkRegion.h>
 
@@ -166,7 +167,6 @@
     }
     mutable Region::iterator i;
 };
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/include/ui/Surface.h b/include/ui/Surface.h
index 0a75bf3..2e24f86 100644
--- a/include/ui/Surface.h
+++ b/include/ui/Surface.h
@@ -48,7 +48,7 @@
         void*       base;
         uint32_t    reserved[2];
     };
-    
+
     bool        isValid() const { return this && mToken>=0 && mClient!=0; }
     SurfaceID   ID() const      { return mToken; }
 
@@ -59,18 +59,17 @@
 
     void*       heapBase(int i) const;
     uint32_t    getFlags() const { return mFlags; }
-    int         getMemoryType() const { return mMemoryType; }
-    
+
     // setSwapRectangle() is mainly used by EGL
     void        setSwapRectangle(const Rect& r);
     const Rect& swapRectangle() const;
     status_t    nextBuffer(SurfaceInfo* info);
-    
+
     sp<Surface>         dup() const;
     static sp<Surface>  readFromParcel(Parcel* parcel);
     static status_t     writeToParcel(const sp<Surface>& surface, Parcel* parcel);
     static bool         isSameSurface(const sp<Surface>& lhs, const sp<Surface>& rhs);
-    
+
     status_t    setLayer(int32_t layer);
     status_t    setPosition(int32_t x, int32_t y);
     status_t    setSize(uint32_t w, uint32_t h);
@@ -83,13 +82,14 @@
     status_t    setAlpha(float alpha=1.0f);
     status_t    setMatrix(float dsdx, float dtdx, float dsdy, float dtdy);
     status_t    setFreezeTint(uint32_t tint);
-    
+
     uint32_t    getIdentity() const { return mIdentity; }
 private:
     friend class SurfaceComposerClient;
 
-    // camera needs access to the ISurface binder interface for preview
+    // camera and camcorder need access to the ISurface binder interface for preview
     friend class Camera;
+    friend class MediaRecorder;
     // mediaplayer needs access to ISurface for display
     friend class MediaPlayer;
     const sp<ISurface>& getISurface() const { return mSurface; }
@@ -98,19 +98,19 @@
     Surface& operator = (Surface& rhs);
     Surface(const Surface& rhs);
 
-    Surface(const sp<SurfaceComposerClient>& client, 
+    Surface(const sp<SurfaceComposerClient>& client,
             const sp<ISurface>& surface,
             const ISurfaceFlingerClient::surface_data_t& data,
             uint32_t w, uint32_t h, PixelFormat format, uint32_t flags,
             bool owner = true);
-    
+
     Surface(Surface const* rhs);
 
     ~Surface();
 
     Region dirtyRegion() const;
     void setDirtyRegion(const Region& region) const;
-    
+
     // this locks protects calls to lockSurface() / unlockSurface()
     // and is called by SurfaceComposerClient.
     Mutex& getLock() const { return mSurfaceLock; }
@@ -118,7 +118,6 @@
     sp<SurfaceComposerClient>   mClient;
     sp<ISurface>                mSurface;
     sp<IMemoryHeap>             mHeap[2];
-    int                         mMemoryType;
     SurfaceID                   mToken;
     uint32_t                    mIdentity;
     PixelFormat                 mFormat;
diff --git a/include/utils/IPCThreadState.h b/include/utils/IPCThreadState.h
index 47043b8..0490fd3 100644
--- a/include/utils/IPCThreadState.h
+++ b/include/utils/IPCThreadState.h
@@ -20,6 +20,7 @@
 #include <utils/Errors.h>
 #include <utils/Parcel.h>
 #include <utils/ProcessState.h>
+#include <utils/Vector.h>
 
 #ifdef HAVE_WIN32_PROC
 typedef  int  uid_t;
@@ -92,6 +93,8 @@
                                            void* cookie);
     
     const   sp<ProcessState>    mProcess;
+            Vector<BBinder*>    mPendingStrongDerefs;
+            Vector<RefBase::weakref_type*> mPendingWeakDerefs;
                                 
             Parcel              mIn;
             Parcel              mOut;
diff --git a/include/utils/MemoryHeapPmem.h b/include/utils/MemoryHeapPmem.h
index b694b20..60335ad 100644
--- a/include/utils/MemoryHeapPmem.h
+++ b/include/utils/MemoryHeapPmem.h
@@ -23,7 +23,7 @@
 #include <utils/MemoryDealer.h>
 #include <utils/MemoryHeapBase.h>
 #include <utils/IMemory.h>
-#include <utils/Vector.h>
+#include <utils/SortedVector.h>
 
 namespace android {
 
@@ -31,11 +31,21 @@
 
 // ---------------------------------------------------------------------------
 
-class SubRegionMemory;
-
 class MemoryHeapPmem : public HeapInterface, public MemoryHeapBase
 {
 public:
+    class MemoryPmem : public BnMemory {
+    public:
+        MemoryPmem(const sp<MemoryHeapPmem>& heap);
+        ~MemoryPmem();
+    protected:
+        const sp<MemoryHeapPmem>&  getHeap() const { return mClientHeap; }
+    private:
+        friend class MemoryHeapPmem;
+        virtual void revoke() = 0;
+        sp<MemoryHeapPmem>  mClientHeap;
+    };
+    
     MemoryHeapPmem(const sp<MemoryHeapBase>& pmemHeap,
                 uint32_t flags = IMemoryHeap::MAP_ONCE);
     ~MemoryHeapPmem();
@@ -51,11 +61,16 @@
     
     /* revoke all allocations made by this heap */
     virtual void revoke();
-    
+
+private:
+    /* use this to create your own IMemory for mapMemory */
+    virtual sp<MemoryPmem> createMemory(size_t offset, size_t size);
+    void remove(const wp<MemoryPmem>& memory);
+
 private:
     sp<MemoryHeapBase>              mParentHeap;
     mutable Mutex                   mLock;
-    Vector< wp<SubRegionMemory> >   mAllocations;
+    SortedVector< wp<MemoryPmem> >  mAllocations;
 };
 
 
diff --git a/include/utils/ResourceTypes.h b/include/utils/ResourceTypes.h
index 31b9aa8..2d56e3e 100644
--- a/include/utils/ResourceTypes.h
+++ b/include/utils/ResourceTypes.h
@@ -140,8 +140,6 @@
     void serialize(void* outData);
     // Deserialize/Unmarshall the patch data
     static Res_png_9patch* deserialize(const void* data);
-    // Deserialize/Unmarshall the patch data into a newly malloc-ed block
-    static void deserialize(const void* data, Res_png_9patch* outData);
     // Compute the size of the serialized data structure
     size_t serializedSize();
 };
@@ -860,6 +858,7 @@
         KEYSHIDDEN_ANY = 0x0000,
         KEYSHIDDEN_NO = 0x0001,
         KEYSHIDDEN_YES = 0x0002,
+        KEYSHIDDEN_SOFT = 0x0003,
     };
     
     union {
@@ -989,11 +988,20 @@
         return diffs;
     }
     
-    // Return true if 'this' is more specific than 'o'.
+    // Return true if 'this' is more specific than 'o'.  Optionally, if
+    // 'requested' is null, then they will also be compared against the
+    // requested configuration and true will only be returned if 'this'
+    // is a better candidate than 'o' for the configuration.  This assumes that
+    // match() has already been used to remove any configurations that don't
+    // match the requested configuration at all; if they are not first filtered,
+    // non-matching results can be considered better than matching ones.
     inline bool
     isBetterThan(const ResTable_config& o, const ResTable_config* requested = NULL) const {
+        // The order of the following tests defines the importance of one
+        // configuration parameter over another.  Those tests first are more
+        // important, trumping any values in those following them.
         if (imsi != 0 && (!requested || requested->imsi != 0)) {
-            if (mcc != 0 && (!requested || requested->mcc!= 0)) {
+            if (mcc != 0 && (!requested || requested->mcc != 0)) {
                 if (o.mcc == 0) {
                     return true;
                 }
@@ -1034,9 +1042,24 @@
             }
         }
         if (input != 0 && (!requested || requested->input != 0)) {
-            if ((inputFlags&MASK_KEYSHIDDEN) != 0 && (!requested
-                                                      || (requested->inputFlags&MASK_KEYSHIDDEN) != 0)) {
-                if ((o.inputFlags&MASK_KEYSHIDDEN) == 0) {
+            const int keysHidden = inputFlags&MASK_KEYSHIDDEN;
+            const int reqKeysHidden = requested
+                    ? requested->inputFlags&MASK_KEYSHIDDEN : 0;
+            if (keysHidden != 0 && reqKeysHidden != 0) {
+                const int oKeysHidden = o.inputFlags&MASK_KEYSHIDDEN;
+                //LOGI("isBetterThan keysHidden: cur=%d, given=%d, config=%d\n",
+                //        keysHidden, oKeysHidden, reqKeysHidden);
+                if (oKeysHidden == 0) {
+                    //LOGI("Better because 0!");
+                    return true;
+                }
+                // For compatibility, we count KEYSHIDDEN_NO as being
+                // the same as KEYSHIDDEN_SOFT.  Here we disambiguate these
+                // may making an exact match more specific.
+                if (keysHidden == reqKeysHidden && oKeysHidden != reqKeysHidden) {
+                    // The current configuration is an exact match, and
+                    // the given one is not, so the current one is better.
+                    //LOGI("Better because other not same!");
                     return true;
                 }
             }
@@ -1078,7 +1101,8 @@
         return false;
     }
     
-    // Return true if 'this' matches the parameters in 'settings'.
+    // Return true if 'this' can be considered a match for the parameters in
+    // 'settings'.
     inline bool match(const ResTable_config& settings) const {
         if (imsi != 0) {
             if (settings.mcc != 0 && mcc != 0
@@ -1121,7 +1145,14 @@
             const int setKeysHidden = settings.inputFlags&MASK_KEYSHIDDEN;
             if (setKeysHidden != 0 && keysHidden != 0
                 && keysHidden != setKeysHidden) {
-                return false;
+                // For compatibility, we count a request for KEYSHIDDEN_NO as also
+                // matching the more recent KEYSHIDDEN_SOFT.  Basically
+                // KEYSHIDDEN_NO means there is some kind of keyboard available.
+                //LOGI("Matching keysHidden: have=%d, config=%d\n", keysHidden, setKeysHidden);
+                if (keysHidden != KEYSHIDDEN_NO || setKeysHidden != KEYSHIDDEN_SOFT) {
+                    //LOGI("No match!");
+                    return false;
+                }
             }
             if (settings.keyboard != 0 && keyboard != 0
                 && keyboard != settings.keyboard) {
diff --git a/include/utils/TimeUtils.h b/include/utils/TimeUtils.h
index 30e5330..b19e021 100644
--- a/include/utils/TimeUtils.h
+++ b/include/utils/TimeUtils.h
@@ -17,10 +17,11 @@
 #ifndef ANDROID_TIME_H
 #define ANDROID_TIME_H
 
+#include <time.h>
+#include <cutils/tztime.h>
 #include <stdint.h>
 #include <sys/types.h>
 #include <sys/time.h>
-#include <time.h>
 #include <utils/String8.h>
 #include <utils/String16.h>
 
@@ -58,7 +59,7 @@
     Time();
 
     void switchTimezone(const char *timezone);
-    String8 format(const char *format) const;
+    String8 format(const char *format, const struct strftime_locale *locale) const;
     void format2445(short* buf, bool hasTime) const;
     String8 toString() const;
     void setToNow();
diff --git a/include/utils/string_array.h b/include/utils/string_array.h
index ede0644..064dda2 100644
--- a/include/utils/string_array.h
+++ b/include/utils/string_array.h
@@ -111,6 +111,19 @@
         return mArray[idx];
     }
 
+    //
+    // Set entry N to specified string.
+    // [should use operator[] here]
+    //
+    void setEntry(int idx, const char* str) {
+        if (idx < 0 || idx >= mCurrent)
+            return;
+        delete[] mArray[idx];
+        int len = strlen(str);
+        mArray[idx] = new char[len+1];
+        memcpy(mArray[idx], str, len+1);
+    }
+
 private:
     int     mMax;
     int     mCurrent;