diff --git a/cmds/dumpstate/DumpstateUtil.cpp b/cmds/dumpstate/DumpstateUtil.cpp
index 97c8ae2..4b69607 100644
--- a/cmds/dumpstate/DumpstateUtil.cpp
+++ b/cmds/dumpstate/DumpstateUtil.cpp
@@ -378,34 +378,6 @@
     return status;
 }
 
-int GetPidByName(const std::string& ps_name) {
-    DIR* proc_dir;
-    struct dirent* ps;
-    unsigned int pid;
-    std::string cmdline;
-
-    if (!(proc_dir = opendir("/proc"))) {
-        MYLOGE("Can't open /proc\n");
-        return -1;
-    }
-
-    while ((ps = readdir(proc_dir))) {
-        if (!(pid = atoi(ps->d_name))) {
-            continue;
-        }
-        android::base::ReadFileToString("/proc/" + std::string(ps->d_name) + "/cmdline", &cmdline);
-        if (cmdline.find(ps_name) == std::string::npos) {
-            continue;
-        } else {
-            closedir(proc_dir);
-            return pid;
-        }
-    }
-    MYLOGE("can't find the pid\n");
-    closedir(proc_dir);
-    return -1;
-}
-
 }  // namespace dumpstate
 }  // namespace os
 }  // namespace android
diff --git a/cmds/dumpstate/DumpstateUtil.h b/cmds/dumpstate/DumpstateUtil.h
index d75b08c..b7ac25c 100644
--- a/cmds/dumpstate/DumpstateUtil.h
+++ b/cmds/dumpstate/DumpstateUtil.h
@@ -205,12 +205,6 @@
  */
 int DumpFileToFd(int fd, const std::string& title, const std::string& path);
 
-/*
- * Finds the process id by process name.
- * |ps_name| the process name we want to search for
- */
-int GetPidByName(const std::string& ps_name);
-
 }  // namespace dumpstate
 }  // namespace os
 }  // namespace android
diff --git a/cmds/dumpstate/tests/dumpstate_test.cpp b/cmds/dumpstate/tests/dumpstate_test.cpp
index 0e88e43..4e6b084 100644
--- a/cmds/dumpstate/tests/dumpstate_test.cpp
+++ b/cmds/dumpstate/tests/dumpstate_test.cpp
@@ -1406,14 +1406,6 @@
         return status;
     }
 
-    // Find out the pid of the process_name
-    int FindPidOfProcess(const std::string& process_name) {
-        CaptureStderr();
-        int status = GetPidByName(process_name);
-        err = GetCapturedStderr();
-        return status;
-    }
-
     int fd;
 
     // 'fd` output and `stderr` from the last command ran.
@@ -1763,18 +1755,6 @@
     EXPECT_THAT(out, EndsWith("skipped on dry run\n"));
 }
 
-TEST_F(DumpstateUtilTest, FindingPidWithExistingProcess) {
-    // init process always has pid 1.
-    EXPECT_EQ(1, FindPidOfProcess("init"));
-    EXPECT_THAT(err, IsEmpty());
-}
-
-TEST_F(DumpstateUtilTest, FindingPidWithNotExistingProcess) {
-    // find the process with abnormal name.
-    EXPECT_EQ(-1, FindPidOfProcess("abcdef12345-543"));
-    EXPECT_THAT(err, StrEq("can't find the pid\n"));
-}
-
 }  // namespace dumpstate
 }  // namespace os
 }  // namespace android
diff --git a/cmds/dumpstate/utils.cpp b/cmds/dumpstate/utils.cpp
index 4cbf577..e08c806 100644
--- a/cmds/dumpstate/utils.cpp
+++ b/cmds/dumpstate/utils.cpp
@@ -725,7 +725,11 @@
         return -1;
     }
     fcntl(s, F_SETFD, FD_CLOEXEC);
-    if (listen(s, 4) < 0) {
+
+    // Set backlog to 0 to make sure that queue size will be minimum.
+    // In Linux, because the minimum queue will be 1, connect() will be blocked
+    // if the other clients already called connect() and the connection request was not accepted.
+    if (listen(s, 0) < 0) {
         MYLOGE("listen(control socket): %s\n", strerror(errno));
         return -1;
     }
@@ -736,6 +740,9 @@
 
     // Close socket just after accept(), to make sure that connect() by client will get error
     // when the socket is used by the other services.
+    // There is still a race condition possibility between accept and close, but there is no way
+    // to close-on-accept atomically.
+    // See detail; b/123306389#comment25
     close(s);
 
     if (fd < 0) {
diff --git a/cmds/installd/migrate_legacy_obb_data.sh b/cmds/installd/migrate_legacy_obb_data.sh
index ef9be5c..1075688 100644
--- a/cmds/installd/migrate_legacy_obb_data.sh
+++ b/cmds/installd/migrate_legacy_obb_data.sh
@@ -15,16 +15,21 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-if ! test -d /data/media/obb ; then
-  log -p i -t migrate_legacy_obb_data "No legacy obb data to migrate."
-  exit 0
-fi
-
-rm -rf /data/media/0/Android/obb/test_probe
+rm -rf /sdcard/Android/obb/test_probe
+mkdir -p /sdcard/Android/obb/
 touch /sdcard/Android/obb/test_probe
 if ! test -f /data/media/0/Android/obb/test_probe ; then
   log -p i -t migrate_legacy_obb_data "No support for 'unshared_obb'. Not migrating"
-  rm -rf /data/media/0/Android/obb/test_probe
+  rm -rf /sdcard/Android/obb/test_probe
+  exit 0
+fi
+
+# Delete the test file, and remove the obb folder if it is empty
+rm -rf /sdcard/Android/obb/test_probe
+rmdir /data/media/obb
+
+if ! test -d /data/media/obb ; then
+  log -p i -t migrate_legacy_obb_data "No legacy obb data to migrate."
   exit 0
 fi
 
diff --git a/cmds/installd/otapreopt_chroot.cpp b/cmds/installd/otapreopt_chroot.cpp
index 0c4badf..b4bcd53 100644
--- a/cmds/installd/otapreopt_chroot.cpp
+++ b/cmds/installd/otapreopt_chroot.cpp
@@ -236,6 +236,18 @@
     // the Android Runtime APEX, as it is required by otapreopt to run dex2oat.
     std::vector<apex::ApexFile> active_packages = ActivateApexPackages();
 
+    // Check that an Android Runtime APEX has been activated; clean up and exit
+    // early otherwise.
+    if (std::none_of(active_packages.begin(),
+                     active_packages.end(),
+                     [](const apex::ApexFile& package){
+                         return package.GetManifest().name() == "com.android.runtime";
+                     })) {
+        LOG(FATAL_WITHOUT_ABORT) << "No activated com.android.runtime APEX package.";
+        DeactivateApexPackages(active_packages);
+        exit(217);
+    }
+
     // Now go on and run otapreopt.
 
     // Incoming:  cmd + status-fd + target-slot + cmd...      | Incoming | = argc
diff --git a/cmds/lshal/ListCommand.cpp b/cmds/lshal/ListCommand.cpp
index c706d91..ad7e4c4 100644
--- a/cmds/lshal/ListCommand.cpp
+++ b/cmds/lshal/ListCommand.cpp
@@ -975,7 +975,8 @@
        "    - DM: if the HAL is in the device manifest\n"
        "    - DC: if the HAL is in the device compatibility matrix\n"
        "    - FM: if the HAL is in the framework manifest\n"
-       "    - FC: if the HAL is in the framework compatibility matrix"});
+       "    - FC: if the HAL is in the framework compatibility matrix\n"
+       "    - X: if the HAL is in none of the above lists"});
     mOptions.push_back({'S', "service-status", no_argument, v++, [](ListCommand* thiz, const char*) {
         thiz->mSelectedColumns.push_back(TableColumnType::SERVICE_STATUS);
         return OK;
diff --git a/cmds/service/service.cpp b/cmds/service/service.cpp
index d5dc6b7..543357c 100644
--- a/cmds/service/service.cpp
+++ b/cmds/service/service.cpp
@@ -70,7 +70,7 @@
 {
     bool wantsUsage = false;
     int result = 0;
-    
+
     while (1) {
         int ic = getopt(argc, argv, "h?");
         if (ic < 0)
@@ -97,7 +97,7 @@
         aerr << "service: Unable to get default service manager!" << endl;
         return 20;
     }
-    
+
     if (optind >= argc) {
         wantsUsage = true;
     } else if (!wantsUsage) {
@@ -119,8 +119,8 @@
             for (unsigned i = 0; i < services.size(); i++) {
                 String16 name = services[i];
                 sp<IBinder> service = sm->checkService(name);
-                aout << i 
-                     << "\t" << good_old_string(name) 
+                aout << i
+                     << "\t" << good_old_string(name)
                      << ": [" << good_old_string(get_interface_name(service)) << "]"
                      << endl;
             }
@@ -188,68 +188,68 @@
                             optind++;
                             data.writeStrongBinder(nullptr);
                         } else if (strcmp(argv[optind], "intent") == 0) {
-                        	
-                        	char* action = nullptr;
-                        	char* dataArg = nullptr;
-                        	char* type = nullptr;
-                        	int launchFlags = 0;
-                        	char* component = nullptr;
-                        	int categoryCount = 0;
-                        	char* categories[16];
-                        	
-                        	char* context1 = nullptr;
-                        	
+
+                            char* action = nullptr;
+                            char* dataArg = nullptr;
+                            char* type = nullptr;
+                            int launchFlags = 0;
+                            char* component = nullptr;
+                            int categoryCount = 0;
+                            char* categories[16];
+
+                            char* context1 = nullptr;
+
                             optind++;
-                            
-                        	while (optind < argc)
-                        	{
-                        		char* key = strtok_r(argv[optind], "=", &context1);
-                        		char* value = strtok_r(nullptr, "=", &context1);
-                                
+
+                            while (optind < argc)
+                            {
+                                char* key = strtok_r(argv[optind], "=", &context1);
+                                char* value = strtok_r(nullptr, "=", &context1);
+
                                 // we have reached the end of the XXX=XXX args.
                                 if (key == nullptr) break;
-                        		
-                        		if (strcmp(key, "action") == 0)
-                        		{
-                        			action = value;
-                        		}
-                        		else if (strcmp(key, "data") == 0)
-                        		{
-                        			dataArg = value;
-                        		}
-                        		else if (strcmp(key, "type") == 0)
-                        		{
-                        			type = value;
-                        		}
-                        		else if (strcmp(key, "launchFlags") == 0)
-                        		{
-                        			launchFlags = atoi(value);
-                        		}
-                        		else if (strcmp(key, "component") == 0)
-                        		{
-                        			component = value;
-                        		}
-                        		else if (strcmp(key, "categories") == 0)
-                        		{
-                        			char* context2 = nullptr;
-                        			categories[categoryCount] = strtok_r(value, ",", &context2);
-                        			
-                        			while (categories[categoryCount] != nullptr)
-                        			{
-                        				categoryCount++;
-                        				categories[categoryCount] = strtok_r(nullptr, ",", &context2);
-                        			}
-                        		}
-                                
+
+                                if (strcmp(key, "action") == 0)
+                                {
+                                    action = value;
+                                }
+                                else if (strcmp(key, "data") == 0)
+                                {
+                                    dataArg = value;
+                                }
+                                else if (strcmp(key, "type") == 0)
+                                {
+                                    type = value;
+                                }
+                                else if (strcmp(key, "launchFlags") == 0)
+                                {
+                                    launchFlags = atoi(value);
+                                }
+                                else if (strcmp(key, "component") == 0)
+                                {
+                                    component = value;
+                                }
+                                else if (strcmp(key, "categories") == 0)
+                                {
+                                    char* context2 = nullptr;
+                                    categories[categoryCount] = strtok_r(value, ",", &context2);
+
+                                    while (categories[categoryCount] != nullptr)
+                                    {
+                                        categoryCount++;
+                                        categories[categoryCount] = strtok_r(nullptr, ",", &context2);
+                                    }
+                                }
+
                                 optind++;
-                        	} 
-                        	
+                            }
+
                             writeString16(data, action);
                             writeString16(data, dataArg);
                             writeString16(data, type);
-                       		data.writeInt32(launchFlags);
+                            data.writeInt32(launchFlags);
                             writeString16(data, component);
-                        	
+
                             if (categoryCount > 0)
                             {
                                 data.writeInt32(categoryCount);
@@ -261,10 +261,10 @@
                             else
                             {
                                 data.writeInt32(0);
-                            }                            
-  
+                            }
+
                             // for now just set the extra field to be null.
-                       		data.writeInt32(-1);
+                            data.writeInt32(-1);
                         } else {
                             aerr << "service: unknown option " << argv[optind] << endl;
                             wantsUsage = true;
@@ -272,7 +272,7 @@
                             break;
                         }
                     }
-                    
+
                     service->transact(code, data, &reply);
                     aout << "Result: " << reply << endl;
                 } else {
@@ -295,7 +295,7 @@
             result = 10;
         }
     }
-    
+
     if (wantsUsage) {
         aout << "Usage: service [-h|-?]\n"
                 "       service list\n"
@@ -311,7 +311,7 @@
 //                "       action=STR data=STR type=STR launchFlags=INT component=STR categories=STR[,STR,...]\n";
         return result;
     }
-    
+
     return result;
 }
 
diff --git a/libs/binder/Android.bp b/libs/binder/Android.bp
index b9c6171..b230943 100644
--- a/libs/binder/Android.bp
+++ b/libs/binder/Android.bp
@@ -73,7 +73,6 @@
         "Status.cpp",
         "TextOutput.cpp",
         "IpPrefix.cpp",
-        "Value.cpp",
         ":libbinder_aidl",
     ],
 
diff --git a/libs/binder/Binder.cpp b/libs/binder/Binder.cpp
index cb0e08d..c1d916c 100644
--- a/libs/binder/Binder.cpp
+++ b/libs/binder/Binder.cpp
@@ -17,12 +17,15 @@
 #include <binder/Binder.h>
 
 #include <atomic>
-#include <utils/misc.h>
 #include <binder/BpBinder.h>
 #include <binder/IInterface.h>
+#include <binder/IPCThreadState.h>
 #include <binder/IResultReceiver.h>
 #include <binder/IShellCallback.h>
 #include <binder/Parcel.h>
+#include <cutils/android_filesystem_config.h>
+#include <cutils/compiler.h>
+#include <utils/misc.h>
 
 #include <stdio.h>
 
@@ -125,10 +128,23 @@
 {
     data.setDataPosition(0);
 
+    // Shell command transaction is conventionally implemented by
+    // overriding onTransact by copy/pasting the parceling code from
+    // this file. So, we must check permissions for it before we call
+    // onTransact. This check is here because shell APIs aren't
+    // guaranteed to be stable, and so they should only be used by
+    // developers.
+    if (CC_UNLIKELY(code == SHELL_COMMAND_TRANSACTION)) {
+        uid_t uid = IPCThreadState::self()->getCallingUid();
+        if (uid != AID_SHELL && uid != AID_ROOT) {
+            return PERMISSION_DENIED;
+        }
+    }
+
     status_t err = NO_ERROR;
     switch (code) {
         case PING_TRANSACTION:
-            reply->writeInt32(pingBinder());
+            err = pingBinder();
             break;
         default:
             err = onTransact(code, data, reply, flags);
diff --git a/libs/binder/BpBinder.cpp b/libs/binder/BpBinder.cpp
index 67f968a..5ceb218 100644
--- a/libs/binder/BpBinder.cpp
+++ b/libs/binder/BpBinder.cpp
@@ -148,6 +148,10 @@
     IPCThreadState::self()->incWeakHandle(handle, this);
 }
 
+int32_t BpBinder::handle() const {
+    return mHandle;
+}
+
 bool BpBinder::isDescriptorCached() const {
     Mutex::Autolock _l(mLock);
     return mDescriptorCache.size() ? true : false;
@@ -186,10 +190,7 @@
 {
     Parcel send;
     Parcel reply;
-    status_t err = transact(PING_TRANSACTION, send, &reply);
-    if (err != NO_ERROR) return err;
-    if (reply.dataSize() < sizeof(status_t)) return NOT_ENOUGH_DATA;
-    return (status_t)reply.readInt32();
+    return transact(PING_TRANSACTION, send, &reply);
 }
 
 status_t BpBinder::dump(int fd, const Vector<String16>& args)
diff --git a/libs/binder/BufferedTextOutput.cpp b/libs/binder/BufferedTextOutput.cpp
index 857bbf9..a7d5240 100644
--- a/libs/binder/BufferedTextOutput.cpp
+++ b/libs/binder/BufferedTextOutput.cpp
@@ -23,12 +23,12 @@
 #include <utils/RefBase.h>
 #include <utils/Vector.h>
 
-#include <private/binder/Static.h>
-
 #include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
 
+#include "Static.h"
+
 // ---------------------------------------------------------------------------
 
 namespace android {
diff --git a/libs/binder/IAppOpsCallback.cpp b/libs/binder/IAppOpsCallback.cpp
index aba4967..4c151e7 100644
--- a/libs/binder/IAppOpsCallback.cpp
+++ b/libs/binder/IAppOpsCallback.cpp
@@ -22,8 +22,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/IAppOpsService.cpp b/libs/binder/IAppOpsService.cpp
index 66d6e31..c426f3a 100644
--- a/libs/binder/IAppOpsService.cpp
+++ b/libs/binder/IAppOpsService.cpp
@@ -22,8 +22,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/IBatteryStats.cpp b/libs/binder/IBatteryStats.cpp
index b307e3e..cc0022a 100644
--- a/libs/binder/IBatteryStats.cpp
+++ b/libs/binder/IBatteryStats.cpp
@@ -20,8 +20,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index 3424c28..cfb86f0 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -31,7 +31,6 @@
 #include <utils/threads.h>
 
 #include <private/binder/binder_module.h>
-#include <private/binder/Static.h>
 
 #include <atomic>
 #include <errno.h>
@@ -44,6 +43,8 @@
 #include <sys/resource.h>
 #include <unistd.h>
 
+#include "Static.h"
+
 #if LOG_NDEBUG
 
 #define IF_LOG_TRANSACTIONS() if (false)
@@ -998,7 +999,7 @@
     if (err >= NO_ERROR) {
         if (bwr.write_consumed > 0) {
             if (bwr.write_consumed < mOut.dataSize())
-                mOut.remove(0, bwr.write_consumed);
+                LOG_ALWAYS_FATAL("Driver did not consume write buffer");
             else {
                 mOut.setDataSize(0);
                 processPostWriteDerefs();
diff --git a/libs/binder/IPermissionController.cpp b/libs/binder/IPermissionController.cpp
index 6b99150..bf2f20a 100644
--- a/libs/binder/IPermissionController.cpp
+++ b/libs/binder/IPermissionController.cpp
@@ -22,8 +22,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/IResultReceiver.cpp b/libs/binder/IResultReceiver.cpp
index 159763d..1e11941 100644
--- a/libs/binder/IResultReceiver.cpp
+++ b/libs/binder/IResultReceiver.cpp
@@ -22,8 +22,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/IServiceManager.cpp b/libs/binder/IServiceManager.cpp
index 07550fb..74f1f47 100644
--- a/libs/binder/IServiceManager.cpp
+++ b/libs/binder/IServiceManager.cpp
@@ -29,7 +29,7 @@
 #include <utils/String8.h>
 #include <utils/SystemClock.h>
 
-#include <private/binder/Static.h>
+#include "Static.h"
 
 #include <unistd.h>
 
diff --git a/libs/binder/IShellCallback.cpp b/libs/binder/IShellCallback.cpp
index 6c697de..88cc603 100644
--- a/libs/binder/IShellCallback.cpp
+++ b/libs/binder/IShellCallback.cpp
@@ -25,8 +25,6 @@
 #include <binder/Parcel.h>
 #include <utils/String8.h>
 
-#include <private/binder/Static.h>
-
 namespace android {
 
 // ----------------------------------------------------------------------
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index c389d18..b5fbf42 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -37,7 +37,6 @@
 #include <binder/ProcessState.h>
 #include <binder/Status.h>
 #include <binder/TextOutput.h>
-#include <binder/Value.h>
 
 #include <cutils/ashmem.h>
 #include <utils/Debug.h>
@@ -48,7 +47,7 @@
 #include <utils/String16.h>
 
 #include <private/binder/binder_module.h>
-#include <private/binder/Static.h>
+#include "Static.h"
 
 #ifndef INT32_MAX
 #define INT32_MAX ((int32_t)(2147483647))
@@ -667,11 +666,6 @@
     }
 }
 
-const binder_size_t* Parcel::objects() const
-{
-    return mObjects;
-}
-
 size_t Parcel::objectsCount() const
 {
     return mObjectsSize;
@@ -1163,10 +1157,6 @@
     return parcelable.writeToParcel(this);
 }
 
-status_t Parcel::writeValue(const binder::Value& value) {
-    return value.writeToParcel(this);
-}
-
 status_t Parcel::writeNativeHandle(const native_handle* handle)
 {
     if (!handle || handle->version != sizeof(native_handle))
@@ -1404,125 +1394,6 @@
     return status.writeToParcel(this);
 }
 
-status_t Parcel::writeMap(const ::android::binder::Map& map_in)
-{
-    using ::std::map;
-    using ::android::binder::Value;
-    using ::android::binder::Map;
-
-    Map::const_iterator iter;
-    status_t ret;
-
-    ret = writeInt32(map_in.size());
-
-    if (ret != NO_ERROR) {
-        return ret;
-    }
-
-    for (iter = map_in.begin(); iter != map_in.end(); ++iter) {
-        ret = writeValue(Value(iter->first));
-        if (ret != NO_ERROR) {
-            return ret;
-        }
-
-        ret = writeValue(iter->second);
-        if (ret != NO_ERROR) {
-            return ret;
-        }
-    }
-
-    return ret;
-}
-
-status_t Parcel::writeNullableMap(const std::unique_ptr<binder::Map>& map)
-{
-    if (map == nullptr) {
-        return writeInt32(-1);
-    }
-
-    return writeMap(*map.get());
-}
-
-status_t Parcel::readMap(::android::binder::Map* map_out)const
-{
-    using ::std::map;
-    using ::android::String16;
-    using ::android::String8;
-    using ::android::binder::Value;
-    using ::android::binder::Map;
-
-    status_t ret = NO_ERROR;
-    int32_t count;
-
-    ret = readInt32(&count);
-    if (ret != NO_ERROR) {
-        return ret;
-    }
-
-    if (count < 0) {
-        ALOGE("readMap: Unexpected count: %d", count);
-        return (count == -1)
-            ? UNEXPECTED_NULL
-            : BAD_VALUE;
-    }
-
-    map_out->clear();
-
-    while (count--) {
-        Map::key_type key;
-        Value value;
-
-        ret = readValue(&value);
-        if (ret != NO_ERROR) {
-            return ret;
-        }
-
-        if (!value.getString(&key)) {
-            ALOGE("readMap: Key type not a string (parcelType = %d)", value.parcelType());
-            return BAD_VALUE;
-        }
-
-        ret = readValue(&value);
-        if (ret != NO_ERROR) {
-            return ret;
-        }
-
-        (*map_out)[key] = value;
-    }
-
-    return ret;
-}
-
-status_t Parcel::readNullableMap(std::unique_ptr<binder::Map>* map) const
-{
-    const size_t start = dataPosition();
-    int32_t count;
-    status_t status = readInt32(&count);
-    map->reset();
-
-    if (status != OK || count == -1) {
-        return status;
-    }
-
-    setDataPosition(start);
-    map->reset(new binder::Map());
-
-    status = readMap(map->get());
-
-    if (status != OK) {
-        map->reset();
-    }
-
-    return status;
-}
-
-
-
-void Parcel::remove(size_t /*start*/, size_t /*amt*/)
-{
-    LOG_ALWAYS_FATAL("Parcel::remove() not yet implemented!");
-}
-
 status_t Parcel::validateReadData(size_t upperBound) const
 {
     // Don't allow non-object reads on object data
@@ -2227,10 +2098,6 @@
     return parcelable->readFromParcel(this);
 }
 
-status_t Parcel::readValue(binder::Value* value) const {
-    return value->readFromParcel(this);
-}
-
 int32_t Parcel::readExceptionCode() const
 {
     binder::Status status;
@@ -2582,7 +2449,7 @@
     } else if (dataSize() > 0) {
         const uint8_t* DATA = data();
         to << indent << HexDump(DATA, dataSize()) << dedent;
-        const binder_size_t* OBJS = objects();
+        const binder_size_t* OBJS = mObjects;
         const size_t N = objectsCount();
         for (size_t i=0; i<N; i++) {
             const flat_binder_object* flat
diff --git a/libs/binder/include/private/binder/ParcelValTypes.h b/libs/binder/ParcelValTypes.h
similarity index 100%
rename from libs/binder/include/private/binder/ParcelValTypes.h
rename to libs/binder/ParcelValTypes.h
diff --git a/libs/binder/PersistableBundle.cpp b/libs/binder/PersistableBundle.cpp
index c0aec0a..97a6c94 100644
--- a/libs/binder/PersistableBundle.cpp
+++ b/libs/binder/PersistableBundle.cpp
@@ -17,7 +17,6 @@
 #define LOG_TAG "PersistableBundle"
 
 #include <binder/PersistableBundle.h>
-#include <private/binder/ParcelValTypes.h>
 
 #include <limits>
 
@@ -26,6 +25,8 @@
 #include <log/log.h>
 #include <utils/Errors.h>
 
+#include "ParcelValTypes.h"
+
 using android::BAD_TYPE;
 using android::BAD_VALUE;
 using android::NO_ERROR;
diff --git a/libs/binder/ProcessState.cpp b/libs/binder/ProcessState.cpp
index b25cd7b..a07b3a0 100644
--- a/libs/binder/ProcessState.cpp
+++ b/libs/binder/ProcessState.cpp
@@ -24,11 +24,10 @@
 #include <cutils/atomic.h>
 #include <utils/Log.h>
 #include <utils/String8.h>
-#include <utils/String8.h>
 #include <utils/threads.h>
 
 #include <private/binder/binder_module.h>
-#include <private/binder/Static.h>
+#include "Static.h"
 
 #include <errno.h>
 #include <fcntl.h>
@@ -40,7 +39,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 
-#define DEFAULT_BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2)
+#define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2)
 #define DEFAULT_MAX_BINDER_THREADS 15
 
 #ifdef __ANDROID_VNDK__
@@ -77,13 +76,7 @@
     if (gProcess != nullptr) {
         return gProcess;
     }
-    gProcess = new ProcessState(kDefaultDriver, DEFAULT_BINDER_VM_SIZE);
-    return gProcess;
-}
-
-sp<ProcessState> ProcessState::selfOrNull()
-{
-    Mutex::Autolock _l(gProcessMutex);
+    gProcess = new ProcessState(kDefaultDriver);
     return gProcess;
 }
 
@@ -104,25 +97,14 @@
         driver = "/dev/binder";
     }
 
-    gProcess = new ProcessState(driver, DEFAULT_BINDER_VM_SIZE);
+    gProcess = new ProcessState(driver);
     return gProcess;
 }
 
-sp<ProcessState> ProcessState::initWithMmapSize(size_t mmap_size) {
-    Mutex::Autolock _l(gProcessMutex);
-    if (gProcess != nullptr) {
-        LOG_ALWAYS_FATAL_IF(mmap_size != gProcess->getMmapSize(),
-                "ProcessState already initialized with a different mmap size.");
-        return gProcess;
-    }
-
-    gProcess = new ProcessState(kDefaultDriver, mmap_size);
-    return gProcess;
-}
-
-void ProcessState::setContextObject(const sp<IBinder>& object)
+sp<ProcessState> ProcessState::selfOrNull()
 {
-    setContextObject(object, String16("default"));
+    Mutex::Autolock _l(gProcessMutex);
+    return gProcess;
 }
 
 sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
@@ -130,48 +112,6 @@
     return getStrongProxyForHandle(0);
 }
 
-void ProcessState::setContextObject(const sp<IBinder>& object, const String16& name)
-{
-    AutoMutex _l(mLock);
-    mContexts.add(name, object);
-}
-
-sp<IBinder> ProcessState::getContextObject(const String16& name, const sp<IBinder>& caller)
-{
-    mLock.lock();
-    sp<IBinder> object(
-        mContexts.indexOfKey(name) >= 0 ? mContexts.valueFor(name) : nullptr);
-    mLock.unlock();
-    
-    //printf("Getting context object %s for %p\n", String8(name).string(), caller.get());
-    
-    if (object != nullptr) return object;
-
-    // Don't attempt to retrieve contexts if we manage them
-    if (mManagesContexts) {
-        ALOGE("getContextObject(%s) failed, but we manage the contexts!\n",
-            String8(name).string());
-        return nullptr;
-    }
-    
-    IPCThreadState* ipc = IPCThreadState::self();
-    {
-        Parcel data, reply;
-        // no interface token on this magic transaction
-        data.writeString16(name);
-        data.writeStrongBinder(caller);
-        status_t result = ipc->transact(0 /*magic*/, 0, data, &reply, 0);
-        if (result == NO_ERROR) {
-            object = reply.readStrongBinder();
-        }
-    }
-    
-    ipc->flushCommands();
-    
-    if (object != nullptr) setContextObject(object, name);
-    return object;
-}
-
 void ProcessState::startThreadPool()
 {
     AutoMutex _l(mLock);
@@ -181,41 +121,33 @@
     }
 }
 
-bool ProcessState::isContextManager(void) const
-{
-    return mManagesContexts;
-}
-
 bool ProcessState::becomeContextManager(context_check_func checkFunc, void* userData)
 {
-    if (!mManagesContexts) {
-        AutoMutex _l(mLock);
-        mBinderContextCheckFunc = checkFunc;
-        mBinderContextUserData = userData;
+    AutoMutex _l(mLock);
+    mBinderContextCheckFunc = checkFunc;
+    mBinderContextUserData = userData;
 
-        flat_binder_object obj {
-            .flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX,
-        };
+    flat_binder_object obj {
+        .flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX,
+    };
 
-        status_t result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR_EXT, &obj);
+    int result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR_EXT, &obj);
 
-        // fallback to original method
-        if (result != 0) {
-            android_errorWriteLog(0x534e4554, "121035042");
+    // fallback to original method
+    if (result != 0) {
+        android_errorWriteLog(0x534e4554, "121035042");
 
-            int dummy = 0;
-            result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &dummy);
-        }
-
-        if (result == 0) {
-            mManagesContexts = true;
-        } else if (result == -1) {
-            mBinderContextCheckFunc = nullptr;
-            mBinderContextUserData = nullptr;
-            ALOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno));
-        }
+        int dummy = 0;
+        result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &dummy);
     }
-    return mManagesContexts;
+
+    if (result == -1) {
+        mBinderContextCheckFunc = nullptr;
+        mBinderContextUserData = nullptr;
+        ALOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno));
+    }
+
+    return result == 0;
 }
 
 // Get references to userspace objects held by the kernel binder driver
@@ -249,10 +181,6 @@
     return count;
 }
 
-size_t ProcessState::getMmapSize() {
-    return mMmapSize;
-}
-
 void ProcessState::setCallRestriction(CallRestriction restriction) {
     LOG_ALWAYS_FATAL_IF(IPCThreadState::selfOrNull(), "Call restrictions must be set before the threadpool is started.");
 
@@ -437,7 +365,7 @@
     return fd;
 }
 
-ProcessState::ProcessState(const char *driver, size_t mmap_size)
+ProcessState::ProcessState(const char *driver)
     : mDriverName(String8(driver))
     , mDriverFD(open_driver(driver))
     , mVMStart(MAP_FAILED)
@@ -446,17 +374,15 @@
     , mExecutingThreadsCount(0)
     , mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
     , mStarvationStartTimeMs(0)
-    , mManagesContexts(false)
     , mBinderContextCheckFunc(nullptr)
     , mBinderContextUserData(nullptr)
     , mThreadPoolStarted(false)
     , mThreadPoolSeq(1)
-    , mMmapSize(mmap_size)
     , mCallRestriction(CallRestriction::NONE)
 {
     if (mDriverFD >= 0) {
         // mmap the binder, providing a chunk of virtual address space to receive transactions.
-        mVMStart = mmap(nullptr, mMmapSize, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
+        mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
         if (mVMStart == MAP_FAILED) {
             // *sigh*
             ALOGE("Using %s failed: unable to mmap transaction memory.\n", mDriverName.c_str());
@@ -473,7 +399,7 @@
 {
     if (mDriverFD >= 0) {
         if (mVMStart != MAP_FAILED) {
-            munmap(mVMStart, mMmapSize);
+            munmap(mVMStart, BINDER_VM_SIZE);
         }
         close(mDriverFD);
     }
diff --git a/libs/binder/Static.cpp b/libs/binder/Static.cpp
index 8625c6f..a6fd8c4 100644
--- a/libs/binder/Static.cpp
+++ b/libs/binder/Static.cpp
@@ -17,7 +17,7 @@
 // All static variables go here, to control initialization and
 // destruction order in the library.
 
-#include <private/binder/Static.h>
+#include "Static.h"
 
 #include <binder/BufferedTextOutput.h>
 #include <binder/IPCThreadState.h>
diff --git a/libs/binder/include/private/binder/Static.h b/libs/binder/Static.h
similarity index 100%
rename from libs/binder/include/private/binder/Static.h
rename to libs/binder/Static.h
diff --git a/libs/binder/TEST_MAPPING b/libs/binder/TEST_MAPPING
index 91b75c7..01e57d3 100644
--- a/libs/binder/TEST_MAPPING
+++ b/libs/binder/TEST_MAPPING
@@ -1,13 +1,16 @@
 {
   "presubmit": [
     {
+      "name": "binderSafeInterfaceTest"
+    },
+    {
       "name": "binderDriverInterfaceTest"
     },
     {
-      "name": "binderValueTypeTest"
+      "name": "binderTextOutputTest"
     },
     {
-      "name": "binderTextOutputTest"
+      "name": "binderLibTest"
     }
   ]
 }
diff --git a/libs/binder/Value.cpp b/libs/binder/Value.cpp
deleted file mode 100644
index 19c57ba..0000000
--- a/libs/binder/Value.cpp
+++ /dev/null
@@ -1,420 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "Value"
-
-#include <binder/Value.h>
-
-#include <limits>
-
-#include <binder/IBinder.h>
-#include <binder/Parcel.h>
-#include <binder/Map.h>
-#include <private/binder/ParcelValTypes.h>
-#include <log/log.h>
-#include <utils/Errors.h>
-
-using android::BAD_TYPE;
-using android::BAD_VALUE;
-using android::NO_ERROR;
-using android::UNEXPECTED_NULL;
-using android::Parcel;
-using android::sp;
-using android::status_t;
-using std::map;
-using std::set;
-using std::vector;
-using android::binder::Value;
-using android::IBinder;
-using android::os::PersistableBundle;
-using namespace android::binder;
-
-// ====================================================================
-
-#define RETURN_IF_FAILED(calledOnce)                                     \
-    do {                                                                 \
-        status_t returnStatus = calledOnce;                              \
-        if (returnStatus) {                                              \
-            ALOGE("Failed at %s:%d (%s)", __FILE__, __LINE__, __func__); \
-            return returnStatus;                                         \
-         }                                                               \
-    } while(false)
-
-// ====================================================================
-
-/* These `internal_type_ptr()` functions allow this
- * class to work without C++ RTTI support. This technique
- * only works properly when called directly from this file,
- * but that is OK because that is the only place we will
- * be calling them from. */
-template<class T> const void* internal_type_ptr()
-{
-    static const T *marker;
-    return (void*)&marker;
-}
-
-/* Allows the type to be specified by the argument
- * instead of inside angle brackets. */
-template<class T> const void* internal_type_ptr(const T&)
-{
-    return internal_type_ptr<T>();
-}
-
-// ====================================================================
-
-namespace android {
-
-namespace binder {
-
-class Value::ContentBase {
-public:
-    virtual ~ContentBase() = default;
-    virtual const void* type_ptr() const = 0;
-    virtual ContentBase * clone() const = 0;
-    virtual bool operator==(const ContentBase& rhs) const = 0;
-
-#ifdef LIBBINDER_VALUE_SUPPORTS_TYPE_INFO
-    virtual const std::type_info &type() const = 0;
-#endif
-
-    template<typename T> bool get(T* out) const;
-};
-
-/* This is the actual class that holds the value. */
-template<typename T> class Value::Content : public Value::ContentBase {
-public:
-    Content() = default;
-    explicit Content(const T & value) : mValue(value) { }
-
-    virtual ~Content() = default;
-
-#ifdef LIBBINDER_VALUE_SUPPORTS_TYPE_INFO
-    virtual const std::type_info &type() const override
-    {
-        return typeid(T);
-    }
-#endif
-
-    virtual const void* type_ptr() const override
-    {
-        return internal_type_ptr<T>();
-    }
-
-    virtual ContentBase * clone() const override
-    {
-        return new Content(mValue);
-    };
-
-    virtual bool operator==(const ContentBase& rhs) const override
-    {
-        if (type_ptr() != rhs.type_ptr()) {
-            return false;
-        }
-        return mValue == static_cast<const Content<T>* >(&rhs)->mValue;
-    }
-
-    T mValue;
-};
-
-template<typename T> bool Value::ContentBase::get(T* out) const
-{
-    if (internal_type_ptr(*out) != type_ptr())
-    {
-        return false;
-    }
-
-    *out = static_cast<const Content<T>*>(this)->mValue;
-
-    return true;
-}
-
-// ====================================================================
-
-Value::Value() : mContent(nullptr)
-{
-}
-
-Value::Value(const Value& value)
-    : mContent(value.mContent ? value.mContent->clone() : nullptr)
-{
-}
-
-Value::~Value()
-{
-    delete mContent;
-}
-
-bool Value::operator==(const Value& rhs) const
-{
-    const Value& lhs(*this);
-
-    if (lhs.empty() && rhs.empty()) {
-        return true;
-    }
-
-    if ( (lhs.mContent == nullptr)
-      || (rhs.mContent == nullptr)
-    ) {
-        return false;
-    }
-
-    return *lhs.mContent == *rhs.mContent;
-}
-
-Value& Value::swap(Value &rhs)
-{
-    std::swap(mContent, rhs.mContent);
-    return *this;
-}
-
-Value& Value::operator=(const Value& rhs)
-{
-    if (this != &rhs) {
-        delete mContent;
-        mContent = rhs.mContent
-            ? rhs.mContent->clone()
-            : nullptr;
-    }
-    return *this;
-}
-
-bool Value::empty() const
-{
-    return mContent == nullptr;
-}
-
-void Value::clear()
-{
-    delete mContent;
-    mContent = nullptr;
-}
-
-int32_t Value::parcelType() const
-{
-    const void* t_info(mContent ? mContent->type_ptr() : nullptr);
-
-    if (t_info == internal_type_ptr<bool>()) return VAL_BOOLEAN;
-    if (t_info == internal_type_ptr<uint8_t>()) return VAL_BYTE;
-    if (t_info == internal_type_ptr<int32_t>()) return VAL_INTEGER;
-    if (t_info == internal_type_ptr<int64_t>()) return VAL_LONG;
-    if (t_info == internal_type_ptr<double>()) return VAL_DOUBLE;
-    if (t_info == internal_type_ptr<String16>()) return VAL_STRING;
-
-    if (t_info == internal_type_ptr<vector<bool>>()) return VAL_BOOLEANARRAY;
-    if (t_info == internal_type_ptr<vector<uint8_t>>()) return VAL_BYTEARRAY;
-    if (t_info == internal_type_ptr<vector<int32_t>>()) return VAL_INTARRAY;
-    if (t_info == internal_type_ptr<vector<int64_t>>()) return VAL_LONGARRAY;
-    if (t_info == internal_type_ptr<vector<double>>()) return VAL_DOUBLEARRAY;
-    if (t_info == internal_type_ptr<vector<String16>>()) return VAL_STRINGARRAY;
-
-    if (t_info == internal_type_ptr<Map>()) return VAL_MAP;
-    if (t_info == internal_type_ptr<PersistableBundle>()) return VAL_PERSISTABLEBUNDLE;
-
-    return VAL_NULL;
-}
-
-#ifdef LIBBINDER_VALUE_SUPPORTS_TYPE_INFO
-const std::type_info& Value::type() const
-{
-    return mContent != nullptr
-        ? mContent->type()
-        : typeid(void);
-}
-#endif // ifdef LIBBINDER_VALUE_SUPPORTS_TYPE_INFO
-
-#define DEF_TYPE_ACCESSORS(T, TYPENAME)                      \
-    bool Value::is ## TYPENAME() const                       \
-    {                                                        \
-        return mContent                                      \
-            ? internal_type_ptr<T>() == mContent->type_ptr() \
-            : false;                                         \
-    }                                                        \
-    bool Value::get ## TYPENAME(T* out) const                \
-    {                                                        \
-        return mContent                                      \
-            ? mContent->get(out)                             \
-            : false;                                         \
-    }                                                        \
-    void Value::put ## TYPENAME(const T& in)                 \
-    {                                                        \
-        *this = in;                                          \
-    }                                                        \
-    Value& Value::operator=(const T& rhs)                    \
-    {                                                        \
-        delete mContent;                                     \
-        mContent = new Content< T >(rhs);                    \
-        return *this;                                        \
-    }                                                        \
-    Value::Value(const T& value)                             \
-        : mContent(new Content< T >(value))                  \
-    { }
-
-DEF_TYPE_ACCESSORS(bool, Boolean)
-DEF_TYPE_ACCESSORS(int8_t, Byte)
-DEF_TYPE_ACCESSORS(int32_t, Int)
-DEF_TYPE_ACCESSORS(int64_t, Long)
-DEF_TYPE_ACCESSORS(double, Double)
-DEF_TYPE_ACCESSORS(String16, String)
-
-DEF_TYPE_ACCESSORS(std::vector<bool>, BooleanVector)
-DEF_TYPE_ACCESSORS(std::vector<uint8_t>, ByteVector)
-DEF_TYPE_ACCESSORS(std::vector<int32_t>, IntVector)
-DEF_TYPE_ACCESSORS(std::vector<int64_t>, LongVector)
-DEF_TYPE_ACCESSORS(std::vector<double>, DoubleVector)
-DEF_TYPE_ACCESSORS(std::vector<String16>, StringVector)
-
-DEF_TYPE_ACCESSORS(::android::binder::Map, Map)
-DEF_TYPE_ACCESSORS(PersistableBundle, PersistableBundle)
-
-bool Value::getString(String8* out) const
-{
-    String16 val;
-    bool ret = getString(&val);
-    if (ret) {
-        *out = String8(val);
-    }
-    return ret;
-}
-
-bool Value::getString(::std::string* out) const
-{
-    String8 val;
-    bool ret = getString(&val);
-    if (ret) {
-        *out = val.string();
-    }
-    return ret;
-}
-
-status_t Value::writeToParcel(Parcel* parcel) const
-{
-    // This implementation needs to be kept in sync with the writeValue
-    // implementation in frameworks/base/core/java/android/os/Parcel.java
-
-#define BEGIN_HANDLE_WRITE()                                                                      \
-    do {                                                                                          \
-        const void* t_info(mContent?mContent->type_ptr():nullptr);                                \
-        if (false) { }
-#define HANDLE_WRITE_TYPE(T, TYPEVAL, TYPEMETHOD)                                                 \
-    else if (t_info == internal_type_ptr<T>()) {                                                  \
-        RETURN_IF_FAILED(parcel->writeInt32(TYPEVAL));                                            \
-        RETURN_IF_FAILED(parcel->TYPEMETHOD(static_cast<const Content<T>*>(mContent)->mValue));   \
-    }
-#define HANDLE_WRITE_PARCELABLE(T, TYPEVAL)                                                       \
-    else if (t_info == internal_type_ptr<T>()) {                                                  \
-        RETURN_IF_FAILED(parcel->writeInt32(TYPEVAL));                                            \
-        RETURN_IF_FAILED(static_cast<const Content<T>*>(mContent)->mValue.writeToParcel(parcel)); \
-    }
-#define END_HANDLE_WRITE()                                                                        \
-        else {                                                                                    \
-            ALOGE("writeToParcel: Type not supported");                                           \
-            return BAD_TYPE;                                                                      \
-        }                                                                                         \
-    } while (false);
-
-    BEGIN_HANDLE_WRITE()
-
-    HANDLE_WRITE_TYPE(bool,     VAL_BOOLEAN, writeBool)
-    HANDLE_WRITE_TYPE(int8_t,   VAL_BYTE,    writeByte)
-    HANDLE_WRITE_TYPE(int8_t,   VAL_BYTE,    writeByte)
-    HANDLE_WRITE_TYPE(int32_t,  VAL_INTEGER, writeInt32)
-    HANDLE_WRITE_TYPE(int64_t,  VAL_LONG,    writeInt64)
-    HANDLE_WRITE_TYPE(double,   VAL_DOUBLE,  writeDouble)
-    HANDLE_WRITE_TYPE(String16, VAL_STRING,  writeString16)
-
-    HANDLE_WRITE_TYPE(vector<bool>,     VAL_BOOLEANARRAY, writeBoolVector)
-    HANDLE_WRITE_TYPE(vector<uint8_t>,  VAL_BYTEARRAY,    writeByteVector)
-    HANDLE_WRITE_TYPE(vector<int8_t>,   VAL_BYTEARRAY,    writeByteVector)
-    HANDLE_WRITE_TYPE(vector<int32_t>,  VAL_INTARRAY,     writeInt32Vector)
-    HANDLE_WRITE_TYPE(vector<int64_t>,  VAL_LONGARRAY,    writeInt64Vector)
-    HANDLE_WRITE_TYPE(vector<double>,   VAL_DOUBLEARRAY,  writeDoubleVector)
-    HANDLE_WRITE_TYPE(vector<String16>, VAL_STRINGARRAY,  writeString16Vector)
-
-    HANDLE_WRITE_PARCELABLE(PersistableBundle, VAL_PERSISTABLEBUNDLE)
-
-    END_HANDLE_WRITE()
-
-    return NO_ERROR;
-
-#undef BEGIN_HANDLE_WRITE
-#undef HANDLE_WRITE_TYPE
-#undef HANDLE_WRITE_PARCELABLE
-#undef END_HANDLE_WRITE
-}
-
-status_t Value::readFromParcel(const Parcel* parcel)
-{
-    // This implementation needs to be kept in sync with the readValue
-    // implementation in frameworks/base/core/java/android/os/Parcel.javai
-
-#define BEGIN_HANDLE_READ()                                                                      \
-    switch(value_type) {                                                                         \
-        default:                                                                                 \
-            ALOGE("readFromParcel: Parcel type %d is not supported", value_type);                \
-            return BAD_TYPE;
-#define HANDLE_READ_TYPE(T, TYPEVAL, TYPEMETHOD)                                                 \
-        case TYPEVAL:                                                                            \
-            mContent = new Content<T>();                                                         \
-            RETURN_IF_FAILED(parcel->TYPEMETHOD(&static_cast<Content<T>*>(mContent)->mValue));   \
-            break;
-#define HANDLE_READ_PARCELABLE(T, TYPEVAL)                                                       \
-        case TYPEVAL:                                                                            \
-            mContent = new Content<T>();                                                         \
-            RETURN_IF_FAILED(static_cast<Content<T>*>(mContent)->mValue.readFromParcel(parcel)); \
-            break;
-#define END_HANDLE_READ()                                                                        \
-    }
-
-    int32_t value_type = VAL_NULL;
-
-    delete mContent;
-    mContent = nullptr;
-
-    RETURN_IF_FAILED(parcel->readInt32(&value_type));
-
-    BEGIN_HANDLE_READ()
-
-    HANDLE_READ_TYPE(bool,     VAL_BOOLEAN, readBool)
-    HANDLE_READ_TYPE(int8_t,   VAL_BYTE,    readByte)
-    HANDLE_READ_TYPE(int32_t,  VAL_INTEGER, readInt32)
-    HANDLE_READ_TYPE(int64_t,  VAL_LONG,    readInt64)
-    HANDLE_READ_TYPE(double,   VAL_DOUBLE,  readDouble)
-    HANDLE_READ_TYPE(String16, VAL_STRING,  readString16)
-
-    HANDLE_READ_TYPE(vector<bool>,     VAL_BOOLEANARRAY, readBoolVector)
-    HANDLE_READ_TYPE(vector<uint8_t>,  VAL_BYTEARRAY,    readByteVector)
-    HANDLE_READ_TYPE(vector<int32_t>,  VAL_INTARRAY,     readInt32Vector)
-    HANDLE_READ_TYPE(vector<int64_t>,  VAL_LONGARRAY,    readInt64Vector)
-    HANDLE_READ_TYPE(vector<double>,   VAL_DOUBLEARRAY,  readDoubleVector)
-    HANDLE_READ_TYPE(vector<String16>, VAL_STRINGARRAY,  readString16Vector)
-
-    HANDLE_READ_PARCELABLE(PersistableBundle, VAL_PERSISTABLEBUNDLE)
-
-    END_HANDLE_READ()
-
-    return NO_ERROR;
-
-#undef BEGIN_HANDLE_READ
-#undef HANDLE_READ_TYPE
-#undef HANDLE_READ_PARCELABLE
-#undef END_HANDLE_READ
-}
-
-}  // namespace binder
-
-}  // namespace android
-
-/* vim: set ts=4 sw=4 tw=0 et :*/
diff --git a/libs/binder/include/binder/BpBinder.h b/libs/binder/include/binder/BpBinder.h
index 78f2e1d..b3a1d0b 100644
--- a/libs/binder/include/binder/BpBinder.h
+++ b/libs/binder/include/binder/BpBinder.h
@@ -34,7 +34,7 @@
 public:
     static BpBinder*    create(int32_t handle);
 
-    inline  int32_t     handle() const { return mHandle; }
+    int32_t             handle() const;
 
     virtual const String16&    getInterfaceDescriptor() const;
     virtual bool        isBinderAlive() const;
diff --git a/libs/binder/include/binder/Map.h b/libs/binder/include/binder/Map.h
deleted file mode 100644
index 96a4f8a..0000000
--- a/libs/binder/include/binder/Map.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright (C) 2005 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_MAP_H
-#define ANDROID_MAP_H
-
-#include <map>
-#include <string>
-
-// ---------------------------------------------------------------------------
-namespace android {
-namespace binder {
-
-class Value;
-
-/**
- * Convenience typedef for ::std::map<::std::string,::android::binder::Value>
- */
-typedef ::std::map<::std::string, Value> Map;
-
-} // namespace binder
-} // namespace android
-
-// ---------------------------------------------------------------------------
-
-#endif // ANDROID_MAP_H
diff --git a/libs/binder/include/binder/Parcel.h b/libs/binder/include/binder/Parcel.h
index 0046e3a..b65d456 100644
--- a/libs/binder/include/binder/Parcel.h
+++ b/libs/binder/include/binder/Parcel.h
@@ -17,6 +17,7 @@
 #ifndef ANDROID_PARCEL_H
 #define ANDROID_PARCEL_H
 
+#include <map> // for legacy reasons
 #include <string>
 #include <vector>
 
@@ -32,7 +33,6 @@
 
 #include <binder/IInterface.h>
 #include <binder/Parcelable.h>
-#include <binder/Map.h>
 
 // ---------------------------------------------------------------------------
 namespace android {
@@ -97,10 +97,6 @@
 
     void                freeData();
 
-private:
-    const binder_size_t* objects() const;
-
-public:
     size_t              objectsCount() const;
     
     status_t            errorCheck() const;
@@ -172,8 +168,6 @@
 
     status_t            writeParcelable(const Parcelable& parcelable);
 
-    status_t            writeValue(const binder::Value& value);
-
     template<typename T>
     status_t            write(const Flattenable<T>& val);
 
@@ -185,9 +179,6 @@
     template<typename T>
     status_t            writeVectorSize(const std::unique_ptr<std::vector<T>>& val);
 
-    status_t            writeMap(const binder::Map& map);
-    status_t            writeNullableMap(const std::unique_ptr<binder::Map>& map);
-
     // Place a native_handle into the parcel (the native_handle's file-
     // descriptors are dup'ed, so it is safe to delete the native_handle
     // when this function returns).
@@ -244,8 +235,6 @@
     // Currently the native implementation doesn't do any of the StrictMode
     // stack gathering and serialization that the Java implementation does.
     status_t            writeNoException();
-
-    void                remove(size_t start, size_t amt);
     
     status_t            read(void* outData, size_t len) const;
     const void*         readInplace(size_t len) const;
@@ -297,8 +286,6 @@
     template<typename T>
     status_t            readParcelable(std::unique_ptr<T>* parcelable) const;
 
-    status_t            readValue(binder::Value* value) const;
-
     template<typename T>
     status_t            readStrongBinder(sp<T>* val) const;
 
@@ -344,9 +331,6 @@
     template<typename T>
     status_t            resizeOutVector(std::unique_ptr<std::vector<T>>* val) const;
 
-    status_t            readMap(binder::Map* map)const;
-    status_t            readNullableMap(std::unique_ptr<binder::Map>* map) const;
-
     // Like Parcel.java's readExceptionCode().  Reads the first int32
     // off of a Parcel's header, returning 0 or the negative error
     // code on exceptions, but also deals with skipping over rich
diff --git a/libs/binder/include/binder/ProcessState.h b/libs/binder/include/binder/ProcessState.h
index 1622ba2..3af9eed 100644
--- a/libs/binder/include/binder/ProcessState.h
+++ b/libs/binder/include/binder/ProcessState.h
@@ -36,8 +36,6 @@
 public:
     static  sp<ProcessState>    self();
     static  sp<ProcessState>    selfOrNull();
-    // Note: don't call self() or selfOrNull() before initWithMmapSize()
-    static  sp<ProcessState>    initWithMmapSize(size_t mmapSize); // size in bytes
 
     /* initWithDriver() can be used to configure libbinder to use
      * a different binder driver dev node. It must be called *before*
@@ -47,21 +45,14 @@
      */
     static  sp<ProcessState>    initWithDriver(const char *driver);
 
-            void                setContextObject(const sp<IBinder>& object);
             sp<IBinder>         getContextObject(const sp<IBinder>& caller);
-        
-            void                setContextObject(const sp<IBinder>& object,
-                                                 const String16& name);
-            sp<IBinder>         getContextObject(const String16& name,
-                                                 const sp<IBinder>& caller);
 
             void                startThreadPool();
                         
     typedef bool (*context_check_func)(const String16& name,
                                        const sp<IBinder>& caller,
                                        void* userData);
-        
-            bool                isContextManager(void) const;
+
             bool                becomeContextManager(
                                     context_check_func checkFunc,
                                     void* userData);
@@ -78,7 +69,6 @@
             String8             getDriverName();
 
             ssize_t             getKernelReferences(size_t count, uintptr_t* buf);
-            size_t              getMmapSize();
 
             enum class CallRestriction {
                 // all calls okay
@@ -95,7 +85,7 @@
 private:
     friend class IPCThreadState;
     
-            explicit            ProcessState(const char* driver, size_t mmap_size);
+            explicit            ProcessState(const char* driver);
                                 ~ProcessState();
 
                                 ProcessState(const ProcessState& o);
@@ -124,23 +114,15 @@
             int64_t             mStarvationStartTimeMs;
 
     mutable Mutex               mLock;  // protects everything below.
-            // TODO: mManagesContexts is often accessed without the lock.
-            //       Explain why that's safe.
 
             Vector<handle_entry>mHandleToObject;
 
-            bool                mManagesContexts;
             context_check_func  mBinderContextCheckFunc;
             void*               mBinderContextUserData;
 
-            KeyedVector<String16, sp<IBinder> >
-                                mContexts;
-
-
             String8             mRootDir;
             bool                mThreadPoolStarted;
     volatile int32_t            mThreadPoolSeq;
-            const size_t        mMmapSize;
 
             CallRestriction     mCallRestriction;
 };
diff --git a/libs/binder/include/binder/Value.h b/libs/binder/include/binder/Value.h
deleted file mode 100644
index 735f40e..0000000
--- a/libs/binder/include/binder/Value.h
+++ /dev/null
@@ -1,186 +0,0 @@
-/*
- * Copyright (C) 2015 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_VALUE_H
-#define ANDROID_VALUE_H
-
-#include <stdint.h>
-#include <map>
-#include <set>
-#include <vector>
-#include <string>
-
-#include <binder/Parcelable.h>
-#include <binder/PersistableBundle.h>
-#include <binder/Map.h>
-#include <utils/String8.h>
-#include <utils/String16.h>
-#include <utils/StrongPointer.h>
-
-namespace android {
-
-class Parcel;
-
-namespace binder {
-
-/**
- * A limited C++ generic type. The purpose of this class is to allow C++
- * programs to make use of (or implement) Binder interfaces which make use
- * the Java "Object" generic type (either via the use of the Map type or
- * some other mechanism).
- *
- * This class only supports a limited set of types, but additional types
- * may be easily added to this class in the future as needed---without
- * breaking binary compatability.
- *
- * This class was written in such a way as to help avoid type errors by
- * giving each type their own explicity-named accessor methods (rather than
- * overloaded methods).
- *
- * When reading or writing this class to a Parcel, use the `writeValue()`
- * and `readValue()` methods.
- */
-class Value {
-public:
-    Value();
-    virtual ~Value();
-
-    Value& swap(Value &);
-
-    bool empty() const;
-
-    void clear();
-
-#ifdef LIBBINDER_VALUE_SUPPORTS_TYPE_INFO
-    const std::type_info& type() const;
-#endif
-
-    int32_t parcelType() const;
-
-    bool operator==(const Value& rhs) const;
-    bool operator!=(const Value& rhs) const { return !this->operator==(rhs); }
-
-    Value(const Value& value);
-    Value(const bool& value); // NOLINT(google-explicit-constructor)
-    Value(const int8_t& value); // NOLINT(google-explicit-constructor)
-    Value(const int32_t& value); // NOLINT(google-explicit-constructor)
-    Value(const int64_t& value); // NOLINT(google-explicit-constructor)
-    Value(const double& value); // NOLINT(google-explicit-constructor)
-    Value(const String16& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<bool>& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<uint8_t>& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<int32_t>& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<int64_t>& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<double>& value); // NOLINT(google-explicit-constructor)
-    Value(const std::vector<String16>& value); // NOLINT(google-explicit-constructor)
-    Value(const os::PersistableBundle& value); // NOLINT(google-explicit-constructor)
-    Value(const binder::Map& value); // NOLINT(google-explicit-constructor)
-
-    Value& operator=(const Value& rhs);
-    Value& operator=(const int8_t& rhs);
-    Value& operator=(const bool& rhs);
-    Value& operator=(const int32_t& rhs);
-    Value& operator=(const int64_t& rhs);
-    Value& operator=(const double& rhs);
-    Value& operator=(const String16& rhs);
-    Value& operator=(const std::vector<bool>& rhs);
-    Value& operator=(const std::vector<uint8_t>& rhs);
-    Value& operator=(const std::vector<int32_t>& rhs);
-    Value& operator=(const std::vector<int64_t>& rhs);
-    Value& operator=(const std::vector<double>& rhs);
-    Value& operator=(const std::vector<String16>& rhs);
-    Value& operator=(const os::PersistableBundle& rhs);
-    Value& operator=(const binder::Map& rhs);
-
-    void putBoolean(const bool& value);
-    void putByte(const int8_t& value);
-    void putInt(const int32_t& value);
-    void putLong(const int64_t& value);
-    void putDouble(const double& value);
-    void putString(const String16& value);
-    void putBooleanVector(const std::vector<bool>& value);
-    void putByteVector(const std::vector<uint8_t>& value);
-    void putIntVector(const std::vector<int32_t>& value);
-    void putLongVector(const std::vector<int64_t>& value);
-    void putDoubleVector(const std::vector<double>& value);
-    void putStringVector(const std::vector<String16>& value);
-    void putPersistableBundle(const os::PersistableBundle& value);
-    void putMap(const binder::Map& value);
-
-    bool getBoolean(bool* out) const;
-    bool getByte(int8_t* out) const;
-    bool getInt(int32_t* out) const;
-    bool getLong(int64_t* out) const;
-    bool getDouble(double* out) const;
-    bool getString(String16* out) const;
-    bool getBooleanVector(std::vector<bool>* out) const;
-    bool getByteVector(std::vector<uint8_t>* out) const;
-    bool getIntVector(std::vector<int32_t>* out) const;
-    bool getLongVector(std::vector<int64_t>* out) const;
-    bool getDoubleVector(std::vector<double>* out) const;
-    bool getStringVector(std::vector<String16>* out) const;
-    bool getPersistableBundle(os::PersistableBundle* out) const;
-    bool getMap(binder::Map* out) const;
-
-    bool isBoolean() const;
-    bool isByte() const;
-    bool isInt() const;
-    bool isLong() const;
-    bool isDouble() const;
-    bool isString() const;
-    bool isBooleanVector() const;
-    bool isByteVector() const;
-    bool isIntVector() const;
-    bool isLongVector() const;
-    bool isDoubleVector() const;
-    bool isStringVector() const;
-    bool isPersistableBundle() const;
-    bool isMap() const;
-
-    // String Convenience Adapters
-    // ---------------------------
-
-    explicit Value(const String8& value):               Value(String16(value)) { }
-    explicit Value(const ::std::string& value):         Value(String8(value.c_str())) { }
-    void putString(const String8& value)       { return putString(String16(value)); }
-    void putString(const ::std::string& value) { return putString(String8(value.c_str())); }
-    Value& operator=(const String8& rhs)       { return *this = String16(rhs); }
-    Value& operator=(const ::std::string& rhs) { return *this = String8(rhs.c_str()); }
-    bool getString(String8* out) const;
-    bool getString(::std::string* out) const;
-
-private:
-
-    // This allows ::android::Parcel to call the two methods below.
-    friend class ::android::Parcel;
-
-    // This is called by ::android::Parcel::writeValue()
-    status_t writeToParcel(Parcel* parcel) const;
-
-    // This is called by ::android::Parcel::readValue()
-    status_t readFromParcel(const Parcel* parcel);
-
-    template<typename T> class Content;
-    class ContentBase;
-
-    ContentBase* mContent;
-};
-
-}  // namespace binder
-
-}  // namespace android
-
-#endif  // ANDROID_VALUE_H
diff --git a/libs/binder/tests/Android.bp b/libs/binder/tests/Android.bp
index 14ca821..edbe05e 100644
--- a/libs/binder/tests/Android.bp
+++ b/libs/binder/tests/Android.bp
@@ -46,17 +46,6 @@
 }
 
 cc_test {
-    name: "binderValueTypeTest",
-    defaults: ["binder_test_defaults"],
-    srcs: ["binderValueTypeTest.cpp"],
-    shared_libs: [
-        "libbinder",
-        "libutils",
-    ],
-    test_suites: ["device-tests"],
-}
-
-cc_test {
     name: "binderLibTest_IPC_32",
     defaults: ["binder_test_defaults"],
     srcs: ["binderLibTest.cpp"],
@@ -82,6 +71,7 @@
         "libbinder",
         "libutils",
     ],
+    test_suites: ["device-tests"],
 }
 
 cc_test {
@@ -147,4 +137,5 @@
         "liblog",
         "libutils",
     ],
+    test_suites: ["device-tests"],
 }
diff --git a/libs/binder/tests/binderDriverInterfaceTest.cpp b/libs/binder/tests/binderDriverInterfaceTest.cpp
index 6508bb1..77ebac8 100644
--- a/libs/binder/tests/binderDriverInterfaceTest.cpp
+++ b/libs/binder/tests/binderDriverInterfaceTest.cpp
@@ -286,13 +286,7 @@
         EXPECT_EQ(0u, br.arg2.cookie);
         EXPECT_EQ(0u, br.arg2.code);
         EXPECT_EQ(0u, br.arg2.flags);
-
-        // ping returns a 4 byte header in libbinder, but the original
-        // C implementation of servicemanager returns a 0 byte header
-        if (br.arg2.data_size != 0 && br.arg2.data_size != 4) {
-            ADD_FAILURE() << br.arg2.data_size << " is expected to be 0 or 4";
-        }
-
+        EXPECT_EQ(0u, br.arg2.data_size);
         EXPECT_EQ(0u, br.arg2.offsets_size);
 
         SCOPED_TRACE("3rd WriteRead");
diff --git a/libs/binder/tests/binderLibTest.cpp b/libs/binder/tests/binderLibTest.cpp
index 78f1159..0a07186 100644
--- a/libs/binder/tests/binderLibTest.cpp
+++ b/libs/binder/tests/binderLibTest.cpp
@@ -553,50 +553,6 @@
     ASSERT_TRUE(server != nullptr);
 }
 
-TEST_F(BinderLibTest, DeathNotificationNoRefs)
-{
-    status_t ret;
-
-    sp<TestDeathRecipient> testDeathRecipient = new TestDeathRecipient();
-
-    {
-        sp<IBinder> binder = addServer();
-        ASSERT_TRUE(binder != nullptr);
-        ret = binder->linkToDeath(testDeathRecipient);
-        EXPECT_EQ(NO_ERROR, ret);
-    }
-    IPCThreadState::self()->flushCommands();
-    ret = testDeathRecipient->waitEvent(5);
-    EXPECT_EQ(NO_ERROR, ret);
-#if 0 /* Is there an unlink api that does not require a strong reference? */
-    ret = binder->unlinkToDeath(testDeathRecipient);
-    EXPECT_EQ(NO_ERROR, ret);
-#endif
-}
-
-TEST_F(BinderLibTest, DeathNotificationWeakRef)
-{
-    status_t ret;
-    wp<IBinder> wbinder;
-
-    sp<TestDeathRecipient> testDeathRecipient = new TestDeathRecipient();
-
-    {
-        sp<IBinder> binder = addServer();
-        ASSERT_TRUE(binder != nullptr);
-        ret = binder->linkToDeath(testDeathRecipient);
-        EXPECT_EQ(NO_ERROR, ret);
-        wbinder = binder;
-    }
-    IPCThreadState::self()->flushCommands();
-    ret = testDeathRecipient->waitEvent(5);
-    EXPECT_EQ(NO_ERROR, ret);
-#if 0 /* Is there an unlink api that does not require a strong reference? */
-    ret = binder->unlinkToDeath(testDeathRecipient);
-    EXPECT_EQ(NO_ERROR, ret);
-#endif
-}
-
 TEST_F(BinderLibTest, DeathNotificationStrongRef)
 {
     status_t ret;
@@ -1015,9 +971,6 @@
 
 TEST_F(BinderLibTest, PropagateFlagSet)
 {
-    status_t ret;
-    Parcel data, reply;
-
     IPCThreadState::self()->clearPropagateWorkSource();
     IPCThreadState::self()->setCallingWorkSourceUid(100);
     EXPECT_EQ(true, IPCThreadState::self()->shouldPropagateWorkSource());
@@ -1025,9 +978,6 @@
 
 TEST_F(BinderLibTest, PropagateFlagCleared)
 {
-    status_t ret;
-    Parcel data, reply;
-
     IPCThreadState::self()->setCallingWorkSourceUid(100);
     IPCThreadState::self()->clearPropagateWorkSource();
     EXPECT_EQ(false, IPCThreadState::self()->shouldPropagateWorkSource());
@@ -1035,9 +985,6 @@
 
 TEST_F(BinderLibTest, PropagateFlagRestored)
 {
-    status_t ret;
-    Parcel data, reply;
-
     int token = IPCThreadState::self()->setCallingWorkSourceUid(100);
     IPCThreadState::self()->restoreCallingWorkSource(token);
 
diff --git a/libs/binder/tests/binderValueTypeTest.cpp b/libs/binder/tests/binderValueTypeTest.cpp
deleted file mode 100644
index f8922b0..0000000
--- a/libs/binder/tests/binderValueTypeTest.cpp
+++ /dev/null
@@ -1,110 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <limits>
-#include <cstddef>
-#include <vector>
-
-#include "android-base/file.h"
-#include <gtest/gtest.h>
-
-#include <binder/Parcel.h>
-#include <binder/Value.h>
-#include <binder/Debug.h>
-
-using ::android::binder::Value;
-using ::android::os::PersistableBundle;
-using ::android::String16;
-using ::std::vector;
-
-#define VALUE_TYPE_TEST(T, TYPENAME, VAL)         \
-    TEST(ValueType, Handles ## TYPENAME) {        \
-        T x = VAL;                                \
-        T y = T();                                \
-        Value value = VAL;                        \
-        ASSERT_FALSE(value.empty());              \
-        ASSERT_TRUE(value.is ## TYPENAME ());     \
-        ASSERT_TRUE(value.get ## TYPENAME (&y));  \
-        ASSERT_EQ(x, y);                          \
-        ASSERT_EQ(value, Value(y));               \
-        value.put ## TYPENAME (x);                \
-        ASSERT_EQ(value, Value(y));               \
-        value = Value();                          \
-        ASSERT_TRUE(value.empty());               \
-        ASSERT_NE(value, Value(y));               \
-        value = y;                                \
-        ASSERT_EQ(value, Value(x));               \
-    }
-
-#define VALUE_TYPE_VECTOR_TEST(T, TYPENAME, VAL)      \
-    TEST(ValueType, Handles ## TYPENAME ## Vector) {  \
-        vector<T> x;                                  \
-        vector<T> y;                                  \
-        x.push_back(VAL);                             \
-        x.push_back(T());                             \
-        Value value(x);                               \
-        ASSERT_FALSE(value.empty());                  \
-        ASSERT_TRUE(value.is ## TYPENAME ## Vector());    \
-        ASSERT_TRUE(value.get ## TYPENAME ## Vector(&y)); \
-        ASSERT_EQ(x, y);                              \
-        ASSERT_EQ(value, Value(y));                   \
-        value.put ## TYPENAME ## Vector(x);           \
-        ASSERT_EQ(value, Value(y));                   \
-        value = Value();                              \
-        ASSERT_TRUE(value.empty());                   \
-        ASSERT_NE(value, Value(y));                   \
-        value = y;                                    \
-        ASSERT_EQ(value, Value(x));                   \
-    }
-
-VALUE_TYPE_TEST(bool, Boolean, true)
-VALUE_TYPE_TEST(int32_t, Int, 31337)
-VALUE_TYPE_TEST(int64_t, Long, 13370133701337L)
-VALUE_TYPE_TEST(double, Double, 3.14159265358979323846)
-VALUE_TYPE_TEST(String16, String, String16("Lovely"))
-
-VALUE_TYPE_VECTOR_TEST(bool, Boolean, true)
-VALUE_TYPE_VECTOR_TEST(int32_t, Int, 31337)
-VALUE_TYPE_VECTOR_TEST(int64_t, Long, 13370133701337L)
-VALUE_TYPE_VECTOR_TEST(double, Double, 3.14159265358979323846)
-VALUE_TYPE_VECTOR_TEST(String16, String, String16("Lovely"))
-
-VALUE_TYPE_TEST(PersistableBundle, PersistableBundle, PersistableBundle())
-
-TEST(ValueType, HandlesClear) {
-    Value value;
-    ASSERT_TRUE(value.empty());
-    value.putInt(31337);
-    ASSERT_FALSE(value.empty());
-    value.clear();
-    ASSERT_TRUE(value.empty());
-}
-
-TEST(ValueType, HandlesSwap) {
-    Value value_a, value_b;
-    int32_t int_x;
-    value_a.putInt(31337);
-    ASSERT_FALSE(value_a.empty());
-    ASSERT_TRUE(value_b.empty());
-    value_a.swap(value_b);
-    ASSERT_FALSE(value_b.empty());
-    ASSERT_TRUE(value_a.empty());
-    ASSERT_TRUE(value_b.getInt(&int_x));
-    ASSERT_EQ(31337, int_x);
-}
diff --git a/libs/dumputils/Android.bp b/libs/dumputils/Android.bp
index 3412e14..e23de8e 100644
--- a/libs/dumputils/Android.bp
+++ b/libs/dumputils/Android.bp
@@ -17,7 +17,6 @@
 
     shared_libs: [
         "libbase",
-        "libbinder",
         "libhidlbase",
         "libhidltransport",
         "liblog",
diff --git a/libs/gui/LayerState.cpp b/libs/gui/LayerState.cpp
index 6066421..aa07cbe 100644
--- a/libs/gui/LayerState.cpp
+++ b/libs/gui/LayerState.cpp
@@ -267,8 +267,9 @@
     }
     if (other.what & eFlagsChanged) {
         what |= eFlagsChanged;
-        flags = other.flags;
-        mask = other.mask;
+        flags &= ~other.mask;
+        flags |= (other.flags & other.mask);
+        mask |= other.mask;
     }
     if (other.what & eLayerStackChanged) {
         what |= eLayerStackChanged;
diff --git a/services/surfaceflinger/Scheduler/Scheduler.cpp b/services/surfaceflinger/Scheduler/Scheduler.cpp
index 27f42d2..7acb470 100644
--- a/services/surfaceflinger/Scheduler/Scheduler.cpp
+++ b/services/surfaceflinger/Scheduler/Scheduler.cpp
@@ -76,6 +76,7 @@
     mSupportKernelTimer = support_kernel_idle_timer(false);
 
     mSetTouchTimerMs = set_touch_timer_ms(0);
+    mSetDisplayPowerTimerMs = set_display_power_timer_ms(0);
 
     char value[PROPERTY_VALUE_MAX];
     property_get("debug.sf.set_idle_timer_ms", value, "0");
@@ -105,10 +106,19 @@
                 [this] { expiredTouchTimerCallback(); });
         mTouchTimer->start();
     }
+
+    if (mSetDisplayPowerTimerMs > 0) {
+        mDisplayPowerTimer = std::make_unique<scheduler::OneShotTimer>(
+                std::chrono::milliseconds(mSetDisplayPowerTimerMs),
+                [this] { resetDisplayPowerTimerCallback(); },
+                [this] { expiredDisplayPowerTimerCallback(); });
+        mDisplayPowerTimer->start();
+    }
 }
 
 Scheduler::~Scheduler() {
     // Ensure the OneShotTimer threads are joined before we start destroying state.
+    mDisplayPowerTimer.reset();
     mTouchTimer.reset();
     mIdleTimer.reset();
 }
@@ -375,11 +385,17 @@
 }
 
 void Scheduler::setChangeRefreshRateCallback(
-        const ChangeRefreshRateCallback& changeRefreshRateCallback) {
+        const ChangeRefreshRateCallback&& changeRefreshRateCallback) {
     std::lock_guard<std::mutex> lock(mCallbackLock);
     mChangeRefreshRateCallback = changeRefreshRateCallback;
 }
 
+void Scheduler::setGetCurrentRefreshRateTypeCallback(
+        const GetCurrentRefreshRateTypeCallback&& getCurrentRefreshRateTypeCallback) {
+    std::lock_guard<std::mutex> lock(mCallbackLock);
+    mGetCurrentRefreshRateTypeCallback = getCurrentRefreshRateTypeCallback;
+}
+
 void Scheduler::setGetVsyncPeriodCallback(const GetVsyncPeriod&& getVsyncPeriod) {
     std::lock_guard<std::mutex> lock(mCallbackLock);
     mGetVsyncPeriod = getVsyncPeriod;
@@ -414,41 +430,75 @@
     mLayerHistory.clearHistory();
 }
 
+void Scheduler::setDisplayPowerState(bool normal) {
+    {
+        std::lock_guard<std::mutex> lock(mFeatureStateLock);
+        mIsDisplayPowerStateNormal = normal;
+    }
+
+    if (mDisplayPowerTimer) {
+        mDisplayPowerTimer->reset();
+    }
+
+    // Display Power event will boost the refresh rate to performance.
+    // Clear Layer History to get fresh FPS detection
+    mLayerHistory.clearHistory();
+}
+
 void Scheduler::resetTimerCallback() {
-    timerChangeRefreshRate(IdleTimerState::RESET);
+    handleTimerStateChanged(&mCurrentIdleTimerState, IdleTimerState::RESET, false);
     ATRACE_INT("ExpiredIdleTimer", 0);
 }
 
 void Scheduler::resetKernelTimerCallback() {
     ATRACE_INT("ExpiredKernelIdleTimer", 0);
     std::lock_guard<std::mutex> lock(mCallbackLock);
-    if (mGetVsyncPeriod) {
-        resyncToHardwareVsync(true, mGetVsyncPeriod());
+    if (mGetVsyncPeriod && mGetCurrentRefreshRateTypeCallback) {
+        // If we're not in performance mode then the kernel timer shouldn't do
+        // anything, as the refresh rate during DPU power collapse will be the
+        // same.
+        if (mGetCurrentRefreshRateTypeCallback() == Scheduler::RefreshRateType::PERFORMANCE) {
+            resyncToHardwareVsync(true, mGetVsyncPeriod());
+        }
     }
 }
 
 void Scheduler::expiredTimerCallback() {
-    timerChangeRefreshRate(IdleTimerState::EXPIRED);
+    handleTimerStateChanged(&mCurrentIdleTimerState, IdleTimerState::EXPIRED, false);
     ATRACE_INT("ExpiredIdleTimer", 1);
 }
 
 void Scheduler::resetTouchTimerCallback() {
-    // We do not notify the applications about config changes when idle timer is reset.
-    touchChangeRefreshRate(TouchState::ACTIVE);
+    handleTimerStateChanged(&mCurrentTouchState, TouchState::ACTIVE, true);
     ATRACE_INT("TouchState", 1);
 }
 
 void Scheduler::expiredTouchTimerCallback() {
-    // We do not notify the applications about config changes when idle timer expires.
-    touchChangeRefreshRate(TouchState::INACTIVE);
+    handleTimerStateChanged(&mCurrentTouchState, TouchState::INACTIVE, true);
     ATRACE_INT("TouchState", 0);
 }
 
+void Scheduler::resetDisplayPowerTimerCallback() {
+    handleTimerStateChanged(&mDisplayPowerTimerState, DisplayPowerTimerState::RESET, true);
+    ATRACE_INT("ExpiredDisplayPowerTimer", 0);
+}
+
+void Scheduler::expiredDisplayPowerTimerCallback() {
+    handleTimerStateChanged(&mDisplayPowerTimerState, DisplayPowerTimerState::EXPIRED, true);
+    ATRACE_INT("ExpiredDisplayPowerTimer", 1);
+}
+
 void Scheduler::expiredKernelTimerCallback() {
+    std::lock_guard<std::mutex> lock(mCallbackLock);
     ATRACE_INT("ExpiredKernelIdleTimer", 1);
-    // Disable HW Vsync if the timer expired, as we don't need it
-    // enabled if we're not pushing frames.
-    disableHardwareVsync(false);
+    if (mGetCurrentRefreshRateTypeCallback) {
+        if (mGetCurrentRefreshRateTypeCallback() != Scheduler::RefreshRateType::PERFORMANCE) {
+            // Disable HW Vsync if the timer expired, as we don't need it
+            // enabled if we're not pushing frames, and if we're in PERFORMANCE
+            // mode then we'll need to re-update the DispSync model anyways.
+            disableHardwareVsync(false);
+        }
+    }
 }
 
 std::string Scheduler::doDump() {
@@ -458,39 +508,23 @@
     return stream.str();
 }
 
-void Scheduler::timerChangeRefreshRate(IdleTimerState idleTimerState) {
-    RefreshRateType newRefreshRateType;
-    {
-        std::lock_guard<std::mutex> lock(mFeatureStateLock);
-        if (mCurrentIdleTimerState == idleTimerState) {
-            return;
-        }
-        mCurrentIdleTimerState = idleTimerState;
-        newRefreshRateType = calculateRefreshRateType();
-        if (mRefreshRateType == newRefreshRateType) {
-            return;
-        }
-        mRefreshRateType = newRefreshRateType;
-    }
-    changeRefreshRate(newRefreshRateType, ConfigEvent::None);
-}
-
-void Scheduler::touchChangeRefreshRate(TouchState touchState) {
+template <class T>
+void Scheduler::handleTimerStateChanged(T* currentState, T newState, bool eventOnContentDetection) {
     ConfigEvent event = ConfigEvent::None;
     RefreshRateType newRefreshRateType;
     {
         std::lock_guard<std::mutex> lock(mFeatureStateLock);
-        if (mCurrentTouchState == touchState) {
+        if (*currentState == newState) {
             return;
         }
-        mCurrentTouchState = touchState;
+        *currentState = newState;
         newRefreshRateType = calculateRefreshRateType();
         if (mRefreshRateType == newRefreshRateType) {
             return;
         }
         mRefreshRateType = newRefreshRateType;
-        // Send an event in case that content detection is on as touch has a higher priority
-        if (mCurrentContentFeatureState == ContentFeatureState::CONTENT_DETECTION_ON) {
+        if (eventOnContentDetection &&
+            mCurrentContentFeatureState == ContentFeatureState::CONTENT_DETECTION_ON) {
             event = ConfigEvent::Changed;
         }
     }
@@ -503,6 +537,12 @@
         return RefreshRateType::DEFAULT;
     }
 
+    // If Display Power is not in normal operation we want to be in performance mode.
+    // When coming back to normal mode, a grace period is given with DisplayPowerTimer
+    if (!mIsDisplayPowerStateNormal || mDisplayPowerTimerState == DisplayPowerTimerState::RESET) {
+        return RefreshRateType::PERFORMANCE;
+    }
+
     // As long as touch is active we want to be in performance mode
     if (mCurrentTouchState == TouchState::ACTIVE) {
         return RefreshRateType::PERFORMANCE;
diff --git a/services/surfaceflinger/Scheduler/Scheduler.h b/services/surfaceflinger/Scheduler/Scheduler.h
index a307760..123036e 100644
--- a/services/surfaceflinger/Scheduler/Scheduler.h
+++ b/services/surfaceflinger/Scheduler/Scheduler.h
@@ -49,6 +49,7 @@
     }
 
     using RefreshRateType = scheduler::RefreshRateConfigs::RefreshRateType;
+    using GetCurrentRefreshRateTypeCallback = std::function<RefreshRateType()>;
     using ChangeRefreshRateCallback = std::function<void(RefreshRateType, ConfigEvent)>;
     using GetVsyncPeriod = std::function<nsecs_t()>;
 
@@ -165,7 +166,9 @@
     // Updates FPS based on the most content presented.
     void updateFpsBasedOnContent();
     // Callback that gets invoked when Scheduler wants to change the refresh rate.
-    void setChangeRefreshRateCallback(const ChangeRefreshRateCallback& changeRefreshRateCallback);
+    void setChangeRefreshRateCallback(const ChangeRefreshRateCallback&& changeRefreshRateCallback);
+    void setGetCurrentRefreshRateTypeCallback(
+            const GetCurrentRefreshRateTypeCallback&& getCurrentRefreshRateType);
     void setGetVsyncPeriodCallback(const GetVsyncPeriod&& getVsyncPeriod);
 
     // Returns whether idle timer is enabled or not
@@ -177,6 +180,9 @@
     // Function that resets the touch timer.
     void notifyTouchEvent();
 
+    // Function that sets whether display power mode is normal or not.
+    void setDisplayPowerState(bool normal);
+
     // Returns relevant information about Scheduler for dumpsys purposes.
     std::string doDump();
 
@@ -197,6 +203,7 @@
     enum class ContentFeatureState { CONTENT_DETECTION_ON, CONTENT_DETECTION_OFF };
     enum class IdleTimerState { EXPIRED, RESET };
     enum class TouchState { INACTIVE, ACTIVE };
+    enum class DisplayPowerTimerState { EXPIRED, RESET };
 
     // Creates a connection on the given EventThread and forwards the given callbacks.
     sp<EventThreadConnection> createConnectionInternal(EventThread*, ResyncCallback&&,
@@ -221,12 +228,15 @@
     void resetTouchTimerCallback();
     // Function that is called when the touch timer expires.
     void expiredTouchTimerCallback();
+    // Function that is called when the display power timer resets.
+    void resetDisplayPowerTimerCallback();
+    // Function that is called when the display power timer expires.
+    void expiredDisplayPowerTimerCallback();
     // Sets vsync period.
     void setVsyncPeriod(const nsecs_t period);
-    // Idle timer feature's function to change the refresh rate.
-    void timerChangeRefreshRate(IdleTimerState idleTimerState);
-    // Touch timer feature's function to change the refresh rate.
-    void touchChangeRefreshRate(TouchState touchState);
+    // handles various timer features to change the refresh rate.
+    template <class T>
+    void handleTimerStateChanged(T* currentState, T newState, bool eventOnContentDetection);
     // Calculate the new refresh rate type
     RefreshRateType calculateRefreshRateType() REQUIRES(mFeatureStateLock);
     // Acquires a lock and calls the ChangeRefreshRateCallback() with given parameters.
@@ -282,7 +292,12 @@
     int64_t mSetTouchTimerMs = 0;
     std::unique_ptr<scheduler::OneShotTimer> mTouchTimer;
 
+    // Timer used to monitor display power mode.
+    int64_t mSetDisplayPowerTimerMs = 0;
+    std::unique_ptr<scheduler::OneShotTimer> mDisplayPowerTimer;
+
     std::mutex mCallbackLock;
+    GetCurrentRefreshRateTypeCallback mGetCurrentRefreshRateTypeCallback GUARDED_BY(mCallbackLock);
     ChangeRefreshRateCallback mChangeRefreshRateCallback GUARDED_BY(mCallbackLock);
     GetVsyncPeriod mGetVsyncPeriod GUARDED_BY(mCallbackLock);
 
@@ -293,9 +308,12 @@
             ContentFeatureState::CONTENT_DETECTION_OFF;
     IdleTimerState mCurrentIdleTimerState GUARDED_BY(mFeatureStateLock) = IdleTimerState::RESET;
     TouchState mCurrentTouchState GUARDED_BY(mFeatureStateLock) = TouchState::INACTIVE;
+    DisplayPowerTimerState mDisplayPowerTimerState GUARDED_BY(mFeatureStateLock) =
+            DisplayPowerTimerState::EXPIRED;
     uint32_t mContentRefreshRate GUARDED_BY(mFeatureStateLock);
     RefreshRateType mRefreshRateType GUARDED_BY(mFeatureStateLock);
     bool mIsHDRContent GUARDED_BY(mFeatureStateLock) = false;
+    bool mIsDisplayPowerStateNormal GUARDED_BY(mFeatureStateLock) = true;
 
     const scheduler::RefreshRateConfigs& mRefreshRateConfigs;
 
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index fbe409f..5b82556 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -713,6 +713,24 @@
                 Mutex::Autolock lock(mStateLock);
                 setRefreshRateTo(type, event);
             });
+    mScheduler->setGetCurrentRefreshRateTypeCallback([this] {
+        Mutex::Autolock lock(mStateLock);
+        const auto display = getDefaultDisplayDeviceLocked();
+        if (!display) {
+            // If we don't have a default display the fallback to the default
+            // refresh rate type
+            return RefreshRateType::DEFAULT;
+        }
+
+        const int configId = display->getActiveConfig();
+        for (const auto& [type, refresh] : mRefreshRateConfigs.getRefreshRates()) {
+            if (refresh && refresh->configId == configId) {
+                return type;
+            }
+        }
+        // This should never happen, but just gracefully fallback to default.
+        return RefreshRateType::DEFAULT;
+    });
     mScheduler->setGetVsyncPeriodCallback([this] {
         Mutex::Autolock lock(mStateLock);
         return getVsyncPeriod();
@@ -1045,6 +1063,7 @@
         desiredActiveConfigChangeDone();
         return false;
     }
+
     mUpcomingActiveConfig = desiredActiveConfig;
     const auto displayId = display->getId();
     LOG_ALWAYS_FATAL_IF(!displayId);
@@ -4542,6 +4561,7 @@
     if (display->isPrimary()) {
         mTimeStats->setPowerMode(mode);
         mRefreshRateStats.setPowerMode(mode);
+        mScheduler->setDisplayPowerState(mode == HWC_POWER_MODE_NORMAL);
     }
 
     ALOGD("Finished setting power mode %d on display %s", mode, to_string(*displayId).c_str());
@@ -5423,7 +5443,12 @@
                 return NO_ERROR;
             }
             case 1023: { // Set native mode
+                int32_t colorMode;
+
                 mDisplayColorSetting = static_cast<DisplayColorSetting>(data.readInt32());
+                if (data.readInt32(&colorMode) == NO_ERROR) {
+                    mForceColorMode = static_cast<ColorMode>(colorMode);
+                }
                 invalidateHwcGeometry();
                 repaintEverything();
                 return NO_ERROR;
diff --git a/services/surfaceflinger/SurfaceFlingerProperties.cpp b/services/surfaceflinger/SurfaceFlingerProperties.cpp
index 237208d..768074a 100644
--- a/services/surfaceflinger/SurfaceFlingerProperties.cpp
+++ b/services/surfaceflinger/SurfaceFlingerProperties.cpp
@@ -242,6 +242,14 @@
     return defaultValue;
 }
 
+int32_t set_display_power_timer_ms(int32_t defaultValue) {
+    auto temp = SurfaceFlingerProperties::set_display_power_timer_ms();
+    if (temp.has_value()) {
+        return *temp;
+    }
+    return defaultValue;
+}
+
 bool use_smart_90_for_video(bool defaultValue) {
     auto temp = SurfaceFlingerProperties::use_smart_90_for_video();
     if (temp.has_value()) {
diff --git a/services/surfaceflinger/SurfaceFlingerProperties.h b/services/surfaceflinger/SurfaceFlingerProperties.h
index b5418d6..5f88322 100644
--- a/services/surfaceflinger/SurfaceFlingerProperties.h
+++ b/services/surfaceflinger/SurfaceFlingerProperties.h
@@ -77,6 +77,8 @@
 
 int32_t set_touch_timer_ms(int32_t defaultValue);
 
+int32_t set_display_power_timer_ms(int32_t defaultValue);
+
 bool use_smart_90_for_video(bool defaultValue);
 
 bool enable_protected_contents(bool defaultValue);
diff --git a/services/surfaceflinger/sysprop/SurfaceFlingerProperties.sysprop b/services/surfaceflinger/sysprop/SurfaceFlingerProperties.sysprop
index 565df9a..56ab4e3 100644
--- a/services/surfaceflinger/sysprop/SurfaceFlingerProperties.sysprop
+++ b/services/surfaceflinger/sysprop/SurfaceFlingerProperties.sysprop
@@ -323,6 +323,18 @@
     prop_name: "ro.surface_flinger.set_touch_timer_ms"
 }
 
+# setDisplayPowerTimerMs indicates what is considered a timeout in milliseconds for Scheduler.
+# This value is used by the Scheduler to trigger display power inactivity callbacks that will
+# keep the display in peak refresh rate as long as display power is not in normal mode.
+# Setting this property to 0 means there is no timer.
+prop {
+    api_name: "set_display_power_timer_ms"
+    type: Integer
+    scope: System
+    access: Readonly
+    prop_name: "ro.surface_flinger.set_display_power_timer_ms"
+}
+
 # useSmart90ForVideo indicates whether Scheduler should detect content FPS, and try to adjust the
 # screen refresh rate based on that.
 prop {
diff --git a/services/surfaceflinger/sysprop/api/system-current.txt b/services/surfaceflinger/sysprop/api/system-current.txt
index 89323c2..79854b3 100644
--- a/services/surfaceflinger/sysprop/api/system-current.txt
+++ b/services/surfaceflinger/sysprop/api/system-current.txt
@@ -18,6 +18,7 @@
     method public static java.util.Optional<java.lang.Long> present_time_offset_from_vsync_ns();
     method public static java.util.Optional<android.sysprop.SurfaceFlingerProperties.primary_display_orientation_values> primary_display_orientation();
     method public static java.util.Optional<java.lang.Boolean> running_without_sync_framework();
+    method public static java.util.Optional<java.lang.Integer> set_display_power_timer_ms();
     method public static java.util.Optional<java.lang.Integer> set_idle_timer_ms();
     method public static java.util.Optional<java.lang.Integer> set_touch_timer_ms();
     method public static java.util.Optional<java.lang.Boolean> start_graphics_allocator_service();
diff --git a/services/surfaceflinger/tests/Transaction_test.cpp b/services/surfaceflinger/tests/Transaction_test.cpp
index d5f6534..aed7b40 100644
--- a/services/surfaceflinger/tests/Transaction_test.cpp
+++ b/services/surfaceflinger/tests/Transaction_test.cpp
@@ -4427,6 +4427,30 @@
     }
 }
 
+TEST_F(LayerUpdateTest, MergingTransactionFlags) {
+    Transaction().hide(mFGSurfaceControl).apply();
+    std::unique_ptr<ScreenCapture> sc;
+    {
+        SCOPED_TRACE("before merge");
+        ScreenCapture::captureScreen(&sc);
+        sc->expectBGColor(0, 12);
+        sc->expectBGColor(75, 75);
+        sc->expectBGColor(145, 145);
+    }
+
+    Transaction t1, t2;
+    t1.show(mFGSurfaceControl);
+    t2.setFlags(mFGSurfaceControl, 0 /* flags */, layer_state_t::eLayerSecure /* mask */);
+    t1.merge(std::move(t2));
+    t1.apply();
+
+    {
+        SCOPED_TRACE("after merge");
+        ScreenCapture::captureScreen(&sc);
+        sc->expectFGColor(75, 75);
+    }
+}
+
 class ChildLayerTest : public LayerUpdateTest {
 protected:
     void SetUp() override {
diff --git a/vulkan/include/vulkan/vk_android_native_buffer.h b/vulkan/include/vulkan/vk_android_native_buffer.h
index 23006fa..9ffe83b 100644
--- a/vulkan/include/vulkan/vk_android_native_buffer.h
+++ b/vulkan/include/vulkan/vk_android_native_buffer.h
@@ -62,6 +62,11 @@
 typedef VkFlags VkSwapchainImageUsageFlagsANDROID;
 
 typedef struct {
+    uint64_t consumer;
+    uint64_t producer;
+} VkNativeBufferUsage2ANDROID;
+
+typedef struct {
     VkStructureType             sType; // must be VK_STRUCTURE_TYPE_NATIVE_BUFFER_ANDROID
     const void*                 pNext;
 
@@ -73,10 +78,7 @@
     int                         format;
     int                         usage; // DEPRECATED in SPEC_VERSION 6
     // -- Added in SPEC_VERSION 6 --
-    struct {
-        uint64_t                consumer;
-        uint64_t                producer;
-    } usage2;
+    VkNativeBufferUsage2ANDROID usage2;
 } VkNativeBufferANDROID;
 
 typedef struct {