diff --git a/graphics/composer/2.1/default/Android.bp b/graphics/composer/2.1/default/Android.bp
index 22f4906..0d63c3c 100644
--- a/graphics/composer/2.1/default/Android.bp
+++ b/graphics/composer/2.1/default/Android.bp
@@ -1,17 +1,19 @@
 cc_library_shared {
     name: "android.hardware.graphics.composer@2.1-impl",
     relative_install_path: "hw",
-    srcs: ["Hwc.cpp"],
+    srcs: ["Hwc.cpp", "HwcClient.cpp"],
     shared_libs: [
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.composer@2.1",
         "libbase",
         "libcutils",
+        "libfmq",
         "libhardware",
         "libhidlbase",
         "libhidltransport",
         "libhwbinder",
         "liblog",
+        "libsync",
         "libutils",
     ],
 }
@@ -19,7 +21,7 @@
 cc_binary {
     name: "android.hardware.graphics.composer@2.1-service",
     relative_install_path: "hw",
-    srcs: ["service.cpp", "Hwc.cpp"],
+    srcs: ["service.cpp", "Hwc.cpp", "HwcClient.cpp"],
     cppflags: ["-DBINDERIZED"],
     init_rc: ["android.hardware.graphics.composer@2.1-service.rc"],
 
@@ -29,11 +31,19 @@
         "libbase",
         "libbinder",
         "libcutils",
+        "libfmq",
         "libhardware",
         "libhidlbase",
         "libhidltransport",
         "libhwbinder",
         "liblog",
+        "libsync",
         "libutils",
     ],
 }
+
+cc_library_static {
+    name: "libhwcomposer-command-buffer",
+    shared_libs: ["android.hardware.graphics.composer@2.1"],
+    export_include_dirs: ["."],
+}
diff --git a/graphics/composer/2.1/default/Hwc.cpp b/graphics/composer/2.1/default/Hwc.cpp
index 36c6e54..d14de6f 100644
--- a/graphics/composer/2.1/default/Hwc.cpp
+++ b/graphics/composer/2.1/default/Hwc.cpp
@@ -16,19 +16,12 @@
 
 #define LOG_TAG "HwcPassthrough"
 
-#include <mutex>
 #include <type_traits>
-#include <unordered_map>
-#include <unordered_set>
-#include <utility>
-#include <vector>
 
-#include <hardware/gralloc.h>
-#include <hardware/gralloc1.h>
-#include <hardware/hwcomposer2.h>
 #include <log/log.h>
 
 #include "Hwc.h"
+#include "HwcClient.h"
 
 namespace android {
 namespace hardware {
@@ -37,419 +30,9 @@
 namespace V2_1 {
 namespace implementation {
 
-using android::hardware::graphics::common::V1_0::PixelFormat;
-using android::hardware::graphics::common::V1_0::Transform;
-using android::hardware::graphics::common::V1_0::Dataspace;
-using android::hardware::graphics::common::V1_0::ColorMode;
-using android::hardware::graphics::common::V1_0::ColorTransform;
-using android::hardware::graphics::common::V1_0::Hdr;
-
-namespace {
-
-class HandleImporter {
-public:
-    HandleImporter() : mInitialized(false) {}
-
-    bool initialize()
-    {
-        // allow only one client
-        if (mInitialized) {
-            return false;
-        }
-
-        if (!openGralloc()) {
-            return false;
-        }
-
-        mInitialized = true;
-        return true;
-    }
-
-    void cleanup()
-    {
-        if (!mInitialized) {
-            return;
-        }
-
-        closeGralloc();
-        mInitialized = false;
-    }
-
-    // In IComposer, any buffer_handle_t is owned by the caller and we need to
-    // make a clone for hwcomposer2.  We also need to translate empty handle
-    // to nullptr.  This function does that, in-place.
-    bool importBuffer(buffer_handle_t& handle)
-    {
-        if (!handle->numFds && !handle->numInts) {
-            handle = nullptr;
-            return true;
-        }
-
-        buffer_handle_t clone = cloneBuffer(handle);
-        if (!clone) {
-            return false;
-        }
-
-        handle = clone;
-        return true;
-    }
-
-    void freeBuffer(buffer_handle_t handle)
-    {
-        if (!handle) {
-            return;
-        }
-
-        releaseBuffer(handle);
-    }
-
-    bool importFence(const native_handle_t* handle, int& fd)
-    {
-        if (handle->numFds == 0) {
-            fd = -1;
-        } else if (handle->numFds == 1) {
-            fd = dup(handle->data[0]);
-            if (fd < 0) {
-                ALOGE("failed to dup fence fd %d", handle->data[0]);
-                return false;
-            }
-        } else {
-            ALOGE("invalid fence handle with %d file descriptors",
-                    handle->numFds);
-            return false;
-        }
-
-        return true;
-    }
-
-    void closeFence(int fd)
-    {
-        if (fd >= 0) {
-            close(fd);
-        }
-    }
-
-private:
-    bool mInitialized;
-
-    // Some existing gralloc drivers do not support retaining more than once,
-    // when we are in passthrough mode.
-#ifdef BINDERIZED
-    bool openGralloc()
-    {
-        const hw_module_t* module;
-        int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
-        if (err) {
-            ALOGE("failed to get gralloc module");
-            return false;
-        }
-
-        uint8_t major = (module->module_api_version >> 8) & 0xff;
-        if (major > 1) {
-            ALOGE("unknown gralloc module major version %d", major);
-            return false;
-        }
-
-        if (major == 1) {
-            err = gralloc1_open(module, &mDevice);
-            if (err) {
-                ALOGE("failed to open gralloc1 device");
-                return false;
-            }
-
-            mRetain = reinterpret_cast<GRALLOC1_PFN_RETAIN>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RETAIN));
-            mRelease = reinterpret_cast<GRALLOC1_PFN_RELEASE>(
-                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RELEASE));
-            if (!mRetain || !mRelease) {
-                ALOGE("invalid gralloc1 device");
-                gralloc1_close(mDevice);
-                return false;
-            }
-        } else {
-            mModule = reinterpret_cast<const gralloc_module_t*>(module);
-        }
-
-        return true;
-    }
-
-    void closeGralloc()
-    {
-        if (mDevice) {
-            gralloc1_close(mDevice);
-        }
-    }
-
-    buffer_handle_t cloneBuffer(buffer_handle_t handle)
-    {
-        native_handle_t* clone = native_handle_clone(handle);
-        if (!clone) {
-            ALOGE("failed to clone buffer %p", handle);
-            return nullptr;
-        }
-
-        bool err;
-        if (mDevice) {
-            err = (mRetain(mDevice, clone) != GRALLOC1_ERROR_NONE);
-        } else {
-            err = (mModule->registerBuffer(mModule, clone) != 0);
-        }
-
-        if (err) {
-            ALOGE("failed to retain/register buffer %p", clone);
-            native_handle_close(clone);
-            native_handle_delete(clone);
-            return nullptr;
-        }
-
-        return clone;
-    }
-
-    void releaseBuffer(buffer_handle_t handle)
-    {
-        if (mDevice) {
-            mRelease(mDevice, handle);
-        } else {
-            mModule->unregisterBuffer(mModule, handle);
-            native_handle_close(handle);
-            native_handle_delete(const_cast<native_handle_t*>(handle));
-        }
-    }
-
-    // gralloc1
-    gralloc1_device_t* mDevice;
-    GRALLOC1_PFN_RETAIN mRetain;
-    GRALLOC1_PFN_RELEASE mRelease;
-
-    // gralloc0
-    const gralloc_module_t* mModule;
-#else
-    bool openGralloc() { return true; }
-    void closeGralloc() {}
-    buffer_handle_t cloneBuffer(buffer_handle_t handle) { return handle; }
-    void releaseBuffer(buffer_handle_t) {}
-#endif
-};
-
-HandleImporter sHandleImporter;
-
-class BufferClone {
-public:
-    BufferClone() : mHandle(nullptr) {}
-
-    BufferClone(BufferClone&& other)
-    {
-        mHandle = other.mHandle;
-        other.mHandle = nullptr;
-    }
-
-    BufferClone(const BufferClone& other) = delete;
-    BufferClone& operator=(const BufferClone& other) = delete;
-
-    BufferClone& operator=(buffer_handle_t handle)
-    {
-        clear();
-        mHandle = handle;
-        return *this;
-    }
-
-    ~BufferClone()
-    {
-        clear();
-    }
-
-private:
-    void clear()
-    {
-        if (mHandle) {
-            sHandleImporter.freeBuffer(mHandle);
-        }
-    }
-
-    buffer_handle_t mHandle;
-};
-
-} // anonymous namespace
-
-class HwcHal : public IComposer {
-public:
-    HwcHal(const hw_module_t* module);
-    virtual ~HwcHal();
-
-    // IComposer interface
-    Return<void> getCapabilities(getCapabilities_cb hidl_cb) override;
-    Return<void> dumpDebugInfo(dumpDebugInfo_cb hidl_cb) override;
-    Return<void> registerCallback(const sp<IComposerCallback>& callback) override;
-    Return<uint32_t> getMaxVirtualDisplayCount() override;
-    Return<void> createVirtualDisplay(uint32_t width, uint32_t height,
-            PixelFormat formatHint, createVirtualDisplay_cb hidl_cb) override;
-    Return<Error> destroyVirtualDisplay(Display display) override;
-    Return<Error> acceptDisplayChanges(Display display) override;
-    Return<void> createLayer(Display display,
-            createLayer_cb hidl_cb) override;
-    Return<Error> destroyLayer(Display display, Layer layer) override;
-    Return<void> getActiveConfig(Display display,
-            getActiveConfig_cb hidl_cb) override;
-    Return<void> getChangedCompositionTypes(Display display,
-            getChangedCompositionTypes_cb hidl_cb) override;
-    Return<Error> getClientTargetSupport(Display display,
-            uint32_t width, uint32_t height,
-            PixelFormat format, Dataspace dataspace) override;
-    Return<void> getColorModes(Display display,
-            getColorModes_cb hidl_cb) override;
-    Return<void> getDisplayAttribute(Display display,
-            Config config, Attribute attribute,
-            getDisplayAttribute_cb hidl_cb) override;
-    Return<void> getDisplayConfigs(Display display,
-            getDisplayConfigs_cb hidl_cb) override;
-    Return<void> getDisplayName(Display display,
-            getDisplayName_cb hidl_cb) override;
-    Return<void> getDisplayRequests(Display display,
-            getDisplayRequests_cb hidl_cb) override;
-    Return<void> getDisplayType(Display display,
-            getDisplayType_cb hidl_cb) override;
-    Return<void> getDozeSupport(Display display,
-            getDozeSupport_cb hidl_cb) override;
-    Return<void> getHdrCapabilities(Display display,
-            getHdrCapabilities_cb hidl_cb) override;
-    Return<void> getReleaseFences(Display display,
-            getReleaseFences_cb hidl_cb) override;
-    Return<void> presentDisplay(Display display,
-            presentDisplay_cb hidl_cb) override;
-    Return<Error> setActiveConfig(Display display, Config config) override;
-    Return<Error> setClientTarget(Display display,
-            const hidl_handle& target,
-            const hidl_handle& acquireFence,
-            Dataspace dataspace, const hidl_vec<Rect>& damage) override;
-    Return<Error> setColorMode(Display display, ColorMode mode) override;
-    Return<Error> setColorTransform(Display display,
-            const hidl_vec<float>& matrix, ColorTransform hint) override;
-    Return<Error> setOutputBuffer(Display display,
-            const hidl_handle& buffer,
-            const hidl_handle& releaseFence) override;
-    Return<Error> setPowerMode(Display display, PowerMode mode) override;
-    Return<Error> setVsyncEnabled(Display display, Vsync enabled) override;
-    Return<void> validateDisplay(Display display,
-            validateDisplay_cb hidl_cb) override;
-    Return<Error> setCursorPosition(Display display,
-            Layer layer, int32_t x, int32_t y) override;
-    Return<Error> setLayerBuffer(Display display,
-            Layer layer, const hidl_handle& buffer,
-            const hidl_handle& acquireFence) override;
-    Return<Error> setLayerSurfaceDamage(Display display,
-            Layer layer, const hidl_vec<Rect>& damage) override;
-    Return<Error> setLayerBlendMode(Display display,
-            Layer layer, BlendMode mode) override;
-    Return<Error> setLayerColor(Display display,
-            Layer layer, const Color& color) override;
-    Return<Error> setLayerCompositionType(Display display,
-            Layer layer, Composition type) override;
-    Return<Error> setLayerDataspace(Display display,
-            Layer layer, Dataspace dataspace) override;
-    Return<Error> setLayerDisplayFrame(Display display,
-            Layer layer, const Rect& frame) override;
-    Return<Error> setLayerPlaneAlpha(Display display,
-            Layer layer, float alpha) override;
-    Return<Error> setLayerSidebandStream(Display display,
-            Layer layer, const hidl_handle& stream) override;
-    Return<Error> setLayerSourceCrop(Display display,
-            Layer layer, const FRect& crop) override;
-    Return<Error> setLayerTransform(Display display,
-            Layer layer, Transform transform) override;
-    Return<Error> setLayerVisibleRegion(Display display,
-            Layer layer, const hidl_vec<Rect>& visible) override;
-    Return<Error> setLayerZOrder(Display display,
-            Layer layer, uint32_t z) override;
-
-private:
-    void initCapabilities();
-
-    template<typename T>
-    void initDispatch(T& func, hwc2_function_descriptor_t desc);
-    void initDispatch();
-
-    bool hasCapability(Capability capability) const;
-
-    static void hotplugHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display, int32_t connected);
-    static void refreshHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display);
-    static void vsyncHook(hwc2_callback_data_t callbackData,
-        hwc2_display_t display, int64_t timestamp);
-
-    hwc2_device_t* mDevice;
-
-    std::unordered_set<Capability> mCapabilities;
-
-    struct {
-        HWC2_PFN_ACCEPT_DISPLAY_CHANGES acceptDisplayChanges;
-        HWC2_PFN_CREATE_LAYER createLayer;
-        HWC2_PFN_CREATE_VIRTUAL_DISPLAY createVirtualDisplay;
-        HWC2_PFN_DESTROY_LAYER destroyLayer;
-        HWC2_PFN_DESTROY_VIRTUAL_DISPLAY destroyVirtualDisplay;
-        HWC2_PFN_DUMP dump;
-        HWC2_PFN_GET_ACTIVE_CONFIG getActiveConfig;
-        HWC2_PFN_GET_CHANGED_COMPOSITION_TYPES getChangedCompositionTypes;
-        HWC2_PFN_GET_CLIENT_TARGET_SUPPORT getClientTargetSupport;
-        HWC2_PFN_GET_COLOR_MODES getColorModes;
-        HWC2_PFN_GET_DISPLAY_ATTRIBUTE getDisplayAttribute;
-        HWC2_PFN_GET_DISPLAY_CONFIGS getDisplayConfigs;
-        HWC2_PFN_GET_DISPLAY_NAME getDisplayName;
-        HWC2_PFN_GET_DISPLAY_REQUESTS getDisplayRequests;
-        HWC2_PFN_GET_DISPLAY_TYPE getDisplayType;
-        HWC2_PFN_GET_DOZE_SUPPORT getDozeSupport;
-        HWC2_PFN_GET_HDR_CAPABILITIES getHdrCapabilities;
-        HWC2_PFN_GET_MAX_VIRTUAL_DISPLAY_COUNT getMaxVirtualDisplayCount;
-        HWC2_PFN_GET_RELEASE_FENCES getReleaseFences;
-        HWC2_PFN_PRESENT_DISPLAY presentDisplay;
-        HWC2_PFN_REGISTER_CALLBACK registerCallback;
-        HWC2_PFN_SET_ACTIVE_CONFIG setActiveConfig;
-        HWC2_PFN_SET_CLIENT_TARGET setClientTarget;
-        HWC2_PFN_SET_COLOR_MODE setColorMode;
-        HWC2_PFN_SET_COLOR_TRANSFORM setColorTransform;
-        HWC2_PFN_SET_CURSOR_POSITION setCursorPosition;
-        HWC2_PFN_SET_LAYER_BLEND_MODE setLayerBlendMode;
-        HWC2_PFN_SET_LAYER_BUFFER setLayerBuffer;
-        HWC2_PFN_SET_LAYER_COLOR setLayerColor;
-        HWC2_PFN_SET_LAYER_COMPOSITION_TYPE setLayerCompositionType;
-        HWC2_PFN_SET_LAYER_DATASPACE setLayerDataspace;
-        HWC2_PFN_SET_LAYER_DISPLAY_FRAME setLayerDisplayFrame;
-        HWC2_PFN_SET_LAYER_PLANE_ALPHA setLayerPlaneAlpha;
-        HWC2_PFN_SET_LAYER_SIDEBAND_STREAM setLayerSidebandStream;
-        HWC2_PFN_SET_LAYER_SOURCE_CROP setLayerSourceCrop;
-        HWC2_PFN_SET_LAYER_SURFACE_DAMAGE setLayerSurfaceDamage;
-        HWC2_PFN_SET_LAYER_TRANSFORM setLayerTransform;
-        HWC2_PFN_SET_LAYER_VISIBLE_REGION setLayerVisibleRegion;
-        HWC2_PFN_SET_LAYER_Z_ORDER setLayerZOrder;
-        HWC2_PFN_SET_OUTPUT_BUFFER setOutputBuffer;
-        HWC2_PFN_SET_POWER_MODE setPowerMode;
-        HWC2_PFN_SET_VSYNC_ENABLED setVsyncEnabled;
-        HWC2_PFN_VALIDATE_DISPLAY validateDisplay;
-    } mDispatch;
-
-    // cloned buffers for a display
-    struct DisplayBuffers {
-        BufferClone ClientTarget;
-        BufferClone OutputBuffer;
-
-        std::unordered_map<Layer, BufferClone> LayerBuffers;
-        std::unordered_map<Layer, BufferClone> LayerSidebandStreams;
-    };
-
-    std::mutex mCallbackMutex;
-    sp<IComposerCallback> mCallback;
-
-    std::mutex mDisplayMutex;
-    std::unordered_map<Display, DisplayBuffers> mDisplays;
-};
-
 HwcHal::HwcHal(const hw_module_t* module)
     : mDevice(nullptr), mDispatch()
 {
-    if (!sHandleImporter.initialize()) {
-        LOG_ALWAYS_FATAL("failed to initialize handle importer");
-    }
-
     int status = hwc2_open(module, &mDevice);
     if (status) {
         LOG_ALWAYS_FATAL("failed to open hwcomposer2 device: %s",
@@ -463,8 +46,6 @@
 HwcHal::~HwcHal()
 {
     hwc2_close(mDevice);
-    mDisplays.clear();
-    sHandleImporter.cleanup();
 }
 
 void HwcHal::initCapabilities()
@@ -599,694 +180,509 @@
     return Void();
 }
 
+Return<void> HwcHal::createClient(createClient_cb hidl_cb)
+{
+    Error err = Error::NONE;
+    sp<HwcClient> client;
+
+    {
+        std::lock_guard<std::mutex> lock(mClientMutex);
+
+        // only one client is allowed
+        if (mClient == nullptr) {
+            client = new HwcClient(*this);
+            mClient = client;
+        } else {
+            err = Error::NO_RESOURCES;
+        }
+    }
+
+    hidl_cb(err, client);
+
+    return Void();
+}
+
+sp<HwcClient> HwcHal::getClient()
+{
+    std::lock_guard<std::mutex> lock(mClientMutex);
+    return (mClient != nullptr) ? mClient.promote() : nullptr;
+}
+
+void HwcHal::removeClient()
+{
+    std::lock_guard<std::mutex> lock(mClientMutex);
+    mClient = nullptr;
+}
+
 void HwcHal::hotplugHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display, int32_t connected)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-
-    {
-        std::lock_guard<std::mutex> lock(hal->mDisplayMutex);
-
-        if (connected == HWC2_CONNECTION_CONNECTED) {
-            hal->mDisplays.emplace(display, DisplayBuffers());
-        } else if (connected == HWC2_CONNECTION_DISCONNECTED) {
-            hal->mDisplays.erase(display);
-        }
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onHotplug(display,
+                static_cast<IComposerCallback::Connection>(connected));
     }
-
-    hal->mCallback->onHotplug(display,
-            static_cast<IComposerCallback::Connection>(connected));
 }
 
 void HwcHal::refreshHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-    hal->mCallback->onRefresh(display);
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onRefresh(display);
+    }
 }
 
 void HwcHal::vsyncHook(hwc2_callback_data_t callbackData,
         hwc2_display_t display, int64_t timestamp)
 {
     auto hal = reinterpret_cast<HwcHal*>(callbackData);
-    hal->mCallback->onVsync(display, timestamp);
+    auto client = hal->getClient();
+    if (client != nullptr) {
+        client->onVsync(display, timestamp);
+    }
 }
 
-Return<void> HwcHal::registerCallback(const sp<IComposerCallback>& callback)
+void HwcHal::enableCallback(bool enable)
 {
-    std::lock_guard<std::mutex> lock(mCallbackMutex);
-
-    mCallback = callback;
-
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
-            reinterpret_cast<hwc2_function_pointer_t>(hotplugHook));
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
-            reinterpret_cast<hwc2_function_pointer_t>(refreshHook));
-    mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
-            reinterpret_cast<hwc2_function_pointer_t>(vsyncHook));
-
-    return Void();
+    if (enable) {
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
+                reinterpret_cast<hwc2_function_pointer_t>(hotplugHook));
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
+                reinterpret_cast<hwc2_function_pointer_t>(refreshHook));
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
+                reinterpret_cast<hwc2_function_pointer_t>(vsyncHook));
+    } else {
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_HOTPLUG, this,
+                nullptr);
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_REFRESH, this,
+                nullptr);
+        mDispatch.registerCallback(mDevice, HWC2_CALLBACK_VSYNC, this,
+                nullptr);
+    }
 }
 
-Return<uint32_t> HwcHal::getMaxVirtualDisplayCount()
+uint32_t HwcHal::getMaxVirtualDisplayCount()
 {
     return mDispatch.getMaxVirtualDisplayCount(mDevice);
 }
 
-Return<void> HwcHal::createVirtualDisplay(uint32_t width, uint32_t height,
-        PixelFormat formatHint, createVirtualDisplay_cb hidl_cb)
+Error HwcHal::createVirtualDisplay(uint32_t width, uint32_t height,
+    PixelFormat& format, Display& display)
 {
-    int32_t format = static_cast<int32_t>(formatHint);
-    hwc2_display_t display;
-    auto error = mDispatch.createVirtualDisplay(mDevice, width, height,
-            &format, &display);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
+    int32_t hwc_format = static_cast<int32_t>(format);
+    int32_t err = mDispatch.createVirtualDisplay(mDevice, width, height,
+            &hwc_format, &display);
+    format = static_cast<PixelFormat>(hwc_format);
 
-        mDisplays.emplace(display, DisplayBuffers());
-    }
-
-    hidl_cb(static_cast<Error>(error), display,
-            static_cast<PixelFormat>(format));
-
-    return Void();
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::destroyVirtualDisplay(Display display)
+Error HwcHal::destroyVirtualDisplay(Display display)
 {
-    auto error = mDispatch.destroyVirtualDisplay(mDevice, display);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        mDisplays.erase(display);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.destroyVirtualDisplay(mDevice, display);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::acceptDisplayChanges(Display display)
+Error HwcHal::createLayer(Display display, Layer& layer)
 {
-    auto error = mDispatch.acceptDisplayChanges(mDevice, display);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.createLayer(mDevice, display, &layer);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::createLayer(Display display, createLayer_cb hidl_cb)
+Error HwcHal::destroyLayer(Display display, Layer layer)
 {
-    hwc2_layer_t layer;
-    auto error = mDispatch.createLayer(mDevice, display, &layer);
-
-    hidl_cb(static_cast<Error>(error), layer);
-
-    return Void();
+    int32_t err = mDispatch.destroyLayer(mDevice, display, layer);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::destroyLayer(Display display, Layer layer)
+Error HwcHal::getActiveConfig(Display display, Config& config)
 {
-    auto error = mDispatch.destroyLayer(mDevice, display, layer);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerBuffers.erase(layer);
-        dpy->second.LayerSidebandStreams.erase(layer);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.getActiveConfig(mDevice, display, &config);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getActiveConfig(Display display,
-        getActiveConfig_cb hidl_cb)
-{
-    hwc2_config_t config;
-    auto error = mDispatch.getActiveConfig(mDevice, display, &config);
-
-    hidl_cb(static_cast<Error>(error), config);
-
-    return Void();
-}
-
-Return<void> HwcHal::getChangedCompositionTypes(Display display,
-        getChangedCompositionTypes_cb hidl_cb)
-{
-    uint32_t count = 0;
-    auto error = mDispatch.getChangedCompositionTypes(mDevice, display,
-            &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<Composition> types(count);
-    error = mDispatch.getChangedCompositionTypes(mDevice, display,
-            &count, layers.data(),
-            reinterpret_cast<std::underlying_type<Composition>::type*>(
-                types.data()));
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    types.resize(count);
-
-    hidl_vec<Layer> layers_reply;
-    layers_reply.setToExternal(layers.data(), layers.size());
-
-    hidl_vec<Composition> types_reply;
-    types_reply.setToExternal(types.data(), types.size());
-
-    hidl_cb(static_cast<Error>(error), layers_reply, types_reply);
-
-    return Void();
-}
-
-Return<Error> HwcHal::getClientTargetSupport(Display display,
+Error HwcHal::getClientTargetSupport(Display display,
         uint32_t width, uint32_t height,
         PixelFormat format, Dataspace dataspace)
 {
-    auto error = mDispatch.getClientTargetSupport(mDevice, display,
+    int32_t err = mDispatch.getClientTargetSupport(mDevice, display,
             width, height, static_cast<int32_t>(format),
             static_cast<int32_t>(dataspace));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getColorModes(Display display, getColorModes_cb hidl_cb)
+Error HwcHal::getColorModes(Display display, hidl_vec<ColorMode>& modes)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getColorModes(mDevice, display, &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getColorModes(mDevice, display, &count, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<ColorMode> modes(count);
-    error = mDispatch.getColorModes(mDevice, display, &count,
+    modes.resize(count);
+    err = mDispatch.getColorModes(mDevice, display, &count,
             reinterpret_cast<std::underlying_type<ColorMode>::type*>(
                 modes.data()));
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    if (err != HWC2_ERROR_NONE) {
+        modes = hidl_vec<ColorMode>();
+        return static_cast<Error>(err);
     }
-    modes.resize(count);
 
-    hidl_vec<ColorMode> modes_reply;
-    modes_reply.setToExternal(modes.data(), modes.size());
-    hidl_cb(static_cast<Error>(error), modes_reply);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayAttribute(Display display,
-        Config config, Attribute attribute,
-        getDisplayAttribute_cb hidl_cb)
+Error HwcHal::getDisplayAttribute(Display display, Config config,
+        IComposerClient::Attribute attribute, int32_t& value)
 {
-    int32_t value;
-    auto error = mDispatch.getDisplayAttribute(mDevice, display, config,
+    int32_t err = mDispatch.getDisplayAttribute(mDevice, display, config,
             static_cast<int32_t>(attribute), &value);
-
-    hidl_cb(static_cast<Error>(error), value);
-
-    return Void();
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::getDisplayConfigs(Display display,
-        getDisplayConfigs_cb hidl_cb)
+Error HwcHal::getDisplayConfigs(Display display, hidl_vec<Config>& configs)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayConfigs(mDevice, display,
+    int32_t err = mDispatch.getDisplayConfigs(mDevice, display,
             &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<hwc2_config_t> configs(count);
-    error = mDispatch.getDisplayConfigs(mDevice, display,
-            &count, configs.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
     configs.resize(count);
+    err = mDispatch.getDisplayConfigs(mDevice, display,
+            &count, configs.data());
+    if (err != HWC2_ERROR_NONE) {
+        configs = hidl_vec<Config>();
+        return static_cast<Error>(err);
+    }
 
-    hidl_vec<Config> configs_reply;
-    configs_reply.setToExternal(configs.data(), configs.size());
-    hidl_cb(static_cast<Error>(error), configs_reply);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayName(Display display,
-        getDisplayName_cb hidl_cb)
+Error HwcHal::getDisplayName(Display display, hidl_string& name)
 {
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayName(mDevice, display, &count, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getDisplayName(mDevice, display, &count, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<char> name(count + 1);
-    error = mDispatch.getDisplayName(mDevice, display, &count, name.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    std::vector<char> buf(count + 1);
+    err = mDispatch.getDisplayName(mDevice, display, &count, buf.data());
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
-    name.resize(count + 1);
-    name[count] = '\0';
+    buf.resize(count + 1);
+    buf[count] = '\0';
 
-    hidl_string name_reply;
-    name_reply.setToExternal(name.data(), count);
-    hidl_cb(static_cast<Error>(error), name_reply);
+    name = buf.data();
 
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getDisplayRequests(Display display,
-        getDisplayRequests_cb hidl_cb)
+Error HwcHal::getDisplayType(Display display, IComposerClient::DisplayType& type)
 {
-    int32_t display_reqs;
+    int32_t hwc_type = HWC2_DISPLAY_TYPE_INVALID;
+    int32_t err = mDispatch.getDisplayType(mDevice, display, &hwc_type);
+    type = static_cast<IComposerClient::DisplayType>(hwc_type);
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::getDozeSupport(Display display, bool& support)
+{
+    int32_t hwc_support = 0;
+    int32_t err = mDispatch.getDozeSupport(mDevice, display, &hwc_support);
+    support = hwc_support;
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
+        float& maxLuminance, float& maxAverageLuminance, float& minLuminance)
+{
     uint32_t count = 0;
-    auto error = mDispatch.getDisplayRequests(mDevice, display,
-            &display_reqs, &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
+    int32_t err = mDispatch.getHdrCapabilities(mDevice, display, &count,
+            nullptr, &maxLuminance, &maxAverageLuminance, &minLuminance);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<int32_t> layer_reqs(count);
-    error = mDispatch.getDisplayRequests(mDevice, display,
-            &display_reqs, &count, layers.data(), layer_reqs.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    layer_reqs.resize(count);
-
-    hidl_vec<Layer> layers_reply;
-    layers_reply.setToExternal(layers.data(), layers.size());
-
-    hidl_vec<uint32_t> layer_reqs_reply;
-    layer_reqs_reply.setToExternal(
-            reinterpret_cast<uint32_t*>(layer_reqs.data()),
-            layer_reqs.size());
-
-    hidl_cb(static_cast<Error>(error), display_reqs,
-            layers_reply, layer_reqs_reply);
-
-    return Void();
-}
-
-Return<void> HwcHal::getDisplayType(Display display,
-        getDisplayType_cb hidl_cb)
-{
-    int32_t type;
-    auto error = mDispatch.getDisplayType(mDevice, display, &type);
-
-    hidl_cb(static_cast<Error>(error), static_cast<DisplayType>(type));
-
-    return Void();
-}
-
-Return<void> HwcHal::getDozeSupport(Display display,
-        getDozeSupport_cb hidl_cb)
-{
-    int32_t support;
-    auto error = mDispatch.getDozeSupport(mDevice, display, &support);
-
-    hidl_cb(static_cast<Error>(error), support);
-
-    return Void();
-}
-
-Return<void> HwcHal::getHdrCapabilities(Display display,
-        getHdrCapabilities_cb hidl_cb)
-{
-    float max_lumi, max_avg_lumi, min_lumi;
-    uint32_t count = 0;
-    auto error = mDispatch.getHdrCapabilities(mDevice, display,
-            &count, nullptr, &max_lumi, &max_avg_lumi, &min_lumi);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<Hdr> types(count);
-    error = mDispatch.getHdrCapabilities(mDevice, display, &count,
-            reinterpret_cast<std::underlying_type<Hdr>::type*>(types.data()),
-            &max_lumi, &max_avg_lumi, &min_lumi);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
     types.resize(count);
+    err = mDispatch.getHdrCapabilities(mDevice, display, &count,
+            reinterpret_cast<std::underlying_type<Hdr>::type*>(types.data()),
+            &maxLuminance, &maxAverageLuminance, &minLuminance);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
+    }
 
-    hidl_vec<Hdr> types_reply;
-    types_reply.setToExternal(types.data(), types.size());
-    hidl_cb(static_cast<Error>(error), types_reply,
-            max_lumi, max_avg_lumi, min_lumi);
-
-    return Void();
+    return Error::NONE;
 }
 
-Return<void> HwcHal::getReleaseFences(Display display,
-        getReleaseFences_cb hidl_cb)
+Error HwcHal::setActiveConfig(Display display, Config config)
 {
-    uint32_t count = 0;
-    auto error = mDispatch.getReleaseFences(mDevice, display,
-            &count, nullptr, nullptr);
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-
-    std::vector<hwc2_layer_t> layers(count);
-    std::vector<int32_t> fences(count);
-    error = mDispatch.getReleaseFences(mDevice, display,
-            &count, layers.data(), fences.data());
-    if (error != HWC2_ERROR_NONE) {
-        count = 0;
-    }
-    layers.resize(count);
-    fences.resize(count);
-
-    // filter out layers with release fence -1
-    std::vector<hwc2_layer_t> filtered_layers;
-    std::vector<int> filtered_fences;
-    for (size_t i = 0; i < layers.size(); i++) {
-        if (fences[i] >= 0) {
-            filtered_layers.push_back(layers[i]);
-            filtered_fences.push_back(fences[i]);
-        }
-    }
-
-    hidl_vec<Layer> layers_reply;
-    native_handle_t* fences_reply =
-        native_handle_create(filtered_fences.size(), 0);
-    if (fences_reply) {
-        layers_reply.setToExternal(filtered_layers.data(),
-                filtered_layers.size());
-        memcpy(fences_reply->data, filtered_fences.data(),
-                sizeof(int) * filtered_fences.size());
-
-        hidl_cb(static_cast<Error>(error), layers_reply, fences_reply);
-
-        native_handle_close(fences_reply);
-        native_handle_delete(fences_reply);
-    } else {
-        NATIVE_HANDLE_DECLARE_STORAGE(fences_storage, 0, 0);
-        fences_reply = native_handle_init(fences_storage, 0, 0);
-
-        hidl_cb(Error::NO_RESOURCES, layers_reply, fences_reply);
-
-        for (auto fence : filtered_fences) {
-            close(fence);
-        }
-    }
-
-    return Void();
+    int32_t err = mDispatch.setActiveConfig(mDevice, display, config);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::presentDisplay(Display display,
-        presentDisplay_cb hidl_cb)
+Error HwcHal::setColorMode(Display display, ColorMode mode)
 {
-    int32_t fence = -1;
-    auto error = mDispatch.presentDisplay(mDevice, display, &fence);
-
-    NATIVE_HANDLE_DECLARE_STORAGE(fence_storage, 1, 0);
-    native_handle_t* fence_reply;
-    if (fence >= 0) {
-        fence_reply = native_handle_init(fence_storage, 1, 0);
-        fence_reply->data[0] = fence;
-    } else {
-        fence_reply = native_handle_init(fence_storage, 0, 0);
-    }
-
-    hidl_cb(static_cast<Error>(error), fence_reply);
-
-    if (fence >= 0) {
-        close(fence);
-    }
-
-    return Void();
-}
-
-Return<Error> HwcHal::setActiveConfig(Display display, Config config)
-{
-    auto error = mDispatch.setActiveConfig(mDevice, display, config);
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setClientTarget(Display display,
-        const hidl_handle& target,
-        const hidl_handle& acquireFence,
-        Dataspace dataspace, const hidl_vec<Rect>& damage)
-{
-    const native_handle_t* targetHandle = target.getNativeHandle();
-    if (!sHandleImporter.importBuffer(targetHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t fence;
-    if (!sHandleImporter.importFence(acquireFence, fence)) {
-        sHandleImporter.freeBuffer(targetHandle);
-        return Error::NO_RESOURCES;
-    }
-
-    hwc_region_t damage_region = { damage.size(),
-        reinterpret_cast<const hwc_rect_t*>(&damage[0]) };
-
-    int32_t error = mDispatch.setClientTarget(mDevice, display,
-            targetHandle, fence, static_cast<int32_t>(dataspace),
-            damage_region);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.ClientTarget = targetHandle;
-    } else {
-        sHandleImporter.freeBuffer(target);
-        sHandleImporter.closeFence(fence);
-    }
-
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setColorMode(Display display, ColorMode mode)
-{
-    auto error = mDispatch.setColorMode(mDevice, display,
+    int32_t err = mDispatch.setColorMode(mDevice, display,
             static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setColorTransform(Display display,
-        const hidl_vec<float>& matrix, ColorTransform hint)
+Error HwcHal::setPowerMode(Display display, IComposerClient::PowerMode mode)
 {
-    auto error = mDispatch.setColorTransform(mDevice, display,
-            &matrix[0], static_cast<int32_t>(hint));
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setOutputBuffer(Display display,
-        const hidl_handle& buffer,
-        const hidl_handle& releaseFence)
-{
-    const native_handle_t* bufferHandle = buffer.getNativeHandle();
-    if (!sHandleImporter.importBuffer(bufferHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t fence;
-    if (!sHandleImporter.importFence(releaseFence, fence)) {
-        sHandleImporter.freeBuffer(bufferHandle);
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t error = mDispatch.setOutputBuffer(mDevice,
-            display, bufferHandle, fence);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.OutputBuffer = bufferHandle;
-    } else {
-        sHandleImporter.freeBuffer(bufferHandle);
-    }
-
-    // unlike in setClientTarget, fence is owned by us and is always closed
-    sHandleImporter.closeFence(fence);
-
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setPowerMode(Display display, PowerMode mode)
-{
-    auto error = mDispatch.setPowerMode(mDevice, display,
+    int32_t err = mDispatch.setPowerMode(mDevice, display,
             static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setVsyncEnabled(Display display,
-        Vsync enabled)
+Error HwcHal::setVsyncEnabled(Display display, IComposerClient::Vsync enabled)
 {
-    auto error = mDispatch.setVsyncEnabled(mDevice, display,
+    int32_t err = mDispatch.setVsyncEnabled(mDevice, display,
             static_cast<int32_t>(enabled));
-    return static_cast<Error>(error);
+    return static_cast<Error>(err);
 }
 
-Return<void> HwcHal::validateDisplay(Display display,
-        validateDisplay_cb hidl_cb)
+Error HwcHal::setColorTransform(Display display, const float* matrix,
+        int32_t hint)
+{
+    int32_t err = mDispatch.setColorTransform(mDevice, display, matrix, hint);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setClientTarget(Display display, buffer_handle_t target,
+        int32_t acquireFence, int32_t dataspace,
+        const std::vector<hwc_rect_t>& damage)
+{
+    hwc_region region = { damage.size(), damage.data() };
+    int32_t err = mDispatch.setClientTarget(mDevice, display, target,
+            acquireFence, dataspace, region);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setOutputBuffer(Display display, buffer_handle_t buffer,
+        int32_t releaseFence)
+{
+    int32_t err = mDispatch.setOutputBuffer(mDevice, display, buffer,
+            releaseFence);
+    // unlike in setClientTarget, releaseFence is owned by us
+    if (err == HWC2_ERROR_NONE && releaseFence >= 0) {
+        close(releaseFence);
+    }
+
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::validateDisplay(Display display,
+        std::vector<Layer>& changedLayers,
+        std::vector<IComposerClient::Composition>& compositionTypes,
+        uint32_t& displayRequestMask,
+        std::vector<Layer>& requestedLayers,
+        std::vector<uint32_t>& requestMasks)
 {
     uint32_t types_count = 0;
     uint32_t reqs_count = 0;
-    auto error = mDispatch.validateDisplay(mDevice, display,
+    int32_t err = mDispatch.validateDisplay(mDevice, display,
             &types_count, &reqs_count);
-
-    hidl_cb(static_cast<Error>(error), types_count, reqs_count);
-
-    return Void();
-}
-
-Return<Error> HwcHal::setCursorPosition(Display display,
-        Layer layer, int32_t x, int32_t y)
-{
-    auto error = mDispatch.setCursorPosition(mDevice, display, layer, x, y);
-    return static_cast<Error>(error);
-}
-
-Return<Error> HwcHal::setLayerBuffer(Display display,
-        Layer layer, const hidl_handle& buffer,
-        const hidl_handle& acquireFence)
-{
-    const native_handle_t* bufferHandle = buffer.getNativeHandle();
-    if (!sHandleImporter.importBuffer(bufferHandle)) {
-        return Error::NO_RESOURCES;
+    if (err != HWC2_ERROR_NONE && err != HWC2_ERROR_HAS_CHANGES) {
+        return static_cast<Error>(err);
     }
 
-    int32_t fence;
-    if (!sHandleImporter.importFence(acquireFence, fence)) {
-        sHandleImporter.freeBuffer(bufferHandle);
-        return Error::NO_RESOURCES;
+    err = mDispatch.getChangedCompositionTypes(mDevice, display,
+            &types_count, nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
     }
 
-    int32_t error = mDispatch.setLayerBuffer(mDevice,
-            display, layer, bufferHandle, fence);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerBuffers[layer] = bufferHandle;
-    } else {
-        sHandleImporter.freeBuffer(bufferHandle);
-        sHandleImporter.closeFence(fence);
+    changedLayers.resize(types_count);
+    compositionTypes.resize(types_count);
+    err = mDispatch.getChangedCompositionTypes(mDevice, display,
+            &types_count, changedLayers.data(),
+            reinterpret_cast<
+            std::underlying_type<IComposerClient::Composition>::type*>(
+                compositionTypes.data()));
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+        return static_cast<Error>(err);
     }
 
-    return static_cast<Error>(error);
+    int32_t display_reqs = 0;
+    err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
+            &reqs_count, nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+        return static_cast<Error>(err);
+    }
+
+    requestedLayers.resize(reqs_count);
+    requestMasks.resize(reqs_count);
+    err = mDispatch.getDisplayRequests(mDevice, display, &display_reqs,
+            &reqs_count, requestedLayers.data(),
+            reinterpret_cast<int32_t*>(requestMasks.data()));
+    if (err != HWC2_ERROR_NONE) {
+        changedLayers.clear();
+        compositionTypes.clear();
+
+        requestedLayers.clear();
+        requestMasks.clear();
+        return static_cast<Error>(err);
+    }
+
+    displayRequestMask = display_reqs;
+
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSurfaceDamage(Display display,
-        Layer layer, const hidl_vec<Rect>& damage)
+Error HwcHal::acceptDisplayChanges(Display display)
 {
-    hwc_region_t damage_region = { damage.size(),
-        reinterpret_cast<const hwc_rect_t*>(&damage[0]) };
-
-    auto error = mDispatch.setLayerSurfaceDamage(mDevice, display, layer,
-            damage_region);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.acceptDisplayChanges(mDevice, display);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerBlendMode(Display display,
-        Layer layer, BlendMode mode)
+Error HwcHal::presentDisplay(Display display, int32_t& presentFence,
+        std::vector<Layer>& layers, std::vector<int32_t>& releaseFences)
 {
-    auto error = mDispatch.setLayerBlendMode(mDevice, display, layer,
-            static_cast<int32_t>(mode));
-    return static_cast<Error>(error);
+    presentFence = -1;
+    int32_t err = mDispatch.presentDisplay(mDevice, display, &presentFence);
+    if (err != HWC2_ERROR_NONE) {
+        return static_cast<Error>(err);
+    }
+
+    uint32_t count = 0;
+    err = mDispatch.getReleaseFences(mDevice, display, &count,
+            nullptr, nullptr);
+    if (err != HWC2_ERROR_NONE) {
+        ALOGW("failed to get release fences");
+        return Error::NONE;
+    }
+
+    layers.resize(count);
+    releaseFences.resize(count);
+    err = mDispatch.getReleaseFences(mDevice, display, &count,
+            layers.data(), releaseFences.data());
+    if (err != HWC2_ERROR_NONE) {
+        ALOGW("failed to get release fences");
+        layers.clear();
+        releaseFences.clear();
+        return Error::NONE;
+    }
+
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerColor(Display display,
-        Layer layer, const Color& color)
+Error HwcHal::setLayerCursorPosition(Display display, Layer layer,
+        int32_t x, int32_t y)
+{
+    int32_t err = mDispatch.setCursorPosition(mDevice, display, layer, x, y);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerBuffer(Display display, Layer layer,
+        buffer_handle_t buffer, int32_t acquireFence)
+{
+    int32_t err = mDispatch.setLayerBuffer(mDevice, display, layer,
+            buffer, acquireFence);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerSurfaceDamage(Display display, Layer layer,
+        const std::vector<hwc_rect_t>& damage)
+{
+    hwc_region region = { damage.size(), damage.data() };
+    int32_t err = mDispatch.setLayerSurfaceDamage(mDevice, display, layer,
+            region);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerBlendMode(Display display, Layer layer, int32_t mode)
+{
+    int32_t err = mDispatch.setLayerBlendMode(mDevice, display, layer, mode);
+    return static_cast<Error>(err);
+}
+
+Error HwcHal::setLayerColor(Display display, Layer layer,
+        IComposerClient::Color color)
 {
     hwc_color_t hwc_color{color.r, color.g, color.b, color.a};
-    auto error = mDispatch.setLayerColor(mDevice, display, layer, hwc_color);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerColor(mDevice, display, layer, hwc_color);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerCompositionType(Display display,
-        Layer layer, Composition type)
+Error HwcHal::setLayerCompositionType(Display display, Layer layer,
+        int32_t type)
 {
-    auto error = mDispatch.setLayerCompositionType(mDevice, display, layer,
-            static_cast<int32_t>(type));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerCompositionType(mDevice, display, layer,
+            type);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerDataspace(Display display,
-        Layer layer, Dataspace dataspace)
+Error HwcHal::setLayerDataspace(Display display, Layer layer,
+        int32_t dataspace)
 {
-    auto error = mDispatch.setLayerDataspace(mDevice, display, layer,
-            static_cast<int32_t>(dataspace));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerDataspace(mDevice, display, layer,
+            dataspace);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerDisplayFrame(Display display,
-        Layer layer, const Rect& frame)
+Error HwcHal::setLayerDisplayFrame(Display display, Layer layer,
+        const hwc_rect_t& frame)
 {
-    hwc_rect_t hwc_frame{frame.left, frame.top, frame.right, frame.bottom};
-    auto error = mDispatch.setLayerDisplayFrame(mDevice, display, layer,
-            hwc_frame);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerDisplayFrame(mDevice, display, layer,
+            frame);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerPlaneAlpha(Display display,
-        Layer layer, float alpha)
+Error HwcHal::setLayerPlaneAlpha(Display display, Layer layer, float alpha)
 {
-    auto error = mDispatch.setLayerPlaneAlpha(mDevice, display, layer, alpha);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerPlaneAlpha(mDevice, display, layer,
+            alpha);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSidebandStream(Display display,
-        Layer layer, const hidl_handle& stream)
+Error HwcHal::setLayerSidebandStream(Display display, Layer layer,
+        buffer_handle_t stream)
 {
-    const native_handle_t* streamHandle = stream.getNativeHandle();
-    if (!sHandleImporter.importBuffer(streamHandle)) {
-        return Error::NO_RESOURCES;
-    }
-
-    int32_t error = mDispatch.setLayerSidebandStream(mDevice,
-            display, layer, streamHandle);
-    if (error == HWC2_ERROR_NONE) {
-        std::lock_guard<std::mutex> lock(mDisplayMutex);
-
-        auto dpy = mDisplays.find(display);
-        dpy->second.LayerSidebandStreams[layer] = streamHandle;
-    } else {
-        sHandleImporter.freeBuffer(streamHandle);
-    }
-
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerSidebandStream(mDevice, display, layer,
+            stream);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerSourceCrop(Display display,
-        Layer layer, const FRect& crop)
+Error HwcHal::setLayerSourceCrop(Display display, Layer layer,
+        const hwc_frect_t& crop)
 {
-    hwc_frect_t hwc_crop{crop.left, crop.top, crop.right, crop.bottom};
-    auto error = mDispatch.setLayerSourceCrop(mDevice, display, layer,
-            hwc_crop);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerSourceCrop(mDevice, display, layer, crop);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerTransform(Display display,
-        Layer layer, Transform transform)
+Error HwcHal::setLayerTransform(Display display, Layer layer,
+        int32_t transform)
 {
-    auto error = mDispatch.setLayerTransform(mDevice, display, layer,
-            static_cast<int32_t>(transform));
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerTransform(mDevice, display, layer,
+            transform);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerVisibleRegion(Display display,
-        Layer layer, const hidl_vec<Rect>& visible)
+Error HwcHal::setLayerVisibleRegion(Display display, Layer layer,
+        const std::vector<hwc_rect_t>& visible)
 {
-    hwc_region_t visible_region = { visible.size(),
-        reinterpret_cast<const hwc_rect_t*>(&visible[0]) };
-
-    auto error = mDispatch.setLayerVisibleRegion(mDevice, display, layer,
-            visible_region);
-    return static_cast<Error>(error);
+    hwc_region_t region = { visible.size(), visible.data() };
+    int32_t err = mDispatch.setLayerVisibleRegion(mDevice, display, layer,
+            region);
+    return static_cast<Error>(err);
 }
 
-Return<Error> HwcHal::setLayerZOrder(Display display,
-        Layer layer, uint32_t z)
+Error HwcHal::setLayerZOrder(Display display, Layer layer, uint32_t z)
 {
-    auto error = mDispatch.setLayerZOrder(mDevice, display, layer, z);
-    return static_cast<Error>(error);
+    int32_t err = mDispatch.setLayerZOrder(mDevice, display, layer, z);
+    return static_cast<Error>(err);
 }
 
 IComposer* HIDL_FETCH_IComposer(const char*)
diff --git a/graphics/composer/2.1/default/Hwc.h b/graphics/composer/2.1/default/Hwc.h
index de69417..89ac4f7 100644
--- a/graphics/composer/2.1/default/Hwc.h
+++ b/graphics/composer/2.1/default/Hwc.h
@@ -17,7 +17,12 @@
 #ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_H
 #define ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_H
 
+#include <mutex>
+#include <unordered_set>
+#include <vector>
+
 #include <android/hardware/graphics/composer/2.1/IComposer.h>
+#include <hardware/hwcomposer2.h>
 
 namespace android {
 namespace hardware {
@@ -26,6 +31,172 @@
 namespace V2_1 {
 namespace implementation {
 
+using android::hardware::graphics::common::V1_0::PixelFormat;
+using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::graphics::common::V1_0::Dataspace;
+using android::hardware::graphics::common::V1_0::ColorMode;
+using android::hardware::graphics::common::V1_0::ColorTransform;
+using android::hardware::graphics::common::V1_0::Hdr;
+
+class HwcClient;
+
+class HwcHal : public IComposer {
+public:
+    HwcHal(const hw_module_t* module);
+    virtual ~HwcHal();
+
+    // IComposer interface
+    Return<void> getCapabilities(getCapabilities_cb hidl_cb) override;
+    Return<void> dumpDebugInfo(dumpDebugInfo_cb hidl_cb) override;
+    Return<void> createClient(createClient_cb hidl_cb) override;
+
+    bool hasCapability(Capability capability) const;
+
+    void removeClient();
+
+    void enableCallback(bool enable);
+
+    uint32_t getMaxVirtualDisplayCount();
+    Error createVirtualDisplay(uint32_t width, uint32_t height,
+        PixelFormat& format, Display& display);
+    Error destroyVirtualDisplay(Display display);
+
+    Error createLayer(Display display, Layer& layer);
+    Error destroyLayer(Display display, Layer layer);
+
+    Error getActiveConfig(Display display, Config& config);
+    Error getClientTargetSupport(Display display,
+            uint32_t width, uint32_t height,
+            PixelFormat format, Dataspace dataspace);
+    Error getColorModes(Display display, hidl_vec<ColorMode>& modes);
+    Error getDisplayAttribute(Display display, Config config,
+            IComposerClient::Attribute attribute, int32_t& value);
+    Error getDisplayConfigs(Display display, hidl_vec<Config>& configs);
+    Error getDisplayName(Display display, hidl_string& name);
+    Error getDisplayType(Display display, IComposerClient::DisplayType& type);
+    Error getDozeSupport(Display display, bool& support);
+    Error getHdrCapabilities(Display display, hidl_vec<Hdr>& types,
+            float& maxLuminance, float& maxAverageLuminance,
+            float& minLuminance);
+
+    Error setActiveConfig(Display display, Config config);
+    Error setColorMode(Display display, ColorMode mode);
+    Error setPowerMode(Display display, IComposerClient::PowerMode mode);
+    Error setVsyncEnabled(Display display, IComposerClient::Vsync enabled);
+
+    Error setColorTransform(Display display, const float* matrix,
+            int32_t hint);
+    Error setClientTarget(Display display, buffer_handle_t target,
+            int32_t acquireFence, int32_t dataspace,
+            const std::vector<hwc_rect_t>& damage);
+    Error setOutputBuffer(Display display, buffer_handle_t buffer,
+            int32_t releaseFence);
+    Error validateDisplay(Display display,
+            std::vector<Layer>& changedLayers,
+            std::vector<IComposerClient::Composition>& compositionTypes,
+            uint32_t& displayRequestMask,
+            std::vector<Layer>& requestedLayers,
+            std::vector<uint32_t>& requestMasks);
+    Error acceptDisplayChanges(Display display);
+    Error presentDisplay(Display display, int32_t& presentFence,
+            std::vector<Layer>& layers, std::vector<int32_t>& releaseFences);
+
+    Error setLayerCursorPosition(Display display, Layer layer,
+            int32_t x, int32_t y);
+    Error setLayerBuffer(Display display, Layer layer,
+            buffer_handle_t buffer, int32_t acquireFence);
+    Error setLayerSurfaceDamage(Display display, Layer layer,
+            const std::vector<hwc_rect_t>& damage);
+    Error setLayerBlendMode(Display display, Layer layer, int32_t mode);
+    Error setLayerColor(Display display, Layer layer,
+            IComposerClient::Color color);
+    Error setLayerCompositionType(Display display, Layer layer,
+            int32_t type);
+    Error setLayerDataspace(Display display, Layer layer,
+            int32_t dataspace);
+    Error setLayerDisplayFrame(Display display, Layer layer,
+            const hwc_rect_t& frame);
+    Error setLayerPlaneAlpha(Display display, Layer layer, float alpha);
+    Error setLayerSidebandStream(Display display, Layer layer,
+            buffer_handle_t stream);
+    Error setLayerSourceCrop(Display display, Layer layer,
+            const hwc_frect_t& crop);
+    Error setLayerTransform(Display display, Layer layer,
+            int32_t transform);
+    Error setLayerVisibleRegion(Display display, Layer layer,
+            const std::vector<hwc_rect_t>& visible);
+    Error setLayerZOrder(Display display, Layer layer, uint32_t z);
+
+private:
+    void initCapabilities();
+
+    template<typename T>
+    void initDispatch(T& func, hwc2_function_descriptor_t desc);
+    void initDispatch();
+
+    sp<HwcClient> getClient();
+
+    static void hotplugHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display, int32_t connected);
+    static void refreshHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display);
+    static void vsyncHook(hwc2_callback_data_t callbackData,
+        hwc2_display_t display, int64_t timestamp);
+
+    hwc2_device_t* mDevice;
+
+    std::unordered_set<Capability> mCapabilities;
+
+    struct {
+        HWC2_PFN_ACCEPT_DISPLAY_CHANGES acceptDisplayChanges;
+        HWC2_PFN_CREATE_LAYER createLayer;
+        HWC2_PFN_CREATE_VIRTUAL_DISPLAY createVirtualDisplay;
+        HWC2_PFN_DESTROY_LAYER destroyLayer;
+        HWC2_PFN_DESTROY_VIRTUAL_DISPLAY destroyVirtualDisplay;
+        HWC2_PFN_DUMP dump;
+        HWC2_PFN_GET_ACTIVE_CONFIG getActiveConfig;
+        HWC2_PFN_GET_CHANGED_COMPOSITION_TYPES getChangedCompositionTypes;
+        HWC2_PFN_GET_CLIENT_TARGET_SUPPORT getClientTargetSupport;
+        HWC2_PFN_GET_COLOR_MODES getColorModes;
+        HWC2_PFN_GET_DISPLAY_ATTRIBUTE getDisplayAttribute;
+        HWC2_PFN_GET_DISPLAY_CONFIGS getDisplayConfigs;
+        HWC2_PFN_GET_DISPLAY_NAME getDisplayName;
+        HWC2_PFN_GET_DISPLAY_REQUESTS getDisplayRequests;
+        HWC2_PFN_GET_DISPLAY_TYPE getDisplayType;
+        HWC2_PFN_GET_DOZE_SUPPORT getDozeSupport;
+        HWC2_PFN_GET_HDR_CAPABILITIES getHdrCapabilities;
+        HWC2_PFN_GET_MAX_VIRTUAL_DISPLAY_COUNT getMaxVirtualDisplayCount;
+        HWC2_PFN_GET_RELEASE_FENCES getReleaseFences;
+        HWC2_PFN_PRESENT_DISPLAY presentDisplay;
+        HWC2_PFN_REGISTER_CALLBACK registerCallback;
+        HWC2_PFN_SET_ACTIVE_CONFIG setActiveConfig;
+        HWC2_PFN_SET_CLIENT_TARGET setClientTarget;
+        HWC2_PFN_SET_COLOR_MODE setColorMode;
+        HWC2_PFN_SET_COLOR_TRANSFORM setColorTransform;
+        HWC2_PFN_SET_CURSOR_POSITION setCursorPosition;
+        HWC2_PFN_SET_LAYER_BLEND_MODE setLayerBlendMode;
+        HWC2_PFN_SET_LAYER_BUFFER setLayerBuffer;
+        HWC2_PFN_SET_LAYER_COLOR setLayerColor;
+        HWC2_PFN_SET_LAYER_COMPOSITION_TYPE setLayerCompositionType;
+        HWC2_PFN_SET_LAYER_DATASPACE setLayerDataspace;
+        HWC2_PFN_SET_LAYER_DISPLAY_FRAME setLayerDisplayFrame;
+        HWC2_PFN_SET_LAYER_PLANE_ALPHA setLayerPlaneAlpha;
+        HWC2_PFN_SET_LAYER_SIDEBAND_STREAM setLayerSidebandStream;
+        HWC2_PFN_SET_LAYER_SOURCE_CROP setLayerSourceCrop;
+        HWC2_PFN_SET_LAYER_SURFACE_DAMAGE setLayerSurfaceDamage;
+        HWC2_PFN_SET_LAYER_TRANSFORM setLayerTransform;
+        HWC2_PFN_SET_LAYER_VISIBLE_REGION setLayerVisibleRegion;
+        HWC2_PFN_SET_LAYER_Z_ORDER setLayerZOrder;
+        HWC2_PFN_SET_OUTPUT_BUFFER setOutputBuffer;
+        HWC2_PFN_SET_POWER_MODE setPowerMode;
+        HWC2_PFN_SET_VSYNC_ENABLED setVsyncEnabled;
+        HWC2_PFN_VALIDATE_DISPLAY validateDisplay;
+    } mDispatch;
+
+    std::mutex mClientMutex;
+    wp<HwcClient> mClient;
+};
+
 extern "C" IComposer* HIDL_FETCH_IComposer(const char* name);
 
 } // namespace implementation
diff --git a/graphics/composer/2.1/default/HwcClient.cpp b/graphics/composer/2.1/default/HwcClient.cpp
new file mode 100644
index 0000000..16af94c
--- /dev/null
+++ b/graphics/composer/2.1/default/HwcClient.cpp
@@ -0,0 +1,1126 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "HwcPassthrough"
+
+#include <hardware/gralloc.h>
+#include <hardware/gralloc1.h>
+#include <log/log.h>
+
+#include "Hwc.h"
+#include "HwcClient.h"
+#include "IComposerCommandBuffer.h"
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+namespace implementation {
+
+namespace {
+
+class HandleImporter {
+public:
+    HandleImporter() : mInitialized(false) {}
+
+    bool initialize()
+    {
+        // allow only one client
+        if (mInitialized) {
+            return false;
+        }
+
+        if (!openGralloc()) {
+            return false;
+        }
+
+        mInitialized = true;
+        return true;
+    }
+
+    void cleanup()
+    {
+        if (!mInitialized) {
+            return;
+        }
+
+        closeGralloc();
+        mInitialized = false;
+    }
+
+    // In IComposer, any buffer_handle_t is owned by the caller and we need to
+    // make a clone for hwcomposer2.  We also need to translate empty handle
+    // to nullptr.  This function does that, in-place.
+    bool importBuffer(buffer_handle_t& handle)
+    {
+        if (!handle) {
+            return true;
+        }
+
+        if (!handle->numFds && !handle->numInts) {
+            handle = nullptr;
+            return true;
+        }
+
+        buffer_handle_t clone = cloneBuffer(handle);
+        if (!clone) {
+            return false;
+        }
+
+        handle = clone;
+        return true;
+    }
+
+    void freeBuffer(buffer_handle_t handle)
+    {
+        if (!handle) {
+            return;
+        }
+
+        releaseBuffer(handle);
+    }
+
+private:
+    bool mInitialized;
+
+    // Some existing gralloc drivers do not support retaining more than once,
+    // when we are in passthrough mode.
+#ifdef BINDERIZED
+    bool openGralloc()
+    {
+        const hw_module_t* module;
+        int err = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
+        if (err) {
+            ALOGE("failed to get gralloc module");
+            return false;
+        }
+
+        uint8_t major = (module->module_api_version >> 8) & 0xff;
+        if (major > 1) {
+            ALOGE("unknown gralloc module major version %d", major);
+            return false;
+        }
+
+        if (major == 1) {
+            err = gralloc1_open(module, &mDevice);
+            if (err) {
+                ALOGE("failed to open gralloc1 device");
+                return false;
+            }
+
+            mRetain = reinterpret_cast<GRALLOC1_PFN_RETAIN>(
+                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RETAIN));
+            mRelease = reinterpret_cast<GRALLOC1_PFN_RELEASE>(
+                    mDevice->getFunction(mDevice, GRALLOC1_FUNCTION_RELEASE));
+            if (!mRetain || !mRelease) {
+                ALOGE("invalid gralloc1 device");
+                gralloc1_close(mDevice);
+                return false;
+            }
+        } else {
+            mModule = reinterpret_cast<const gralloc_module_t*>(module);
+        }
+
+        return true;
+    }
+
+    void closeGralloc()
+    {
+        if (mDevice) {
+            gralloc1_close(mDevice);
+        }
+    }
+
+    buffer_handle_t cloneBuffer(buffer_handle_t handle)
+    {
+        native_handle_t* clone = native_handle_clone(handle);
+        if (!clone) {
+            ALOGE("failed to clone buffer %p", handle);
+            return nullptr;
+        }
+
+        bool err;
+        if (mDevice) {
+            err = (mRetain(mDevice, clone) != GRALLOC1_ERROR_NONE);
+        } else {
+            err = (mModule->registerBuffer(mModule, clone) != 0);
+        }
+
+        if (err) {
+            ALOGE("failed to retain/register buffer %p", clone);
+            native_handle_close(clone);
+            native_handle_delete(clone);
+            return nullptr;
+        }
+
+        return clone;
+    }
+
+    void releaseBuffer(buffer_handle_t handle)
+    {
+        if (mDevice) {
+            mRelease(mDevice, handle);
+        } else {
+            mModule->unregisterBuffer(mModule, handle);
+            native_handle_close(handle);
+            native_handle_delete(const_cast<native_handle_t*>(handle));
+        }
+    }
+
+    // gralloc1
+    gralloc1_device_t* mDevice;
+    GRALLOC1_PFN_RETAIN mRetain;
+    GRALLOC1_PFN_RELEASE mRelease;
+
+    // gralloc0
+    const gralloc_module_t* mModule;
+#else
+    bool openGralloc() { return true; }
+    void closeGralloc() {}
+    buffer_handle_t cloneBuffer(buffer_handle_t handle) { return handle; }
+    void releaseBuffer(buffer_handle_t) {}
+#endif
+};
+
+HandleImporter sHandleImporter;
+
+} // anonymous namespace
+
+BufferClone::BufferClone()
+    : mHandle(nullptr)
+{
+}
+
+BufferClone::BufferClone(BufferClone&& other)
+{
+    mHandle = other.mHandle;
+    other.mHandle = nullptr;
+}
+
+BufferClone& BufferClone::operator=(buffer_handle_t handle)
+{
+    clear();
+    mHandle = handle;
+    return *this;
+}
+
+BufferClone::~BufferClone()
+{
+    clear();
+}
+
+void BufferClone::clear()
+{
+    if (mHandle) {
+        sHandleImporter.freeBuffer(mHandle);
+    }
+}
+
+HwcClient::HwcClient(HwcHal& hal)
+    : mHal(hal), mReader(*this), mWriter(kWriterInitialSize)
+{
+    if (!sHandleImporter.initialize()) {
+        LOG_ALWAYS_FATAL("failed to initialize handle importer");
+    }
+}
+
+HwcClient::~HwcClient()
+{
+    mHal.enableCallback(false);
+    mHal.removeClient();
+
+    // no need to grab the mutex as any in-flight hwbinder call should keep
+    // the client alive
+    for (const auto& dpy : mDisplayData) {
+        if (!dpy.second.Layers.empty()) {
+            ALOGW("client destroyed with valid layers");
+        }
+        for (const auto& ly : dpy.second.Layers) {
+            mHal.destroyLayer(dpy.first, ly.first);
+        }
+
+        if (dpy.second.IsVirtual) {
+            ALOGW("client destroyed with valid virtual display");
+            mHal.destroyVirtualDisplay(dpy.first);
+        }
+    }
+
+    mDisplayData.clear();
+
+    sHandleImporter.cleanup();
+}
+
+void HwcClient::onHotplug(Display display,
+        IComposerCallback::Connection connected)
+{
+    {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        if (connected == IComposerCallback::Connection::CONNECTED) {
+            mDisplayData.emplace(display, DisplayData(false));
+        } else if (connected == IComposerCallback::Connection::DISCONNECTED) {
+            mDisplayData.erase(display);
+        }
+    }
+
+    mCallback->onHotplug(display, connected);
+}
+
+void HwcClient::onRefresh(Display display)
+{
+    mCallback->onRefresh(display);
+}
+
+void HwcClient::onVsync(Display display, int64_t timestamp)
+{
+    mCallback->onVsync(display, timestamp);
+}
+
+Return<void> HwcClient::registerCallback(const sp<IComposerCallback>& callback)
+{
+    // no locking as we require this function to be called only once
+    mCallback = callback;
+    mHal.enableCallback(callback != nullptr);
+
+    return Void();
+}
+
+Return<uint32_t> HwcClient::getMaxVirtualDisplayCount()
+{
+    return mHal.getMaxVirtualDisplayCount();
+}
+
+Return<void> HwcClient::createVirtualDisplay(uint32_t width, uint32_t height,
+        PixelFormat formatHint, uint32_t outputBufferSlotCount,
+        createVirtualDisplay_cb hidl_cb)
+{
+    Display display;
+    Error err = mHal.createVirtualDisplay(width, height, formatHint, display);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.emplace(display, DisplayData(true)).first;
+        dpy->second.OutputBuffers.resize(outputBufferSlotCount);
+    }
+
+    hidl_cb(err, display, formatHint);
+    return Void();
+}
+
+Return<Error> HwcClient::destroyVirtualDisplay(Display display)
+{
+    Error err = mHal.destroyVirtualDisplay(display);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        mDisplayData.erase(display);
+    }
+
+    return err;
+}
+
+Return<void> HwcClient::createLayer(Display display, uint32_t bufferSlotCount,
+        createLayer_cb hidl_cb)
+{
+    Layer layer;
+    Error err = mHal.createLayer(display, layer);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.find(display);
+        auto ly = dpy->second.Layers.emplace(layer, LayerBuffers()).first;
+        ly->second.Buffers.resize(bufferSlotCount);
+    }
+
+    hidl_cb(err, layer);
+    return Void();
+}
+
+Return<Error> HwcClient::destroyLayer(Display display, Layer layer)
+{
+    Error err = mHal.destroyLayer(display, layer);
+    if (err == Error::NONE) {
+        std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+        auto dpy = mDisplayData.find(display);
+        dpy->second.Layers.erase(layer);
+    }
+
+    return err;
+}
+
+Return<void> HwcClient::getActiveConfig(Display display,
+        getActiveConfig_cb hidl_cb)
+{
+    Config config;
+    Error err = mHal.getActiveConfig(display, config);
+
+    hidl_cb(err, config);
+    return Void();
+}
+
+Return<Error> HwcClient::getClientTargetSupport(Display display,
+        uint32_t width, uint32_t height,
+        PixelFormat format, Dataspace dataspace)
+{
+    Error err = mHal.getClientTargetSupport(display,
+            width, height, format, dataspace);
+    return err;
+}
+
+Return<void> HwcClient::getColorModes(Display display, getColorModes_cb hidl_cb)
+{
+    hidl_vec<ColorMode> modes;
+    Error err = mHal.getColorModes(display, modes);
+
+    hidl_cb(err, modes);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayAttribute(Display display,
+        Config config, Attribute attribute,
+        getDisplayAttribute_cb hidl_cb)
+{
+    int32_t value;
+    Error err = mHal.getDisplayAttribute(display, config, attribute, value);
+
+    hidl_cb(err, value);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayConfigs(Display display,
+        getDisplayConfigs_cb hidl_cb)
+{
+    hidl_vec<Config> configs;
+    Error err = mHal.getDisplayConfigs(display, configs);
+
+    hidl_cb(err, configs);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayName(Display display,
+        getDisplayName_cb hidl_cb)
+{
+    hidl_string name;
+    Error err = mHal.getDisplayName(display, name);
+
+    hidl_cb(err, name);
+    return Void();
+}
+
+Return<void> HwcClient::getDisplayType(Display display,
+        getDisplayType_cb hidl_cb)
+{
+    DisplayType type;
+    Error err = mHal.getDisplayType(display, type);
+
+    hidl_cb(err, type);
+    return Void();
+}
+
+Return<void> HwcClient::getDozeSupport(Display display,
+        getDozeSupport_cb hidl_cb)
+{
+    bool support;
+    Error err = mHal.getDozeSupport(display, support);
+
+    hidl_cb(err, support);
+    return Void();
+}
+
+Return<void> HwcClient::getHdrCapabilities(Display display,
+        getHdrCapabilities_cb hidl_cb)
+{
+    hidl_vec<Hdr> types;
+    float max_lumi = 0.0f;
+    float max_avg_lumi = 0.0f;
+    float min_lumi = 0.0f;
+    Error err = mHal.getHdrCapabilities(display, types,
+            max_lumi, max_avg_lumi, min_lumi);
+
+    hidl_cb(err, types, max_lumi, max_avg_lumi, min_lumi);
+    return Void();
+}
+
+Return<Error> HwcClient::setClientTargetSlotCount(Display display,
+        uint32_t clientTargetSlotCount)
+{
+    std::lock_guard<std::mutex> lock(mDisplayDataMutex);
+
+    auto dpy = mDisplayData.find(display);
+    if (dpy == mDisplayData.end()) {
+        return Error::BAD_DISPLAY;
+    }
+
+    dpy->second.ClientTargets.resize(clientTargetSlotCount);
+
+    return Error::NONE;
+}
+
+Return<Error> HwcClient::setActiveConfig(Display display, Config config)
+{
+    Error err = mHal.setActiveConfig(display, config);
+    return err;
+}
+
+Return<Error> HwcClient::setColorMode(Display display, ColorMode mode)
+{
+    Error err = mHal.setColorMode(display, mode);
+    return err;
+}
+
+Return<Error> HwcClient::setPowerMode(Display display, PowerMode mode)
+{
+    Error err = mHal.setPowerMode(display, mode);
+    return err;
+}
+
+Return<Error> HwcClient::setVsyncEnabled(Display display, Vsync enabled)
+{
+    Error err = mHal.setVsyncEnabled(display, enabled);
+    return err;
+}
+
+Return<Error> HwcClient::setInputCommandQueue(
+        const MQDescriptorSync& descriptor)
+{
+    std::lock_guard<std::mutex> lock(mCommandMutex);
+    return mReader.setMQDescriptor(descriptor) ?
+        Error::NONE : Error::NO_RESOURCES;
+}
+
+Return<void> HwcClient::getOutputCommandQueue(
+        getOutputCommandQueue_cb hidl_cb)
+{
+    // no locking as we require this function to be called inside
+    // executeCommands_cb
+
+    auto outDescriptor = mWriter.getMQDescriptor();
+    if (outDescriptor) {
+        hidl_cb(Error::NONE, *outDescriptor);
+    } else {
+        hidl_cb(Error::NO_RESOURCES, MQDescriptorSync(0, nullptr, 0));
+    }
+
+    return Void();
+}
+
+Return<void> HwcClient::executeCommands(uint32_t inLength,
+        const hidl_vec<hidl_handle>& inHandles,
+        executeCommands_cb hidl_cb)
+{
+    std::lock_guard<std::mutex> lock(mCommandMutex);
+
+    bool outChanged = false;
+    uint32_t outLength = 0;
+    hidl_vec<hidl_handle> outHandles;
+
+    if (!mReader.readQueue(inLength, inHandles)) {
+        hidl_cb(Error::BAD_PARAMETER, outChanged, outLength, outHandles);
+        return Void();
+    }
+
+    Error err = mReader.parse();
+    if (err == Error::NONE &&
+            !mWriter.writeQueue(outChanged, outLength, outHandles)) {
+        err = Error::NO_RESOURCES;
+    }
+
+    hidl_cb(err, outChanged, outLength, outHandles);
+
+    mReader.reset();
+    mWriter.reset();
+
+    return Void();
+}
+
+HwcClient::CommandReader::CommandReader(HwcClient& client)
+    : mClient(client), mHal(client.mHal), mWriter(client.mWriter)
+{
+}
+
+Error HwcClient::CommandReader::parse()
+{
+    IComposerClient::Command command;
+    uint16_t length;
+
+    while (!isEmpty()) {
+        if (!beginCommand(command, length)) {
+            break;
+        }
+
+        bool parsed = false;
+        switch (command) {
+        case IComposerClient::Command::SELECT_DISPLAY:
+            parsed = parseSelectDisplay(length);
+            break;
+        case IComposerClient::Command::SELECT_LAYER:
+            parsed = parseSelectLayer(length);
+            break;
+        case IComposerClient::Command::SET_COLOR_TRANSFORM:
+            parsed = parseSetColorTransform(length);
+            break;
+        case IComposerClient::Command::SET_CLIENT_TARGET:
+            parsed = parseSetClientTarget(length);
+            break;
+        case IComposerClient::Command::SET_OUTPUT_BUFFER:
+            parsed = parseSetOutputBuffer(length);
+            break;
+        case IComposerClient::Command::VALIDATE_DISPLAY:
+            parsed = parseValidateDisplay(length);
+            break;
+        case IComposerClient::Command::ACCEPT_DISPLAY_CHANGES:
+            parsed = parseAcceptDisplayChanges(length);
+            break;
+        case IComposerClient::Command::PRESENT_DISPLAY:
+            parsed = parsePresentDisplay(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_CURSOR_POSITION:
+            parsed = parseSetLayerCursorPosition(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_BUFFER:
+            parsed = parseSetLayerBuffer(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SURFACE_DAMAGE:
+            parsed = parseSetLayerSurfaceDamage(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_BLEND_MODE:
+            parsed = parseSetLayerBlendMode(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_COLOR:
+            parsed = parseSetLayerColor(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_COMPOSITION_TYPE:
+            parsed = parseSetLayerCompositionType(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_DATASPACE:
+            parsed = parseSetLayerDataspace(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_DISPLAY_FRAME:
+            parsed = parseSetLayerDisplayFrame(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_PLANE_ALPHA:
+            parsed = parseSetLayerPlaneAlpha(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SIDEBAND_STREAM:
+            parsed = parseSetLayerSidebandStream(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_SOURCE_CROP:
+            parsed = parseSetLayerSourceCrop(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_TRANSFORM:
+            parsed = parseSetLayerTransform(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_VISIBLE_REGION:
+            parsed = parseSetLayerVisibleRegion(length);
+            break;
+        case IComposerClient::Command::SET_LAYER_Z_ORDER:
+            parsed = parseSetLayerZOrder(length);
+            break;
+        default:
+            parsed = false;
+            break;
+        }
+
+        endCommand();
+
+        if (!parsed) {
+            ALOGE("failed to parse command 0x%x, length %" PRIu16,
+                    command, length);
+            break;
+        }
+    }
+
+    return (isEmpty()) ? Error::NONE : Error::BAD_PARAMETER;
+}
+
+bool HwcClient::CommandReader::parseSelectDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kSelectDisplayLength) {
+        return false;
+    }
+
+    mDisplay = read64();
+    mWriter.selectDisplay(mDisplay);
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSelectLayer(uint16_t length)
+{
+    if (length != CommandWriter::kSelectLayerLength) {
+        return false;
+    }
+
+    mLayer = read64();
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetColorTransform(uint16_t length)
+{
+    if (length != CommandWriter::kSetColorTransformLength) {
+        return false;
+    }
+
+    float matrix[16];
+    for (int i = 0; i < 16; i++) {
+        matrix[i] = readFloat();
+    }
+    auto transform = readSigned();
+
+    auto err = mHal.setColorTransform(mDisplay, matrix, transform);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetClientTarget(uint16_t length)
+{
+    // 4 parameters followed by N rectangles
+    if ((length - 4) % 4 != 0) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto clientTarget = readHandle(useCache);
+    auto fence = readFence();
+    auto dataspace = readSigned();
+    auto damage = readRegion((length - 4) / 4);
+
+    auto err = lookupBuffer(BufferCache::CLIENT_TARGETS,
+            slot, useCache, clientTarget);
+    if (err == Error::NONE) {
+        err = mHal.setClientTarget(mDisplay, clientTarget, fence,
+                dataspace, damage);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetOutputBuffer(uint16_t length)
+{
+    if (length != CommandWriter::kSetOutputBufferLength) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto outputBuffer = readHandle(useCache);
+    auto fence = readFence();
+
+    auto err = lookupBuffer(BufferCache::OUTPUT_BUFFERS,
+            slot, useCache, outputBuffer);
+    if (err == Error::NONE) {
+        err = mHal.setOutputBuffer(mDisplay, outputBuffer, fence);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseValidateDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kValidateDisplayLength) {
+        return false;
+    }
+
+    std::vector<Layer> changedLayers;
+    std::vector<IComposerClient::Composition> compositionTypes;
+    uint32_t displayRequestMask;
+    std::vector<Layer> requestedLayers;
+    std::vector<uint32_t> requestMasks;
+
+    auto err = mHal.validateDisplay(mDisplay, changedLayers, compositionTypes,
+            displayRequestMask, requestedLayers, requestMasks);
+    if (err == Error::NONE) {
+        mWriter.setChangedCompositionTypes(changedLayers,
+                compositionTypes);
+        mWriter.setDisplayRequests(displayRequestMask,
+                requestedLayers, requestMasks);
+    } else {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseAcceptDisplayChanges(uint16_t length)
+{
+    if (length != CommandWriter::kAcceptDisplayChangesLength) {
+        return false;
+    }
+
+    auto err = mHal.acceptDisplayChanges(mDisplay);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parsePresentDisplay(uint16_t length)
+{
+    if (length != CommandWriter::kPresentDisplayLength) {
+        return false;
+    }
+
+    int presentFence;
+    std::vector<Layer> layers;
+    std::vector<int> fences;
+    auto err = mHal.presentDisplay(mDisplay, presentFence, layers, fences);
+    if (err == Error::NONE) {
+        mWriter.setPresentFence(presentFence);
+        mWriter.setReleaseFences(layers, fences);
+    } else {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerCursorPosition(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerCursorPositionLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerCursorPosition(mDisplay, mLayer,
+            readSigned(), readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerBuffer(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerBufferLength) {
+        return false;
+    }
+
+    bool useCache;
+    auto slot = read();
+    auto buffer = readHandle(useCache);
+    auto fence = readFence();
+
+    auto err = lookupBuffer(BufferCache::LAYER_BUFFERS,
+            slot, useCache, buffer);
+    if (err == Error::NONE) {
+        err = mHal.setLayerBuffer(mDisplay, mLayer, buffer, fence);
+    }
+    if (err != Error::NONE) {
+        close(fence);
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSurfaceDamage(uint16_t length)
+{
+    // N rectangles
+    if (length % 4 != 0) {
+        return false;
+    }
+
+    auto damage = readRegion(length / 4);
+    auto err = mHal.setLayerSurfaceDamage(mDisplay, mLayer, damage);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerBlendMode(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerBlendModeLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerBlendMode(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerColor(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerColorLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerColor(mDisplay, mLayer, readColor());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerCompositionType(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerCompositionTypeLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerCompositionType(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerDataspace(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerDataspaceLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerDataspace(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerDisplayFrame(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerDisplayFrameLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerDisplayFrame(mDisplay, mLayer, readRect());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerPlaneAlpha(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerPlaneAlphaLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerPlaneAlpha(mDisplay, mLayer, read());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSidebandStream(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerSidebandStreamLength) {
+        return false;
+    }
+
+    auto stream = readHandle();
+
+    auto err = lookupLayerSidebandStream(stream);
+    if (err == Error::NONE) {
+        err = mHal.setLayerSidebandStream(mDisplay, mLayer, stream);
+    }
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerSourceCrop(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerSourceCropLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerSourceCrop(mDisplay, mLayer, readFRect());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerTransform(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerTransformLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerTransform(mDisplay, mLayer, readSigned());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerVisibleRegion(uint16_t length)
+{
+    // N rectangles
+    if (length % 4 != 0) {
+        return false;
+    }
+
+    auto region = readRegion(length / 4);
+    auto err = mHal.setLayerVisibleRegion(mDisplay, mLayer, region);
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+bool HwcClient::CommandReader::parseSetLayerZOrder(uint16_t length)
+{
+    if (length != CommandWriter::kSetLayerZOrderLength) {
+        return false;
+    }
+
+    auto err = mHal.setLayerZOrder(mDisplay, mLayer, read());
+    if (err != Error::NONE) {
+        mWriter.setError(getCommandLoc(), err);
+    }
+
+    return true;
+}
+
+hwc_rect_t HwcClient::CommandReader::readRect()
+{
+    return hwc_rect_t{
+        readSigned(),
+        readSigned(),
+        readSigned(),
+        readSigned(),
+    };
+}
+
+std::vector<hwc_rect_t> HwcClient::CommandReader::readRegion(size_t count)
+{
+    std::vector<hwc_rect_t> region;
+    region.reserve(count);
+    while (count > 0) {
+        region.emplace_back(readRect());
+        count--;
+    }
+
+    return region;
+}
+
+hwc_frect_t HwcClient::CommandReader::readFRect()
+{
+    return hwc_frect_t{
+        readFloat(),
+        readFloat(),
+        readFloat(),
+        readFloat(),
+    };
+}
+
+Error HwcClient::CommandReader::lookupBuffer(BufferCache cache, uint32_t slot,
+        bool useCache, buffer_handle_t& handle)
+{
+    std::lock_guard<std::mutex> lock(mClient.mDisplayDataMutex);
+
+    auto dpy = mClient.mDisplayData.find(mDisplay);
+    if (dpy == mClient.mDisplayData.end()) {
+        return Error::BAD_DISPLAY;
+    }
+
+    BufferClone* clone = nullptr;
+    switch (cache) {
+    case BufferCache::CLIENT_TARGETS:
+        if (slot < dpy->second.ClientTargets.size()) {
+            clone = &dpy->second.ClientTargets[slot];
+        }
+        break;
+    case BufferCache::OUTPUT_BUFFERS:
+        if (slot < dpy->second.OutputBuffers.size()) {
+            clone = &dpy->second.OutputBuffers[slot];
+        }
+        break;
+    case BufferCache::LAYER_BUFFERS:
+        {
+            auto ly = dpy->second.Layers.find(mLayer);
+            if (ly == dpy->second.Layers.end()) {
+                return Error::BAD_LAYER;
+            }
+            if (slot < ly->second.Buffers.size()) {
+                clone = &ly->second.Buffers[slot];
+            }
+        }
+        break;
+    case BufferCache::LAYER_SIDEBAND_STREAMS:
+        {
+            auto ly = dpy->second.Layers.find(mLayer);
+            if (ly == dpy->second.Layers.end()) {
+                return Error::BAD_LAYER;
+            }
+            if (slot == 0) {
+                clone = &ly->second.SidebandStream;
+            }
+        }
+        break;
+    default:
+        break;
+    }
+
+    if (!clone) {
+        ALOGW("invalid buffer slot");
+        return Error::BAD_PARAMETER;
+    }
+
+    // use or update cache
+    if (useCache) {
+        handle = *clone;
+    } else {
+        if (!sHandleImporter.importBuffer(handle)) {
+            return Error::NO_RESOURCES;
+        }
+
+        *clone = handle;
+    }
+
+    return Error::NONE;
+}
+
+} // namespace implementation
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
diff --git a/graphics/composer/2.1/default/HwcClient.h b/graphics/composer/2.1/default/HwcClient.h
new file mode 100644
index 0000000..a9bc4cd
--- /dev/null
+++ b/graphics/composer/2.1/default/HwcClient.h
@@ -0,0 +1,202 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
+#define ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
+
+#include <mutex>
+#include <unordered_map>
+#include <vector>
+
+#include "Hwc.h"
+#include "IComposerCommandBuffer.h"
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+namespace implementation {
+
+class BufferClone {
+public:
+    BufferClone();
+    BufferClone(BufferClone&& other);
+
+    BufferClone(const BufferClone& other) = delete;
+    BufferClone& operator=(const BufferClone& other) = delete;
+
+    BufferClone& operator=(buffer_handle_t handle);
+    ~BufferClone();
+
+    operator buffer_handle_t() const { return mHandle; }
+
+private:
+    void clear();
+
+    buffer_handle_t mHandle;
+};
+
+class HwcClient : public IComposerClient {
+public:
+    HwcClient(HwcHal& hal);
+    virtual ~HwcClient();
+
+    void onHotplug(Display display, IComposerCallback::Connection connected);
+    void onRefresh(Display display);
+    void onVsync(Display display, int64_t timestamp);
+
+    // IComposerClient interface
+    Return<void> registerCallback(
+            const sp<IComposerCallback>& callback) override;
+    Return<uint32_t> getMaxVirtualDisplayCount() override;
+    Return<void> createVirtualDisplay(uint32_t width, uint32_t height,
+            PixelFormat formatHint, uint32_t outputBufferSlotCount,
+            createVirtualDisplay_cb hidl_cb) override;
+    Return<Error> destroyVirtualDisplay(Display display) override;
+    Return<void> createLayer(Display display, uint32_t bufferSlotCount,
+            createLayer_cb hidl_cb) override;
+    Return<Error> destroyLayer(Display display, Layer layer) override;
+    Return<void> getActiveConfig(Display display,
+            getActiveConfig_cb hidl_cb) override;
+    Return<Error> getClientTargetSupport(Display display,
+            uint32_t width, uint32_t height,
+            PixelFormat format, Dataspace dataspace) override;
+    Return<void> getColorModes(Display display,
+            getColorModes_cb hidl_cb) override;
+    Return<void> getDisplayAttribute(Display display,
+            Config config, Attribute attribute,
+            getDisplayAttribute_cb hidl_cb) override;
+    Return<void> getDisplayConfigs(Display display,
+            getDisplayConfigs_cb hidl_cb) override;
+    Return<void> getDisplayName(Display display,
+            getDisplayName_cb hidl_cb) override;
+    Return<void> getDisplayType(Display display,
+            getDisplayType_cb hidl_cb) override;
+    Return<void> getDozeSupport(Display display,
+            getDozeSupport_cb hidl_cb) override;
+    Return<void> getHdrCapabilities(Display display,
+            getHdrCapabilities_cb hidl_cb) override;
+    Return<Error> setActiveConfig(Display display, Config config) override;
+    Return<Error> setColorMode(Display display, ColorMode mode) override;
+    Return<Error> setPowerMode(Display display, PowerMode mode) override;
+    Return<Error> setVsyncEnabled(Display display, Vsync enabled) override;
+    Return<Error> setClientTargetSlotCount(Display display,
+            uint32_t clientTargetSlotCount) override;
+    Return<Error> setInputCommandQueue(
+            const MQDescriptorSync& descriptor) override;
+    Return<void> getOutputCommandQueue(
+            getOutputCommandQueue_cb hidl_cb) override;
+    Return<void> executeCommands(uint32_t inLength,
+            const hidl_vec<hidl_handle>& inHandles,
+            executeCommands_cb hidl_cb) override;
+
+private:
+    struct LayerBuffers {
+        std::vector<BufferClone> Buffers;
+        BufferClone SidebandStream;
+    };
+
+    struct DisplayData {
+        bool IsVirtual;
+
+        std::vector<BufferClone> ClientTargets;
+        std::vector<BufferClone> OutputBuffers;
+
+        std::unordered_map<Layer, LayerBuffers> Layers;
+
+        DisplayData(bool isVirtual) : IsVirtual(isVirtual) {}
+    };
+
+    class CommandReader : public CommandReaderBase {
+    public:
+        CommandReader(HwcClient& client);
+        Error parse();
+
+    private:
+        bool parseSelectDisplay(uint16_t length);
+        bool parseSelectLayer(uint16_t length);
+        bool parseSetColorTransform(uint16_t length);
+        bool parseSetClientTarget(uint16_t length);
+        bool parseSetOutputBuffer(uint16_t length);
+        bool parseValidateDisplay(uint16_t length);
+        bool parseAcceptDisplayChanges(uint16_t length);
+        bool parsePresentDisplay(uint16_t length);
+        bool parseSetLayerCursorPosition(uint16_t length);
+        bool parseSetLayerBuffer(uint16_t length);
+        bool parseSetLayerSurfaceDamage(uint16_t length);
+        bool parseSetLayerBlendMode(uint16_t length);
+        bool parseSetLayerColor(uint16_t length);
+        bool parseSetLayerCompositionType(uint16_t length);
+        bool parseSetLayerDataspace(uint16_t length);
+        bool parseSetLayerDisplayFrame(uint16_t length);
+        bool parseSetLayerPlaneAlpha(uint16_t length);
+        bool parseSetLayerSidebandStream(uint16_t length);
+        bool parseSetLayerSourceCrop(uint16_t length);
+        bool parseSetLayerTransform(uint16_t length);
+        bool parseSetLayerVisibleRegion(uint16_t length);
+        bool parseSetLayerZOrder(uint16_t length);
+
+        hwc_rect_t readRect();
+        std::vector<hwc_rect_t> readRegion(size_t count);
+        hwc_frect_t readFRect();
+
+        enum class BufferCache {
+            CLIENT_TARGETS,
+            OUTPUT_BUFFERS,
+            LAYER_BUFFERS,
+            LAYER_SIDEBAND_STREAMS,
+        };
+        Error lookupBuffer(BufferCache cache, uint32_t slot,
+                bool useCache, buffer_handle_t& handle);
+
+        Error lookupLayerSidebandStream(buffer_handle_t& handle)
+        {
+            return lookupBuffer(BufferCache::LAYER_SIDEBAND_STREAMS,
+                    0, false, handle);
+        }
+
+        HwcClient& mClient;
+        HwcHal& mHal;
+        CommandWriter& mWriter;
+
+        Display mDisplay;
+        Layer mLayer;
+    };
+
+    HwcHal& mHal;
+
+    // 64KiB minus a small space for metadata such as read/write pointers
+    static constexpr size_t kWriterInitialSize =
+        64 * 1024 / sizeof(uint32_t) - 16;
+    std::mutex mCommandMutex;
+    CommandReader mReader;
+    CommandWriter mWriter;
+
+    sp<IComposerCallback> mCallback;
+
+    std::mutex mDisplayDataMutex;
+    std::unordered_map<Display, DisplayData> mDisplayData;
+};
+
+} // namespace implementation
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
+
+#endif  // ANDROID_HARDWARE_GRAPHICS_COMPOSER_V2_1_HWC_CLIENT_H
diff --git a/graphics/composer/2.1/default/IComposerCommandBuffer.h b/graphics/composer/2.1/default/IComposerCommandBuffer.h
new file mode 100644
index 0000000..030db88
--- /dev/null
+++ b/graphics/composer/2.1/default/IComposerCommandBuffer.h
@@ -0,0 +1,848 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H
+#define ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H
+
+#ifndef LOG_TAG
+#warn "IComposerCommandBuffer.h included without LOG_TAG"
+#endif
+
+#undef LOG_NDEBUG
+#define LOG_NDEBUG 0
+
+#include <algorithm>
+#include <limits>
+#include <memory>
+#include <vector>
+
+#include <inttypes.h>
+#include <string.h>
+
+#include <android/hardware/graphics/composer/2.1/IComposer.h>
+#include <log/log.h>
+#include <sync/sync.h>
+#include <MessageQueue.h>
+
+namespace android {
+namespace hardware {
+namespace graphics {
+namespace composer {
+namespace V2_1 {
+
+using android::hardware::graphics::common::V1_0::ColorTransform;
+using android::hardware::graphics::common::V1_0::Dataspace;
+using android::hardware::graphics::common::V1_0::Transform;
+using android::hardware::MessageQueue;
+
+using CommandQueueType = MessageQueue<uint32_t, kSynchronizedReadWrite>;
+
+// This class helps build a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandWriter {
+public:
+    CommandWriter(uint32_t initialMaxSize)
+        : mDataMaxSize(initialMaxSize)
+    {
+        mData = std::make_unique<uint32_t[]>(mDataMaxSize);
+        reset();
+    }
+
+    ~CommandWriter()
+    {
+        reset();
+    }
+
+    void reset()
+    {
+        mDataWritten = 0;
+        mCommandEnd = 0;
+
+        // handles in mDataHandles are owned by the caller
+        mDataHandles.clear();
+
+        // handles in mTemporaryHandles are owned by the writer
+        for (auto handle : mTemporaryHandles) {
+            native_handle_close(handle);
+            native_handle_delete(handle);
+        }
+        mTemporaryHandles.clear();
+    }
+
+    IComposerClient::Command getCommand(uint32_t offset)
+    {
+        uint32_t val = (offset < mDataWritten) ? mData[offset] : 0;
+        return static_cast<IComposerClient::Command>(val &
+                static_cast<uint32_t>(IComposerClient::Command::OPCODE_MASK));
+    }
+
+    bool writeQueue(bool& queueChanged, uint32_t& commandLength,
+            hidl_vec<hidl_handle>& commandHandles)
+    {
+        // write data to queue, optionally resizing it
+        if (mQueue && (mDataMaxSize <= mQueue->getQuantumCount())) {
+            if (!mQueue->write(mData.get(), mDataWritten)) {
+                ALOGE("failed to write commands to message queue");
+                return false;
+            }
+
+            queueChanged = false;
+        } else {
+            auto newQueue = std::make_unique<CommandQueueType>(mDataMaxSize);
+            if (!newQueue->isValid() ||
+                    !newQueue->write(mData.get(), mDataWritten)) {
+                ALOGE("failed to prepare a new message queue ");
+                return false;
+            }
+
+            mQueue = std::move(newQueue);
+            queueChanged = true;
+        }
+
+        commandLength = mDataWritten;
+        commandHandles.setToExternal(
+                const_cast<hidl_handle*>(mDataHandles.data()),
+                mDataHandles.size());
+
+        return true;
+    }
+
+    const MQDescriptorSync* getMQDescriptor() const
+    {
+        return (mQueue) ? mQueue->getDesc() : nullptr;
+    }
+
+    static constexpr uint16_t kSelectDisplayLength = 2;
+    void selectDisplay(Display display)
+    {
+        beginCommand(IComposerClient::Command::SELECT_DISPLAY,
+                kSelectDisplayLength);
+        write64(display);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSelectLayerLength = 2;
+    void selectLayer(Layer layer)
+    {
+        beginCommand(IComposerClient::Command::SELECT_LAYER,
+                kSelectLayerLength);
+        write64(layer);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetErrorLength = 2;
+    void setError(uint32_t location, Error error)
+    {
+        beginCommand(IComposerClient::Command::SET_ERROR, kSetErrorLength);
+        write(location);
+        writeSigned(static_cast<int32_t>(error));
+        endCommand();
+    }
+
+    void setChangedCompositionTypes(const std::vector<Layer>& layers,
+            const std::vector<IComposerClient::Composition>& types)
+    {
+        size_t totalLayers = std::min(layers.size(), types.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength) / 3);
+
+            beginCommand(
+                    IComposerClient::Command::SET_CHANGED_COMPOSITION_TYPES,
+                    count * 3);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                writeSigned(static_cast<int32_t>(types[currentLayer + i]));
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    void setDisplayRequests(uint32_t displayRequestMask,
+            const std::vector<Layer>& layers,
+            const std::vector<uint32_t>& layerRequestMasks)
+    {
+        size_t totalLayers = std::min(layers.size(),
+                layerRequestMasks.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength - 1) / 3);
+
+            beginCommand(IComposerClient::Command::SET_DISPLAY_REQUESTS,
+                    1 + count * 3);
+            write(displayRequestMask);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                write(static_cast<int32_t>(layerRequestMasks[currentLayer + i]));
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    static constexpr uint16_t kSetPresentFenceLength = 1;
+    void setPresentFence(int presentFence)
+    {
+        beginCommand(IComposerClient::Command::SET_PRESENT_FENCE,
+                kSetPresentFenceLength);
+        writeFence(presentFence);
+        endCommand();
+    }
+
+    void setReleaseFences(const std::vector<Layer>& layers,
+            const std::vector<int>& releaseFences)
+    {
+        size_t totalLayers = std::min(layers.size(), releaseFences.size());
+        size_t currentLayer = 0;
+
+        while (currentLayer < totalLayers) {
+            size_t count = std::min(totalLayers - currentLayer,
+                    static_cast<size_t>(kMaxLength) / 3);
+
+            beginCommand(IComposerClient::Command::SET_RELEASE_FENCES,
+                    count * 3);
+            for (size_t i = 0; i < count; i++) {
+                write64(layers[currentLayer + i]);
+                writeFence(releaseFences[currentLayer + i]);
+            }
+            endCommand();
+
+            currentLayer += count;
+        }
+    }
+
+    static constexpr uint16_t kSetColorTransformLength = 17;
+    void setColorTransform(const float* matrix, ColorTransform hint)
+    {
+        beginCommand(IComposerClient::Command::SET_COLOR_TRANSFORM,
+                kSetColorTransformLength);
+        for (int i = 0; i < 16; i++) {
+            writeFloat(matrix[i]);
+        }
+        writeSigned(static_cast<int32_t>(hint));
+        endCommand();
+    }
+
+    void setClientTarget(uint32_t slot, const native_handle_t* target,
+            int acquireFence, Dataspace dataspace,
+            const std::vector<IComposerClient::Rect>& damage)
+    {
+        bool doWrite = (damage.size() <= (kMaxLength - 4) / 4);
+        size_t length = 4 + ((doWrite) ? damage.size() * 4 : 0);
+
+        beginCommand(IComposerClient::Command::SET_CLIENT_TARGET, length);
+        write(slot);
+        writeHandle(target, true);
+        writeFence(acquireFence);
+        writeSigned(static_cast<int32_t>(dataspace));
+        // When there are too many rectangles in the damage region and doWrite
+        // is false, we write no rectangle at all which means the entire
+        // client target is damaged.
+        if (doWrite) {
+            writeRegion(damage);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetOutputBufferLength = 3;
+    void setOutputBuffer(uint32_t slot, const native_handle_t* buffer,
+            int releaseFence)
+    {
+        beginCommand(IComposerClient::Command::SET_OUTPUT_BUFFER,
+                kSetOutputBufferLength);
+        write(slot);
+        writeHandle(buffer, true);
+        writeFence(releaseFence);
+        endCommand();
+    }
+
+    static constexpr uint16_t kValidateDisplayLength = 0;
+    void validateDisplay()
+    {
+        beginCommand(IComposerClient::Command::VALIDATE_DISPLAY,
+                kValidateDisplayLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kAcceptDisplayChangesLength = 0;
+    void acceptDisplayChanges()
+    {
+        beginCommand(IComposerClient::Command::ACCEPT_DISPLAY_CHANGES,
+                kAcceptDisplayChangesLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kPresentDisplayLength = 0;
+    void presentDisplay()
+    {
+        beginCommand(IComposerClient::Command::PRESENT_DISPLAY,
+                kPresentDisplayLength);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerCursorPositionLength = 2;
+    void setLayerCursorPosition(int32_t x, int32_t y)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_CURSOR_POSITION,
+                kSetLayerCursorPositionLength);
+        writeSigned(x);
+        writeSigned(y);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerBufferLength = 3;
+    void setLayerBuffer(uint32_t slot, const native_handle_t* buffer,
+            int acquireFence)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_BUFFER,
+                kSetLayerBufferLength);
+        write(slot);
+        writeHandle(buffer, true);
+        writeFence(acquireFence);
+        endCommand();
+    }
+
+    void setLayerSurfaceDamage(
+            const std::vector<IComposerClient::Rect>& damage)
+    {
+        bool doWrite = (damage.size() <= kMaxLength / 4);
+        size_t length = (doWrite) ? damage.size() * 4 : 0;
+
+        beginCommand(IComposerClient::Command::SET_LAYER_SURFACE_DAMAGE,
+                length);
+        // When there are too many rectangles in the damage region and doWrite
+        // is false, we write no rectangle at all which means the entire
+        // layer is damaged.
+        if (doWrite) {
+            writeRegion(damage);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerBlendModeLength = 1;
+    void setLayerBlendMode(IComposerClient::BlendMode mode)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_BLEND_MODE,
+                kSetLayerBlendModeLength);
+        writeSigned(static_cast<int32_t>(mode));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerColorLength = 1;
+    void setLayerColor(IComposerClient::Color color)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_COLOR,
+                kSetLayerColorLength);
+        writeColor(color);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerCompositionTypeLength = 1;
+    void setLayerCompositionType(IComposerClient::Composition type)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_COMPOSITION_TYPE,
+                kSetLayerCompositionTypeLength);
+        writeSigned(static_cast<int32_t>(type));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerDataspaceLength = 1;
+    void setLayerDataspace(Dataspace dataspace)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_DATASPACE,
+                kSetLayerDataspaceLength);
+        writeSigned(static_cast<int32_t>(dataspace));
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerDisplayFrameLength = 4;
+    void setLayerDisplayFrame(const IComposerClient::Rect& frame)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_DISPLAY_FRAME,
+                kSetLayerDisplayFrameLength);
+        writeRect(frame);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerPlaneAlphaLength = 1;
+    void setLayerPlaneAlpha(float alpha)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_PLANE_ALPHA,
+                kSetLayerPlaneAlphaLength);
+        writeFloat(alpha);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerSidebandStreamLength = 1;
+    void setLayerSidebandStream(const native_handle_t* stream)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_SIDEBAND_STREAM,
+                kSetLayerSidebandStreamLength);
+        writeHandle(stream);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerSourceCropLength = 4;
+    void setLayerSourceCrop(const IComposerClient::FRect& crop)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_SOURCE_CROP,
+                kSetLayerSourceCropLength);
+        writeFRect(crop);
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerTransformLength = 1;
+    void setLayerTransform(Transform transform)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_TRANSFORM,
+                kSetLayerTransformLength);
+        writeSigned(static_cast<int32_t>(transform));
+        endCommand();
+    }
+
+    void setLayerVisibleRegion(
+            const std::vector<IComposerClient::Rect>& visible)
+    {
+        bool doWrite = (visible.size() <= kMaxLength / 4);
+        size_t length = (doWrite) ? visible.size() * 4 : 0;
+
+        beginCommand(IComposerClient::Command::SET_LAYER_VISIBLE_REGION,
+                length);
+        // When there are too many rectangles in the visible region and
+        // doWrite is false, we write no rectangle at all which means the
+        // entire layer is visible.
+        if (doWrite) {
+            writeRegion(visible);
+        }
+        endCommand();
+    }
+
+    static constexpr uint16_t kSetLayerZOrderLength = 1;
+    void setLayerZOrder(uint32_t z)
+    {
+        beginCommand(IComposerClient::Command::SET_LAYER_Z_ORDER,
+                kSetLayerZOrderLength);
+        write(z);
+        endCommand();
+    }
+
+protected:
+    void beginCommand(IComposerClient::Command command, uint16_t length)
+    {
+        if (mCommandEnd) {
+            LOG_FATAL("endCommand was not called before command 0x%x",
+                    command);
+        }
+
+        growData(1 + length);
+        write(static_cast<uint32_t>(command) | length);
+
+        mCommandEnd = mDataWritten + length;
+    }
+
+    void endCommand()
+    {
+        if (!mCommandEnd) {
+            LOG_FATAL("beginCommand was not called");
+        } else if (mDataWritten > mCommandEnd) {
+            LOG_FATAL("too much data written");
+            mDataWritten = mCommandEnd;
+        } else if (mDataWritten < mCommandEnd) {
+            LOG_FATAL("too little data written");
+            while (mDataWritten < mCommandEnd) {
+                write(0);
+            }
+        }
+
+        mCommandEnd = 0;
+    }
+
+    void write(uint32_t val)
+    {
+        mData[mDataWritten++] = val;
+    }
+
+    void writeSigned(int32_t val)
+    {
+        memcpy(&mData[mDataWritten++], &val, sizeof(val));
+    }
+
+    void writeFloat(float val)
+    {
+        memcpy(&mData[mDataWritten++], &val, sizeof(val));
+    }
+
+    void write64(uint64_t val)
+    {
+        uint32_t lo = static_cast<uint32_t>(val & 0xffffffff);
+        uint32_t hi = static_cast<uint32_t>(val >> 32);
+        write(lo);
+        write(hi);
+    }
+
+    void writeRect(const IComposerClient::Rect& rect)
+    {
+        writeSigned(rect.left);
+        writeSigned(rect.top);
+        writeSigned(rect.right);
+        writeSigned(rect.bottom);
+    }
+
+    void writeRegion(const std::vector<IComposerClient::Rect>& region)
+    {
+        for (const auto& rect : region) {
+            writeRect(rect);
+        }
+    }
+
+    void writeFRect(const IComposerClient::FRect& rect)
+    {
+        writeFloat(rect.left);
+        writeFloat(rect.top);
+        writeFloat(rect.right);
+        writeFloat(rect.bottom);
+    }
+
+    void writeColor(const IComposerClient::Color& color)
+    {
+        write((color.r <<  0) |
+              (color.g <<  8) |
+              (color.b << 16) |
+              (color.a << 24));
+    }
+
+    // ownership of handle is not transferred
+    void writeHandle(const native_handle_t* handle, bool useCache)
+    {
+        if (!handle) {
+            writeSigned(static_cast<int32_t>((useCache) ?
+                        IComposerClient::HandleIndex::CACHED :
+                        IComposerClient::HandleIndex::EMPTY));
+            return;
+        }
+
+        mDataHandles.push_back(handle);
+        writeSigned(mDataHandles.size() - 1);
+    }
+
+    void writeHandle(const native_handle_t* handle)
+    {
+        writeHandle(handle, false);
+    }
+
+    // ownership of fence is transferred
+    void writeFence(int fence)
+    {
+        native_handle_t* handle = nullptr;
+        if (fence >= 0) {
+            handle = getTemporaryHandle(1, 0);
+            if (handle) {
+                handle->data[0] = fence;
+            } else {
+                ALOGW("failed to get temporary handle for fence %d", fence);
+                sync_wait(fence, -1);
+                close(fence);
+            }
+        }
+
+        writeHandle(handle);
+    }
+
+    native_handle_t* getTemporaryHandle(int numFds, int numInts)
+    {
+        native_handle_t* handle = native_handle_create(numFds, numInts);
+        if (handle) {
+            mTemporaryHandles.push_back(handle);
+        }
+        return handle;
+    }
+
+    static constexpr uint16_t kMaxLength =
+        std::numeric_limits<uint16_t>::max();
+
+private:
+    void growData(uint32_t grow)
+    {
+        uint32_t newWritten = mDataWritten + grow;
+        if (newWritten < mDataWritten) {
+            LOG_ALWAYS_FATAL("buffer overflowed; data written %" PRIu32
+                    ", growing by %" PRIu32, mDataWritten, grow);
+        }
+
+        if (newWritten <= mDataMaxSize) {
+            return;
+        }
+
+        uint32_t newMaxSize = mDataMaxSize << 1;
+        if (newMaxSize < newWritten) {
+            newMaxSize = newWritten;
+        }
+
+        auto newData = std::make_unique<uint32_t[]>(newMaxSize);
+        std::copy_n(mData.get(), mDataWritten, newData.get());
+        mDataMaxSize = newMaxSize;
+        mData = std::move(newData);
+    }
+
+    uint32_t mDataMaxSize;
+    std::unique_ptr<uint32_t[]> mData;
+
+    uint32_t mDataWritten;
+    // end offset of the current command
+    uint32_t mCommandEnd;
+
+    std::vector<hidl_handle> mDataHandles;
+    std::vector<native_handle_t *> mTemporaryHandles;
+
+    std::unique_ptr<CommandQueueType> mQueue;
+};
+
+// This class helps parse a command queue.  Note that all sizes/lengths are in
+// units of uint32_t's.
+class CommandReaderBase {
+public:
+    CommandReaderBase() : mDataMaxSize(0)
+    {
+        reset();
+    }
+
+    bool setMQDescriptor(const MQDescriptorSync& descriptor)
+    {
+        mQueue = std::make_unique<CommandQueueType>(descriptor, false);
+        if (mQueue->isValid()) {
+            return true;
+        } else {
+            mQueue = nullptr;
+            return false;
+        }
+    }
+
+    bool readQueue(uint32_t commandLength,
+            const hidl_vec<hidl_handle>& commandHandles)
+    {
+        if (!mQueue) {
+            return false;
+        }
+
+        auto quantumCount = mQueue->getQuantumCount();
+        if (mDataMaxSize < quantumCount) {
+            mDataMaxSize = quantumCount;
+            mData = std::make_unique<uint32_t[]>(mDataMaxSize);
+        }
+
+        if (commandLength > mDataMaxSize ||
+                !mQueue->read(mData.get(), commandLength)) {
+            ALOGE("failed to read commands from message queue");
+            return false;
+        }
+
+        mDataSize = commandLength;
+        mDataRead = 0;
+        mCommandBegin = 0;
+        mCommandEnd = 0;
+        mDataHandles.setToExternal(
+                const_cast<hidl_handle*>(commandHandles.data()),
+                commandHandles.size());
+
+        return true;
+    }
+
+    void reset()
+    {
+        mDataSize = 0;
+        mDataRead = 0;
+        mCommandBegin = 0;
+        mCommandEnd = 0;
+        mDataHandles.setToExternal(nullptr, 0);
+    }
+
+protected:
+    bool isEmpty() const
+    {
+        return (mDataRead >= mDataSize);
+    }
+
+    bool beginCommand(IComposerClient::Command& command, uint16_t& length)
+    {
+        if (mCommandEnd) {
+            LOG_FATAL("endCommand was not called before command 0x%x",
+                    command);
+        }
+
+        constexpr uint32_t opcode_mask =
+            static_cast<uint32_t>(IComposerClient::Command::OPCODE_MASK);
+        constexpr uint32_t length_mask =
+            static_cast<uint32_t>(IComposerClient::Command::LENGTH_MASK);
+
+        uint32_t val = read();
+        command = static_cast<IComposerClient::Command>(val & opcode_mask);
+        length = static_cast<uint16_t>(val & length_mask);
+
+        if (mDataRead + length > mDataSize) {
+            ALOGE("command 0x%x has invalid command length %" PRIu16,
+                    command, length);
+            // undo the read() above
+            mDataRead--;
+            return false;
+        }
+
+        mCommandEnd = mDataRead + length;
+
+        return true;
+    }
+
+    void endCommand()
+    {
+        if (!mCommandEnd) {
+            LOG_FATAL("beginCommand was not called");
+        } else if (mDataRead > mCommandEnd) {
+            LOG_FATAL("too much data read");
+            mDataRead = mCommandEnd;
+        } else if (mDataRead < mCommandEnd) {
+            LOG_FATAL("too little data read");
+            mDataRead = mCommandEnd;
+        }
+
+        mCommandBegin = mCommandEnd;
+        mCommandEnd = 0;
+    }
+
+    uint32_t getCommandLoc() const
+    {
+        return mCommandBegin;
+    }
+
+    uint32_t read()
+    {
+        return mData[mDataRead++];
+    }
+
+    int32_t readSigned()
+    {
+        int32_t val;
+        memcpy(&val, &mData[mDataRead++], sizeof(val));
+        return val;
+    }
+
+    float readFloat()
+    {
+        float val;
+        memcpy(&val, &mData[mDataRead++], sizeof(val));
+        return val;
+    }
+
+    uint64_t read64()
+    {
+        uint32_t lo = read();
+        uint32_t hi = read();
+        return (static_cast<uint64_t>(hi) << 32) | lo;
+    }
+
+    IComposerClient::Color readColor()
+    {
+        uint32_t val = read();
+        return IComposerClient::Color{
+            static_cast<uint8_t>((val >>  0) & 0xff),
+            static_cast<uint8_t>((val >>  8) & 0xff),
+            static_cast<uint8_t>((val >> 16) & 0xff),
+            static_cast<uint8_t>((val >> 24) & 0xff),
+        };
+    }
+
+    // ownership of handle is not transferred
+    const native_handle_t* readHandle(bool& useCache)
+    {
+        const native_handle_t* handle = nullptr;
+
+        int32_t index = readSigned();
+        switch (index) {
+        case static_cast<int32_t>(IComposerClient::HandleIndex::EMPTY):
+            useCache = false;
+            break;
+        case static_cast<int32_t>(IComposerClient::HandleIndex::CACHED):
+            useCache = true;
+            break;
+        default:
+            if (static_cast<size_t>(index) < mDataHandles.size()) {
+                handle = mDataHandles[index].getNativeHandle();
+            } else {
+                ALOGE("invalid handle index %zu", static_cast<size_t>(index));
+            }
+            useCache = false;
+            break;
+        }
+
+        return handle;
+    }
+
+    const native_handle_t* readHandle()
+    {
+        bool useCache;
+        return readHandle(useCache);
+    }
+
+    // ownership of fence is transferred
+    int readFence()
+    {
+        auto handle = readHandle();
+        if (!handle || handle->numFds == 0) {
+            return -1;
+        }
+
+        if (handle->numFds != 1) {
+            ALOGE("invalid fence handle with %d fds", handle->numFds);
+            return -1;
+        }
+
+        int fd = dup(handle->data[0]);
+        if (fd < 0) {
+            ALOGW("failed to dup fence %d", handle->data[0]);
+            sync_wait(handle->data[0], -1);
+            fd = -1;
+        }
+
+        return fd;
+    }
+
+private:
+    std::unique_ptr<CommandQueueType> mQueue;
+    uint32_t mDataMaxSize;
+    std::unique_ptr<uint32_t[]> mData;
+
+    uint32_t mDataSize;
+    uint32_t mDataRead;
+
+    // begin/end offsets of the current command
+    uint32_t mCommandBegin;
+    uint32_t mCommandEnd;
+
+    hidl_vec<hidl_handle> mDataHandles;
+};
+
+} // namespace V2_1
+} // namespace composer
+} // namespace graphics
+} // namespace hardware
+} // namespace android
+
+#endif // ANDROID_HARDWARE_GRAPHICS_COMPOSER_COMMAND_BUFFER_H