diff --git a/awt/Android.mk b/awt/Android.mk
index c7480f5..213c6ce 100644
--- a/awt/Android.mk
+++ b/awt/Android.mk
@@ -28,4 +28,4 @@
 
 LOCAL_DX_FLAGS := --core-library
 
-include $(BUILD_JAVA_LIBRARY)
+#include $(BUILD_JAVA_LIBRARY)
diff --git a/camera/libcameraservice/CameraService.cpp b/camera/libcameraservice/CameraService.cpp
index 022fe5a..e4b6791 100644
--- a/camera/libcameraservice/CameraService.cpp
+++ b/camera/libcameraservice/CameraService.cpp
@@ -504,8 +504,7 @@
     }
 
     // start recording mode
-    ret = mHardware->startRecording(recordingCallback,
-                                    mCameraService.get());
+    ret = mHardware->startRecording(recordingCallback, mCameraService.get());
     if (ret != NO_ERROR) {
         LOGE("mHardware->startRecording() failed with status %d", ret);
     }
@@ -798,7 +797,7 @@
 }
 
 // recording callback
-void CameraService::Client::recordingCallback(const sp<IMemory>& mem, void* user)
+void CameraService::Client::recordingCallback(nsecs_t timestamp, const sp<IMemory>& mem, void* user)
 {
     LOGV("recordingCallback");
     sp<Client> client = getClientFromCookie(user);
@@ -806,7 +805,7 @@
         return;
     }
     // The strong pointer guarantees the client will exist, but no lock is held.
-    client->postRecordingFrame(mem);
+    client->postRecordingFrame(timestamp, mem);
 }
 
 // take a picture - image is returned in callback
@@ -1072,14 +1071,14 @@
     mCameraClient->dataCallback(CAMERA_MSG_PREVIEW_FRAME, frame);
 }
 
-void CameraService::Client::postRecordingFrame(const sp<IMemory>& frame)
+void CameraService::Client::postRecordingFrame(nsecs_t timestamp, const sp<IMemory>& frame)
 {
     LOGV("postRecordingFrame");
     if (frame == 0) {
         LOGW("frame is a null pointer");
         return;
     }
-    mCameraClient->dataCallback(CAMERA_MSG_VIDEO_FRAME, frame);
+    mCameraClient->dataCallbackTimestamp(timestamp, CAMERA_MSG_VIDEO_FRAME, frame);
 }
 
 void CameraService::Client::postPreviewFrame(const sp<IMemory>& mem)
diff --git a/camera/libcameraservice/CameraService.h b/camera/libcameraservice/CameraService.h
index 0f07673..ea93789 100644
--- a/camera/libcameraservice/CameraService.h
+++ b/camera/libcameraservice/CameraService.h
@@ -132,7 +132,7 @@
 
                     status_t    checkPid();
 
-        static      void        recordingCallback(const sp<IMemory>& mem, void* user);
+        static      void        recordingCallback(nsecs_t timestamp, const sp<IMemory>& mem, void* user);
         static      void        previewCallback(const sp<IMemory>& mem, void* user);
         static      void        shutterCallback(void *user);
         static      void        yuvPictureCallback(const sp<IMemory>& mem, void* user);
@@ -144,7 +144,7 @@
                     void        postRaw(const sp<IMemory>& mem);
                     void        postJpeg(const sp<IMemory>& mem);
                     void        postPreviewFrame(const sp<IMemory>& mem);
-                    void        postRecordingFrame(const sp<IMemory>& frame);
+                    void        postRecordingFrame(nsecs_t timestamp, const sp<IMemory>& frame);
                     void        copyFrameAndPostCopiedFrame(sp<IMemoryHeap> heap, size_t offset, size_t size);
                     void        postError(status_t error);
                     void        postAutoFocus(bool focused);
diff --git a/cmds/keystore/keystore_get.h b/cmds/keystore/keystore_get.h
index a7fd9a5..7665e81 100644
--- a/cmds/keystore/keystore_get.h
+++ b/cmds/keystore/keystore_get.h
@@ -29,7 +29,7 @@
  * is returned. Otherwise it returns the value in dynamically allocated memory
  * and sets the size if the pointer is not NULL. One can release the memory by
  * calling free(). */
-static char *keystore_get(char *key, int *size)
+static char *keystore_get(const char *key, int *size)
 {
     char buffer[MAX_KEY_VALUE_LENGTH];
     char *value;
diff --git a/include/ui/Camera.h b/include/ui/Camera.h
index e3544ab..afb07b5 100644
--- a/include/ui/Camera.h
+++ b/include/ui/Camera.h
@@ -18,6 +18,7 @@
 #ifndef ANDROID_HARDWARE_CAMERA_H
 #define ANDROID_HARDWARE_CAMERA_H
 
+#include <utils/Timers.h>
 #include <ui/ICameraClient.h>
 
 namespace android {
@@ -94,6 +95,7 @@
 public:
     virtual void notify(int32_t msgType, int32_t ext1, int32_t ext2) = 0;
     virtual void postData(int32_t msgType, const sp<IMemory>& dataPtr) = 0;
+    virtual void postDataTimestamp(nsecs_t timestamp, int32_t msgType, const sp<IMemory>& dataPtr) = 0;
 };
 
 class Camera : public BnCameraClient, public IBinder::DeathRecipient
@@ -155,6 +157,7 @@
     // ICameraClient interface
     virtual void        notifyCallback(int32_t msgType, int32_t ext, int32_t ext2);
     virtual void        dataCallback(int32_t msgType, const sp<IMemory>& dataPtr);
+    virtual void        dataCallbackTimestamp(nsecs_t timestamp, int32_t msgType, const sp<IMemory>& dataPtr);
 
     sp<ICamera>         remote();
 
diff --git a/include/ui/CameraHardwareInterface.h b/include/ui/CameraHardwareInterface.h
index 73036f0..822b4a8 100644
--- a/include/ui/CameraHardwareInterface.h
+++ b/include/ui/CameraHardwareInterface.h
@@ -28,7 +28,7 @@
 typedef void (*preview_callback)(const sp<IMemory>& mem, void* user);
 
 /** Callback for startRecord() */
-typedef void (*recording_callback)(const sp<IMemory>& mem, void* user);
+typedef void (*recording_callback)(nsecs_t timestamp, const sp<IMemory>& mem, void* user);
 
 /** Callback for takePicture() */
 typedef void (*shutter_callback)(void* user);
diff --git a/include/ui/ICameraClient.h b/include/ui/ICameraClient.h
index c4bdd07..1001c71 100644
--- a/include/ui/ICameraClient.h
+++ b/include/ui/ICameraClient.h
@@ -21,6 +21,7 @@
 #include <utils/IInterface.h>
 #include <utils/Parcel.h>
 #include <utils/IMemory.h>
+#include <utils/Timers.h>
 
 namespace android {
 
@@ -31,7 +32,7 @@
 
     virtual void            notifyCallback(int32_t msgType, int32_t ext1, int32_t ext2) = 0;
     virtual void            dataCallback(int32_t msgType, const sp<IMemory>& data) = 0;
-
+    virtual void            dataCallbackTimestamp(nsecs_t timestamp, int32_t msgType, const sp<IMemory>& data) = 0;
 };
 
 // ----------------------------------------------------------------------------
diff --git a/include/utils/ResourceTypes.h b/include/utils/ResourceTypes.h
index 93bca4a..edd0cae 100644
--- a/include/utils/ResourceTypes.h
+++ b/include/utils/ResourceTypes.h
@@ -825,7 +825,11 @@
     };
     
     enum {
-        DENSITY_ANY = 0
+        DENSITY_DEFAULT = 0,
+        DENSITY_LOW = 120,
+        DENSITY_MEDIUM = 160,
+        DENSITY_HIGH = 240,
+        DENSITY_NONE = 0xffff
     };
     
     union {
@@ -854,7 +858,6 @@
     
     enum {
         MASK_KEYSHIDDEN = 0x0003,
-        SHIFT_KEYSHIDDEN = 0,
         KEYSHIDDEN_ANY = 0x0000,
         KEYSHIDDEN_NO = 0x0001,
         KEYSHIDDEN_YES = 0x0002,
@@ -906,10 +909,18 @@
     };
     
     enum {
-        SCREENLAYOUT_ANY  = 0x0000,
-        SCREENLAYOUT_SMALL = 0x0001,
-        SCREENLAYOUT_NORMAL = 0x0002,
-        SCREENLAYOUT_LARGE = 0x0003,
+        // screenLayout bits for screen size class.
+        MASK_SCREENSIZE = 0x0f,
+        SCREENSIZE_ANY  = 0x00,
+        SCREENSIZE_SMALL = 0x01,
+        SCREENSIZE_NORMAL = 0x02,
+        SCREENSIZE_LARGE = 0x03,
+        
+        // screenLayout bits for wide/long screen variation.
+        MASK_SCREENLONG = 0x30,
+        SCREENLONG_ANY = 0x00,
+        SCREENLONG_NO = 0x10,
+        SCREENLONG_YES = 0x20,
     };
     
     union {
@@ -1039,6 +1050,17 @@
             }
         }
 
+        if (screenConfig || o.screenConfig) {
+            if (((screenLayout^o.screenLayout) & MASK_SCREENSIZE) != 0) {
+                if (!(screenLayout & MASK_SCREENSIZE)) return false;
+                if (!(o.screenLayout & MASK_SCREENSIZE)) return true;
+            }
+            if (((screenLayout^o.screenLayout) & MASK_SCREENLONG) != 0) {
+                if (!(screenLayout & MASK_SCREENLONG)) return false;
+                if (!(o.screenLayout & MASK_SCREENLONG)) return true;
+            }
+        }
+
         if (screenType || o.screenType) {
             if (orientation != o.orientation) {
                 if (!orientation) return false;
@@ -1055,7 +1077,7 @@
         }
 
         if (input || o.input) {
-            if (inputFlags != o.inputFlags) {
+            if (((inputFlags^o.inputFlags) & MASK_KEYSHIDDEN) != 0) {
                 if (!(inputFlags & MASK_KEYSHIDDEN)) return false;
                 if (!(o.inputFlags & MASK_KEYSHIDDEN)) return true;
             }
@@ -1083,13 +1105,6 @@
             }
         }
 
-        if (screenConfig || o.screenConfig) {
-            if (screenLayout != o.screenLayout) {
-                if (!screenLayout) return false;
-                if (!o.screenLayout) return true;
-            }
-        }
-
         if (version || o.version) {
             if (sdkVersion != o.sdkVersion) {
                 if (!sdkVersion) return false;
@@ -1138,6 +1153,17 @@
                 }
             }
 
+            if (screenConfig || o.screenConfig) {
+                if (((screenLayout^o.screenLayout) & MASK_SCREENSIZE) != 0
+                        && (requested->screenLayout & MASK_SCREENSIZE)) {
+                    return (screenLayout & MASK_SCREENSIZE);
+                }
+                if (((screenLayout^o.screenLayout) & MASK_SCREENLONG) != 0
+                        && (requested->screenLayout & MASK_SCREENLONG)) {
+                    return (screenLayout & MASK_SCREENLONG);
+                }
+            }
+
             if (screenType || o.screenType) {
                 if ((orientation != o.orientation) && requested->orientation) {
                     return (orientation);
@@ -1219,12 +1245,6 @@
                 }
             }
 
-            if (screenConfig || o.screenConfig) {
-                if ((screenLayout != o.screenLayout) && requested->screenLayout) {
-                    return (screenLayout);
-                }
-            }
-
             if (version || o.version) {
                 if ((sdkVersion != o.sdkVersion) && requested->sdkVersion) {
                     return (sdkVersion);
@@ -1272,6 +1292,21 @@
                 return false;
             }
         }
+        if (screenConfig != 0) {
+            const int screenSize = screenLayout&MASK_SCREENSIZE;
+            const int setScreenSize = settings.screenLayout&MASK_SCREENSIZE;
+            if (setScreenSize != 0 && screenSize != 0
+                    && screenSize != setScreenSize) {
+                return false;
+            }
+            
+            const int screenLong = screenLayout&MASK_SCREENLONG;
+            const int setScreenLong = settings.screenLayout&MASK_SCREENLONG;
+            if (setScreenLong != 0 && screenLong != 0
+                    && screenLong != setScreenLong) {
+                return false;
+            }
+        }
         if (screenType != 0) {
             if (settings.orientation != 0 && orientation != 0
                 && orientation != settings.orientation) {
@@ -1316,12 +1351,6 @@
                 return false;
             }
         }
-        if (screenConfig != 0) {
-            if (settings.screenLayout != 0 && screenLayout != 0
-                && screenLayout != settings.screenLayout) {
-                return false;
-            }
-        }
         if (version != 0) {
             if (settings.sdkVersion != 0 && sdkVersion != 0
                 && sdkVersion != settings.sdkVersion) {
@@ -1351,12 +1380,14 @@
     String8 toString() const {
         char buf[200];
         sprintf(buf, "imsi=%d/%d lang=%c%c reg=%c%c orient=%d touch=%d dens=%d "
-                "kbd=%d nav=%d input=%d scrnW=%d scrnH=%d layout=%d vers=%d.%d",
+                "kbd=%d nav=%d input=%d scrnW=%d scrnH=%d sz=%d long=%d vers=%d.%d",
                 mcc, mnc,
                 language[0] ? language[0] : '-', language[1] ? language[1] : '-',
                 country[0] ? country[0] : '-', country[1] ? country[1] : '-',
                 orientation, touchscreen, density, keyboard, navigation, inputFlags,
-                screenWidth, screenHeight, screenLayout, sdkVersion, minorVersion);
+                screenWidth, screenHeight,
+                screenLayout&MASK_SCREENSIZE, screenLayout&MASK_SCREENLONG,
+                sdkVersion, minorVersion);
         return String8(buf);
     }
 };
diff --git a/include/utils/String8.h b/include/utils/String8.h
index c49faf6..ecc5774 100644
--- a/include/utils/String8.h
+++ b/include/utils/String8.h
@@ -29,11 +29,107 @@
 
 // ---------------------------------------------------------------------------
 
+extern "C" {
+
+typedef uint32_t char32_t;
+
+size_t strlen32(const char32_t *);
+size_t strnlen32(const char32_t *, size_t);
+
+/*
+ * Returns the length of "src" when "src" is valid UTF-8 string.
+ * Returns 0 if src is NULL, 0-length string or non UTF-8 string.
+ * This function should be used to determine whether "src" is valid UTF-8
+ * characters with valid unicode codepoints. "src" must be null-terminated.
+ *
+ * If you are going to use other GetUtf... functions defined in this header
+ * with string which may not be valid UTF-8 with valid codepoint (form 0 to
+ * 0x10FFFF), you should use this function before calling others, since the
+ * other functions do not check whether the string is valid UTF-8 or not.
+ *
+ * If you do not care whether "src" is valid UTF-8 or not, you should use
+ * strlen() as usual, which should be much faster.
+ */
+size_t utf8_length(const char *src);
+
+/*
+ * Returns the UTF-32 length of "src".
+ */
+size_t utf32_length(const char *src, size_t src_len);
+
+/*
+ * Returns the UTF-8 length of "src".
+ */
+size_t utf8_length_from_utf32(const char32_t *src, size_t src_len);
+
+/*
+ * Returns the unicode value at "index".
+ * Returns -1 when the index is invalid (equals to or more than "src_len").
+ * If returned value is positive, it is able to be converted to char32_t, which
+ * is unsigned. Then, if "next_index" is not NULL, the next index to be used is
+ * stored in "next_index". "next_index" can be NULL.
+ */
+int32_t utf32_at(const char *src, size_t src_len,
+                 size_t index, size_t *next_index);
+
+/*
+ * Stores a UTF-32 string converted from "src" in "dst", if "dst_length" is not
+ * large enough to store the string, the part of the "src" string is stored
+ * into "dst".
+ * Returns the size actually used for storing the string.
+ * "dst" is not null-terminated when dst_len is fully used (like strncpy).
+ */
+size_t utf8_to_utf32(const char* src, size_t src_len,
+                     char32_t* dst, size_t dst_len);
+
+/*
+ * Stores a UTF-8 string converted from "src" in "dst", if "dst_length" is not
+ * large enough to store the string, the part of the "src" string is stored
+ * into "dst" as much as possible. See the examples for more detail.
+ * Returns the size actually used for storing the string.
+ * dst" is not null-terminated when dst_len is fully used (like strncpy).
+ *
+ * Example 1
+ * "src" == \u3042\u3044 (\xE3\x81\x82\xE3\x81\x84)
+ * "src_len" == 2
+ * "dst_len" >= 7
+ * ->
+ * Returned value == 6
+ * "dst" becomes \xE3\x81\x82\xE3\x81\x84\0
+ * (note that "dst" is null-terminated)
+ *
+ * Example 2
+ * "src" == \u3042\u3044 (\xE3\x81\x82\xE3\x81\x84)
+ * "src_len" == 2
+ * "dst_len" == 5
+ * ->
+ * Returned value == 3
+ * "dst" becomes \xE3\x81\x82\0
+ * (note that "dst" is null-terminated, but \u3044 is not stored in "dst"
+ * since "dst" does not have enough size to store the character)
+ *
+ * Example 3
+ * "src" == \u3042\u3044 (\xE3\x81\x82\xE3\x81\x84)
+ * "src_len" == 2
+ * "dst_len" == 6
+ * ->
+ * Returned value == 6
+ * "dst" becomes \xE3\x81\x82\xE3\x81\x84
+ * (note that "dst" is NOT null-terminated, like strncpy)
+ */
+size_t utf32_to_utf8(const char32_t* src, size_t src_len,
+                     char* dst, size_t dst_len);
+
+}
+
+// ---------------------------------------------------------------------------
+
 namespace android {
 
 class TextOutput;
 
-//! This is a string holding UTF-8 characters.
+//! This is a string holding UTF-8 characters. Does not allow the value more
+// than 0x10FFFF, which is not valid unicode codepoint.
 class String8
 {
 public:
@@ -45,7 +141,8 @@
     explicit                    String8(const String16& o);
     explicit                    String8(const char16_t* o);
     explicit                    String8(const char16_t* o, size_t numChars);
-    
+    explicit                    String8(const char32_t* o);
+    explicit                    String8(const char32_t* o, size_t numChars);
                                 ~String8();
     
     inline  const char*         string() const;
@@ -59,11 +156,20 @@
             status_t            setTo(const char* other);
             status_t            setTo(const char* other, size_t numChars);
             status_t            setTo(const char16_t* other, size_t numChars);
-    
+            status_t            setTo(const char32_t* other,
+                                      size_t length);
+
             status_t            append(const String8& other);
             status_t            append(const char* other);
             status_t            append(const char* other, size_t numChars);
 
+            // Note that this function takes O(N) time to calculate the value.
+            // No cache value is stored.
+            size_t              getUtf32Length() const;
+            int32_t             getUtf32At(size_t index,
+                                           size_t *next_index) const;
+            size_t              getUtf32(char32_t* dst, size_t dst_len) const;
+
     inline  String8&            operator=(const String8& other);
     inline  String8&            operator=(const char* other);
     
@@ -103,7 +209,7 @@
             void                toLower(size_t start, size_t numChars);
             void                toUpper();
             void                toUpper(size_t start, size_t numChars);
-            
+
     /*
      * These methods operate on the string as if it were a path name.
      */
@@ -346,7 +452,7 @@
     return mString;
 }
 
-}; // namespace android
+}  // namespace android
 
 // ---------------------------------------------------------------------------
 
diff --git a/libs/audioflinger/AudioFlinger.cpp b/libs/audioflinger/AudioFlinger.cpp
index 8a19fbd..f5bdeda 100644
--- a/libs/audioflinger/AudioFlinger.cpp
+++ b/libs/audioflinger/AudioFlinger.cpp
@@ -738,12 +738,13 @@
 
 bool AudioFlinger::isMusicActive() const
 {
+    Mutex::Autolock _l(mLock);
  #ifdef WITH_A2DP
      if (isA2dpEnabled()) {
-         return mA2dpMixerThread->isMusicActive();
+         return mA2dpMixerThread->isMusicActive_l();
      }
  #endif
-    return mHardwareMixerThread->isMusicActive();
+    return mHardwareMixerThread->isMusicActive_l();
 }
 
 status_t AudioFlinger::setParameter(const char* key, const char* value)
@@ -1444,7 +1445,8 @@
     return mStreamTypes[stream].mute;
 }
 
-bool AudioFlinger::MixerThread::isMusicActive() const
+// isMusicActive_l() must be called with AudioFlinger::mLock held
+bool AudioFlinger::MixerThread::isMusicActive_l() const
 {
     size_t count = mActiveTracks.size();
     for (size_t i = 0 ; i < count ; ++i) {
@@ -2030,7 +2032,10 @@
     inBuffer.i16 = data;
     
     if (mCblk->user == 0) {
-        if (mOutputMixerThread->isMusicActive()) {
+        mOutputMixerThread->mAudioFlinger->mLock.lock();
+        bool isMusicActive = mOutputMixerThread->isMusicActive_l();
+        mOutputMixerThread->mAudioFlinger->mLock.unlock();
+        if (isMusicActive) {
             mCblk->forceReady = 1;
             LOGV("OutputTrack::start() force ready");
         } else if (mCblk->frameCount > frames){
diff --git a/libs/audioflinger/AudioFlinger.h b/libs/audioflinger/AudioFlinger.h
index 8e47b29..634934e 100644
--- a/libs/audioflinger/AudioFlinger.h
+++ b/libs/audioflinger/AudioFlinger.h
@@ -463,7 +463,7 @@
         virtual     float       streamVolume(int stream) const;
         virtual     bool        streamMute(int stream) const;
 
-                    bool        isMusicActive() const;
+                    bool        isMusicActive_l() const;
         
                     
                     sp<Track>   createTrack_l(
diff --git a/libs/surfaceflinger/Android.mk b/libs/surfaceflinger/Android.mk
index 9272983..ec5aa3f 100644
--- a/libs/surfaceflinger/Android.mk
+++ b/libs/surfaceflinger/Android.mk
@@ -15,7 +15,6 @@
     LayerBitmap.cpp \
     LayerDim.cpp \
     LayerOrientationAnim.cpp \
-    LayerOrientationAnimRotate.cpp \
     OrientationAnimation.cpp \
     SurfaceFlinger.cpp \
     Tokenizer.cpp \
diff --git a/libs/surfaceflinger/LayerOrientationAnim.cpp b/libs/surfaceflinger/LayerOrientationAnim.cpp
index 3e4035e..79e5328 100644
--- a/libs/surfaceflinger/LayerOrientationAnim.cpp
+++ b/libs/surfaceflinger/LayerOrientationAnim.cpp
@@ -46,10 +46,7 @@
 // Animation...
 const float DURATION = ms2ns(200);
 const float BOUNCES_PER_SECOND = 0.5f;
-//const float BOUNCES_AMPLITUDE = 1.0f/16.0f;
-const float BOUNCES_AMPLITUDE = 0;
 const float DIM_TARGET = 0.40f;
-//#define INTERPOLATED_TIME(_t)   ((_t)*(_t))
 #define INTERPOLATED_TIME(_t)   (_t)
 
 // ---------------------------------------------------------------------------
@@ -64,14 +61,8 @@
       mTextureName(-1), mTextureNameIn(-1)
 {
     // blur that texture. 
-    mStartTime = systemTime();
-    mFinishTime = 0;
     mOrientationCompleted = false;
-    mFirstRedraw = false;
-    mLastNormalizedTime = 0;
     mNeedsBlending = false;
-    mAlphaInLerp.set(1.0f, DIM_TARGET);
-    mAlphaOutLerp.set(0.5f, 1.0f);
 }
 
 LayerOrientationAnim::~LayerOrientationAnim()
@@ -117,108 +108,37 @@
 
 void LayerOrientationAnim::onOrientationCompleted()
 {
-    mFinishTime = systemTime();
-    mOrientationCompleted = true;
-    mFirstRedraw = true;
-    mNeedsBlending = true;
-    mFlinger->invalidateLayerVisibility(this);
+    mAnim->onAnimationFinished();
 }
 
 void LayerOrientationAnim::onDraw(const Region& clip) const
 {
-    const nsecs_t now = systemTime();
-    float alphaIn, alphaOut;
+    float alphaIn =  DIM_TARGET;
     
-    if (mOrientationCompleted) {
-        if (mFirstRedraw) {
-            mFirstRedraw = false;
-            
-            // make a copy of what's on screen
-            copybit_image_t image;
-            mBitmapOut.getBitmapSurface(&image);
-            const DisplayHardware& hw(graphicPlane(0).displayHardware());
-            hw.copyBackToImage(image);
-
-            // and erase the screen for this round
-            glDisable(GL_BLEND);
-            glDisable(GL_DITHER);
-            glDisable(GL_SCISSOR_TEST);
-            glClearColor(0,0,0,0);
-            glClear(GL_COLOR_BUFFER_BIT);
-            
-            // FIXME: code below is gross
-            mNeedsBlending = false;
-            LayerOrientationAnim* self(const_cast<LayerOrientationAnim*>(this));
-            mFlinger->invalidateLayerVisibility(self);
-        }
-
-        // make sure pick-up where we left off
-        const float duration = DURATION * mLastNormalizedTime;
-        const float normalizedTime = (float(now - mFinishTime) / duration);
-        if (normalizedTime <= 1.0f) {
-            const float interpolatedTime = INTERPOLATED_TIME(normalizedTime);
-            alphaIn = mAlphaInLerp.getOut();
-            alphaOut = mAlphaOutLerp(interpolatedTime);
-        } else {
-            mAnim->onAnimationFinished();
-            alphaIn = mAlphaInLerp.getOut();
-            alphaOut = mAlphaOutLerp.getOut();
-        }
-    } else {
-        const float normalizedTime = float(now - mStartTime) / DURATION;
-        if (normalizedTime <= 1.0f) {
-            mLastNormalizedTime = normalizedTime;
-            const float interpolatedTime = INTERPOLATED_TIME(normalizedTime);
-            alphaIn = mAlphaInLerp(interpolatedTime);
-            alphaOut = 0.0f;
-        } else {
-            mLastNormalizedTime = 1.0f;
-            const float to_seconds = DURATION / seconds(1);
-            alphaIn = mAlphaInLerp.getOut();
-            if (BOUNCES_AMPLITUDE > 0.0f) {
-                const float phi = BOUNCES_PER_SECOND * 
-                        (((normalizedTime - 1.0f) * to_seconds)*M_PI*2);
-                if (alphaIn > 1.0f) alphaIn = 1.0f;
-                else if (alphaIn < 0.0f) alphaIn = 0.0f;
-                alphaIn += BOUNCES_AMPLITUDE * (1.0f - cosf(phi));
-            }
-            alphaOut = 0.0f;
-        }
-        mAlphaOutLerp.setIn(alphaIn);
+    // clear screen
+    // TODO: with update on demand, we may be able 
+    // to not erase the screen at all during the animation 
+    if (!mOrientationCompleted) {
+        glDisable(GL_BLEND);
+        glDisable(GL_DITHER);
+        glDisable(GL_SCISSOR_TEST);
+        glClearColor(0,0,0,0);
+        glClear(GL_COLOR_BUFFER_BIT);
     }
-    drawScaled(1.0f, alphaIn, alphaOut);
-}
-
-void LayerOrientationAnim::drawScaled(float scale, float alphaIn, float alphaOut) const
-{
+    
     copybit_image_t dst;
     const GraphicPlane& plane(graphicPlane(0));
     const DisplayHardware& hw(plane.displayHardware());
     hw.getDisplaySurface(&dst);
 
-    // clear screen
-    // TODO: with update on demand, we may be able 
-    // to not erase the screen at all during the animation 
-    if (!mOrientationCompleted) {
-        if (scale==1.0f && (alphaIn>=1.0f || alphaOut>=1.0f)) {
-            // we don't need to erase the screen in that case
-        } else {
-            glDisable(GL_BLEND);
-            glDisable(GL_DITHER);
-            glDisable(GL_SCISSOR_TEST);
-            glClearColor(0,0,0,0);
-            glClear(GL_COLOR_BUFFER_BIT);
-        }
-    }
-    
     copybit_image_t src;
     mBitmapIn.getBitmapSurface(&src);
 
     copybit_image_t srcOut;
     mBitmapOut.getBitmapSurface(&srcOut);
 
-    const int w = dst.w*scale; 
-    const int h = dst.h*scale; 
+    const int w = dst.w; 
+    const int h = dst.h; 
     const int xc = uint32_t(dst.w-w)/2;
     const int yc = uint32_t(dst.h-h)/2;
     const copybit_rect_t drect = { xc, yc, xc+w, yc+h }; 
@@ -237,13 +157,7 @@
             copybit->set_parameter(copybit, COPYBIT_BLUR, COPYBIT_ENABLE);
             copybit->set_parameter(copybit, COPYBIT_PLANE_ALPHA, int(alphaIn*255));
             err = copybit->stretch(copybit, &dst, &src, &drect, &srect, &it);
-        }
-
-        if (!err && alphaOut > 0.0f) {
-            region_iterator it(reg);
             copybit->set_parameter(copybit, COPYBIT_BLUR, COPYBIT_DISABLE);
-            copybit->set_parameter(copybit, COPYBIT_PLANE_ALPHA, int(alphaOut*255));
-            err = copybit->stretch(copybit, &dst, &srcOut, &drect, &srect, &it);
         }
         LOGE_IF(err != NO_ERROR, "copybit failed (%s)", strerror(err));
     }
@@ -258,7 +172,6 @@
         t.data = (GGLubyte*)(intptr_t(src.base) + src.offset);
 
         Transform tr;
-        tr.set(scale,0,0,scale);
         tr.set(xc, yc);
         
         // FIXME: we should not access mVertices and mDrawingState like that,
@@ -285,18 +198,6 @@
             self.mDrawingState.alpha = int(alphaIn*255);
             drawWithOpenGL(reg, mTextureNameIn, t);
         }
-
-        if (alphaOut > 0.0f) {
-            t.data = (GGLubyte*)(intptr_t(srcOut.base) + srcOut.offset);
-            if (UNLIKELY(mTextureName == -1LU)) {
-                mTextureName = createTexture();
-                GLuint w=0, h=0;
-                const Region dirty(Rect(t.width, t.height));
-                loadTexture(dirty, mTextureName, t, w, h);
-            }
-            self.mDrawingState.alpha = int(alphaOut*255);
-            drawWithOpenGL(reg, mTextureName, t);
-        }
     }
 }
 
diff --git a/libs/surfaceflinger/LayerOrientationAnim.h b/libs/surfaceflinger/LayerOrientationAnim.h
index 365c6ae..12b6f1c 100644
--- a/libs/surfaceflinger/LayerOrientationAnim.h
+++ b/libs/surfaceflinger/LayerOrientationAnim.h
@@ -64,45 +64,13 @@
     virtual bool needsBlending() const;
     virtual bool isSecure() const       { return false; }
 private:
-    void drawScaled(float scale, float alphaIn, float alphaOut) const;
-
-    class Lerp {
-        float in;
-        float outMinusIn;
-    public:
-        Lerp() : in(0), outMinusIn(0) { }
-        Lerp(float in, float out) : in(in), outMinusIn(out-in) { }
-        float getIn() const { return in; };
-        float getOut() const { return in + outMinusIn; }
-        void set(float in, float out) { 
-            this->in = in; 
-            this->outMinusIn = out-in; 
-        }
-        void setIn(float in) { 
-            this->in = in; 
-        }
-        void setOut(float out) { 
-            this->outMinusIn = out - this->in; 
-        }
-        float operator()(float t) const { 
-            return outMinusIn*t + in; 
-        }
-    };
-    
     OrientationAnimation* mAnim;
     LayerBitmap mBitmapIn;
     LayerBitmap mBitmapOut;
-    nsecs_t mStartTime;
-    nsecs_t mFinishTime;
     bool mOrientationCompleted;
-    mutable bool mFirstRedraw;
-    mutable float mLastNormalizedTime;
     mutable GLuint  mTextureName;
     mutable GLuint  mTextureNameIn;
     mutable bool mNeedsBlending;
-    
-    mutable Lerp mAlphaInLerp;
-    mutable Lerp mAlphaOutLerp;
 };
 
 // ---------------------------------------------------------------------------
diff --git a/libs/surfaceflinger/LayerOrientationAnimRotate.cpp b/libs/surfaceflinger/LayerOrientationAnimRotate.cpp
deleted file mode 100644
index 89ffb19..0000000
--- a/libs/surfaceflinger/LayerOrientationAnimRotate.cpp
+++ /dev/null
@@ -1,274 +0,0 @@
-/*
- * Copyright (C) 2007 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "SurfaceFlinger"
-
-#include <stdlib.h>
-#include <stdint.h>
-#include <sys/types.h>
-
-#include <utils/Errors.h>
-#include <utils/Log.h>
-
-#include <core/SkBitmap.h>
-
-#include <ui/EGLDisplaySurface.h>
-
-#include "LayerBase.h"
-#include "LayerOrientationAnim.h"
-#include "LayerOrientationAnimRotate.h"
-#include "SurfaceFlinger.h"
-#include "DisplayHardware/DisplayHardware.h"
-#include "OrientationAnimation.h"
-
-namespace android {
-// ---------------------------------------------------------------------------
-
-const uint32_t LayerOrientationAnimRotate::typeInfo = LayerBase::typeInfo | 0x100;
-const char* const LayerOrientationAnimRotate::typeID = "LayerOrientationAnimRotate";
-
-// ---------------------------------------------------------------------------
-
-const float ROTATION = M_PI * 0.5f;
-const float ROTATION_FACTOR = 1.0f; // 1.0 or 2.0
-const float DURATION = ms2ns(200);
-const float BOUNCES_PER_SECOND = 0.8;
-const float BOUNCES_AMPLITUDE = (5.0f/180.f) * M_PI;
-
-LayerOrientationAnimRotate::LayerOrientationAnimRotate(
-        SurfaceFlinger* flinger, DisplayID display, 
-        OrientationAnimation* anim, 
-        const LayerBitmap& bitmap,
-        const LayerBitmap& bitmapIn)
-    : LayerOrientationAnimBase(flinger, display), mAnim(anim), 
-      mBitmap(bitmap), mBitmapIn(bitmapIn), 
-      mTextureName(-1), mTextureNameIn(-1)
-{
-    mStartTime = systemTime();
-    mFinishTime = 0;
-    mOrientationCompleted = false;
-    mFirstRedraw = false;
-    mLastNormalizedTime = 0;
-    mLastAngle = 0;
-    mLastScale = 0;
-    mNeedsBlending = false;
-    const GraphicPlane& plane(graphicPlane(0));
-    mOriginalTargetOrientation = plane.getOrientation(); 
-}
-
-LayerOrientationAnimRotate::~LayerOrientationAnimRotate()
-{
-    if (mTextureName != -1U) {
-        LayerBase::deletedTextures.add(mTextureName);
-    }
-    if (mTextureNameIn != -1U) {
-        LayerBase::deletedTextures.add(mTextureNameIn);
-    }
-}
-
-bool LayerOrientationAnimRotate::needsBlending() const 
-{
-    return mNeedsBlending; 
-}
-
-Point LayerOrientationAnimRotate::getPhysicalSize() const
-{
-    const GraphicPlane& plane(graphicPlane(0));
-    const DisplayHardware& hw(plane.displayHardware());
-    return Point(hw.getWidth(), hw.getHeight());
-}
-
-void LayerOrientationAnimRotate::validateVisibility(const Transform&)
-{
-    const Layer::State& s(drawingState());
-    const Transform tr(s.transform);
-    const Point size(getPhysicalSize());
-    uint32_t w = size.x;
-    uint32_t h = size.y;
-    mTransformedBounds = tr.makeBounds(w, h);
-    mLeft = tr.tx();
-    mTop  = tr.ty();
-    transparentRegionScreen.clear();
-    mTransformed = true;
-    mCanUseCopyBit = false;
-}
-
-void LayerOrientationAnimRotate::onOrientationCompleted()
-{
-    mFinishTime = systemTime();
-    mOrientationCompleted = true;
-    mFirstRedraw = true;
-    mNeedsBlending = true;
-    mFlinger->invalidateLayerVisibility(this);
-}
-
-void LayerOrientationAnimRotate::onDraw(const Region& clip) const
-{
-    // Animation...
-
-    const nsecs_t now = systemTime();
-    float angle, scale, alpha;
-    
-    if (mOrientationCompleted) {
-        if (mFirstRedraw) {
-            // make a copy of what's on screen
-            copybit_image_t image;
-            mBitmapIn.getBitmapSurface(&image);
-            const DisplayHardware& hw(graphicPlane(0).displayHardware());
-            hw.copyBackToImage(image);
-            
-            // FIXME: code below is gross
-            mFirstRedraw = false; 
-            mNeedsBlending = false;
-            LayerOrientationAnimRotate* self(const_cast<LayerOrientationAnimRotate*>(this));
-            mFlinger->invalidateLayerVisibility(self);
-        }
-
-        // make sure pick-up where we left off
-        const float duration = DURATION * mLastNormalizedTime;
-        const float normalizedTime = (float(now - mFinishTime) / duration);
-        if (normalizedTime <= 1.0f) {
-            const float squaredTime = normalizedTime*normalizedTime;
-            angle = (ROTATION*ROTATION_FACTOR - mLastAngle)*squaredTime + mLastAngle;
-            scale = (1.0f - mLastScale)*squaredTime + mLastScale;
-            alpha = normalizedTime;
-        } else {
-            mAnim->onAnimationFinished();
-            angle = ROTATION;
-            alpha = 1.0f;
-            scale = 1.0f;
-        }
-    } else {
-        // FIXME: works only for portrait framebuffers
-        const Point size(getPhysicalSize());
-        const float TARGET_SCALE = size.x * (1.0f / size.y);
-        const float normalizedTime = float(now - mStartTime) / DURATION;
-        if (normalizedTime <= 1.0f) {
-            mLastNormalizedTime = normalizedTime;
-            const float squaredTime = normalizedTime*normalizedTime;
-            angle = ROTATION * squaredTime;
-            scale = (TARGET_SCALE - 1.0f)*squaredTime + 1.0f;
-            alpha = 0;
-        } else {
-            mLastNormalizedTime = 1.0f;
-            angle = ROTATION;
-            if (BOUNCES_AMPLITUDE) {
-                const float to_seconds = DURATION / seconds(1);
-                const float phi = BOUNCES_PER_SECOND * 
-                (((normalizedTime - 1.0f) * to_seconds)*M_PI*2);
-                angle += BOUNCES_AMPLITUDE * sinf(phi);
-            }
-            scale = TARGET_SCALE;
-            alpha = 0;
-        }
-        mLastAngle = angle;
-        mLastScale = scale;
-    }
-    drawScaled(angle, scale, alpha);
-}
-
-void LayerOrientationAnimRotate::drawScaled(float f, float s, float alpha) const
-{
-    copybit_image_t dst;
-    const GraphicPlane& plane(graphicPlane(0));
-    const DisplayHardware& hw(plane.displayHardware());
-    hw.getDisplaySurface(&dst);
-
-    // clear screen
-    // TODO: with update on demand, we may be able 
-    // to not erase the screen at all during the animation 
-    glDisable(GL_BLEND);
-    glDisable(GL_DITHER);
-    glDisable(GL_SCISSOR_TEST);
-    glClearColor(0,0,0,0);
-    glClear(GL_COLOR_BUFFER_BIT);
-    
-    const int w = dst.w; 
-    const int h = dst.h; 
-
-    copybit_image_t src;
-    mBitmap.getBitmapSurface(&src);
-    const copybit_rect_t srect = { 0, 0, src.w, src.h };
-
-
-    GGLSurface t;
-    t.version = sizeof(GGLSurface);
-    t.width  = src.w;
-    t.height = src.h;
-    t.stride = src.w;
-    t.vstride= src.h;
-    t.format = src.format;
-    t.data = (GGLubyte*)(intptr_t(src.base) + src.offset);
-
-    if (!mOriginalTargetOrientation) {
-        f = -f;
-    }
-
-    Transform tr;
-    tr.set(f, w*0.5f, h*0.5f);
-    tr.scale(s, w*0.5f, h*0.5f);
-
-    // FIXME: we should not access mVertices and mDrawingState like that,
-    // but since we control the animation, we know it's going to work okay.
-    // eventually we'd need a more formal way of doing things like this.
-    LayerOrientationAnimRotate& self(const_cast<LayerOrientationAnimRotate&>(*this));
-    tr.transform(self.mVertices[0], 0, 0);
-    tr.transform(self.mVertices[1], 0, src.h);
-    tr.transform(self.mVertices[2], src.w, src.h);
-    tr.transform(self.mVertices[3], src.w, 0);
-
-    if (!(mFlags & DisplayHardware::SLOW_CONFIG)) {
-        // Too slow to do this in software
-        self.mDrawingState.flags |= ISurfaceComposer::eLayerFilter;
-    }
-
-    if (UNLIKELY(mTextureName == -1LU)) {
-        mTextureName = createTexture();
-        GLuint w=0, h=0;
-        const Region dirty(Rect(t.width, t.height));
-        loadTexture(dirty, mTextureName, t, w, h);
-    }
-    self.mDrawingState.alpha = 255; //-int(alpha*255);
-    const Region clip(Rect( srect.l, srect.t, srect.r, srect.b ));
-    drawWithOpenGL(clip, mTextureName, t);
-    
-    if (alpha > 0) {
-        const float sign = (!mOriginalTargetOrientation) ? 1.0f : -1.0f;
-        tr.set(f + sign*(M_PI * 0.5f * ROTATION_FACTOR), w*0.5f, h*0.5f);
-        tr.scale(s, w*0.5f, h*0.5f);
-        tr.transform(self.mVertices[0], 0, 0);
-        tr.transform(self.mVertices[1], 0, src.h);
-        tr.transform(self.mVertices[2], src.w, src.h);
-        tr.transform(self.mVertices[3], src.w, 0);
-
-        copybit_image_t src;
-        mBitmapIn.getBitmapSurface(&src);
-        t.data = (GGLubyte*)(intptr_t(src.base) + src.offset);
-        if (UNLIKELY(mTextureNameIn == -1LU)) {
-            mTextureNameIn = createTexture();
-            GLuint w=0, h=0;
-            const Region dirty(Rect(t.width, t.height));
-            loadTexture(dirty, mTextureNameIn, t, w, h);
-        }
-        self.mDrawingState.alpha = int(alpha*255);
-        const Region clip(Rect( srect.l, srect.t, srect.r, srect.b ));
-        drawWithOpenGL(clip, mTextureNameIn, t);
-    }
-}
-
-// ---------------------------------------------------------------------------
-
-}; // namespace android
diff --git a/libs/surfaceflinger/LayerOrientationAnimRotate.h b/libs/surfaceflinger/LayerOrientationAnimRotate.h
deleted file mode 100644
index 5fbbd42..0000000
--- a/libs/surfaceflinger/LayerOrientationAnimRotate.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2007 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef ANDROID_LAYER_ORIENTATION_ANIM_ROTATE_H
-#define ANDROID_LAYER_ORIENTATION_ANIM_ROTATE_H
-
-#include <stdint.h>
-#include <sys/types.h>
-#include <utils/threads.h>
-#include <utils/Parcel.h>
-
-#include "LayerBase.h"
-#include "LayerBitmap.h"
-
-namespace android {
-
-// ---------------------------------------------------------------------------
-class OrientationAnimation;
-
-class LayerOrientationAnimRotate : public LayerOrientationAnimBase
-{
-public:    
-    static const uint32_t typeInfo;
-    static const char* const typeID;
-    virtual char const* getTypeID() const { return typeID; }
-    virtual uint32_t getTypeInfo() const { return typeInfo; }
-    
-    LayerOrientationAnimRotate(SurfaceFlinger* flinger, DisplayID display,
-                        OrientationAnimation* anim, 
-                        const LayerBitmap& zoomOut,
-                        const LayerBitmap& zoomIn);
-        virtual ~LayerOrientationAnimRotate();
-
-            void onOrientationCompleted();
-
-    virtual void onDraw(const Region& clip) const;
-    virtual Point getPhysicalSize() const;
-    virtual void validateVisibility(const Transform& globalTransform);
-    virtual bool needsBlending() const;
-    virtual bool isSecure() const       { return false; }
-private:
-    void drawScaled(float angle, float scale, float alpha) const;
-    
-    OrientationAnimation* mAnim;
-    LayerBitmap mBitmap;
-    LayerBitmap mBitmapIn;
-    nsecs_t mStartTime;
-    nsecs_t mFinishTime;
-    bool mOrientationCompleted;
-    int mOriginalTargetOrientation;
-    mutable bool mFirstRedraw;
-    mutable float mLastNormalizedTime;
-    mutable float mLastAngle;
-    mutable float mLastScale;
-    mutable GLuint  mTextureName;
-    mutable GLuint  mTextureNameIn;
-    mutable bool mNeedsBlending;
-};
-
-// ---------------------------------------------------------------------------
-
-}; // namespace android
-
-#endif // ANDROID_LAYER_ORIENTATION_ANIM_ROTATE_H
diff --git a/libs/surfaceflinger/OrientationAnimation.cpp b/libs/surfaceflinger/OrientationAnimation.cpp
index 70eec8d..12c0eef 100644
--- a/libs/surfaceflinger/OrientationAnimation.cpp
+++ b/libs/surfaceflinger/OrientationAnimation.cpp
@@ -21,7 +21,6 @@
 #include <limits.h>
 
 #include "LayerOrientationAnim.h"
-#include "LayerOrientationAnimRotate.h"
 #include "OrientationAnimation.h"
 #include "SurfaceFlinger.h"
 #include "VRamHeap.h"
@@ -112,13 +111,8 @@
 
     LayerOrientationAnimBase* l;
     
-    if (mType & 0x80) {
-        l = new LayerOrientationAnimRotate(
-                mFlinger.get(), 0, this, bitmap, bitmapIn);
-    } else {
-        l = new LayerOrientationAnim(
-                mFlinger.get(), 0, this, bitmap, bitmapIn);
-    }
+    l = new LayerOrientationAnim(
+            mFlinger.get(), 0, this, bitmap, bitmapIn);
 
     l->initStates(w, h, 0);
     l->setLayer(INT_MAX-1);
@@ -137,7 +131,7 @@
         return true;
         
     }
-    mLayerOrientationAnim->invalidate();
+    //mLayerOrientationAnim->invalidate();
     return false;
 }
 
diff --git a/libs/surfaceflinger/SurfaceFlinger.cpp b/libs/surfaceflinger/SurfaceFlinger.cpp
index ef4a8ea..fb25663 100644
--- a/libs/surfaceflinger/SurfaceFlinger.cpp
+++ b/libs/surfaceflinger/SurfaceFlinger.cpp
@@ -1236,6 +1236,13 @@
 {
     LayerBaseClient* layer = 0;
     sp<LayerBaseClient::Surface> surfaceHandle;
+
+    if (int32_t(w|h) < 0) {
+        LOGE("createSurface() failed, w or h is negative (w=%d, h=%d)",
+                int(w), int(h));
+        return surfaceHandle;
+    }
+    
     Mutex::Autolock _l(mStateLock);
     Client* const c = mClientsMap.valueFor(clientId);
     if (UNLIKELY(!c)) {
diff --git a/libs/ui/Camera.cpp b/libs/ui/Camera.cpp
index 975594f..5015379 100644
--- a/libs/ui/Camera.cpp
+++ b/libs/ui/Camera.cpp
@@ -310,6 +310,19 @@
     }
 }
 
+// callback from camera service when timestamped frame is ready
+void Camera::dataCallbackTimestamp(nsecs_t timestamp, int32_t msgType, const sp<IMemory>& dataPtr)
+{
+    sp<CameraListener> listener;
+    {
+        Mutex::Autolock _l(mLock);
+        listener = mListener;
+    }
+    if (listener != NULL) {
+        listener->postDataTimestamp(timestamp, msgType, dataPtr);
+    }
+}
+
 void Camera::binderDied(const wp<IBinder>& who) {
     LOGW("ICamera died");
     notifyCallback(CAMERA_MSG_ERROR, CAMERA_ERROR_SERVER_DIED, 0);
diff --git a/libs/ui/ICameraClient.cpp b/libs/ui/ICameraClient.cpp
index c6cf75c..59a6cf2 100644
--- a/libs/ui/ICameraClient.cpp
+++ b/libs/ui/ICameraClient.cpp
@@ -27,6 +27,7 @@
 enum {
     NOTIFY_CALLBACK = IBinder::FIRST_CALL_TRANSACTION,
     DATA_CALLBACK,
+    DATA_CALLBACK_TIMESTAMP,
 };
 
 class BpCameraClient: public BpInterface<ICameraClient>
@@ -60,6 +61,17 @@
         remote()->transact(DATA_CALLBACK, data, &reply, IBinder::FLAG_ONEWAY);
     }
 
+    // generic data callback from camera service to app with image data
+    void dataCallbackTimestamp(nsecs_t timestamp, int32_t msgType, const sp<IMemory>& imageData)
+    {
+        LOGV("dataCallback");
+        Parcel data, reply;
+        data.writeInterfaceToken(ICameraClient::getInterfaceDescriptor());
+        data.writeInt64(timestamp);
+        data.writeInt32(msgType);
+        data.writeStrongBinder(imageData->asBinder());
+        remote()->transact(DATA_CALLBACK_TIMESTAMP, data, &reply, IBinder::FLAG_ONEWAY);
+    }
 };
 
 IMPLEMENT_META_INTERFACE(CameraClient, "android.hardware.ICameraClient");
@@ -86,13 +98,22 @@
             return NO_ERROR;
         } break;
         case DATA_CALLBACK: {
-            LOGV("RAW_CALLBACK");
+            LOGV("DATA_CALLBACK");
             CHECK_INTERFACE(ICameraClient, data, reply);
             int32_t msgType = data.readInt32();
             sp<IMemory> imageData = interface_cast<IMemory>(data.readStrongBinder());
             dataCallback(msgType, imageData);
             return NO_ERROR;
         } break;
+        case DATA_CALLBACK_TIMESTAMP: {
+            LOGV("DATA_CALLBACK_TIMESTAMP");
+            CHECK_INTERFACE(ICameraClient, data, reply);
+            nsecs_t timestamp = data.readInt64();
+            int32_t msgType = data.readInt32();
+            sp<IMemory> imageData = interface_cast<IMemory>(data.readStrongBinder());
+            dataCallbackTimestamp(timestamp, msgType, imageData);
+            return NO_ERROR;
+        } break;
         default:
             return BBinder::onTransact(code, data, reply, flags);
     }
diff --git a/libs/utils/ResourceTypes.cpp b/libs/utils/ResourceTypes.cpp
index 109f28d..4dca8bd 100644
--- a/libs/utils/ResourceTypes.cpp
+++ b/libs/utils/ResourceTypes.cpp
@@ -1573,7 +1573,6 @@
 status_t ResTable::add(ResTable* src)
 {
     mError = src->mError;
-    mParams = src->mParams;
     
     for (size_t i=0; i<src->mHeaders.size(); i++) {
         mHeaders.add(src->mHeaders[i]);
@@ -4008,7 +4007,16 @@
                         printf("      NON-INTEGER ResTable_type ADDRESS: %p\n", type);
                         continue;
                     }
-                    printf("      config %d lang=%c%c cnt=%c%c orien=%d touch=%d density=%d key=%d infl=%d nav=%d w=%d h=%d lyt=%d\n",
+                    char density[16];
+                    uint16_t dval = dtohs(type->config.density);
+                    if (dval == ResTable_config::DENSITY_DEFAULT) {
+                        strcpy(density, "def");
+                    } else if (dval == ResTable_config::DENSITY_NONE) {
+                        strcpy(density, "no");
+                    } else {
+                        sprintf(density, "%d", (int)dval);
+                    }
+                    printf("      config %d lang=%c%c cnt=%c%c orien=%d touch=%d density=%s key=%d infl=%d nav=%d w=%d h=%d sz=%d lng=%d\n",
                            (int)configIndex,
                            type->config.language[0] ? type->config.language[0] : '-',
                            type->config.language[1] ? type->config.language[1] : '-',
@@ -4016,13 +4024,14 @@
                            type->config.country[1] ? type->config.country[1] : '-',
                            type->config.orientation,
                            type->config.touchscreen,
-                           dtohs(type->config.density),
+                           density,
                            type->config.keyboard,
                            type->config.inputFlags,
                            type->config.navigation,
                            dtohs(type->config.screenWidth),
                            dtohs(type->config.screenHeight),
-                           type->config.screenLayout);
+                           type->config.screenLayout&ResTable_config::MASK_SCREENSIZE,
+                           type->config.screenLayout&ResTable_config::MASK_SCREENLONG);
                     size_t entryCount = dtohl(type->entryCount);
                     uint32_t entriesStart = dtohl(type->entriesStart);
                     if ((entriesStart&0x3) != 0) {
diff --git a/libs/utils/String8.cpp b/libs/utils/String8.cpp
index c50d343..e908ec1 100644
--- a/libs/utils/String8.cpp
+++ b/libs/utils/String8.cpp
@@ -25,25 +25,39 @@
 
 #include <ctype.h>
 
-namespace android {
+/*
+ * Functions outside android is below the namespace android, since they use
+ * functions and constants in android namespace.
+ */
 
 // ---------------------------------------------------------------------------
 
-static const uint32_t kByteMask = 0x000000BF;
-static const uint32_t kByteMark = 0x00000080;
+namespace android {
+
+static const char32_t kByteMask = 0x000000BF;
+static const char32_t kByteMark = 0x00000080;
 
 // Surrogates aren't valid for UTF-32 characters, so define some
 // constants that will let us screen them out.
-static const uint32_t kUnicodeSurrogateHighStart  = 0x0000D800;
-static const uint32_t kUnicodeSurrogateHighEnd    = 0x0000DBFF;
-static const uint32_t kUnicodeSurrogateLowStart   = 0x0000DC00;
-static const uint32_t kUnicodeSurrogateLowEnd     = 0x0000DFFF;
-static const uint32_t kUnicodeSurrogateStart      = kUnicodeSurrogateHighStart;
-static const uint32_t kUnicodeSurrogateEnd        = kUnicodeSurrogateLowEnd;
+static const char32_t kUnicodeSurrogateHighStart  = 0x0000D800;
+static const char32_t kUnicodeSurrogateHighEnd    = 0x0000DBFF;
+static const char32_t kUnicodeSurrogateLowStart   = 0x0000DC00;
+static const char32_t kUnicodeSurrogateLowEnd     = 0x0000DFFF;
+static const char32_t kUnicodeSurrogateStart      = kUnicodeSurrogateHighStart;
+static const char32_t kUnicodeSurrogateEnd        = kUnicodeSurrogateLowEnd;
+static const char32_t kUnicodeMaxCodepoint        = 0x0010FFFF;
 
 // Mask used to set appropriate bits in first byte of UTF-8 sequence,
 // indexed by number of bytes in the sequence.
-static const uint32_t kFirstByteMark[] = {
+// 0xxxxxxx
+// -> (00-7f) 7bit. Bit mask for the first byte is 0x00000000
+// 110yyyyx 10xxxxxx
+// -> (c0-df)(80-bf) 11bit. Bit mask is 0x000000C0
+// 1110yyyy 10yxxxxx 10xxxxxx
+// -> (e0-ef)(80-bf)(80-bf) 16bit. Bit mask is 0x000000E0
+// 11110yyy 10yyxxxx 10xxxxxx 10xxxxxx
+// -> (f0-f7)(80-bf)(80-bf)(80-bf) 21bit. Bit mask is 0x000000F0
+static const char32_t kFirstByteMark[] = {
     0x00000000, 0x00000000, 0x000000C0, 0x000000E0, 0x000000F0
 };
 
@@ -52,7 +66,7 @@
 #define RES_PATH_SEPARATOR '/'
 
 // Return number of utf8 bytes required for the character.
-static size_t utf32_to_utf8_bytes(uint32_t srcChar)
+static size_t utf32_to_utf8_bytes(char32_t srcChar)
 {
     size_t bytesToWrite;
 
@@ -79,7 +93,7 @@
         }
     }
     // Max code point for Unicode is 0x0010FFFF.
-    else if (srcChar < 0x00110000)
+    else if (srcChar <= kUnicodeMaxCodepoint)
     {
         bytesToWrite = 4;
     }
@@ -94,7 +108,7 @@
 
 // Write out the source character to <dstP>.
 
-static void utf32_to_utf8(uint8_t* dstP, uint32_t srcChar, size_t bytes)
+static void utf32_to_utf8(uint8_t* dstP, char32_t srcChar, size_t bytes)
 {
     dstP += bytes;
     switch (bytes)
@@ -126,7 +140,7 @@
 	  // Bite me, Darwin!
 		gDarwinIsReallyAnnoying = gDarwinCantLoadAllObjects;
 #endif
-			
+
     SharedBuffer* buf = SharedBuffer::alloc(1);
     char* str = (char*)buf->data();
     *str = 0;
@@ -160,20 +174,20 @@
     return getEmptyString();
 }
 
-// Note: not dealing with expanding surrogate pairs.
-static char* allocFromUTF16(const char16_t* in, size_t len)
+template<typename T, typename L>
+static char* allocFromUTF16OrUTF32(const T* in, L len)
 {
     if (len == 0) return getEmptyString();
-    
+
     size_t bytes = 0;
-    const char16_t* end = in+len;
-    const char16_t* p = in;
-    
+    const T* end = in+len;
+    const T* p = in;
+
     while (p < end) {
         bytes += utf32_to_utf8_bytes(*p);
         p++;
     }
-    
+
     SharedBuffer* buf = SharedBuffer::alloc(bytes+1);
     LOG_ASSERT(buf, "Unable to allocate shared buffer");
     if (buf) {
@@ -181,19 +195,30 @@
         char* str = (char*)buf->data();
         char* d = str;
         while (p < end) {
-            uint32_t c = *p++;
+            const T c = *p++;
             size_t len = utf32_to_utf8_bytes(c);
             utf32_to_utf8((uint8_t*)d, c, len);
             d += len;
         }
         *d = 0;
-        
+
         return str;
     }
-    
+
     return getEmptyString();
 }
 
+// Note: not dealing with expanding surrogate pairs.
+static char* allocFromUTF16(const char16_t* in, size_t len)
+{
+    return allocFromUTF16OrUTF32<char16_t, size_t>(in, len);
+}
+
+static char* allocFromUTF32(const char32_t* in, size_t len)
+{
+    return allocFromUTF16OrUTF32<char32_t, size_t>(in, len);
+}
+
 // ---------------------------------------------------------------------------
 
 String8::String8()
@@ -238,6 +263,16 @@
 {
 }
 
+String8::String8(const char32_t* o)
+    : mString(allocFromUTF32(o, strlen32(o)))
+{
+}
+
+String8::String8(const char32_t* o, size_t len)
+    : mString(allocFromUTF32(o, len))
+{
+}
+
 String8::~String8()
 {
     SharedBuffer::bufferFromData(mString)->release();
@@ -280,6 +315,16 @@
     return NO_MEMORY;
 }
 
+status_t String8::setTo(const char32_t* other, size_t len)
+{
+    SharedBuffer::bufferFromData(mString)->release();
+    mString = allocFromUTF32(other, len);
+    if (mString) return NO_ERROR;
+
+    mString = getEmptyString();
+    return NO_MEMORY;
+}
+
 status_t String8::append(const String8& other)
 {
     const size_t otherLen = other.bytes();
@@ -418,6 +463,21 @@
     unlockBuffer(len);
 }
 
+size_t String8::getUtf32Length() const
+{
+    return utf32_length(mString, length());
+}
+
+int32_t String8::getUtf32At(size_t index, size_t *next_index) const
+{
+    return utf32_at(mString, length(), index, next_index);
+}
+
+size_t String8::getUtf32(char32_t* dst, size_t dst_len) const
+{
+    return utf8_to_utf32(mString, length(), dst, dst_len);
+}
+
 TextOutput& operator<<(TextOutput& to, const String8& val)
 {
     to << val.string();
@@ -427,7 +487,6 @@
 // ---------------------------------------------------------------------------
 // Path functions
 
-
 void String8::setPathName(const char* name)
 {
     setPathName(name, strlen(name));
@@ -600,5 +659,192 @@
     return *this;
 }
 
-
 }; // namespace android
+
+// ---------------------------------------------------------------------------
+
+size_t strlen32(const char32_t *s)
+{
+  const char32_t *ss = s;
+  while ( *ss )
+    ss++;
+  return ss-s;
+}
+
+size_t strnlen32(const char32_t *s, size_t maxlen)
+{
+  const char32_t *ss = s;
+  while ((maxlen > 0) && *ss) {
+    ss++;
+    maxlen--;
+  }
+  return ss-s;
+}
+
+size_t utf8_length(const char *src)
+{
+    const char *cur = src;
+    size_t ret = 0;
+    while (*cur != '\0') {
+        const char first_char = *cur++;
+        if ((first_char & 0x80) == 0) { // ASCII
+            ret += 1;
+            continue;
+        }
+        // (UTF-8's character must not be like 10xxxxxx,
+        //  but 110xxxxx, 1110xxxx, ... or 1111110x)
+        if ((first_char & 0x40) == 0) {
+            return 0;
+        }
+
+        int32_t mask, to_ignore_mask;
+        size_t num_to_read = 0;
+        char32_t utf32 = 0;
+        for (num_to_read = 1, mask = 0x40, to_ignore_mask = 0x80;
+             num_to_read < 5 && (first_char & mask);
+             num_to_read++, to_ignore_mask |= mask, mask >>= 1) {
+            if ((*cur & 0xC0) != 0x80) { // must be 10xxxxxx
+                return 0;
+            }
+            // 0x3F == 00111111
+            utf32 = (utf32 << 6) + (*cur++ & 0x3F);
+        }
+        // "first_char" must be (110xxxxx - 11110xxx)
+        if (num_to_read == 5) {
+            return 0;
+        }
+        to_ignore_mask |= mask;
+        utf32 |= ((~to_ignore_mask) & first_char) << (6 * (num_to_read - 1));
+        if (utf32 > android::kUnicodeMaxCodepoint) {
+            return 0;
+        }
+
+        ret += num_to_read;
+    }
+    return ret;
+}
+
+size_t utf32_length(const char *src, size_t src_len)
+{
+    if (src == NULL || src_len == 0) {
+        return 0;
+    }
+    size_t ret = 0;
+    const char* cur;
+    const char* end;
+    size_t num_to_skip;
+    for (cur = src, end = src + src_len, num_to_skip = 1;
+         cur < end;
+         cur += num_to_skip, ret++) {
+        const char first_char = *cur;
+        num_to_skip = 1;
+        if ((first_char & 0x80) == 0) {  // ASCII
+            continue;
+        }
+        int32_t mask;
+
+        for (mask = 0x40; (first_char & mask); num_to_skip++, mask >>= 1) {
+        }
+    }
+    return ret;
+}
+
+size_t utf8_length_from_utf32(const char32_t *src, size_t src_len)
+{
+    if (src == NULL || src_len == 0) {
+        return 0;
+    }
+    size_t ret = 0;
+    const char32_t *end = src + src_len;
+    while (src < end) {
+        ret += android::utf32_to_utf8_bytes(*src++);
+    }
+    return ret;
+}
+
+static int32_t utf32_at_internal(const char* cur, size_t *num_read)
+{
+    const char first_char = *cur;
+    if ((first_char & 0x80) == 0) { // ASCII
+        *num_read = 1;
+        return *cur;
+    }
+    cur++;
+    char32_t mask, to_ignore_mask;
+    size_t num_to_read = 0;
+    char32_t utf32 = first_char;
+    for (num_to_read = 1, mask = 0x40, to_ignore_mask = 0xFFFFFF80;
+         (first_char & mask);
+         num_to_read++, to_ignore_mask |= mask, mask >>= 1) {
+        // 0x3F == 00111111
+        utf32 = (utf32 << 6) + (*cur++ & 0x3F);
+    }
+    to_ignore_mask |= mask;
+    utf32 &= ~(to_ignore_mask << (6 * (num_to_read - 1)));
+
+    *num_read = num_to_read;
+    return static_cast<int32_t>(utf32);
+}
+
+int32_t utf32_at(const char *src, size_t src_len,
+                 size_t index, size_t *next_index)
+{
+    if (index >= src_len) {
+        return -1;
+    }
+    size_t dummy_index;
+    if (next_index == NULL) {
+        next_index = &dummy_index;
+    }
+    size_t num_read;
+    int32_t ret = utf32_at_internal(src + index, &num_read);
+    if (ret >= 0) {
+        *next_index = index + num_read;
+    }
+
+    return ret;
+}
+
+size_t utf8_to_utf32(const char* src, size_t src_len,
+                     char32_t* dst, size_t dst_len)
+{
+    if (src == NULL || src_len == 0 || dst == NULL || dst_len == 0) {
+        return 0;
+    }
+
+    const char* cur = src;
+    const char* end = src + src_len;
+    char32_t* cur_utf32 = dst;
+    const char32_t* end_utf32 = dst + dst_len;
+    while (cur_utf32 < end_utf32 && cur < end) {
+        size_t num_read;
+        *cur_utf32++ =
+                static_cast<char32_t>(utf32_at_internal(cur, &num_read));
+        cur += num_read;
+    }
+    if (cur_utf32 < end_utf32) {
+        *cur_utf32 = 0;
+    }
+    return static_cast<size_t>(cur_utf32 - dst);
+}
+
+size_t utf32_to_utf8(const char32_t* src, size_t src_len,
+                     char* dst, size_t dst_len)
+{
+    if (src == NULL || src_len == 0 || dst == NULL || dst_len == 0) {
+        return 0;
+    }
+    const char32_t *cur_utf32 = src;
+    const char32_t *end_utf32 = src + src_len;
+    char *cur = dst;
+    const char *end = dst + dst_len;
+    while (cur_utf32 < end_utf32 && cur < end) {
+        size_t len = android::utf32_to_utf8_bytes(*cur_utf32);
+        android::utf32_to_utf8((uint8_t *)cur, *cur_utf32++, len);
+        cur += len;
+    }
+    if (cur < end) {
+        *cur = '\0';
+    }
+    return cur - dst;
+}
diff --git a/libs/utils/ZipUtils.cpp b/libs/utils/ZipUtils.cpp
index 5df94cb..9138878 100644
--- a/libs/utils/ZipUtils.cpp
+++ b/libs/utils/ZipUtils.cpp
@@ -210,7 +210,7 @@
             LOGV("+++ reading %ld bytes (%ld left)\n",
                 getSize, compRemaining);
 
-            int cc = fread(readBuf, getSize, 1, fp);
+            int cc = fread(readBuf, 1, getSize, fp);
             if (cc != (int) getSize) {
                 LOGD("inflate read failed (%d vs %ld)\n",
                     cc, getSize);
@@ -341,4 +341,3 @@
 
     return true;
 }
-
diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index c44478d..4461567 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -1103,7 +1103,7 @@
         // default value
         if (binarySearch<config_pair_t>(
                 (config_pair_t const*)attrib_list,
-                0, numAttributes,
+                0, numAttributes-1,
                 config_defaults[j].key) < 0)
         {
             for (int i=0 ; i<numConfigs ; i++) {
diff --git a/opengl/libs/EGL/egl.cpp b/opengl/libs/EGL/egl.cpp
index de323b3..c6e0f50 100644
--- a/opengl/libs/EGL/egl.cpp
+++ b/opengl/libs/EGL/egl.cpp
@@ -799,7 +799,7 @@
     EGLint patch_index = -1;
     GLint attr;
     size_t size = 0;
-    while ((attr=attrib_list[size])) {
+    while ((attr=attrib_list[size]) != EGL_NONE) {
         if (attr == EGL_CONFIG_ID)
             patch_index = size;
         size += 2;
diff --git a/vpn/java/android/net/vpn/VpnManager.java b/vpn/java/android/net/vpn/VpnManager.java
index dc70b26..0bf2346 100644
--- a/vpn/java/android/net/vpn/VpnManager.java
+++ b/vpn/java/android/net/vpn/VpnManager.java
@@ -42,6 +42,15 @@
     public static final String BROADCAST_PROFILE_NAME = "profile_name";
     /** Key to the connectivity state of a connectivity broadcast event. */
     public static final String BROADCAST_CONNECTION_STATE = "connection_state";
+    /** Key to the error code of a connectivity broadcast event. */
+    public static final String BROADCAST_ERROR_CODE = "err";
+    /** Error code to indicate an error from authentication. */
+    public static final int VPN_ERROR_AUTH = 1;
+    /** Error code to indicate the connection attempt failed. */
+    public static final int VPN_ERROR_CONNECTION_FAILED = 2;
+    /** Error code to indicate the server is not known. */
+    public static final int VPN_ERROR_UNKNOWN_SERVER = 3;
+    private static final int VPN_ERROR_NO_ERROR = 0;
 
     public static final String PROFILES_PATH = "/data/misc/vpn/profiles";
 
@@ -52,7 +61,8 @@
     private static final String ACTION_VPN_SERVICE = PACKAGE_PREFIX + "SERVICE";
 
     // Action to start VPN settings
-    private static final String ACTION_VPN_SETTINGS = PACKAGE_PREFIX + "SETTINGS";
+    private static final String ACTION_VPN_SETTINGS =
+            PACKAGE_PREFIX + "SETTINGS";
 
     private static final String TAG = VpnManager.class.getSimpleName();
 
@@ -130,9 +140,18 @@
 
     /** Broadcasts the connectivity state of the specified profile. */
     public void broadcastConnectivity(String profileName, VpnState s) {
+        broadcastConnectivity(profileName, s, VPN_ERROR_NO_ERROR);
+    }
+
+    /** Broadcasts the connectivity state with an error code. */
+    public void broadcastConnectivity(String profileName, VpnState s,
+            int error) {
         Intent intent = new Intent(ACTION_VPN_CONNECTIVITY);
         intent.putExtra(BROADCAST_PROFILE_NAME, profileName);
         intent.putExtra(BROADCAST_CONNECTION_STATE, s);
+        if (error != VPN_ERROR_NO_ERROR) {
+            intent.putExtra(BROADCAST_ERROR_CODE, error);
+        }
         mContext.sendBroadcast(intent);
     }
 
diff --git a/vpn/java/android/net/vpn/VpnState.java b/vpn/java/android/net/vpn/VpnState.java
index ebd9364..6e61f9c 100644
--- a/vpn/java/android/net/vpn/VpnState.java
+++ b/vpn/java/android/net/vpn/VpnState.java
@@ -26,8 +26,13 @@
  * {@link DISCONNECTING} and then {@link IDLE}.
  * {@link CANCELLED} is a state when a VPN connection attempt is aborted, and
  * is in transition to {@link IDLE}.
+ * The {@link UNUSABLE} state indicates that the profile is not in a state for
+ * connecting due to possibly the integrity of the fields or another profile is
+ * connecting etc.
+ * The {@link UNKNOWN} state indicates that the profile state is to be
+ * determined.
  * {@hide}
  */
 public enum VpnState {
-    CONNECTING, DISCONNECTING, CANCELLED, CONNECTED, IDLE
+    CONNECTING, DISCONNECTING, CANCELLED, CONNECTED, IDLE, UNUSABLE, UNKNOWN
 }