diff --git a/cmds/dumpstate/dumpstate.c b/cmds/dumpstate/dumpstate.c
index 3b28b22..218ff07 100644
--- a/cmds/dumpstate/dumpstate.c
+++ b/cmds/dumpstate/dumpstate.c
@@ -88,6 +88,7 @@
 
 
     dump_file("KERNEL WAKELOCKS", "/proc/wakelocks");
+    dump_file("KERNEL WAKE SOURCES", "/d/wakeup_sources");
     dump_file("KERNEL CPUFREQ", "/sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state");
 
     run_command("PROCESSES", 10, "ps", "-P", NULL);
@@ -312,6 +313,14 @@
     int use_socket = 0;
     int do_fb = 0;
 
+    if (getuid() != 0) {
+        // Old versions of the adb client would call the
+        // dumpstate command directly. Newer clients
+        // call /system/bin/bugreport instead. If we detect
+        // we're being called incorrectly, then exec the
+        // correct program.
+        return execl("/system/bin/bugreport", "/system/bin/bugreport", NULL);
+    }
     ALOGI("begin\n");
 
     signal(SIGPIPE, SIG_IGN);
@@ -356,44 +365,42 @@
         fclose(cmdline);
     }
 
-    if (getuid() == 0) {
-        if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
-            ALOGE("prctl(PR_SET_KEEPCAPS) failed: %s\n", strerror(errno));
-            return -1;
-        }
+    if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
+        ALOGE("prctl(PR_SET_KEEPCAPS) failed: %s\n", strerror(errno));
+        return -1;
+    }
 
-        /* switch to non-root user and group */
-        gid_t groups[] = { AID_LOG, AID_SDCARD_R, AID_SDCARD_RW,
-                AID_MOUNT, AID_INET, AID_NET_BW_STATS };
-        if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) {
-            ALOGE("Unable to setgroups, aborting: %s\n", strerror(errno));
-            return -1;
-        }
-        if (setgid(AID_SHELL) != 0) {
-            ALOGE("Unable to setgid, aborting: %s\n", strerror(errno));
-            return -1;
-        }
-        if (setuid(AID_SHELL) != 0) {
-            ALOGE("Unable to setuid, aborting: %s\n", strerror(errno));
-            return -1;
-        }
+    /* switch to non-root user and group */
+    gid_t groups[] = { AID_LOG, AID_SDCARD_R, AID_SDCARD_RW,
+            AID_MOUNT, AID_INET, AID_NET_BW_STATS };
+    if (setgroups(sizeof(groups)/sizeof(groups[0]), groups) != 0) {
+        ALOGE("Unable to setgroups, aborting: %s\n", strerror(errno));
+        return -1;
+    }
+    if (setgid(AID_SHELL) != 0) {
+        ALOGE("Unable to setgid, aborting: %s\n", strerror(errno));
+        return -1;
+    }
+    if (setuid(AID_SHELL) != 0) {
+        ALOGE("Unable to setuid, aborting: %s\n", strerror(errno));
+        return -1;
+    }
 
-        struct __user_cap_header_struct capheader;
-        struct __user_cap_data_struct capdata[2];
-        memset(&capheader, 0, sizeof(capheader));
-        memset(&capdata, 0, sizeof(capdata));
-        capheader.version = _LINUX_CAPABILITY_VERSION_3;
-        capheader.pid = 0;
+    struct __user_cap_header_struct capheader;
+    struct __user_cap_data_struct capdata[2];
+    memset(&capheader, 0, sizeof(capheader));
+    memset(&capdata, 0, sizeof(capdata));
+    capheader.version = _LINUX_CAPABILITY_VERSION_3;
+    capheader.pid = 0;
 
-        capdata[CAP_TO_INDEX(CAP_SYSLOG)].permitted = CAP_TO_MASK(CAP_SYSLOG);
-        capdata[CAP_TO_INDEX(CAP_SYSLOG)].effective = CAP_TO_MASK(CAP_SYSLOG);
-        capdata[0].inheritable = 0;
-        capdata[1].inheritable = 0;
+    capdata[CAP_TO_INDEX(CAP_SYSLOG)].permitted = CAP_TO_MASK(CAP_SYSLOG);
+    capdata[CAP_TO_INDEX(CAP_SYSLOG)].effective = CAP_TO_MASK(CAP_SYSLOG);
+    capdata[0].inheritable = 0;
+    capdata[1].inheritable = 0;
 
-        if (capset(&capheader, &capdata[0]) < 0) {
-            ALOGE("capset failed: %s\n", strerror(errno));
-            return -1;
-        }
+    if (capset(&capheader, &capdata[0]) < 0) {
+        ALOGE("capset failed: %s\n", strerror(errno));
+        return -1;
     }
 
     char path[PATH_MAX], tmp_path[PATH_MAX];
diff --git a/include/binder/PermissionCache.h b/include/binder/PermissionCache.h
index 1171d48..bcdf0c2 100644
--- a/include/binder/PermissionCache.h
+++ b/include/binder/PermissionCache.h
@@ -22,6 +22,7 @@
 
 #include <utils/String16.h>
 #include <utils/Singleton.h>
+#include <utils/SortedVector.h>
 
 namespace android {
 // ---------------------------------------------------------------------------
diff --git a/include/gui/BufferQueue.h b/include/gui/BufferQueue.h
index 1c80d0c..04a2f52 100644
--- a/include/gui/BufferQueue.h
+++ b/include/gui/BufferQueue.h
@@ -96,7 +96,9 @@
     // allowSynchronousMode specifies whether or not synchronous mode can be
     // enabled.
     // bufferCount sets the minimum number of undequeued buffers for this queue
-    BufferQueue(  bool allowSynchronousMode = true, int bufferCount = MIN_UNDEQUEUED_BUFFERS);
+    BufferQueue(bool allowSynchronousMode = true,
+            int bufferCount = MIN_UNDEQUEUED_BUFFERS,
+            const sp<IGraphicBufferAlloc>& allocator = NULL);
     virtual ~BufferQueue();
 
     virtual int query(int what, int* value);
@@ -209,6 +211,11 @@
     // releaseBuffer releases a buffer slot from the consumer back to the
     // BufferQueue pending a fence sync.
     //
+    // If releaseBuffer returns STALE_BUFFER_SLOT, then the consumer must free
+    // any references to the just-released buffer that it might have, as if it
+    // had received a onBuffersReleased() call with a mask set for the released
+    // buffer.
+    //
     // Note that the dependencies on EGL will be removed once we switch to using
     // the Android HW Sync HAL.
     status_t releaseBuffer(int buf, EGLDisplay display, EGLSyncKHR fence);
diff --git a/include/gui/CpuConsumer.h b/include/gui/CpuConsumer.h
new file mode 100644
index 0000000..a50a1de
--- /dev/null
+++ b/include/gui/CpuConsumer.h
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_GUI_CPUCONSUMER_H
+#define ANDROID_GUI_CPUCONSUMER_H
+
+#include <gui/BufferQueue.h>
+
+#include <ui/GraphicBuffer.h>
+
+#include <utils/String8.h>
+#include <utils/Vector.h>
+#include <utils/threads.h>
+
+#define ANDROID_GRAPHICS_CPUCONSUMER_JNI_ID "mCpuConsumer"
+
+namespace android {
+
+/**
+ * CpuConsumer is a BufferQueue consumer endpoint that allows direct CPU
+ * access to the underlying gralloc buffers provided by BufferQueue. Multiple
+ * buffers may be acquired by it at once, to be used concurrently by the
+ * CpuConsumer owner. Sets gralloc usage flags to be software-read-only.
+ * This queue is synchronous by default.
+ */
+
+class CpuConsumer: public virtual RefBase,
+                     protected BufferQueue::ConsumerListener
+{
+  public:
+    struct FrameAvailableListener : public virtual RefBase {
+        // onFrameAvailable() is called each time an additional frame becomes
+        // available for consumption. A new frame queued will always trigger the
+        // callback, whether the queue is empty or not.
+        //
+        // This is called without any lock held and can be called concurrently
+        // by multiple threads.
+        virtual void onFrameAvailable() = 0;
+    };
+
+    struct LockedBuffer {
+        uint8_t    *data;
+        uint32_t    width;
+        uint32_t    height;
+        PixelFormat format;
+        uint32_t    stride;
+        Rect        crop;
+        uint32_t    transform;
+        uint32_t    scalingMode;
+        int64_t     timestamp;
+        uint64_t    frameNumber;
+    };
+
+    // Create a new CPU consumer. The maxLockedBuffers parameter specifies
+    // how many buffers can be locked for user access at the same time.
+    CpuConsumer(uint32_t maxLockedBuffers);
+
+    virtual ~CpuConsumer();
+
+    // set the name of the CpuConsumer that will be used to identify it in
+    // log messages.
+    void setName(const String8& name);
+
+    // Gets the next graphics buffer from the producer and locks it for CPU use,
+    // filling out the passed-in locked buffer structure with the native pointer
+    // and metadata. Returns BAD_VALUE if no new buffer is available, and
+    // INVALID_OPERATION if the maximum number of buffers is already locked.
+    //
+    // Only a fixed number of buffers can be locked at a time, determined by the
+    // construction-time maxLockedBuffers parameter. If INVALID_OPERATION is
+    // returned by lockNextBuffer, then old buffers must be returned to the queue
+    // by calling unlockBuffer before more buffers can be acquired.
+    status_t lockNextBuffer(LockedBuffer *nativeBuffer);
+
+    // Returns a locked buffer to the queue, allowing it to be reused. Since
+    // only a fixed number of buffers may be locked at a time, old buffers must
+    // be released by calling unlockBuffer to ensure new buffers can be acquired by
+    // lockNextBuffer.
+    status_t unlockBuffer(const LockedBuffer &nativeBuffer);
+
+    // setFrameAvailableListener sets the listener object that will be notified
+    // when a new frame becomes available.
+    void setFrameAvailableListener(const sp<FrameAvailableListener>& listener);
+
+    sp<ISurfaceTexture> getProducerInterface() const { return mBufferQueue; }
+  protected:
+
+    // Implementation of the BufferQueue::ConsumerListener interface.  These
+    // calls are used to notify the CpuConsumer of asynchronous events in the
+    // BufferQueue.
+    virtual void onFrameAvailable();
+    virtual void onBuffersReleased();
+
+  private:
+    // Free local buffer state
+    status_t freeBufferLocked(int buf);
+
+    // Maximum number of buffers that can be locked at a time
+    uint32_t mMaxLockedBuffers;
+
+    // mName is a string used to identify the SurfaceTexture in log messages.
+    // It can be set by the setName method.
+    String8 mName;
+
+    // mFrameAvailableListener is the listener object that will be called when a
+    // new frame becomes available. If it is not NULL it will be called from
+    // queueBuffer.
+    sp<FrameAvailableListener> mFrameAvailableListener;
+
+    // Underlying buffer queue
+    sp<BufferQueue> mBufferQueue;
+
+    // Array for caching buffers from the buffer queue
+    sp<GraphicBuffer> mBufferSlot[BufferQueue::NUM_BUFFER_SLOTS];
+    // Array for tracking pointers passed to the consumer, matching the
+    // mBufferSlot indexing
+    void *mBufferPointers[BufferQueue::NUM_BUFFER_SLOTS];
+    // Count of currently locked buffers
+    uint32_t mCurrentLockedBuffers;
+
+    // mMutex is the mutex used to prevent concurrent access to the member
+    // variables of CpuConsumer objects. It must be locked whenever the
+    // member variables are accessed.
+    mutable Mutex mMutex;
+};
+
+} // namespace android
+
+#endif // ANDROID_GUI_CPUCONSUMER_H
diff --git a/include/gui/ISurfaceComposer.h b/include/gui/ISurfaceComposer.h
index 7320e4d..e4e8aa7 100644
--- a/include/gui/ISurfaceComposer.h
+++ b/include/gui/ISurfaceComposer.h
@@ -139,6 +139,12 @@
 
     /* return an IDisplayEventConnection */
     virtual sp<IDisplayEventConnection> createDisplayEventConnection() = 0;
+
+    /* triggers screen off and waits for it to complete */
+    virtual void blank() = 0;
+
+    /* triggers screen on and waits for it to complete */
+    virtual void unblank() = 0;
 };
 
 // ----------------------------------------------------------------------------
@@ -160,6 +166,8 @@
         TURN_ELECTRON_BEAM_ON,
         AUTHENTICATE_SURFACE,
         CREATE_DISPLAY_EVENT_CONNECTION,
+        BLANK,
+        UNBLANK,
     };
 
     virtual status_t    onTransact( uint32_t code,
diff --git a/include/utils/Trace.h b/include/utils/Trace.h
index 4219206..e5cc7ec 100644
--- a/include/utils/Trace.h
+++ b/include/utils/Trace.h
@@ -51,7 +51,8 @@
 #define ATRACE_TAG_SYNC_MANAGER     (1<<7)
 #define ATRACE_TAG_AUDIO            (1<<8)
 #define ATRACE_TAG_VIDEO            (1<<9)
-#define ATRACE_TAG_LAST             ATRACE_TAG_VIDEO
+#define ATRACE_TAG_CAMERA           (1<<10)
+#define ATRACE_TAG_LAST             ATRACE_TAG_CAMERA
 
 #define ATRACE_TAG_VALID_MASK ((ATRACE_TAG_LAST - 1) | ATRACE_TAG_LAST)
 
diff --git a/libs/gui/Android.mk b/libs/gui/Android.mk
index 8224847..8fc96cf 100644
--- a/libs/gui/Android.mk
+++ b/libs/gui/Android.mk
@@ -21,7 +21,8 @@
 	LayerState.cpp \
 	Surface.cpp \
 	SurfaceComposerClient.cpp \
-	DummyConsumer.cpp
+	DummyConsumer.cpp \
+	CpuConsumer.cpp
 
 LOCAL_SHARED_LIBRARIES := \
 	libcutils \
diff --git a/libs/gui/BufferQueue.cpp b/libs/gui/BufferQueue.cpp
index a0774cf..a2e08c0 100644
--- a/libs/gui/BufferQueue.cpp
+++ b/libs/gui/BufferQueue.cpp
@@ -81,7 +81,8 @@
     }
 }
 
-BufferQueue::BufferQueue(  bool allowSynchronousMode, int bufferCount ) :
+BufferQueue::BufferQueue(bool allowSynchronousMode, int bufferCount,
+        const sp<IGraphicBufferAlloc>& allocator) :
     mDefaultWidth(1),
     mDefaultHeight(1),
     mPixelFormat(PIXEL_FORMAT_RGBA_8888),
@@ -105,10 +106,14 @@
     mConsumerName = String8::format("unnamed-%d-%d", getpid(), createProcessUniqueId());
 
     ST_LOGV("BufferQueue");
-    sp<ISurfaceComposer> composer(ComposerService::getComposerService());
-    mGraphicBufferAlloc = composer->createGraphicBufferAlloc();
-    if (mGraphicBufferAlloc == 0) {
-        ST_LOGE("createGraphicBufferAlloc() failed in BufferQueue()");
+    if (allocator == NULL) {
+        sp<ISurfaceComposer> composer(ComposerService::getComposerService());
+        mGraphicBufferAlloc = composer->createGraphicBufferAlloc();
+        if (mGraphicBufferAlloc == 0) {
+            ST_LOGE("createGraphicBufferAlloc() failed in BufferQueue()");
+        }
+    } else {
+        mGraphicBufferAlloc = allocator;
     }
 }
 
diff --git a/libs/gui/CpuConsumer.cpp b/libs/gui/CpuConsumer.cpp
new file mode 100644
index 0000000..48a54c7
--- /dev/null
+++ b/libs/gui/CpuConsumer.cpp
@@ -0,0 +1,231 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+//#define LOG_NDEBUG 0
+#define LOG_TAG "CpuConsumer"
+#define ATRACE_TAG ATRACE_TAG_GRAPHICS
+#include <utils/Log.h>
+
+#include <gui/CpuConsumer.h>
+
+#define CC_LOGV(x, ...) ALOGV("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define CC_LOGD(x, ...) ALOGD("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define CC_LOGI(x, ...) ALOGI("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define CC_LOGW(x, ...) ALOGW("[%s] "x, mName.string(), ##__VA_ARGS__)
+#define CC_LOGE(x, ...) ALOGE("[%s] "x, mName.string(), ##__VA_ARGS__)
+
+namespace android {
+
+// Get an ID that's unique within this process.
+static int32_t createProcessUniqueId() {
+    static volatile int32_t globalCounter = 0;
+    return android_atomic_inc(&globalCounter);
+}
+
+CpuConsumer::CpuConsumer(uint32_t maxLockedBuffers) :
+    mMaxLockedBuffers(maxLockedBuffers),
+    mCurrentLockedBuffers(0)
+{
+    mName = String8::format("cc-unnamed-%d-%d", getpid(),
+            createProcessUniqueId());
+
+    for (int i = 0; i < BufferQueue::NUM_BUFFER_SLOTS; i++) {
+        mBufferPointers[i] = NULL;
+    }
+
+    mBufferQueue = new BufferQueue(true);
+
+    wp<BufferQueue::ConsumerListener> listener;
+    sp<BufferQueue::ConsumerListener> proxy;
+    listener = static_cast<BufferQueue::ConsumerListener*>(this);
+    proxy = new BufferQueue::ProxyConsumerListener(listener);
+
+    status_t err = mBufferQueue->consumerConnect(proxy);
+    if (err != NO_ERROR) {
+        ALOGE("CpuConsumer: error connecting to BufferQueue: %s (%d)",
+                strerror(-err), err);
+    } else {
+        mBufferQueue->setSynchronousMode(true);
+        mBufferQueue->setConsumerUsageBits(GRALLOC_USAGE_SW_READ_OFTEN);
+        mBufferQueue->setConsumerName(mName);
+    }
+}
+
+CpuConsumer::~CpuConsumer()
+{
+    Mutex::Autolock _l(mMutex);
+    for (int i = 0; i < BufferQueue::NUM_BUFFER_SLOTS; i++) {
+        freeBufferLocked(i);
+    }
+    mBufferQueue->consumerDisconnect();
+    mBufferQueue.clear();
+}
+
+void CpuConsumer::setName(const String8& name) {
+    Mutex::Autolock _l(mMutex);
+    mName = name;
+    mBufferQueue->setConsumerName(name);
+}
+
+status_t CpuConsumer::lockNextBuffer(LockedBuffer *nativeBuffer) {
+    status_t err;
+
+    if (!nativeBuffer) return BAD_VALUE;
+    if (mCurrentLockedBuffers == mMaxLockedBuffers) {
+        return INVALID_OPERATION;
+    }
+
+    BufferQueue::BufferItem b;
+
+    Mutex::Autolock _l(mMutex);
+
+    err = mBufferQueue->acquireBuffer(&b);
+    if (err != OK) {
+        if (err == BufferQueue::NO_BUFFER_AVAILABLE) {
+            return BAD_VALUE;
+        } else {
+            CC_LOGE("Error acquiring buffer: %s (%d)", strerror(err), err);
+            return err;
+        }
+    }
+
+    int buf = b.mBuf;
+
+    if (b.mGraphicBuffer != NULL) {
+        if (mBufferPointers[buf] != NULL) {
+            CC_LOGE("Reallocation of buffer %d while in consumer use!", buf);
+            mBufferQueue->releaseBuffer(buf, EGL_NO_DISPLAY, EGL_NO_SYNC_KHR);
+            return BAD_VALUE;
+        }
+        mBufferSlot[buf] = b.mGraphicBuffer;
+    }
+
+    err = mBufferSlot[buf]->lock(
+        GraphicBuffer::USAGE_SW_READ_OFTEN,
+        b.mCrop,
+        &mBufferPointers[buf]);
+
+    if (mBufferPointers[buf] != NULL && err != OK) {
+        CC_LOGE("Unable to lock buffer for CPU reading: %s (%d)", strerror(-err),
+                err);
+        return err;
+    }
+
+    nativeBuffer->data   = reinterpret_cast<uint8_t*>(mBufferPointers[buf]);
+    nativeBuffer->width  = mBufferSlot[buf]->getWidth();
+    nativeBuffer->height = mBufferSlot[buf]->getHeight();
+    nativeBuffer->format = mBufferSlot[buf]->getPixelFormat();
+    nativeBuffer->stride = mBufferSlot[buf]->getStride();
+
+    nativeBuffer->crop        = b.mCrop;
+    nativeBuffer->transform   = b.mTransform;
+    nativeBuffer->scalingMode = b.mScalingMode;
+    nativeBuffer->timestamp   = b.mTimestamp;
+    nativeBuffer->frameNumber = b.mFrameNumber;
+
+    mCurrentLockedBuffers++;
+
+    return OK;
+}
+
+status_t CpuConsumer::unlockBuffer(const LockedBuffer &nativeBuffer) {
+    Mutex::Autolock _l(mMutex);
+    int buf = 0;
+    status_t err;
+
+    void *bufPtr = reinterpret_cast<void *>(nativeBuffer.data);
+    for (; buf < BufferQueue::NUM_BUFFER_SLOTS; buf++) {
+        if (bufPtr == mBufferPointers[buf]) break;
+    }
+    if (buf == BufferQueue::NUM_BUFFER_SLOTS) {
+        CC_LOGE("%s: Can't find buffer to free", __FUNCTION__);
+        return BAD_VALUE;
+    }
+
+    mBufferPointers[buf] = NULL;
+    err = mBufferSlot[buf]->unlock();
+    if (err != OK) {
+        CC_LOGE("%s: Unable to unlock graphic buffer %d", __FUNCTION__, buf);
+        return err;
+    }
+    err = mBufferQueue->releaseBuffer(buf, EGL_NO_DISPLAY, EGL_NO_SYNC_KHR);
+    if (err == BufferQueue::STALE_BUFFER_SLOT) {
+        freeBufferLocked(buf);
+    } else if (err != OK) {
+        CC_LOGE("%s: Unable to release graphic buffer %d to queue", __FUNCTION__,
+                buf);
+        return err;
+    }
+
+    mCurrentLockedBuffers--;
+
+    return OK;
+}
+
+void CpuConsumer::setFrameAvailableListener(
+        const sp<FrameAvailableListener>& listener) {
+    CC_LOGV("setFrameAvailableListener");
+    Mutex::Autolock lock(mMutex);
+    mFrameAvailableListener = listener;
+}
+
+
+void CpuConsumer::onFrameAvailable() {
+    CC_LOGV("onFrameAvailable");
+    sp<FrameAvailableListener> listener;
+    { // scope for the lock
+        Mutex::Autolock _l(mMutex);
+        listener = mFrameAvailableListener;
+    }
+
+    if (listener != NULL) {
+        CC_LOGV("actually calling onFrameAvailable");
+        listener->onFrameAvailable();
+    }
+}
+
+void CpuConsumer::onBuffersReleased() {
+    CC_LOGV("onBuffersReleased");
+
+    Mutex::Autolock lock(mMutex);
+
+    uint32_t mask = 0;
+    mBufferQueue->getReleasedBuffers(&mask);
+    for (int i = 0; i < BufferQueue::NUM_BUFFER_SLOTS; i++) {
+        if (mask & (1 << i)) {
+            freeBufferLocked(i);
+        }
+    }
+
+}
+
+status_t CpuConsumer::freeBufferLocked(int buf) {
+    status_t err = OK;
+
+    if (mBufferPointers[buf] != NULL) {
+        CC_LOGW("Buffer %d freed while locked by consumer", buf);
+        mBufferPointers[buf] = NULL;
+        err = mBufferSlot[buf]->unlock();
+        if (err != OK) {
+            CC_LOGE("%s: Unable to unlock graphic buffer %d", __FUNCTION__, buf);
+        }
+        mCurrentLockedBuffers--;
+    }
+    mBufferSlot[buf] = NULL;
+    return err;
+}
+
+} // namespace android
diff --git a/libs/gui/ISurfaceComposer.cpp b/libs/gui/ISurfaceComposer.cpp
index 1f1794c..8177e4d 100644
--- a/libs/gui/ISurfaceComposer.cpp
+++ b/libs/gui/ISurfaceComposer.cpp
@@ -193,6 +193,20 @@
         result = interface_cast<IDisplayEventConnection>(reply.readStrongBinder());
         return result;
     }
+
+    virtual void blank()
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
+        remote()->transact(BnSurfaceComposer::BLANK, data, &reply);
+    }
+
+    virtual void unblank()
+    {
+        Parcel data, reply;
+        data.writeInterfaceToken(ISurfaceComposer::getInterfaceDescriptor());
+        remote()->transact(BnSurfaceComposer::UNBLANK, data, &reply);
+    }
 };
 
 IMPLEMENT_META_INTERFACE(SurfaceComposer, "android.ui.ISurfaceComposer");
@@ -279,6 +293,14 @@
             reply->writeStrongBinder(connection->asBinder());
             return NO_ERROR;
         } break;
+        case BLANK: {
+            CHECK_INTERFACE(ISurfaceComposer, data, reply);
+            blank();
+        } break;
+        case UNBLANK: {
+            CHECK_INTERFACE(ISurfaceComposer, data, reply);
+            unblank();
+        } break;
         default:
             return BBinder::onTransact(code, data, reply, flags);
     }
diff --git a/libs/gui/tests/Android.mk b/libs/gui/tests/Android.mk
index 741534b..3a8e356 100644
--- a/libs/gui/tests/Android.mk
+++ b/libs/gui/tests/Android.mk
@@ -31,6 +31,35 @@
 # to integrate with auto-test framework.
 include $(BUILD_NATIVE_TEST)
 
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := CpuConsumer_test
+
+LOCAL_MODULE_TAGS := tests
+
+LOCAL_SRC_FILES := \
+    CpuConsumer_test.cpp
+
+LOCAL_SHARED_LIBRARIES := \
+	libEGL \
+	libGLESv2 \
+	libbinder \
+	libcutils \
+	libgui \
+	libstlport \
+	libui \
+	libutils \
+
+LOCAL_C_INCLUDES := \
+    bionic \
+    bionic/libstdc++/include \
+    external/gtest/include \
+    external/stlport/stlport \
+
+# Build the binary to $(TARGET_OUT_DATA_NATIVE_TESTS)/$(LOCAL_MODULE)
+# to integrate with auto-test framework.
+include $(BUILD_NATIVE_TEST)
+
 # Include subdirectory makefiles
 # ============================================================
 
diff --git a/libs/gui/tests/CpuConsumer_test.cpp b/libs/gui/tests/CpuConsumer_test.cpp
new file mode 100644
index 0000000..7ad60e8
--- /dev/null
+++ b/libs/gui/tests/CpuConsumer_test.cpp
@@ -0,0 +1,579 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "CpuConsumer_test"
+//#define LOG_NDEBUG 0
+//#define LOG_NNDEBUG 0
+
+#ifdef LOG_NNDEBUG
+#define ALOGVV(...) ALOGV(__VA_ARGS__)
+#else
+#define ALOGVV(...) ((void)0)
+#endif
+
+#include <gtest/gtest.h>
+#include <gui/CpuConsumer.h>
+#include <gui/SurfaceTextureClient.h>
+#include <ui/GraphicBuffer.h>
+#include <utils/String8.h>
+#include <utils/Thread.h>
+#include <utils/Mutex.h>
+#include <utils/Condition.h>
+
+#include <ui/FramebufferNativeWindow.h>
+
+namespace android {
+
+struct CpuConsumerTestParams {
+    uint32_t width;
+    uint32_t height;
+    int maxLockedBuffers;
+    PixelFormat format;
+};
+
+::std::ostream& operator<<(::std::ostream& os, const CpuConsumerTestParams& p) {
+    return os << "[ (" << p.width << ", " << p.height << "), B:"
+              << p.maxLockedBuffers << ", F:0x"
+              << ::std::hex << p.format << "]";
+}
+
+class CpuConsumerTest : public ::testing::TestWithParam<CpuConsumerTestParams> {
+protected:
+
+    virtual void SetUp() {
+        const ::testing::TestInfo* const test_info =
+                ::testing::UnitTest::GetInstance()->current_test_info();
+        CpuConsumerTestParams params = GetParam();
+        ALOGV("** Starting test %s (%d x %d, %d, 0x%x)",
+                test_info->name(),
+                params.width, params.height,
+                params.maxLockedBuffers, params.format);
+        mCC = new CpuConsumer(params.maxLockedBuffers);
+        String8 name("CpuConsumer_Under_Test");
+        mCC->setName(name);
+        mSTC = new SurfaceTextureClient(mCC->getProducerInterface());
+        mANW = mSTC;
+    }
+
+    virtual void TearDown() {
+        mANW.clear();
+        mSTC.clear();
+        mCC.clear();
+    }
+
+    class FrameWaiter : public CpuConsumer::FrameAvailableListener {
+    public:
+        FrameWaiter():
+                mPendingFrames(0) {
+        }
+
+        void waitForFrame() {
+            Mutex::Autolock lock(mMutex);
+            while (mPendingFrames == 0) {
+                mCondition.wait(mMutex);
+            }
+            mPendingFrames--;
+        }
+
+        virtual void onFrameAvailable() {
+            Mutex::Autolock lock(mMutex);
+            mPendingFrames++;
+            mCondition.signal();
+        }
+
+        int mPendingFrames;
+        Mutex mMutex;
+        Condition mCondition;
+    };
+
+    // Note that SurfaceTexture will lose the notifications
+    // onBuffersReleased and onFrameAvailable as there is currently
+    // no way to forward the events.  This DisconnectWaiter will not let the
+    // disconnect finish until finishDisconnect() is called.  It will
+    // also block until a disconnect is called
+    class DisconnectWaiter : public BufferQueue::ConsumerListener {
+    public:
+        DisconnectWaiter () :
+            mWaitForDisconnect(false),
+            mPendingFrames(0) {
+        }
+
+        void waitForFrame() {
+            Mutex::Autolock lock(mMutex);
+            while (mPendingFrames == 0) {
+                mFrameCondition.wait(mMutex);
+            }
+            mPendingFrames--;
+        }
+
+        virtual void onFrameAvailable() {
+            Mutex::Autolock lock(mMutex);
+            mPendingFrames++;
+            mFrameCondition.signal();
+        }
+
+        virtual void onBuffersReleased() {
+            Mutex::Autolock lock(mMutex);
+            while (!mWaitForDisconnect) {
+                mDisconnectCondition.wait(mMutex);
+            }
+        }
+
+        void finishDisconnect() {
+            Mutex::Autolock lock(mMutex);
+            mWaitForDisconnect = true;
+            mDisconnectCondition.signal();
+        }
+
+    private:
+        Mutex mMutex;
+
+        bool mWaitForDisconnect;
+        Condition mDisconnectCondition;
+
+        int mPendingFrames;
+        Condition mFrameCondition;
+    };
+
+    sp<CpuConsumer> mCC;
+    sp<SurfaceTextureClient> mSTC;
+    sp<ANativeWindow> mANW;
+};
+
+#define ASSERT_NO_ERROR(err, msg) \
+    ASSERT_EQ(NO_ERROR, err) << msg << strerror(-err)
+
+void checkPixel(const CpuConsumer::LockedBuffer &buf,
+        uint32_t x, uint32_t y, uint32_t r, uint32_t g, uint32_t b) {
+    // Ignores components that don't exist for given pixel
+    switch(buf.format) {
+        case HAL_PIXEL_FORMAT_RAW_SENSOR: {
+            String8 msg;
+            uint16_t *bPtr = (uint16_t*)buf.data;
+            bPtr += y * buf.stride + x;
+            // GRBG Bayer mosaic; only check the matching channel
+            switch( ((y & 1) << 1) | (x & 1) ) {
+                case 0: // G
+                case 3: // G
+                    EXPECT_EQ(g, *bPtr);
+                    break;
+                case 1: // R
+                    EXPECT_EQ(r, *bPtr);
+                    break;
+                case 2: // B
+                    EXPECT_EQ(b, *bPtr);
+                    break;
+            }
+            break;
+        }
+        default: {
+            ADD_FAILURE() << "Unknown format for check:" << buf.format;
+            break;
+        }
+    }
+}
+
+// Fill a YV12 buffer with a multi-colored checkerboard pattern
+void fillYV12Buffer(uint8_t* buf, int w, int h, int stride) {
+    const int blockWidth = w > 16 ? w / 16 : 1;
+    const int blockHeight = h > 16 ? h / 16 : 1;
+    const int yuvTexOffsetY = 0;
+    int yuvTexStrideY = stride;
+    int yuvTexOffsetV = yuvTexStrideY * h;
+    int yuvTexStrideV = (yuvTexStrideY/2 + 0xf) & ~0xf;
+    int yuvTexOffsetU = yuvTexOffsetV + yuvTexStrideV * h/2;
+    int yuvTexStrideU = yuvTexStrideV;
+    for (int x = 0; x < w; x++) {
+        for (int y = 0; y < h; y++) {
+            int parityX = (x / blockWidth) & 1;
+            int parityY = (y / blockHeight) & 1;
+            unsigned char intensity = (parityX ^ parityY) ? 63 : 191;
+            buf[yuvTexOffsetY + (y * yuvTexStrideY) + x] = intensity;
+            if (x < w / 2 && y < h / 2) {
+                buf[yuvTexOffsetU + (y * yuvTexStrideU) + x] = intensity;
+                if (x * 2 < w / 2 && y * 2 < h / 2) {
+                    buf[yuvTexOffsetV + (y*2 * yuvTexStrideV) + x*2 + 0] =
+                    buf[yuvTexOffsetV + (y*2 * yuvTexStrideV) + x*2 + 1] =
+                    buf[yuvTexOffsetV + ((y*2+1) * yuvTexStrideV) + x*2 + 0] =
+                    buf[yuvTexOffsetV + ((y*2+1) * yuvTexStrideV) + x*2 + 1] =
+                        intensity;
+                }
+            }
+        }
+    }
+}
+
+// Fill a RAW sensor buffer with a multi-colored checkerboard pattern.
+// Assumes GRBG mosaic ordering. Result should be a grid in a 2x2 pattern
+// of [ R, B; G, W]
+void fillBayerRawBuffer(uint8_t* buf, int w, int h, int stride) {
+    ALOGVV("fillBayerRawBuffer: %p with %d x %d, stride %d", buf, w, h ,stride);
+    // Blocks need to be even-width/height, aim for 8-wide otherwise
+    const int blockWidth = (w > 16 ? w / 8 : 2) & ~0x1;
+    const int blockHeight = (h > 16 ? h / 8 : 2) & ~0x1;
+    for (int y = 0; y < h; y+=2) {
+        uint16_t *bPtr1 = ((uint16_t*)buf) + stride*y;
+        uint16_t *bPtr2 = bPtr1 + stride;
+        for (int x = 0; x < w; x+=2) {
+            int blockX = (x / blockWidth ) & 1;
+            int blockY = (y / blockHeight) & 1;
+            unsigned short r = (blockX == blockY) ? 1000 : 200;
+            unsigned short g = blockY ? 1000: 200;
+            unsigned short b = blockX ? 1000: 200;
+            // GR row
+            *bPtr1++ = g;
+            *bPtr1++ = r;
+            // BG row
+            *bPtr2++ = b;
+            *bPtr2++ = g;
+        }
+    }
+
+}
+
+void checkBayerRawBuffer(const CpuConsumer::LockedBuffer &buf) {
+    uint32_t w = buf.width;
+    uint32_t h = buf.height;
+    const int blockWidth = (w > 16 ? w / 8 : 2) & ~0x1;
+    const int blockHeight = (h > 16 ? h / 8 : 2) & ~0x1;
+    const int blockRows = h / blockHeight;
+    const int blockCols = w / blockWidth;
+
+    // Top-left square is red
+    checkPixel(buf, 0, 0, 1000, 200, 200);
+    checkPixel(buf, 1, 0, 1000, 200, 200);
+    checkPixel(buf, 0, 1, 1000, 200, 200);
+    checkPixel(buf, 1, 1, 1000, 200, 200);
+
+    // One-right square is blue
+    checkPixel(buf, blockWidth,     0, 200, 200, 1000);
+    checkPixel(buf, blockWidth + 1, 0, 200, 200, 1000);
+    checkPixel(buf, blockWidth,     1, 200, 200, 1000);
+    checkPixel(buf, blockWidth + 1, 1, 200, 200, 1000);
+
+    // One-down square is green
+    checkPixel(buf, 0, blockHeight, 200, 1000, 200);
+    checkPixel(buf, 1, blockHeight, 200, 1000, 200);
+    checkPixel(buf, 0, blockHeight + 1, 200, 1000, 200);
+    checkPixel(buf, 1, blockHeight + 1, 200, 1000, 200);
+
+    // One-diag square is white
+    checkPixel(buf, blockWidth,     blockHeight, 1000, 1000, 1000);
+    checkPixel(buf, blockWidth + 1, blockHeight, 1000, 1000, 1000);
+    checkPixel(buf, blockWidth,     blockHeight + 1, 1000, 1000, 1000);
+    checkPixel(buf, blockWidth + 1, blockHeight + 1, 1000, 1000, 1000);
+
+    // Test bottom-right pixel
+    const int maxBlockX = ((w-1) / blockWidth) & 0x1;
+    const int maxBlockY = ((w-1) / blockHeight) & 0x1;
+    unsigned short maxR = (maxBlockX == maxBlockY) ? 1000 : 200;
+    unsigned short maxG = maxBlockY ? 1000: 200;
+    unsigned short maxB = maxBlockX ? 1000: 200;
+    checkPixel(buf, w-1, h-1, maxR, maxG, maxB);
+}
+
+// Fill a YV12 buffer with red outside a given rectangle and green inside it.
+void fillYV12BufferRect(uint8_t* buf, int w, int h, int stride,
+        const android_native_rect_t& rect) {
+    const int yuvTexOffsetY = 0;
+    int yuvTexStrideY = stride;
+    int yuvTexOffsetV = yuvTexStrideY * h;
+    int yuvTexStrideV = (yuvTexStrideY/2 + 0xf) & ~0xf;
+    int yuvTexOffsetU = yuvTexOffsetV + yuvTexStrideV * h/2;
+    int yuvTexStrideU = yuvTexStrideV;
+    for (int x = 0; x < w; x++) {
+        for (int y = 0; y < h; y++) {
+            bool inside = rect.left <= x && x < rect.right &&
+                    rect.top <= y && y < rect.bottom;
+            buf[yuvTexOffsetY + (y * yuvTexStrideY) + x] = inside ? 240 : 64;
+            if (x < w / 2 && y < h / 2) {
+                bool inside = rect.left <= 2*x && 2*x < rect.right &&
+                        rect.top <= 2*y && 2*y < rect.bottom;
+                buf[yuvTexOffsetU + (y * yuvTexStrideU) + x] = 16;
+                buf[yuvTexOffsetV + (y * yuvTexStrideV) + x] =
+                        inside ? 16 : 255;
+            }
+        }
+    }
+}
+
+void fillRGBA8Buffer(uint8_t* buf, int w, int h, int stride) {
+    const size_t PIXEL_SIZE = 4;
+    for (int x = 0; x < w; x++) {
+        for (int y = 0; y < h; y++) {
+            off_t offset = (y * stride + x) * PIXEL_SIZE;
+            for (int c = 0; c < 4; c++) {
+                int parityX = (x / (1 << (c+2))) & 1;
+                int parityY = (y / (1 << (c+2))) & 1;
+                buf[offset + c] = (parityX ^ parityY) ? 231 : 35;
+            }
+        }
+    }
+}
+
+void fillRGBA8BufferSolid(uint8_t* buf, int w, int h, int stride, uint8_t r,
+        uint8_t g, uint8_t b, uint8_t a) {
+    const size_t PIXEL_SIZE = 4;
+    for (int y = 0; y < h; y++) {
+        for (int x = 0; x < h; x++) {
+            off_t offset = (y * stride + x) * PIXEL_SIZE;
+            buf[offset + 0] = r;
+            buf[offset + 1] = g;
+            buf[offset + 2] = b;
+            buf[offset + 3] = a;
+        }
+    }
+}
+
+// Configures the ANativeWindow producer-side interface based on test parameters
+void configureANW(const sp<ANativeWindow>& anw,
+        const CpuConsumerTestParams& params,
+        int maxBufferSlack) {
+    status_t err;
+    err = native_window_set_buffers_geometry(anw.get(),
+            params.width, params.height, params.format);
+    ASSERT_NO_ERROR(err, "set_buffers_geometry error: ");
+
+    err = native_window_set_usage(anw.get(),
+            GRALLOC_USAGE_SW_WRITE_OFTEN);
+    ASSERT_NO_ERROR(err, "set_usage error: ");
+
+    int minUndequeuedBuffers;
+    err = anw.get()->query(anw.get(),
+            NATIVE_WINDOW_MIN_UNDEQUEUED_BUFFERS,
+            &minUndequeuedBuffers);
+    ASSERT_NO_ERROR(err, "query error: ");
+
+    ALOGVV("Setting buffer count to %d",
+            maxBufferSlack + 1 + minUndequeuedBuffers);
+    err = native_window_set_buffer_count(anw.get(),
+            maxBufferSlack + 1 + minUndequeuedBuffers);
+    ASSERT_NO_ERROR(err, "set_buffer_count error: ");
+
+}
+
+// Produce one frame of image data; assumes format and resolution configuration
+// is already done.
+void produceOneFrame(const sp<ANativeWindow>& anw,
+        const CpuConsumerTestParams& params,
+        int64_t timestamp, uint32_t *stride) {
+    status_t err;
+    ANativeWindowBuffer* anb;
+    ALOGVV("Dequeue buffer from %p", anw.get());
+    err = anw->dequeueBuffer(anw.get(), &anb);
+    ASSERT_NO_ERROR(err, "dequeueBuffer error: ");
+
+    ASSERT_TRUE(anb != NULL);
+
+    sp<GraphicBuffer> buf(new GraphicBuffer(anb, false));
+
+    ALOGVV("Lock buffer from %p", anw.get());
+    err = anw->lockBuffer(anw.get(), buf->getNativeBuffer());
+    ASSERT_NO_ERROR(err, "lockBuffer error: ");
+
+    *stride = buf->getStride();
+    uint8_t* img = NULL;
+
+    ALOGVV("Lock buffer from %p for write", anw.get());
+    err = buf->lock(GRALLOC_USAGE_SW_WRITE_OFTEN, (void**)(&img));
+    ASSERT_NO_ERROR(err, "lock error: ");
+
+    switch (params.format) {
+        case HAL_PIXEL_FORMAT_YV12:
+            fillYV12Buffer(img, params.width, params.height, *stride);
+            break;
+        case HAL_PIXEL_FORMAT_RAW_SENSOR:
+            fillBayerRawBuffer(img, params.width, params.height, buf->getStride());
+            break;
+        default:
+            FAIL() << "Unknown pixel format under test!";
+            break;
+    }
+    ALOGVV("Unlock buffer from %p", anw.get());
+    err = buf->unlock();
+    ASSERT_NO_ERROR(err, "unlock error: ");
+
+    ALOGVV("Set timestamp to %p", anw.get());
+    err = native_window_set_buffers_timestamp(anw.get(), timestamp);
+    ASSERT_NO_ERROR(err, "set_buffers_timestamp error: ");
+
+    ALOGVV("Queue buffer to %p", anw.get());
+    err = anw->queueBuffer(anw.get(), buf->getNativeBuffer());
+    ASSERT_NO_ERROR(err, "queueBuffer error:");
+};
+
+TEST_P(CpuConsumerTest, FromCpuSingle) {
+    status_t err;
+    CpuConsumerTestParams params = GetParam();
+
+    // Set up
+
+    ASSERT_NO_FATAL_FAILURE(configureANW(mANW, params, 1));
+
+    // Produce
+
+    const int64_t time = 12345678L;
+    uint32_t stride;
+    ASSERT_NO_FATAL_FAILURE(produceOneFrame(mANW, params, time,
+                    &stride));
+
+    // Consume
+
+    CpuConsumer::LockedBuffer b;
+    err = mCC->lockNextBuffer(&b);
+    ASSERT_NO_ERROR(err, "getNextBuffer error: ");
+
+    ASSERT_TRUE(b.data != NULL);
+    EXPECT_EQ(params.width,  b.width);
+    EXPECT_EQ(params.height, b.height);
+    EXPECT_EQ(params.format, b.format);
+    EXPECT_EQ(stride, b.stride);
+    EXPECT_EQ(time, b.timestamp);
+
+    checkBayerRawBuffer(b);
+    mCC->unlockBuffer(b);
+}
+
+TEST_P(CpuConsumerTest, FromCpuManyInQueue) {
+    status_t err;
+    CpuConsumerTestParams params = GetParam();
+
+    const int numInQueue = 5;
+    // Set up
+
+    ASSERT_NO_FATAL_FAILURE(configureANW(mANW, params, numInQueue));
+
+    // Produce
+
+    const int64_t time[numInQueue] = { 1L, 2L, 3L, 4L, 5L};
+    uint32_t stride[numInQueue];
+
+    for (int i = 0; i < numInQueue; i++) {
+        ALOGV("Producing frame %d", i);
+        ASSERT_NO_FATAL_FAILURE(produceOneFrame(mANW, params, time[i],
+                        &stride[i]));
+    }
+
+    // Consume
+
+    for (int i = 0; i < numInQueue; i++) {
+        ALOGV("Consuming frame %d", i);
+        CpuConsumer::LockedBuffer b;
+        err = mCC->lockNextBuffer(&b);
+        ASSERT_NO_ERROR(err, "getNextBuffer error: ");
+
+        ASSERT_TRUE(b.data != NULL);
+        EXPECT_EQ(params.width,  b.width);
+        EXPECT_EQ(params.height, b.height);
+        EXPECT_EQ(params.format, b.format);
+        EXPECT_EQ(stride[i], b.stride);
+        EXPECT_EQ(time[i], b.timestamp);
+
+        checkBayerRawBuffer(b);
+
+        mCC->unlockBuffer(b);
+    }
+}
+
+TEST_P(CpuConsumerTest, FromCpuLockMax) {
+    status_t err;
+    CpuConsumerTestParams params = GetParam();
+
+    // Set up
+
+    ASSERT_NO_FATAL_FAILURE(configureANW(mANW, params, params.maxLockedBuffers + 1));
+
+    // Produce
+
+    const int64_t time = 1234L;
+    uint32_t stride;
+
+    for (int i = 0; i < params.maxLockedBuffers + 1; i++) {
+        ALOGV("Producing frame %d", i);
+        ASSERT_NO_FATAL_FAILURE(produceOneFrame(mANW, params, time,
+                        &stride));
+    }
+
+    // Consume
+
+    CpuConsumer::LockedBuffer *b = new CpuConsumer::LockedBuffer[params.maxLockedBuffers];
+    for (int i = 0; i < params.maxLockedBuffers; i++) {
+        ALOGV("Locking frame %d", i);
+        err = mCC->lockNextBuffer(&b[i]);
+        ASSERT_NO_ERROR(err, "getNextBuffer error: ");
+
+        ASSERT_TRUE(b[i].data != NULL);
+        EXPECT_EQ(params.width,  b[i].width);
+        EXPECT_EQ(params.height, b[i].height);
+        EXPECT_EQ(params.format, b[i].format);
+        EXPECT_EQ(stride, b[i].stride);
+        EXPECT_EQ(time, b[i].timestamp);
+
+        checkBayerRawBuffer(b[i]);
+    }
+
+    ALOGV("Locking frame %d (too many)", params.maxLockedBuffers);
+    CpuConsumer::LockedBuffer bTooMuch;
+    err = mCC->lockNextBuffer(&bTooMuch);
+    ASSERT_TRUE(err == INVALID_OPERATION) << "Allowing too many locks";
+
+    ALOGV("Unlocking frame 0");
+    err = mCC->unlockBuffer(b[0]);
+    ASSERT_NO_ERROR(err, "Could not unlock buffer 0: ");
+
+    ALOGV("Locking frame %d (should work now)", params.maxLockedBuffers);
+    err = mCC->lockNextBuffer(&bTooMuch);
+    ASSERT_NO_ERROR(err, "Did not allow new lock after unlock");
+
+    ASSERT_TRUE(bTooMuch.data != NULL);
+    EXPECT_EQ(params.width,  bTooMuch.width);
+    EXPECT_EQ(params.height, bTooMuch.height);
+    EXPECT_EQ(params.format, bTooMuch.format);
+    EXPECT_EQ(stride, bTooMuch.stride);
+    EXPECT_EQ(time, bTooMuch.timestamp);
+
+    checkBayerRawBuffer(bTooMuch);
+
+    ALOGV("Unlocking extra buffer");
+    err = mCC->unlockBuffer(bTooMuch);
+    ASSERT_NO_ERROR(err, "Could not unlock extra buffer: ");
+
+    ALOGV("Locking frame %d (no more available)", params.maxLockedBuffers + 1);
+    err = mCC->lockNextBuffer(&b[0]);
+    ASSERT_EQ(BAD_VALUE, err) << "Not out of buffers somehow";
+
+    for (int i = 1; i < params.maxLockedBuffers; i++) {
+        mCC->unlockBuffer(b[i]);
+    }
+
+    delete[] b;
+
+}
+
+CpuConsumerTestParams rawTestSets[] = {
+    { 512,   512, 1, HAL_PIXEL_FORMAT_RAW_SENSOR},
+    { 512,   512, 3, HAL_PIXEL_FORMAT_RAW_SENSOR},
+    { 2608, 1960, 1, HAL_PIXEL_FORMAT_RAW_SENSOR},
+    { 2608, 1960, 3, HAL_PIXEL_FORMAT_RAW_SENSOR},
+    { 100,   100, 1, HAL_PIXEL_FORMAT_RAW_SENSOR},
+    { 100,   100, 3, HAL_PIXEL_FORMAT_RAW_SENSOR}
+};
+
+INSTANTIATE_TEST_CASE_P(RawTests,
+        CpuConsumerTest,
+        ::testing::ValuesIn(rawTestSets));
+
+} // namespace android
diff --git a/libs/utils/ZipFileRO.cpp b/libs/utils/ZipFileRO.cpp
index cad7720..db17546 100644
--- a/libs/utils/ZipFileRO.cpp
+++ b/libs/utils/ZipFileRO.cpp
@@ -118,7 +118,7 @@
  */
 int ZipFileRO::entryToIndex(const ZipEntryRO entry) const
 {
-    long ent = ((long) entry) - kZipEntryAdj;
+    long ent = ((intptr_t) entry) - kZipEntryAdj;
     if (ent < 0 || ent >= mHashTableSize || mHashTable[ent].name == NULL) {
         ALOGW("Invalid ZipEntryRO %p (%ld)\n", entry, ent);
         return -1;
@@ -459,7 +459,7 @@
     for (int ent = 0; ent < mHashTableSize; ent++) {
         if (mHashTable[ent].name != NULL) {
             if (idx-- == 0)
-                return (ZipEntryRO) (ent + kZipEntryAdj);
+                return (ZipEntryRO) (intptr_t)(ent + kZipEntryAdj);
         }
     }
 
diff --git a/opengl/libs/EGL/egl_display.cpp b/opengl/libs/EGL/egl_display.cpp
index a46aa38..80072ab 100644
--- a/opengl/libs/EGL/egl_display.cpp
+++ b/opengl/libs/EGL/egl_display.cpp
@@ -263,7 +263,13 @@
     Mutex::Autolock _l(lock);
 
     if (refs == 0) {
-        return setError(EGL_NOT_INITIALIZED, EGL_FALSE);
+        /*
+         * From the EGL spec (3.2):
+         * "Termination of a display that has already been terminated,
+         *  (...), is allowed, but the only effect of such a call is
+         *  to return EGL_TRUE (...)
+         */
+        return EGL_TRUE;
     }
 
     // this is specific to Android, display termination is ref-counted.
diff --git a/opengl/libs/GLES_trace/src/gltrace_context.cpp b/opengl/libs/GLES_trace/src/gltrace_context.cpp
index 45dbb43..91b291e 100644
--- a/opengl/libs/GLES_trace/src/gltrace_context.cpp
+++ b/opengl/libs/GLES_trace/src/gltrace_context.cpp
@@ -119,7 +119,7 @@
 
     const size_t DEFAULT_BUFFER_SIZE = 8192;
     BufferedOutputStream *stream = new BufferedOutputStream(mStream, DEFAULT_BUFFER_SIZE);
-    GLTraceContext *traceContext = new GLTraceContext(id, this, stream);
+    GLTraceContext *traceContext = new GLTraceContext(id, version, this, stream);
     mPerContextState[eglContext] = traceContext;
 
     return traceContext;
@@ -129,8 +129,10 @@
     return mPerContextState[c];
 }
 
-GLTraceContext::GLTraceContext(int id, GLTraceState *state, BufferedOutputStream *stream) :
+GLTraceContext::GLTraceContext(int id, int version, GLTraceState *state,
+        BufferedOutputStream *stream) :
     mId(id),
+    mVersion(version),
     mState(state),
     mBufferedOutputStream(stream),
     mElementArrayBuffers(DefaultKeyedVector<GLuint, ElementArrayBuffer*>(NULL))
@@ -143,6 +145,10 @@
     return mId;
 }
 
+int GLTraceContext::getVersion() {
+    return mVersion;
+}
+
 GLTraceState *GLTraceContext::getGlobalTraceState() {
     return mState;
 }
diff --git a/opengl/libs/GLES_trace/src/gltrace_context.h b/opengl/libs/GLES_trace/src/gltrace_context.h
index 323cfdc..4c38bba 100644
--- a/opengl/libs/GLES_trace/src/gltrace_context.h
+++ b/opengl/libs/GLES_trace/src/gltrace_context.h
@@ -50,6 +50,7 @@
 /** GL Trace Context info associated with each EGLContext */
 class GLTraceContext {
     int mId;                    /* unique context id */
+    int mVersion;               /* GL version, e.g: egl_connection_t::GLESv2_INDEX */
     GLTraceState *mState;       /* parent GL Trace state (for per process GL Trace State Info) */
 
     void *fbcontents;           /* memory area to read framebuffer contents */
@@ -65,8 +66,9 @@
 public:
     gl_hooks_t *hooks;
 
-    GLTraceContext(int id, GLTraceState *state, BufferedOutputStream *stream);
+    GLTraceContext(int id, int version, GLTraceState *state, BufferedOutputStream *stream);
     int getId();
+    int getVersion();
     GLTraceState *getGlobalTraceState();
     void getCompressedFB(void **fb, unsigned *fbsize,
                             unsigned *fbwidth, unsigned *fbheight,
diff --git a/opengl/libs/GLES_trace/src/gltrace_fixup.cpp b/opengl/libs/GLES_trace/src/gltrace_fixup.cpp
index 3597b26..1bd790e 100644
--- a/opengl/libs/GLES_trace/src/gltrace_fixup.cpp
+++ b/opengl/libs/GLES_trace/src/gltrace_fixup.cpp
@@ -15,6 +15,7 @@
  */
 
 #include <cutils/log.h>
+#include <EGL/egldefs.h>
 #include <GLES/gl.h>
 #include <GLES/glext.h>
 #include <GLES2/gl2.h>
@@ -592,6 +593,11 @@
 }
 
 void trace_VertexAttribPointerDataForGlDrawArrays(GLTraceContext *context, GLMessage *glmsg) {
+    if (context->getVersion() == egl_connection_t::GLESv1_INDEX) {
+        // only supported for GLES2 and above
+        return;
+    }
+
     /* void glDrawArrays(GLenum mode, GLint first, GLsizei count) */
     GLsizei count = glmsg->args(2).intvalue(0);
 
@@ -604,6 +610,11 @@
 
 void trace_VertexAttribPointerDataForGlDrawElements(GLTraceContext *context, GLMessage *glmsg,
                             GLvoid *indices) {
+    if (context->getVersion() == egl_connection_t::GLESv1_INDEX) {
+        // only supported for GLES2 and above
+        return;
+    }
+
     /* void glDrawElements(GLenum mode, GLsizei count, GLenum type, const GLvoid* indices) */
     GLsizei count = glmsg->args(1).intvalue(0);
     GLenum type = glmsg->args(2).intvalue(0);
diff --git a/opengl/specs/EGL_ANDROID_fence_sync.txt b/opengl/specs/EGL_ANDROID_fence_sync.txt
new file mode 100644
index 0000000..bb618c9
--- /dev/null
+++ b/opengl/specs/EGL_ANDROID_fence_sync.txt
@@ -0,0 +1,213 @@
+Name
+
+    ANDROID_fence_sync
+
+Name Strings
+
+    EGL_ANDROID_fence_sync
+
+Contributors
+
+    Jamie Gennis
+
+Contact
+
+    Jamie Gennis, Google Inc. (jgennis 'at' google.com)
+
+Status
+
+    Draft.
+
+Version
+
+    Version 1, May 29, 2012
+
+Number
+
+    EGL Extension #XXX
+
+Dependencies
+
+    Requires EGL 1.1
+
+    This extension is written against the wording of the EGL 1.2 Specification
+
+    EGL_KHR_fence_sync is required.
+
+Overview
+
+    This extension enables the creation of EGL fence sync objects that are
+    associated with an Android Sync HAL fence object.  These EGL fence sync
+    objects have nearly identical semantics to those defined by the
+    KHR_fence_sync extension, except that they have an additional attribute
+    storing the file descriptor referring to the native Android fence object.
+
+New Types
+
+    None.
+
+New Procedures and Functions
+
+    None.
+
+New Tokens
+
+    Accepted by the <type> parameter of eglCreateSyncKHR, and returned
+    in <value> when eglGetSyncAttribKHR is called with <attribute>
+    EGL_SYNC_TYPE_KHR:
+
+    EGL_SYNC_ANDROID_FENCE_ANDROID          0x3144
+
+    Accepted by the <attribute> parameter of eglGetSyncAttribKHR:
+
+    EGL_SYNC_FENCE_FD_ANDROID               0x3145
+
+    Returned in <value> when eglGetSyncAttribKHR is called with <attribute>
+    EGL_SYNC_CONDITION_KHR:
+
+    EGL_SYNC_ANDROID_FENCE_SIGNALED_ANDROID 0x3146
+
+Changes to Chapter 3 of the EGL 1.2 Specification (EGL Functions and Errors)
+
+    Add the following after the sixth paragraph of Section 3.8.1 (Sync
+    Objects), added by KHR_fence_sync
+
+    "If <type> is EGL_SYNC_ANDROID_FENCE_ANDROID, an EGL Android fence sync
+    object is created. In this case the EGL_SYNC_FENCE_FD_ANDROID attribute may
+    optionally be specified. If this attribute is specified, it must be set to
+    a file descriptor that refers to a native Android fence object.
+
+    The default values for the EGL Android fence sync object attributes are as
+    follows:
+
+      Attribute Name            Initial Attribute Value(s)
+      ---------------           --------------------------
+      EGL_SYNC_TYPE_KHR         EGL_SYNC_ANDROID_FENCE_ANDROID
+      EGL_SYNC_STATUS_KHR       EGL_UNSIGNALED_KHR
+      EGL_SYNC_CONDITION_KHR    EGL_SYNC_PRIOR_COMMANDS_COMPLETE_KHR
+
+    Upon creation of an EGL Android fence sync object, the
+    EGL_SYNC_FENCE_FD_ANDROID attribute is set to a newly generated file
+    descriptor that refers to a native Android fence object. If the
+    EGL_SYNC_FENCE_FD_ANDROID attribute is specified in the eglCreateSyncKHR
+    call then the generated file descriptor refers to the same native Android
+    fence object as the file descriptor passed to eglCreateSyncKHR.  Note,
+    however, that the value of the sync object attribute is *not* the same file
+    descriptor as the one passed to eglCreateSyncKHR - it simply refers to the
+    same underlying native Android fence object. Additionally, if the
+    EGL_SYNC_FENCE_FD_ANDROID attribute is specified then the
+    EGL_SYNC_CONDITION_KHR attribute is set to
+    EGL_SYNC_ANDROID_FENCE_SIGNALED_ANDROID and the EGL_SYNC_STATUS_KHR
+    attribute is set to reflect the signal status of the native Android fence
+    object."
+
+    Modify Section 3.8.1 (Sync Objects), added by KHR_fence_sync, starting at
+    the seventh paragraph
+
+    "When a fence sync object is created or when an EGL Android fence sync
+    object is created without specifying the EGL_SYNC_FENCE_FD_ANDROID
+    attribute, eglCreateSyncKHR also inserts a fence command into the command
+    stream of the bound client API's current context (i.e., the context
+    returned by eglGetCurrentContext), and associates it with the newly created
+    sync object.
+
+    When the condition of the sync object is satisfied by the fence command,
+    the sync is signaled by the associated client API context, causing any
+    eglClientWaitSyncKHR commands (see below) blocking on <sync> to unblock. If
+    the sync object is an EGL Android fence sync object then the native Android
+    fence object is also signaled when the condition is satisfied. The
+    EGL_SYNC_PRIOR_COMMANDS_COMPLETE_KHR condition is satisfied by completion
+    of the fence command corresponding to the sync object and all preceding
+    commands in the associated client API context's command stream. The sync
+    object will not be signaled until all effects from these commands on the
+    client API's internal and framebuffer state are fully realized. No other
+    state is affected by execution of the fence command.
+
+    The EGL_SYNC_ANDROID_FENCE_SIGNALED_ANDROID condition is satisfied by the
+    signaling of the native Android fence object. When this happens any
+    eglClientWaitSyncKHR commands blocking on <sync> unblock."
+
+    Modify the list of eglCreateSyncKHR errors in Section 3.8.1 (Sync Objects),
+    added by KHR_fence_sync
+
+    "Errors
+    ------
+
+      * If <dpy> is not the name of a valid, initialized EGLDisplay,
+        EGL_NO_SYNC_KHR is returned and an EGL_BAD_DISPLAY error is
+        generated.
+      * If <type> is EGL_SYNC_FENCE_KHR and <attrib_list> is neither NULL nor
+        empty (containing only EGL_NONE), EGL_NO_SYNC_KHR is returned and an
+        EGL_BAD_ATTRIBUTE error is generated.
+      * If <type> is EGL_SYNC_ANDROID_FENCE_ANDROID and <attrib_list> contains
+        an attribute other than EGL_SYNC_FENCE_FD_ANDROID, EGL_NO_SYNC_KHR is
+        returned and an EGL_BAD_ATTRIBUTE error is generated.
+      * If <type> is not a supported type of sync object,
+        EGL_NO_SYNC_KHR is returned and an EGL_BAD_ATTRIBUTE error is
+        generated.
+      * If <type> is EGL_SYNC_FENCE_KHR or EGL_SYNC_ANDROID_FENCE_ANDROID and
+        no context is current for the bound API (i.e., eglGetCurrentContext
+        returns EGL_NO_CONTEXT), EGL_NO_SYNC_KHR is returned and an
+        EGL_BAD_MATCH error is generated.
+      * If <type> is EGL_SYNC_FENCE_KHR or EGL_SYNC_ANDROID_FENCE_ANDROID and
+        <dpy> does not match the EGLDisplay of the currently bound context for
+        the currently bound client API (the EGLDisplay returned by
+        eglGetCurrentDisplay()) then EGL_NO_SYNC_KHR is returned and an
+        EGL_BAD_MATCH error is generated.
+      * If <type> is EGL_SYNC_FENCE_KHR or EGL_SYNC_ANDROID_FENCE_ANDROID and
+        the currently bound client API does not support the client API
+        extension indicating it can place fence commands, then EGL_NO_SYNC_KHR
+        is returned and an EGL_BAD_MATCH error is generated."
+
+    Modify table 3.cc in Section 3.8.1 (Sync Objects), added by KHR_fence_sync
+
+    "
+    Attribute                 Description                Supported Sync Objects
+    -----------------         -----------------------    ----------------------
+    EGL_SYNC_TYPE_KHR         Type of the sync object    All
+    EGL_SYNC_STATUS_KHR       Status of the sync object  All
+    EGL_SYNC_CONDITION_KHR    Signaling condition        EGL_SYNC_FENCE_KHR and
+                                                         EGL_SYNC_ANDROID_FENCE_ANDROID only
+    EGL_SYNC_FENCE_FD_ANDROID Native Android fence       EGL_SYNC_ANDROID_FENCE_ANDROID only
+                              object file descriptor
+    "
+
+    Modify the second paragraph description of eglDestroySyncKHR in Section
+    3.8.1 (Sync Objects), added by KHR_fence_sync
+
+    "If no errors are generated, EGL_TRUE is returned, and <sync> will no
+    longer be the handle of a valid sync object.  Additionally, if <sync> is an
+    EGL Android fence sync object then the file descriptor stored in the
+    EGL_SYNC_FENCE_FD_ANDROID attribute is closed and is no longer a valid file
+    descriptor."
+
+Issues
+
+    1. Should EGLSyncKHR objects that wrap Android fence objects use the
+    EGL_SYNC_FENCE_KHR type?
+
+    RESOLVED: A new sync object type will be added.
+
+    We don't want to require all EGL fence sync objects to wrap Android fence
+    objects, so we need some way to tell the EGL implementation at sync object
+    creation whether the sync object should support querying the Android fence
+    FD attribute. We could do this with either a new sync object type or with a
+    boolean attribute. It might be nice to pick up future signaling conditions
+    that might be added for fence sync objects, but there may be things that
+    get added that don't make sense in the context of Android fence objects.
+
+    2. Who is responsible for dup'ing the Android fence file descriptors?
+
+    RESOLVED: The recipient of a file descriptor is responsible for dup'ing it
+    if it wishes to maintain a reference to the Android fence object.
+
+    This means that when eglCreateSyncKHR is called with an existing file
+    descriptor, the EGL implementation must dup it. On the other hand, when
+    eglGetSyncAttribKHR is called to query the file descriptor, it is the
+    responsibility of the caller to dup the file descriptor if it wishes to
+    maintain a reference that will outlast the EGLSyncKHR object.
+
+Revision History
+
+#1 (Jamie Gennis, May 29, 2012)
+    - Initial draft.
diff --git a/opengl/specs/README b/opengl/specs/README
index 16b278f..af3f165 100644
--- a/opengl/specs/README
+++ b/opengl/specs/README
@@ -10,4 +10,7 @@
 0x3141               (unused)
 0x3142               EGL_ANDROID_recordable
 0x3143               EGL_VERSION_HW_ANDROID (internal use)
-0x3144 - 0x314F      (unused)
+0x3144               EGL_SYNC_ANDROID_FENCE_ANDROID
+0x3145               EGL_SYNC_FENCE_FD_ANDROID
+0x3146               EGL_SYNC_ANDROID_FENCE_SIGNALED_ANDROID
+0x3147 - 0x314F      (unused)
diff --git a/opengl/tests/hwc/hwcColorEquiv.cpp b/opengl/tests/hwc/hwcColorEquiv.cpp
index bb305dc..ab5277e 100644
--- a/opengl/tests/hwc/hwcColorEquiv.cpp
+++ b/opengl/tests/hwc/hwcColorEquiv.cpp
@@ -124,7 +124,7 @@
 // Globals
 static const int texUsage = GraphicBuffer::USAGE_HW_TEXTURE |
         GraphicBuffer::USAGE_SW_WRITE_RARELY;
-static hwc_composer_device_t *hwcDevice;
+static hwc_composer_device_1_t *hwcDevice;
 static EGLDisplay dpy;
 static EGLSurface surface;
 static EGLint width, height;
@@ -344,16 +344,16 @@
     hwcTestFillColorHBlend(equivFrame.get(), refFormat->format,
                            startRefColor, endRefColor);
 
-    hwc_layer_list_t *list;
-    size_t size = sizeof(hwc_layer_list) + numFrames * sizeof(hwc_layer_t);
-    if ((list = (hwc_layer_list_t *) calloc(1, size)) == NULL) {
+    hwc_layer_list_1_t *list;
+    size_t size = sizeof(hwc_layer_list_1_t) + numFrames * sizeof(hwc_layer_1_t);
+    if ((list = (hwc_layer_list_1_t *) calloc(1, size)) == NULL) {
         testPrintE("Allocate list failed");
         exit(11);
     }
     list->flags = HWC_GEOMETRY_CHANGED;
     list->numHwLayers = numFrames;
 
-    hwc_layer_t *layer = &list->hwLayers[0];
+    hwc_layer_1_t *layer = &list->hwLayers[0];
     layer->handle = refFrame->handle;
     layer->blending = HWC_BLENDING_NONE;
     layer->sourceCrop.left = 0;
diff --git a/opengl/tests/hwc/hwcCommit.cpp b/opengl/tests/hwc/hwcCommit.cpp
index efa646c..d4873d8 100644
--- a/opengl/tests/hwc/hwcCommit.cpp
+++ b/opengl/tests/hwc/hwcCommit.cpp
@@ -230,7 +230,7 @@
 // Globals
 static const int texUsage = GraphicBuffer::USAGE_HW_TEXTURE |
         GraphicBuffer::USAGE_SW_WRITE_RARELY;
-static hwc_composer_device_t *hwcDevice;
+static hwc_composer_device_1_t *hwcDevice;
 static EGLDisplay dpy;
 static EGLSurface surface;
 static EGLint width, height;
@@ -1397,7 +1397,7 @@
 // Given a list of rectangles, determine how many HWC will commit to render
 uint32_t numOverlays(list<Rectangle>& rectList)
 {
-    hwc_layer_list_t *hwcList;
+    hwc_layer_list_1_t *hwcList;
     list<sp<GraphicBuffer> > buffers;
 
     hwcList = hwcTestCreateLayerList(rectList.size());
@@ -1406,7 +1406,7 @@
         exit(30);
     }
 
-    hwc_layer_t *layer = &hwcList->hwLayers[0];
+    hwc_layer_1_t *layer = &hwcList->hwLayers[0];
     for (std::list<Rectangle>::iterator it = rectList.begin();
          it != rectList.end(); ++it, ++layer) {
         // Allocate the texture for the source frame
diff --git a/opengl/tests/hwc/hwcRects.cpp b/opengl/tests/hwc/hwcRects.cpp
index 906c169..e2f0039 100644
--- a/opengl/tests/hwc/hwcRects.cpp
+++ b/opengl/tests/hwc/hwcRects.cpp
@@ -165,7 +165,7 @@
 list<Rectangle> rectangle;
 static const int texUsage = GraphicBuffer::USAGE_HW_TEXTURE |
         GraphicBuffer::USAGE_SW_WRITE_RARELY;
-static hwc_composer_device_t *hwcDevice;
+static hwc_composer_device_1_t *hwcDevice;
 static EGLDisplay dpy;
 static EGLSurface surface;
 static EGLint width, height;
@@ -307,14 +307,14 @@
     }
 
     // Create list of frames
-    hwc_layer_list_t *list;
+    hwc_layer_list_1_t *list;
     list = hwcTestCreateLayerList(rectangle.size());
     if (list == NULL) {
         testPrintE("hwcTestCreateLayerList failed");
         exit(5);
     }
 
-    hwc_layer_t *layer = &list->hwLayers[0];
+    hwc_layer_1_t *layer = &list->hwLayers[0];
     for (std::list<Rectangle>::iterator it = rectangle.begin();
          it != rectangle.end(); ++it, ++layer) {
         layer->handle = it->texture->handle;
diff --git a/opengl/tests/hwc/hwcStress.cpp b/opengl/tests/hwc/hwcStress.cpp
index b02a424..ccc7328 100644
--- a/opengl/tests/hwc/hwcStress.cpp
+++ b/opengl/tests/hwc/hwcStress.cpp
@@ -192,7 +192,7 @@
 // File scope globals
 static const int texUsage = GraphicBuffer::USAGE_HW_TEXTURE |
         GraphicBuffer::USAGE_SW_WRITE_RARELY;
-static hwc_composer_device_t *hwcDevice;
+static hwc_composer_device_1_t *hwcDevice;
 static EGLDisplay dpy;
 static EGLSurface surface;
 static EGLint width, height;
@@ -409,7 +409,7 @@
         // generated for this pass.
         srand48(pass);
 
-        hwc_layer_list_t *list;
+        hwc_layer_list_1_t *list;
         list = hwcTestCreateLayerList(testRandMod(frames.size()) + 1);
         if (list == NULL) {
             testPrintE("hwcTestCreateLayerList failed");
@@ -428,7 +428,7 @@
         for (unsigned int n1 = 0; n1 < list->numHwLayers; n1++) {
             unsigned int idx = testRandMod(selectedFrames[n1].size());
             sp<GraphicBuffer> gBuf = selectedFrames[n1][idx];
-            hwc_layer_t *layer = &list->hwLayers[n1];
+            hwc_layer_1_t *layer = &list->hwLayers[n1];
             layer->handle = gBuf->handle;
 
             layer->blending = blendingOps[testRandMod(NUMA(blendingOps))];
@@ -497,7 +497,7 @@
             for (unsigned int n1 = 0; n1 < list->numHwLayers; n1++) {
                 unsigned int idx = testRandMod(selectedFrames[n1].size());
                 sp<GraphicBuffer> gBuf = selectedFrames[n1][idx];
-                hwc_layer_t *layer = &list->hwLayers[n1];
+                hwc_layer_1_t *layer = &list->hwLayers[n1];
                 layer->handle = (native_handle_t *) gBuf->handle;
             }
 
diff --git a/opengl/tests/hwc/hwcTestLib.cpp b/opengl/tests/hwc/hwcTestLib.cpp
index 28e0c3f..c6dbe9d 100644
--- a/opengl/tests/hwc/hwcTestLib.cpp
+++ b/opengl/tests/hwc/hwcTestLib.cpp
@@ -134,7 +134,7 @@
 }
 
 // Open Hardware Composer Device
-void hwcTestOpenHwc(hwc_composer_device_t **hwcDevicePtr)
+void hwcTestOpenHwc(hwc_composer_device_1_t **hwcDevicePtr)
 {
     int rv;
     hw_module_t const *hwcModule;
@@ -145,7 +145,7 @@
         perror(NULL);
         exit(77);
     }
-    if ((rv = hwc_open(hwcModule, hwcDevicePtr)) != 0) {
+    if ((rv = hwc_open_1(hwcModule, hwcDevicePtr)) != 0) {
         testPrintE("hwc_open failed, rv: %i", rv);
         errno = -rv;
         perror(NULL);
@@ -399,12 +399,12 @@
  * Dynamically creates layer list with numLayers worth
  * of hwLayers entries.
  */
-hwc_layer_list_t *hwcTestCreateLayerList(size_t numLayers)
+hwc_layer_list_1_t *hwcTestCreateLayerList(size_t numLayers)
 {
-    hwc_layer_list_t *list;
+    hwc_layer_list_1_t *list;
 
-    size_t size = sizeof(hwc_layer_list) + numLayers * sizeof(hwc_layer_t);
-    if ((list = (hwc_layer_list_t *) calloc(1, size)) == NULL) {
+    size_t size = sizeof(hwc_layer_list_1_t) + numLayers * sizeof(hwc_layer_1_t);
+    if ((list = (hwc_layer_list_1_t *) calloc(1, size)) == NULL) {
         return NULL;
     }
     list->flags = HWC_GEOMETRY_CHANGED;
@@ -417,13 +417,13 @@
  * hwcTestFreeLayerList
  * Frees memory previous allocated via hwcTestCreateLayerList().
  */
-void hwcTestFreeLayerList(hwc_layer_list_t *list)
+void hwcTestFreeLayerList(hwc_layer_list_1_t *list)
 {
     free(list);
 }
 
 // Display the settings of the layer list pointed to by list
-void hwcTestDisplayList(hwc_layer_list_t *list)
+void hwcTestDisplayList(hwc_layer_list_1_t *list)
 {
     testPrintI("  flags: %#x%s", list->flags,
                (list->flags & HWC_GEOMETRY_CHANGED) ? " GEOMETRY_CHANGED" : "");
@@ -494,7 +494,7 @@
  * Displays the portions of a list that are meant to be modified by
  * a prepare call.
  */
-void hwcTestDisplayListPrepareModifiable(hwc_layer_list_t *list)
+void hwcTestDisplayListPrepareModifiable(hwc_layer_list_1_t *list)
 {
     uint32_t numOverlays = 0;
     for (unsigned int layer = 0; layer < list->numHwLayers; layer++) {
@@ -522,7 +522,7 @@
  *
  * Displays the handles of all the graphic buffers in the list.
  */
-void hwcTestDisplayListHandles(hwc_layer_list_t *list)
+void hwcTestDisplayListHandles(hwc_layer_list_1_t *list)
 {
     const unsigned int maxLayersPerLine = 6;
 
diff --git a/opengl/tests/hwc/hwcTestLib.h b/opengl/tests/hwc/hwcTestLib.h
index b0c3012..db3f5c1 100644
--- a/opengl/tests/hwc/hwcTestLib.h
+++ b/opengl/tests/hwc/hwcTestLib.h
@@ -107,17 +107,17 @@
 // Function Prototypes
 void hwcTestInitDisplay(bool verbose, EGLDisplay *dpy, EGLSurface *surface,
     EGLint *width, EGLint *height);
-void hwcTestOpenHwc(hwc_composer_device_t **hwcDevicePtr);
+void hwcTestOpenHwc(hwc_composer_device_1_t **hwcDevicePtr);
 const struct hwcTestGraphicFormat *hwcTestGraphicFormatLookup(const char *desc);
 const struct hwcTestGraphicFormat *hwcTestGraphicFormatLookup(uint32_t id);
 const char *hwcTestGraphicFormat2str(uint32_t format);
 std::string hwcTestRect2str(const struct hwc_rect& rect);
 
-hwc_layer_list_t *hwcTestCreateLayerList(size_t numLayers);
-void hwcTestFreeLayerList(hwc_layer_list_t *list);
-void hwcTestDisplayList(hwc_layer_list_t *list);
-void hwcTestDisplayListPrepareModifiable(hwc_layer_list_t *list);
-void hwcTestDisplayListHandles(hwc_layer_list_t *list);
+hwc_layer_list_1_t *hwcTestCreateLayerList(size_t numLayers);
+void hwcTestFreeLayerList(hwc_layer_list_1_t *list);
+void hwcTestDisplayList(hwc_layer_list_1_t *list);
+void hwcTestDisplayListPrepareModifiable(hwc_layer_list_1_t *list);
+void hwcTestDisplayListHandles(hwc_layer_list_1_t *list);
 
 uint32_t hwcTestColor2Pixel(uint32_t format, ColorFract color, float alpha);
 void hwcTestColorConvert(uint32_t fromFormat, uint32_t toFormat,
diff --git a/services/surfaceflinger/Android.mk b/services/surfaceflinger/Android.mk
index 6f7a7e1..f4bf9ef 100644
--- a/services/surfaceflinger/Android.mk
+++ b/services/surfaceflinger/Android.mk
@@ -2,6 +2,7 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES:= \
+    Client.cpp                              \
     EventThread.cpp                         \
     Layer.cpp                               \
     LayerBase.cpp                           \
@@ -9,6 +10,7 @@
     LayerScreenshot.cpp                     \
     DisplayHardware/DisplayHardware.cpp     \
     DisplayHardware/DisplayHardwareBase.cpp \
+    DisplayHardware/FramebufferSurface.cpp  \
     DisplayHardware/HWComposer.cpp          \
     DisplayHardware/PowerHAL.cpp            \
     GLExtensions.cpp                        \
@@ -21,18 +23,18 @@
 LOCAL_CFLAGS:= -DLOG_TAG=\"SurfaceFlinger\"
 LOCAL_CFLAGS += -DGL_GLEXT_PROTOTYPES -DEGL_EGLEXT_PROTOTYPES
 
-ifeq ($(TARGET_BOARD_PLATFORM), omap3)
+ifeq ($(TARGET_BOARD_PLATFORM),omap3)
 	LOCAL_CFLAGS += -DNO_RGBX_8888
 endif
-ifeq ($(TARGET_BOARD_PLATFORM), omap4)
+ifeq ($(TARGET_BOARD_PLATFORM),omap4)
 	LOCAL_CFLAGS += -DHAS_CONTEXT_PRIORITY
 endif
-ifeq ($(TARGET_BOARD_PLATFORM), s5pc110)
+ifeq ($(TARGET_BOARD_PLATFORM),s5pc110)
 	LOCAL_CFLAGS += -DHAS_CONTEXT_PRIORITY
 	LOCAL_CFLAGS += -DNEVER_DEFAULT_TO_ASYNC_MODE
 endif
 
-ifeq ($(TARGET_DISABLE_TRIPLE_BUFFERING), true)
+ifeq ($(TARGET_DISABLE_TRIPLE_BUFFERING),true)
 	LOCAL_CFLAGS += -DTARGET_DISABLE_TRIPLE_BUFFERING
 endif
 
@@ -47,9 +49,9 @@
 	libgui
 
 # this is only needed for DDMS debugging
-ifneq ($(TARGET_BUILD_PDK), true)
+ifneq ($(TARGET_BUILD_PDK),true)
 	LOCAL_SHARED_LIBRARIES += libdvm libandroid_runtime
-	LOCAL_CLFAGS += -DDDMS_DEBUGGING
+	LOCAL_CFLAGS += -DDDMS_DEBUGGING
 	LOCAL_SRC_FILES += DdmConnection.cpp
 endif
 
diff --git a/services/surfaceflinger/Client.cpp b/services/surfaceflinger/Client.cpp
new file mode 100644
index 0000000..6af1943
--- /dev/null
+++ b/services/surfaceflinger/Client.cpp
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <binder/PermissionCache.h>
+
+#include <private/android_filesystem_config.h>
+
+#include "Client.h"
+#include "LayerBase.h"
+#include "SurfaceFlinger.h"
+
+namespace android {
+
+// ---------------------------------------------------------------------------
+
+const String16 sAccessSurfaceFlinger("android.permission.ACCESS_SURFACE_FLINGER");
+
+// ---------------------------------------------------------------------------
+
+Client::Client(const sp<SurfaceFlinger>& flinger)
+    : mFlinger(flinger), mNameGenerator(1)
+{
+}
+
+Client::~Client()
+{
+    const size_t count = mLayers.size();
+    for (size_t i=0 ; i<count ; i++) {
+        sp<LayerBaseClient> layer(mLayers.valueAt(i).promote());
+        if (layer != 0) {
+            mFlinger->removeLayer(layer);
+        }
+    }
+}
+
+status_t Client::initCheck() const {
+    return NO_ERROR;
+}
+
+size_t Client::attachLayer(const sp<LayerBaseClient>& layer)
+{
+    Mutex::Autolock _l(mLock);
+    size_t name = mNameGenerator++;
+    mLayers.add(name, layer);
+    return name;
+}
+
+void Client::detachLayer(const LayerBaseClient* layer)
+{
+    Mutex::Autolock _l(mLock);
+    // we do a linear search here, because this doesn't happen often
+    const size_t count = mLayers.size();
+    for (size_t i=0 ; i<count ; i++) {
+        if (mLayers.valueAt(i) == layer) {
+            mLayers.removeItemsAt(i, 1);
+            break;
+        }
+    }
+}
+sp<LayerBaseClient> Client::getLayerUser(int32_t i) const
+{
+    Mutex::Autolock _l(mLock);
+    sp<LayerBaseClient> lbc;
+    wp<LayerBaseClient> layer(mLayers.valueFor(i));
+    if (layer != 0) {
+        lbc = layer.promote();
+        ALOGE_IF(lbc==0, "getLayerUser(name=%d) is dead", int(i));
+    }
+    return lbc;
+}
+
+
+status_t Client::onTransact(
+    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
+{
+    // these must be checked
+     IPCThreadState* ipc = IPCThreadState::self();
+     const int pid = ipc->getCallingPid();
+     const int uid = ipc->getCallingUid();
+     const int self_pid = getpid();
+     if (CC_UNLIKELY(pid != self_pid && uid != AID_GRAPHICS && uid != 0)) {
+         // we're called from a different process, do the real check
+         if (!PermissionCache::checkCallingPermission(sAccessSurfaceFlinger))
+         {
+             ALOGE("Permission Denial: "
+                     "can't openGlobalTransaction pid=%d, uid=%d", pid, uid);
+             return PERMISSION_DENIED;
+         }
+     }
+     return BnSurfaceComposerClient::onTransact(code, data, reply, flags);
+}
+
+
+sp<ISurface> Client::createSurface(
+        ISurfaceComposerClient::surface_data_t* params,
+        const String8& name,
+        DisplayID display, uint32_t w, uint32_t h, PixelFormat format,
+        uint32_t flags)
+{
+    /*
+     * createSurface must be called from the GL thread so that it can
+     * have access to the GL context.
+     */
+
+    class MessageCreateSurface : public MessageBase {
+        sp<ISurface> result;
+        SurfaceFlinger* flinger;
+        ISurfaceComposerClient::surface_data_t* params;
+        Client* client;
+        const String8& name;
+        DisplayID display;
+        uint32_t w, h;
+        PixelFormat format;
+        uint32_t flags;
+    public:
+        MessageCreateSurface(SurfaceFlinger* flinger,
+                ISurfaceComposerClient::surface_data_t* params,
+                const String8& name, Client* client,
+                DisplayID display, uint32_t w, uint32_t h, PixelFormat format,
+                uint32_t flags)
+            : flinger(flinger), params(params), client(client), name(name),
+              display(display), w(w), h(h), format(format), flags(flags)
+        {
+        }
+        sp<ISurface> getResult() const { return result; }
+        virtual bool handler() {
+            result = flinger->createSurface(params, name, client,
+                    display, w, h, format, flags);
+            return true;
+        }
+    };
+
+    sp<MessageBase> msg = new MessageCreateSurface(mFlinger.get(),
+            params, name, this, display, w, h, format, flags);
+    mFlinger->postMessageSync(msg);
+    return static_cast<MessageCreateSurface*>( msg.get() )->getResult();
+}
+status_t Client::destroySurface(SurfaceID sid) {
+    return mFlinger->removeSurface(this, sid);
+}
+
+// ---------------------------------------------------------------------------
+}; // namespace android
diff --git a/services/surfaceflinger/Client.h b/services/surfaceflinger/Client.h
new file mode 100644
index 0000000..9bfee72
--- /dev/null
+++ b/services/surfaceflinger/Client.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_CLIENT_H
+#define ANDROID_SF_CLIENT_H
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <utils/Errors.h>
+#include <utils/KeyedVector.h>
+#include <utils/Mutex.h>
+
+#include <gui/ISurfaceComposerClient.h>
+
+namespace android {
+
+// ---------------------------------------------------------------------------
+
+class LayerBaseClient;
+class SurfaceFlinger;
+
+// ---------------------------------------------------------------------------
+
+class Client : public BnSurfaceComposerClient
+{
+public:
+        Client(const sp<SurfaceFlinger>& flinger);
+        ~Client();
+
+    status_t initCheck() const;
+
+    // protected by SurfaceFlinger::mStateLock
+    size_t attachLayer(const sp<LayerBaseClient>& layer);
+
+    void detachLayer(const LayerBaseClient* layer);
+
+    sp<LayerBaseClient> getLayerUser(int32_t i) const;
+
+private:
+    // ISurfaceComposerClient interface
+    virtual sp<ISurface> createSurface(
+            surface_data_t* params, const String8& name,
+            DisplayID display, uint32_t w, uint32_t h,PixelFormat format,
+            uint32_t flags);
+
+    virtual status_t destroySurface(SurfaceID surfaceId);
+
+    virtual status_t onTransact(
+        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);
+
+    // constant
+    sp<SurfaceFlinger> mFlinger;
+
+    // protected by mLock
+    DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;
+    size_t mNameGenerator;
+
+    // thread-safe
+    mutable Mutex mLock;
+};
+
+// ---------------------------------------------------------------------------
+}; // namespace android
+
+#endif // ANDROID_SF_CLIENT_H
diff --git a/services/surfaceflinger/DisplayHardware/DisplayHardware.cpp b/services/surfaceflinger/DisplayHardware/DisplayHardware.cpp
index bb93215..e1c4f62 100644
--- a/services/surfaceflinger/DisplayHardware/DisplayHardware.cpp
+++ b/services/surfaceflinger/DisplayHardware/DisplayHardware.cpp
@@ -25,13 +25,13 @@
 #include <utils/Log.h>
 
 #include <ui/PixelFormat.h>
-#include <ui/FramebufferNativeWindow.h>
 
 #include <GLES/gl.h>
 #include <EGL/egl.h>
 #include <EGL/eglext.h>
 
 #include "DisplayHardware/DisplayHardware.h"
+#include "DisplayHardware/FramebufferSurface.h"
 
 #include <hardware/gralloc.h>
 
@@ -148,7 +148,7 @@
 
 void DisplayHardware::init(uint32_t dpy)
 {
-    mNativeWindow = new FramebufferNativeWindow();
+    mNativeWindow = new FramebufferSurface();
     framebuffer_device_t const * fbDev = mNativeWindow->getDevice();
     if (!fbDev) {
         ALOGE("Display subsystem failed to initialize. check logs. exiting...");
diff --git a/services/surfaceflinger/DisplayHardware/DisplayHardware.h b/services/surfaceflinger/DisplayHardware/DisplayHardware.h
index 0604031..f029a0a 100644
--- a/services/surfaceflinger/DisplayHardware/DisplayHardware.h
+++ b/services/surfaceflinger/DisplayHardware/DisplayHardware.h
@@ -35,7 +35,7 @@
 
 namespace android {
 
-class FramebufferNativeWindow;
+class FramebufferSurface;
 
 class DisplayHardware :
     public DisplayHardwareBase,
@@ -144,7 +144,7 @@
     // protected by mLock
     wp<VSyncHandler>    mVSyncHandler;
 
-    sp<FramebufferNativeWindow> mNativeWindow;
+    sp<FramebufferSurface> mNativeWindow;
 };
 
 }; // namespace android
diff --git a/services/surfaceflinger/DisplayHardware/DisplayHardwareBase.cpp b/services/surfaceflinger/DisplayHardware/DisplayHardwareBase.cpp
index d3a8bde..e161c44 100644
--- a/services/surfaceflinger/DisplayHardware/DisplayHardwareBase.cpp
+++ b/services/surfaceflinger/DisplayHardware/DisplayHardwareBase.cpp
@@ -30,91 +30,13 @@
 // ----------------------------------------------------------------------------
 namespace android {
 
-static char const * const kSleepFileName = "/sys/power/wait_for_fb_sleep";
-static char const * const kWakeFileName  = "/sys/power/wait_for_fb_wake";
-
-// ----------------------------------------------------------------------------
-
-DisplayHardwareBase::DisplayEventThread::DisplayEventThread(
-        const sp<SurfaceFlinger>& flinger)
-    : Thread(false), mFlinger(flinger) {
-}
-
-DisplayHardwareBase::DisplayEventThread::~DisplayEventThread() {
-}
-
-status_t DisplayHardwareBase::DisplayEventThread::initCheck() const {
-    return ((access(kSleepFileName, R_OK) == 0 &&
-            access(kWakeFileName, R_OK) == 0)) ? NO_ERROR : NO_INIT;
-}
-
-bool DisplayHardwareBase::DisplayEventThread::threadLoop() {
-
-    if (waitForFbSleep() == NO_ERROR) {
-        sp<SurfaceFlinger> flinger = mFlinger.promote();
-        ALOGD("About to give-up screen, flinger = %p", flinger.get());
-        if (flinger != 0) {
-            flinger->screenReleased();
-        }
-        if (waitForFbWake() == NO_ERROR) {
-            ALOGD("Screen about to return, flinger = %p", flinger.get());
-            if (flinger != 0) {
-                flinger->screenAcquired();
-            }
-            return true;
-        }
-    }
-
-    // error, exit the thread
-    return false;
-}
-
-status_t DisplayHardwareBase::DisplayEventThread::waitForFbSleep() {
-    int err = 0;
-    char buf;
-    int fd = open(kSleepFileName, O_RDONLY, 0);
-    // if the file doesn't exist, the error will be caught in read() below
-    do {
-        err = read(fd, &buf, 1);
-    } while (err < 0 && errno == EINTR);
-    close(fd);
-    ALOGE_IF(err<0, "*** ANDROID_WAIT_FOR_FB_SLEEP failed (%s)", strerror(errno));
-    return err < 0 ? -errno : int(NO_ERROR);
-}
-
-status_t DisplayHardwareBase::DisplayEventThread::waitForFbWake() {
-    int err = 0;
-    char buf;
-    int fd = open(kWakeFileName, O_RDONLY, 0);
-    // if the file doesn't exist, the error will be caught in read() below
-    do {
-        err = read(fd, &buf, 1);
-    } while (err < 0 && errno == EINTR);
-    close(fd);
-    ALOGE_IF(err<0, "*** ANDROID_WAIT_FOR_FB_WAKE failed (%s)", strerror(errno));
-    return err < 0 ? -errno : int(NO_ERROR);
-}
-
-// ----------------------------------------------------------------------------
-
 DisplayHardwareBase::DisplayHardwareBase(const sp<SurfaceFlinger>& flinger,
         uint32_t displayIndex) 
 {
     mScreenAcquired = true;
-    mDisplayEventThread = new DisplayEventThread(flinger);
-}
-
-void DisplayHardwareBase::startSleepManagement() const {
-    if (mDisplayEventThread->initCheck() == NO_ERROR) {
-        mDisplayEventThread->run("DisplayEventThread", PRIORITY_URGENT_DISPLAY);
-    } else {
-        ALOGW("/sys/power/wait_for_fb_{wake|sleep} don't exist");
-    }
 }
 
 DisplayHardwareBase::~DisplayHardwareBase() {
-    // request exit
-    mDisplayEventThread->requestExitAndWait();
 }
 
 bool DisplayHardwareBase::canDraw() const {
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
new file mode 100644
index 0000000..02ec86e
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.cpp
@@ -0,0 +1,188 @@
+/*
+ **
+ ** Copyright 2007 The Android Open Source Project
+ **
+ ** Licensed under the Apache License Version 2.0(the "License");
+ ** you may not use this file except in compliance with the License.
+ ** You may obtain a copy of the License at
+ **
+ **     http://www.apache.org/licenses/LICENSE-2.0
+ **
+ ** Unless required by applicable law or agreed to in writing software
+ ** distributed under the License is distributed on an "AS IS" BASIS
+ ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND either express or implied.
+ ** See the License for the specific language governing permissions and
+ ** limitations under the License.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+
+#include <cutils/log.h>
+
+#include <utils/String8.h>
+
+#include <ui/Rect.h>
+
+#include <EGL/egl.h>
+
+#include <hardware/hardware.h>
+#include <gui/SurfaceTextureClient.h>
+#include <ui/GraphicBuffer.h>
+
+#include "DisplayHardware/FramebufferSurface.h"
+
+// ----------------------------------------------------------------------------
+namespace android {
+// ----------------------------------------------------------------------------
+
+
+/*
+ * This implements the (main) framebuffer management. This class is used
+ * mostly by SurfaceFlinger, but also by command line GL application.
+ *
+ */
+
+FramebufferSurface::FramebufferSurface()
+    : SurfaceTextureClient(),
+      fbDev(0), mCurrentBufferIndex(-1), mUpdateOnDemand(false)
+{
+    hw_module_t const* module;
+    if (hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module) == 0) {
+        int stride;
+        int err;
+        int i;
+        err = framebuffer_open(module, &fbDev);
+        ALOGE_IF(err, "couldn't open framebuffer HAL (%s)", strerror(-err));
+
+        // bail out if we can't initialize the modules
+        if (!fbDev)
+            return;
+
+        mUpdateOnDemand = (fbDev->setUpdateRect != 0);
+
+        const_cast<uint32_t&>(ANativeWindow::flags) = fbDev->flags;
+        const_cast<float&>(ANativeWindow::xdpi) = fbDev->xdpi;
+        const_cast<float&>(ANativeWindow::ydpi) = fbDev->ydpi;
+        const_cast<int&>(ANativeWindow::minSwapInterval) =  fbDev->minSwapInterval;
+        const_cast<int&>(ANativeWindow::maxSwapInterval) =  fbDev->maxSwapInterval;
+    } else {
+        ALOGE("Couldn't get gralloc module");
+    }
+
+    class GraphicBufferAlloc : public BnGraphicBufferAlloc {
+    public:
+        GraphicBufferAlloc() { };
+        virtual ~GraphicBufferAlloc() { };
+        virtual sp<GraphicBuffer> createGraphicBuffer(uint32_t w, uint32_t h,
+                PixelFormat format, uint32_t usage, status_t* error) {
+            sp<GraphicBuffer> graphicBuffer(new GraphicBuffer(w, h, format, usage));
+            return graphicBuffer;
+        }
+    };
+
+    mBufferQueue = new BufferQueue(true, NUM_FRAME_BUFFERS, new GraphicBufferAlloc());
+    mBufferQueue->setConsumerUsageBits(GRALLOC_USAGE_HW_FB|GRALLOC_USAGE_HW_RENDER|GRALLOC_USAGE_HW_COMPOSER);
+    mBufferQueue->setDefaultBufferFormat(fbDev->format);
+    mBufferQueue->setDefaultBufferSize(fbDev->width, fbDev->height);
+    mBufferQueue->setSynchronousMode(true);
+    mBufferQueue->setBufferCountServer(NUM_FRAME_BUFFERS);
+    setISurfaceTexture(mBufferQueue);
+}
+
+void FramebufferSurface::onFirstRef() {
+    class Listener : public BufferQueue::ConsumerListener {
+        const wp<FramebufferSurface> that;
+        virtual ~Listener() { }
+        virtual void onBuffersReleased() { }
+        void onFrameAvailable() {
+            sp<FramebufferSurface> self = that.promote();
+            if (self != NULL) {
+                BufferQueue::BufferItem item;
+                status_t err = self->mBufferQueue->acquireBuffer(&item);
+                if (err == 0) {
+                    if (item.mGraphicBuffer != 0) {
+                        self->mBuffers[item.mBuf] = item.mGraphicBuffer;
+                    }
+                    self->fbDev->post(self->fbDev, self->mBuffers[item.mBuf]->handle);
+                    if (self->mCurrentBufferIndex >= 0) {
+                        self->mBufferQueue->releaseBuffer(self->mCurrentBufferIndex,
+                                EGL_NO_DISPLAY, EGL_NO_SYNC_KHR);
+                    }
+                    self->mCurrentBufferIndex = item.mBuf;
+                }
+            }
+        }
+    public:
+        Listener(const sp<FramebufferSurface>& that) : that(that) { }
+    };
+
+    mBufferQueue->setConsumerName(String8("FramebufferSurface"));
+    mBufferQueue->consumerConnect(new Listener(this));
+}
+
+FramebufferSurface::~FramebufferSurface() {
+    if (fbDev) {
+        framebuffer_close(fbDev);
+    }
+}
+
+status_t FramebufferSurface::setUpdateRectangle(const Rect& r)
+{
+    if (!mUpdateOnDemand) {
+        return INVALID_OPERATION;
+    }
+    return fbDev->setUpdateRect(fbDev, r.left, r.top, r.width(), r.height());
+}
+
+status_t FramebufferSurface::compositionComplete()
+{
+    if (fbDev->compositionComplete) {
+        return fbDev->compositionComplete(fbDev);
+    }
+    return INVALID_OPERATION;
+}
+
+void FramebufferSurface::dump(String8& result) {
+    if (fbDev->common.version >= 1 && fbDev->dump) {
+        const size_t SIZE = 4096;
+        char buffer[SIZE];
+
+        fbDev->dump(fbDev, buffer, SIZE);
+        result.append(buffer);
+    }
+}
+
+int FramebufferSurface::query(int what, int* value) const {
+    Mutex::Autolock _l(mLock);
+    framebuffer_device_t* fb = fbDev;
+    switch (what) {
+        case NATIVE_WINDOW_DEFAULT_WIDTH:
+        case NATIVE_WINDOW_WIDTH:
+            *value = fb->width;
+            return NO_ERROR;
+        case NATIVE_WINDOW_DEFAULT_HEIGHT:
+        case NATIVE_WINDOW_HEIGHT:
+            *value = fb->height;
+            return NO_ERROR;
+        case NATIVE_WINDOW_FORMAT:
+            *value = fb->format;
+            return NO_ERROR;
+        case NATIVE_WINDOW_CONCRETE_TYPE:
+            *value = NATIVE_WINDOW_FRAMEBUFFER;
+            return NO_ERROR;
+        case NATIVE_WINDOW_QUEUES_TO_WINDOW_COMPOSER:
+            *value = 0;
+            return NO_ERROR;
+        case NATIVE_WINDOW_TRANSFORM_HINT:
+            *value = 0;
+            return NO_ERROR;
+    }
+    return SurfaceTextureClient::query(what, value);
+}
+
+// ----------------------------------------------------------------------------
+}; // namespace android
+// ----------------------------------------------------------------------------
diff --git a/services/surfaceflinger/DisplayHardware/FramebufferSurface.h b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
new file mode 100644
index 0000000..5b4fd01
--- /dev/null
+++ b/services/surfaceflinger/DisplayHardware/FramebufferSurface.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2007 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SF_FRAMEBUFFER_SURFACE_H
+#define ANDROID_SF_FRAMEBUFFER_SURFACE_H
+
+#include <stdint.h>
+#include <sys/types.h>
+
+#include <EGL/egl.h>
+
+#include <gui/SurfaceTextureClient.h>
+
+#define NUM_FRAME_BUFFERS  2
+
+// ---------------------------------------------------------------------------
+namespace android {
+// ---------------------------------------------------------------------------
+
+class Rect;
+class String8;
+
+// ---------------------------------------------------------------------------
+
+class FramebufferSurface : public SurfaceTextureClient {
+public:
+    FramebufferSurface();
+
+    virtual void onFirstRef();
+
+    framebuffer_device_t const * getDevice() const { return fbDev; }
+
+    bool isUpdateOnDemand() const { return mUpdateOnDemand; }
+    status_t setUpdateRectangle(const Rect& updateRect);
+    status_t compositionComplete();
+
+    void dump(String8& result);
+
+private:
+    virtual ~FramebufferSurface(); // this class cannot be overloaded
+    virtual int query(int what, int* value) const;
+
+    framebuffer_device_t* fbDev;
+
+    sp<BufferQueue> mBufferQueue;
+    int mCurrentBufferIndex;
+    sp<GraphicBuffer> mBuffers[NUM_FRAME_BUFFERS];
+
+    mutable Mutex mLock;
+    bool mUpdateOnDemand;
+};
+
+// ---------------------------------------------------------------------------
+}; // namespace android
+// ---------------------------------------------------------------------------
+
+#endif // ANDROID_SF_FRAMEBUFFER_SURFACE_H
+
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.cpp b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
index 65763db..385be63 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.cpp
@@ -16,6 +16,9 @@
 
 #define ATRACE_TAG ATRACE_TAG_GRAPHICS
 
+// Uncomment this to remove support for HWC_DEVICE_API_VERSION_0_3 and older
+// #define HWC_REMOVE_DEPRECATED_VERSIONS 1
+
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -41,6 +44,58 @@
 #include "SurfaceFlinger.h"
 
 namespace android {
+
+// ---------------------------------------------------------------------------
+// Support for HWC_DEVICE_API_VERSION_0_3 and older:
+// Since v0.3 is deprecated and support will be dropped soon, as much as
+// possible the code is written to target v1.0. When using a v0.3 HWC, we
+// allocate v0.3 structures, but assign them to v1.0 pointers. Fields that
+// exist in both versions are located at the same offset, so in most cases we
+// can just use the v1.0 pointer without branches or casts.
+
+#if HWC_REMOVE_DEPRECATED_VERSIONS
+// We need complete types with to satisfy semantic checks, even though the
+// code paths that use these won't get executed at runtime (and will likely be
+// dead-code-eliminated). When we remove the code to support v0.3 we can remove
+// these as well.
+typedef hwc_layer_1_t hwc_layer_t;
+typedef hwc_layer_list_1_t hwc_layer_list_t;
+typedef hwc_composer_device_1_t hwc_composer_device_t;
+#endif
+
+// This function assumes we've already rejected HWC's with lower-than-required
+// versions. Don't use it for the initial "does HWC meet requirements" check!
+static bool hwcHasVersion(const hwc_composer_device_1_t* hwc, uint32_t version) {
+    if (HWC_REMOVE_DEPRECATED_VERSIONS &&
+            version <= HWC_DEVICE_API_VERSION_1_0) {
+        return true;
+    } else {
+        return hwc->common.version >= version;
+    }
+}
+
+static size_t sizeofHwcLayerList(const hwc_composer_device_1_t* hwc,
+        size_t numLayers) {
+    if (hwcHasVersion(hwc, HWC_DEVICE_API_VERSION_1_0)) {
+        return sizeof(hwc_layer_list_1_t) + numLayers*sizeof(hwc_layer_1_t);
+    } else {
+        return sizeof(hwc_layer_list_t) + numLayers*sizeof(hwc_layer_t);
+    }
+}
+
+// ---------------------------------------------------------------------------
+
+struct HWComposer::cb_context {
+    struct callbacks : public hwc_procs_t {
+        // these are here to facilitate the transition when adding
+        // new callbacks (an implementation can check for NULL before
+        // calling a new callback).
+        void (*zero[4])(void);
+    };
+    callbacks procs;
+    HWComposer* hwc;
+};
+
 // ---------------------------------------------------------------------------
 
 HWComposer::HWComposer(
@@ -51,6 +106,7 @@
       mModule(0), mHwc(0), mList(0), mCapacity(0),
       mNumOVLayers(0), mNumFBLayers(0),
       mDpy(EGL_NO_DISPLAY), mSur(EGL_NO_SURFACE),
+      mCBContext(new cb_context),
       mEventHandler(handler),
       mRefreshPeriod(refreshPeriod),
       mVSyncCount(0), mDebugForceFakeVSync(false)
@@ -63,18 +119,28 @@
     int err = hw_get_module(HWC_HARDWARE_MODULE_ID, &mModule);
     ALOGW_IF(err, "%s module not found", HWC_HARDWARE_MODULE_ID);
     if (err == 0) {
-        err = hwc_open(mModule, &mHwc);
+        err = hwc_open_1(mModule, &mHwc);
         ALOGE_IF(err, "%s device failed to initialize (%s)",
                 HWC_HARDWARE_COMPOSER, strerror(-err));
         if (err == 0) {
-            if (mHwc->registerProcs) {
-                mCBContext.hwc = this;
-                mCBContext.procs.invalidate = &hook_invalidate;
-                mCBContext.procs.vsync = &hook_vsync;
-                mHwc->registerProcs(mHwc, &mCBContext.procs);
-                memset(mCBContext.procs.zero, 0, sizeof(mCBContext.procs.zero));
+            if (HWC_REMOVE_DEPRECATED_VERSIONS &&
+                    mHwc->common.version < HWC_DEVICE_API_VERSION_1_0) {
+                ALOGE("%s device version %#x too old, will not be used",
+                        HWC_HARDWARE_COMPOSER, mHwc->common.version);
+                hwc_close_1(mHwc);
+                mHwc = NULL;
             }
-            if (mHwc->common.version >= HWC_DEVICE_API_VERSION_0_3) {
+        }
+
+        if (mHwc) {
+            if (mHwc->registerProcs) {
+                mCBContext->hwc = this;
+                mCBContext->procs.invalidate = &hook_invalidate;
+                mCBContext->procs.vsync = &hook_vsync;
+                mHwc->registerProcs(mHwc, &mCBContext->procs);
+                memset(mCBContext->procs.zero, 0, sizeof(mCBContext->procs.zero));
+            }
+            if (hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_0_3)) {
                 if (mDebugForceFakeVSync) {
                     // make sure to turn h/w vsync off in "fake vsync" mode
                     mHwc->methods->eventControl(mHwc, HWC_EVENT_VSYNC, 0);
@@ -100,8 +166,9 @@
         mVSyncThread->requestExitAndWait();
     }
     if (mHwc) {
-        hwc_close(mHwc);
+        hwc_close_1(mHwc);
     }
+    delete mCBContext;
 }
 
 status_t HWComposer::initCheck() const {
@@ -151,8 +218,8 @@
     if (mHwc) {
         if (!mList || mCapacity < numLayers) {
             free(mList);
-            size_t size = sizeof(hwc_layer_list) + numLayers*sizeof(hwc_layer_t);
-            mList = (hwc_layer_list_t*)malloc(size);
+            size_t size = sizeofHwcLayerList(mHwc, numLayers);
+            mList = (hwc_layer_list_1_t*)malloc(size);
             mCapacity = numLayers;
         }
         mList->flags = HWC_GEOMETRY_CHANGED;
@@ -168,11 +235,19 @@
         size_t numFBLayers = 0;
         size_t count = mList->numHwLayers;
         for (size_t i=0 ; i<count ; i++) {
-            hwc_layer& l(mList->hwLayers[i]);
-            if (l.flags & HWC_SKIP_LAYER) {
-                l.compositionType = HWC_FRAMEBUFFER;
+            hwc_layer_1_t* l = NULL;
+            if (hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_1_0)) {
+                l = &mList->hwLayers[i];
+            } else {
+                // mList really has hwc_layer_list_t memory layout
+                hwc_layer_list_t* list = (hwc_layer_list_t*)mList;
+                hwc_layer_t* layer = &list->hwLayers[i];
+                l = (hwc_layer_1_t*)layer;
             }
-            switch (l.compositionType) {
+            if (l->flags & HWC_SKIP_LAYER) {
+                l->compositionType = HWC_FRAMEBUFFER;
+            }
+            switch (l->compositionType) {
                 case HWC_OVERLAY:
                     numOVLayers++;
                     break;
@@ -207,7 +282,7 @@
 
 status_t HWComposer::release() const {
     if (mHwc) {
-        if (mHwc->common.version >= HWC_DEVICE_API_VERSION_0_3) {
+        if (hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_0_3)) {
             mHwc->methods->eventControl(mHwc, HWC_EVENT_VSYNC, 0);
         }
         int err = mHwc->set(mHwc, NULL, NULL, NULL);
@@ -230,10 +305,186 @@
     return mList ? mList->numHwLayers : 0;
 }
 
-hwc_layer_t* HWComposer::getLayers() const {
-    return mList ? mList->hwLayers : 0;
+/*
+ * Helper template to implement a concrete HWCLayer
+ * This holds the pointer to the concrete hwc layer type
+ * and implements the "iterable" side of HWCLayer.
+ */
+template<typename CONCRETE, typename HWCTYPE>
+class Iterable : public HWComposer::HWCLayer {
+protected:
+    HWCTYPE* const mLayerList;
+    HWCTYPE* mCurrentLayer;
+    Iterable(HWCTYPE* layer) : mLayerList(layer), mCurrentLayer(layer) { }
+    inline HWCTYPE const * getLayer() const { return mCurrentLayer; }
+    inline HWCTYPE* getLayer() { return mCurrentLayer; }
+    virtual ~Iterable() { }
+private:
+    // returns a copy of ourselves
+    virtual HWComposer::HWCLayer* dup() {
+        return new CONCRETE( static_cast<const CONCRETE&>(*this) );
+    }
+    virtual status_t setLayer(size_t index) {
+        mCurrentLayer = &mLayerList[index];
+        return NO_ERROR;
+    }
+};
+
+// #if !HWC_REMOVE_DEPRECATED_VERSIONS
+/*
+ * Concrete implementation of HWCLayer for HWC_DEVICE_API_VERSION_0_3
+ * This implements the HWCLayer side of HWCIterableLayer.
+ */
+class HWCLayerVersion0 : public Iterable<HWCLayerVersion0, hwc_layer_t> {
+public:
+    HWCLayerVersion0(hwc_layer_t* layer)
+        : Iterable<HWCLayerVersion0, hwc_layer_t>(layer) { }
+
+    virtual int32_t getCompositionType() const {
+        return getLayer()->compositionType;
+    }
+    virtual uint32_t getHints() const {
+        return getLayer()->hints;
+    }
+
+    virtual void setDefaultState() {
+        getLayer()->compositionType = HWC_FRAMEBUFFER;
+        getLayer()->hints = 0;
+        getLayer()->flags = HWC_SKIP_LAYER;
+        getLayer()->transform = 0;
+        getLayer()->blending = HWC_BLENDING_NONE;
+        getLayer()->visibleRegionScreen.numRects = 0;
+        getLayer()->visibleRegionScreen.rects = NULL;
+    }
+    virtual void setSkip(bool skip) {
+        if (skip) {
+            getLayer()->flags |= HWC_SKIP_LAYER;
+        } else {
+            getLayer()->flags &= ~HWC_SKIP_LAYER;
+        }
+    }
+    virtual void setBlending(uint32_t blending) {
+        getLayer()->blending = blending;
+    }
+    virtual void setTransform(uint32_t transform) {
+        getLayer()->transform = transform;
+    }
+    virtual void setFrame(const Rect& frame) {
+        reinterpret_cast<Rect&>(getLayer()->displayFrame) = frame;
+    }
+    virtual void setCrop(const Rect& crop) {
+        reinterpret_cast<Rect&>(getLayer()->sourceCrop) = crop;
+    }
+    virtual void setVisibleRegionScreen(const Region& reg) {
+        getLayer()->visibleRegionScreen.rects =
+                reinterpret_cast<hwc_rect_t const *>(
+                        reg.getArray(&getLayer()->visibleRegionScreen.numRects));
+    }
+    virtual void setBuffer(const sp<GraphicBuffer>& buffer) {
+        if (buffer == 0 || buffer->handle == 0) {
+            getLayer()->compositionType = HWC_FRAMEBUFFER;
+            getLayer()->flags |= HWC_SKIP_LAYER;
+            getLayer()->handle = 0;
+        } else {
+            getLayer()->handle = buffer->handle;
+        }
+    }
+};
+// #endif // !HWC_REMOVE_DEPRECATED_VERSIONS
+
+/*
+ * Concrete implementation of HWCLayer for HWC_DEVICE_API_VERSION_1_0.
+ * This implements the HWCLayer side of HWCIterableLayer.
+ */
+class HWCLayerVersion1 : public Iterable<HWCLayerVersion1, hwc_layer_1_t> {
+public:
+    HWCLayerVersion1(hwc_layer_1_t* layer)
+        : Iterable<HWCLayerVersion1, hwc_layer_1_t>(layer) { }
+
+    virtual int32_t getCompositionType() const {
+        return getLayer()->compositionType;
+    }
+    virtual uint32_t getHints() const {
+        return getLayer()->hints;
+    }
+
+    virtual void setDefaultState() {
+        getLayer()->compositionType = HWC_FRAMEBUFFER;
+        getLayer()->hints = 0;
+        getLayer()->flags = HWC_SKIP_LAYER;
+        getLayer()->transform = 0;
+        getLayer()->blending = HWC_BLENDING_NONE;
+        getLayer()->visibleRegionScreen.numRects = 0;
+        getLayer()->visibleRegionScreen.rects = NULL;
+        getLayer()->acquireFenceFd = -1;
+        getLayer()->releaseFenceFd = -1;
+    }
+    virtual void setSkip(bool skip) {
+        if (skip) {
+            getLayer()->flags |= HWC_SKIP_LAYER;
+        } else {
+            getLayer()->flags &= ~HWC_SKIP_LAYER;
+        }
+    }
+    virtual void setBlending(uint32_t blending) {
+        getLayer()->blending = blending;
+    }
+    virtual void setTransform(uint32_t transform) {
+        getLayer()->transform = transform;
+    }
+    virtual void setFrame(const Rect& frame) {
+        reinterpret_cast<Rect&>(getLayer()->displayFrame) = frame;
+    }
+    virtual void setCrop(const Rect& crop) {
+        reinterpret_cast<Rect&>(getLayer()->sourceCrop) = crop;
+    }
+    virtual void setVisibleRegionScreen(const Region& reg) {
+        getLayer()->visibleRegionScreen.rects =
+                reinterpret_cast<hwc_rect_t const *>(
+                        reg.getArray(&getLayer()->visibleRegionScreen.numRects));
+    }
+    virtual void setBuffer(const sp<GraphicBuffer>& buffer) {
+        if (buffer == 0 || buffer->handle == 0) {
+            getLayer()->compositionType = HWC_FRAMEBUFFER;
+            getLayer()->flags |= HWC_SKIP_LAYER;
+            getLayer()->handle = 0;
+        } else {
+            getLayer()->handle = buffer->handle;
+        }
+    }
+};
+
+/*
+ * returns an iterator initialized at a given index in the layer list
+ */
+HWComposer::LayerListIterator HWComposer::getLayerIterator(size_t index) {
+    if (!mList || index > mList->numHwLayers) {
+        return LayerListIterator();
+    }
+    if (hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_1_0)) {
+        return LayerListIterator(new HWCLayerVersion1(mList->hwLayers), index);
+    } else {
+        hwc_layer_list_t* list0 = (hwc_layer_list_t*)mList;
+        return LayerListIterator(new HWCLayerVersion0(list0->hwLayers), index);
+    }
 }
 
+/*
+ * returns an iterator on the beginning of the layer list
+ */
+HWComposer::LayerListIterator HWComposer::begin() {
+    return getLayerIterator(0);
+}
+
+/*
+ * returns an iterator on the end of the layer list
+ */
+HWComposer::LayerListIterator HWComposer::end() {
+    return getLayerIterator(getNumLayers());
+}
+
+
+
 void HWComposer::dump(String8& result, char* buffer, size_t SIZE,
         const Vector< sp<LayerBase> >& visibleLayersSortedByZ) const {
     if (mHwc && mList) {
@@ -247,7 +498,14 @@
                 "----------+----------+----------+----------+----+-------+----------+---------------------------+--------------------------------\n");
         //      " ________ | ________ | ________ | ________ | __ | _____ | ________ | [_____,_____,_____,_____] | [_____,_____,_____,_____]
         for (size_t i=0 ; i<mList->numHwLayers ; i++) {
-            const hwc_layer_t& l(mList->hwLayers[i]);
+            hwc_layer_1_t l;
+            if (hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_1_0)) {
+                l = mList->hwLayers[i];
+            } else {
+                hwc_layer_list_t* list0 = (hwc_layer_list_t*)mList;
+                *(hwc_layer_t*)&l = list0->hwLayers[i];
+                l.acquireFenceFd = l.releaseFenceFd = -1;
+            }
             const sp<LayerBase> layer(visibleLayersSortedByZ[i]);
             int32_t format = -1;
             if (layer->getLayer() != NULL) {
@@ -265,7 +523,7 @@
                     layer->getName().string());
         }
     }
-    if (mHwc && mHwc->common.version >= HWC_DEVICE_API_VERSION_0_1 && mHwc->dump) {
+    if (mHwc && hwcHasVersion(mHwc, HWC_DEVICE_API_VERSION_0_1) && mHwc->dump) {
         mHwc->dump(mHwc, buffer, SIZE);
         result.append(buffer);
     }
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.h b/services/surfaceflinger/DisplayHardware/HWComposer.h
index aada3cd..05c6f6d 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.h
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.h
@@ -22,7 +22,7 @@
 
 #include <EGL/egl.h>
 
-#include <hardware/hwcomposer.h>
+#include <hardware/hwcomposer_defs.h>
 
 #include <utils/StrongPointer.h>
 #include <utils/Vector.h>
@@ -31,12 +31,17 @@
                            const struct timespec *request,
                            struct timespec *remain);
 
+struct hwc_composer_device_1;
+struct hwc_layer_list_1;
+struct hwc_procs;
+
 namespace android {
 // ---------------------------------------------------------------------------
 
 class String8;
 class SurfaceFlinger;
 class LayerBase;
+class GraphicBuffer;
 
 class HWComposer
 {
@@ -57,9 +62,6 @@
     // tells the HAL what the framebuffer is
     void setFrameBuffer(EGLDisplay dpy, EGLSurface sur);
 
-    // create a work list for numLayers layer. sets HWC_GEOMETRY_CHANGED.
-    status_t createWorkList(size_t numLayers);
-
     // Asks the HAL what it can do
     status_t prepare() const;
 
@@ -72,14 +74,109 @@
     // release hardware resources
     status_t release() const;
 
+    // create a work list for numLayers layer. sets HWC_GEOMETRY_CHANGED.
+    status_t createWorkList(size_t numLayers);
+
     // get the layer array created by createWorkList()
     size_t getNumLayers() const;
-    hwc_layer_t* getLayers() const;
 
     // get number of layers of the given type as updated in prepare().
     // type is HWC_OVERLAY or HWC_FRAMEBUFFER
     size_t getLayerCount(int type) const;
 
+    // needed forward declarations
+    class LayerListIterator;
+
+    /*
+     * Interface to hardware composer's layers functionality.
+     * This abstracts the HAL interface to layers which can evolve in
+     * incompatible ways from one release to another.
+     * The idea is that we could extend this interface as we add
+     * features to h/w composer.
+     */
+    class HWCLayerInterface {
+    protected:
+        virtual ~HWCLayerInterface() { }
+    public:
+        virtual int32_t getCompositionType() const = 0;
+        virtual uint32_t getHints() const = 0;
+        virtual void setDefaultState() = 0;
+        virtual void setSkip(bool skip) = 0;
+        virtual void setBlending(uint32_t blending) = 0;
+        virtual void setTransform(uint32_t transform) = 0;
+        virtual void setFrame(const Rect& frame) = 0;
+        virtual void setCrop(const Rect& crop) = 0;
+        virtual void setVisibleRegionScreen(const Region& reg) = 0;
+        virtual void setBuffer(const sp<GraphicBuffer>& buffer) = 0;
+    };
+
+    /*
+     * Interface used to implement an iterator to a list
+     * of HWCLayer.
+     */
+    class HWCLayer : public HWCLayerInterface {
+        friend class LayerListIterator;
+        // select the layer at the given index
+        virtual status_t setLayer(size_t index) = 0;
+        virtual HWCLayer* dup() = 0;
+        static HWCLayer* copy(HWCLayer *rhs) {
+            return rhs ? rhs->dup() : NULL;
+        }
+    protected:
+        virtual ~HWCLayer() { }
+    };
+
+    /*
+     * Iterator through a HWCLayer list.
+     * This behaves more or less like a forward iterator.
+     */
+    class LayerListIterator {
+        friend struct HWComposer;
+        HWCLayer* const mLayerList;
+        size_t mIndex;
+
+        LayerListIterator() : mLayerList(NULL), mIndex(0) { }
+
+        LayerListIterator(HWCLayer* layer, size_t index)
+            : mLayerList(layer), mIndex(index) { }
+
+        // we don't allow assignment, because we don't need it for now
+        LayerListIterator& operator = (const LayerListIterator& rhs);
+
+    public:
+        // copy operators
+        LayerListIterator(const LayerListIterator& rhs)
+            : mLayerList(HWCLayer::copy(rhs.mLayerList)), mIndex(rhs.mIndex) {
+        }
+
+        ~LayerListIterator() { delete mLayerList; }
+
+        // pre-increment
+        LayerListIterator& operator++() {
+            mLayerList->setLayer(++mIndex);
+            return *this;
+        }
+
+        // dereference
+        HWCLayerInterface& operator * () { return *mLayerList; }
+        HWCLayerInterface* operator -> () { return mLayerList; }
+
+        // comparison
+        bool operator == (const LayerListIterator& rhs) const {
+            return mIndex == rhs.mIndex;
+        }
+        bool operator != (const LayerListIterator& rhs) const {
+            return !operator==(rhs);
+        }
+    };
+
+    // Returns an iterator to the beginning of the layer list
+    LayerListIterator begin();
+
+    // Returns an iterator to the end of the layer list
+    LayerListIterator end();
+
+
     // Events handling ---------------------------------------------------------
 
     enum {
@@ -111,18 +208,9 @@
             const Vector< sp<LayerBase> >& visibleLayersSortedByZ) const;
 
 private:
+    LayerListIterator getLayerIterator(size_t index);
 
-    struct callbacks : public hwc_procs_t {
-        // these are here to facilitate the transition when adding
-        // new callbacks (an implementation can check for NULL before
-        // calling a new callback).
-        void (*zero[4])(void);
-    };
-
-    struct cb_context {
-        callbacks procs;
-        HWComposer* hwc;
-    };
+    struct cb_context;
 
     static void hook_invalidate(struct hwc_procs* procs);
     static void hook_vsync(struct hwc_procs* procs, int dpy, int64_t timestamp);
@@ -130,24 +218,23 @@
     inline void invalidate();
     inline void vsync(int dpy, int64_t timestamp);
 
-    sp<SurfaceFlinger>      mFlinger;
-    hw_module_t const*      mModule;
-    hwc_composer_device_t*  mHwc;
-    hwc_layer_list_t*       mList;
-    size_t                  mCapacity;
-    mutable size_t          mNumOVLayers;
-    mutable size_t          mNumFBLayers;
-    hwc_display_t           mDpy;
-    hwc_surface_t           mSur;
-    cb_context              mCBContext;
-    EventHandler&           mEventHandler;
-    nsecs_t                 mRefreshPeriod;
-    size_t                  mVSyncCount;
-    sp<VSyncThread>         mVSyncThread;
-    bool                    mDebugForceFakeVSync;
+    sp<SurfaceFlinger>              mFlinger;
+    hw_module_t const*              mModule;
+    struct hwc_composer_device_1*   mHwc;
+    struct hwc_layer_list_1*        mList;
+    size_t                          mCapacity;
+    mutable size_t                  mNumOVLayers;
+    mutable size_t                  mNumFBLayers;
+    EGLDisplay                      mDpy;
+    EGLSurface                      mSur;
+    cb_context*                     mCBContext;
+    EventHandler&                   mEventHandler;
+    nsecs_t                         mRefreshPeriod;
+    size_t                          mVSyncCount;
+    sp<VSyncThread>                 mVSyncThread;
+    bool                            mDebugForceFakeVSync;
 };
 
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 4062340..890bcb4 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -259,16 +259,17 @@
     return crop;
 }
 
-void Layer::setGeometry(hwc_layer_t* hwcl)
+void Layer::setGeometry(HWComposer::HWCLayerInterface& layer)
 {
-    LayerBaseClient::setGeometry(hwcl);
+    LayerBaseClient::setGeometry(layer);
 
-    hwcl->flags &= ~HWC_SKIP_LAYER;
+    // enable this layer
+    layer.setSkip(false);
 
     // we can't do alpha-fade with the hwc HAL
     const State& s(drawingState());
     if (s.alpha < 0xFF) {
-        hwcl->flags = HWC_SKIP_LAYER;
+        layer.setSkip(true);
     }
 
     /*
@@ -288,29 +289,18 @@
 
     // we can only handle simple transformation
     if (finalTransform & Transform::ROT_INVALID) {
-        hwcl->flags = HWC_SKIP_LAYER;
+        layer.setSkip(true);
     } else {
-        hwcl->transform = finalTransform;
+        layer.setTransform(finalTransform);
     }
-
-    Rect crop = computeBufferCrop();
-    hwcl->sourceCrop.left   = crop.left;
-    hwcl->sourceCrop.top    = crop.top;
-    hwcl->sourceCrop.right  = crop.right;
-    hwcl->sourceCrop.bottom = crop.bottom;
+    layer.setCrop(computeBufferCrop());
 }
 
-void Layer::setPerFrameData(hwc_layer_t* hwcl) {
+void Layer::setPerFrameData(HWComposer::HWCLayerInterface& layer) {
     const sp<GraphicBuffer>& buffer(mActiveBuffer);
-    if (buffer == NULL) {
-        // this can happen if the client never drew into this layer yet,
-        // or if we ran out of memory. In that case, don't let
-        // HWC handle it.
-        hwcl->flags |= HWC_SKIP_LAYER;
-        hwcl->handle = NULL;
-    } else {
-        hwcl->handle = buffer->handle;
-    }
+    // NOTE: buffer can be NULL if the client never drew into this
+    // layer yet, or if we ran out of memory
+    layer.setBuffer(buffer);
 }
 
 void Layer::onDraw(const Region& clip) const
diff --git a/services/surfaceflinger/Layer.h b/services/surfaceflinger/Layer.h
index 393599f..7a164aa 100644
--- a/services/surfaceflinger/Layer.h
+++ b/services/surfaceflinger/Layer.h
@@ -64,8 +64,8 @@
     bool isFixedSize() const;
 
     // LayerBase interface
-    virtual void setGeometry(hwc_layer_t* hwcl);
-    virtual void setPerFrameData(hwc_layer_t* hwcl);
+    virtual void setGeometry(HWComposer::HWCLayerInterface& layer);
+    virtual void setPerFrameData(HWComposer::HWCLayerInterface& layer);
     virtual void onDraw(const Region& clip) const;
     virtual uint32_t doTransaction(uint32_t transactionFlags);
     virtual void lockPageFlip(bool& recomputeVisibleRegions);
diff --git a/services/surfaceflinger/LayerBase.cpp b/services/surfaceflinger/LayerBase.cpp
index 16bac8f..893dcb9 100644
--- a/services/surfaceflinger/LayerBase.cpp
+++ b/services/surfaceflinger/LayerBase.cpp
@@ -29,6 +29,7 @@
 #include <hardware/hardware.h>
 
 #include "clz.h"
+#include "Client.h"
 #include "LayerBase.h"
 #include "SurfaceFlinger.h"
 #include "DisplayHardware/DisplayHardware.h"
@@ -281,48 +282,34 @@
         const Transform& planeTransform, Region& outDirtyRegion) {
 }
 
-void LayerBase::setGeometry(hwc_layer_t* hwcl)
+void LayerBase::setGeometry(HWComposer::HWCLayerInterface& layer)
 {
-    hwcl->compositionType = HWC_FRAMEBUFFER;
-    hwcl->hints = 0;
-    hwcl->flags = HWC_SKIP_LAYER;
-    hwcl->transform = 0;
-    hwcl->blending = HWC_BLENDING_NONE;
+    layer.setDefaultState();
 
     // this gives us only the "orientation" component of the transform
     const State& s(drawingState());
     const uint32_t finalTransform = s.transform.getOrientation();
     // we can only handle simple transformation
     if (finalTransform & Transform::ROT_INVALID) {
-        hwcl->flags = HWC_SKIP_LAYER;
+        layer.setTransform(0);
     } else {
-        hwcl->transform = finalTransform;
+        layer.setTransform(finalTransform);
     }
 
     if (!isOpaque()) {
-        hwcl->blending = mPremultipliedAlpha ?
-                HWC_BLENDING_PREMULT : HWC_BLENDING_COVERAGE;
+        layer.setBlending(mPremultipliedAlpha ?
+                HWC_BLENDING_PREMULT :
+                HWC_BLENDING_COVERAGE);
     }
 
     // scaling is already applied in mTransformedBounds
-    hwcl->displayFrame.left   = mTransformedBounds.left;
-    hwcl->displayFrame.top    = mTransformedBounds.top;
-    hwcl->displayFrame.right  = mTransformedBounds.right;
-    hwcl->displayFrame.bottom = mTransformedBounds.bottom;
-    hwcl->visibleRegionScreen.rects =
-            reinterpret_cast<hwc_rect_t const *>(
-                    visibleRegionScreen.getArray(
-                            &hwcl->visibleRegionScreen.numRects));
-
-    hwcl->sourceCrop.left   = 0;
-    hwcl->sourceCrop.top    = 0;
-    hwcl->sourceCrop.right  = mTransformedBounds.width();
-    hwcl->sourceCrop.bottom = mTransformedBounds.height();
+    layer.setFrame(mTransformedBounds);
+    layer.setVisibleRegionScreen(visibleRegionScreen);
+    layer.setCrop(mTransformedBounds.getBounds());
 }
 
-void LayerBase::setPerFrameData(hwc_layer_t* hwcl) {
-    hwcl->compositionType = HWC_FRAMEBUFFER;
-    hwcl->handle = NULL;
+void LayerBase::setPerFrameData(HWComposer::HWCLayerInterface& layer) {
+    layer.setBuffer(0);
 }
 
 void LayerBase::setFiltering(bool filtering)
diff --git a/services/surfaceflinger/LayerBase.h b/services/surfaceflinger/LayerBase.h
index c547a40..4d5d1e4 100644
--- a/services/surfaceflinger/LayerBase.h
+++ b/services/surfaceflinger/LayerBase.h
@@ -32,8 +32,6 @@
 
 #include <private/gui/LayerState.h>
 
-#include <hardware/hwcomposer.h>
-
 #include "DisplayHardware/DisplayHardware.h"
 #include "Transform.h"
 
@@ -116,8 +114,8 @@
 
     virtual const char* getTypeId() const { return "LayerBase"; }
 
-    virtual void setGeometry(hwc_layer_t* hwcl);
-    virtual void setPerFrameData(hwc_layer_t* hwcl);
+    virtual void setGeometry(HWComposer::HWCLayerInterface& layer);
+    virtual void setPerFrameData(HWComposer::HWCLayerInterface& layer);
 
 
     /**
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 51fcce4..e059f1c 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -50,6 +50,7 @@
 
 #include "clz.h"
 #include "DdmConnection.h"
+#include "Client.h"
 #include "EventThread.h"
 #include "GLExtensions.h"
 #include "Layer.h"
@@ -117,6 +118,8 @@
     if (mDebugDDMS) {
         DdmConnection::start(getServiceName());
     }
+#else
+#warning "DDMS_DEBUGGING disabled"
 #endif
 
     ALOGI_IF(mDebugRegion,       "showupdates enabled");
@@ -299,7 +302,6 @@
     // start the EventThread
     mEventThread = new EventThread(this);
     mEventQueue.setEventThread(mEventThread);
-    hw.startSleepManagement();
 
     /*
      *  We're now ready to accept clients...
@@ -809,12 +811,13 @@
         const Vector< sp<LayerBase> >& currentLayers(mVisibleLayersSortedByZ);
         const size_t count = currentLayers.size();
         hwc.createWorkList(count);
-        hwc_layer_t* const cur(hwc.getLayers());
-        for (size_t i=0 ; cur && i<count ; i++) {
-            currentLayers[i]->setGeometry(&cur[i]);
+
+        HWComposer::LayerListIterator cur = hwc.begin();
+        const HWComposer::LayerListIterator end = hwc.end();
+        for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
+            currentLayers[i]->setGeometry(*cur);
             if (mDebugDisableHWC || mDebugRegion) {
-                cur[i].compositionType = HWC_FRAMEBUFFER;
-                cur[i].flags |= HWC_SKIP_LAYER;
+                cur->setSkip(true);
             }
         }
     }
@@ -868,8 +871,10 @@
 {
     const DisplayHardware& hw(graphicPlane(0).displayHardware());
     HWComposer& hwc(hw.getHwComposer());
-    hwc_layer_t* const cur(hwc.getLayers());
-    if (!cur) {
+
+    HWComposer::LayerListIterator cur = hwc.begin();
+    const HWComposer::LayerListIterator end = hwc.end();
+    if (cur == end) {
         return;
     }
 
@@ -889,9 +894,9 @@
      *  update the per-frame h/w composer data for each layer
      *  and build the transparent region of the FB
      */
-    for (size_t i=0 ; i<count ; i++) {
+    for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
         const sp<LayerBase>& layer(layers[i]);
-        layer->setPerFrameData(&cur[i]);
+        layer->setPerFrameData(*cur);
     }
     status_t err = hwc.prepare();
     ALOGE_IF(err, "HWComposer::prepare failed (%s)", strerror(-err));
@@ -901,10 +906,11 @@
 {
     const DisplayHardware& hw(graphicPlane(0).displayHardware());
     HWComposer& hwc(hw.getHwComposer());
-    hwc_layer_t* const cur(hwc.getLayers());
+    HWComposer::LayerListIterator cur = hwc.begin();
+    const HWComposer::LayerListIterator end = hwc.end();
 
     const size_t fbLayerCount = hwc.getLayerCount(HWC_FRAMEBUFFER);
-    if (!cur || fbLayerCount) {
+    if (cur==end || fbLayerCount) {
         // Never touch the framebuffer if we don't have any framebuffer layers
 
         if (hwc.getLayerCount(HWC_OVERLAY)) {
@@ -929,13 +935,12 @@
 
         const Vector< sp<LayerBase> >& layers(mVisibleLayersSortedByZ);
         const size_t count = layers.size();
-
-        for (size_t i=0 ; i<count ; i++) {
+        for (size_t i=0 ; cur!=end && i<count ; ++i, ++cur) {
             const sp<LayerBase>& layer(layers[i]);
             const Region clip(dirty.intersect(layer->visibleRegionScreen));
             if (!clip.isEmpty()) {
-                if (cur && (cur[i].compositionType == HWC_OVERLAY)) {
-                    if (i && (cur[i].hints & HWC_HINT_CLEAR_FB)
+                if (cur->getCompositionType() == HWC_OVERLAY) {
+                    if (i && (cur->getHints() & HWC_HINT_CLEAR_FB)
                             && layer->isOpaque()) {
                         // never clear the very first layer since we're
                         // guaranteed the FB is already cleared
@@ -1371,6 +1376,7 @@
 // ---------------------------------------------------------------------------
 
 void SurfaceFlinger::onScreenAcquired() {
+    ALOGD("Screen about to return, flinger = %p", this);
     const DisplayHardware& hw(graphicPlane(0).displayHardware());
     hw.acquireScreen();
     mEventThread->onScreenAcquired();
@@ -1382,6 +1388,7 @@
 }
 
 void SurfaceFlinger::onScreenReleased() {
+    ALOGD("About to give-up screen, flinger = %p", this);
     const DisplayHardware& hw(graphicPlane(0).displayHardware());
     if (hw.isScreenAcquired()) {
         mEventThread->onScreenReleased();
@@ -1390,7 +1397,7 @@
     }
 }
 
-void SurfaceFlinger::screenAcquired() {
+void SurfaceFlinger::unblank() {
     class MessageScreenAcquired : public MessageBase {
         SurfaceFlinger* flinger;
     public:
@@ -1404,7 +1411,7 @@
     postMessageSync(msg);
 }
 
-void SurfaceFlinger::screenReleased() {
+void SurfaceFlinger::blank() {
     class MessageScreenReleased : public MessageBase {
         SurfaceFlinger* flinger;
     public:
@@ -1662,6 +1669,8 @@
         case BOOT_FINISHED:
         case TURN_ELECTRON_BEAM_OFF:
         case TURN_ELECTRON_BEAM_ON:
+        case BLANK:
+        case UNBLANK:
         {
             // codes that require permission check
             IPCThreadState* ipc = IPCThreadState::self();
@@ -2511,130 +2520,6 @@
 
 // ---------------------------------------------------------------------------
 
-Client::Client(const sp<SurfaceFlinger>& flinger)
-    : mFlinger(flinger), mNameGenerator(1)
-{
-}
-
-Client::~Client()
-{
-    const size_t count = mLayers.size();
-    for (size_t i=0 ; i<count ; i++) {
-        sp<LayerBaseClient> layer(mLayers.valueAt(i).promote());
-        if (layer != 0) {
-            mFlinger->removeLayer(layer);
-        }
-    }
-}
-
-status_t Client::initCheck() const {
-    return NO_ERROR;
-}
-
-size_t Client::attachLayer(const sp<LayerBaseClient>& layer)
-{
-    Mutex::Autolock _l(mLock);
-    size_t name = mNameGenerator++;
-    mLayers.add(name, layer);
-    return name;
-}
-
-void Client::detachLayer(const LayerBaseClient* layer)
-{
-    Mutex::Autolock _l(mLock);
-    // we do a linear search here, because this doesn't happen often
-    const size_t count = mLayers.size();
-    for (size_t i=0 ; i<count ; i++) {
-        if (mLayers.valueAt(i) == layer) {
-            mLayers.removeItemsAt(i, 1);
-            break;
-        }
-    }
-}
-sp<LayerBaseClient> Client::getLayerUser(int32_t i) const
-{
-    Mutex::Autolock _l(mLock);
-    sp<LayerBaseClient> lbc;
-    wp<LayerBaseClient> layer(mLayers.valueFor(i));
-    if (layer != 0) {
-        lbc = layer.promote();
-        ALOGE_IF(lbc==0, "getLayerUser(name=%d) is dead", int(i));
-    }
-    return lbc;
-}
-
-
-status_t Client::onTransact(
-    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
-{
-    // these must be checked
-     IPCThreadState* ipc = IPCThreadState::self();
-     const int pid = ipc->getCallingPid();
-     const int uid = ipc->getCallingUid();
-     const int self_pid = getpid();
-     if (CC_UNLIKELY(pid != self_pid && uid != AID_GRAPHICS && uid != 0)) {
-         // we're called from a different process, do the real check
-         if (!PermissionCache::checkCallingPermission(sAccessSurfaceFlinger))
-         {
-             ALOGE("Permission Denial: "
-                     "can't openGlobalTransaction pid=%d, uid=%d", pid, uid);
-             return PERMISSION_DENIED;
-         }
-     }
-     return BnSurfaceComposerClient::onTransact(code, data, reply, flags);
-}
-
-
-sp<ISurface> Client::createSurface(
-        ISurfaceComposerClient::surface_data_t* params,
-        const String8& name,
-        DisplayID display, uint32_t w, uint32_t h, PixelFormat format,
-        uint32_t flags)
-{
-    /*
-     * createSurface must be called from the GL thread so that it can
-     * have access to the GL context.
-     */
-
-    class MessageCreateSurface : public MessageBase {
-        sp<ISurface> result;
-        SurfaceFlinger* flinger;
-        ISurfaceComposerClient::surface_data_t* params;
-        Client* client;
-        const String8& name;
-        DisplayID display;
-        uint32_t w, h;
-        PixelFormat format;
-        uint32_t flags;
-    public:
-        MessageCreateSurface(SurfaceFlinger* flinger,
-                ISurfaceComposerClient::surface_data_t* params,
-                const String8& name, Client* client,
-                DisplayID display, uint32_t w, uint32_t h, PixelFormat format,
-                uint32_t flags)
-            : flinger(flinger), params(params), client(client), name(name),
-              display(display), w(w), h(h), format(format), flags(flags)
-        {
-        }
-        sp<ISurface> getResult() const { return result; }
-        virtual bool handler() {
-            result = flinger->createSurface(params, name, client,
-                    display, w, h, format, flags);
-            return true;
-        }
-    };
-
-    sp<MessageBase> msg = new MessageCreateSurface(mFlinger.get(),
-            params, name, this, display, w, h, format, flags);
-    mFlinger->postMessageSync(msg);
-    return static_cast<MessageCreateSurface*>( msg.get() )->getResult();
-}
-status_t Client::destroySurface(SurfaceID sid) {
-    return mFlinger->removeSurface(this, sid);
-}
-
-// ---------------------------------------------------------------------------
-
 GraphicBufferAlloc::GraphicBufferAlloc() {}
 
 GraphicBufferAlloc::~GraphicBufferAlloc() {}
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index b20973b..c3efdbc 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -57,40 +57,6 @@
 
 // ---------------------------------------------------------------------------
 
-class Client : public BnSurfaceComposerClient
-{
-public:
-        Client(const sp<SurfaceFlinger>& flinger);
-        ~Client();
-
-    status_t initCheck() const;
-
-    // protected by SurfaceFlinger::mStateLock
-    size_t attachLayer(const sp<LayerBaseClient>& layer);
-    void detachLayer(const LayerBaseClient* layer);
-    sp<LayerBaseClient> getLayerUser(int32_t i) const;
-
-private:
-    // ISurfaceComposerClient interface
-    virtual sp<ISurface> createSurface(
-            surface_data_t* params, const String8& name,
-            DisplayID display, uint32_t w, uint32_t h,PixelFormat format,
-            uint32_t flags);
-    virtual status_t destroySurface(SurfaceID surfaceId);
-    virtual status_t onTransact(
-        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);
-
-    // constant
-    sp<SurfaceFlinger> mFlinger;
-
-    // protected by mLock
-    DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;
-    size_t mNameGenerator;
-
-    // thread-safe
-    mutable Mutex mLock;
-};
-
 class GraphicBufferAlloc : public BnGraphicBufferAlloc
 {
 public:
@@ -182,11 +148,10 @@
     virtual status_t                    turnElectronBeamOff(int32_t mode);
     virtual status_t                    turnElectronBeamOn(int32_t mode);
 
-
             // called when screen needs to turn off
-            void screenReleased();
+    virtual void                        blank();
             // called when screen is turning back on
-            void screenAcquired();
+    virtual void                        unblank();
 
             // called on the main thread in response to screenReleased()
             void onScreenReleased();