diff --git a/cmds/keystore/keymgmt.c b/cmds/keystore/keymgmt.c
index c45b53c..9a1f845 100644
--- a/cmds/keystore/keymgmt.c
+++ b/cmds/keystore/keymgmt.c
@@ -228,6 +228,11 @@
     char keyfile[KEYFILE_LEN];
 
     if (state != UNLOCKED) return -state;
+    if ((strlen(namespace) >= MAX_KEY_NAME_LENGTH) ||
+        (strlen(keyname) >= MAX_KEY_NAME_LENGTH)) {
+        LOGE("keyname is too long.");
+        return -1;
+    }
     sprintf(keyfile, KEYFILE_NAME, namespace, keyname);
     return unlink(keyfile);
 }
@@ -243,12 +248,12 @@
         LOGE("Can not store key with current state %d\n", state);
         return -state;
     }
-    sprintf(keyfile, KEYFILE_NAME, namespace, keyname);
-    // flatten the args
-    if (strlen(keyname) >= MAX_KEY_NAME_LENGTH) {
+    if ((strlen(namespace) >= MAX_KEY_NAME_LENGTH) ||
+        (strlen(keyname) >= MAX_KEY_NAME_LENGTH)) {
         LOGE("keyname is too long.");
         return -1;
     }
+    sprintf(keyfile, KEYFILE_NAME, namespace, keyname);
     strcpy(blob.keyname, keyname);
     blob.value_size = size;
     if (size > MAX_KEY_VALUE_LENGTH) {
@@ -271,6 +276,11 @@
         LOGE("Can not retrieve key value with current state %d\n", state);
         return -state;
     }
+    if ((strlen(namespace) >= MAX_KEY_NAME_LENGTH) ||
+        (strlen(keyname) >= MAX_KEY_NAME_LENGTH)) {
+        LOGE("keyname is too long.");
+        return -1;
+    }
     sprintf(keyfile, KEYFILE_NAME, namespace, keyname);
     ret = load_n_decrypt(keyname, keyfile, &decryptKey, &blob);
     if (!ret) {
@@ -299,6 +309,13 @@
         LOGE("cannot open keystore dir or namespace is null\n");
         return -1;
     }
+
+    if (strlen(namespace) >= MAX_KEY_NAME_LENGTH) {
+        LOGE("namespace is too long.");
+        return -1;
+    }
+
+    reply[0] = 0;
     while ((de = readdir(d))) {
         char *prefix, *name, *keyfile = de->d_name;
         char *context = NULL;
@@ -367,6 +384,7 @@
 
 int reset_keystore()
 {
+    int ret = 0;
     DIR *d;
     struct dirent *de;
 
@@ -374,18 +392,24 @@
         LOGE("cannot open keystore dir\n");
         return -1;
     }
-    while ((de = readdir(d))) unlink(de->d_name);
+    while ((de = readdir(d))) {
+        if (unlink(de->d_name) != 0) ret = -1;
+    }
     closedir(d);
     state = UNINITIALIZED;
-    LOGI("keystore is reset.");
-    return 0;
+    if (ret == 0) {
+        LOGI("keystore is reset.");
+    } else {
+        LOGI("keystore can not be cleaned up entirely.");
+    }
+    return ret;
 }
 
 int init_keystore(const char *dir)
 {
     int fd;
 
-    if (!dir) mkdir(dir, 0770);
+    if (dir) mkdir(dir, 0770);
     if (!dir || chdir(dir)) {
         LOGE("Can not open/create the keystore directory %s\n",
              dir ? dir : "(null)");
diff --git a/cmds/keystore/tests/Android.mk b/cmds/keystore/tests/Android.mk
new file mode 100644
index 0000000..33541cc
--- /dev/null
+++ b/cmds/keystore/tests/Android.mk
@@ -0,0 +1,28 @@
+# Copyright (C) 2009 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# define the KEYSTORE_TESTS environment variable to build the test programs
+ifdef KEYSTORE_TESTS
+LOCAL_PATH:= $(call my-dir)
+include $(CLEAR_VARS)
+LOCAL_SRC_FILES:= netkeystore_test.c ../keymgmt.c
+LOCAL_SHARED_LIBRARIES := libcutils libssl
+LOCAL_MODULE:= netkeystore_test
+LOCAL_MODULE_TAGS := optional
+LOCAL_C_INCLUDES := external/openssl/include \
+								frameworks/base/cmds/keystore
+EXTRA_CFLAGS := -g -O0 -DGTEST_OS_LINUX -DGTEST_HAS_STD_STRING
+include $(BUILD_EXECUTABLE)
+
+endif  #KEYSTORE_TESTS
diff --git a/cmds/keystore/tests/netkeystore_test.c b/cmds/keystore/tests/netkeystore_test.c
new file mode 100644
index 0000000..e7e686b
--- /dev/null
+++ b/cmds/keystore/tests/netkeystore_test.c
@@ -0,0 +1,249 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "common.h"
+#include "keymgmt.h"
+
+typedef int FUNC_PTR();
+typedef struct {
+    const char *name;
+    FUNC_PTR *func;
+} TESTFUNC;
+
+#define FUNC_NAME(x) { #x, test_##x }
+#define FUNC_BODY(x) int test_##x()
+
+#define TEST_PASSWD        "12345678"
+#define TEST_NPASSWD    "11111111"
+#define TEST_DIR        "/data/local/tmp/keystore"
+#define READONLY_DIR    "/proc/keystore"
+#define TEST_NAMESPACE    "test"
+#define TEST_KEYNAME    "key"
+#define TEST_KEYNAME2    "key2"
+#define TEST_KEYVALUE    "ANDROID"
+
+void setup()
+{
+    if (init_keystore(TEST_DIR) != 0) {
+        fprintf(stderr, "Can not create the test directory %s\n", TEST_DIR);
+        exit(-1);
+    }
+}
+
+void teardown()
+{
+    reset_keystore();
+    rmdir(TEST_DIR);
+}
+
+FUNC_BODY(init_keystore)
+{
+    if (init_keystore(READONLY_DIR) == 0) return -1;
+
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(reset_keystore)
+{
+    chdir("/procx");
+    if (reset_keystore() == 0) return -1;
+    chdir(TEST_DIR);
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(get_state)
+{
+    if (get_state() != UNINITIALIZED) return -1;
+    passwd(TEST_PASSWD);
+    if (get_state() != UNLOCKED) return -1;
+    lock();
+    if (get_state() != LOCKED) return -1;
+    reset_keystore();
+    if (get_state() != UNINITIALIZED) return -1;
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(passwd)
+{
+    char buf[512];
+
+    if (passwd(" 23432dsfsdf") == 0) return -1;
+    if (passwd("dsfsdf") == 0) return -1;
+    passwd(TEST_PASSWD);
+    lock();
+    if (unlock("55555555") == 0) return -1;
+    if (unlock(TEST_PASSWD) != 0) return -1;
+
+    // change the password
+    sprintf(buf, "%s %s", "klfdjdsklfjg", "abcdefghi");
+    if (passwd(buf) == 0) return -1;
+
+    sprintf(buf, "%s %s", TEST_PASSWD, TEST_NPASSWD);
+    if (passwd(buf) != 0) return -1;
+    lock();
+
+    if (unlock(TEST_PASSWD) == 0) return -1;
+    if (unlock(TEST_NPASSWD) != 0) return -1;
+
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(lock)
+{
+    if (lock() == 0) return -1;
+    passwd(TEST_PASSWD);
+    if (lock() != 0) return -1;
+    if (lock() != 0) return -1;
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(unlock)
+{
+    int i = MAX_RETRY_COUNT;
+    passwd(TEST_PASSWD);
+    lock();
+    while (i > 1) {
+        if (unlock(TEST_NPASSWD) != --i) return -1;
+    }
+    if (unlock(TEST_NPASSWD) != -1) return -1;
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(put_key)
+{
+    int i = 0;
+    char keyname[512];
+
+    if (put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+                strlen(TEST_KEYVALUE)) == 0) return -1;
+    passwd(TEST_PASSWD);
+    if (put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+                strlen(TEST_KEYVALUE)) != 0) return -1;
+
+    for(i = 0; i < 500; i++) keyname[i] = 'K';
+    keyname[i] = 0;
+    if (put_key(TEST_NAMESPACE, keyname, (unsigned char *)TEST_KEYVALUE,
+                strlen(TEST_KEYVALUE)) == 0) return -1;
+    if (put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+                MAX_KEY_VALUE_LENGTH + 1) == 0) return -1;
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(get_key)
+{
+    int size;
+    unsigned char data[MAX_KEY_VALUE_LENGTH];
+
+    if (get_key(TEST_NAMESPACE, TEST_KEYNAME, data, &size) == 0) return -1;
+
+    passwd(TEST_PASSWD);
+    put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+            strlen(TEST_KEYVALUE));
+    if (get_key(TEST_NAMESPACE, TEST_KEYNAME, data, &size) != 0) return -1;
+    if (memcmp(data, TEST_KEYVALUE, size) != 0) return -1;
+
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(remove_key)
+{
+    if (remove_key(TEST_NAMESPACE, TEST_KEYNAME) == 0) return -1;
+
+    passwd(TEST_PASSWD);
+    if (remove_key(TEST_NAMESPACE, TEST_KEYNAME) == 0) return -1;
+
+    put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+            strlen(TEST_KEYVALUE));
+    if (remove_key(TEST_NAMESPACE, TEST_KEYNAME) != 0) return -1;
+
+    return EXIT_SUCCESS;
+}
+
+FUNC_BODY(list_keys)
+{
+    int i;
+    char buf[128];
+    char reply[BUFFER_MAX];
+
+    for(i = 0; i < 100; i++) buf[i] = 'K';
+    buf[i] = 0;
+
+    if (list_keys(TEST_NAMESPACE, reply) == 0) return -1;
+
+    passwd(TEST_PASSWD);
+    if (list_keys(buf, reply) == 0) return -1;
+
+    if (list_keys(TEST_NAMESPACE, reply) != 0) return -1;
+    if (strcmp(reply, "") != 0) return -1;
+
+    put_key(TEST_NAMESPACE, TEST_KEYNAME, (unsigned char *)TEST_KEYVALUE,
+            strlen(TEST_KEYVALUE));
+    if (list_keys(TEST_NAMESPACE, reply) != 0) return -1;
+    if (strcmp(reply, TEST_KEYNAME) != 0) return -1;
+
+    put_key(TEST_NAMESPACE, TEST_KEYNAME2, (unsigned char *)TEST_KEYVALUE,
+            strlen(TEST_KEYVALUE));
+
+    if (list_keys(TEST_NAMESPACE, reply) != 0) return -1;
+    sprintf(buf, "%s %s", TEST_KEYNAME2, TEST_KEYNAME);
+    if (strcmp(reply, buf) != 0) return -1;
+
+    return EXIT_SUCCESS;
+}
+
+TESTFUNC all_tests[] = {
+    FUNC_NAME(init_keystore),
+    FUNC_NAME(reset_keystore),
+    FUNC_NAME(get_state),
+    FUNC_NAME(passwd),
+    FUNC_NAME(lock),
+    FUNC_NAME(unlock),
+    FUNC_NAME(put_key),
+    FUNC_NAME(get_key),
+    FUNC_NAME(remove_key),
+    FUNC_NAME(list_keys),
+};
+
+int main(int argc, char **argv) {
+    int i, ret;
+    for (i = 0 ; i < (int)(sizeof(all_tests)/sizeof(TESTFUNC)) ; ++i) {
+        setup();
+        if ((ret = all_tests[i].func()) != EXIT_SUCCESS) {
+            fprintf(stderr, "ERROR in function %s\n", all_tests[i].name);
+            return ret;
+        } else {
+            fprintf(stderr, "function %s PASSED!\n", all_tests[i].name);
+        }
+        teardown();
+    }
+    return EXIT_SUCCESS;
+}
diff --git a/include/ui/FramebufferNativeWindow.h b/include/ui/FramebufferNativeWindow.h
index e72357a..cb9bf94 100644
--- a/include/ui/FramebufferNativeWindow.h
+++ b/include/ui/FramebufferNativeWindow.h
@@ -62,6 +62,7 @@
     static int dequeueBuffer(android_native_window_t* window, android_native_buffer_t** buffer);
     static int lockBuffer(android_native_window_t* window, android_native_buffer_t* buffer);
     static int queueBuffer(android_native_window_t* window, android_native_buffer_t* buffer);
+    static int query(android_native_window_t* window, int what, int* value);
     
     framebuffer_device_t* fbDev;
     alloc_device_t* grDev;
diff --git a/include/ui/Surface.h b/include/ui/Surface.h
index 8c4f63d..5665c1f 100644
--- a/include/ui/Surface.h
+++ b/include/ui/Surface.h
@@ -36,6 +36,7 @@
 
 class BufferMapper;
 class Rect;
+class MediaPlayerImpl;
 class Surface;
 class SurfaceComposerClient;
 struct per_client_cblk_t;
@@ -115,6 +116,8 @@
     sp<ISurface>                mSurface;
     SurfaceID                   mToken;
     uint32_t                    mIdentity;
+    uint32_t                    mWidth;
+    uint32_t                    mHeight;
     PixelFormat                 mFormat;
     uint32_t                    mFlags;
     mutable Mutex               mLock;
@@ -178,6 +181,7 @@
     // mediaplayer needs access to ISurface for display
     friend class MediaPlayer;
     friend class Test;
+    friend class MediaPlayerImpl;
     const sp<ISurface>& getISurface() const { return mSurface; }
 
     status_t getBufferLocked(int index);
@@ -192,10 +196,12 @@
     static int dequeueBuffer(android_native_window_t* window, android_native_buffer_t** buffer);
     static int lockBuffer(android_native_window_t* window, android_native_buffer_t* buffer);
     static int queueBuffer(android_native_window_t* window, android_native_buffer_t* buffer);
+    static int query(android_native_window_t* window, int what, int* value);
 
     int dequeueBuffer(android_native_buffer_t** buffer);
     int lockBuffer(android_native_buffer_t* buffer);
     int queueBuffer(android_native_buffer_t* buffer);
+    int query(int what, int* value);
 
     status_t dequeueBuffer(sp<SurfaceBuffer>* buffer);
     status_t lockBuffer(const sp<SurfaceBuffer>& buffer);
@@ -209,6 +215,8 @@
     sp<SurfaceBuffer>           mLockedBuffer;
     SurfaceID                   mToken;
     uint32_t                    mIdentity;
+    uint32_t                    mWidth;
+    uint32_t                    mHeight;
     PixelFormat                 mFormat;
     uint32_t                    mFlags;
     mutable Region              mDirtyRegion;
diff --git a/include/ui/egl/android_natives.h b/include/ui/egl/android_natives.h
index 0398ea7..a3a1316 100644
--- a/include/ui/egl/android_natives.h
+++ b/include/ui/egl/android_natives.h
@@ -60,6 +60,12 @@
 
 // ---------------------------------------------------------------------------
 
+/* attributes queriable with query() */
+enum {
+    NATIVE_WINDOW_WIDTH     = 0,
+    NATIVE_WINDOW_HEIGHT    = 1
+};
+
 struct android_native_window_t 
 {
 #ifdef __cplusplus
@@ -129,8 +135,15 @@
     int     (*queueBuffer)(struct android_native_window_t* window,
                 struct android_native_buffer_t* buffer);
 
+    /*
+     * hook used to retrieve information about the native window.
+     * 
+     * Returns 0 on success or -errno on error.
+     */
+    int     (*query)(struct android_native_window_t* window,
+            int what, int* value);
     
-    void* reserved_proc[5];
+    void* reserved_proc[4];
 };
 
 // ---------------------------------------------------------------------------
diff --git a/include/utils/ResourceTypes.h b/include/utils/ResourceTypes.h
index edd0cae..e524e2a 100644
--- a/include/utils/ResourceTypes.h
+++ b/include/utils/ResourceTypes.h
@@ -1655,7 +1655,8 @@
     ssize_t resolveReference(Res_value* inOutValue,
                              ssize_t blockIndex,
                              uint32_t* outLastRef = NULL,
-                             uint32_t* inoutTypeSpecFlags = NULL) const;
+                             uint32_t* inoutTypeSpecFlags = NULL,
+                             ResTable_config* outConfig = NULL) const;
 
     enum {
         TMP_BUFFER_SIZE = 16
@@ -1729,7 +1730,8 @@
          */
         ssize_t resolveAttributeReference(Res_value* inOutValue,
                 ssize_t blockIndex, uint32_t* outLastRef = NULL,
-                uint32_t* inoutTypeSpecFlags = NULL) const;
+                uint32_t* inoutTypeSpecFlags = NULL,
+                ResTable_config* inoutConfig = NULL) const;
 
         void dumpToLog() const;
         
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index f40e4bd..785a3c5 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -661,7 +661,7 @@
 
 status_t Parcel::writeNativeHandle(const native_handle* handle)
 {
-    if (handle->version != sizeof(native_handle))
+    if (!handle || handle->version != sizeof(native_handle))
         return BAD_TYPE;
 
     status_t err;
diff --git a/libs/ui/FramebufferNativeWindow.cpp b/libs/ui/FramebufferNativeWindow.cpp
index 8c8fd6b..8b7ea21 100644
--- a/libs/ui/FramebufferNativeWindow.cpp
+++ b/libs/ui/FramebufferNativeWindow.cpp
@@ -124,6 +124,7 @@
     android_native_window_t::dequeueBuffer = dequeueBuffer;
     android_native_window_t::lockBuffer = lockBuffer;
     android_native_window_t::queueBuffer = queueBuffer;
+    android_native_window_t::query = query;
 }
 
 FramebufferNativeWindow::~FramebufferNativeWindow() {
@@ -198,6 +199,23 @@
     return res;
 }
 
+int FramebufferNativeWindow::query(android_native_window_t* window,
+        int what, int* value) 
+{
+    FramebufferNativeWindow* self = getSelf(window);
+    Mutex::Autolock _l(self->mutex);
+    framebuffer_device_t* fb = self->fbDev;
+    switch (what) {
+        case NATIVE_WINDOW_WIDTH:
+            *value = fb->width;
+            return NO_ERROR;
+        case NATIVE_WINDOW_HEIGHT:
+            *value = fb->height;
+            return NO_ERROR;
+    }
+    return BAD_VALUE;
+}
+
 // ----------------------------------------------------------------------------
 }; // namespace android
 // ----------------------------------------------------------------------------
diff --git a/libs/ui/Surface.cpp b/libs/ui/Surface.cpp
index aef47fd..a4710aa 100644
--- a/libs/ui/Surface.cpp
+++ b/libs/ui/Surface.cpp
@@ -180,7 +180,7 @@
         uint32_t w, uint32_t h, PixelFormat format, uint32_t flags)
     : mClient(client), mSurface(surface),
       mToken(data.token), mIdentity(data.identity),
-      mFormat(format), mFlags(flags)
+      mWidth(w), mHeight(h), mFormat(format), mFlags(flags)
 {
 }
         
@@ -338,6 +338,8 @@
     uint32_t format = 0;
     SurfaceID token = -1;
     uint32_t identity = 0;
+    uint32_t width = 0;
+    uint32_t height = 0;
     sp<SurfaceComposerClient> client;
     sp<ISurface> sur;
     if (SurfaceControl::isValid(control)) {
@@ -345,6 +347,8 @@
         identity = control->mIdentity;
         client   = control->mClient;
         sur      = control->mSurface;
+        width    = control->mWidth;
+        height   = control->mHeight;
         format   = control->mFormat;
         flags    = control->mFlags;
     }
@@ -352,6 +356,8 @@
     parcel->writeStrongBinder(sur!=0     ? sur->asBinder()      : NULL);
     parcel->writeInt32(token);
     parcel->writeInt32(identity);
+    parcel->writeInt32(width);
+    parcel->writeInt32(height);
     parcel->writeInt32(format);
     parcel->writeInt32(flags);
     return NO_ERROR;
@@ -373,6 +379,7 @@
 Surface::Surface(const sp<SurfaceControl>& surface)
     : mClient(surface->mClient), mSurface(surface->mSurface),
       mToken(surface->mToken), mIdentity(surface->mIdentity),
+      mWidth(surface->mWidth), mHeight(surface->mHeight),
       mFormat(surface->mFormat), mFlags(surface->mFlags),
       mBufferMapper(BufferMapper::get())
 {
@@ -386,6 +393,8 @@
     mSurface    = interface_cast<ISurface>(parcel.readStrongBinder());
     mToken      = parcel.readInt32();
     mIdentity   = parcel.readInt32();
+    mWidth      = parcel.readInt32();
+    mHeight     = parcel.readInt32();
     mFormat     = parcel.readInt32();
     mFlags      = parcel.readInt32();
 
@@ -401,6 +410,7 @@
     android_native_window_t::dequeueBuffer    = dequeueBuffer;
     android_native_window_t::lockBuffer       = lockBuffer;
     android_native_window_t::queueBuffer      = queueBuffer;
+    android_native_window_t::query            = query;
     mSwapRectangle.makeInvalid();
     DisplayInfo dinfo;
     SurfaceComposerClient::getDisplayInfo(0, &dinfo);
@@ -492,6 +502,13 @@
     return self->queueBuffer(buffer);
 }
 
+int Surface::query(android_native_window_t* window, 
+        int what, int* value)
+{
+    Surface* self = getSelf(window);
+    return self->query(what, value);
+}
+
 // ----------------------------------------------------------------------------
 
 status_t Surface::dequeueBuffer(sp<SurfaceBuffer>* buffer)
@@ -499,6 +516,9 @@
     android_native_buffer_t* out;
     status_t err = dequeueBuffer(&out);
     *buffer = SurfaceBuffer::getSelf(out);
+    // reset the width/height with the what we get from the buffer
+    mWidth  = uint32_t(out->width);
+    mHeight = uint32_t(out->height);
     return err;
 }
 
@@ -538,14 +558,16 @@
 
     volatile const surface_info_t* const back = lcblk->surface + backIdx;
     if (back->flags & surface_info_t::eNeedNewBuffer) {
-        getBufferLocked(backIdx);
+        err = getBufferLocked(backIdx);
     }
 
-    const sp<SurfaceBuffer>& backBuffer(mBuffers[backIdx]);
-    mDirtyRegion.set(backBuffer->width, backBuffer->height);
-    *buffer = backBuffer.get();
+    if (err == NO_ERROR) {
+        const sp<SurfaceBuffer>& backBuffer(mBuffers[backIdx]);
+        mDirtyRegion.set(backBuffer->width, backBuffer->height);
+        *buffer = backBuffer.get();
+    }
   
-    return NO_ERROR;
+    return err;
 }
 
 int Surface::lockBuffer(android_native_buffer_t* buffer)
@@ -586,6 +608,19 @@
     return NO_ERROR;
 }
 
+int Surface::query(int what, int* value)
+{
+    switch (what) {
+        case NATIVE_WINDOW_WIDTH:
+            *value = int(mWidth);
+            return NO_ERROR;
+        case NATIVE_WINDOW_HEIGHT:
+            *value = int(mHeight);
+            return NO_ERROR;
+    }
+    return BAD_VALUE;
+}
+
 // ----------------------------------------------------------------------------
 
 status_t Surface::lock(SurfaceInfo* info, bool blocking) {
@@ -696,7 +731,7 @@
             currentBuffer.clear();
         }
         err = getBufferMapper().registerBuffer(buffer->handle);
-        LOGW_IF(err, "map(...) failed %d (%s)", err, strerror(-err));
+        LOGW_IF(err, "registerBuffer(...) failed %d (%s)", err, strerror(-err));
         if (err == NO_ERROR) {
             currentBuffer = buffer;
         }
diff --git a/libs/utils/ResourceTypes.cpp b/libs/utils/ResourceTypes.cpp
index 4dca8bd..0831f4a 100644
--- a/libs/utils/ResourceTypes.cpp
+++ b/libs/utils/ResourceTypes.cpp
@@ -1486,7 +1486,7 @@
 
 ssize_t ResTable::Theme::resolveAttributeReference(Res_value* inOutValue,
         ssize_t blockIndex, uint32_t* outLastRef,
-        uint32_t* inoutTypeSpecFlags) const
+        uint32_t* inoutTypeSpecFlags, ResTable_config* inoutConfig) const
 {
     //printf("Resolving type=0x%x\n", inOutValue->dataType);
     if (inOutValue->dataType == Res_value::TYPE_ATTRIBUTE) {
@@ -1498,7 +1498,8 @@
             return blockIndex;
         }
     }
-    return mTable.resolveReference(inOutValue, blockIndex, outLastRef);
+    return mTable.resolveReference(inOutValue, blockIndex, outLastRef,
+            inoutTypeSpecFlags, inoutConfig);
 }
 
 void ResTable::Theme::dumpToLog() const
@@ -1891,7 +1892,8 @@
 }
 
 ssize_t ResTable::resolveReference(Res_value* value, ssize_t blockIndex,
-        uint32_t* outLastRef, uint32_t* inoutTypeSpecFlags) const
+        uint32_t* outLastRef, uint32_t* inoutTypeSpecFlags,
+        ResTable_config* outConfig) const
 {
     int count=0;
     while (blockIndex >= 0 && value->dataType == value->TYPE_REFERENCE
@@ -1899,7 +1901,8 @@
         if (outLastRef) *outLastRef = value->data;
         uint32_t lastRef = value->data;
         uint32_t newFlags = 0;
-        const ssize_t newIndex = getResource(value->data, value, true, &newFlags);
+        const ssize_t newIndex = getResource(value->data, value, true, &newFlags,
+                outConfig);
         //LOGI("Resolving reference d=%p: newIndex=%d, t=0x%02x, d=%p\n",
         //     (void*)lastRef, (int)newIndex, (int)value->dataType, (void*)value->data);
         //printf("Getting reference 0x%08x: newIndex=%d\n", value->data, newIndex);
diff --git a/opengl/libagl/egl.cpp b/opengl/libagl/egl.cpp
index 7afcae7..cf66be3 100644
--- a/opengl/libagl/egl.cpp
+++ b/opengl/libagl/egl.cpp
@@ -145,7 +145,7 @@
 
     virtual     EGLBoolean  bindDrawSurface(ogles_context_t* gl) = 0;
     virtual     EGLBoolean  bindReadSurface(ogles_context_t* gl) = 0;
-    virtual     void        connect() {}
+    virtual     EGLBoolean  connect() { return EGL_TRUE; }
     virtual     void        disconnect() {}
     virtual     EGLint      getWidth() const = 0;
     virtual     EGLint      getHeight() const = 0;
@@ -214,10 +214,10 @@
     virtual     EGLBoolean  swapBuffers();
     virtual     EGLBoolean  bindDrawSurface(ogles_context_t* gl);
     virtual     EGLBoolean  bindReadSurface(ogles_context_t* gl);
-    virtual     void        connect();
+    virtual     EGLBoolean  connect();
     virtual     void        disconnect();
-    virtual     EGLint      getWidth() const    { return buffer->width;  }
-    virtual     EGLint      getHeight() const   { return buffer->height; }
+    virtual     EGLint      getWidth() const    { return width;  }
+    virtual     EGLint      getHeight() const   { return height; }
     virtual     EGLint      getHorizontalResolution() const;
     virtual     EGLint      getVerticalResolution() const;
     virtual     EGLint      getRefreshRate() const;
@@ -365,26 +365,8 @@
     
     // keep a reference on the window
     nativeWindow->common.incRef(&nativeWindow->common);
-
-    // dequeue a buffer
-    nativeWindow->dequeueBuffer(nativeWindow, &buffer);
-
-    // allocate a corresponding depth-buffer
-    width = buffer->width;
-    height = buffer->height;
-    if (depthFormat) {
-        depth.width   = width;
-        depth.height  = height;
-        depth.stride  = depth.width; // use the width here
-        depth.data    = (GGLubyte*)malloc(depth.stride*depth.height*2);
-        if (depth.data == 0) {
-            setError(EGL_BAD_ALLOC, EGL_NO_SURFACE);
-            return;
-        }
-    }
-
-    // keep a reference on the buffer
-    buffer->common.incRef(&buffer->common);
+    nativeWindow->query(nativeWindow, NATIVE_WINDOW_WIDTH, &width);
+    nativeWindow->query(nativeWindow, NATIVE_WINDOW_HEIGHT, &height);
 }
 
 egl_window_surface_v2_t::~egl_window_surface_v2_t() {
@@ -400,8 +382,29 @@
     }
 }
 
-void egl_window_surface_v2_t::connect() 
+EGLBoolean egl_window_surface_v2_t::connect() 
 {
+    // dequeue a buffer
+    if (nativeWindow->dequeueBuffer(nativeWindow, &buffer) != NO_ERROR) {
+        return setError(EGL_BAD_ALLOC, EGL_FALSE);
+    }
+
+    // allocate a corresponding depth-buffer
+    width = buffer->width;
+    height = buffer->height;
+    if (depth.format) {
+        depth.width   = width;
+        depth.height  = height;
+        depth.stride  = depth.width; // use the width here
+        depth.data    = (GGLubyte*)malloc(depth.stride*depth.height*2);
+        if (depth.data == 0) {
+            return setError(EGL_BAD_ALLOC, EGL_FALSE);
+        }
+    }
+
+    // keep a reference on the buffer
+    buffer->common.incRef(&buffer->common);
+
     // Lock the buffer
     nativeWindow->lockBuffer(nativeWindow, buffer);
     // pin the buffer down
@@ -409,9 +412,10 @@
             GRALLOC_USAGE_SW_WRITE_OFTEN, &bits) != NO_ERROR) {
         LOGE("connect() failed to lock buffer %p (%ux%u)",
                 buffer, buffer->width, buffer->height);
-        setError(EGL_BAD_ACCESS, EGL_NO_SURFACE);
+        return setError(EGL_BAD_ACCESS, EGL_FALSE);
         // FIXME: we should make sure we're not accessing the buffer anymore
     }
+    return EGL_TRUE;
 }
 
 void egl_window_surface_v2_t::disconnect() 
@@ -420,6 +424,16 @@
         bits = NULL;
         unlock(buffer);
     }
+    // enqueue the last frame
+    nativeWindow->queueBuffer(nativeWindow, buffer);
+    if (buffer) {
+        buffer->common.decRef(&buffer->common);
+        buffer = 0;
+    }
+    if (previousBuffer) {
+        previousBuffer->common.decRef(&previousBuffer->common); 
+        previousBuffer = 0;
+    }
 }
 
 status_t egl_window_surface_v2_t::lock(
@@ -432,6 +446,7 @@
 
 status_t egl_window_surface_v2_t::unlock(android_native_buffer_t* buf)
 {
+    if (!buf) return BAD_VALUE;
     int err = module->unlock(module, buf->handle);
     return err;
 }
@@ -503,6 +518,10 @@
 
 EGLBoolean egl_window_surface_v2_t::swapBuffers()
 {
+    if (!buffer) {
+        return setError(EGL_BAD_ACCESS, EGL_FALSE);
+    }
+    
     /*
      * Handle eglSetSwapRectangleANDROID()
      * We copyback from the front buffer 
@@ -568,7 +587,7 @@
             GRALLOC_USAGE_SW_WRITE_OFTEN, &bits) != NO_ERROR) {
         LOGE("eglSwapBuffers() failed to lock buffer %p (%ux%u)",
                 buffer, buffer->width, buffer->height);
-        setError(EGL_BAD_ACCESS, EGL_NO_SURFACE);
+        return setError(EGL_BAD_ACCESS, EGL_FALSE);
         // FIXME: we should make sure we're not accessing the buffer anymore
     }
 
@@ -1736,7 +1755,9 @@
                 ogles_scissor(gl, 0, 0, w, h);
             }
             if (d) {
-                d->connect();
+                if (d->connect() == EGL_FALSE) {
+                    return EGL_FALSE;
+                }
                 d->ctx = ctx;
                 d->bindDrawSurface(gl);
             }
diff --git a/opengl/libs/EGL/egl.cpp b/opengl/libs/EGL/egl.cpp
index c2003dd..236d247 100644
--- a/opengl/libs/EGL/egl.cpp
+++ b/opengl/libs/EGL/egl.cpp
@@ -135,9 +135,10 @@
 
 struct tls_t
 {
-    tls_t() : error(EGL_SUCCESS), ctx(0) { }
+    tls_t() : error(EGL_SUCCESS), ctx(0), logCallWithNoContext(EGL_TRUE) { }
     EGLint      error;
     EGLContext  ctx;
+    EGLBoolean  logCallWithNoContext;
 };
 
 
@@ -352,8 +353,14 @@
 }
 
 static void gl_no_context() {
-    LOGE("call to OpenGL ES API with no current context");
+    tls_t* tls = getTLS();
+    if (tls->logCallWithNoContext == EGL_TRUE) {
+        tls->logCallWithNoContext = EGL_FALSE;
+        LOGE("call to OpenGL ES API with no current context "
+             "(logged once per thread)");
+    }
 }
+
 static void early_egl_init(void) 
 {
 #if !USE_FAST_TLS_KEY
diff --git a/vpn/java/android/net/vpn/PptpProfile.java b/vpn/java/android/net/vpn/PptpProfile.java
index c68bb71..b4b7be5 100644
--- a/vpn/java/android/net/vpn/PptpProfile.java
+++ b/vpn/java/android/net/vpn/PptpProfile.java
@@ -16,15 +16,41 @@
 
 package android.net.vpn;
 
+import android.os.Parcel;
+
 /**
  * The profile for PPTP type of VPN.
  * {@hide}
  */
 public class PptpProfile extends VpnProfile {
     private static final long serialVersionUID = 1L;
+    private boolean mEncryption = true;
 
     @Override
     public VpnType getType() {
         return VpnType.PPTP;
     }
+
+    /**
+     * Enables/disables the encryption for PPTP tunnel.
+     */
+    public void setEncryptionEnabled(boolean enabled) {
+        mEncryption = enabled;
+    }
+
+    public boolean isEncryptionEnabled() {
+        return mEncryption;
+    }
+
+    @Override
+    protected void readFromParcel(Parcel in) {
+        super.readFromParcel(in);
+        mEncryption = in.readInt() > 0;
+    }
+
+    @Override
+    public void writeToParcel(Parcel parcel, int flags) {
+        super.writeToParcel(parcel, flags);
+        parcel.writeInt(mEncryption ? 1 : 0);
+    }
 }
diff --git a/vpn/java/android/net/vpn/VpnManager.java b/vpn/java/android/net/vpn/VpnManager.java
index 0bf2346..e448e5a 100644
--- a/vpn/java/android/net/vpn/VpnManager.java
+++ b/vpn/java/android/net/vpn/VpnManager.java
@@ -50,6 +50,10 @@
     public static final int VPN_ERROR_CONNECTION_FAILED = 2;
     /** Error code to indicate the server is not known. */
     public static final int VPN_ERROR_UNKNOWN_SERVER = 3;
+    /** Error code to indicate an error from challenge response. */
+    public static final int VPN_ERROR_CHALLENGE = 4;
+    /** Error code to indicate an error of remote server hanging up. */
+    public static final int VPN_ERROR_REMOTE_HUNG_UP = 5;
     private static final int VPN_ERROR_NO_ERROR = 0;
 
     public static final String PROFILES_PATH = "/data/misc/vpn/profiles";