Merge "Remove minLayer and maxLayer from screenshot code."
diff --git a/cmds/dumpsys/dumpsys.cpp b/cmds/dumpsys/dumpsys.cpp
index 5412d4d..9bfd710 100644
--- a/cmds/dumpsys/dumpsys.cpp
+++ b/cmds/dumpsys/dumpsys.cpp
@@ -65,7 +65,7 @@
             "         -l: only list services, do not dump them\n"
             "         -t TIMEOUT_SEC: TIMEOUT to use in seconds instead of default 10 seconds\n"
             "         -T TIMEOUT_MS: TIMEOUT to use in milliseconds instead of default 10 seconds\n"
-            "         --proto: filter services that support dumping data in proto format. Dumps"
+            "         --proto: filter services that support dumping data in proto format. Dumps\n"
             "               will be in proto format.\n"
             "         --priority LEVEL: filter services based on specified priority\n"
             "               LEVEL must be one of CRITICAL | HIGH | NORMAL\n"
diff --git a/cmds/installd/Android.bp b/cmds/installd/Android.bp
index 94c3102..9d0d8ba 100644
--- a/cmds/installd/Android.bp
+++ b/cmds/installd/Android.bp
@@ -108,10 +108,8 @@
         "-Wall",
         "-Werror"
     ],
-    clang: true,
 
-    srcs: [
-        "otapreopt_parameters.cpp"],
+    srcs: ["otapreopt_parameters.cpp"],
 
     export_include_dirs: ["."],
 
@@ -123,4 +121,39 @@
     ],
 }
 
-subdirs = ["tests"]
+//
+//  OTA Executable
+//
+
+cc_binary {
+    name: "otapreopt",
+    cflags: [
+        "-Wall",
+        "-Werror"
+    ],
+
+    srcs: [
+        "dexopt.cpp",
+        "globals.cpp",
+        "otapreopt.cpp",
+        "utils.cpp",
+    ],
+
+    header_libs: ["dex2oat_headers"],
+
+    static_libs: [
+        "libartimagevalues",
+        "libdiskusage",
+        "libotapreoptparameters",
+    ],
+
+    shared_libs: [
+        "libbase",
+        "libcrypto",
+        "libcutils",
+        "liblog",
+        "liblogwrap",
+        "libselinux",
+        "libutils",
+    ],
+}
diff --git a/cmds/installd/Android.mk b/cmds/installd/Android.mk
index a4f95da..30de0b3 100644
--- a/cmds/installd/Android.mk
+++ b/cmds/installd/Android.mk
@@ -1,43 +1,5 @@
 LOCAL_PATH := $(call my-dir)
 
-#
-# OTA Executable
-#
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := otapreopt
-LOCAL_CFLAGS := -Wall -Werror
-
-# Base & ASLR boundaries for boot image creation.
-ifndef LIBART_IMG_HOST_MIN_BASE_ADDRESS_DELTA
-  LOCAL_LIBART_IMG_HOST_MIN_BASE_ADDRESS_DELTA := -0x1000000
-else
-  LOCAL_LIBART_IMG_HOST_MIN_BASE_ADDRESS_DELTA := $(LIBART_IMG_HOST_MIN_BASE_ADDRESS_DELTA)
-endif
-ifndef LIBART_IMG_HOST_MAX_BASE_ADDRESS_DELTA
-  LOCAL_LIBART_IMG_HOST_MAX_BASE_ADDRESS_DELTA := 0x1000000
-else
-  LOCAL_LIBART_IMG_HOST_MAX_BASE_ADDRESS_DELTA := $(LIBART_IMG_HOST_MAX_BASE_ADDRESS_DELTA)
-endif
-LOCAL_CFLAGS += -DART_BASE_ADDRESS=$(LIBART_IMG_HOST_BASE_ADDRESS)
-LOCAL_CFLAGS += -DART_BASE_ADDRESS_MIN_DELTA=$(LOCAL_LIBART_IMG_HOST_MIN_BASE_ADDRESS_DELTA)
-LOCAL_CFLAGS += -DART_BASE_ADDRESS_MAX_DELTA=$(LOCAL_LIBART_IMG_HOST_MAX_BASE_ADDRESS_DELTA)
-
-LOCAL_SRC_FILES := otapreopt.cpp otapreopt_parameters.cpp globals.cpp utils.cpp dexopt.cpp
-LOCAL_HEADER_LIBRARIES := dex2oat_headers
-LOCAL_SHARED_LIBRARIES := \
-    libbase \
-    libcrypto \
-    libcutils \
-    liblog \
-    liblogwrap \
-    libselinux \
-    libutils \
-
-LOCAL_STATIC_LIBRARIES := libdiskusage
-LOCAL_CLANG := true
-include $(BUILD_EXECUTABLE)
-
 # OTA slot script
 
 include $(CLEAR_VARS)
diff --git a/cmds/installd/art_helper/Android.bp b/cmds/installd/art_helper/Android.bp
new file mode 100644
index 0000000..c47dd72
--- /dev/null
+++ b/cmds/installd/art_helper/Android.bp
@@ -0,0 +1,12 @@
+// Inherit image values.
+art_global_defaults {
+    name: "libartimagevalues_defaults",
+}
+
+cc_library_static {
+    name: "libartimagevalues",
+    defaults: ["libartimagevalues_defaults"],
+    srcs: ["art_image_values.cpp"],
+    export_include_dirs: ["."],
+    cflags: ["-Wconversion"],
+}
diff --git a/cmds/installd/art_helper/art_image_values.cpp b/cmds/installd/art_helper/art_image_values.cpp
new file mode 100644
index 0000000..a139049
--- /dev/null
+++ b/cmds/installd/art_helper/art_image_values.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "art_image_values.h"
+
+namespace android {
+namespace installd {
+namespace art {
+
+uint32_t GetImageBaseAddress() {
+    return ART_BASE_ADDRESS;
+}
+int32_t GetImageMinBaseAddressDelta() {
+    return ART_BASE_ADDRESS_MIN_DELTA;
+}
+int32_t GetImageMaxBaseAddressDelta() {
+    return ART_BASE_ADDRESS_MAX_DELTA;
+}
+
+static_assert(ART_BASE_ADDRESS_MIN_DELTA < ART_BASE_ADDRESS_MAX_DELTA, "Inconsistent setup");
+
+}  // namespace art
+}  // namespace installd
+}  // namespace android
diff --git a/cmds/installd/art_helper/art_image_values.h b/cmds/installd/art_helper/art_image_values.h
new file mode 100644
index 0000000..20c44c9
--- /dev/null
+++ b/cmds/installd/art_helper/art_image_values.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef FRAMEWORKS_NATIVE_CMDS_INSTALLD_ART_HELPER_ART_IMAGE_VALUES_H
+#define FRAMEWORKS_NATIVE_CMDS_INSTALLD_ART_HELPER_ART_IMAGE_VALUES_H
+
+#include <cstdint>
+
+namespace android {
+namespace installd {
+namespace art {
+
+uint32_t GetImageBaseAddress();
+int32_t GetImageMinBaseAddressDelta();
+int32_t GetImageMaxBaseAddressDelta();
+
+}  // namespace art
+}  // namespace installd
+}  // namespace android
+
+#endif  // FRAMEWORKS_NATIVE_CMDS_INSTALLD_ART_HELPER_ART_IMAGE_VALUES_H
diff --git a/cmds/installd/otapreopt.cpp b/cmds/installd/otapreopt.cpp
index 7291ef3..73098f8 100644
--- a/cmds/installd/otapreopt.cpp
+++ b/cmds/installd/otapreopt.cpp
@@ -32,6 +32,7 @@
 #include <android-base/macros.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <art_image_values.h>
 #include <cutils/fs.h>
 #include <cutils/properties.h>
 #include <dex2oat_return_codes.h>
@@ -441,8 +442,8 @@
 
         cmd.push_back(StringPrintf("--instruction-set=%s", isa));
 
-        int32_t base_offset = ChooseRelocationOffsetDelta(ART_BASE_ADDRESS_MIN_DELTA,
-                                                          ART_BASE_ADDRESS_MAX_DELTA);
+        int32_t base_offset = ChooseRelocationOffsetDelta(art::GetImageMinBaseAddressDelta(),
+                                                          art::GetImageMaxBaseAddressDelta());
         cmd.push_back(StringPrintf("--base-offset-delta=%d", base_offset));
 
         std::string error_msg;
@@ -466,9 +467,9 @@
         }
         cmd.push_back(StringPrintf("--oat-file=%s", oat_path.c_str()));
 
-        int32_t base_offset = ChooseRelocationOffsetDelta(ART_BASE_ADDRESS_MIN_DELTA,
-                ART_BASE_ADDRESS_MAX_DELTA);
-        cmd.push_back(StringPrintf("--base=0x%x", ART_BASE_ADDRESS + base_offset));
+        int32_t base_offset = ChooseRelocationOffsetDelta(art::GetImageMinBaseAddressDelta(),
+                                                          art::GetImageMaxBaseAddressDelta());
+        cmd.push_back(StringPrintf("--base=0x%x", art::GetImageBaseAddress() + base_offset));
 
         cmd.push_back(StringPrintf("--instruction-set=%s", isa));
 
@@ -610,7 +611,7 @@
         // If the dexopt failed, we may have a stale boot image from a previous OTA run.
         // Then regenerate and retry.
         if (WEXITSTATUS(dexopt_result) ==
-                static_cast<int>(art::dex2oat::ReturnCode::kCreateRuntime)) {
+                static_cast<int>(::art::dex2oat::ReturnCode::kCreateRuntime)) {
             if (!PrepareBootImage(/* force */ true)) {
                 LOG(ERROR) << "Forced boot image creating failed. Original error return was "
                         << dexopt_result;
diff --git a/cmds/installd/otapreopt_parameters.cpp b/cmds/installd/otapreopt_parameters.cpp
index cf3de01..b1ad8db 100644
--- a/cmds/installd/otapreopt_parameters.cpp
+++ b/cmds/installd/otapreopt_parameters.cpp
@@ -16,6 +16,8 @@
 
 #include "otapreopt_parameters.h"
 
+#include <cstring>
+
 #include <android-base/logging.h>
 
 #include "dexopt.h"
@@ -248,6 +250,8 @@
         case 8: num_args_expected = 16; break;
         // Version 9 adds a new dexopt flag: DEXOPT_GENERATE_APP_IMAGE
         case 9: num_args_expected = 16; break;
+        // Version 10 is a compatibility bump.
+        case 10: num_args_expected = 16; break;
         default:
             LOG(ERROR) << "Don't know how to read arguments for version " << version;
             return false;
@@ -360,6 +364,15 @@
         }
     }
 
+    if (version < 10) {
+        // Do not accept '&' as shared libraries from versions prior to 10. These may lead
+        // to runtime crashes. The server side of version 10+ should send the correct
+        // context in almost all cases (e.g., only for actual shared packages).
+        if (shared_libraries != nullptr && std::string("&") == shared_libraries) {
+            return false;
+        }
+    }
+
     return true;
 }
 
diff --git a/cmds/installd/tests/installd_otapreopt_test.cpp b/cmds/installd/tests/installd_otapreopt_test.cpp
index b518507..66dd51e 100644
--- a/cmds/installd/tests/installd_otapreopt_test.cpp
+++ b/cmds/installd/tests/installd_otapreopt_test.cpp
@@ -114,11 +114,14 @@
             case 7: return "7";
             case 8: return "8";
             case 9: return "9";
+            case 10: return "10";
         }
         return nullptr;
     }
 
-    std::vector<const char*> getArgs(uint32_t version, bool versioned) {
+    std::vector<const char*> getArgs(uint32_t version,
+                                     bool versioned,
+                                     const char* shared_libs = "shared.lib") {
         std::vector<const char*> args;
         args.push_back("otapreopt");  // "otapreopt"
         args.push_back("a");  // slot
@@ -135,7 +138,7 @@
         args.push_back("0");  // dexopt_flags
         args.push_back("speed");  // filter
         args.push_back("!");  // volume
-        args.push_back("shared.lib");  // libs
+        args.push_back(shared_libs);  // libs
 
         if (version > 1) {
             args.push_back("!");  // seinfo
@@ -159,9 +162,11 @@
         return args;
     }
 
-    void VerifyReadArguments(uint32_t version, bool versioned) {
+    void VerifyReadArguments(uint32_t version,
+                             bool versioned,
+                             const char* shared_libs = "shared.lib") {
         OTAPreoptParameters params;
-        std::vector<const char*> args = getArgs(version, versioned);
+        std::vector<const char*> args = getArgs(version, versioned, shared_libs);
         ASSERT_TRUE(params.ReadArguments(args.size() - 1, args.data()));
         verifyPackageParameters(params, version, versioned, args.data());
     }
@@ -199,6 +204,18 @@
     VerifyReadArguments(7, true);
 }
 
+TEST_F(OTAPreoptTest, ReadArgumentsV9SharedLibsAmpersand) {
+    OTAPreoptParameters params;
+    std::vector<const char*> args = getArgs(9, true, "&");
+    ASSERT_FALSE(params.ReadArguments(args.size() - 1, args.data()));
+}
+
+TEST_F(OTAPreoptTest, ReadArgumentsV10SharedLibsAmpersand) {
+    OTAPreoptParameters params;
+    std::vector<const char*> args = getArgs(10, true, "&");
+    ASSERT_TRUE(params.ReadArguments(args.size() - 1, args.data()));
+}
+
 TEST_F(OTAPreoptTest, ReadArgumentsFailToManyArgs) {
     OTAPreoptParameters params;
     std::vector<const char*> args = getArgs(5, true);
diff --git a/libs/binder/ndk/Android.bp b/libs/binder/ndk/Android.bp
index e5c68b5..3f3c4fa 100644
--- a/libs/binder/ndk/Android.bp
+++ b/libs/binder/ndk/Android.bp
@@ -27,6 +27,7 @@
         "ibinder.cpp",
         "parcel.cpp",
         "process.cpp",
+        "status.cpp",
         "service_manager.cpp",
     ],
 
@@ -36,3 +37,19 @@
         "libutils",
     ],
 }
+
+ndk_headers {
+    name: "libbinder_ndk_headers",
+    from: "include_ndk/android",
+    to: "android",
+    srcs: [
+        "include_ndk/android/*.h",
+    ],
+    license: "NOTICE",
+}
+
+ndk_library {
+    name: "libbinder_ndk",
+    symbol_file: "libbinder_ndk.map.txt",
+    first_version: "29",
+}
diff --git a/libs/binder/ndk/NOTICE b/libs/binder/ndk/NOTICE
new file mode 100644
index 0000000..d1ab54c
--- /dev/null
+++ b/libs/binder/ndk/NOTICE
@@ -0,0 +1,189 @@
+
+   Copyright (c) 2018, The Android Open Source Project
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/libs/binder/ndk/ibinder.cpp b/libs/binder/ndk/ibinder.cpp
index 8a1ec05..f16cde6 100644
--- a/libs/binder/ndk/ibinder.cpp
+++ b/libs/binder/ndk/ibinder.cpp
@@ -19,6 +19,7 @@
 
 #include <android/binder_status.h>
 #include "parcel_internal.h"
+#include "status_internal.h"
 
 #include <android-base/logging.h>
 
@@ -27,6 +28,7 @@
 using ::android::IBinder;
 using ::android::Parcel;
 using ::android::sp;
+using ::android::status_t;
 using ::android::String16;
 using ::android::wp;
 
@@ -116,17 +118,18 @@
     return getClass()->getInterfaceDescriptor();
 }
 
-binder_status_t ABBinder::onTransact(transaction_code_t code, const Parcel& data, Parcel* reply,
-                                     binder_flags_t flags) {
+status_t ABBinder::onTransact(transaction_code_t code, const Parcel& data, Parcel* reply,
+                              binder_flags_t flags) {
     if (isUserCommand(code)) {
         if (!data.checkInterface(this)) {
-            return EX_ILLEGAL_STATE;
+            return STATUS_BAD_TYPE;
         }
 
         const AParcel in = AParcel::readOnly(this, &data);
         AParcel out = AParcel(this, reply, false /*owns*/);
 
-        return getClass()->onTransact(this, code, &in, &out);
+        binder_status_t status = getClass()->onTransact(this, code, &in, &out);
+        return PruneStatusT(status);
     } else {
         return BBinder::onTransact(code, data, reply, flags);
     }
@@ -253,13 +256,13 @@
     sp<TransferDeathRecipient> recipient =
             new TransferDeathRecipient(binder->getBinder(), cookie, mOnDied);
 
-    binder_status_t status = binder->getBinder()->linkToDeath(recipient, cookie, 0 /*flags*/);
-    if (status != EX_NONE) {
-        return status;
+    status_t status = binder->getBinder()->linkToDeath(recipient, cookie, 0 /*flags*/);
+    if (status != STATUS_OK) {
+        return PruneStatusT(status);
     }
 
     mDeathRecipients.push_back(recipient);
-    return EX_NONE;
+    return STATUS_OK;
 }
 
 binder_status_t AIBinder_DeathRecipient::unlinkToDeath(AIBinder* binder, void* cookie) {
@@ -270,22 +273,19 @@
     for (auto it = mDeathRecipients.rbegin(); it != mDeathRecipients.rend(); ++it) {
         sp<TransferDeathRecipient> recipient = *it;
 
-        if (recipient->getCookie() == cookie &&
-
-            recipient->getWho() == binder->getBinder()) {
+        if (recipient->getCookie() == cookie && recipient->getWho() == binder->getBinder()) {
             mDeathRecipients.erase(it.base() - 1);
 
-            binder_status_t status =
-                    binder->getBinder()->unlinkToDeath(recipient, cookie, 0 /*flags*/);
-            if (status != EX_NONE) {
+            status_t status = binder->getBinder()->unlinkToDeath(recipient, cookie, 0 /*flags*/);
+            if (status != ::android::OK) {
                 LOG(ERROR) << __func__
                            << ": removed reference to death recipient but unlink failed.";
             }
-            return status;
+            return PruneStatusT(status);
         }
     }
 
-    return -ENOENT;
+    return STATUS_NAME_NOT_FOUND;
 }
 
 // start of C-API methods
@@ -323,19 +323,20 @@
 
 binder_status_t AIBinder_ping(AIBinder* binder) {
     if (binder == nullptr) {
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
-    return binder->getBinder()->pingBinder();
+    return PruneStatusT(binder->getBinder()->pingBinder());
 }
 
 binder_status_t AIBinder_linkToDeath(AIBinder* binder, AIBinder_DeathRecipient* recipient,
                                      void* cookie) {
     if (binder == nullptr || recipient == nullptr) {
         LOG(ERROR) << __func__ << ": Must provide binder and recipient.";
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
+    // returns binder_status_t
     return recipient->linkToDeath(binder, cookie);
 }
 
@@ -343,9 +344,10 @@
                                        void* cookie) {
     if (binder == nullptr || recipient == nullptr) {
         LOG(ERROR) << __func__ << ": Must provide binder and recipient.";
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
+    // returns binder_status_t
     return recipient->unlinkToDeath(binder, cookie);
 }
 
@@ -406,14 +408,14 @@
 binder_status_t AIBinder_prepareTransaction(AIBinder* binder, AParcel** in) {
     if (binder == nullptr || in == nullptr) {
         LOG(ERROR) << __func__ << ": requires non-null parameters.";
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
     const AIBinder_Class* clazz = binder->getClass();
     if (clazz == nullptr) {
         LOG(ERROR) << __func__
                    << ": Class must be defined for a remote binder transaction. See "
                       "AIBinder_associateClass.";
-        return EX_ILLEGAL_STATE;
+        return STATUS_INVALID_OPERATION;
     }
 
     if (!binder->isRemote()) {
@@ -424,20 +426,22 @@
     }
 
     *in = new AParcel(binder);
-    binder_status_t status = (**in)->writeInterfaceToken(clazz->getInterfaceDescriptor());
-    if (status != EX_NONE) {
+    status_t status = (*in)->get()->writeInterfaceToken(clazz->getInterfaceDescriptor());
+    binder_status_t ret = PruneStatusT(status);
+
+    if (ret != STATUS_OK) {
         delete *in;
         *in = nullptr;
     }
 
-    return status;
+    return ret;
 }
 
 binder_status_t AIBinder_transact(AIBinder* binder, transaction_code_t code, AParcel** in,
                                   AParcel** out, binder_flags_t flags) {
     if (in == nullptr) {
         LOG(ERROR) << __func__ << ": requires non-null in parameter";
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
     using AutoParcelDestroyer = std::unique_ptr<AParcel*, void (*)(AParcel**)>;
@@ -447,36 +451,36 @@
 
     if (!isUserCommand(code)) {
         LOG(ERROR) << __func__ << ": Only user-defined transactions can be made from the NDK.";
-        return EX_UNSUPPORTED_OPERATION;
+        return STATUS_UNKNOWN_TRANSACTION;
     }
 
     if ((flags & ~FLAG_ONEWAY) != 0) {
         LOG(ERROR) << __func__ << ": Unrecognized flags sent: " << flags;
-        return EX_ILLEGAL_ARGUMENT;
+        return STATUS_BAD_VALUE;
     }
 
     if (binder == nullptr || *in == nullptr || out == nullptr) {
         LOG(ERROR) << __func__ << ": requires non-null parameters.";
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
     if ((*in)->getBinder() != binder) {
         LOG(ERROR) << __func__ << ": parcel is associated with binder object " << binder
                    << " but called with " << (*in)->getBinder();
-        return EX_ILLEGAL_STATE;
+        return STATUS_BAD_VALUE;
     }
 
     *out = new AParcel(binder);
 
-    binder_status_t parcelStatus =
-            binder->getBinder()->transact(code, *(*in)->operator->(), (*out)->operator->(), flags);
+    status_t status = binder->getBinder()->transact(code, *(*in)->get(), (*out)->get(), flags);
+    binder_status_t ret = PruneStatusT(status);
 
-    if (parcelStatus != EX_NONE) {
+    if (ret != STATUS_OK) {
         delete *out;
         *out = nullptr;
     }
 
-    return parcelStatus;
+    return ret;
 }
 
 AIBinder_DeathRecipient* AIBinder_DeathRecipient_new(
diff --git a/libs/binder/ndk/ibinder_internal.h b/libs/binder/ndk/ibinder_internal.h
index fcf1b0b..5b6bc94 100644
--- a/libs/binder/ndk/ibinder_internal.h
+++ b/libs/binder/ndk/ibinder_internal.h
@@ -66,8 +66,8 @@
     ABBinder* asABBinder() override { return this; }
 
     const ::android::String16& getInterfaceDescriptor() const override;
-    binder_status_t onTransact(uint32_t code, const ::android::Parcel& data,
-                               ::android::Parcel* reply, binder_flags_t flags) override;
+    ::android::status_t onTransact(uint32_t code, const ::android::Parcel& data,
+                                   ::android::Parcel* reply, binder_flags_t flags) override;
 
 private:
     ABBinder(const AIBinder_Class* clazz, void* userData);
diff --git a/libs/binder/ndk/include_ndk/android/binder_ibinder.h b/libs/binder/ndk/include_ndk/android/binder_ibinder.h
index 7dca5a4..5081248 100644
--- a/libs/binder/ndk/include_ndk/android/binder_ibinder.h
+++ b/libs/binder/ndk/include_ndk/android/binder_ibinder.h
@@ -97,7 +97,7 @@
  *
  * If the process containing an AIBinder dies, it is possible to be holding a strong reference to
  * an object which does not exist. In this case, transactions to this binder will return
- * EX_DEAD_OBJECT. See also AIBinder_linkToDeath, AIBinder_unlinkToDeath, and AIBinder_isAlive.
+ * STATUS_DEAD_OBJECT. See also AIBinder_linkToDeath, AIBinder_unlinkToDeath, and AIBinder_isAlive.
  *
  * Once an AIBinder is created, anywhere it is passed (remotely or locally), there is a 1-1
  * correspondence between the address of an AIBinder and the object it represents. This means that
@@ -211,7 +211,7 @@
 /**
  * Stops registration for the associated binder dying. Does not delete the recipient. This function
  * may return a binder transaction failure and in case the death recipient cannot be found, it
- * returns -ENOENT.
+ * returns STATUS_NAME_NOT_FOUND.
  */
 binder_status_t AIBinder_unlinkToDeath(AIBinder* binder, AIBinder_DeathRecipient* recipient,
                                        void* cookie);
diff --git a/libs/binder/ndk/include_ndk/android/binder_parcel.h b/libs/binder/ndk/include_ndk/android/binder_parcel.h
index e871ed1..8628025 100644
--- a/libs/binder/ndk/include_ndk/android/binder_parcel.h
+++ b/libs/binder/ndk/include_ndk/android/binder_parcel.h
@@ -66,6 +66,17 @@
  */
 binder_status_t AParcel_readNullableStrongBinder(const AParcel* parcel, AIBinder** binder);
 
+/**
+ * Writes an AStatus object to the next location in a non-null parcel.
+ */
+binder_status_t AParcel_writeStatusHeader(AParcel* parcel, const AStatus* status);
+
+/**
+ * Reads an AStatus from the next location in a non-null parcel. Ownership is passed to the caller
+ * of this function.
+ */
+binder_status_t AParcel_readStatusHeader(const AParcel* parcel, AStatus** status);
+
 // @START
 /**
  * Writes int32_t value to the next location in a non-null parcel.
diff --git a/libs/binder/ndk/include_ndk/android/binder_status.h b/libs/binder/ndk/include_ndk/android/binder_status.h
index e97e181..6389a1b 100644
--- a/libs/binder/ndk/include_ndk/android/binder_status.h
+++ b/libs/binder/ndk/include_ndk/android/binder_status.h
@@ -25,12 +25,42 @@
 
 #pragma once
 
+#include <errno.h>
 #include <stdint.h>
 #include <sys/cdefs.h>
 
 __BEGIN_DECLS
 
-// Keep the exception codes in sync with android/os/Parcel.java.
+enum {
+    STATUS_OK = 0,
+
+    STATUS_UNKNOWN_ERROR = (-2147483647 - 1), // INT32_MIN value
+    STATUS_NO_MEMORY = -ENOMEM,
+    STATUS_INVALID_OPERATION = -ENOSYS,
+    STATUS_BAD_VALUE = -EINVAL,
+    STATUS_BAD_TYPE = (STATUS_UNKNOWN_ERROR + 1),
+    STATUS_NAME_NOT_FOUND = -ENOENT,
+    STATUS_PERMISSION_DENIED = -EPERM,
+    STATUS_NO_INIT = -ENODEV,
+    STATUS_ALREADY_EXISTS = -EEXIST,
+    STATUS_DEAD_OBJECT = -EPIPE,
+    STATUS_FAILED_TRANSACTION = (STATUS_UNKNOWN_ERROR + 2),
+    STATUS_BAD_INDEX = -EOVERFLOW,
+    STATUS_NOT_ENOUGH_DATA = -ENODATA,
+    STATUS_WOULD_BLOCK = -EWOULDBLOCK,
+    STATUS_TIMED_OUT = -ETIMEDOUT,
+    STATUS_UNKNOWN_TRANSACTION = -EBADMSG,
+    STATUS_FDS_NOT_ALLOWED = (STATUS_UNKNOWN_ERROR + 7),
+    STATUS_UNEXPECTED_NULL = (STATUS_UNKNOWN_ERROR + 8),
+};
+
+/**
+ * One of the STATUS_* values.
+ *
+ * All unrecognized values are coerced into STATUS_UNKNOWN_ERROR.
+ */
+typedef int32_t binder_status_t;
+
 enum {
     EX_NONE = 0,
     EX_SECURITY = -1,
@@ -44,12 +74,6 @@
     EX_PARCELABLE = -9,
 
     /**
-     * This is special and Java specific; see Parcel.java.
-     * This should be considered a success, and the next readInt32 bytes can be ignored.
-     */
-    EX_HAS_REPLY_HEADER = -128,
-
-    /**
      * This is special, and indicates to native binder proxies that the
      * transaction has failed at a low level.
      */
@@ -57,10 +81,103 @@
 };
 
 /**
- * One of the above values or -errno.
- * By convention, positive values are considered to mean service-specific exceptions.
+ * One of the EXCEPTION_* types.
+ *
+ * All unrecognized values are coerced into EXCEPTION_TRANSACTION_FAILED.
+ *
+ * These exceptions values are used by the SDK for parcelables. Also see Parcel.java.
  */
-typedef int32_t binder_status_t;
+typedef int32_t binder_exception_t;
+
+/**
+ * This is a helper class that encapsulates a standard way to keep track of and chain binder errors
+ * along with service specific errors.
+ *
+ * It is not required to be used in order to parcel/receive transactions, but it is required in
+ * order to be compatible with standard AIDL transactions.
+ */
+struct AStatus;
+typedef struct AStatus AStatus;
+
+/**
+ * New status which is considered a success.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_newOk();
+
+/**
+ * New status with exception code.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_fromExceptionCode(
+        binder_exception_t exception);
+
+/**
+ * New status with exception code and message.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_fromExceptionCodeWithMessage(
+        binder_exception_t exception, const char* message);
+
+/**
+ * New status with a service speciic error.
+ *
+ * This is considered to be EX_TRANSACTION_FAILED with extra information.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_fromServiceSpecificError(
+        int32_t serviceSpecific);
+
+/**
+ * New status with a service specific error and message.
+ *
+ * This is considered to be EX_TRANSACTION_FAILED with extra information.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_fromServiceSpecificErrorWithMessage(
+        int32_t serviceSpecific, const char* message);
+
+/**
+ * New status with binder_status_t. This is typically for low level failures when a binder_status_t
+ * is returned by an API on AIBinder or AParcel, and that is to be returned from a method returning
+ * an AStatus instance.
+ */
+__attribute__((warn_unused_result)) AStatus* AStatus_fromStatus(binder_status_t status);
+
+/**
+ * Whether this object represents a successful transaction. If this function returns true, then
+ * AStatus_getExceptionCode will return EX_NONE.
+ */
+bool AStatus_isOk(const AStatus* status);
+
+/**
+ * The exception that this status object represents.
+ */
+binder_exception_t AStatus_getExceptionCode(const AStatus* status);
+
+/**
+ * The service specific error if this object represents one. This function will only ever return a
+ * non-zero result if AStatus_getExceptionCode returns EX_SERVICE_SPECIFIC. If this function returns
+ * 0, the status object may still represent a different exception or status. To find out if this
+ * transaction as a whole is okay, use AStatus_isOk instead.
+ */
+int32_t AStatus_getServiceSpecificError(const AStatus* status);
+
+/**
+ * The status if this object represents one. This function will only ever return a non-zero result
+ * if AStatus_getExceptionCode returns EX_TRANSACTION_FAILED. If this function return 0, the status
+ * object may represent a different exception or a service specific error. To find out if this
+ * transaction as a whole is okay, use AStatus_isOk instead.
+ */
+binder_status_t AStatus_getStatus(const AStatus* status);
+
+/**
+ * If there is a message associated with this status, this will return that message. If there is no
+ * message, this will return an empty string.
+ *
+ * The returned string has the lifetime of the status object passed into this function.
+ */
+const char* AStatus_getMessage(const AStatus* status);
+
+/**
+ * Deletes memory associated with the status instance.
+ */
+void AStatus_delete(AStatus** status);
 
 __END_DECLS
 
diff --git a/libs/binder/ndk/libbinder_ndk.map.txt b/libs/binder/ndk/libbinder_ndk.map.txt
new file mode 100644
index 0000000..14683b9
--- /dev/null
+++ b/libs/binder/ndk/libbinder_ndk.map.txt
@@ -0,0 +1,61 @@
+LIBBINDER_NDK { # introduced=29
+  global:
+    AIBinder_associateClass;
+    AIBinder_Class_define;
+    AIBinder_DeathRecipient_delete;
+    AIBinder_DeathRecipient_new;
+    AIBinder_debugGetRefCount;
+    AIBinder_decStrong;
+    AIBinder_getClass;
+    AIBinder_getUserData;
+    AIBinder_incStrong;
+    AIBinder_isAlive;
+    AIBinder_isRemote;
+    AIBinder_linkToDeath;
+    AIBinder_new;
+    AIBinder_ping;
+    AIBinder_prepareTransaction;
+    AIBinder_transact;
+    AIBinder_unlinkToDeath;
+    AIBinder_Weak_delete;
+    AIBinder_Weak_new;
+    AIBinder_Weak_promote;
+    AParcel_delete;
+    AParcel_readBool;
+    AParcel_readByte;
+    AParcel_readChar;
+    AParcel_readDouble;
+    AParcel_readFloat;
+    AParcel_readInt32;
+    AParcel_readInt64;
+    AParcel_readNullableStrongBinder;
+    AParcel_readStatusHeader;
+    AParcel_readStrongBinder;
+    AParcel_readUint32;
+    AParcel_readUint64;
+    AParcel_writeBool;
+    AParcel_writeByte;
+    AParcel_writeChar;
+    AParcel_writeDouble;
+    AParcel_writeFloat;
+    AParcel_writeInt32;
+    AParcel_writeInt64;
+    AParcel_writeStatusHeader;
+    AParcel_writeStrongBinder;
+    AParcel_writeUint32;
+    AParcel_writeUint64;
+    AStatus_delete;
+    AStatus_fromExceptionCode;
+    AStatus_fromExceptionCodeWithMessage;
+    AStatus_fromServiceSpecificError;
+    AStatus_fromServiceSpecificErrorWithMessage;
+    AStatus_fromStatus;
+    AStatus_getExceptionCode;
+    AStatus_getMessage;
+    AStatus_getServiceSpecificError;
+    AStatus_getStatus;
+    AStatus_isOk;
+    AStatus_newOk;
+  local:
+    *;
+};
diff --git a/libs/binder/ndk/parcel.cpp b/libs/binder/ndk/parcel.cpp
index ccdfc7b..a063657 100644
--- a/libs/binder/ndk/parcel.cpp
+++ b/libs/binder/ndk/parcel.cpp
@@ -18,12 +18,14 @@
 #include "parcel_internal.h"
 
 #include "ibinder_internal.h"
+#include "status_internal.h"
 
 #include <binder/Parcel.h>
 
 using ::android::IBinder;
 using ::android::Parcel;
 using ::android::sp;
+using ::android::status_t;
 
 void AParcel_delete(AParcel** parcel) {
     if (parcel == nullptr) {
@@ -36,104 +38,133 @@
 
 binder_status_t AParcel_writeStrongBinder(AParcel* parcel, AIBinder* binder) {
     sp<IBinder> writeBinder = binder != nullptr ? binder->getBinder() : nullptr;
-    return (*parcel)->writeStrongBinder(writeBinder);
+    return parcel->get()->writeStrongBinder(writeBinder);
 }
 binder_status_t AParcel_readStrongBinder(const AParcel* parcel, AIBinder** binder) {
     sp<IBinder> readBinder = nullptr;
-    binder_status_t status = (*parcel)->readStrongBinder(&readBinder);
-    if (status != EX_NONE) {
-        return status;
+    status_t status = parcel->get()->readStrongBinder(&readBinder);
+    if (status != STATUS_OK) {
+        return PruneStatusT(status);
     }
     sp<AIBinder> ret = ABpBinder::lookupOrCreateFromBinder(readBinder);
     AIBinder_incStrong(ret.get());
     *binder = ret.get();
-    return status;
+    return PruneStatusT(status);
 }
 binder_status_t AParcel_readNullableStrongBinder(const AParcel* parcel, AIBinder** binder) {
     sp<IBinder> readBinder = nullptr;
-    binder_status_t status = (*parcel)->readNullableStrongBinder(&readBinder);
-    if (status != EX_NONE) {
-        return status;
+    status_t status = parcel->get()->readNullableStrongBinder(&readBinder);
+    if (status != STATUS_OK) {
+        return PruneStatusT(status);
     }
     sp<AIBinder> ret = ABpBinder::lookupOrCreateFromBinder(readBinder);
     AIBinder_incStrong(ret.get());
     *binder = ret.get();
-    return status;
+    return PruneStatusT(status);
+}
+binder_status_t AParcel_writeStatusHeader(AParcel* parcel, const AStatus* status) {
+    return PruneStatusT(status->get()->writeToParcel(parcel->get()));
+}
+binder_status_t AParcel_readStatusHeader(const AParcel* parcel, AStatus** status) {
+    ::android::binder::Status bstatus;
+    binder_status_t ret = PruneStatusT(bstatus.readFromParcel(*parcel->get()));
+    if (ret == EX_NONE) {
+        *status = new AStatus(std::move(bstatus));
+    }
+    return ret;
 }
 
 // See gen_parcel_helper.py. These auto-generated read/write methods use the same types for
 // libbinder and this library.
 // @START
 binder_status_t AParcel_writeInt32(AParcel* parcel, int32_t value) {
-    return (*parcel)->writeInt32(value);
+    status_t status = parcel->get()->writeInt32(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeUint32(AParcel* parcel, uint32_t value) {
-    return (*parcel)->writeUint32(value);
+    status_t status = parcel->get()->writeUint32(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeInt64(AParcel* parcel, int64_t value) {
-    return (*parcel)->writeInt64(value);
+    status_t status = parcel->get()->writeInt64(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeUint64(AParcel* parcel, uint64_t value) {
-    return (*parcel)->writeUint64(value);
+    status_t status = parcel->get()->writeUint64(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeFloat(AParcel* parcel, float value) {
-    return (*parcel)->writeFloat(value);
+    status_t status = parcel->get()->writeFloat(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeDouble(AParcel* parcel, double value) {
-    return (*parcel)->writeDouble(value);
+    status_t status = parcel->get()->writeDouble(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeBool(AParcel* parcel, bool value) {
-    return (*parcel)->writeBool(value);
+    status_t status = parcel->get()->writeBool(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeChar(AParcel* parcel, char16_t value) {
-    return (*parcel)->writeChar(value);
+    status_t status = parcel->get()->writeChar(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_writeByte(AParcel* parcel, int8_t value) {
-    return (*parcel)->writeByte(value);
+    status_t status = parcel->get()->writeByte(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readInt32(const AParcel* parcel, int32_t* value) {
-    return (*parcel)->readInt32(value);
+    status_t status = parcel->get()->readInt32(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readUint32(const AParcel* parcel, uint32_t* value) {
-    return (*parcel)->readUint32(value);
+    status_t status = parcel->get()->readUint32(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readInt64(const AParcel* parcel, int64_t* value) {
-    return (*parcel)->readInt64(value);
+    status_t status = parcel->get()->readInt64(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readUint64(const AParcel* parcel, uint64_t* value) {
-    return (*parcel)->readUint64(value);
+    status_t status = parcel->get()->readUint64(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readFloat(const AParcel* parcel, float* value) {
-    return (*parcel)->readFloat(value);
+    status_t status = parcel->get()->readFloat(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readDouble(const AParcel* parcel, double* value) {
-    return (*parcel)->readDouble(value);
+    status_t status = parcel->get()->readDouble(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readBool(const AParcel* parcel, bool* value) {
-    return (*parcel)->readBool(value);
+    status_t status = parcel->get()->readBool(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readChar(const AParcel* parcel, char16_t* value) {
-    return (*parcel)->readChar(value);
+    status_t status = parcel->get()->readChar(value);
+    return PruneStatusT(status);
 }
 
 binder_status_t AParcel_readByte(const AParcel* parcel, int8_t* value) {
-    return (*parcel)->readByte(value);
+    status_t status = parcel->get()->readByte(value);
+    return PruneStatusT(status);
 }
 
 // @END
diff --git a/libs/binder/ndk/parcel_internal.h b/libs/binder/ndk/parcel_internal.h
index b6a9110..d69971f 100644
--- a/libs/binder/ndk/parcel_internal.h
+++ b/libs/binder/ndk/parcel_internal.h
@@ -24,8 +24,8 @@
 #include "ibinder_internal.h"
 
 struct AParcel {
-    const ::android::Parcel* operator->() const { return mParcel; }
-    ::android::Parcel* operator->() { return mParcel; }
+    const ::android::Parcel* get() const { return mParcel; }
+    ::android::Parcel* get() { return mParcel; }
 
     AParcel(const AIBinder* binder) : AParcel(binder, new ::android::Parcel, true /*owns*/) {}
     AParcel(const AIBinder* binder, ::android::Parcel* parcel, bool owns)
diff --git a/libs/binder/ndk/runtests.sh b/libs/binder/ndk/runtests.sh
index 6c8527d..2257eb2 100755
--- a/libs/binder/ndk/runtests.sh
+++ b/libs/binder/ndk/runtests.sh
@@ -37,4 +37,7 @@
 adb wait-for-device
 adb sync data
 
+# very simple unit tests, tests things outside of the NDK as well
 run_libbinder_ndk_test
+
+atest android.binder.cts.NdkBinderTest
diff --git a/libs/binder/ndk/scripts/gen_parcel_helper.py b/libs/binder/ndk/scripts/gen_parcel_helper.py
index 794afe2..85ee755 100755
--- a/libs/binder/ndk/scripts/gen_parcel_helper.py
+++ b/libs/binder/ndk/scripts/gen_parcel_helper.py
@@ -68,7 +68,8 @@
         header += " */\n"
         header += "binder_status_t AParcel_write" + pretty + "(AParcel* parcel, " + cpp + " value);\n\n"
         source += "binder_status_t AParcel_write" + pretty + "(AParcel* parcel, " + cpp + " value) {\n"
-        source += "    return (*parcel)->write" + pretty + "(value);\n"
+        source += "    status_t status = parcel->get()->write" + pretty + "(value);\n"
+        source += "    return PruneStatusT(status);\n"
         source += "}\n\n"
 
     for pretty, cpp in data_types:
@@ -77,7 +78,8 @@
         header += " */\n"
         header += "binder_status_t AParcel_read" + pretty + "(const AParcel* parcel, " + cpp + "* value);\n\n"
         source += "binder_status_t AParcel_read" + pretty + "(const AParcel* parcel, " + cpp + "* value) {\n"
-        source += "    return (*parcel)->read" + pretty + "(value);\n"
+        source += "    status_t status = parcel->get()->read" + pretty + "(value);\n"
+        source += "    return PruneStatusT(status);\n"
         source += "}\n\n"
 
     replaceFileTags(ROOT + "include_ndk/android/binder_parcel.h", header)
diff --git a/libs/binder/ndk/scripts/init_map.sh b/libs/binder/ndk/scripts/init_map.sh
new file mode 100755
index 0000000..132144b
--- /dev/null
+++ b/libs/binder/ndk/scripts/init_map.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Simple helper for ease of development until this API is frozen.
+
+echo "LIBBINDER_NDK { # introduced=29"
+echo "  global:"
+{
+    grep -oP "AIBinder_[a-zA-Z0-9_]+(?=\()" include_ndk/android/binder_ibinder.h;
+    grep -oP "AParcel_[a-zA-Z0-9_]+(?=\()" include_ndk/android/binder_parcel.h;
+    grep -oP "AStatus_[a-zA-Z0-9_]+(?=\()" include_ndk/android/binder_status.h;
+} | sort | uniq | awk '{ print "    " $0 ";"; }'
+echo "  local:"
+echo "    *;"
+echo "};"
diff --git a/libs/binder/ndk/service_manager.cpp b/libs/binder/ndk/service_manager.cpp
index 5bc69b0..9ddc555 100644
--- a/libs/binder/ndk/service_manager.cpp
+++ b/libs/binder/ndk/service_manager.cpp
@@ -15,7 +15,9 @@
  */
 
 #include <android/binder_manager.h>
+
 #include "ibinder_internal.h"
+#include "status_internal.h"
 
 #include <binder/IServiceManager.h>
 
@@ -23,15 +25,17 @@
 using ::android::IBinder;
 using ::android::IServiceManager;
 using ::android::sp;
+using ::android::status_t;
 using ::android::String16;
 
 binder_status_t AServiceManager_addService(AIBinder* binder, const char* instance) {
     if (binder == nullptr || instance == nullptr) {
-        return EX_NULL_POINTER;
+        return STATUS_UNEXPECTED_NULL;
     }
 
     sp<IServiceManager> sm = defaultServiceManager();
-    return sm->addService(String16(instance), binder->getBinder());
+    status_t status = sm->addService(String16(instance), binder->getBinder());
+    return PruneStatusT(status);
 }
 AIBinder* AServiceManager_getService(const char* instance) {
     if (instance == nullptr) {
diff --git a/libs/binder/ndk/status.cpp b/libs/binder/ndk/status.cpp
new file mode 100644
index 0000000..deb0392
--- /dev/null
+++ b/libs/binder/ndk/status.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android/binder_status.h>
+#include "status_internal.h"
+
+#include <android-base/logging.h>
+
+using ::android::status_t;
+using ::android::binder::Status;
+
+AStatus* AStatus_newOk() {
+    return new AStatus();
+}
+
+AStatus* AStatus_fromExceptionCode(binder_exception_t exception) {
+    return new AStatus(Status::fromExceptionCode(exception));
+}
+
+AStatus* AStatus_fromExceptionCodeWithMessage(binder_exception_t exception, const char* message) {
+    return new AStatus(Status::fromExceptionCode(exception, message));
+}
+
+AStatus* AStatus_fromServiceSpecificError(int32_t serviceSpecific) {
+    return new AStatus(Status::fromServiceSpecificError(serviceSpecific));
+}
+
+AStatus* AStatus_fromServiceSpecificErrorWithMessage(int32_t serviceSpecific, const char* message) {
+    return new AStatus(Status::fromServiceSpecificError(serviceSpecific, message));
+}
+
+AStatus* AStatus_fromStatus(binder_status_t status) {
+    return new AStatus(Status::fromStatusT(status));
+}
+
+bool AStatus_isOk(const AStatus* status) {
+    return status->get()->isOk();
+}
+
+binder_exception_t AStatus_getExceptionCode(const AStatus* status) {
+    return PruneException(status->get()->exceptionCode());
+}
+
+int32_t AStatus_getServiceSpecificError(const AStatus* status) {
+    return status->get()->serviceSpecificErrorCode();
+}
+
+binder_status_t AStatus_getStatus(const AStatus* status) {
+    return PruneStatusT(status->get()->transactionError());
+}
+
+const char* AStatus_getMessage(const AStatus* status) {
+    return status->get()->exceptionMessage().c_str();
+}
+
+void AStatus_delete(AStatus** status) {
+    if (status == nullptr) {
+        return;
+    }
+
+    delete *status;
+    *status = nullptr;
+}
+
+binder_status_t PruneStatusT(status_t status) {
+    if (status > 0) return status;
+
+    switch (status) {
+        case ::android::OK:
+            return STATUS_OK;
+        case ::android::NO_MEMORY:
+            return STATUS_NO_MEMORY;
+        case ::android::INVALID_OPERATION:
+            return STATUS_INVALID_OPERATION;
+        case ::android::BAD_VALUE:
+            return STATUS_BAD_VALUE;
+        case ::android::BAD_TYPE:
+            return STATUS_BAD_TYPE;
+        case ::android::NAME_NOT_FOUND:
+            return STATUS_NAME_NOT_FOUND;
+        case ::android::PERMISSION_DENIED:
+            return STATUS_PERMISSION_DENIED;
+        case ::android::NO_INIT:
+            return STATUS_NO_INIT;
+        case ::android::ALREADY_EXISTS:
+            return STATUS_ALREADY_EXISTS;
+        case ::android::DEAD_OBJECT:
+            return STATUS_DEAD_OBJECT;
+        case ::android::FAILED_TRANSACTION:
+            return STATUS_FAILED_TRANSACTION;
+        case ::android::BAD_INDEX:
+            return STATUS_BAD_INDEX;
+        case ::android::NOT_ENOUGH_DATA:
+            return STATUS_NOT_ENOUGH_DATA;
+        case ::android::WOULD_BLOCK:
+            return STATUS_WOULD_BLOCK;
+        case ::android::TIMED_OUT:
+            return STATUS_TIMED_OUT;
+        case ::android::UNKNOWN_TRANSACTION:
+            return STATUS_UNKNOWN_TRANSACTION;
+        case ::android::FDS_NOT_ALLOWED:
+            return STATUS_FDS_NOT_ALLOWED;
+        case ::android::UNEXPECTED_NULL:
+            return STATUS_UNEXPECTED_NULL;
+        case ::android::UNKNOWN_ERROR:
+            return STATUS_UNKNOWN_ERROR;
+
+        default:
+            LOG(WARNING) << __func__
+                         << ": Unknown status_t pruned into STATUS_UNKNOWN_ERROR: " << status;
+            return STATUS_UNKNOWN_ERROR;
+    }
+}
+
+binder_exception_t PruneException(int32_t exception) {
+    switch (exception) {
+        case Status::EX_NONE:
+            return EX_NONE;
+        case Status::EX_SECURITY:
+            return EX_SECURITY;
+        case Status::EX_BAD_PARCELABLE:
+            return EX_BAD_PARCELABLE;
+        case Status::EX_ILLEGAL_ARGUMENT:
+            return EX_ILLEGAL_ARGUMENT;
+        case Status::EX_NULL_POINTER:
+            return EX_NULL_POINTER;
+        case Status::EX_ILLEGAL_STATE:
+            return EX_ILLEGAL_STATE;
+        case Status::EX_NETWORK_MAIN_THREAD:
+            return EX_NETWORK_MAIN_THREAD;
+        case Status::EX_UNSUPPORTED_OPERATION:
+            return EX_UNSUPPORTED_OPERATION;
+        case Status::EX_SERVICE_SPECIFIC:
+            return EX_SERVICE_SPECIFIC;
+        case Status::EX_PARCELABLE:
+            return EX_PARCELABLE;
+        case Status::EX_TRANSACTION_FAILED:
+            return EX_TRANSACTION_FAILED;
+
+        default:
+            LOG(WARNING) << __func__
+                         << ": Unknown status_t pruned into EX_TRANSACTION_FAILED: " << exception;
+            return EX_TRANSACTION_FAILED;
+    }
+}
diff --git a/libs/binder/ndk/status_internal.h b/libs/binder/ndk/status_internal.h
new file mode 100644
index 0000000..8c32baf
--- /dev/null
+++ b/libs/binder/ndk/status_internal.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/binder_status.h>
+
+#include <binder/Status.h>
+#include <utils/Errors.h>
+
+struct AStatus {
+    AStatus() {} // ok
+    AStatus(::android::binder::Status&& status) : mStatus(std::move(status)) {}
+
+    ::android::binder::Status* get() { return &mStatus; }
+    const ::android::binder::Status* get() const { return &mStatus; }
+
+private:
+    ::android::binder::Status mStatus;
+};
+
+// This collapses the statuses into the declared range.
+binder_status_t PruneStatusT(android::status_t status);
+
+// This collapses the exception into the declared range.
+binder_exception_t PruneException(int32_t exception);
diff --git a/libs/binder/ndk/test/iface.cpp b/libs/binder/ndk/test/iface.cpp
index a1aa0fa..80700df 100644
--- a/libs/binder/ndk/test/iface.cpp
+++ b/libs/binder/ndk/test/iface.cpp
@@ -41,7 +41,7 @@
 
 binder_status_t IFoo_Class_onTransact(AIBinder* binder, transaction_code_t code, const AParcel* in,
                                       AParcel* out) {
-    binder_status_t stat = EX_UNSUPPORTED_OPERATION;
+    binder_status_t stat = STATUS_FAILED_TRANSACTION;
 
     sp<IFoo> foo = static_cast<IFoo_Class_Data*>(AIBinder_getUserData(binder))->foo;
     CHECK(foo != nullptr) << "Transaction made on already deleted object";
@@ -50,7 +50,7 @@
         case IFoo::DOFOO: {
             int32_t valueIn;
             stat = AParcel_readInt32(in, &valueIn);
-            if (stat != EX_NONE) break;
+            if (stat != STATUS_OK) break;
             int32_t valueOut = foo->doubleNumber(valueIn);
             stat = AParcel_writeInt32(out, valueOut);
             break;
@@ -70,16 +70,16 @@
 
     virtual int32_t doubleNumber(int32_t in) {
         AParcel* parcelIn;
-        CHECK(EX_NONE == AIBinder_prepareTransaction(mBinder, &parcelIn));
+        CHECK(STATUS_OK == AIBinder_prepareTransaction(mBinder, &parcelIn));
 
-        CHECK(EX_NONE == AParcel_writeInt32(parcelIn, in));
+        CHECK(STATUS_OK == AParcel_writeInt32(parcelIn, in));
 
         AParcel* parcelOut;
-        CHECK(EX_NONE ==
+        CHECK(STATUS_OK ==
               AIBinder_transact(mBinder, IFoo::DOFOO, &parcelIn, &parcelOut, 0 /*flags*/));
 
         int32_t out;
-        CHECK(EX_NONE == AParcel_readInt32(parcelOut, &out));
+        CHECK(STATUS_OK == AParcel_readInt32(parcelOut, &out));
 
         AParcel_delete(&parcelOut);
 
diff --git a/libs/binder/ndk/test/main_client.cpp b/libs/binder/ndk/test/main_client.cpp
index b8518d7..2dcccfe 100644
--- a/libs/binder/ndk/test/main_client.cpp
+++ b/libs/binder/ndk/test/main_client.cpp
@@ -41,7 +41,7 @@
     ASSERT_NE(nullptr, binder);
     EXPECT_TRUE(AIBinder_isRemote(binder));
     EXPECT_TRUE(AIBinder_isAlive(binder));
-    EXPECT_EQ(EX_NONE, AIBinder_ping(binder));
+    EXPECT_EQ(STATUS_OK, AIBinder_ping(binder));
 
     AIBinder_decStrong(binder);
 }
@@ -60,9 +60,11 @@
     AIBinder_DeathRecipient* recipient = AIBinder_DeathRecipient_new(OnBinderDeath);
     ASSERT_NE(nullptr, recipient);
 
-    EXPECT_EQ(EX_NONE, AIBinder_linkToDeath(binder, recipient, nullptr));
-    EXPECT_EQ(EX_NONE, AIBinder_unlinkToDeath(binder, recipient, nullptr));
-    EXPECT_EQ(-ENOENT, AIBinder_unlinkToDeath(binder, recipient, nullptr));
+    EXPECT_EQ(STATUS_OK, AIBinder_linkToDeath(binder, recipient, nullptr));
+    EXPECT_EQ(STATUS_OK, AIBinder_linkToDeath(binder, recipient, nullptr));
+    EXPECT_EQ(STATUS_OK, AIBinder_unlinkToDeath(binder, recipient, nullptr));
+    EXPECT_EQ(STATUS_OK, AIBinder_unlinkToDeath(binder, recipient, nullptr));
+    EXPECT_EQ(STATUS_NAME_NOT_FOUND, AIBinder_unlinkToDeath(binder, recipient, nullptr));
 
     AIBinder_DeathRecipient_delete(&recipient);
     AIBinder_decStrong(binder);
@@ -79,7 +81,7 @@
     static const char* kInstanceName = "test-get-service-in-process";
 
     sp<IFoo> foo = new MyTestFoo;
-    EXPECT_EQ(EX_NONE, foo->addService(kInstanceName));
+    EXPECT_EQ(STATUS_OK, foo->addService(kInstanceName));
 
     sp<IFoo> getFoo = IFoo::getService(kInstanceName);
     EXPECT_EQ(foo.get(), getFoo.get());
@@ -119,7 +121,7 @@
     static const char* kInstanceName1 = "test-multi-1";
     static const char* kInstanceName2 = "test-multi-2";
     sp<IFoo> foo = new MyTestFoo;
-    EXPECT_EQ(EX_NONE, foo->addService(kInstanceName1));
-    EXPECT_EQ(EX_NONE, foo->addService(kInstanceName2));
+    EXPECT_EQ(STATUS_OK, foo->addService(kInstanceName1));
+    EXPECT_EQ(STATUS_OK, foo->addService(kInstanceName2));
     EXPECT_EQ(IFoo::getService(kInstanceName1), IFoo::getService(kInstanceName2));
 }
diff --git a/libs/binder/ndk/test/main_server.cpp b/libs/binder/ndk/test/main_server.cpp
index f3da7da..0718a69 100644
--- a/libs/binder/ndk/test/main_server.cpp
+++ b/libs/binder/ndk/test/main_server.cpp
@@ -33,7 +33,7 @@
     // Strong reference to MyFoo kept by service manager.
     binder_status_t status = (new MyFoo)->addService(IFoo::kSomeInstanceName);
 
-    if (status != EX_NONE) {
+    if (status != STATUS_OK) {
         LOG(FATAL) << "Could not register: " << status;
     }
 
diff --git a/libs/binder/ndk/update.sh b/libs/binder/ndk/update.sh
index 1eba892..49b4730 100755
--- a/libs/binder/ndk/update.sh
+++ b/libs/binder/ndk/update.sh
@@ -18,5 +18,6 @@
 set -ex
 
 # This script makes sure that the source code is in sync with the various scripts
+./scripts/init_map.sh > libbinder_ndk.map.txt
 ./scripts/gen_parcel_helper.py
 ./scripts/format.sh
diff --git a/libs/vr/libvrflinger/Android.bp b/libs/vr/libvrflinger/Android.bp
index 776dd8e..07904fb 100644
--- a/libs/vr/libvrflinger/Android.bp
+++ b/libs/vr/libvrflinger/Android.bp
@@ -64,6 +64,7 @@
 headerLibraries = [
     "android.hardware.graphics.composer@2.1-command-buffer",
     "android.hardware.graphics.composer@2.2-command-buffer",
+    "android.hardware.graphics.composer@2.3-command-buffer",
     "libdvr_headers",
     "libsurfaceflinger_headers",
 ]
diff --git a/services/sensorservice/Android.bp b/services/sensorservice/Android.bp
index a7f3a52..a6b9533 100644
--- a/services/sensorservice/Android.bp
+++ b/services/sensorservice/Android.bp
@@ -47,6 +47,7 @@
         "libhidltransport",
         "libhwbinder",
         "android.hardware.sensors@1.0",
+        "android.hardware.sensors@2.0",
     ],
 
     static_libs: ["android.hardware.sensors@1.0-convert"],
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index 372b609..3822ee1 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -306,7 +306,7 @@
     int handle = s->getSensor().getHandle();
     int type = s->getSensor().getType();
     if (mSensors.add(handle, s, isDebug, isVirtual)){
-        mRecentEvent.emplace(handle, new RecentEventLogger(type));
+        mRecentEvent.emplace(handle, new SensorServiceUtil::RecentEventLogger(type));
         return s->getSensor();
     } else {
         return mSensors.getNonSensor();
diff --git a/services/sensorservice/SensorService.h b/services/sensorservice/SensorService.h
index f71723d..db945bb 100644
--- a/services/sensorservice/SensorService.h
+++ b/services/sensorservice/SensorService.h
@@ -59,7 +59,6 @@
 namespace android {
 // ---------------------------------------------------------------------------
 class SensorInterface;
-using namespace SensorServiceUtil;
 
 class SensorService :
         public BinderService<SensorService>,
@@ -277,7 +276,7 @@
     static uint8_t sHmacGlobalKey[128];
     static bool sHmacGlobalKeyIsValid;
 
-    SensorList mSensors;
+    SensorServiceUtil::SensorList mSensors;
     status_t mInitCheck;
 
     // Socket buffersize used to initialize BitTube. This size depends on whether batching is
@@ -294,7 +293,7 @@
     bool mWakeLockAcquired;
     sensors_event_t *mSensorEventBuffer, *mSensorEventScratch;
     wp<const SensorEventConnection> * mMapFlushEventsToConnections;
-    std::unordered_map<int, RecentEventLogger*> mRecentEvent;
+    std::unordered_map<int, SensorServiceUtil::RecentEventLogger*> mRecentEvent;
     SortedVector< wp<SensorDirectConnection> > mDirectConnections;
     Mode mCurrentOperatingMode;
 
diff --git a/services/sensorservice/SensorsWrapper.h b/services/sensorservice/SensorsWrapper.h
new file mode 100644
index 0000000..f3fa164
--- /dev/null
+++ b/services/sensorservice/SensorsWrapper.h
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ANDROID_SENSORS_WRAPPER_H
+#define ANDROID_SENSORS_WRAPPER_H
+
+#include "android/hardware/sensors/1.0/ISensors.h"
+#include "android/hardware/sensors/2.0/ISensors.h"
+
+#include <utils/LightRefBase.h>
+
+namespace android {
+namespace SensorServiceUtil {
+
+using ::android::hardware::MQDescriptorSync;
+using ::android::hardware::Return;
+using ::android::hardware::sensors::V1_0::Event;
+using ::android::hardware::sensors::V1_0::ISensors;
+using ::android::hardware::sensors::V1_0::OperationMode;
+using ::android::hardware::sensors::V1_0::RateLevel;
+using ::android::hardware::sensors::V1_0::Result;
+using ::android::hardware::sensors::V1_0::SharedMemInfo;
+
+/*
+ * The ISensorsWrapper interface includes all function from supported Sensors HAL versions. This
+ * allows for the SensorDevice to use the ISensorsWrapper interface to interact with the Sensors
+ * HAL regardless of the current version of the Sensors HAL that is loaded. Each concrete
+ * instantiation of ISensorsWrapper must correspond to a specific Sensors HAL version. This design
+ * is beneficial because only the functions that change between Sensors HAL versions must be newly
+ * newly implemented, any previously implemented function that does not change may remain the same.
+ *
+ * Functions that exist across all versions of the Sensors HAL should be implemented as pure
+ * virtual functions which forces the concrete instantiations to implement the functions.
+ *
+ * Functions that do not exist across all versions of the Sensors HAL should include a default
+ * implementation that generates an error if called. The default implementation should never
+ * be called and must be overridden by Sensors HAL versions that support the function.
+ */
+class ISensorsWrapper : public VirtualLightRefBase {
+public:
+    virtual bool supportsPolling() const = 0;
+
+    virtual bool supportsMessageQueues() const = 0;
+
+    virtual Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) = 0;
+
+    virtual Return<Result> setOperationMode(OperationMode mode) = 0;
+
+    virtual Return<Result> activate(int32_t sensorHandle, bool enabled) = 0;
+
+    virtual Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                                 int64_t maxReportLatencyNs) = 0;
+
+    virtual Return<Result> flush(int32_t sensorHandle) = 0;
+
+    virtual Return<Result> injectSensorData(const Event& event) = 0;
+
+    virtual Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                               ISensors::registerDirectChannel_cb _hidl_cb) = 0;
+
+    virtual Return<Result> unregisterDirectChannel(int32_t channelHandle) = 0;
+
+    virtual Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle,
+                                            RateLevel rate,
+                                            ISensors::configDirectReport_cb _hidl_cb) = 0;
+
+    virtual Return<void> poll(int32_t maxCount, ISensors::poll_cb _hidl_cb) {
+        (void)maxCount;
+        (void)_hidl_cb;
+        // TODO (b/111070257): Generate an assert-level error since this should never be called
+        // directly
+        return Return<void>();
+    }
+
+    virtual Return<Result> initializeMessageQueues(const MQDescriptorSync<Event>& eventQueueDesc,
+                                                   const MQDescriptorSync<uint32_t>& wakeLockDesc) {
+        (void)eventQueueDesc;
+        (void)wakeLockDesc;
+        // TODO (b/111070257): Generate an assert-level error since this should never be called
+        // directly
+        return Result::INVALID_OPERATION;
+    }
+};
+
+template<typename T>
+class SensorsWrapperBase : public ISensorsWrapper {
+public:
+    SensorsWrapperBase(sp<T> sensors) :
+        mSensors(sensors) { };
+
+    Return<void> getSensorsList(ISensors::getSensorsList_cb _hidl_cb) override {
+        return mSensors->getSensorsList(_hidl_cb);
+    }
+
+    Return<Result> setOperationMode(OperationMode mode) override {
+        return mSensors->setOperationMode(mode);
+    }
+
+    Return<Result> activate(int32_t sensorHandle, bool enabled) override {
+        return mSensors->activate(sensorHandle, enabled);
+    }
+
+    Return<Result> batch(int32_t sensorHandle, int64_t samplingPeriodNs,
+                         int64_t maxReportLatencyNs) override {
+        return mSensors->batch(sensorHandle, samplingPeriodNs, maxReportLatencyNs);
+    }
+
+    Return<Result> flush(int32_t sensorHandle) override {
+        return mSensors->flush(sensorHandle);
+    }
+
+    Return<Result> injectSensorData(const Event& event) override {
+        return mSensors->injectSensorData(event);
+    }
+
+    Return<void> registerDirectChannel(const SharedMemInfo& mem,
+                                       ISensors::registerDirectChannel_cb _hidl_cb) override {
+        return mSensors->registerDirectChannel(mem, _hidl_cb);
+    }
+
+    Return<Result> unregisterDirectChannel(int32_t channelHandle) override {
+        return mSensors->unregisterDirectChannel(channelHandle);
+    }
+
+    Return<void> configDirectReport(int32_t sensorHandle, int32_t channelHandle,
+                                    RateLevel rate,
+                                    ISensors::configDirectReport_cb _hidl_cb) override {
+        return mSensors->configDirectReport(sensorHandle, channelHandle, rate, _hidl_cb);
+    }
+
+protected:
+    sp<T> mSensors;
+};
+
+class SensorsWrapperV1_0 : public SensorsWrapperBase<hardware::sensors::V1_0::ISensors> {
+public:
+    SensorsWrapperV1_0(sp<hardware::sensors::V1_0::ISensors> sensors) :
+        SensorsWrapperBase(sensors) { };
+
+    bool supportsPolling() const override {
+        return true;
+    }
+
+    bool supportsMessageQueues() const override {
+        return false;
+    }
+
+    Return<void> poll(int32_t maxCount,
+                      hardware::sensors::V1_0::ISensors::poll_cb _hidl_cb) override {
+        return mSensors->poll(maxCount, _hidl_cb);
+    }
+};
+
+class SensorsWrapperV2_0 : public SensorsWrapperBase<hardware::sensors::V2_0::ISensors> {
+public:
+    SensorsWrapperV2_0(sp<hardware::sensors::V2_0::ISensors> sensors)
+        : SensorsWrapperBase(sensors) { };
+
+    bool supportsPolling() const override {
+        return false;
+    }
+
+    bool supportsMessageQueues() const override {
+        return true;
+    }
+
+    Return<Result> initializeMessageQueues(
+            const MQDescriptorSync<Event>& eventQueueDesc,
+            const MQDescriptorSync<uint32_t>& wakeLockDesc) override {
+        return mSensors->initializeMessageQueues(eventQueueDesc, wakeLockDesc);
+    }
+};
+
+}; // namespace SensorServiceUtil
+}; // namespace android
+
+#endif // ANDROID_SENSORS_WRAPPER_H
diff --git a/services/surfaceflinger/Android.bp b/services/surfaceflinger/Android.bp
index da57511..744bdba 100644
--- a/services/surfaceflinger/Android.bp
+++ b/services/surfaceflinger/Android.bp
@@ -46,6 +46,7 @@
         "libhwbinder",
         "liblayers_proto",
         "liblog",
+    	"libnativewindow",
         "libpdx_default_transport",
         "libprotobuf-cpp-lite",
         "libsync",
@@ -65,6 +66,7 @@
     header_libs: [
         "android.hardware.graphics.composer@2.1-command-buffer",
         "android.hardware.graphics.composer@2.2-command-buffer",
+        "android.hardware.graphics.composer@2.3-command-buffer",
     ],
     export_static_lib_headers: [
         "librenderengine",
diff --git a/services/surfaceflinger/DisplayDevice.cpp b/services/surfaceflinger/DisplayDevice.cpp
index 3eb0a92..4becfab 100644
--- a/services/surfaceflinger/DisplayDevice.cpp
+++ b/services/surfaceflinger/DisplayDevice.cpp
@@ -543,8 +543,8 @@
 
     ANativeWindow* const window = mNativeWindow.get();
     mSurface->setNativeWindow(window);
-    mDisplayWidth = mSurface->queryWidth();
-    mDisplayHeight = mSurface->queryHeight();
+    mDisplayWidth = mSurface->getWidth();
+    mDisplayHeight = mSurface->getHeight();
 
     LOG_FATAL_IF(mDisplayWidth != newWidth,
                 "Unable to set new width to %d", newWidth);
diff --git a/services/surfaceflinger/DisplayHardware/ComposerHal.cpp b/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
index 741eb7c..163b26c 100644
--- a/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
+++ b/services/surfaceflinger/DisplayHardware/ComposerHal.cpp
@@ -991,6 +991,18 @@
     return error;
 }
 
+Error Composer::setLayerColorTransform(Display display, Layer layer, const float* matrix)
+{
+    if (!mClient_2_3) {
+        return Error::UNSUPPORTED;
+    }
+
+    mWriter.selectDisplay(display);
+    mWriter.selectLayer(layer);
+    mWriter.setLayerColorTransform(matrix);
+    return Error::NONE;
+}
+
 CommandReader::~CommandReader()
 {
     resetData();
diff --git a/services/surfaceflinger/DisplayHardware/ComposerHal.h b/services/surfaceflinger/DisplayHardware/ComposerHal.h
index 60b0f72..94be6e9 100644
--- a/services/surfaceflinger/DisplayHardware/ComposerHal.h
+++ b/services/surfaceflinger/DisplayHardware/ComposerHal.h
@@ -27,7 +27,7 @@
 #include <android/hardware/graphics/common/1.1/types.h>
 #include <android/hardware/graphics/composer/2.3/IComposer.h>
 #include <android/hardware/graphics/composer/2.3/IComposerClient.h>
-#include <composer-command-buffer/2.2/ComposerCommandBuffer.h>
+#include <composer-command-buffer/2.3/ComposerCommandBuffer.h>
 #include <gui/HdrMetadata.h>
 #include <math/mat4.h>
 #include <ui/GraphicBuffer.h>
@@ -60,8 +60,8 @@
 using V2_1::IComposerCallback;
 using V2_1::Layer;
 
-using V2_2::CommandReaderBase;
-using V2_2::CommandWriterBase;
+using V2_3::CommandReaderBase;
+using V2_3::CommandWriterBase;
 
 using V2_3::IComposer;
 using V2_3::IComposerClient;
@@ -191,6 +191,8 @@
     // Composer HAL 2.3
     virtual Error getDisplayIdentificationData(Display display, uint8_t* outPort,
                                                std::vector<uint8_t>* outData) = 0;
+    virtual Error setLayerColorTransform(Display display, Layer layer,
+                                         const float* matrix) = 0;
 };
 
 namespace impl {
@@ -389,6 +391,7 @@
     // Composer HAL 2.3
     Error getDisplayIdentificationData(Display display, uint8_t* outPort,
                                        std::vector<uint8_t>* outData) override;
+    Error setLayerColorTransform(Display display, Layer layer, const float* matrix) override;
 
 private:
     class CommandWriter : public CommandWriterBase {
diff --git a/services/surfaceflinger/DisplayHardware/HWC2.cpp b/services/surfaceflinger/DisplayHardware/HWC2.cpp
index a32ff6e..3a40648 100644
--- a/services/surfaceflinger/DisplayHardware/HWC2.cpp
+++ b/services/surfaceflinger/DisplayHardware/HWC2.cpp
@@ -781,7 +781,8 @@
   : mComposer(composer),
     mCapabilities(capabilities),
     mDisplayId(displayId),
-    mId(layerId)
+    mId(layerId),
+    mColorMatrix(android::mat4())
 {
     ALOGV("Created layer %" PRIu64 " on display %" PRIu64, layerId, displayId);
 }
@@ -988,4 +989,14 @@
   return static_cast<Error>(intError);
 }
 
+// Composer HAL 2.3
+Error Layer::setColorTransform(const android::mat4& matrix) {
+    if (matrix == mColorMatrix) {
+        return Error::None;
+    }
+    mColorMatrix = matrix;
+    auto intError = mComposer.setLayerColorTransform(mDisplayId, mId, matrix.asArray());
+    return static_cast<Error>(intError);
+}
+
 } // namespace HWC2
diff --git a/services/surfaceflinger/DisplayHardware/HWC2.h b/services/surfaceflinger/DisplayHardware/HWC2.h
index a8f24d6..363adb5 100644
--- a/services/surfaceflinger/DisplayHardware/HWC2.h
+++ b/services/surfaceflinger/DisplayHardware/HWC2.h
@@ -355,6 +355,9 @@
     [[clang::warn_unused_result]] Error setZOrder(uint32_t z);
     [[clang::warn_unused_result]] Error setInfo(uint32_t type, uint32_t appId);
 
+    // Composer HAL 2.3
+    [[clang::warn_unused_result]] Error setColorTransform(const android::mat4& matrix);
+
 private:
     // These are references to data owned by HWC2::Device, which will outlive
     // this HWC2::Layer, so these references are guaranteed to be valid for
@@ -367,6 +370,7 @@
     android::ui::Dataspace mDataSpace = android::ui::Dataspace::UNKNOWN;
     android::HdrMetadata mHdrMetadata;
     std::function<void(Layer*)> mLayerDestroyedListener;
+    android::mat4 mColorMatrix;
 };
 
 } // namespace HWC2
diff --git a/services/surfaceflinger/LayerBE.cpp b/services/surfaceflinger/LayerBE.cpp
index da98bf5..ef017aa 100644
--- a/services/surfaceflinger/LayerBE.cpp
+++ b/services/surfaceflinger/LayerBE.cpp
@@ -26,6 +26,28 @@
 
 #include <string>
 
+namespace {
+
+const char* getCompositionName(HWC2::Composition compositionType) {
+    switch (compositionType) {
+        case HWC2::Composition::Invalid:
+            return "Invalid";
+        case HWC2::Composition::Client:
+            return "Client";
+        case HWC2::Composition::Device:
+            return "Device";
+        case HWC2::Composition::SolidColor:
+            return "Solid Color";
+        case HWC2::Composition::Cursor:
+            return "Cursor";
+        case HWC2::Composition::Sideband:
+            return "Sideband";
+    }
+    return "Invalid";
+}
+
+}  // namespace anonymous
+
 namespace android {
 
 LayerBE::LayerBE(Layer* layer, std::string layerName)
@@ -74,9 +96,12 @@
     result += base::StringPrintf("\tz=%d\n", hwc.z);
     result += base::StringPrintf("\ttype=%d\n", hwc.type);
     result += base::StringPrintf("\tappId=%d\n", hwc.appId);
-    result += base::StringPrintf("\tdisplayFrame=%4d %4d %4d %4d\n", hwc.displayFrame.left, hwc.displayFrame.top, hwc.displayFrame.right, hwc.displayFrame.bottom);
+    result += base::StringPrintf("\tdisplayFrame=%4d %4d %4d %4d\n", hwc.displayFrame.left,
+                                 hwc.displayFrame.top, hwc.displayFrame.right,
+                                 hwc.displayFrame.bottom);
     result += base::StringPrintf("\talpha=%.3f", hwc.alpha);
-    result += base::StringPrintf("\tsourceCrop=%6.1f %6.1f %6.1f %6.1f\n", hwc.sourceCrop.left, hwc.sourceCrop.top, hwc.sourceCrop.right, hwc.sourceCrop.bottom);
+    result += base::StringPrintf("\tsourceCrop=%6.1f %6.1f %6.1f %6.1f\n", hwc.sourceCrop.left,
+                                 hwc.sourceCrop.top, hwc.sourceCrop.right, hwc.sourceCrop.bottom);
 
     {
         //
@@ -112,12 +137,16 @@
         result += base::StringPrintf("[%s]CompositionInfo\n", tag);
     }
     result += base::StringPrintf("\tLayerName: %s\n", layerName.c_str());
-    result += base::StringPrintf("\tCompositionType: %d\n", compositionType);
+    result += base::StringPrintf("\tCompositionType: %s\n",
+                                 getCompositionName(compositionType));
     result += base::StringPrintf("\tmBuffer = %p\n", mBuffer.get());
     result += base::StringPrintf("\tmBufferSlot=%d\n", mBufferSlot);
-    result += base::StringPrintf("\tdisplayFrame=%4d %4d %4d %4d\n", hwc.displayFrame.left, hwc.displayFrame.top, hwc.displayFrame.right, hwc.displayFrame.bottom);
+    result += base::StringPrintf("\tdisplayFrame=%4d %4d %4d %4d\n", hwc.displayFrame.left,
+                                 hwc.displayFrame.top, hwc.displayFrame.right,
+                                 hwc.displayFrame.bottom);
     result += base::StringPrintf("\talpha=%f\n", hwc.alpha);
-    result += base::StringPrintf("\tsourceCrop=%6.1f %6.1f %6.1f %6.1f\n", hwc.sourceCrop.left, hwc.sourceCrop.top, hwc.sourceCrop.right, hwc.sourceCrop.bottom);
+    result += base::StringPrintf("\tsourceCrop=%6.1f %6.1f %6.1f %6.1f\n", hwc.sourceCrop.left,
+                                 hwc.sourceCrop.top, hwc.sourceCrop.right, hwc.sourceCrop.bottom);
 
     switch (compositionType) {
         case HWC2::Composition::Device:
diff --git a/services/surfaceflinger/RenderEngine/Android.bp b/services/surfaceflinger/RenderEngine/Android.bp
index e1ab066..79145c2 100644
--- a/services/surfaceflinger/RenderEngine/Android.bp
+++ b/services/surfaceflinger/RenderEngine/Android.bp
@@ -26,6 +26,7 @@
         "libGLESv2",
         "libgui",
         "liblog",
+    	"libnativewindow",
         "libui",
         "libutils",
     ],
diff --git a/services/surfaceflinger/RenderEngine/Description.cpp b/services/surfaceflinger/RenderEngine/Description.cpp
index b7522da..9696d28 100644
--- a/services/surfaceflinger/RenderEngine/Description.cpp
+++ b/services/surfaceflinger/RenderEngine/Description.cpp
@@ -23,76 +23,33 @@
 namespace android {
 namespace renderengine {
 
-void Description::setPremultipliedAlpha(bool premultipliedAlpha) {
-    mPremultipliedAlpha = premultipliedAlpha;
-}
-
-void Description::setOpaque(bool opaque) {
-    mOpaque = opaque;
-}
-
-void Description::setTexture(const Texture& texture) {
-    mTexture = texture;
-    mTextureEnabled = true;
-}
-
-void Description::disableTexture() {
-    mTextureEnabled = false;
-}
-
-void Description::setColor(const half4& color) {
-    mColor = color;
-}
-
-void Description::setProjectionMatrix(const mat4& mtx) {
-    mProjectionMatrix = mtx;
-}
-
-void Description::setColorMatrix(const mat4& mtx) {
-    mColorMatrix = mtx;
-}
-
-void Description::setInputTransformMatrix(const mat3& matrix) {
-    mInputTransformMatrix = matrix;
-}
-
-void Description::setOutputTransformMatrix(const mat4& matrix) {
-    mOutputTransformMatrix = matrix;
+Description::TransferFunction Description::dataSpaceToTransferFunction(ui::Dataspace dataSpace) {
+    ui::Dataspace transfer = static_cast<ui::Dataspace>(dataSpace & ui::Dataspace::TRANSFER_MASK);
+    switch (transfer) {
+        case ui::Dataspace::TRANSFER_ST2084:
+            return Description::TransferFunction::ST2084;
+        case ui::Dataspace::TRANSFER_HLG:
+            return Description::TransferFunction::HLG;
+        case ui::Dataspace::TRANSFER_LINEAR:
+            return Description::TransferFunction::LINEAR;
+        default:
+            return Description::TransferFunction::SRGB;
+    }
 }
 
 bool Description::hasInputTransformMatrix() const {
-    const mat3 identity;
-    return mInputTransformMatrix != identity;
+    const mat4 identity;
+    return inputTransformMatrix != identity;
 }
 
 bool Description::hasOutputTransformMatrix() const {
     const mat4 identity;
-    return mOutputTransformMatrix != identity;
+    return outputTransformMatrix != identity;
 }
 
 bool Description::hasColorMatrix() const {
     const mat4 identity;
-    return mColorMatrix != identity;
-}
-
-const mat4& Description::getColorMatrix() const {
-    return mColorMatrix;
-}
-
-void Description::setY410BT2020(bool enable) {
-    mY410BT2020 = enable;
-}
-
-void Description::setInputTransferFunction(TransferFunction transferFunction) {
-    mInputTransferFunction = transferFunction;
-}
-
-void Description::setOutputTransferFunction(TransferFunction transferFunction) {
-    mOutputTransferFunction = transferFunction;
-}
-
-void Description::setDisplayMaxLuminance(const float maxLuminance) {
-    mDisplayMaxLuminance = maxLuminance;
+    return colorMatrix != identity;
 }
 
 }  // namespace renderengine
diff --git a/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.cpp b/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.cpp
index 0f0ff62..813c9e6 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.cpp
+++ b/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.cpp
@@ -398,9 +398,9 @@
         mDisplayP3ToSrgb = mat4(ColorSpaceConnector(displayP3, srgb).getTransform());
 
         // no chromatic adaptation needed since all color spaces use D65 for their white points.
-        mSrgbToXyz = srgb.getRGBtoXYZ();
-        mDisplayP3ToXyz = displayP3.getRGBtoXYZ();
-        mBt2020ToXyz = bt2020.getRGBtoXYZ();
+        mSrgbToXyz = mat4(srgb.getRGBtoXYZ());
+        mDisplayP3ToXyz = mat4(displayP3.getRGBtoXYZ());
+        mBt2020ToXyz = mat4(bt2020.getRGBtoXYZ());
         mXyzToSrgb = mat4(srgb.getXYZtoRGB());
         mXyzToDisplayP3 = mat4(displayP3.getXYZtoRGB());
         mXyzToBt2020 = mat4(bt2020.getXYZtoRGB());
@@ -444,12 +444,17 @@
         if (success && glSurface.getAsync()) {
             eglSwapInterval(mEGLDisplay, 0);
         }
+        if (success) {
+            mSurfaceHeight = glSurface.getHeight();
+        }
     }
+
     return success;
 }
 
 void GLES20RenderEngine::resetCurrentSurface() {
     eglMakeCurrent(mEGLDisplay, EGL_NO_SURFACE, EGL_NO_SURFACE, EGL_NO_CONTEXT);
+    mSurfaceHeight = 0;
 }
 
 base::unique_fd GLES20RenderEngine::flush() {
@@ -563,8 +568,12 @@
     drawMesh(mesh);
 }
 
-void GLES20RenderEngine::setScissor(uint32_t left, uint32_t bottom, uint32_t right, uint32_t top) {
-    glScissor(left, bottom, right, top);
+void GLES20RenderEngine::setScissor(const Rect& region) {
+    // Invert y-coordinate to map to GL-space.
+    int32_t canvasHeight = mRenderToFbo ? mFboHeight : mSurfaceHeight;
+    int32_t glBottom = canvasHeight - region.bottom;
+
+    glScissor(region.left, glBottom, region.getWidth(), region.getHeight());
     glEnable(GL_SCISSOR_TEST);
 }
 
@@ -592,10 +601,6 @@
     }
 }
 
-void GLES20RenderEngine::readPixels(size_t l, size_t b, size_t w, size_t h, uint32_t* pixels) {
-    glReadPixels(l, b, w, h, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
-}
-
 status_t GLES20RenderEngine::bindFrameBuffer(Framebuffer* framebuffer) {
     GLFramebuffer* glFramebuffer = static_cast<GLFramebuffer*>(framebuffer);
     EGLImageKHR eglImage = glFramebuffer->getEGLImage();
@@ -612,6 +617,7 @@
                            GL_TEXTURE_2D, textureName, 0);
 
     mRenderToFbo = true;
+    mFboHeight = glFramebuffer->getBufferHeight();
 
     uint32_t glStatus = glCheckFramebufferStatus(GL_FRAMEBUFFER);
 
@@ -623,13 +629,14 @@
 
 void GLES20RenderEngine::unbindFrameBuffer(Framebuffer* /* framebuffer */) {
     mRenderToFbo = false;
+    mFboHeight = 0;
 
     // back to main framebuffer
     glBindFramebuffer(GL_FRAMEBUFFER, 0);
 
     // Workaround for b/77935566 to force the EGL driver to release the
     // screenshot buffer
-    setScissor(0, 0, 0, 0);
+    setScissor(Rect::EMPTY_RECT);
     clearWithColor(0.0, 0.0, 0.0, 0.0);
     disableScissor();
 }
@@ -673,19 +680,19 @@
     }
 
     glViewport(0, 0, vpw, vph);
-    mState.setProjectionMatrix(m);
+    mState.projectionMatrix = m;
     mVpWidth = vpw;
     mVpHeight = vph;
 }
 
 void GLES20RenderEngine::setupLayerBlending(bool premultipliedAlpha, bool opaque,
                                             bool disableTexture, const half4& color) {
-    mState.setPremultipliedAlpha(premultipliedAlpha);
-    mState.setOpaque(opaque);
-    mState.setColor(color);
+    mState.isPremultipliedAlpha = premultipliedAlpha;
+    mState.isOpaque = opaque;
+    mState.color = color;
 
     if (disableTexture) {
-        mState.disableTexture();
+        mState.textureEnabled = false;
     }
 
     if (color.a < 1.0f || !opaque) {
@@ -697,7 +704,7 @@
 }
 
 void GLES20RenderEngine::setSourceY410BT2020(bool enable) {
-    mState.setY410BT2020(enable);
+    mState.isY410BT2020 = enable;
 }
 
 void GLES20RenderEngine::setSourceDataSpace(Dataspace source) {
@@ -709,7 +716,7 @@
 }
 
 void GLES20RenderEngine::setDisplayMaxLuminance(const float maxLuminance) {
-    mState.setDisplayMaxLuminance(maxLuminance);
+    mState.displayMaxLuminance = maxLuminance;
 }
 
 void GLES20RenderEngine::setupLayerTexturing(const Texture& texture) {
@@ -724,22 +731,24 @@
     glTexParameteri(target, GL_TEXTURE_MAG_FILTER, filter);
     glTexParameteri(target, GL_TEXTURE_MIN_FILTER, filter);
 
-    mState.setTexture(texture);
+    mState.texture = texture;
+    mState.textureEnabled = true;
 }
 
 void GLES20RenderEngine::setupLayerBlackedOut() {
     glBindTexture(GL_TEXTURE_2D, mProtectedTexName);
     Texture texture(Texture::TEXTURE_2D, mProtectedTexName);
     texture.setDimensions(1, 1); // FIXME: we should get that from somewhere
-    mState.setTexture(texture);
+    mState.texture = texture;
+    mState.textureEnabled = true;
 }
 
 void GLES20RenderEngine::setupColorTransform(const mat4& colorTransform) {
-    mState.setColorMatrix(colorTransform);
+    mState.colorMatrix = colorTransform;
 }
 
 void GLES20RenderEngine::disableTexturing() {
-    mState.disableTexture();
+    mState.textureEnabled = false;
 }
 
 void GLES20RenderEngine::disableBlending() {
@@ -747,10 +756,10 @@
 }
 
 void GLES20RenderEngine::setupFillWithColor(float r, float g, float b, float a) {
-    mState.setPremultipliedAlpha(true);
-    mState.setOpaque(false);
-    mState.setColor(half4(r, g, b, a));
-    mState.disableTexture();
+    mState.isPremultipliedAlpha = true;
+    mState.isOpaque = false;
+    mState.color = half4(r, g, b, a);
+    mState.textureEnabled = false;
     glDisable(GL_BLEND);
 }
 
@@ -784,26 +793,26 @@
             // The supported input color spaces are standard RGB, Display P3 and BT2020.
             switch (inputStandard) {
                 case Dataspace::STANDARD_DCI_P3:
-                    managedState.setInputTransformMatrix(mDisplayP3ToXyz);
+                    managedState.inputTransformMatrix = mDisplayP3ToXyz;
                     break;
                 case Dataspace::STANDARD_BT2020:
-                    managedState.setInputTransformMatrix(mBt2020ToXyz);
+                    managedState.inputTransformMatrix = mBt2020ToXyz;
                     break;
                 default:
-                    managedState.setInputTransformMatrix(mSrgbToXyz);
+                    managedState.inputTransformMatrix = mSrgbToXyz;
                     break;
             }
 
             // The supported output color spaces are BT2020, Display P3 and standard RGB.
             switch (outputStandard) {
                 case Dataspace::STANDARD_BT2020:
-                    managedState.setOutputTransformMatrix(mXyzToBt2020);
+                    managedState.outputTransformMatrix = mXyzToBt2020;
                     break;
                 case Dataspace::STANDARD_DCI_P3:
-                    managedState.setOutputTransformMatrix(mXyzToDisplayP3);
+                    managedState.outputTransformMatrix = mXyzToDisplayP3;
                     break;
                 default:
-                    managedState.setOutputTransformMatrix(mXyzToSrgb);
+                    managedState.outputTransformMatrix = mXyzToSrgb;
                     break;
             }
         } else if (inputStandard != outputStandard) {
@@ -818,9 +827,9 @@
             // - sRGB
             // - Display P3
             if (outputStandard == Dataspace::STANDARD_BT709) {
-                managedState.setOutputTransformMatrix(mDisplayP3ToSrgb);
+                managedState.outputTransformMatrix = mDisplayP3ToSrgb;
             } else if (outputStandard == Dataspace::STANDARD_DCI_P3) {
-                managedState.setOutputTransformMatrix(mSrgbToDisplayP3);
+                managedState.outputTransformMatrix = mSrgbToDisplayP3;
             }
         }
 
@@ -830,32 +839,10 @@
         // - the input transfer function doesn't match the output transfer function.
         if (managedState.hasColorMatrix() || managedState.hasOutputTransformMatrix() ||
             inputTransfer != outputTransfer) {
-            switch (inputTransfer) {
-                case Dataspace::TRANSFER_ST2084:
-                    managedState.setInputTransferFunction(Description::TransferFunction::ST2084);
-                    break;
-                case Dataspace::TRANSFER_HLG:
-                    managedState.setInputTransferFunction(Description::TransferFunction::HLG);
-                    break;
-                case Dataspace::TRANSFER_LINEAR:
-                    managedState.setInputTransferFunction(Description::TransferFunction::LINEAR);
-                    break;
-                default:
-                    managedState.setInputTransferFunction(Description::TransferFunction::SRGB);
-                    break;
-            }
-
-            switch (outputTransfer) {
-                case Dataspace::TRANSFER_ST2084:
-                    managedState.setOutputTransferFunction(Description::TransferFunction::ST2084);
-                    break;
-                case Dataspace::TRANSFER_HLG:
-                    managedState.setOutputTransferFunction(Description::TransferFunction::HLG);
-                    break;
-                default:
-                    managedState.setOutputTransferFunction(Description::TransferFunction::SRGB);
-                    break;
-            }
+            managedState.inputTransferFunction =
+                Description::dataSpaceToTransferFunction(inputTransfer);
+            managedState.outputTransferFunction =
+                Description::dataSpaceToTransferFunction(outputTransfer);
         }
 
         ProgramCache::getInstance().useProgram(managedState);
diff --git a/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.h b/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.h
index 1abc5ba..fa01410 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.h
+++ b/services/surfaceflinger/RenderEngine/gl/GLES20RenderEngine.h
@@ -64,12 +64,11 @@
     void clearWithColor(float red, float green, float blue, float alpha) override;
     void fillRegionWithColor(const Region& region, float red, float green, float blue,
                              float alpha) override;
-    void setScissor(uint32_t left, uint32_t bottom, uint32_t right, uint32_t top) override;
+    void setScissor(const Rect& region) override;
     void disableScissor() override;
     void genTextures(size_t count, uint32_t* names) override;
     void deleteTextures(size_t count, uint32_t const* names) override;
     void bindExternalTextureImage(uint32_t texName, const Image& image) override;
-    void readPixels(size_t l, size_t b, size_t w, size_t h, uint32_t* pixels) override;
     status_t bindFrameBuffer(Framebuffer* framebuffer) override;
     void unbindFrameBuffer(Framebuffer* framebuffer) override;
     void checkErrors() const override;
@@ -131,14 +130,16 @@
 
     mat4 mSrgbToDisplayP3;
     mat4 mDisplayP3ToSrgb;
-    mat3 mSrgbToXyz;
-    mat3 mBt2020ToXyz;
-    mat3 mDisplayP3ToXyz;
+    mat4 mSrgbToXyz;
+    mat4 mBt2020ToXyz;
+    mat4 mDisplayP3ToXyz;
     mat4 mXyzToSrgb;
     mat4 mXyzToDisplayP3;
     mat4 mXyzToBt2020;
 
     bool mRenderToFbo = false;
+    int32_t mSurfaceHeight = 0;
+    int32_t mFboHeight = 0;
 
     // Current dataspace of layer being rendered
     ui::Dataspace mDataSpace = ui::Dataspace::UNKNOWN;
diff --git a/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.cpp b/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.cpp
index 6aca1c8..83d2bde 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.cpp
+++ b/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.cpp
@@ -20,6 +20,7 @@
 #include <GLES/glext.h>
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
+#include <nativebase/nativebase.h>
 #include "GLES20RenderEngine.h"
 
 namespace android {
@@ -43,6 +44,8 @@
     if (mEGLImage != EGL_NO_IMAGE_KHR) {
         eglDestroyImageKHR(mEGLDisplay, mEGLImage);
         mEGLImage = EGL_NO_IMAGE_KHR;
+        mBufferWidth = 0;
+        mBufferHeight = 0;
     }
 
     if (nativeBuffer) {
@@ -52,6 +55,8 @@
         if (mEGLImage == EGL_NO_IMAGE_KHR) {
             return false;
         }
+        mBufferWidth = nativeBuffer->width;
+        mBufferHeight = nativeBuffer->height;
     }
     return true;
 }
diff --git a/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.h b/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.h
index 90b2248..193cbdc 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.h
+++ b/services/surfaceflinger/RenderEngine/gl/GLFramebuffer.h
@@ -39,11 +39,16 @@
     EGLImageKHR getEGLImage() const { return mEGLImage; }
     uint32_t getTextureName() const { return mTextureName; }
     uint32_t getFramebufferName() const { return mFramebufferName; }
+    int32_t getBufferHeight() const { return mBufferHeight; }
+    int32_t getBufferWidth() const { return mBufferWidth; }
 
 private:
     EGLDisplay mEGLDisplay;
     EGLImageKHR mEGLImage;
     uint32_t mTextureName, mFramebufferName;
+
+    int32_t mBufferHeight = 0;
+    int32_t mBufferWidth = 0;
 };
 
 }  // namespace gl
diff --git a/services/surfaceflinger/RenderEngine/gl/GLSurface.cpp b/services/surfaceflinger/RenderEngine/gl/GLSurface.cpp
index ff9a252..104af56 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLSurface.cpp
+++ b/services/surfaceflinger/RenderEngine/gl/GLSurface.cpp
@@ -16,6 +16,7 @@
 
 #include "GLSurface.h"
 
+#include <android/native_window.h>
 #include <log/log.h>
 #include <ui/PixelFormat.h>
 #include "GLES20RenderEngine.h"
@@ -41,11 +42,15 @@
     if (mEGLSurface != EGL_NO_SURFACE) {
         eglDestroySurface(mEGLDisplay, mEGLSurface);
         mEGLSurface = EGL_NO_SURFACE;
+        mSurfaceWidth = 0;
+        mSurfaceHeight = 0;
     }
 
     mWindow = window;
     if (mWindow) {
         mEGLSurface = eglCreateWindowSurface(mEGLDisplay, mEGLConfig, mWindow, nullptr);
+        mSurfaceWidth = ANativeWindow_getWidth(window);
+        mSurfaceHeight = ANativeWindow_getHeight(window);
     }
 }
 
@@ -71,15 +76,6 @@
     return value;
 }
 
-EGLint GLSurface::querySurface(EGLint attrib) const {
-    EGLint value;
-    if (!eglQuerySurface(mEGLDisplay, mEGLSurface, attrib, &value)) {
-        value = 0;
-    }
-
-    return value;
-}
-
 int32_t GLSurface::queryRedSize() const {
     return queryConfig(EGL_RED_SIZE);
 }
@@ -96,12 +92,12 @@
     return queryConfig(EGL_ALPHA_SIZE);
 }
 
-int32_t GLSurface::queryWidth() const {
-    return querySurface(EGL_WIDTH);
+int32_t GLSurface::getWidth() const {
+    return mSurfaceWidth;
 }
 
-int32_t GLSurface::queryHeight() const {
-    return querySurface(EGL_HEIGHT);
+int32_t GLSurface::getHeight() const {
+    return mSurfaceHeight;
 }
 
 }  // namespace gl
diff --git a/services/surfaceflinger/RenderEngine/gl/GLSurface.h b/services/surfaceflinger/RenderEngine/gl/GLSurface.h
index 0b89c70..8aa223a 100644
--- a/services/surfaceflinger/RenderEngine/gl/GLSurface.h
+++ b/services/surfaceflinger/RenderEngine/gl/GLSurface.h
@@ -47,15 +47,14 @@
     int32_t queryBlueSize() const override;
     int32_t queryAlphaSize() const override;
 
-    int32_t queryWidth() const override;
-    int32_t queryHeight() const override;
-
     bool getAsync() const { return mAsync; }
     EGLSurface getEGLSurface() const { return mEGLSurface; }
 
+    int32_t getWidth() const override;
+    int32_t getHeight() const override;
+
 private:
     EGLint queryConfig(EGLint attrib) const;
-    EGLint querySurface(EGLint attrib) const;
 
     EGLDisplay mEGLDisplay;
     EGLConfig mEGLConfig;
@@ -63,6 +62,9 @@
     bool mCritical = false;
     bool mAsync = false;
 
+    int32_t mSurfaceWidth = 0;
+    int32_t mSurfaceHeight = 0;
+
     ANativeWindow* mWindow = nullptr;
     EGLSurface mEGLSurface = EGL_NO_SURFACE;
 
diff --git a/services/surfaceflinger/RenderEngine/gl/Program.cpp b/services/surfaceflinger/RenderEngine/gl/Program.cpp
index c8d6cf9..da67f92 100644
--- a/services/surfaceflinger/RenderEngine/gl/Program.cpp
+++ b/services/surfaceflinger/RenderEngine/gl/Program.cpp
@@ -129,28 +129,28 @@
 
     if (mSamplerLoc >= 0) {
         glUniform1i(mSamplerLoc, 0);
-        glUniformMatrix4fv(mTextureMatrixLoc, 1, GL_FALSE, desc.mTexture.getMatrix().asArray());
+        glUniformMatrix4fv(mTextureMatrixLoc, 1, GL_FALSE, desc.texture.getMatrix().asArray());
     }
     if (mColorLoc >= 0) {
-        const float color[4] = {desc.mColor.r, desc.mColor.g, desc.mColor.b, desc.mColor.a};
+        const float color[4] = {desc.color.r, desc.color.g, desc.color.b, desc.color.a};
         glUniform4fv(mColorLoc, 1, color);
     }
     if (mInputTransformMatrixLoc >= 0) {
-        mat4 inputTransformMatrix = mat4(desc.mInputTransformMatrix);
+        mat4 inputTransformMatrix = desc.inputTransformMatrix;
         glUniformMatrix4fv(mInputTransformMatrixLoc, 1, GL_FALSE, inputTransformMatrix.asArray());
     }
     if (mOutputTransformMatrixLoc >= 0) {
         // The output transform matrix and color matrix can be combined as one matrix
         // that is applied right before applying OETF.
-        mat4 outputTransformMatrix = desc.mColorMatrix * desc.mOutputTransformMatrix;
+        mat4 outputTransformMatrix = desc.colorMatrix * desc.outputTransformMatrix;
         glUniformMatrix4fv(mOutputTransformMatrixLoc, 1, GL_FALSE,
                            outputTransformMatrix.asArray());
     }
     if (mDisplayMaxLuminanceLoc >= 0) {
-        glUniform1f(mDisplayMaxLuminanceLoc, desc.mDisplayMaxLuminance);
+        glUniform1f(mDisplayMaxLuminanceLoc, desc.displayMaxLuminance) ;
     }
     // these uniforms are always present
-    glUniformMatrix4fv(mProjectionMatrixLoc, 1, GL_FALSE, desc.mProjectionMatrix.asArray());
+    glUniformMatrix4fv(mProjectionMatrixLoc, 1, GL_FALSE, desc.projectionMatrix.asArray());
 }
 
 }  // namespace gl
diff --git a/services/surfaceflinger/RenderEngine/gl/ProgramCache.cpp b/services/surfaceflinger/RenderEngine/gl/ProgramCache.cpp
index a19c1f1..9254aa0 100644
--- a/services/surfaceflinger/RenderEngine/gl/ProgramCache.cpp
+++ b/services/surfaceflinger/RenderEngine/gl/ProgramCache.cpp
@@ -130,19 +130,19 @@
 ProgramCache::Key ProgramCache::computeKey(const Description& description) {
     Key needs;
     needs.set(Key::TEXTURE_MASK,
-              !description.mTextureEnabled
+              !description.textureEnabled
                       ? Key::TEXTURE_OFF
-                      : description.mTexture.getTextureTarget() == GL_TEXTURE_EXTERNAL_OES
+                      : description.texture.getTextureTarget() == GL_TEXTURE_EXTERNAL_OES
                               ? Key::TEXTURE_EXT
-                              : description.mTexture.getTextureTarget() == GL_TEXTURE_2D
+                              : description.texture.getTextureTarget() == GL_TEXTURE_2D
                                       ? Key::TEXTURE_2D
                                       : Key::TEXTURE_OFF)
             .set(Key::ALPHA_MASK,
-                 (description.mColor.a < 1) ? Key::ALPHA_LT_ONE : Key::ALPHA_EQ_ONE)
+                 (description.color.a < 1) ? Key::ALPHA_LT_ONE : Key::ALPHA_EQ_ONE)
             .set(Key::BLEND_MASK,
-                 description.mPremultipliedAlpha ? Key::BLEND_PREMULT : Key::BLEND_NORMAL)
+                 description.isPremultipliedAlpha ? Key::BLEND_PREMULT : Key::BLEND_NORMAL)
             .set(Key::OPACITY_MASK,
-                 description.mOpaque ? Key::OPACITY_OPAQUE : Key::OPACITY_TRANSLUCENT)
+                 description.isOpaque ? Key::OPACITY_OPAQUE : Key::OPACITY_TRANSLUCENT)
             .set(Key::Key::INPUT_TRANSFORM_MATRIX_MASK,
                  description.hasInputTransformMatrix() ?
                      Key::INPUT_TRANSFORM_MATRIX_ON : Key::INPUT_TRANSFORM_MATRIX_OFF)
@@ -151,10 +151,10 @@
                      Key::OUTPUT_TRANSFORM_MATRIX_ON : Key::OUTPUT_TRANSFORM_MATRIX_OFF);
 
     needs.set(Key::Y410_BT2020_MASK,
-              description.mY410BT2020 ? Key::Y410_BT2020_ON : Key::Y410_BT2020_OFF);
+              description.isY410BT2020 ? Key::Y410_BT2020_ON : Key::Y410_BT2020_OFF);
 
     if (needs.hasTransformMatrix() || (needs.getInputTF() != needs.getOutputTF())) {
-        switch (description.mInputTransferFunction) {
+        switch (description.inputTransferFunction) {
             case Description::TransferFunction::LINEAR:
             default:
                 needs.set(Key::INPUT_TF_MASK, Key::INPUT_TF_LINEAR);
@@ -170,7 +170,7 @@
                 break;
         }
 
-        switch (description.mOutputTransferFunction) {
+        switch (description.outputTransferFunction) {
             case Description::TransferFunction::LINEAR:
             default:
                 needs.set(Key::OUTPUT_TF_MASK, Key::OUTPUT_TF_LINEAR);
diff --git a/services/surfaceflinger/RenderEngine/gl/ProgramCache.h b/services/surfaceflinger/RenderEngine/gl/ProgramCache.h
index ea77a2d..47963eb 100644
--- a/services/surfaceflinger/RenderEngine/gl/ProgramCache.h
+++ b/services/surfaceflinger/RenderEngine/gl/ProgramCache.h
@@ -29,7 +29,7 @@
 
 namespace renderengine {
 
-class Description;
+struct Description;
 
 namespace gl {
 
diff --git a/services/surfaceflinger/RenderEngine/include/renderengine/RenderEngine.h b/services/surfaceflinger/RenderEngine/include/renderengine/RenderEngine.h
index 17d8782..05668f8 100644
--- a/services/surfaceflinger/RenderEngine/include/renderengine/RenderEngine.h
+++ b/services/surfaceflinger/RenderEngine/include/renderengine/RenderEngine.h
@@ -96,12 +96,11 @@
     virtual void fillRegionWithColor(const Region& region, float red, float green,
                                      float blue, float alpha) = 0;
 
-    virtual void setScissor(uint32_t left, uint32_t bottom, uint32_t right, uint32_t top) = 0;
+    virtual void setScissor(const Rect& region) = 0;
     virtual void disableScissor() = 0;
     virtual void genTextures(size_t count, uint32_t* names) = 0;
     virtual void deleteTextures(size_t count, uint32_t const* names) = 0;
     virtual void bindExternalTextureImage(uint32_t texName, const Image& image) = 0;
-    virtual void readPixels(size_t l, size_t b, size_t w, size_t h, uint32_t* pixels) = 0;
     // When binding a native buffer, it must be done before setViewportAndProjection
     // Returns NO_ERROR when binds successfully, NO_MEMORY when there's no memory for allocation.
     virtual status_t bindFrameBuffer(Framebuffer* framebuffer) = 0;
diff --git a/services/surfaceflinger/RenderEngine/include/renderengine/Surface.h b/services/surfaceflinger/RenderEngine/include/renderengine/Surface.h
index 3343e1f..3999ddc 100644
--- a/services/surfaceflinger/RenderEngine/include/renderengine/Surface.h
+++ b/services/surfaceflinger/RenderEngine/include/renderengine/Surface.h
@@ -38,8 +38,8 @@
     virtual int32_t queryBlueSize() const = 0;
     virtual int32_t queryAlphaSize() const = 0;
 
-    virtual int32_t queryWidth() const = 0;
-    virtual int32_t queryHeight() const = 0;
+    virtual int32_t getWidth() const = 0;
+    virtual int32_t getHeight() const = 0;
 };
 
 }  // namespace renderengine
diff --git a/services/surfaceflinger/RenderEngine/include/renderengine/private/Description.h b/services/surfaceflinger/RenderEngine/include/renderengine/private/Description.h
index a6301ae..efab8ff 100644
--- a/services/surfaceflinger/RenderEngine/include/renderengine/private/Description.h
+++ b/services/surfaceflinger/RenderEngine/include/renderengine/private/Description.h
@@ -17,84 +17,60 @@
 #ifndef SF_RENDER_ENGINE_DESCRIPTION_H_
 #define SF_RENDER_ENGINE_DESCRIPTION_H_
 
+#include <ui/GraphicTypes.h>
 #include <renderengine/Texture.h>
 
 namespace android {
 namespace renderengine {
 
-namespace gl {
-class Program;
-class ProgramCache;
-}
-
 /*
- * This holds the state of the rendering engine. This class is used
- * to generate a corresponding GLSL program and set the appropriate
- * uniform.
- *
- * Program and ProgramCache are friends and access the state directly
+ * This is the structure that holds the state of the rendering engine.
+ * This class is used to generate a corresponding GLSL program and set the
+ * appropriate uniform.
  */
-class Description {
-public:
-    Description() = default;
-    ~Description() = default;
-
-    void setPremultipliedAlpha(bool premultipliedAlpha);
-    void setOpaque(bool opaque);
-    void setTexture(const Texture& texture);
-    void disableTexture();
-    void setColor(const half4& color);
-    void setProjectionMatrix(const mat4& mtx);
-    void setColorMatrix(const mat4& mtx);
-    void setInputTransformMatrix(const mat3& matrix);
-    void setOutputTransformMatrix(const mat4& matrix);
-    bool hasInputTransformMatrix() const;
-    bool hasOutputTransformMatrix() const;
-    bool hasColorMatrix() const;
-    const mat4& getColorMatrix() const;
-
-    void setY410BT2020(bool enable);
-
+struct Description {
     enum class TransferFunction : int {
         LINEAR,
         SRGB,
         ST2084,
         HLG,  // Hybrid Log-Gamma for HDR.
     };
-    void setInputTransferFunction(TransferFunction transferFunction);
-    void setOutputTransferFunction(TransferFunction transferFunction);
-    void setDisplayMaxLuminance(const float maxLuminance);
 
-private:
-    friend class gl::Program;
-    friend class gl::ProgramCache;
+    static TransferFunction dataSpaceToTransferFunction(ui::Dataspace dataSpace);
+
+    Description() = default;
+    ~Description() = default;
+
+    bool hasInputTransformMatrix() const;
+    bool hasOutputTransformMatrix() const;
+    bool hasColorMatrix() const;
 
     // whether textures are premultiplied
-    bool mPremultipliedAlpha = false;
+    bool isPremultipliedAlpha = false;
     // whether this layer is marked as opaque
-    bool mOpaque = true;
+    bool isOpaque = true;
 
     // Texture this layer uses
-    Texture mTexture;
-    bool mTextureEnabled = false;
+    Texture texture;
+    bool textureEnabled = false;
 
     // color used when texturing is disabled or when setting alpha.
-    half4 mColor;
+    half4 color;
 
     // true if the sampled pixel values are in Y410/BT2020 rather than RGBA
-    bool mY410BT2020 = false;
+    bool isY410BT2020 = false;
 
     // transfer functions for the input/output
-    TransferFunction mInputTransferFunction = TransferFunction::LINEAR;
-    TransferFunction mOutputTransferFunction = TransferFunction::LINEAR;
+    TransferFunction inputTransferFunction = TransferFunction::LINEAR;
+    TransferFunction outputTransferFunction = TransferFunction::LINEAR;
 
-    float mDisplayMaxLuminance;
+    float displayMaxLuminance;
 
     // projection matrix
-    mat4 mProjectionMatrix;
-    mat4 mColorMatrix;
-    mat3 mInputTransformMatrix;
-    mat4 mOutputTransformMatrix;
+    mat4 projectionMatrix;
+    mat4 colorMatrix;
+    mat4 inputTransformMatrix;
+    mat4 outputTransformMatrix;
 };
 
 }  // namespace renderengine
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index f218664..fa9cc79 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -103,12 +103,6 @@
 
 #define DISPLAY_COUNT       1
 
-/*
- * DEBUG_SCREENSHOTS: set to true to check that screenshots are not all
- * black pixels.
- */
-#define DEBUG_SCREENSHOTS   false
-
 namespace android {
 
 using namespace android::hardware::configstore;
@@ -2493,8 +2487,8 @@
     renderSurface->setCritical(state.type == DisplayDevice::DISPLAY_PRIMARY);
     renderSurface->setAsync(state.isVirtual());
     renderSurface->setNativeWindow(nativeWindow.get());
-    const int displayWidth = renderSurface->queryWidth();
-    const int displayHeight = renderSurface->queryHeight();
+    const int displayWidth = renderSurface->getWidth();
+    const int displayHeight = renderSurface->getHeight();
 
     // Make sure that composition can never be stalled by a virtual display
     // consumer that isn't processing buffers fast enough. We have to do this
@@ -3205,9 +3199,7 @@
             // the GL scissor so we don't draw anything where we shouldn't
 
             // enable scissor for this frame
-            const uint32_t height = display->getHeight();
-            getBE().mRenderEngine->setScissor(scissor.left, height - scissor.bottom,
-                                              scissor.getWidth(), scissor.getHeight());
+            getBE().mRenderEngine->setScissor(scissor);
         }
     }
 
@@ -4695,6 +4687,12 @@
     result.append("\n");
 
     /*
+     * Tracing state
+     */
+    mTracing.dump(result);
+    result.append("\n");
+
+    /*
      * HWC layer minidump
      */
     for (const auto& [token, display] : mDisplays) {
@@ -5083,12 +5081,12 @@
             case 1025: { // Set layer tracing
                 n = data.readInt32();
                 if (n) {
-                    ALOGV("LayerTracing enabled");
+                    ALOGD("LayerTracing enabled");
                     mTracing.enable();
                     doTracing("tracing.enable");
                     reply->writeInt32(NO_ERROR);
                 } else {
-                    ALOGV("LayerTracing disabled");
+                    ALOGD("LayerTracing disabled");
                     status_t err = mTracing.disable();
                     reply->writeInt32(err);
                 }
@@ -5506,51 +5504,15 @@
     // dependent on the context's EGLConfig.
     renderScreenImplLocked(renderArea, traverseLayers, useIdentityTransform);
 
-    if (DEBUG_SCREENSHOTS) {
+    base::unique_fd syncFd = getRenderEngine().flush();
+    if (syncFd < 0) {
         getRenderEngine().finish();
-        *outSyncFd = -1;
-
-        const auto reqWidth = renderArea.getReqWidth();
-        const auto reqHeight = renderArea.getReqHeight();
-
-        uint32_t* pixels = new uint32_t[reqWidth*reqHeight];
-        getRenderEngine().readPixels(0, 0, reqWidth, reqHeight, pixels);
-        checkScreenshot(reqWidth, reqHeight, reqWidth, pixels, traverseLayers);
-        delete [] pixels;
-    } else {
-        base::unique_fd syncFd = getRenderEngine().flush();
-        if (syncFd < 0) {
-            getRenderEngine().finish();
-        }
-        *outSyncFd = syncFd.release();
     }
+    *outSyncFd = syncFd.release();
 
     return NO_ERROR;
 }
 
-void SurfaceFlinger::checkScreenshot(size_t w, size_t s, size_t h, void const* vaddr,
-                                     TraverseLayersFunction traverseLayers) {
-    if (DEBUG_SCREENSHOTS) {
-        for (size_t y = 0; y < h; y++) {
-            uint32_t const* p = (uint32_t const*)vaddr + y * s;
-            for (size_t x = 0; x < w; x++) {
-                if (p[x] != 0xFF000000) return;
-            }
-        }
-        ALOGE("*** we just took a black screenshot ***");
-
-        size_t i = 0;
-        traverseLayers([&](Layer* layer) {
-            const Layer::State& state(layer->getDrawingState());
-            ALOGE("%c index=%zu, name=%s, layerStack=%d, z=%d, visible=%d, flags=%x, alpha=%.3f",
-                  layer->isVisible() ? '+' : '-', i, layer->getName().string(),
-                  layer->getLayerStack(), state.z, layer->isVisible(), state.flags,
-                  static_cast<float>(state.color.a));
-            i++;
-        });
-    }
-}
-
 // ---------------------------------------------------------------------------
 
 void SurfaceFlinger::State::traverseInZOrder(const LayerVector::Visitor& visitor) const {
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index 9eb572c..01d18d9 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -755,8 +755,6 @@
     void dumpAllLocked(const Vector<String16>& args, size_t& index, String8& result) const;
     bool startDdmConnection();
     void appendSfConfigString(String8& result) const;
-    void checkScreenshot(size_t w, size_t s, size_t h, void const* vaddr,
-                         TraverseLayersFunction traverseLayers);
 
     void logFrameStats();
 
diff --git a/services/surfaceflinger/SurfaceTracing.cpp b/services/surfaceflinger/SurfaceTracing.cpp
index 0e9b04e..370b3b8 100644
--- a/services/surfaceflinger/SurfaceTracing.cpp
+++ b/services/surfaceflinger/SurfaceTracing.cpp
@@ -52,7 +52,7 @@
     return err;
 }
 
-bool SurfaceTracing::isEnabled() {
+bool SurfaceTracing::isEnabled() const {
     return mEnabled;
 }
 
@@ -65,6 +65,15 @@
     entry->set_elapsed_realtime_nanos(elapsedRealtimeNano());
     entry->set_where(where);
     entry->mutable_layers()->Swap(&layers);
+
+    constexpr int maxBufferedEntryCount = 3600;
+    if (mTrace.entry_size() >= maxBufferedEntryCount) {
+        // TODO: flush buffered entries without disabling tracing
+        ALOGE("too many buffered frames; force disable tracing");
+        mEnabled = false;
+        writeProtoFileLocked();
+        mTrace.Clear();
+    }
 }
 
 status_t SurfaceTracing::writeProtoFileLocked() {
@@ -84,4 +93,11 @@
     return NO_ERROR;
 }
 
+void SurfaceTracing::dump(String8& result) const {
+    std::lock_guard<std::mutex> protoGuard(mTraceMutex);
+
+    result.appendFormat("Tracing state: %s\n", mEnabled ? "enabled" : "disabled");
+    result.appendFormat("  number of entries: %d\n", mTrace.entry_size());
+}
+
 } // namespace android
diff --git a/services/surfaceflinger/SurfaceTracing.h b/services/surfaceflinger/SurfaceTracing.h
index 590ab96..27e2c9e 100644
--- a/services/surfaceflinger/SurfaceTracing.h
+++ b/services/surfaceflinger/SurfaceTracing.h
@@ -18,6 +18,7 @@
 
 #include <layerproto/LayerProtoHeader.h>
 #include <utils/Errors.h>
+#include <utils/String8.h>
 
 #include <mutex>
 
@@ -32,9 +33,10 @@
 public:
     void enable();
     status_t disable();
-    bool isEnabled();
+    bool isEnabled() const;
 
     void traceLayers(const char* where, LayersProto);
+    void dump(String8& result) const;
 
 private:
     static constexpr auto DEFAULT_FILENAME = "/data/misc/wmtrace/layers_trace.pb";
@@ -43,7 +45,7 @@
 
     bool mEnabled = false;
     std::string mOutputFileName = DEFAULT_FILENAME;
-    std::mutex mTraceMutex;
+    mutable std::mutex mTraceMutex;
     LayersTraceFileProto mTrace;
 };
 
diff --git a/services/surfaceflinger/tests/unittests/DisplayTransactionTest.cpp b/services/surfaceflinger/tests/unittests/DisplayTransactionTest.cpp
index aa377af..cc46043 100644
--- a/services/surfaceflinger/tests/unittests/DisplayTransactionTest.cpp
+++ b/services/surfaceflinger/tests/unittests/DisplayTransactionTest.cpp
@@ -284,8 +284,8 @@
         EXPECT_CALL(*test->mRenderSurface, setAsync(static_cast<bool>(ASYNC))).Times(1);
         EXPECT_CALL(*test->mRenderSurface, setCritical(static_cast<bool>(CRITICAL))).Times(1);
         EXPECT_CALL(*test->mRenderSurface, setNativeWindow(test->mNativeWindow.get())).Times(1);
-        EXPECT_CALL(*test->mRenderSurface, queryWidth()).WillOnce(Return(WIDTH));
-        EXPECT_CALL(*test->mRenderSurface, queryHeight()).WillOnce(Return(HEIGHT));
+        EXPECT_CALL(*test->mRenderSurface, getWidth()).WillOnce(Return(WIDTH));
+        EXPECT_CALL(*test->mRenderSurface, getHeight()).WillOnce(Return(HEIGHT));
     }
 
     static void setupFramebufferConsumerBufferQueueCallExpectations(DisplayTransactionTest* test) {
@@ -1757,8 +1757,8 @@
     EXPECT_CALL(*renderSurface, setNativeWindow(nullptr)).Times(1);
     EXPECT_CALL(*displaySurface, resizeBuffers(newWidth, oldHeight)).Times(1);
     EXPECT_CALL(*renderSurface, setNativeWindow(nativeWindow)).Times(1);
-    EXPECT_CALL(*renderSurface, queryWidth()).WillOnce(Return(newWidth));
-    EXPECT_CALL(*renderSurface, queryHeight()).WillOnce(Return(oldHeight));
+    EXPECT_CALL(*renderSurface, getWidth()).WillOnce(Return(newWidth));
+    EXPECT_CALL(*renderSurface, getHeight()).WillOnce(Return(oldHeight));
 
     // --------------------------------------------------------------------
     // Invocation
@@ -1798,8 +1798,8 @@
     EXPECT_CALL(*renderSurface, setNativeWindow(nullptr)).Times(1);
     EXPECT_CALL(*displaySurface, resizeBuffers(oldWidth, newHeight)).Times(1);
     EXPECT_CALL(*renderSurface, setNativeWindow(nativeWindow)).Times(1);
-    EXPECT_CALL(*renderSurface, queryWidth()).WillOnce(Return(oldWidth));
-    EXPECT_CALL(*renderSurface, queryHeight()).WillOnce(Return(newHeight));
+    EXPECT_CALL(*renderSurface, getWidth()).WillOnce(Return(oldWidth));
+    EXPECT_CALL(*renderSurface, getHeight()).WillOnce(Return(newHeight));
 
     // --------------------------------------------------------------------
     // Invocation
diff --git a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
index b9e0715..ecf3181 100644
--- a/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
+++ b/services/surfaceflinger/tests/unittests/mock/DisplayHardware/MockComposer.h
@@ -112,6 +112,7 @@
     MOCK_METHOD3(setLayerZOrder, Error(Display, Layer, uint32_t));
     MOCK_METHOD4(setLayerInfo, Error(Display, Layer, uint32_t, uint32_t));
     MOCK_METHOD3(getRenderIntents, Error(Display, ColorMode, std::vector<RenderIntent>*));
+    MOCK_METHOD3(setLayerColorTransform, Error(Display, Layer, const float*));
 };
 
 } // namespace mock
diff --git a/services/surfaceflinger/tests/unittests/mock/RenderEngine/MockRenderEngine.h b/services/surfaceflinger/tests/unittests/mock/RenderEngine/MockRenderEngine.h
index 39ed622..c29452c 100644
--- a/services/surfaceflinger/tests/unittests/mock/RenderEngine/MockRenderEngine.h
+++ b/services/surfaceflinger/tests/unittests/mock/RenderEngine/MockRenderEngine.h
@@ -50,12 +50,11 @@
     bool waitFence(base::unique_fd fd) override { return waitFence(&fd); };
     MOCK_METHOD4(clearWithColor, void(float, float, float, float));
     MOCK_METHOD5(fillRegionWithColor, void(const Region&, float, float, float, float));
-    MOCK_METHOD4(setScissor, void(uint32_t, uint32_t, uint32_t, uint32_t));
+    MOCK_METHOD1(setScissor, void(const Rect&));
     MOCK_METHOD0(disableScissor, void());
     MOCK_METHOD2(genTextures, void(size_t, uint32_t*));
     MOCK_METHOD2(deleteTextures, void(size_t, uint32_t const*));
     MOCK_METHOD2(bindExternalTextureImage, void(uint32_t, const renderengine::Image&));
-    MOCK_METHOD5(readPixels, void(size_t, size_t, size_t, size_t, uint32_t*));
     MOCK_CONST_METHOD0(checkErrors, void());
     MOCK_METHOD4(setViewportAndProjection,
                  void(size_t, size_t, Rect, ui::Transform::orientation_flags));
@@ -91,8 +90,8 @@
     MOCK_CONST_METHOD0(queryGreenSize, int32_t());
     MOCK_CONST_METHOD0(queryBlueSize, int32_t());
     MOCK_CONST_METHOD0(queryAlphaSize, int32_t());
-    MOCK_CONST_METHOD0(queryWidth, int32_t());
-    MOCK_CONST_METHOD0(queryHeight, int32_t());
+    MOCK_CONST_METHOD0(getWidth, int32_t());
+    MOCK_CONST_METHOD0(getHeight, int32_t());
 };
 
 class Image : public renderengine::Image {
diff --git a/services/vr/performanced/task.cpp b/services/vr/performanced/task.cpp
index c2f078e..bda1682 100644
--- a/services/vr/performanced/task.cpp
+++ b/services/vr/performanced/task.cpp
@@ -115,7 +115,7 @@
     std::istream file_stream(&filebuf);
 
     for (std::string line; std::getline(file_stream, line);) {
-      auto offset = line.find(":");
+      auto offset = line.find(':');
       if (offset == std::string::npos) {
         ALOGW("ReadStatusFields: Failed to find delimiter \":\" in line=\"%s\"",
               line.c_str());