diff --git a/AndroidProducts.mk b/AndroidProducts.mk
index 77183bb..3310b9c 100644
--- a/AndroidProducts.mk
+++ b/AndroidProducts.mk
@@ -1,3 +1,4 @@
 PRODUCT_MAKEFILES := \
     $(LOCAL_DIR)/kernel-tests/goldfish_kernel_tests_x86_64.mk \
-    $(LOCAL_DIR)/sdk_phone_x86_vendor.mk
+    $(LOCAL_DIR)/sdk_phone_x86_vendor.mk \
+    $(LOCAL_DIR)/fvp.mk
diff --git a/MultiDisplayProvider/jni/com_android_emulator_multidisplay.cpp b/MultiDisplayProvider/jni/com_android_emulator_multidisplay.cpp
index ef4a053..54a1339 100644
--- a/MultiDisplayProvider/jni/com_android_emulator_multidisplay.cpp
+++ b/MultiDisplayProvider/jni/com_android_emulator_multidisplay.cpp
@@ -26,7 +26,6 @@
 #include <sys/epoll.h>
 
 #include "utils/Log.h"
-#include "../../include/qemu_pipe.h"
 #include "nativehelper/JNIHelp.h"
 #include <nativehelper/ScopedLocalRef.h>
 #include "jni.h"
@@ -65,14 +64,14 @@
         mConsumer->acquireBuffer(&bufferItem, 0);
         ANativeWindowBuffer* b = bufferItem.mGraphicBuffer->getNativeBuffer();
         if (b && b->handle) {
-            cb_handle_t* cb = (cb_handle_t*)(b->handle);
+            const cb_handle_t* cb = cb_handle_t::from(b->handle);
             if (mCb != cb->hostHandle) {
                 ALOGI("sent cb %d", cb->hostHandle);
                 mCb = cb->hostHandle;
                 uint32_t data[] = {mId, mCb};
                 std::vector<uint8_t> buf;
                 fillMsg(buf, BIND, (uint8_t*)data, sizeof(data));
-                WriteFully(gFd, buf.data(), buf.size());
+                qemu_pipe_write_fully(gFd, buf.data(), buf.size());
             }
         }
         else {
@@ -106,13 +105,13 @@
 
 static jint nativeOpen(JNIEnv* env, jobject obj) {
     // Open pipe
-    gFd = qemu_pipe_open("multidisplay");
+    gFd = qemu_pipe_open_ns(NULL, "multidisplay", O_RDWR);
     if (gFd < 0) {
         ALOGE("Error opening multidisplay pipe %d", gFd);
     } else {
         std::vector<uint8_t> buf;
         fillMsg(buf, QUERY, nullptr, 0);
-        WriteFully(gFd, buf.data(), buf.size());
+        qemu_pipe_write_fully(gFd, buf.data(), buf.size());
         ALOGI("multidisplay pipe connected!!!");
     }
     return gFd;
@@ -121,9 +120,9 @@
 static bool nativeReadPipe(JNIEnv* env, jobject obj, jintArray arr) {
     int* arrp = env->GetIntArrayElements(arr, 0);
     uint32_t length;
-    ReadFully(gFd, &length, sizeof(length));
+    qemu_pipe_read_fully(gFd, &length, sizeof(length));
     std::vector<uint8_t> args(length, 0);
-    ReadFully(gFd, args.data(), (size_t)length);
+    qemu_pipe_read_fully(gFd, args.data(), (size_t)length);
     switch(args[0]) {
         case ADD: {
             ALOGV("received add event");
diff --git a/arm32-vendor.mk b/arm32-vendor.mk
index d94b99c..f447325 100644
--- a/arm32-vendor.mk
+++ b/arm32-vendor.mk
@@ -2,8 +2,6 @@
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib/libgoldfish-ril.so
 
-DEVICE_MANIFEST_FILE := device/generic/goldfish/manifest-arm.xml
-
 # Note: the following lines need to stay at the beginning so that it can
 # take priority  and override the rules it inherit from other mk files
 # see copy file rules in core/Makefile
diff --git a/arm64-vendor.mk b/arm64-vendor.mk
index b97ccfc..6343136 100644
--- a/arm64-vendor.mk
+++ b/arm64-vendor.mk
@@ -2,8 +2,6 @@
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib64/libgoldfish-ril.so
 
-DEVICE_MANIFEST_FILE := device/generic/goldfish/manifest-arm.xml
-
 # Note: the following lines need to stay at the beginning so that it can
 # take priority  and override the rules it inherit from other mk files
 # see copy file rules in core/Makefile
diff --git a/audio/audio_hw.c b/audio/audio_hw.c
index 071b47f..e4db967 100644
--- a/audio/audio_hw.c
+++ b/audio/audio_hw.c
@@ -381,7 +381,7 @@
     }
 
     if (get) {
-        str = strdup(str_parms_to_str(reply));
+        str = str_parms_to_str(reply);
     }
     else {
         ALOGD("%s Unsupported paramter: %s", __FUNCTION__, keys);
@@ -917,7 +917,7 @@
     }
 
     if (get) {
-        str = strdup(str_parms_to_str(reply));
+        str = str_parms_to_str(reply);
     }
     else {
         ALOGD("%s Unsupported paramter: %s", __FUNCTION__, keys);
diff --git a/audio/audio_hw_legacy.c b/audio/audio_hw_legacy.c
index 3d6a253..d1bbbe3 100644
--- a/audio/audio_hw_legacy.c
+++ b/audio/audio_hw_legacy.c
@@ -161,7 +161,7 @@
     ret = str_parms_get_str(query, AUDIO_PARAMETER_STREAM_ROUTING, value, sizeof(value));
     if (ret >= 0) {
         str_parms_add_int(reply, AUDIO_PARAMETER_STREAM_ROUTING, out->device);
-        str = strdup(str_parms_to_str(reply));
+        str = str_parms_to_str(reply);
     } else {
         str = strdup(keys);
     }
@@ -318,7 +318,7 @@
     ret = str_parms_get_str(query, AUDIO_PARAMETER_STREAM_ROUTING, value, sizeof(value));
     if (ret >= 0) {
         str_parms_add_int(reply, AUDIO_PARAMETER_STREAM_ROUTING, in->device);
-        str = strdup(str_parms_to_str(reply));
+        str = str_parms_to_str(reply);
     } else {
         str = strdup(keys);
     }
diff --git a/camera/Android.mk b/camera/Android.mk
index e5a1b04..4a6cf7c 100644
--- a/camera/Android.mk
+++ b/camera/Android.mk
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ifneq ($(filter generic_x86 generic_x86_64 generic generic_arm64 generic_x86_arm, $(TARGET_DEVICE)),)
+ifneq ($(filter generic_x86 generic_x86_64 generic generic_arm64 generic_x86_64_arm64 generic_x86_arm, $(TARGET_DEVICE)),)
 
 LOCAL_PATH := $(call my-dir)
 
@@ -37,7 +37,8 @@
     libdl \
     libjpeg \
     libcamera_metadata \
-    libhardware
+    libcbmanager \
+    android.hardware.graphics.mapper@2.0 \
 
 emulator_camera_static_libraries := \
 	android.hardware.camera.common@1.0-helper \
@@ -48,6 +49,7 @@
 	external/libyuv/files/include \
 	frameworks/native/include/media/hardware \
 	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/system/include \
 	$(LOCAL_PATH)/../../goldfish-opengl/system/OpenglSystemCommon \
 	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon \
 	$(call include-path-for, camera)
@@ -130,6 +132,7 @@
 
 include ${CLEAR_VARS}
 
+LOCAL_VENDOR_MODULE := true
 LOCAL_MODULE_RELATIVE_PATH := ${emulator_camera_module_relative_path}
 LOCAL_CFLAGS := ${emulator_camera_cflags}
 LOCAL_CLANG_CFLAGS += ${emulator_camera_clang_flags}
diff --git a/camera/EmulatedBaseCamera.h b/camera/EmulatedBaseCamera.h
index abaed98..a487a47 100644
--- a/camera/EmulatedBaseCamera.h
+++ b/camera/EmulatedBaseCamera.h
@@ -57,6 +57,8 @@
      ***************************************************************************/
 
   public:
+    int getCameraId() const { return mCameraID; }
+
     /* Creates connection to the emulated camera device.
      * This method is called in response to hw_module_methods_t::open callback.
      * NOTE: When this method is called the object is locked.
diff --git a/camera/EmulatedCamera.cpp b/camera/EmulatedCamera.cpp
index f24da22..389ef40 100755
--- a/camera/EmulatedCamera.cpp
+++ b/camera/EmulatedCamera.cpp
@@ -98,12 +98,13 @@
 }
 
 EmulatedCamera::EmulatedCamera(int cameraId,
-                               struct hw_module_t* module)
+                               struct hw_module_t* module,
+                               CbManager* cbManager)
         : EmulatedBaseCamera(cameraId,
                 HARDWARE_DEVICE_API_VERSION(1, 0),
                 &common,
                 module),
-          mPreviewWindow(),
+          mPreviewWindow(cbManager),
           mCallbackNotifier()
 {
     /* camera_device v1 fields. */
diff --git a/camera/EmulatedCamera.h b/camera/EmulatedCamera.h
index 6df76b7..1990a47 100755
--- a/camera/EmulatedCamera.h
+++ b/camera/EmulatedCamera.h
@@ -31,6 +31,7 @@
 #include "EmulatedCameraDevice.h"
 #include "PreviewWindow.h"
 #include "CallbackNotifier.h"
+#include "cbmanager.h"
 
 using ::android::hardware::camera::common::V1_0::helper::CameraParameters;
 using ::android::hardware::camera::common::V1_0::helper::Size;
@@ -55,7 +56,8 @@
      *  module - Emulated camera HAL module descriptor.
      */
     EmulatedCamera(int cameraId,
-                   struct hw_module_t* module);
+                   struct hw_module_t* module,
+                   CbManager* cbManager);
 
     /* Destructs EmulatedCamera instance. */
     virtual ~EmulatedCamera();
diff --git a/camera/EmulatedCameraFactory.cpp b/camera/EmulatedCameraFactory.cpp
index 414289a..6815f7d 100755
--- a/camera/EmulatedCameraFactory.cpp
+++ b/camera/EmulatedCameraFactory.cpp
@@ -45,9 +45,6 @@
 
 EmulatedCameraFactory::EmulatedCameraFactory() :
         mQemuClient(),
-        mEmulatedCameras(nullptr),
-        mEmulatedCameraNum(0),
-        mFakeCameraNum(0),
         mConstructedOK(false),
         mCallbacks(nullptr) {
 
@@ -55,35 +52,28 @@
      * Figure out how many cameras need to be created, so we can allocate the
      * array of emulated cameras before populating it.
      */
-    int emulatedCamerasSize = 0;
 
     // QEMU Cameras
     std::vector<QemuCameraInfo> qemuCameras;
     if (mQemuClient.connectClient(nullptr) == NO_ERROR) {
         findQemuCameras(&qemuCameras);
-        emulatedCamerasSize += qemuCameras.size();
     }
 
+    int fakeCameraNum = 0;
     waitForQemuSfFakeCameraPropertyAvailable();
     // Fake Cameras
     if (isFakeCameraEmulationOn(/* backCamera */ true)) {
-        mFakeCameraNum++;
+        fakeCameraNum++;
     }
     if (isFakeCameraEmulationOn(/* backCamera */ false)) {
-        mFakeCameraNum++;
+        fakeCameraNum++;
     }
-    emulatedCamerasSize += mFakeCameraNum;
 
     /*
      * We have the number of cameras we need to create, now allocate space for
      * them.
      */
-    mEmulatedCameras = new EmulatedBaseCamera*[emulatedCamerasSize];
-    if (mEmulatedCameras == nullptr) {
-        ALOGE("%s: Unable to allocate emulated camera array for %d entries",
-                __FUNCTION__, mEmulatedCameraNum);
-        return;
-    }
+    mEmulatedCameras.reserve(qemuCameras.size() + fakeCameraNum);
 
     createQemuCameras(qemuCameras);
 
@@ -95,17 +85,16 @@
         createFakeCamera(/* backCamera */ false);
     }
 
-    ALOGE("%d cameras are being emulated. %d of them are fake cameras.",
-            mEmulatedCameraNum, mFakeCameraNum);
+    ALOGE("%zu cameras are being emulated. %d of them are fake cameras.",
+            mEmulatedCameras.size(), fakeCameraNum);
 
     // Create hotplug thread.
     {
-        Vector<int> cameraIdVector;
-        for (int i = 0; i < mEmulatedCameraNum; ++i) {
-            cameraIdVector.push_back(i);
+        std::vector<int> cameraIdVector;
+        for (const auto &camera: mEmulatedCameras) {
+            cameraIdVector.push_back(camera->getCameraId());
         }
-        mHotplugThread = new EmulatedCameraHotplugThread(&cameraIdVector[0],
-                                                         mEmulatedCameraNum);
+        mHotplugThread = new EmulatedCameraHotplugThread(std::move(cameraIdVector));
         mHotplugThread->run("EmulatedCameraHotplugThread");
     }
 
@@ -113,14 +102,7 @@
 }
 
 EmulatedCameraFactory::~EmulatedCameraFactory() {
-    if (mEmulatedCameras != nullptr) {
-        for (int n = 0; n < mEmulatedCameraNum; n++) {
-            if (mEmulatedCameras[n] != nullptr) {
-                delete mEmulatedCameras[n];
-            }
-        }
-        delete[] mEmulatedCameras;
-    }
+    mEmulatedCameras.clear();
 
     if (mHotplugThread != nullptr) {
         mHotplugThread->requestExit();
@@ -334,6 +316,42 @@
     }
 }
 
+std::unique_ptr<EmulatedBaseCamera>
+EmulatedCameraFactory::createQemuCameraImpl(int halVersion,
+                                            const QemuCameraInfo& camInfo,
+                                            int cameraId,
+                                            struct hw_module_t* module) {
+    status_t res;
+
+    switch (halVersion) {
+    case 1: {
+            auto camera = std::make_unique<EmulatedQemuCamera>(cameraId, module,
+                                                               &mCbManager);
+            res = camera->Initialize(camInfo.name, camInfo.frameDims, camInfo.dir);
+            if (res == NO_ERROR) {
+                return camera;
+            }
+        }
+        break;
+
+    case 3: {
+            auto camera = std::make_unique<EmulatedQemuCamera3>(cameraId, module, &mCbManager);
+            res = camera->Initialize(camInfo.name, camInfo.frameDims, camInfo.dir);
+            if (res == NO_ERROR) {
+                return camera;
+            }
+        }
+        break;
+
+    default:
+        ALOGE("%s: QEMU support for camera hal version %d is not "
+              "implemented", __func__, halVersion);
+        break;
+    }
+
+    return nullptr;
+}
+
 void EmulatedCameraFactory::createQemuCameras(
         const std::vector<QemuCameraInfo> &qemuCameras) {
     /*
@@ -352,132 +370,66 @@
          * Here, we're assuming the first webcam is intended to be the back
          * camera and any other webcams are front cameras.
          */
-        int halVersion = 0;
-        if (qemuIndex == 0) {
-            halVersion = getCameraHalVersion(/* backCamera */ true);
-        } else {
-            halVersion = getCameraHalVersion(/* backCamera */ false);
+        const bool isBackcamera = (qemuIndex == 0);
+        const int halVersion = getCameraHalVersion(isBackcamera);
+
+        std::unique_ptr<EmulatedBaseCamera> camera =
+            createQemuCameraImpl(halVersion,
+                                 cameraInfo,
+                                 mEmulatedCameras.size(),
+                                 &HAL_MODULE_INFO_SYM.common);
+        if (camera) {
+            mEmulatedCameras.push_back(std::move(camera));
         }
 
-        // Create and initialize QEMU camera.
-        EmulatedBaseCamera *qemuCam = nullptr;
-        status_t res;
-        switch (halVersion) {
-            case 1:
-                EmulatedQemuCamera *qemuCamOne;
-                qemuCamOne = new EmulatedQemuCamera(
-                        mEmulatedCameraNum, &HAL_MODULE_INFO_SYM.common);
-                if (qemuCamOne == nullptr) {
-                    ALOGE("%s: Unable to instantiate EmulatedQemuCamera",
-                            __FUNCTION__);
-                } else {
-                    /*
-                     * We have to initialize in each switch case, because
-                     * EmulatedBaseCamera::Initialize has a different method
-                     * signature.
-                     *
-                     * TODO: Having an EmulatedBaseQemuCamera class
-                     * could fix this issue.
-                     */
-                    res = qemuCamOne->Initialize(
-                            cameraInfo.name,
-                            cameraInfo.frameDims,
-                            cameraInfo.dir);
-                }
-                qemuCam = qemuCamOne;
-                break;
-            case 2:
-                ALOGE("%s: QEMU support for camera hal version %d is not "
-                        "implemented", __FUNCTION__, halVersion);
-                break;
-            case 3:
-                EmulatedQemuCamera3 *qemuCamThree;
-                qemuCamThree = new EmulatedQemuCamera3(
-                        mEmulatedCameraNum, &HAL_MODULE_INFO_SYM.common);
-                if (qemuCamThree == nullptr) {
-                    ALOGE("%s: Unable to instantiate EmulatedQemuCamera3",
-                            __FUNCTION__);
-                } else {
-                    res = qemuCamThree->Initialize(
-                            cameraInfo.name,
-                            cameraInfo.frameDims,
-                            cameraInfo.dir);
-                }
-                qemuCam = qemuCamThree;
-                break;
-            default:
-                ALOGE("%s: Unknown camera hal version requested: %d",
-                        __FUNCTION__, halVersion);
-        }
+        qemuIndex++;
+    }
+}
 
-        if (qemuCam == nullptr) {
-            ALOGE("%s: Unable to instantiate EmulatedQemuCamera",
-                    __FUNCTION__);
-        } else {
-            if (res == NO_ERROR) {
-                mEmulatedCameras[mEmulatedCameraNum] = qemuCam;
-                qemuIndex++;
-                mEmulatedCameraNum++;
+std::unique_ptr<EmulatedBaseCamera>
+EmulatedCameraFactory::createFakeCameraImpl(bool backCamera,
+                                            int halVersion,
+                                            int cameraId,
+                                            struct hw_module_t* module) {
+    switch (halVersion) {
+    case 1:
+        return std::make_unique<EmulatedFakeCamera>(cameraId, backCamera, module, &mCbManager);
+
+    case 2:
+        return std::make_unique<EmulatedFakeCamera2>(cameraId, backCamera, module, &mCbManager);
+
+    case 3: {
+            static const char key[] = "ro.kernel.qemu.camera.fake.rotating";
+            char prop[PROPERTY_VALUE_MAX];
+
+            if (property_get(key, prop, nullptr) > 0) {
+                return std::make_unique<EmulatedFakeCamera>(cameraId, backCamera, module, &mCbManager);
             } else {
-                delete qemuCam;
+                return std::make_unique<EmulatedFakeCamera3>(cameraId, backCamera, module, &mCbManager);
             }
         }
+
+    default:
+        ALOGE("%s: Unknown %s camera hal version requested: %d",
+              __func__, backCamera ? "back" : "front", halVersion);
+        return nullptr;
     }
 }
 
 void EmulatedCameraFactory::createFakeCamera(bool backCamera) {
-    int halVersion = getCameraHalVersion(backCamera);
+    const int halVersion = getCameraHalVersion(backCamera);
 
-    /*
-     * Create and initialize the fake camera, using the index into
-     * mEmulatedCameras as the camera ID.
-     */
-    switch (halVersion) {
-        case 1:
-            mEmulatedCameras[mEmulatedCameraNum] =
-                    new EmulatedFakeCamera(mEmulatedCameraNum, backCamera,
-                            &HAL_MODULE_INFO_SYM.common);
-            break;
-        case 2:
-            mEmulatedCameras[mEmulatedCameraNum] =
-                    new EmulatedFakeCamera2(mEmulatedCameraNum, backCamera,
-                            &HAL_MODULE_INFO_SYM.common);
-            break;
-        case 3:
-            {
-                const char *key = "ro.kernel.qemu.camera.fake.rotating";
-                char prop[PROPERTY_VALUE_MAX];
-                if (property_get(key, prop, nullptr) > 0) {
-                    mEmulatedCameras[mEmulatedCameraNum] =
-                        new EmulatedFakeCamera(mEmulatedCameraNum, backCamera,
-                                &HAL_MODULE_INFO_SYM.common);
-                } else {
-                    mEmulatedCameras[mEmulatedCameraNum] =
-                        new EmulatedFakeCamera3(mEmulatedCameraNum, backCamera,
-                                &HAL_MODULE_INFO_SYM.common);
-                }
-            }
-            break;
-        default:
-            ALOGE("%s: Unknown %s camera hal version requested: %d",
-                    __FUNCTION__, backCamera ? "back" : "front", halVersion);
-    }
+    std::unique_ptr<EmulatedBaseCamera> camera = createFakeCameraImpl(
+        backCamera, halVersion, mEmulatedCameras.size(),
+        &HAL_MODULE_INFO_SYM.common);
 
-    if (mEmulatedCameras[mEmulatedCameraNum] == nullptr) {
-        ALOGE("%s: Unable to instantiate fake camera class", __FUNCTION__);
+    status_t res = camera->Initialize();
+    if (res == NO_ERROR) {
+        mEmulatedCameras.push_back(std::move(camera));
     } else {
-        ALOGV("%s: %s camera device version is %d", __FUNCTION__,
-                backCamera ? "Back" : "Front", halVersion);
-        status_t res = mEmulatedCameras[mEmulatedCameraNum]->Initialize();
-        if (res == NO_ERROR) {
-            // Camera creation and initialization was successful.
-            mEmulatedCameraNum++;
-        } else {
-            ALOGE("%s: Unable to initialize %s camera %d: %s (%d)",
-                    __FUNCTION__, backCamera ? "back" : "front",
-                    mEmulatedCameraNum, strerror(-res), res);
-            delete mEmulatedCameras[mEmulatedCameraNum];
-        }
+        ALOGE("%s: Unable to initialize %s camera %zu: %s (%d)",
+              __func__, backCamera ? "back" : "front",
+              mEmulatedCameras.size(), strerror(-res), res);
     }
 }
 
@@ -546,7 +498,7 @@
 
 void EmulatedCameraFactory::onStatusChanged(int cameraId, int newStatus) {
 
-    EmulatedBaseCamera *cam = mEmulatedCameras[cameraId];
+    EmulatedBaseCamera *cam = mEmulatedCameras[cameraId].get();
     if (!cam) {
         ALOGE("%s: Invalid camera ID %d", __FUNCTION__, cameraId);
         return;
diff --git a/camera/EmulatedCameraFactory.h b/camera/EmulatedCameraFactory.h
index 4091bfc..10e759e 100755
--- a/camera/EmulatedCameraFactory.h
+++ b/camera/EmulatedCameraFactory.h
@@ -19,6 +19,7 @@
 
 #include "EmulatedBaseCamera.h"
 #include "QemuClient.h"
+#include "cbmanager.h"
 
 #include <cutils/properties.h>
 
@@ -169,7 +170,7 @@
      * Gets number of emulated cameras.
      */
     int getEmulatedCameraNum() const {
-        return mEmulatedCameraNum;
+        return mEmulatedCameras.size();
     }
 
     /*
@@ -223,6 +224,12 @@
      */
     void createQemuCameras(const std::vector<QemuCameraInfo> &qemuCameras);
 
+    std::unique_ptr<EmulatedBaseCamera> createQemuCameraImpl(
+        int halVersion,
+        const QemuCameraInfo& cameraInfo,
+        int cameraId,
+        struct hw_module_t* module);
+
     /*
      * Creates a fake camera and adds it to mEmulatedCameras. If backCamera is
      * true, it will be created as if it were a camera on the back of the phone.
@@ -230,6 +237,12 @@
      */
     void createFakeCamera(bool backCamera);
 
+    std::unique_ptr<EmulatedBaseCamera> createFakeCameraImpl(
+        bool backCamera,
+        int halVersion,
+        int cameraId,
+        struct hw_module_t* module);
+
     /*
      * Waits till qemu-props has done setup, timeout after 500ms.
      */
@@ -254,14 +267,11 @@
     // Connection to the camera service in the emulator.
     FactoryQemuClient mQemuClient;
 
+    // API to manipulate color buffers
+    CbManager mCbManager;
+
     // Array of cameras available for the emulation.
-    EmulatedBaseCamera **mEmulatedCameras;
-
-    // Number of emulated cameras (including the fake ones).
-    int mEmulatedCameraNum;
-
-    // Number of emulated fake cameras.
-    int mFakeCameraNum;
+    std::vector<std::unique_ptr<EmulatedBaseCamera>> mEmulatedCameras;
 
     // Flags whether or not constructor has succeeded.
     bool mConstructedOK;
diff --git a/camera/EmulatedCameraHotplugThread.cpp b/camera/EmulatedCameraHotplugThread.cpp
index f7782be..f80b531 100644
--- a/camera/EmulatedCameraHotplugThread.cpp
+++ b/camera/EmulatedCameraHotplugThread.cpp
@@ -24,6 +24,7 @@
 
 #include "EmulatedCameraHotplugThread.h"
 #include "EmulatedCameraFactory.h"
+#include "qemu_pipe.h"
 
 #define FAKE_HOTPLUG_FILE "/data/misc/media/emulator.camera.hotplug"
 
@@ -35,20 +36,12 @@
 namespace android {
 
 EmulatedCameraHotplugThread::EmulatedCameraHotplugThread(
-    const int* cameraIdArray,
-    size_t size) :
-        Thread(/*canCallJava*/false) {
+    std::vector<int> subscribedCameraIds) :
+        Thread(/*canCallJava*/false),
+        mSubscribedCameraIds(std::move(subscribedCameraIds)) {
 
     mRunning = true;
     mInotifyFd = 0;
-
-    for (size_t i = 0; i < size; ++i) {
-        int id = cameraIdArray[i];
-
-        if (createFileIfNotExists(id)) {
-            mSubscribedCameraIds.push_back(id);
-        }
-    }
 }
 
 EmulatedCameraHotplugThread::~EmulatedCameraHotplugThread() {
@@ -116,11 +109,7 @@
          * For each fake camera file, add a watch for when
          * the file is closed (if it was written to)
          */
-        Vector<int>::const_iterator it, end;
-        it = mSubscribedCameraIds.begin();
-        end = mSubscribedCameraIds.end();
-        for (; it != end; ++it) {
-            int cameraId = *it;
+        for (int cameraId: mSubscribedCameraIds) {
             if (!addWatch(cameraId)) {
                 mRunning = false;
                 break;
@@ -146,7 +135,7 @@
     // If requestExit was already called, mRunning will be false
     while (mRunning) {
         char buffer[EVENT_BUF_LEN];
-        int length = TEMP_FAILURE_RETRY(
+        int length = QEMU_PIPE_RETRY(
                         read(mInotifyFd, buffer, EVENT_BUF_LEN));
 
         if (length < 0) {
@@ -223,39 +212,12 @@
     return String8::format(FAKE_HOTPLUG_FILE ".%d", cameraId);
 }
 
-bool EmulatedCameraHotplugThread::createFileIfNotExists(int cameraId) const
-{
-    String8 filePath = getFilePath(cameraId);
-    // make sure this file exists and we have access to it
-    int fd = TEMP_FAILURE_RETRY(
-                open(filePath.string(), O_WRONLY | O_CREAT | O_TRUNC,
-                     /* mode = ug+rwx */ S_IRWXU | S_IRWXG ));
-    if (fd == -1) {
-        ALOGE("%s: Could not create file '%s', error: '%s' (%d)",
-             __FUNCTION__, filePath.string(), strerror(errno), errno);
-        return false;
-    }
-
-    // File has '1' by default since we are plugged in by default
-    if (TEMP_FAILURE_RETRY(write(fd, "1\n", /*count*/2)) == -1) {
-        ALOGE("%s: Could not write '1' to file '%s', error: '%s' (%d)",
-             __FUNCTION__, filePath.string(), strerror(errno), errno);
-        return false;
-    }
-
-    close(fd);
-    return true;
-}
-
 int EmulatedCameraHotplugThread::getCameraId(const String8& filePath) const {
-    Vector<int>::const_iterator it, end;
-    it = mSubscribedCameraIds.begin();
-    end = mSubscribedCameraIds.end();
-    for (; it != end; ++it) {
-        String8 camPath = getFilePath(*it);
+    for (int cameraId: mSubscribedCameraIds) {
+        String8 camPath = getFilePath(cameraId);
 
         if (camPath == filePath) {
-            return *it;
+            return cameraId;
         }
     }
 
@@ -337,7 +299,7 @@
 
 int EmulatedCameraHotplugThread::readFile(const String8& filePath) const {
 
-    int fd = TEMP_FAILURE_RETRY(
+    int fd = QEMU_PIPE_RETRY(
                 open(filePath.string(), O_RDONLY, /*mode*/0));
     if (fd == -1) {
         ALOGE("%s: Could not open file '%s', error: '%s' (%d)",
@@ -348,7 +310,7 @@
     char buffer[1];
     int length;
 
-    length = TEMP_FAILURE_RETRY(
+    length = QEMU_PIPE_RETRY(
                     read(fd, buffer, sizeof(buffer)));
 
     int retval;
diff --git a/camera/EmulatedCameraHotplugThread.h b/camera/EmulatedCameraHotplugThread.h
index d286ff6..dfedb86 100644
--- a/camera/EmulatedCameraHotplugThread.h
+++ b/camera/EmulatedCameraHotplugThread.h
@@ -25,6 +25,7 @@
  * Refer to FAKE_HOTPLUG_FILE in EmulatedCameraHotplugThread.cpp
  */
 
+#include <vector>
 #include "EmulatedCamera2.h"
 #include <utils/String8.h>
 #include <utils/Vector.h>
@@ -32,7 +33,7 @@
 namespace android {
 class EmulatedCameraHotplugThread : public Thread {
   public:
-    EmulatedCameraHotplugThread(const int* cameraIdArray, size_t size);
+    EmulatedCameraHotplugThread(std::vector<int> subscribedCameraIds);
     ~EmulatedCameraHotplugThread();
 
     virtual void requestExit();
@@ -59,10 +60,8 @@
     String8 getFilePath(int cameraId) const;
     int readFile(const String8& filePath) const;
 
-    bool createFileIfNotExists(int cameraId) const;
-
     int mInotifyFd;
-    Vector<int> mSubscribedCameraIds;
+    std::vector<int> mSubscribedCameraIds;
     Vector<SubscriberInfo> mSubscribers;
 
     // variables above are unguarded:
diff --git a/camera/EmulatedFakeCamera.cpp b/camera/EmulatedFakeCamera.cpp
index bf41fb6..7d3f500 100755
--- a/camera/EmulatedFakeCamera.cpp
+++ b/camera/EmulatedFakeCamera.cpp
@@ -32,8 +32,9 @@
 
 EmulatedFakeCamera::EmulatedFakeCamera(int cameraId,
                                        bool facingBack,
-                                       struct hw_module_t* module)
-        : EmulatedCamera(cameraId, module),
+                                       struct hw_module_t* module,
+                                       CbManager* cbManager)
+        : EmulatedCamera(cameraId, module, cbManager),
           mFacingBack(facingBack),
           mFakeCameraDevice(nullptr)
 {
diff --git a/camera/EmulatedFakeCamera.h b/camera/EmulatedFakeCamera.h
index 00b340b..1ef8a79 100755
--- a/camera/EmulatedFakeCamera.h
+++ b/camera/EmulatedFakeCamera.h
@@ -24,6 +24,7 @@
  */
 
 #include "EmulatedCamera.h"
+#include "cbmanager.h"
 
 namespace android {
 
@@ -34,7 +35,7 @@
 class EmulatedFakeCamera : public EmulatedCamera {
 public:
     /* Constructs EmulatedFakeCamera instance. */
-    EmulatedFakeCamera(int cameraId, bool facingBack, struct hw_module_t* module);
+    EmulatedFakeCamera(int cameraId, bool facingBack, struct hw_module_t* module, CbManager* cbManager);
 
     /* Destructs EmulatedFakeCamera instance. */
     ~EmulatedFakeCamera();
diff --git a/camera/EmulatedFakeCamera2.cpp b/camera/EmulatedFakeCamera2.cpp
index 6bff5eb..7870e73 100644
--- a/camera/EmulatedFakeCamera2.cpp
+++ b/camera/EmulatedFakeCamera2.cpp
@@ -27,7 +27,7 @@
 
 #include "EmulatedFakeCamera2.h"
 #include "EmulatedCameraFactory.h"
-#include "GrallocModule.h"
+#include "cbmanager.h"
 
 #define ERROR_CAMERA_NOT_PRESENT (-EPIPE)
 
@@ -88,10 +88,12 @@
 
 EmulatedFakeCamera2::EmulatedFakeCamera2(int cameraId,
         bool facingBack,
-        struct hw_module_t* module)
+        struct hw_module_t* module,
+        CbManager* cbManager)
         : EmulatedCamera2(cameraId,module),
           mFacingBack(facingBack),
-          mIsConnected(false)
+          mIsConnected(false),
+          mCbManager(cbManager)
 {
     ALOGD("Constructing emulated fake camera 2 facing %s",
             facingBack ? "back" : "front");
@@ -173,7 +175,7 @@
     mReadoutThread = new ReadoutThread(this);
     mControlThread = new ControlThread(this);
     mSensor = new Sensor(mSensorWidth, mSensorHeight);
-    mJpegCompressor = new JpegCompressor();
+    mJpegCompressor = new JpegCompressor(mCbManager);
 
     mNextStreamId = 1;
     mNextReprocessStreamId = 1;
@@ -1068,8 +1070,8 @@
             }
 
             /* Lock the buffer from the perspective of the graphics mapper */
-            res = GrallocModule::getInstance().lock(*(b.buffer),
-                    GRALLOC_USAGE_HW_CAMERA_WRITE,
+            res = mParent->mCbManager->lockBuffer(*(b.buffer),
+                    (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
                     0, 0, s.width, s.height,
                     (void**)&(b.img));
 
@@ -1096,8 +1098,8 @@
             }
 
             /* Lock the buffer from the perspective of the graphics mapper */
-            res = GrallocModule::getInstance().lock(*(b.buffer),
-                    GRALLOC_USAGE_HW_CAMERA_READ,
+            res = mParent->mCbManager->lockBuffer(*(b.buffer),
+                    (CbManager::BufferUsage::CAMERA_INPUT | 0),
                     0, 0, s.width, s.height,
                     (void**)&(b.img) );
             if (res != NO_ERROR) {
@@ -1375,7 +1377,7 @@
             } else {
                 ALOGV("Readout:    Sending image buffer %zu (%p) to output stream %d",
                         i, (void*)*(b.buffer), b.streamId);
-                GrallocModule::getInstance().unlock(*(b.buffer));
+                mParent->mCbManager->unlockBuffer(*(b.buffer));
                 const Stream &s = mParent->getStreamInfo(b.streamId);
                 res = s.ops->enqueue_buffer(s.ops, captureTime, b.buffer);
                 if (res != OK) {
@@ -1419,7 +1421,7 @@
     ALOGV("%s: Compression complete, pushing to stream %d", __FUNCTION__,
             jpegBuffer.streamId);
 
-    GrallocModule::getInstance().unlock(*(jpegBuffer.buffer));
+    mParent->mCbManager->unlockBuffer(*(jpegBuffer.buffer));
     const Stream &s = mParent->getStreamInfo(jpegBuffer.streamId);
     res = s.ops->enqueue_buffer(s.ops, mJpegTimestamp, jpegBuffer.buffer);
 }
@@ -1427,7 +1429,7 @@
 void EmulatedFakeCamera2::ReadoutThread::onJpegInputDone(
         const StreamBuffer &inputBuffer) {
     status_t res;
-    GrallocModule::getInstance().unlock(*(inputBuffer.buffer));
+    mParent->mCbManager->unlockBuffer(*(inputBuffer.buffer));
     const ReprocessStream &s =
             mParent->getReprocessStreamInfo(-inputBuffer.streamId);
     res = s.ops->release_buffer(s.ops, inputBuffer.buffer);
diff --git a/camera/EmulatedFakeCamera2.h b/camera/EmulatedFakeCamera2.h
index b695016..d652d33 100644
--- a/camera/EmulatedFakeCamera2.h
+++ b/camera/EmulatedFakeCamera2.h
@@ -27,6 +27,7 @@
 #include "fake-pipeline2/Base.h"
 #include "fake-pipeline2/Sensor.h"
 #include "fake-pipeline2/JpegCompressor.h"
+#include "cbmanager.h"
 #include <utils/Condition.h>
 #include <utils/KeyedVector.h>
 #include <utils/String8.h>
@@ -40,7 +41,7 @@
 class EmulatedFakeCamera2 : public EmulatedCamera2 {
 public:
     /* Constructs EmulatedFakeCamera instance. */
-    EmulatedFakeCamera2(int cameraId, bool facingBack, struct hw_module_t* module);
+    EmulatedFakeCamera2(int cameraId, bool facingBack, struct hw_module_t* module, CbManager* cbManager);
 
     /* Destructs EmulatedFakeCamera instance. */
     ~EmulatedFakeCamera2();
@@ -415,6 +416,7 @@
 
     KeyedVector<uint32_t, Stream> mStreams;
     KeyedVector<uint32_t, ReprocessStream> mReprocessStreams;
+    CbManager* mCbManager;
 
     /** Simulated hardware interfaces */
     sp<Sensor> mSensor;
diff --git a/camera/EmulatedFakeCamera3.cpp b/camera/EmulatedFakeCamera3.cpp
index 16d4d13..6e918a7 100644
--- a/camera/EmulatedFakeCamera3.cpp
+++ b/camera/EmulatedFakeCamera3.cpp
@@ -30,7 +30,7 @@
 #include "EmulatedFakeCamera3.h"
 #include "EmulatedCameraFactory.h"
 #include <ui/Fence.h>
-#include "GrallocModule.h"
+#include "cbmanager.h"
 
 #include "fake-pipeline2/Sensor.h"
 #include "fake-pipeline2/JpegCompressor.h"
@@ -94,9 +94,9 @@
  */
 
 EmulatedFakeCamera3::EmulatedFakeCamera3(int cameraId, bool facingBack,
-        struct hw_module_t* module) :
+        struct hw_module_t* module, CbManager* cbManager) :
         EmulatedCamera3(cameraId, module),
-        mFacingBack(facingBack) {
+        mFacingBack(facingBack), mCbManager(cbManager) {
     ALOGI("Constructing emulated fake camera 3: ID %d, facing %s",
             mCameraID, facingBack ? "back" : "front");
 
@@ -156,7 +156,7 @@
     if (res != NO_ERROR) return res;
 
     mReadoutThread = new ReadoutThread(this);
-    mJpegCompressor = new JpegCompressor();
+    mJpegCompressor = new JpegCompressor(mCbManager);
 
     res = mReadoutThread->run("EmuCam3::readoutThread");
     if (res != NO_ERROR) return res;
@@ -949,10 +949,10 @@
             // Lock buffer for writing
             if (srcBuf.stream->format == HAL_PIXEL_FORMAT_YCbCr_420_888) {
                 if (destBuf.format == HAL_PIXEL_FORMAT_YCbCr_420_888) {
-                    android_ycbcr ycbcr = android_ycbcr();
-                    res = GrallocModule::getInstance().lock_ycbcr(
+                    CbManager::YCbCrLayout ycbcr = {};
+                    res = mCbManager->lockYCbCrBuffer(
                         *(destBuf.buffer),
-                        GRALLOC_USAGE_HW_CAMERA_WRITE,
+                        (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
                         0, 0, destBuf.width, destBuf.height,
                         &ycbcr);
                     // This is only valid because we know that emulator's
@@ -964,9 +964,9 @@
                     res = INVALID_OPERATION;
                 }
             } else {
-                res = GrallocModule::getInstance().lock(
+                res = mCbManager->lockBuffer(
                     *(destBuf.buffer),
-                    GRALLOC_USAGE_HW_CAMERA_WRITE,
+                    (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
                     0, 0, destBuf.width, destBuf.height,
                     (void**)&(destBuf.img));
 
@@ -985,8 +985,7 @@
             // Either waiting or locking failed. Unlock locked buffers and bail
             // out.
             for (size_t j = 0; j < i; j++) {
-                GrallocModule::getInstance().unlock(
-                        *(request->output_buffers[i].buffer));
+                mCbManager->unlockBuffer(*(request->output_buffers[i].buffer));
             }
             delete sensorBuffers;
             delete buffers;
@@ -2566,7 +2565,7 @@
                         __FUNCTION__, strerror(-res), res);
             // fallthrough for cleanup
         }
-        GrallocModule::getInstance().unlock(*(buf->buffer));
+        mParent->mCbManager->unlockBuffer(*(buf->buffer));
 
         buf->status = goodBuffer ? CAMERA3_BUFFER_STATUS_OK :
                 CAMERA3_BUFFER_STATUS_ERROR;
@@ -2668,7 +2667,7 @@
         const StreamBuffer &jpegBuffer, bool success) {
     Mutex::Autolock jl(mJpegLock);
 
-    GrallocModule::getInstance().unlock(*(jpegBuffer.buffer));
+    mParent->mCbManager->unlockBuffer(*(jpegBuffer.buffer));
 
     mJpegHalBuffer.status = success ?
             CAMERA3_BUFFER_STATUS_OK : CAMERA3_BUFFER_STATUS_ERROR;
diff --git a/camera/EmulatedFakeCamera3.h b/camera/EmulatedFakeCamera3.h
index 3093aef..bac12a7 100644
--- a/camera/EmulatedFakeCamera3.h
+++ b/camera/EmulatedFakeCamera3.h
@@ -27,6 +27,7 @@
 #include "fake-pipeline2/Base.h"
 #include "fake-pipeline2/Sensor.h"
 #include "fake-pipeline2/JpegCompressor.h"
+#include "cbmanager.h"
 #include <CameraMetadata.h>
 #include <utils/SortedVector.h>
 #include <utils/List.h>
@@ -50,7 +51,7 @@
 public:
 
     EmulatedFakeCamera3(int cameraId, bool facingBack,
-            struct hw_module_t* module);
+            struct hw_module_t* module, CbManager* cbManager);
 
     virtual ~EmulatedFakeCamera3();
 
@@ -161,6 +162,8 @@
 
     SortedVector<AvailableCapabilities> mCapabilities;
 
+    CbManager* mCbManager;
+
     /**
      * Cache for default templates. Once one is requested, the pointer must be
      * valid at least until close() is called on the device
diff --git a/camera/EmulatedFakeRotatingCameraDevice.cpp b/camera/EmulatedFakeRotatingCameraDevice.cpp
index fc1951e..84f1b88 100755
--- a/camera/EmulatedFakeRotatingCameraDevice.cpp
+++ b/camera/EmulatedFakeRotatingCameraDevice.cpp
@@ -26,7 +26,7 @@
 #include <log/log.h>
 #include "EmulatedFakeCamera.h"
 #include "EmulatedFakeRotatingCameraDevice.h"
-#include "qemud.h"
+#include "qemu_pipe.h"
 
 #include <EGL/egl.h>
 #include <GLES/gl.h>
@@ -284,7 +284,7 @@
 void EmulatedFakeRotatingCameraDevice::init_sensor() {
     if (mSensorPipe >=0) return;
     // create a sensor pipe
-    mSensorPipe = qemu_pipe_open(FAKE_CAMERA_SENSOR);
+    mSensorPipe = qemu_pipe_open_ns(NULL, FAKE_CAMERA_SENSOR, O_RDWR);
     if (mSensorPipe < 0) {
         ALOGE("cannot open %s", FAKE_CAMERA_SENSOR);
     } else {
@@ -296,10 +296,10 @@
     if (mSensorPipe < 0) return;
     char get[] = "get";
     int pipe_command_length = sizeof(get);
-    WriteFully(mSensorPipe, &pipe_command_length, sizeof(pipe_command_length));
-    WriteFully(mSensorPipe, get, pipe_command_length);
-    ReadFully(mSensorPipe, &pipe_command_length, sizeof(pipe_command_length));
-    ReadFully(mSensorPipe, &mSensorValues, pipe_command_length);
+    qemu_pipe_write_fully(mSensorPipe, &pipe_command_length, sizeof(pipe_command_length));
+    qemu_pipe_write_fully(mSensorPipe, get, pipe_command_length);
+    qemu_pipe_read_fully(mSensorPipe, &pipe_command_length, sizeof(pipe_command_length));
+    qemu_pipe_read_fully(mSensorPipe, &mSensorValues, pipe_command_length);
     assert(pipe_command_length == 9*sizeof(float));
     ALOGD("accel: %g %g %g; magnetic %g %g %g orientation %g %g %g",
             mSensorValues[SENSOR_VALUE_ACCEL_X], mSensorValues[SENSOR_VALUE_ACCEL_Y],
diff --git a/camera/EmulatedQemuCamera.cpp b/camera/EmulatedQemuCamera.cpp
index d08baad..2d581f1 100755
--- a/camera/EmulatedQemuCamera.cpp
+++ b/camera/EmulatedQemuCamera.cpp
@@ -33,8 +33,9 @@
 
 namespace android {
 
-EmulatedQemuCamera::EmulatedQemuCamera(int cameraId, struct hw_module_t* module)
-        : EmulatedCamera(cameraId, module),
+EmulatedQemuCamera::EmulatedQemuCamera(int cameraId, struct hw_module_t* module,
+                                       CbManager* cbManager)
+        : EmulatedCamera(cameraId, module, cbManager),
           mQemuCameraDevice(this)
 {
 }
diff --git a/camera/EmulatedQemuCamera.h b/camera/EmulatedQemuCamera.h
index 83397ef..975165a 100755
--- a/camera/EmulatedQemuCamera.h
+++ b/camera/EmulatedQemuCamera.h
@@ -24,6 +24,7 @@
 
 #include "EmulatedCamera.h"
 #include "EmulatedQemuCameraDevice.h"
+#include "cbmanager.h"
 
 namespace android {
 
@@ -32,7 +33,8 @@
 class EmulatedQemuCamera : public EmulatedCamera {
 public:
     /* Constructs EmulatedQemuCamera instance. */
-    EmulatedQemuCamera(int cameraId, struct hw_module_t* module);
+    EmulatedQemuCamera(int cameraId, struct hw_module_t* module,
+                       CbManager* cbManager);
 
     /* Destructs EmulatedQemuCamera instance. */
     ~EmulatedQemuCamera();
diff --git a/camera/EmulatedQemuCamera3.cpp b/camera/EmulatedQemuCamera3.cpp
index 7cc3d86..a6f7088 100644
--- a/camera/EmulatedQemuCamera3.cpp
+++ b/camera/EmulatedQemuCamera3.cpp
@@ -34,8 +34,8 @@
 #endif
 
 #include "EmulatedCameraFactory.h"
-#include "GrallocModule.h"
 #include "EmulatedQemuCamera3.h"
+#include "cbmanager.h"
 
 #include <cmath>
 #include <cutils/properties.h>
@@ -84,8 +84,8 @@
  * Constructor/Destructor
  ****************************************************************************/
 
-EmulatedQemuCamera3::EmulatedQemuCamera3(int cameraId, struct hw_module_t* module) :
-        EmulatedCamera3(cameraId, module) {
+EmulatedQemuCamera3::EmulatedQemuCamera3(int cameraId, struct hw_module_t* module, CbManager *cbManager) :
+        EmulatedCamera3(cameraId, module), mCbManager(cbManager) {
     ALOGI("Constructing emulated qemu camera 3: ID %d", mCameraID);
 
     for (size_t i = 0; i < CAMERA3_TEMPLATE_COUNT; ++i) {
@@ -229,7 +229,7 @@
     /*
      * Initialize sensor.
      */
-    mSensor = new QemuSensor(mDeviceName, mSensorWidth, mSensorHeight);
+    mSensor = new QemuSensor(mDeviceName, mSensorWidth, mSensorHeight, mCbManager);
     mSensor->setQemuSensorListener(this);
     res = mSensor->startUp();
     if (res != NO_ERROR) {
@@ -237,7 +237,7 @@
     }
 
     mReadoutThread = new ReadoutThread(this);
-    mJpegCompressor = new JpegCompressor();
+    mJpegCompressor = new JpegCompressor(mCbManager);
 
     res = mReadoutThread->run("EmuCam3::readoutThread");
     if (res != NO_ERROR) return res;
@@ -416,7 +416,7 @@
         if (newStream->format == HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED) {
             if (newStream->usage & GRALLOC_USAGE_HW_CAMERA_WRITE) {
                 if (newStream->usage & GRALLOC_USAGE_HW_TEXTURE) {
-                    newStream->format = HAL_PIXEL_FORMAT_RGBA_8888;
+                    newStream->format = HAL_PIXEL_FORMAT_YCbCr_420_888;
                 }
                 else if (newStream->usage & GRALLOC_USAGE_HW_VIDEO_ENCODER) {
                     newStream->format = HAL_PIXEL_FORMAT_YCbCr_420_888;
@@ -904,7 +904,7 @@
         if (srcBuf.stream->format == HAL_PIXEL_FORMAT_IMPLEMENTATION_DEFINED) {
             if (srcBuf.stream->usage & GRALLOC_USAGE_HW_CAMERA_WRITE) {
                 if (srcBuf.stream->usage & GRALLOC_USAGE_HW_TEXTURE) {
-                    destBuf.format = HAL_PIXEL_FORMAT_RGBA_8888;
+                    destBuf.format = HAL_PIXEL_FORMAT_YCbCr_420_888;
                 }
                 else if (srcBuf.stream->usage & GRALLOC_USAGE_HW_VIDEO_ENCODER) {
                     destBuf.format = HAL_PIXEL_FORMAT_YCbCr_420_888;
@@ -938,10 +938,10 @@
             // Lock buffer for writing.
             if (srcBuf.stream->format == HAL_PIXEL_FORMAT_YCbCr_420_888) {
                 if (destBuf.format == HAL_PIXEL_FORMAT_YCbCr_420_888) {
-                    android_ycbcr ycbcr = android_ycbcr();
-                    res = GrallocModule::getInstance().lock_ycbcr(
+                    CbManager::YCbCrLayout ycbcr = {};
+                    res = mCbManager->lockYCbCrBuffer(
                             *(destBuf.buffer),
-                            GRALLOC_USAGE_HW_CAMERA_WRITE,
+                            (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
                             0, 0, destBuf.width, destBuf.height,
                             &ycbcr);
                     /*
@@ -955,9 +955,9 @@
                     res = INVALID_OPERATION;
                 }
             } else {
-                res = GrallocModule::getInstance().lock(
+                res = mCbManager->lockBuffer(
                     *(destBuf.buffer),
-                    GRALLOC_USAGE_HW_CAMERA_WRITE,
+                    (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
                     0, 0, destBuf.width, destBuf.height,
                     (void**)&(destBuf.img));
 
@@ -974,8 +974,7 @@
              * out.
              */
             for (size_t j = 0; j < i; j++) {
-                GrallocModule::getInstance().unlock(
-                        *(request->output_buffers[i].buffer));
+                mCbManager->unlockBuffer(*(request->output_buffers[i].buffer));
             }
             delete sensorBuffers;
             delete buffers;
@@ -2024,7 +2023,7 @@
                     __FUNCTION__, strerror(-res), res);
             // Fallthrough for cleanup.
         }
-        GrallocModule::getInstance().unlock(*(buf->buffer));
+        mParent->mCbManager->unlockBuffer(*(buf->buffer));
 
         buf->status = goodBuffer ? CAMERA3_BUFFER_STATUS_OK :
                 CAMERA3_BUFFER_STATUS_ERROR;
@@ -2107,7 +2106,7 @@
         const StreamBuffer &jpegBuffer, bool success) {
     Mutex::Autolock jl(mJpegLock);
 
-    GrallocModule::getInstance().unlock(*(jpegBuffer.buffer));
+    mParent->mCbManager->unlockBuffer(*(jpegBuffer.buffer));
 
     mJpegHalBuffer.status = success ?
             CAMERA3_BUFFER_STATUS_OK : CAMERA3_BUFFER_STATUS_ERROR;
diff --git a/camera/EmulatedQemuCamera3.h b/camera/EmulatedQemuCamera3.h
index 5656f53..fa47dc7 100644
--- a/camera/EmulatedQemuCamera3.h
+++ b/camera/EmulatedQemuCamera3.h
@@ -26,6 +26,7 @@
 #include "EmulatedCamera3.h"
 #include "fake-pipeline2/JpegCompressor.h"
 #include "qemu-pipeline3/QemuSensor.h"
+#include "cbmanager.h"
 
 #include <CameraMetadata.h>
 #include <utils/SortedVector.h>
@@ -48,7 +49,7 @@
 class EmulatedQemuCamera3 : public EmulatedCamera3,
         private QemuSensor::QemuSensorListener {
 public:
-    EmulatedQemuCamera3(int cameraId, struct hw_module_t* module);
+    EmulatedQemuCamera3(int cameraId, struct hw_module_t* module, CbManager* cbmanager);
     virtual ~EmulatedQemuCamera3();
 
     /*
@@ -170,6 +171,7 @@
 
     // Shortcut to the input stream.
     camera3_stream_t* mInputStream;
+    CbManager* mCbManager;
 
     typedef List<camera3_stream_t*> StreamList;
     typedef List<camera3_stream_t*>::iterator StreamIterator;
diff --git a/camera/EmulatorCameraTest.cpp b/camera/EmulatorCameraTest.cpp
index 684e6d7..8f9a70a 100644
--- a/camera/EmulatorCameraTest.cpp
+++ b/camera/EmulatorCameraTest.cpp
@@ -3,79 +3,292 @@
 #include <vector>
 
 #include "fake-pipeline2/Base.h"
+#include "fake-pipeline2/Scene.h"
 #include "QemuClient.h"
+#include "cbmanager.h"
+#include "gralloc_cb.h"
 
 #include <linux/videodev2.h>
 #include <utils/Timers.h>
 
 using namespace android;
 
+
+const nsecs_t kExposureTimeRange[2] =
+    {1000L, 300000000L} ; // 1 us - 0.3 sec
+const nsecs_t kFrameDurationRange[2] =
+    {33331760L, 300000000L}; // ~1/30 s - 0.3 sec
+
+const nsecs_t kMinVerticalBlank = 10000L;
+
+const uint8_t kColorFilterArrangement =
+    ANDROID_SENSOR_INFO_COLOR_FILTER_ARRANGEMENT_RGGB;
+
+// Output image data characteristics
+const uint32_t kMaxRawValue = 4000;
+const uint32_t kBlackLevel  = 1000;
+
+// Sensor sensitivity
+const float kSaturationVoltage      = 0.520f;
+const uint32_t kSaturationElectrons = 2000;
+const float kVoltsPerLuxSecond      = 0.100f;
+
+const float kElectronsPerLuxSecond =
+        kSaturationElectrons / kSaturationVoltage
+        * kVoltsPerLuxSecond;
+
+const float kBaseGainFactor = (float)kMaxRawValue /
+            kSaturationElectrons;
+
+const float kReadNoiseStddevBeforeGain = 1.177; // in electrons
+const float kReadNoiseStddevAfterGain =  2.100; // in digital counts
+const float kReadNoiseVarBeforeGain =
+            kReadNoiseStddevBeforeGain *
+            kReadNoiseStddevBeforeGain;
+const float kReadNoiseVarAfterGain =
+            kReadNoiseStddevAfterGain *
+            kReadNoiseStddevAfterGain;
+
+const int32_t kSensitivityRange[2] = {100, 1600};
+const uint32_t kDefaultSensitivity = 100;
+
+void captureRGBA(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height, Scene& scene, uint32_t sWidth, uint32_t sHeight) {
+    float totalGain = gain/100.0 * kBaseGainFactor;
+    // In fixed-point math, calculate total scaling from electrons to 8bpp
+    int scale64x = 64 * totalGain * 255 / kMaxRawValue;
+    unsigned int DivH= (float)sHeight/height * (0x1 << 10);
+    unsigned int DivW = (float)sWidth/width * (0x1 << 10);
+
+    for (unsigned int outY = 0; outY < height; outY++) {
+        unsigned int y = outY * DivH >> 10;
+        uint8_t *px = img + outY * width * 4;
+        scene.setReadoutPixel(0, y);
+        unsigned int lastX = 0;
+        const uint32_t *pixel = scene.getPixelElectrons();
+        for (unsigned int outX = 0; outX < width; outX++) {
+            uint32_t rCount, gCount, bCount;
+            unsigned int x = outX * DivW >> 10;
+            if (x - lastX > 0) {
+                for (unsigned int k = 0; k < (x-lastX); k++) {
+                     pixel = scene.getPixelElectrons();
+                }
+            }
+            lastX = x;
+            // TODO: Perfect demosaicing is a cheat
+            rCount = pixel[Scene::R]  * scale64x;
+            gCount = pixel[Scene::Gr] * scale64x;
+            bCount = pixel[Scene::B]  * scale64x;
+
+            *px++ = rCount < 255*64 ? rCount / 64 : 255;
+            *px++ = gCount < 255*64 ? gCount / 64 : 255;
+            *px++ = bCount < 255*64 ? bCount / 64 : 255;
+            *px++ = 255;
+         }
+        // TODO: Handle this better
+        //simulatedTime += mRowReadoutTime;
+    }
+}
+
+void captureYU12(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height, Scene& scene, uint32_t sWidth, uint32_t sHeight) {
+    float totalGain = gain/100.0 * kBaseGainFactor;
+    // Using fixed-point math with 6 bits of fractional precision.
+    // In fixed-point math, calculate total scaling from electrons to 8bpp
+    const int scale64x = 64 * totalGain * 255 / kMaxRawValue;
+    // In fixed-point math, saturation point of sensor after gain
+    const int saturationPoint = 64 * 255;
+    // Fixed-point coefficients for RGB-YUV transform
+    // Based on JFIF RGB->YUV transform.
+    // Cb/Cr offset scaled by 64x twice since they're applied post-multiply
+    float rgbToY[]  = {19.0, 37.0, 7.0, 0.0};
+    float rgbToCb[] = {-10.0,-21.0, 32.0, 524288.0};
+    float rgbToCr[] = {32.0,-26.0, -5.0, 524288.0};
+    // Scale back to 8bpp non-fixed-point
+    const int scaleOut = 64;
+    const int scaleOutSq = scaleOut * scaleOut; // after multiplies
+    const double invscaleOutSq = 1.0/scaleOutSq;
+    for (int i=0; i < 4; ++i) {
+        rgbToY[i] *= invscaleOutSq;
+        rgbToCb[i] *= invscaleOutSq;
+        rgbToCr[i] *= invscaleOutSq;
+    }
+
+    unsigned int DivH= (float)sHeight/height * (0x1 << 10);
+    unsigned int DivW = (float)sWidth/width * (0x1 << 10);
+    for (unsigned int outY = 0; outY < height; outY++) {
+        unsigned int y = outY * DivH >> 10;
+        uint8_t *pxY = img + outY * width;
+        uint8_t *pxVU = img + (height + outY / 2) * width;
+        uint8_t *pxU = img + height * width + (outY / 2) * (width / 2);
+        uint8_t *pxV = pxU + (height / 2) * (width / 2);
+        scene.setReadoutPixel(0, y);
+        unsigned int lastX = 0;
+        const uint32_t *pixel = scene.getPixelElectrons();
+         for (unsigned int outX = 0; outX < width; outX++) {
+            int32_t rCount, gCount, bCount;
+            unsigned int x = outX * DivW >> 10;
+            if (x - lastX > 0) {
+                for (unsigned int k = 0; k < (x-lastX); k++) {
+                     pixel = scene.getPixelElectrons();
+                }
+            }
+            lastX = x;
+            rCount = pixel[Scene::R]  * scale64x;
+            rCount = rCount < saturationPoint ? rCount : saturationPoint;
+            gCount = pixel[Scene::Gr] * scale64x;
+            gCount = gCount < saturationPoint ? gCount : saturationPoint;
+            bCount = pixel[Scene::B]  * scale64x;
+            bCount = bCount < saturationPoint ? bCount : saturationPoint;
+            *pxY++ = (rgbToY[0] * rCount + rgbToY[1] * gCount + rgbToY[2] * bCount);
+            if (outY % 2 == 0 && outX % 2 == 0) {
+                *pxV++ = (rgbToCr[0] * rCount + rgbToCr[1] * gCount + rgbToCr[2] * bCount + rgbToCr[3]);
+                *pxU++ = (rgbToCb[0] * rCount + rgbToCb[1] * gCount + rgbToCb[2] * bCount + rgbToCb[3]);
+            }
+        }
+    }
+}
+
 // Test the capture speed of qemu camera, e.g., webcam and virtual scene
 int main(int argc, char* argv[]) {
     uint32_t pixFmt;
+    CbManager::PixelFormat cbFmt;
+    bool v1 = false;
+    bool fake = false;
+    std::vector<nsecs_t> report;
+    uint32_t sceneWidth;
+    uint32_t sceneHeight;
+
+    CbManager cbmanager;
+
     if (!strncmp(argv[1], "RGB", 3)) {
         pixFmt = V4L2_PIX_FMT_RGB32;
+        cbFmt = CbManager::PixelFormat::RGBA_8888;
     } else if (!strncmp(argv[1], "NV21", 3)) {
         pixFmt = V4L2_PIX_FMT_NV21;
+        cbFmt = CbManager::PixelFormat::YCBCR_420_888;
     } else if (!strncmp(argv[1], "YV12", 3)) {
         pixFmt = V4L2_PIX_FMT_YVU420;
+        cbFmt = CbManager::PixelFormat::YCBCR_420_888;
+    } else if (!strncmp(argv[1], "YU12", 3)) {
+        pixFmt = V4L2_PIX_FMT_YUV420;
+        cbFmt = CbManager::PixelFormat::YCBCR_420_888;
     } else {
-        printf("format error, use RGB, NV21 or YV12");
+        printf("format error, use RGB, NV21, YV12 or YU12");
         return -1;
     }
     uint32_t width = atoi(argv[2]);
     uint32_t height = atoi(argv[3]);
+    uint32_t repeated = atoi(argv[4]);
     std::string deviceName;
-    if (!strncmp(argv[4], "web", 3)) {
+    if (!strncmp(argv[5], "web", 3)) {
         deviceName = "name=/dev/video0";
-    } else if (!strncmp(argv[4], "vir", 3)) {
+    } else if (!strncmp(argv[5], "vir", 3)) {
         deviceName = "name=virtualscene";
+    } else if (!strncmp(argv[5], "fak", 3)){
+        fake = true;
+        sceneWidth = atoi(argv[6]);
+        sceneHeight = atoi(argv[7]);
     } else {
         printf("device error, use web or virtual");
         return -1;
     }
 
-    // Open qemu pipe
-    CameraQemuClient client;
-    int ret = client.connectClient(deviceName.c_str());
-    if (ret != NO_ERROR) {
-        printf("Failed to connect device\n");
-        return -1;
+    if (fake) {
+        std::vector<uint8_t> buf(width * height * 4);
+        Scene scene(width, height, kElectronsPerLuxSecond);
+        for (int i = 0 ; i < repeated; i++) {
+            nsecs_t start = systemTime();
+            if (pixFmt == V4L2_PIX_FMT_RGB32) {
+                captureRGBA(buf.data(), 0, width, height, scene, sceneWidth, sceneHeight);
+            } else {
+                captureYU12(buf.data(), 0, width, height, scene, sceneWidth, sceneHeight);
+            }
+            nsecs_t end = systemTime();
+            report.push_back(end - start);
+        }
     }
-    ret = client.queryConnect();
-    if (ret == NO_ERROR) {
-        printf("Connected to device\n");
-    } else {
-        printf("Failed to connect device\n");
-        return -1;
-    }
+    else {
+        if (argc > 6 && !strncmp(argv[6], "v1", 2)) {
+            v1 = true;
+        }
+        // Open qemu pipe
+        CameraQemuClient client;
+        int ret = client.connectClient(deviceName.c_str());
+        if (ret != NO_ERROR) {
+            printf("Failed to connect device\n");
+            return -1;
+        }
+        ret = client.queryConnect();
+        if (ret == NO_ERROR) {
+            printf("Connected to device\n");
+        } else {
+            printf("Failed to connect device\n");
+            return -1;
+        }
+        // Caputre ASAP
+        if (v1) {
+            //ret = client.queryStart();
+            ret = client.queryStart(pixFmt, width, height);
+        } else {
+            ret = client.queryStart(pixFmt, width, height);
+        }
+        if (ret != NO_ERROR) {
+            printf("Failed to configure device for query\n");
+            return -1;
+        }
+        if (v1) {
+            const CbManager::BufferUsageBits usage =
+                CbManager::BufferUsage::CAMERA_OUTPUT |
+                CbManager::BufferUsage::CAMERA_INPUT |
+                CbManager::BufferUsage::GPU_TEXTURE;
 
-    // Caputre ASAP
-    ret = client.queryStart(pixFmt, width, height);
-    if (ret != NO_ERROR) {
-        printf("Failed to configure device for query\n");
-        return -1;
+            native_handle_t* handle;
+            CbManager::YCbCrLayout ycbcr;
+            handle = cbmanager.allocateBuffer(width, height, cbFmt, usage);
+            void* addr;
+            if (cbFmt == CbManager::PixelFormat::RGBA_8888) {
+                cbmanager.lockBuffer(*handle, (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
+                               0, 0,
+                               width, height, &addr);
+            } else {
+                cbmanager.lockYCbCrBuffer(*handle,
+                                          (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
+                                          0, 0,
+                                          width, height,
+                                          &ycbcr);
+            }
+            uint64_t offset = ((cb_handle_t*)handle)->getMmapedOffset();
+            printf("offset is 0x%llx\n", offset);
+            float whiteBalance[] = {1.0f, 1.0f, 1.0f};
+            float exposureCompensation = 1.0f;
+            for (int i = 0 ; i < repeated; i++) {
+                nsecs_t start = systemTime();
+                client.queryFrame(width, height, pixFmt, offset,
+                                  whiteBalance[0], whiteBalance[1], whiteBalance[2],
+                                  exposureCompensation, nullptr);
+                nsecs_t end = systemTime();
+                report.push_back(end - start);
+            }
+            cbmanager.unlockBuffer(handle);
+        } else {
+            size_t bufferSize;
+            if (pixFmt == V4L2_PIX_FMT_RGB32) {
+                bufferSize = width * height * 4;
+            } else {
+                bufferSize = width * height * 12 / 8;
+            }
+            std::vector<char> buffer(bufferSize, 0);
+            float whiteBalance[] = {1.0f, 1.0f, 1.0f};
+            float exposureCompensation = 1.0f;
+            for (int i = 0 ; i < repeated; i++) {
+                nsecs_t start = systemTime();
+                client.queryFrame(buffer.data(), nullptr, 0, bufferSize,
+                                  whiteBalance[0], whiteBalance[1], whiteBalance[2],
+                                  exposureCompensation, nullptr);
+                nsecs_t end = systemTime();
+                report.push_back(end - start);
+            }
+        }
     }
-    size_t bufferSize;
-    if (pixFmt == V4L2_PIX_FMT_RGB32) {
-        bufferSize = width * height * 4;
-    } else {
-        bufferSize = width * height * 12 / 8;
-    }
-    std::vector<char> buffer(bufferSize, 0);
-    float whiteBalance[] = {1.0f, 1.0f, 1.0f};
-    float exposureCompensation = 1.0f;
-    std::vector<nsecs_t> report;
-    size_t repeated = 100;
-    for (int i = 0 ; i < repeated; i++) {
-        nsecs_t start = systemTime();
-        client.queryFrame(buffer.data(), nullptr, 0, bufferSize,
-                          whiteBalance[0], whiteBalance[1], whiteBalance[2],
-                          exposureCompensation, nullptr);
-        nsecs_t end = systemTime();
-        report.push_back(end - start);
-    }
-
     // Report
     nsecs_t average, sum = 0;
     for (int i = 0; i < repeated; i++) {
diff --git a/camera/GrallocModule.h b/camera/GrallocModule.h
deleted file mode 100644
index c6d4840..0000000
--- a/camera/GrallocModule.h
+++ /dev/null
@@ -1,44 +0,0 @@
-#ifndef EMU_CAMERA_GRALLOC_MODULE_H
-#define EMU_CAMERA_GRALLOC_MODULE_H
-
-#include <hardware/gralloc.h>
-#include <log/log.h>
-
-class GrallocModule
-{
-public:
-  static GrallocModule &getInstance() {
-    static GrallocModule instance;
-    return instance;
-  }
-
-  int lock(buffer_handle_t handle,
-      int usage, int l, int t, int w, int h, void **vaddr) {
-    return mModule->lock(mModule, handle, usage, l, t, w, h, vaddr);
-  }
-
-#ifdef GRALLOC_MODULE_API_VERSION_0_2
-  int lock_ycbcr(buffer_handle_t handle,
-      int usage, int l, int t, int w, int h,
-      struct android_ycbcr *ycbcr) {
-    return mModule->lock_ycbcr(mModule, handle, usage, l, t, w, h, ycbcr);
-  }
-#endif
-
-  int unlock(buffer_handle_t handle) {
-    return mModule->unlock(mModule, handle);
-  }
-
-private:
-  GrallocModule() {
-    const hw_module_t *module = NULL;
-    int ret = hw_get_module(GRALLOC_HARDWARE_MODULE_ID, &module);
-    if (ret) {
-      ALOGE("%s: Failed to get gralloc module: %d", __FUNCTION__, ret);
-    }
-    mModule = reinterpret_cast<const gralloc_module_t*>(module);
-  }
-  const gralloc_module_t *mModule;
-};
-
-#endif
diff --git a/camera/PreviewWindow.cpp b/camera/PreviewWindow.cpp
index aad54e2..63ab4e9 100755
--- a/camera/PreviewWindow.cpp
+++ b/camera/PreviewWindow.cpp
@@ -24,12 +24,12 @@
 #include <log/log.h>
 #include "EmulatedCameraDevice.h"
 #include "PreviewWindow.h"
-#include "GrallocModule.h"
 
 namespace android {
 
-PreviewWindow::PreviewWindow()
+PreviewWindow::PreviewWindow(CbManager* cbManager)
     : mPreviewWindow(NULL),
+      mCbManager(cbManager),
       mPreviewFrameWidth(0),
       mPreviewFrameHeight(0),
       mPreviewEnabled(false)
@@ -149,9 +149,11 @@
     /* Now let the graphics framework to lock the buffer, and provide
      * us with the framebuffer data address. */
     void* img = NULL;
-    res = GrallocModule::getInstance().lock(
-        *buffer, GRALLOC_USAGE_SW_WRITE_OFTEN,
-        0, 0, mPreviewFrameWidth, mPreviewFrameHeight, &img);
+    res = mCbManager->lockBuffer(
+        *cb_handle_t::from_unconst(*buffer),
+        (CbManager::BufferUsage::CPU_WRITE_OFTEN | 0),
+        0, 0, mPreviewFrameWidth, mPreviewFrameHeight,
+        &img);
     if (res != NO_ERROR) {
         ALOGE("%s: gralloc.lock failure: %d -> %s",
              __FUNCTION__, res, strerror(res));
@@ -172,7 +174,7 @@
         ALOGE("%s: Unable to obtain preview frame: %d", __FUNCTION__, res);
         mPreviewWindow->cancel_buffer(mPreviewWindow, buffer);
     }
-    GrallocModule::getInstance().unlock(*buffer);
+    mCbManager->unlockBuffer(*cb_handle_t::from_unconst(*buffer));
 }
 
 /***************************************************************************
diff --git a/camera/PreviewWindow.h b/camera/PreviewWindow.h
index ef988e5..22e9d03 100755
--- a/camera/PreviewWindow.h
+++ b/camera/PreviewWindow.h
@@ -17,6 +17,8 @@
 #ifndef HW_EMULATOR_CAMERA_PREVIEW_WINDOW_H
 #define HW_EMULATOR_CAMERA_PREVIEW_WINDOW_H
 
+#include "cbmanager.h"
+
 /*
  * Contains declaration of a class PreviewWindow that encapsulates functionality
  * of a preview window set via set_preview_window camera HAL API.
@@ -35,7 +37,7 @@
 class PreviewWindow {
 public:
     /* Constructs PreviewWindow instance. */
-    PreviewWindow();
+    PreviewWindow(CbManager* cbManager);
 
     /* Destructs PreviewWindow instance. */
     ~PreviewWindow();
@@ -133,6 +135,9 @@
     /* Preview window instance. */
     preview_stream_ops*             mPreviewWindow;
 
+    /* API to manipulate color buffers */
+    CbManager*                      mCbManager;
+
     /*
      * Cached preview window frame dimensions.
      */
diff --git a/camera/QemuClient.cpp b/camera/QemuClient.cpp
index 18beb69..6259043 100755
--- a/camera/QemuClient.cpp
+++ b/camera/QemuClient.cpp
@@ -34,7 +34,7 @@
 #endif  // LOG_QUERIES
 
 #define QEMU_PIPE_DEBUG  LOGQ
-#include "qemu_pipe.h"
+#include "qemud.h"
 
 namespace android {
 
@@ -226,20 +226,11 @@
 
     /* Select one of the two: 'factory', or 'emulated camera' service */
     if (param == NULL || *param == '\0') {
-        /* No parameters: connect to the factory service. */
-        char pipe_name[512];
-        snprintf(pipe_name, sizeof(pipe_name), "qemud:%s",
-                 mCameraServiceName);
-        mPipeFD = qemu_pipe_open(pipe_name);
+        mPipeFD = qemud_channel_open(mCameraServiceName);
     } else {
-        /* One extra char ':' that separates service name and parameters + six
-         * characters for 'pipe:qemud:'. This is required by pipe protocol. */
-        char* connection_str = new char[strlen(mCameraServiceName) +
-                                        strlen(param) + 8];
-        sprintf(connection_str, "qemud:%s:%s", mCameraServiceName, param);
-
-        mPipeFD = qemu_pipe_open(connection_str);
-        delete[] connection_str;
+        char buf[256];
+        snprintf(buf, sizeof(buf), "%s:%s", mCameraServiceName, param);
+        mPipeFD = qemud_channel_open(buf);
     }
     if (mPipeFD < 0) {
         ALOGE("%s: Unable to connect to the camera service '%s': %s",
@@ -267,13 +258,12 @@
         return EINVAL;
     }
 
-    const size_t written = TEMP_FAILURE_RETRY(write(mPipeFD, data, data_size));
-    if (written == data_size) {
-        return NO_ERROR;
-    } else {
+    if (qemu_pipe_write_fully(mPipeFD, data, data_size)) {
         ALOGE("%s: Error sending data via qemu pipe: '%s'",
              __FUNCTION__, strerror(errno));
         return errno ? errno : EIO;
+    } else {
+        return NO_ERROR;
     }
 }
 
@@ -293,8 +283,7 @@
      * value. Note also, that the string doesn't contain zero-terminator. */
     size_t payload_size;
     char payload_size_str[9];
-    int rd_res = TEMP_FAILURE_RETRY(read(mPipeFD, payload_size_str, 8));
-    if (rd_res != 8) {
+    if (qemu_pipe_read_fully(mPipeFD, payload_size_str, 8)) {
         ALOGE("%s: Unable to obtain payload size: %s",
              __FUNCTION__, strerror(errno));
         return errno ? errno : EIO;
@@ -316,16 +305,15 @@
              __FUNCTION__, payload_size);
         return ENOMEM;
     }
-    rd_res = TEMP_FAILURE_RETRY(read(mPipeFD, *data, payload_size));
-    if (static_cast<size_t>(rd_res) == payload_size) {
-        *data_size = payload_size;
-        return NO_ERROR;
-    } else {
-        ALOGE("%s: Read size %d doesnt match expected payload size %zu: %s",
-             __FUNCTION__, rd_res, payload_size, strerror(errno));
+    if (qemu_pipe_read_fully(mPipeFD, *data, payload_size)) {
+        ALOGE("%s: qemu_pipe_read_fully coud not read %zu bytes: %s",
+             __FUNCTION__, payload_size, strerror(errno));
         free(*data);
         *data = NULL;
         return errno ? errno : EIO;
+    } else {
+        *data_size = payload_size;
+        return NO_ERROR;
     }
 }
 
@@ -470,6 +458,17 @@
     return res;
 }
 
+status_t CameraQemuClient::queryStart() {
+    ALOGV("%s", __FUNCTION__);
+    QemuQuery query(mQueryStart);
+    doQuery(&query);
+    const status_t res = query.getCompletionStatus();
+    ALOGE_IF(res != NO_ERROR, "%s: Query failed: %s",
+            __FUNCTION__, query.mReplyData ? query.mReplyData :
+                                             "No error message");
+    return res;
+}
+
 status_t CameraQemuClient::queryStart(uint32_t pixel_format,
                                       int width,
                                       int height)
@@ -566,4 +565,44 @@
     return NO_ERROR;
 }
 
+status_t CameraQemuClient::queryFrame(int width,
+                                      int height,
+                                      uint32_t pixel_format,
+                                      uint64_t offset,
+                                      float r_scale,
+                                      float g_scale,
+                                      float b_scale,
+                                      float exposure_comp,
+                                      int64_t* frame_time)
+{
+    ALOGV("%s: w %d h %d %.4s offset 0x%llx", __FUNCTION__, width, height,
+          (char*)(&pixel_format), offset);
+
+    char query_str[256];
+    snprintf(query_str, sizeof(query_str), "%s dim=%dx%d pix=%d offset=%llu whiteb=%g,%g,%g expcomp=%g time=%d",
+             mQueryFrame, width, height, pixel_format, offset,
+             r_scale, g_scale, b_scale,
+             exposure_comp, frame_time != nullptr ? 1 : 0);
+    QemuQuery query(query_str);
+    doQuery(&query);
+    const status_t res = query.getCompletionStatus();
+    if( res != NO_ERROR) {
+        ALOGE("%s: Query failed: %s",
+             __FUNCTION__, query.mReplyData ? query.mReplyData :
+                                              "No error message");
+        return res;
+    }
+
+    /* Copy requested frames. */
+    const uint8_t* frame = reinterpret_cast<const uint8_t*>(query.mReplyData);
+    if (frame_time != nullptr) {
+        if (query.mReplyDataSize >= 8) {
+            *frame_time = *reinterpret_cast<const int64_t*>(frame);
+        } else {
+            *frame_time = 0L;
+        }
+    }
+
+    return NO_ERROR;
+}
 }; /* namespace android */
diff --git a/camera/QemuClient.h b/camera/QemuClient.h
index ff39608..f3f7b6d 100755
--- a/camera/QemuClient.h
+++ b/camera/QemuClient.h
@@ -385,6 +385,8 @@
      */
     status_t queryStart(uint32_t pixel_format, int width, int height);
 
+    status_t queryStart();
+
     /* Queries camera to stop capturing video.
      * Return:
      *  NO_ERROR on success, or an appropriate error status on failure.
@@ -419,6 +421,16 @@
      * Names of the queries available for the emulated camera.
      ***************************************************************************/
 
+    status_t queryFrame(int wdith,
+                        int height,
+                        uint32_t pixel_format,
+                        uint64_t offset,
+                        float r_scale,
+                        float g_scale,
+                        float b_scale,
+                        float exposure_comp,
+                        int64_t* frame_time);
+
 private:
     /* Connect to the camera. */
     static const char mQueryConnect[];
diff --git a/camera/Thumbnail.cpp b/camera/Thumbnail.cpp
index 8f901a3..d3472a4 100644
--- a/camera/Thumbnail.cpp
+++ b/camera/Thumbnail.cpp
@@ -27,40 +27,14 @@
 #include <vector>
 
 /*
- * The NV21 format is a YUV format with an 8-bit Y-component and the U and V
+ * The YU12 format is a YUV format with an 8-bit Y-component and the U and V
  * components are stored as 8 bits each but they are shared between a block of
  * 2x2 pixels. So when calculating bits per pixel the 16 bits of U and V are
  * shared between 4 pixels leading to 4 bits of U and V per pixel. Together
  * with the 8 bits of Y this gives us 12 bits per pixel..
  *
- * The components are not grouped by pixels but separated into one Y-plane and
- * one interleaved U and V-plane. The first half of the byte sequence is all of
- * the Y data laid out in a linear fashion. After that the interleaved U and V-
- * plane starts with one byte of V followed by one byte of U followed by one
- * byte of V and so on. Each byte of U or V is associated with a 2x2 pixel block
- * in a linear fashion.
- *
- * For an 8 by 4 pixel image the layout would be:
- *
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | Y0  | Y1  | Y2  | Y3  | Y4  | Y5  | Y6  | Y7  |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | Y8  | Y9  | Y10 | Y11 | Y12 | Y13 | Y14 | Y15 |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | Y16 | Y17 | Y18 | Y19 | Y20 | Y21 | Y22 | Y23 |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | Y24 | Y25 | Y26 | Y27 | Y28 | Y29 | Y30 | Y31 |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | V0  | U0  | V1  | U1  | V2  | U2  | V3  | U3  |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- * | V4  | U4  | V5  | U5  | V6  | U6  | V7  | U7  |
- * +-----+-----+-----+-----+-----+-----+-----+-----+
- *
- * In this image V0 and U0 are the V and U components for the 2x2 block of
- * pixels whose Y components are Y0, Y1, Y8 and Y9. V1 and U1 are matched with
- * the Y components Y2, Y3, Y10, Y11, and so on for that row. For the next row
- * of V and U the V4 and U4 components would be paired with Y16, Y17, Y24 and
- * Y25.
+ * The components are not grouped by pixels but separated into one Y-plane, one
+ * U-plane and one V-plane.
  */
 
 namespace android {
@@ -69,20 +43,9 @@
                                int sourceWidth, int sourceHeight,
                                int thumbnailWidth, int thumbnailHeight,
                                std::vector<unsigned char>* thumbnail) {
-    // Deinterleave the U and V planes into separate planes, this is because
-    // libyuv requires the planes to be separate when scaling
-    const size_t sourceUVPlaneSize = (sourceWidth * sourceHeight) / 4;
-    // Put both U and V planes in one buffer, one after the other, to reduce
-    // memory fragmentation and number of allocations
-    std::vector<unsigned char> sourcePlanes(sourceUVPlaneSize * 2);
     const unsigned char* ySourcePlane = sourceImage;
-    unsigned char* uSourcePlane = &sourcePlanes[0];
-    unsigned char* vSourcePlane = &sourcePlanes[sourceUVPlaneSize];
-
-    for (size_t i = 0; i < sourceUVPlaneSize; ++i) {
-        vSourcePlane[i] = sourceImage[sourceWidth * sourceHeight + i * 2 + 0];
-        uSourcePlane[i] = sourceImage[sourceWidth * sourceHeight + i * 2 + 1];
-    }
+    const unsigned char* uSourcePlane = sourceImage + sourceWidth * sourceHeight;
+    const unsigned char* vSourcePlane = uSourcePlane + sourceWidth * sourceHeight / 4;
 
     // Create enough space in the output vector for the result
     thumbnail->resize((thumbnailWidth * thumbnailHeight * 12) / 8);
@@ -92,8 +55,8 @@
     const size_t destUVPlaneSize = (thumbnailWidth * thumbnailHeight) / 4;
     std::vector<unsigned char> destPlanes(destUVPlaneSize * 2);
     unsigned char* yDestPlane = &(*thumbnail)[0];
-    unsigned char* uDestPlane = &destPlanes[0];
-    unsigned char* vDestPlane = &destPlanes[destUVPlaneSize];
+    unsigned char* uDestPlane = yDestPlane + thumbnailWidth * thumbnailHeight;
+    unsigned char* vDestPlane = uDestPlane + thumbnailWidth * thumbnailHeight / 4;
 
     // The strides for the U and V planes are half the width because the U and V
     // components are common to 2x2 pixel blocks
@@ -112,14 +75,6 @@
         return false;
     }
 
-    // Now we need to interleave the downscaled U and V planes into the
-    // output buffer to make it NV21 encoded
-    const size_t uvPlanesOffset = thumbnailWidth * thumbnailHeight;
-    for (size_t i = 0; i < destUVPlaneSize; ++i) {
-        (*thumbnail)[uvPlanesOffset + i * 2 + 0] = vDestPlane[i];
-        (*thumbnail)[uvPlanesOffset + i * 2 + 1] = uDestPlane[i];
-    }
-
     return true;
 }
 
diff --git a/camera/fake-pipeline2/JpegCompressor.cpp b/camera/fake-pipeline2/JpegCompressor.cpp
index 51de0c0..08d1570 100644
--- a/camera/fake-pipeline2/JpegCompressor.cpp
+++ b/camera/fake-pipeline2/JpegCompressor.cpp
@@ -29,12 +29,13 @@
 
 namespace android {
 
-JpegCompressor::JpegCompressor():
+JpegCompressor::JpegCompressor(CbManager* cbManager):
         Thread(false),
         mIsBusy(false),
         mSynchronous(false),
         mBuffers(NULL),
-        mListener(NULL) {
+        mListener(NULL),
+        mCbManager(cbManager) {
 }
 
 JpegCompressor::~JpegCompressor() {
@@ -187,7 +188,7 @@
     // Refer to /hardware/libhardware/include/hardware/camera3.h
     // Transport header for compressed JPEG buffers in output streams.
     camera3_jpeg_blob_t jpeg_blob;
-    cb_handle_t *cb = (cb_handle_t *)(*mJpegBuffer.buffer);
+    const cb_handle_t *cb = cb_handle_t::from(*mJpegBuffer.buffer);
     jpeg_blob.jpeg_blob_id = CAMERA3_JPEG_BLOB_ID;
     jpeg_blob.jpeg_size = nV21JpegCompressor.getCompressedSize();
     memcpy(mJpegBuffer.img + cb->width - sizeof(camera3_jpeg_blob_t),
@@ -227,7 +228,14 @@
 
     if (mFoundAux) {
         if (mAuxBuffer.streamId == 0) {
-            delete[] mAuxBuffer.img;
+            if (mAuxBuffer.buffer == nullptr) {
+                delete[] mAuxBuffer.img;
+            } else {
+                cb_handle_t* cb = cb_handle_t::from_unconst(*mAuxBuffer.buffer);
+
+                mCbManager->unlockBuffer(*cb);
+                mCbManager->freeBuffer(cb);
+            }
         } else if (!mSynchronous) {
             mListener->onJpegInputDone(mAuxBuffer);
         }
diff --git a/camera/fake-pipeline2/JpegCompressor.h b/camera/fake-pipeline2/JpegCompressor.h
index 7a78ef7..2d6e80a 100644
--- a/camera/fake-pipeline2/JpegCompressor.h
+++ b/camera/fake-pipeline2/JpegCompressor.h
@@ -30,6 +30,7 @@
 
 #include "Base.h"
 #include "../JpegCompressor.h"
+#include "cbmanager.h"
 #include <CameraMetadata.h>
 
 #include <stdio.h>
@@ -45,7 +46,7 @@
 class JpegCompressor: private Thread, public virtual RefBase {
   public:
 
-    JpegCompressor();
+    JpegCompressor(CbManager* cbManager);
     ~JpegCompressor();
 
     struct JpegListener {
@@ -89,6 +90,7 @@
 
     Buffers *mBuffers;
     JpegListener *mListener;
+    CbManager *mCbManager;
 
     StreamBuffer mJpegBuffer, mAuxBuffer;
     bool mFoundJpeg, mFoundAux;
diff --git a/camera/fake-pipeline2/Scene.cpp b/camera/fake-pipeline2/Scene.cpp
index 11beee7..1bfd216 100644
--- a/camera/fake-pipeline2/Scene.cpp
+++ b/camera/fake-pipeline2/Scene.cpp
@@ -42,8 +42,8 @@
 
 const int Scene::kSceneWidth = 20;
 const int Scene::kSceneHeight = 20;
-const int Scene::kMaxWidth = 640;
-const int Scene::kMaxHeight = 480;
+const int Scene::kMaxWidth = 20;
+const int Scene::kMaxHeight = 20;
 
 const uint8_t Scene::kScene[Scene::kSceneWidth * Scene::kSceneHeight] = {
     //      5         10        15        20
@@ -343,13 +343,13 @@
 
 // Handshake model constants.
 // Frequencies measured in a nanosecond timebase
-const float Scene::kHorizShakeFreq1 = 2 * M_PI * 2  / 1e9; // 2 Hz
-const float Scene::kHorizShakeFreq2 = 2 * M_PI * 13 / 1e9; // 13 Hz
-const float Scene::kVertShakeFreq1  = 2 * M_PI * 3  / 1e9; // 3 Hz
-const float Scene::kVertShakeFreq2  = 2 * M_PI * 11 / 1e9; // 1 Hz
+const float Scene::kHorizShakeFreq1 = 2 * M_PI * 1  / 1e9; // 1 Hz
+const float Scene::kHorizShakeFreq2 = 2 * M_PI * 1 / 1e9; // 1 Hz
+const float Scene::kVertShakeFreq1  = 2 * M_PI * 1  / 1e9; // 1 Hz
+const float Scene::kVertShakeFreq2  = 2 * M_PI * 1 / 1e9; // 1 Hz
 const float Scene::kFreq1Magnitude  = 5;
 const float Scene::kFreq2Magnitude  = 1;
-const float Scene::kShakeFraction   = 0.03; // As a fraction of a scene tile
+const float Scene::kShakeFraction   = 0.2; // As a fraction of a scene tile
 
 // RGB->YUV, Jpeg standard
 const float Scene::kRgb2Yuv[12] = {
diff --git a/camera/fake-pipeline2/Sensor.cpp b/camera/fake-pipeline2/Sensor.cpp
index fcbc4cd..064f48f 100644
--- a/camera/fake-pipeline2/Sensor.cpp
+++ b/camera/fake-pipeline2/Sensor.cpp
@@ -17,6 +17,7 @@
 //#define LOG_NDEBUG 0
 //#define LOG_NNDEBUG 0
 #define LOG_TAG "EmulatedCamera2_Sensor"
+#define ATRACE_TAG ATRACE_TAG_CAMERA
 
 #ifdef LOG_NNDEBUG
 #define ALOGVV(...) ALOGV(__VA_ARGS__)
@@ -25,6 +26,7 @@
 #endif
 
 #include <log/log.h>
+#include <utils/Trace.h>
 
 #include "../EmulatedFakeCamera2.h"
 #include "Sensor.h"
@@ -227,6 +229,7 @@
 }
 
 bool Sensor::threadLoop() {
+    ATRACE_CALL();
     /**
      * Sensor capture operation main loop.
      *
@@ -387,6 +390,7 @@
 };
 
 void Sensor::captureRaw(uint8_t *img, uint32_t gain, uint32_t stride) {
+    ATRACE_CALL();
     float totalGain = gain/100.0 * kBaseGainFactor;
     float noiseVarGain =  totalGain * totalGain;
     float readNoiseVar = kReadNoiseVarBeforeGain * noiseVarGain
@@ -428,6 +432,7 @@
 }
 
 void Sensor::captureRGBA(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height) {
+    ATRACE_CALL();
     float totalGain = gain/100.0 * kBaseGainFactor;
     // In fixed-point math, calculate total scaling from electrons to 8bpp
     int scale64x = 64 * totalGain * 255 / kMaxRawValue;
@@ -466,6 +471,7 @@
 }
 
 void Sensor::captureRGB(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height) {
+    ATRACE_CALL();
     float totalGain = gain/100.0 * kBaseGainFactor;
     // In fixed-point math, calculate total scaling from electrons to 8bpp
     int scale64x = 64 * totalGain * 255 / kMaxRawValue;
@@ -501,6 +507,7 @@
 }
 
 void Sensor::captureYU12(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height) {
+    ATRACE_CALL();
     float totalGain = gain/100.0 * kBaseGainFactor;
     // Using fixed-point math with 6 bits of fractional precision.
     // In fixed-point math, calculate total scaling from electrons to 8bpp
@@ -528,7 +535,6 @@
     for (unsigned int outY = 0; outY < height; outY++) {
         unsigned int y = outY * DivH >> 10;
         uint8_t *pxY = img + outY * width;
-        uint8_t *pxVU = img + (height + outY / 2) * width;
         uint8_t *pxU = img + height * width + (outY / 2) * (width / 2);
         uint8_t *pxV = pxU + (height / 2) * (width / 2);
         mScene.setReadoutPixel(0, y);
@@ -560,6 +566,7 @@
 }
 
 void Sensor::captureDepth(uint8_t *img, uint32_t gain, uint32_t width, uint32_t height) {
+    ATRACE_CALL();
     float totalGain = gain/100.0 * kBaseGainFactor;
     // In fixed-point math, calculate scaling factor to 13bpp millimeters
     int scale64x = 64 * totalGain * 8191 / kMaxRawValue;
@@ -591,7 +598,7 @@
 }
 
 void Sensor::captureDepthCloud(uint8_t *img) {
-
+    ATRACE_CALL();
     android_depth_points *cloud = reinterpret_cast<android_depth_points*>(img);
 
     cloud->num_points = 16;
diff --git a/camera/jpeg-stub/Compressor.cpp b/camera/jpeg-stub/Compressor.cpp
index 3fe0bd6..02a05fd 100644
--- a/camera/jpeg-stub/Compressor.cpp
+++ b/camera/jpeg-stub/Compressor.cpp
@@ -33,7 +33,6 @@
         // provide here so just return.
         return false;
     }
-
     return compressData(data, exifData);
 }
 
@@ -80,24 +79,6 @@
     return true;
 }
 
-static void deinterleave(const uint8_t* vuPlanar, std::vector<uint8_t>& uRows,
-                         std::vector<uint8_t>& vRows, int rowIndex, int width,
-                         int height, int stride) {
-    int numRows = (height - rowIndex) / 2;
-    if (numRows > 8) numRows = 8;
-    for (int row = 0; row < numRows; ++row) {
-        int offset = ((rowIndex >> 1) + row) * stride;
-        const uint8_t* vu = vuPlanar + offset;
-        for (int i = 0; i < (width >> 1); ++i) {
-            int index = row * (width >> 1) + i;
-            uRows[index] = vu[1];
-            vRows[index] = vu[0];
-            vu += 2;
-        }
-    }
-}
-
-
 bool Compressor::compressData(const unsigned char* data, ExifData* exifData) {
     const uint8_t* y[16];
     const uint8_t* cb[8];
@@ -108,9 +89,8 @@
     int width = mCompressInfo.image_width;
     int height = mCompressInfo.image_height;
     const uint8_t* yPlanar = data;
-    const uint8_t* vuPlanar = data + (width * height);
-    std::vector<uint8_t> uRows(8 * (width >> 1));
-    std::vector<uint8_t> vRows(8 * (width >> 1));
+    const uint8_t* uPlanar = yPlanar + width * height;
+    const uint8_t* vPlanar = uPlanar + width * height / 4;
 
     // NOTE! DANGER! Do not construct any non-trivial objects below setjmp!
     // The compiler will not generate code to destroy them during the return
@@ -128,10 +108,6 @@
 
     // process 16 lines of Y and 8 lines of U/V each time.
     while (mCompressInfo.next_scanline < mCompressInfo.image_height) {
-        //deinterleave u and v
-        deinterleave(vuPlanar, uRows, vRows, mCompressInfo.next_scanline,
-                     width, height, width);
-
         // Jpeg library ignores the rows whose indices are greater than height.
         for (i = 0; i < 16; i++) {
             // y row
@@ -140,11 +116,10 @@
             // construct u row and v row
             if ((i & 1) == 0) {
                 // height and width are both halved because of downsampling
-                offset = (i >> 1) * (width >> 1);
-                cb[i/2] = &uRows[offset];
-                cr[i/2] = &vRows[offset];
+                cb[i/2] = uPlanar + (mCompressInfo.next_scanline + i) * width / 4;
+                cr[i/2] = vPlanar + (mCompressInfo.next_scanline + i) * width / 4;
             }
-          }
+        }
         jpeg_write_raw_data(&mCompressInfo, const_cast<JSAMPIMAGE>(planes), 16);
     }
 
diff --git a/camera/media_codecs_google_video_default.xml b/camera/media_codecs_google_video_default.xml
index 75f4264..d8b40a5 100644
--- a/camera/media_codecs_google_video_default.xml
+++ b/camera/media_codecs_google_video_default.xml
@@ -35,6 +35,26 @@
             <Limit name="performance-point-1920x1080" value="30" />
             <Feature name="adaptive-playback" />
         </MediaCodec>
+        <MediaCodec name="OMX.android.goldfish.h264.decoder" type="video/avc">
+            <!-- profiles and levels:  ProfileHigh : Level41 -->
+            <Limit name="size" min="16x16" max="1920x1088" />
+            <Limit name="alignment" value="2x2" />
+            <Limit name="block-size" value="16x16" />
+            <Limit name="blocks-per-second" range="1-244800" />
+            <Limit name="bitrate" range="1-12000000" />
+            <Limit name="performance-point-1920x1080" value="30" />
+            <Feature name="adaptive-playback" />
+        </MediaCodec>
+        <MediaCodec name="OMX.google.goldfish.h264.decoder" type="video/avc">
+            <!-- profiles and levels:  ProfileHigh : Level41 -->
+            <Limit name="size" min="16x16" max="1920x1088" />
+            <Limit name="alignment" value="2x2" />
+            <Limit name="block-size" value="16x16" />
+            <Limit name="blocks-per-second" range="1-244800" />
+            <Limit name="bitrate" range="1-12000000" />
+            <Limit name="performance-point-1920x1080" value="30" />
+            <Feature name="adaptive-playback" />
+        </MediaCodec>
         <MediaCodec name="OMX.google.h264.decoder" type="video/avc">
             <!-- profiles and levels:  ProfileHigh : Level41 -->
             <Limit name="size" min="16x16" max="1920x1088" />
@@ -56,6 +76,26 @@
             <Limit name="performance-point-1920x1080" value="30" />
             <Feature name="adaptive-playback" />
         </MediaCodec>
+        <MediaCodec name="OMX.google.goldfish.vp8.decoder" type="video/x-vnd.on2.vp8">
+            <Limit name="size" min="2x2" max="2560x2560" />
+            <Limit name="alignment" value="2x2" />
+            <Limit name="block-size" value="16x16" />
+            <Limit name="block-count" range="1-25600" />
+            <Limit name="blocks-per-second" range="1-1536000" />
+            <Limit name="bitrate" range="1-40000000" />
+            <Limit name="performance-point-1920x1080" value="30" />
+            <Feature name="adaptive-playback" />
+        </MediaCodec>
+        <MediaCodec name="OMX.google.goldfish.vp9.decoder" type="video/x-vnd.on2.vp9">
+            <Limit name="size" min="2x2" max="2560x2560" />
+            <Limit name="alignment" value="2x2" />
+            <Limit name="block-size" value="16x16" />
+            <Limit name="block-count" range="1-25600" />
+            <Limit name="blocks-per-second" range="1-768000" />
+            <Limit name="bitrate" range="1-40000000" />
+            <Limit name="performance-point-1920x1080" value="30" />
+            <Feature name="adaptive-playback" />
+        </MediaCodec>
         <MediaCodec name="OMX.google.vp8.decoder" type="video/x-vnd.on2.vp8">
             <Limit name="size" min="2x2" max="2048x2048" />
             <Limit name="alignment" value="2x2" />
diff --git a/camera/qemu-pipeline3/QemuSensor.cpp b/camera/qemu-pipeline3/QemuSensor.cpp
index f4560d0..5a20ed2 100644
--- a/camera/qemu-pipeline3/QemuSensor.cpp
+++ b/camera/qemu-pipeline3/QemuSensor.cpp
@@ -21,6 +21,7 @@
 //#define LOG_NNDEBUG 0
 
 #define LOG_TAG "EmulatedCamera3_QemuSensor"
+#define ATRACE_TAG ATRACE_TAG_CAMERA
 
 #ifdef LOG_NNDEBUG
 #define ALOGVV(...) ALOGV(__VA_ARGS__)
@@ -28,6 +29,7 @@
 #define ALOGVV(...) ((void)0)
 #endif
 
+#include "cbmanager.h"
 #include "qemu-pipeline3/QemuSensor.h"
 #include "system/camera_metadata.h"
 
@@ -35,6 +37,8 @@
 #include <cstdlib>
 #include <linux/videodev2.h>
 #include <log/log.h>
+#include <cutils/properties.h>
+#include <utils/Trace.h>
 
 namespace android {
 
@@ -47,7 +51,10 @@
 const int32_t QemuSensor::kSensitivityRange[2] = {100, 1600};
 const uint32_t QemuSensor::kDefaultSensitivity = 100;
 
-QemuSensor::QemuSensor(const char *deviceName, uint32_t width, uint32_t height):
+const char QemuSensor::kHostCameraVerString[] = "ro.kernel.qemu.camera_protocol_ver";
+
+QemuSensor::QemuSensor(const char *deviceName, uint32_t width, uint32_t height,
+                       CbManager* cbManager):
         Thread(false),
         mWidth(width),
         mHeight(height),
@@ -56,12 +63,14 @@
         mLastRequestHeight(-1),
         mCameraQemuClient(),
         mDeviceName(deviceName),
+        mCbManager(cbManager),
         mGotVSync(false),
         mFrameDuration(kFrameDurationRange[0]),
         mNextBuffers(nullptr),
         mFrameNumber(0),
         mCapturedBuffers(nullptr),
         mListener(nullptr) {
+    mHostCameraVer = property_get_int32(kHostCameraVerString, 0);
     ALOGV("QemuSensor created with pixel array %d x %d", width, height);
 }
 
@@ -187,6 +196,7 @@
 }
 
 bool QemuSensor::threadLoop() {
+    ATRACE_CALL();
     /*
      * Stages are out-of-order relative to a single frame's processing, but
      * in-order in time.
@@ -280,7 +290,11 @@
                     captureRGB(b.img, b.width, b.height, b.stride, &timestamp);
                     break;
                 case HAL_PIXEL_FORMAT_RGBA_8888:
-                    captureRGBA(b.img, b.width, b.height, b.stride, &timestamp);
+                    if (mHostCameraVer == 1) {
+                        captureRGBA(b.width, b.height, b.stride, &timestamp, b.buffer);
+                    } else {
+                        captureRGBA(b.img, b.width, b.height, b.stride, &timestamp);
+                    }
                     break;
                 case HAL_PIXEL_FORMAT_BLOB:
                     if (b.dataSpace == HAL_DATASPACE_DEPTH) {
@@ -296,14 +310,40 @@
                         bAux.height = b.height;
                         bAux.format = HAL_PIXEL_FORMAT_YCbCr_420_888;
                         bAux.stride = b.width;
-                        bAux.buffer = nullptr;
-                        // TODO: Reuse these.
-                        bAux.img = new uint8_t[b.width * b.height * 3];
+                        if (mHostCameraVer == 1) {
+                            const CbManager::BufferUsageBits usage =
+                                CbManager::BufferUsage::CAMERA_OUTPUT |
+                                CbManager::BufferUsage::CAMERA_INPUT |
+                                CbManager::BufferUsage::GPU_TEXTURE;
+
+                            cb_handle_t *cb_handle = (cb_handle_t*)mCbManager->allocateBuffer(
+                                bAux.width, bAux.height,
+                                CbManager::PixelFormat(bAux.format), usage);
+
+                            CbManager::YCbCrLayout ycbcr = {};
+                            mCbManager->lockYCbCrBuffer(*(native_handle_t*)cb_handle,
+                                                        (CbManager::BufferUsage::CAMERA_OUTPUT | 0),
+                                                        0, 0,
+                                                        bAux.width, bAux.height,
+                                                        &ycbcr);
+
+                            bAux.buffer = new buffer_handle_t;
+                            *bAux.buffer = cb_handle;
+                            bAux.img = (uint8_t*)ycbcr.y;
+                        } else {
+                            bAux.buffer = nullptr;
+                            // TODO: Reuse these.
+                            bAux.img = new uint8_t[b.width * b.height * 3];
+                        }
                         mNextCapturedBuffers->push_back(bAux);
                     }
                     break;
                 case HAL_PIXEL_FORMAT_YCbCr_420_888:
-                    captureYU12(b.img, b.width, b.height, b.stride, &timestamp);
+                    if (mHostCameraVer == 1) {
+                        captureYU12(b.width, b.height, b.stride, &timestamp, b.buffer);
+                    } else {
+                        captureYU12(b.img, b.width, b.height, b.stride, &timestamp);
+                    }
                     break;
                 default:
                     ALOGE("%s: Unknown/unsupported format %x, no output",
@@ -343,6 +383,7 @@
 
 void QemuSensor::captureRGBA(uint8_t *img, uint32_t width, uint32_t height,
         uint32_t stride, int64_t *timestamp) {
+    ATRACE_CALL();
     status_t res;
     if (width != (uint32_t)mLastRequestWidth ||
         height != (uint32_t)mLastRequestHeight) {
@@ -395,14 +436,52 @@
     }
 
     // Since the format is V4L2_PIX_FMT_RGB32, we need 4 bytes per pixel.
-    size_t bufferSize = width * height * 4;
-    // Apply no white balance or exposure compensation.
+      size_t bufferSize = width * height * 4;
+      // Apply no white balance or exposure compensation.
+      float whiteBalance[] = {1.0f, 1.0f, 1.0f};
+      float exposureCompensation = 1.0f;
+      // Read from webcam.
+      mCameraQemuClient.queryFrame(nullptr, img, 0, bufferSize, whiteBalance[0],
+              whiteBalance[1], whiteBalance[2],
+              exposureCompensation, timestamp);
+
+    ALOGVV("RGBA sensor image captured");
+}
+
+void QemuSensor::captureRGBA(uint32_t width, uint32_t height,
+        uint32_t stride, int64_t *timestamp, buffer_handle_t* handle) {
+    ATRACE_CALL();
+    status_t res;
+    if (mLastRequestWidth == -1 || mLastRequestHeight == -1) {
+        uint32_t pixFmt = V4L2_PIX_FMT_YUV420;
+        res = mCameraQemuClient.queryStart();
+        if (res == NO_ERROR) {
+            mLastRequestWidth = width;
+            mLastRequestHeight = height;
+            ALOGV("%s: Qemu camera device '%s' is started for %.4s[%dx%d] frames",
+                    __FUNCTION__, (const char*) mDeviceName,
+                    reinterpret_cast<const char*>(&pixFmt),
+                    mWidth, mHeight);
+            mState = ECDS_STARTED;
+        } else {
+            ALOGE("%s: Unable to start device '%s' for %.4s[%dx%d] frames",
+                    __FUNCTION__, (const char*) mDeviceName,
+                    reinterpret_cast<const char*>(&pixFmt),
+                    mWidth, mHeight);
+            return;
+        }
+    }
+    if (width != stride) {
+        ALOGW("%s: expect stride (%d), actual stride (%d)", __FUNCTION__,
+              width, stride);
+    }
+
     float whiteBalance[] = {1.0f, 1.0f, 1.0f};
     float exposureCompensation = 1.0f;
-    // Read from webcam.
-    mCameraQemuClient.queryFrame(nullptr, img, 0, bufferSize, whiteBalance[0],
-            whiteBalance[1], whiteBalance[2],
-            exposureCompensation, timestamp);
+    const uint64_t offset = CbManager::getOffset(*handle);
+    mCameraQemuClient.queryFrame(width, height, V4L2_PIX_FMT_RGB32, offset,
+                                 whiteBalance[0], whiteBalance[1], whiteBalance[2],
+                                 exposureCompensation, timestamp);
 
     ALOGVV("RGBA sensor image captured");
 }
@@ -411,7 +490,9 @@
     ALOGE("%s: Not implemented", __FUNCTION__);
 }
 
-void QemuSensor::captureYU12(uint8_t *img, uint32_t width, uint32_t height, uint32_t stride, int64_t *timestamp) {
+void QemuSensor::captureYU12(uint8_t *img, uint32_t width, uint32_t height, uint32_t stride,
+                             int64_t *timestamp) {
+    ATRACE_CALL();
     status_t res;
     if (width != (uint32_t)mLastRequestWidth ||
         height != (uint32_t)mLastRequestHeight) {
@@ -422,7 +503,6 @@
 
         if (mLastRequestWidth != -1 || mLastRequestHeight != -1) {
             // We only need to stop the camera if this isn't the first request.
-
             // Stop the camera device.
             res = mCameraQemuClient.queryStop();
             if (res == NO_ERROR) {
@@ -476,4 +556,41 @@
     ALOGVV("YUV420 sensor image captured");
 }
 
+void QemuSensor::captureYU12(uint32_t width, uint32_t height, uint32_t stride,
+                             int64_t *timestamp, buffer_handle_t* handle) {
+    ATRACE_CALL();
+    status_t res;
+    if (mLastRequestWidth == -1 || mLastRequestHeight == -1) {
+        uint32_t pixFmt = V4L2_PIX_FMT_YUV420;
+        res = mCameraQemuClient.queryStart();
+        if (res == NO_ERROR) {
+            mLastRequestWidth = width;
+            mLastRequestHeight = height;
+            ALOGV("%s: Qemu camera device '%s' is started for %.4s[%dx%d] frames",
+                    __FUNCTION__, (const char*) mDeviceName,
+                    reinterpret_cast<const char*>(&pixFmt),
+                    mWidth, mHeight);
+            mState = ECDS_STARTED;
+        } else {
+            ALOGE("%s: Unable to start device '%s' for %.4s[%dx%d] frames",
+                    __FUNCTION__, (const char*) mDeviceName,
+                    reinterpret_cast<const char*>(&pixFmt),
+                    mWidth, mHeight);
+            return;
+        }
+    }
+    if (width != stride) {
+        ALOGW("%s: expect stride (%d), actual stride (%d)", __FUNCTION__,
+              width, stride);
+    }
+
+    float whiteBalance[] = {1.0f, 1.0f, 1.0f};
+    float exposureCompensation = 1.0f;
+    const uint64_t offset = CbManager::getOffset(*handle);
+    mCameraQemuClient.queryFrame(width, height, V4L2_PIX_FMT_YUV420, offset,
+                                 whiteBalance[0], whiteBalance[1], whiteBalance[2],
+                                 exposureCompensation, timestamp);
+    ALOGVV("YUV420 sensor image captured");
+}
+
 }; // end of namespace android
diff --git a/camera/qemu-pipeline3/QemuSensor.h b/camera/qemu-pipeline3/QemuSensor.h
index a39d3e5..ce88b3c 100644
--- a/camera/qemu-pipeline3/QemuSensor.h
+++ b/camera/qemu-pipeline3/QemuSensor.h
@@ -28,6 +28,7 @@
 
 #include "fake-pipeline2/Base.h"
 #include "QemuClient.h"
+#include "cbmanager.h"
 
 #include <utils/Mutex.h>
 #include <utils/Thread.h>
@@ -46,7 +47,8 @@
     *     width: Width of pixel array.
     *     height: Height of pixel array.
     */
-    QemuSensor(const char *deviceName, uint32_t width, uint32_t height);
+    QemuSensor(const char *deviceName, uint32_t width, uint32_t height,
+               CbManager* cbManager);
     ~QemuSensor();
 
     /*
@@ -123,6 +125,8 @@
     static const int32_t kSensitivityRange[2];
     static const uint32_t kDefaultSensitivity;
 
+    static const char kHostCameraVerString[];
+
   private:
     int32_t mLastRequestWidth, mLastRequestHeight;
 
@@ -144,6 +148,7 @@
 
     CameraQemuClient mCameraQemuClient;
     const char *mDeviceName;
+    CbManager* mCbManager;
 
     // Always lock before accessing control parameters.
     Mutex mControlMutex;
@@ -169,6 +174,7 @@
 
     // Time of sensor startup (used for simulation zero-time point).
     nsecs_t mStartupTime;
+    int32_t mHostCameraVer;
 
   private:
     /*
@@ -186,12 +192,16 @@
     nsecs_t mNextCaptureTime;
     Buffers *mNextCapturedBuffers;
 
+    void captureRGBA(uint32_t width, uint32_t height, uint32_t stride,
+                     int64_t *timestamp, buffer_handle_t* handle);
+    void captureYU12(uint32_t width, uint32_t height, uint32_t stride,
+                     int64_t *timestamp, buffer_handle_t* handle);
     void captureRGBA(uint8_t *img, uint32_t width, uint32_t height,
-            uint32_t stride, int64_t *timestamp);
-    void captureRGB(uint8_t *img, uint32_t width, uint32_t height,
-            uint32_t stride, int64_t *timestamp);
+                     uint32_t stride, int64_t *timestamp);
     void captureYU12(uint8_t *img, uint32_t width, uint32_t height,
-            uint32_t stride, int64_t *timestamp);
+                     uint32_t stride, int64_t *timestamp);
+    void captureRGB(uint8_t *img, uint32_t width, uint32_t height,
+                    uint32_t stride, int64_t *timestamp);
 };
 
 }; // end of namespace android
diff --git a/data/etc/advancedFeatures.ini b/data/etc/advancedFeatures.ini
index 731e3f5..56ff712 100644
--- a/data/etc/advancedFeatures.ini
+++ b/data/etc/advancedFeatures.ini
@@ -12,3 +12,6 @@
 DynamicPartition = on
 YUVCache = on
 MultiDisplay = on
+GLDirectMem = on
+VulkanNullOptionalStrings = on
+VulkanIgnoredHandles = on
diff --git a/data/etc/permissions/privapp-permissions-goldfish.xml b/data/etc/permissions/privapp-permissions-goldfish.xml
index 8f9643b..ad537d0 100644
--- a/data/etc/permissions/privapp-permissions-goldfish.xml
+++ b/data/etc/permissions/privapp-permissions-goldfish.xml
@@ -22,11 +22,6 @@
 -->
 
 <permissions>
-    <privapp-permissions package="com.android.sdksetup">
-        <permission name="android.permission.BACKUP"/>
-        <permission name="android.permission.MANAGE_USERS"/>
-        <permission name="android.permission.WRITE_SECURE_SETTINGS"/>
-    </privapp-permissions>
     <privapp-permissions package="com.android.dialer">
         <permission name="android.permission.STATUS_BAR"/>
     </privapp-permissions>
diff --git a/data/etc/user/advancedFeatures.ini b/data/etc/user/advancedFeatures.ini
index 6c45030..2c6e877 100644
--- a/data/etc/user/advancedFeatures.ini
+++ b/data/etc/user/advancedFeatures.ini
@@ -11,3 +11,6 @@
 RefCountPipe = on
 VirtioInput = on
 DynamicPartition = on
+GLDirectMem = on
+VulkanNullOptionalStrings = on
+VulkanIgnoredHandles = on
diff --git a/emulator-info.txt b/emulator-info.txt
index 5235a63..c2f1fdc 100644
--- a/emulator-info.txt
+++ b/emulator-info.txt
@@ -1,2 +1,2 @@
 # Emulator (stable) version
-require version-emulator=5924900
+require version-emulator=6185563
diff --git a/fingerprint/Android.mk b/fingerprint/Android.mk
index e282578..610b281 100644
--- a/fingerprint/Android.mk
+++ b/fingerprint/Android.mk
@@ -17,21 +17,11 @@
 include $(CLEAR_VARS)
 
 LOCAL_VENDOR_MODULE := true
-LOCAL_MODULE := fingerprint.goldfish
-LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
-LOCAL_SRC_FILES := fingerprint.c
-LOCAL_SHARED_LIBRARIES := liblog libcutils
-LOCAL_HEADER_LIBRARIES := libhardware_headers
-
-include $(BUILD_SHARED_LIBRARY)
-
-include $(CLEAR_VARS)
-
-LOCAL_VENDOR_MODULE := true
 LOCAL_MODULE := fingerprint.ranchu
 LOCAL_MODULE_RELATIVE_PATH := hw
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := fingerprint.c
 LOCAL_SHARED_LIBRARIES := liblog libcutils
 LOCAL_HEADER_LIBRARIES := libhardware_headers
diff --git a/fvp.mk b/fvp.mk
new file mode 100644
index 0000000..ed2c9b5
--- /dev/null
+++ b/fvp.mk
@@ -0,0 +1,100 @@
+#
+# Copyright 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+PRODUCT_USE_DYNAMIC_PARTITIONS := true
+PRODUCT_FULL_TREBLE_OVERRIDE := true
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/media_vendor.mk)
+
+PRODUCT_PACKAGES += \
+    android.hardware.audio@2.0-service \
+    android.hardware.audio@4.0-impl:32 \
+    android.hardware.audio.effect@4.0-impl:32 \
+    android.hardware.drm@1.0-service \
+    android.hardware.drm@1.0-impl \
+    android.hardware.drm@1.2-service.clearkey \
+    android.hardware.gatekeeper@1.0-service.software \
+    android.hardware.graphics.allocator@2.0-service \
+    android.hardware.graphics.allocator@2.0-impl \
+    android.hardware.graphics.composer@2.1-service \
+    android.hardware.graphics.composer@2.1-impl \
+    android.hardware.graphics.mapper@2.0-impl \
+    android.hardware.health@2.0-service \
+    android.hardware.keymaster@4.0-service \
+    android.hardware.keymaster@4.0-impl \
+    libEGL_swiftshader \
+    libGLESv1_CM_swiftshader \
+    libGLESv2_swiftshader \
+
+PRODUCT_PACKAGE_OVERLAYS := device/generic/goldfish/overlay
+
+PRODUCT_NAME := fvp
+PRODUCT_DEVICE := fvpbase
+PRODUCT_BRAND := Android
+PRODUCT_MODEL := AOSP on FVP
+
+PRODUCT_COPY_FILES += \
+    device/generic/goldfish/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
+    frameworks/native/data/etc/android.hardware.ethernet.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.ethernet.xml \
+    device/generic/goldfish/fvpbase/fstab.fvpbase:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.fvpbase \
+    device/generic/goldfish/fvpbase/fstab.fvpbase.initrd:$(TARGET_COPY_OUT_RAMDISK)/fstab.fvpbase \
+    device/generic/goldfish/fvpbase/init.fvpbase.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.fvpbase.rc \
+    frameworks/av/services/audiopolicy/config/audio_policy_configuration_generic.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_configuration.xml \
+    frameworks/av/services/audiopolicy/config/primary_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/primary_audio_policy_configuration.xml \
+    frameworks/av/services/audiopolicy/config/r_submix_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/r_submix_audio_policy_configuration.xml \
+    frameworks/av/services/audiopolicy/config/audio_policy_volumes.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes.xml \
+    frameworks/av/services/audiopolicy/config/default_volume_tables.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default_volume_tables.xml \
+    frameworks/av/services/audiopolicy/config/surround_sound_configuration_5_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/surround_sound_configuration_5_0.xml \
+
+PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    ro.hardware.egl=swiftshader \
+    debug.sf.nobootanimation=1 \
+
+PRODUCT_REQUIRES_INSECURE_EXECMEM_FOR_SWIFTSHADER := true
+
+# It's almost always faster to dexopt on the host even in eng builds.
+WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY := false
+
+DEVICE_MANIFEST_FILE := device/generic/goldfish/fvpbase/manifest.xml
+
+# Normally, the bootloader is supposed to concatenate the Android initramfs
+# and the initramfs for the kernel modules and let the kernel combine
+# them. However, the bootloader that we're using with FVP (U-Boot) doesn't
+# support concatenation, so we implement it in the build system.
+droid: $(OUT_DIR)/target/product/$(PRODUCT_DEVICE)/boot/ramdisk.img
+
+$(OUT_DIR)/target/product/$(PRODUCT_DEVICE)/boot/ramdisk.img: $(OUT_DIR)/target/product/$(PRODUCT_DEVICE)/ramdisk.img $(OUT_DIR)/target/product/$(PRODUCT_DEVICE)/boot/initramfs.img
+	gzip -dc $^ > $@
diff --git a/fvpbase/BoardConfig.mk b/fvpbase/BoardConfig.mk
new file mode 100644
index 0000000..234645e
--- /dev/null
+++ b/fvpbase/BoardConfig.mk
@@ -0,0 +1,51 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TARGET_ARCH := arm64
+TARGET_ARCH_VARIANT := armv8-a
+TARGET_CPU_VARIANT := generic
+TARGET_CPU_ABI := arm64-v8a
+
+TARGET_2ND_ARCH := arm
+TARGET_2ND_CPU_ABI := armeabi-v7a
+TARGET_2ND_CPU_ABI2 := armeabi
+TARGET_2ND_ARCH_VARIANT := armv8-a
+TARGET_2ND_CPU_VARIANT := generic
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+
+TARGET_NO_KERNEL := true
+
+BOARD_USES_SYSTEM_OTHER_ODEX :=
+
+BUILD_QEMU_IMAGES := true
+TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
+
+BOARD_BUILD_SUPER_IMAGE_BY_DEFAULT := true
+
+BOARD_SUPER_PARTITION_SIZE := 3229614080
+BOARD_SUPER_PARTITION_GROUPS := fvp_dynamic_partitions
+BOARD_FVP_DYNAMIC_PARTITIONS_SIZE := 3221225472
+BOARD_FVP_DYNAMIC_PARTITIONS_PARTITION_LIST := system vendor
+TARGET_COPY_OUT_PRODUCT := system/product
+TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
+
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
+
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/fvpbase/sepolicy
+
+TARGET_EXPERIMENTAL_MTE := true
diff --git a/fvpbase/README.md b/fvpbase/README.md
new file mode 100644
index 0000000..d98edb0
--- /dev/null
+++ b/fvpbase/README.md
@@ -0,0 +1,119 @@
+This document describes how to build and run an Android system image targeting
+the ARM Fixed Virtual Platform.
+
+### Building userspace
+
+```
+. build/envsetup.sh
+lunch fvp-eng # or fvp-userdebug
+m
+```
+
+Note that running ``m`` requires that the kernel is built first following
+the instructions below.
+
+### Building the kernel
+
+```
+mkdir android-kernel-mainline
+cd android-kernel-mainline
+repo init -u https://android.googlesource.com/kernel/manifest -b common-android-mainline
+repo sync
+BUILD_CONFIG=common/build.config.fvp build/build.sh
+```
+
+The resulting kernel image and DTB must then be copied into the product output directory:
+
+```
+mkdir -p $ANDROID_PRODUCT_OUT/boot
+cp out/android-mainline/dist/Image out/android-mainline/dist/initramfs.img $ANDROID_PRODUCT_OUT/boot/
+cp out/android-mainline/dist/fvp-base-revc.dtb $ANDROID_PRODUCT_OUT/boot/devtree.dtb
+```
+
+### Building the firmware (ARM Trusted Firmware and U-Boot)
+
+First, install ``dtc``, the device tree compiler. On Debian, this is in the
+``device-tree-compiler`` package. Then run:
+```
+mkdir platform
+cd platform
+repo init -u https://git.linaro.org/landing-teams/working/arm/manifest.git -m pinned-ack.xml -b 19.10
+repo sync
+
+mkdir -p tools/gcc
+cd tools/gcc
+wget https://releases.linaro.org/components/toolchain/binaries/6.2-2016.11/aarch64-linux-gnu/gcc-linaro-6.2.1-2016.11-x86_64_aarch64-linux-gnu.tar.xz
+tar -xJf gcc-linaro-6.2.1-2016.11-x86_64_aarch64-linux-gnu.tar.xz
+wget https://releases.linaro.org/components/toolchain/binaries/6.2-2016.11/arm-linux-gnueabihf/gcc-linaro-6.2.1-2016.11-x86_64_arm-linux-gnueabihf.tar.xz
+tar -xJf gcc-linaro-6.2.1-2016.11-x86_64_arm-linux-gnueabihf.tar.xz
+cd ../..
+
+CFLAGS=-w build-scripts/build-all.sh -p fvp -f busybox build
+build-scripts/build-all.sh -p fvp -f busybox package
+```
+
+These components must then be copied into the product output directory:
+
+```
+cp output/fvp/fvp-busybox/uboot/bl1.bin output/fvp/fvp-busybox/uboot/fip.bin $ANDROID_PRODUCT_OUT/boot/
+```
+
+### Obtaining the model
+
+The model may be obtained from [ARM's
+website](https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms)
+(under "Armv8-A Base Platform FVP").
+
+### Running the model
+
+From a lunched environment, first set the value of the ``MODEL_BIN``
+environment variable to the path to the model executable. Then run the
+following command to launch the model:
+```
+device/generic/goldfish/fvpbase/run_model
+```
+Additional model parameters may be passed by appending them to the
+``run_model`` command.
+
+To terminate the model, press ``Ctrl-] Ctrl-D`` to terminate the telnet
+connection.
+
+### MTE support
+
+**WARNING**: The kernel MTE support patches are experimental and the userspace
+interface is subject to change.
+
+To launch the model with MTE support, the following additional parameters
+must be used:
+```
+-C cluster0.has_arm_v8-5=1 \
+-C cluster0.memory_tagging_support_level=2 \
+-C bp.dram_metadata.is_enabled=1
+```
+MTE in userspace requires a patched common kernel with MTE support. To build
+the kernel, follow the kernel instructions above, but before running the
+``build.sh`` command, run:
+```
+cd common
+git fetch https://github.com/pcc/linux android-experimental-mte
+git checkout FETCH_HEAD
+cd ..
+```
+Then replace the prebuilt binutils with binutils 2.33.1:
+```
+cd binutils-2.33.1
+./configure --prefix=$PWD/inst --target=aarch64-linux-gnu
+make
+make install
+for i in $PWD/inst/bin/*; do
+  ln -sf $i /path/to/android-kernel-mainline/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/$(basename $i)
+  ln -sf $i /path/to/android-kernel-mainline/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/bin/$(basename $i | sed -e 's/gnu/android/g')
+done
+```
+
+### Accessing the model via adb
+
+To connect to the model on the host:
+```
+adb connect localhost:5555
+```
diff --git a/fvpbase/fstab.fvpbase b/fvpbase/fstab.fvpbase
new file mode 100644
index 0000000..6c62809
--- /dev/null
+++ b/fvpbase/fstab.fvpbase
@@ -0,0 +1,8 @@
+# Android fstab file.
+#<src>                                                  <mnt_point>         <type>    <mnt_flags and options>                              <fs_mgr_flags>
+# The filesystem that contains the filesystem checker binary (typically /system) cannot
+# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
+system   /system     ext4    ro,barrier=1     wait,logical,first_stage_mount
+vendor   /vendor     ext4    ro,barrier=1     wait,logical,first_stage_mount
+/dev/block/mmcblk0  /data    ext4      noatime,nosuid,nodev,nomblk_io_submit,errors=panic   wait,check,quota
+/devices/*/block/vde  auto  auto      defaults voldmanaged=sdcard:auto,encryptable=userdata
diff --git a/fvpbase/fstab.fvpbase.initrd b/fvpbase/fstab.fvpbase.initrd
new file mode 100644
index 0000000..5605663
--- /dev/null
+++ b/fvpbase/fstab.fvpbase.initrd
@@ -0,0 +1,4 @@
+# Android fstab file.
+#<dev>  <mnt_point> <type>  <mnt_flags options> <fs_mgr_flags>
+system   /system     ext4    ro,barrier=1     wait,logical,first_stage_mount
+vendor   /vendor     ext4    ro,barrier=1     wait,logical,first_stage_mount
diff --git a/fvpbase/init.fvpbase.rc b/fvpbase/init.fvpbase.rc
new file mode 100644
index 0000000..4d3db00
--- /dev/null
+++ b/fvpbase/init.fvpbase.rc
@@ -0,0 +1,2 @@
+on fs
+    mount_all /vendor/etc/fstab.fvpbase
diff --git a/fvpbase/manifest.xml b/fvpbase/manifest.xml
new file mode 100644
index 0000000..bd369ae
--- /dev/null
+++ b/fvpbase/manifest.xml
@@ -0,0 +1,102 @@
+<manifest version="1.0" type="device" target-level="3">
+    <hal format="hidl">
+        <name>android.hardware.audio</name>
+        <transport>hwbinder</transport>
+        <version>4.0</version>
+        <interface>
+            <name>IDevicesFactory</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.audio.effect</name>
+        <transport>hwbinder</transport>
+        <version>4.0</version>
+        <interface>
+            <name>IEffectsFactory</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.configstore</name>
+        <transport>hwbinder</transport>
+        <version>1.1</version>
+        <interface>
+            <name>ISurfaceFlingerConfigs</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.drm</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>ICryptoFactory</name>
+            <instance>default</instance>
+        </interface>
+        <interface>
+            <name>IDrmFactory</name>
+            <instance>default</instance>
+        </interface>
+        <fqname>@1.2::ICryptoFactory/clearkey</fqname>
+        <fqname>@1.2::IDrmFactory/clearkey</fqname>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.graphics.allocator</name>
+        <transport>hwbinder</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IAllocator</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.graphics.composer</name>
+        <transport>hwbinder</transport>
+        <version>2.1</version>
+        <interface>
+            <name>IComposer</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.graphics.mapper</name>
+        <transport arch="32+64">passthrough</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IMapper</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.health</name>
+        <transport>hwbinder</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IHealth</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.keymaster</name>
+        <transport>hwbinder</transport>
+        <version>4.0</version>
+        <interface>
+            <name>IKeymasterDevice</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.media.omx</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IOmx</name>
+            <instance>default</instance>
+        </interface>
+        <interface>
+            <name>IOmxStore</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/fvpbase/run_model b/fvpbase/run_model
new file mode 100755
index 0000000..3e2a798
--- /dev/null
+++ b/fvpbase/run_model
@@ -0,0 +1,49 @@
+#!/bin/sh -eu
+#
+# Copyright 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+tmp="$(mktemp -d)"
+trap "rm -rf $tmp" EXIT
+mkfifo $tmp/port
+
+"$MODEL_BIN" \
+  -C bp.secureflashloader.fname="$ANDROID_PRODUCT_OUT/boot/bl1.bin" \
+  -C bp.flashloader0.fname="$ANDROID_PRODUCT_OUT/boot/fip.bin" \
+  -C cluster0.cpu0.semihosting-cwd="$ANDROID_PRODUCT_OUT/boot" \
+  -C bp.virtioblockdevice.image_path="$ANDROID_PRODUCT_OUT/system-qemu.img" \
+  -C bp.mmc.p_mmc_file="$ANDROID_PRODUCT_OUT/userdata.img" \
+  -C bp.secure_memory=0 \
+  -C cache_state_modelled=0 \
+  -C bp.pl011_uart0.unbuffered_output=1 \
+  -C bp.pl011_uart0.out_file="$ANDROID_PRODUCT_OUT/uart0.log" \
+  -C bp.pl011_uart1.out_file="$ANDROID_PRODUCT_OUT/uart1.log" \
+  -C bp.terminal_0.terminal_command="echo %port > $tmp/port" \
+  -C bp.terminal_1.start_telnet=0 \
+  -C bp.ve_sysregs.mmbSiteDefault=0 \
+  -C bp.ve_sysregs.exit_on_shutdown=1 \
+  -C bp.virtio_net.hostbridge.userNetworking=1 \
+  -C bp.virtio_net.hostbridge.userNetPorts=5555=5555 \
+  -C bp.virtio_net.enabled=1 \
+  -C cluster0.NUM_CORES=1 \
+  -C cluster0.cpu0.clock_multiplier=20 \
+  -C cluster0.cpu0.enable_crc32=1 \
+  -C cluster1.NUM_CORES=0 \
+  "$@" &
+
+read port < $tmp/port
+telnet localhost $port
+kill -INT %%
+wait
diff --git a/fvpbase/sepolicy/file.te b/fvpbase/sepolicy/file.te
new file mode 100644
index 0000000..b3bd582
--- /dev/null
+++ b/fvpbase/sepolicy/file.te
@@ -0,0 +1 @@
+type varrun_file, file_type, data_file_type, mlstrustedobject;
diff --git a/fvpbase/sepolicy/file_contexts b/fvpbase/sepolicy/file_contexts
new file mode 100644
index 0000000..0c5f7b5
--- /dev/null
+++ b/fvpbase/sepolicy/file_contexts
@@ -0,0 +1,6 @@
+/data/vendor/var/run(/.*)?                       u:object_r:varrun_file:s0
+/dev/block/mmcblk0                               u:object_r:userdata_block_device:s0
+/vendor/bin/hw/android\.hardware\.gatekeeper@1\.0-service.software u:object_r:hal_gatekeeper_default_exec:s0
+/vendor/lib(64)?/libEGL_swiftshader\.so          u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/libGLESv1_CM_swiftshader\.so    u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/libGLESv2_swiftshader\.so       u:object_r:same_process_hal_file:s0
diff --git a/fvpbase/sepolicy/hal_graphics_allocator_default.te b/fvpbase/sepolicy/hal_graphics_allocator_default.te
new file mode 100644
index 0000000..6676f57
--- /dev/null
+++ b/fvpbase/sepolicy/hal_graphics_allocator_default.te
@@ -0,0 +1,4 @@
+allow hal_graphics_allocator_default graphics_device:dir search;
+allow hal_graphics_allocator_default graphics_device:chr_file { ioctl open read write map rw_file_perms };
+allow hal_graphics_allocator_default dumpstate:fd use;
+allow hal_graphics_allocator_default dumpstate:fifo_file write;
diff --git a/fvpbase/sepolicy/property.te b/fvpbase/sepolicy/property.te
new file mode 100644
index 0000000..f014ad5
--- /dev/null
+++ b/fvpbase/sepolicy/property.te
@@ -0,0 +1 @@
+type vendor_device_prop, property_type;
diff --git a/fvpbase/sepolicy/property_contexts b/fvpbase/sepolicy/property_contexts
new file mode 100644
index 0000000..c389bdd
--- /dev/null
+++ b/fvpbase/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.all.modules.ready u:object_r:vendor_device_prop:s0
diff --git a/fvpbase/sepolicy/surfaceflinger.te b/fvpbase/sepolicy/surfaceflinger.te
new file mode 100644
index 0000000..9523630
--- /dev/null
+++ b/fvpbase/sepolicy/surfaceflinger.te
@@ -0,0 +1 @@
+allow surfaceflinger self:process execmem;
diff --git a/gps/Android.mk b/gps/Android.mk
index d1b593a..7196f5f 100644
--- a/gps/Android.mk
+++ b/gps/Android.mk
@@ -28,7 +28,9 @@
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_CFLAGS += -DQEMU_HARDWARE
 LOCAL_SHARED_LIBRARIES := liblog libcutils libhardware
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := gps_qemu.c
 ifeq ($(TARGET_PRODUCT),vbox_x86)
 LOCAL_MODULE := gps.vbox_x86
@@ -44,7 +46,9 @@
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_CFLAGS += -DQEMU_HARDWARE
 LOCAL_SHARED_LIBRARIES := liblog libcutils libhardware
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := gps_qemu.c
 LOCAL_MODULE := gps.ranchu
 
diff --git a/gps/gps_qemu.c b/gps/gps_qemu.c
index 59d2f4e..cfb8e36 100644
--- a/gps/gps_qemu.c
+++ b/gps/gps_qemu.c
@@ -36,10 +36,10 @@
 #include <cutils/sockets.h>
 #include <cutils/properties.h>
 #include <hardware/gps.h>
-#include "qemu_pipe.h"
+#include "qemud.h"
 
 /* the name of the qemu-controlled pipe */
-#define  QEMU_CHANNEL_NAME  "qemud:gps"
+#define  QEMUD_CHANNEL_NAME  "gps"
 
 #define  GPS_DEBUG  0
 
@@ -773,15 +773,18 @@
     int         control_fd = state->control[1];
     GpsStatus gps_status;
     gps_status.size = sizeof(gps_status);
-    GpsSvStatus  gps_sv_status;
-    memset(&gps_sv_status, 0, sizeof(gps_sv_status));
-    gps_sv_status.size = sizeof(gps_sv_status);
-    gps_sv_status.num_svs = 1;
-    gps_sv_status.sv_list[0].size = sizeof(gps_sv_status.sv_list[0]);
-    gps_sv_status.sv_list[0].prn = 17;
-    gps_sv_status.sv_list[0].snr = 60.0;
-    gps_sv_status.sv_list[0].elevation = 30.0;
-    gps_sv_status.sv_list[0].azimuth = 30.0;
+
+    GnssSvStatus  gnss_sv_status;
+    memset(&gnss_sv_status, 0, sizeof(gnss_sv_status));
+    gnss_sv_status.size = sizeof(gnss_sv_status);
+    gnss_sv_status.num_svs = 1;
+    gnss_sv_status.gnss_sv_list[0].size = sizeof(gnss_sv_status.gnss_sv_list[0]);
+    gnss_sv_status.gnss_sv_list[0].svid = 17;
+    gnss_sv_status.gnss_sv_list[0].constellation = GNSS_CONSTELLATION_GPS;
+    gnss_sv_status.gnss_sv_list[0].c_n0_dbhz = 60.0;
+    gnss_sv_status.gnss_sv_list[0].elevation = 30.0;
+    gnss_sv_status.gnss_sv_list[0].azimuth = 30.0;
+    gnss_sv_status.gnss_sv_list[0].flags = GNSS_SV_FLAGS_HAS_CARRIER_FREQUENCY;
 
     nmea_reader_init( reader );
 
@@ -801,8 +804,8 @@
             timeout = 10 * 1000; // 10 seconds
         }
         nevents = epoll_wait( epoll_fd, events, 2, timeout );
-        if (state->callbacks.sv_status_cb) {
-            state->callbacks.sv_status_cb(&gps_sv_status);
+        if (state->callbacks.gnss_sv_status_cb) {
+            state->callbacks.gnss_sv_status_cb(&gnss_sv_status);
         }
         // update satilite info
         if (nevents < 0) {
@@ -907,14 +910,14 @@
     state->control[1] = -1;
     state->fd         = -1;
 
-    state->fd = qemu_pipe_open(QEMU_CHANNEL_NAME);
+    state->fd = qemud_channel_open(QEMUD_CHANNEL_NAME);
 
     if (state->fd < 0) {
         D("no gps emulation detected");
         return;
     }
 
-    D("gps emulation will read from '%s' qemu pipe", QEMU_CHANNEL_NAME );
+    D("gps emulation will read from '%s' qemud channel", QEMUD_CHANNEL_NAME );
 
     if ( socketpair( AF_LOCAL, SOCK_STREAM, 0, state->control ) < 0 ) {
         ALOGE("could not create thread control socket pair: %s", strerror(errno));
diff --git a/health/Android.bp b/health/Android.bp
deleted file mode 100644
index 11a7a8d..0000000
--- a/health/Android.bp
+++ /dev/null
@@ -1,32 +0,0 @@
-cc_binary {
-    name: "android.hardware.health@2.0-service.goldfish",
-    init_rc: ["android.hardware.health@2.0-service.goldfish.rc"],
-    proprietary: true,
-    relative_install_path: "hw",
-    srcs: [
-        "HealthService.cpp",
-    ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
-    static_libs: [
-        "android.hardware.health@2.0-impl",
-        "android.hardware.health@1.0-convert",
-        "libhealthservice",
-        "libbatterymonitor",
-        "libhealthstoragedefault",
-    ],
-    shared_libs: [
-        "libbase",
-        "libcutils",
-        "libhidlbase",
-        "libutils",
-        "android.hardware.health@2.0",
-    ],
-    header_libs: ["libhealthd_headers"],
-
-    overrides: [
-        "healthd",
-    ],
-}
diff --git a/health/HealthService.cpp b/health/HealthService.cpp
deleted file mode 100644
index 2498a5c..0000000
--- a/health/HealthService.cpp
+++ /dev/null
@@ -1,12 +0,0 @@
-#include <health2/service.h>
-#include <healthd/healthd.h>
-
-int main() {
-    return health_service_main();
-}
-
-void healthd_board_init(struct healthd_config*) {}
-
-int healthd_board_battery_update(struct android::BatteryProperties*) {
-    return 0;
-}
diff --git a/health/android.hardware.health@2.0-service.goldfish.rc b/health/android.hardware.health@2.0-service.goldfish.rc
deleted file mode 100644
index ecd42e4..0000000
--- a/health/android.hardware.health@2.0-service.goldfish.rc
+++ /dev/null
@@ -1,5 +0,0 @@
-service vendor.health-hal-2-0 /vendor/bin/hw/android.hardware.health@2.0-service.goldfish
-    class hal
-    user system
-    group system
-    file /dev/kmsg w
diff --git a/include/Android.bp b/include/Android.bp
deleted file mode 100644
index 2f09676..0000000
--- a/include/Android.bp
+++ /dev/null
@@ -1,5 +0,0 @@
-cc_library_headers {
-    name: "goldfish_headers",
-    vendor_available: true,
-    export_include_dirs: ["."],
-}
diff --git a/include/qemu.h b/include/qemu.h
deleted file mode 100644
index b5ba463..0000000
--- a/include/qemu.h
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef _libs_hardware_qemu_h
-#define _libs_hardware_qemu_h
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* returns 1 iff we're running in the emulator */
-extern int  qemu_check(void);
-
-/* a structure used to hold enough state to connect to a given
- * QEMU communication channel, either through a qemud socket or
- * a serial port.
- *
- * initialize the structure by zero-ing it out
- */
-typedef struct {
-    char   is_inited;
-    char   is_available;
-    char   is_qemud;
-    char   is_qemud_old;
-    char   is_tty;
-    int    fd;
-    char   device[32];
-} QemuChannel;
-
-/* try to open a qemu communication channel.
- * returns a file descriptor on success, or -1 in case of
- * error.
- *
- * 'channel' must be a QemuChannel structure that is empty
- * on the first call. You can call this function several
- * time to re-open the channel using the same 'channel'
- * object to speed things a bit.
- */
-extern int  qemu_channel_open( QemuChannel*  channel,
-                               const char*   name,
-                               int           mode );
-
-/* create a command made of a 4-hexchar prefix followed
- * by the content. the prefix contains the content's length
- * in hexadecimal coding.
- *
- * 'buffer' must be at last 6 bytes
- * returns -1 in case of overflow, or the command's total length
- * otherwise (i.e. content length + 4)
- */
-extern int  qemu_command_format( char*        buffer, 
-                                 int          buffer_size,
-                                 const char*  format,
-                                 ... );
-
-/* directly sends a command through the 'hw-control' channel.
- * this will open the channel, send the formatted command, then
- * close the channel automatically.
- * returns 0 on success, or -1 on error.
- */
-extern int  qemu_control_command( const char*  fmt, ... );
-
-/* sends a question to the hw-control channel, then receive an answer in
- * a user-allocated buffer. returns the length of the answer, or -1
- * in case of error.
- *
- * 'question' *must* have been formatted through qemu_command_format
- */
-extern int  qemu_control_query( const char*  question, int  questionlen,
-                                char*        answer,   int  answersize );
-
-/* use QEMU_FALLBACK(call) to call a QEMU-specific callback  */
-/* use QEMU_FALLBACK_VOID(call) if the function returns void */
-#  define  QEMU_FALLBACK(x)  \
-    do { \
-        if (qemu_check()) \
-            return qemu_ ## x ; \
-    } while (0)
-#  define  QEMU_FALLBACK_VOID(x)  \
-    do { \
-        if (qemu_check()) { \
-            qemu_ ## x ; \
-            return; \
-        } \
-    } while (0)
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* _libs_hardware_qemu_h */
diff --git a/include/qemu_pipe.h b/include/qemu_pipe.h
deleted file mode 100644
index d585ba1..0000000
--- a/include/qemu_pipe.h
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef ANDROID_INCLUDE_HARDWARE_QEMU_PIPE_H
-#define ANDROID_INCLUDE_HARDWARE_QEMU_PIPE_H
-
-#include <sys/cdefs.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <sys/mman.h>
-#include <pthread.h>  /* for pthread_once() */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#ifndef D
-#  define  D(...)   do{}while(0)
-#endif
-
-typedef int QEMU_PIPE_HANDLE;
-
-#define QEMU_PIPE_INVALID_HANDLE -1
-
-static __inline__ bool ReadFully(int fd, void* data, size_t byte_count) {
-  uint8_t* p = (uint8_t*)(data);
-  size_t remaining = byte_count;
-  while (remaining > 0) {
-    ssize_t n = TEMP_FAILURE_RETRY(read(fd, p, remaining));
-    if (n <= 0) return false;
-    p += n;
-    remaining -= n;
-  }
-  return true;
-}
-
-static __inline__ bool WriteFully(int fd, const void* data, size_t byte_count) {
-  const uint8_t* p = (const uint8_t*)(data);
-  size_t remaining = byte_count;
-  while (remaining > 0) {
-    ssize_t n = TEMP_FAILURE_RETRY(write(fd, p, remaining));
-    if (n == -1) return false;
-    p += n;
-    remaining -= n;
-  }
-  return true;
-}
-
-/* Try to open a new Qemu fast-pipe. This function returns a file descriptor
- * that can be used to communicate with a named service managed by the
- * emulator.
- *
- * This file descriptor can be used as a standard pipe/socket descriptor.
- *
- * 'pipeName' is the name of the emulator service you want to connect to.
- * E.g. 'opengles' or 'camera'.
- *
- * On success, return a valid file descriptor
- * Returns -1 on error, and errno gives the error code, e.g.:
- *
- *    EINVAL  -> unknown/unsupported pipeName
- *    ENOSYS  -> fast pipes not available in this system.
- *
- * ENOSYS should never happen, except if you're trying to run within a
- * misconfigured emulator.
- *
- * You should be able to open several pipes to the same pipe service,
- * except for a few special cases (e.g. GSM modem), where EBUSY will be
- * returned if more than one client tries to connect to it.
- */
-static __inline__ int
-qemu_pipe_open(const char*  pipeName)
-{
-    char  buff[256];
-    int   buffLen;
-    int   fd;
-
-    if (pipeName == NULL || pipeName[0] == '\0') {
-        errno = EINVAL;
-        return -1;
-    }
-
-    snprintf(buff, sizeof buff, "pipe:%s", pipeName);
-
-    fd = TEMP_FAILURE_RETRY(open("/dev/qemu_pipe", O_RDWR));
-    if (fd < 0 && errno == ENOENT)
-        fd = TEMP_FAILURE_RETRY(open("/dev/goldfish_pipe", O_RDWR));
-    if (fd < 0) {
-        D("%s: Could not open /dev/qemu_pipe: %s", __FUNCTION__, strerror(errno));
-        //errno = ENOSYS;
-        return -1;
-    }
-
-    buffLen = strlen(buff);
-
-    if (!WriteFully(fd, buff, buffLen + 1)) {
-        D("%s: Could not connect to %s pipe service: %s", __FUNCTION__, pipeName, strerror(errno));
-        return -1;
-    }
-
-    return fd;
-}
-
-static __inline__ bool
-qemu_pipe_valid(QEMU_PIPE_HANDLE pipe) {
-    return pipe >= 0;
-}
-#endif /* ANDROID_INCLUDE_HARDWARE_QEMUD_PIPE_H */
diff --git a/include/qemud.h b/include/qemud.h
index c6327ee..282ea4c 100644
--- a/include/qemud.h
+++ b/include/qemud.h
@@ -17,74 +17,16 @@
 #ifndef ANDROID_INCLUDE_HARDWARE_QEMUD_H
 #define ANDROID_INCLUDE_HARDWARE_QEMUD_H
 
-#include <cutils/sockets.h>
 #include "qemu_pipe.h"
 
-/* the following is helper code that is used by the QEMU-specific
- * hardware HAL modules to communicate with the emulator program
- * through the 'qemud' multiplexing daemon, or through the qemud
- * pipe.
- *
- * see the documentation comments for details in
- * development/emulator/qemud/qemud.c
- *
- * all definitions here are built into the HAL module to avoid
- * having to write a tiny shared library for this.
- */
-
-/* we expect the D macro to be defined to a function macro
- * that sends its formatted string argument(s) to the log.
- * If not, ignore the traces.
- */
-#ifndef D
-#  define  D(...)   do{}while(0)
-#endif
-
-
-static __inline__ int
+static __inline__ QEMU_PIPE_HANDLE
 qemud_channel_open(const char*  name)
 {
-    int  fd;
-    int  namelen = strlen(name);
-    char answer[2];
-    char pipe_name[256];
-
-    /* First, try to connect to the pipe. */
-    snprintf(pipe_name, sizeof(pipe_name), "qemud:%s", name);
-    fd = qemu_pipe_open(pipe_name);
-    D("%s: pipe name %s (name %s) fd %d", __FUNCTION__, pipe_name, name, fd);
-    if (fd < 0) {
-        D("QEMUD pipe is not available for %s: %s", name, strerror(errno));
-        /* If pipe is not available, connect to qemud control socket */
-        fd = socket_local_client( "qemud",
-                                  ANDROID_SOCKET_NAMESPACE_RESERVED,
-                                  SOCK_STREAM );
-        if (fd < 0) {
-            D("no qemud control socket: %s", strerror(errno));
-            return -1;
-        }
-
-        /* send service name to connect */
-        if (!WriteFully(fd, name, namelen)) {
-            D("can't send service name to qemud: %s",
-               strerror(errno));
-            close(fd);
-            return -1;
-        }
-
-        /* read answer from daemon */
-        if (!ReadFully(fd, answer, 2) ||
-            answer[0] != 'O' || answer[1] != 'K') {
-            D("cant' connect to %s service through qemud", name);
-            close(fd);
-            return -1;
-        }
-    }
-    return fd;
+    return qemu_pipe_open_ns("qemud", name, O_RDWR);
 }
 
 static __inline__ int
-qemud_channel_send(int  fd, const void*  msg, int  msglen)
+qemud_channel_send(QEMU_PIPE_HANDLE pipe, const void*  msg, int  msglen)
 {
     char  header[5];
 
@@ -94,26 +36,26 @@
     if (msglen == 0)
         return 0;
 
-    snprintf(header, sizeof header, "%04x", msglen);
-    if (!WriteFully(fd, header, 4)) {
+    snprintf(header, sizeof(header), "%04x", msglen);
+    if (qemu_pipe_write_fully(pipe, header, 4)) {
         D("can't write qemud frame header: %s", strerror(errno));
         return -1;
     }
 
-    if (!WriteFully(fd, msg, msglen)) {
-        D("can4t write qemud frame payload: %s", strerror(errno));
+    if (qemu_pipe_write_fully(pipe, msg, msglen)) {
+        D("can't write qemud frame payload: %s", strerror(errno));
         return -1;
     }
     return 0;
 }
 
 static __inline__ int
-qemud_channel_recv(int  fd, void*  msg, int  msgsize)
+qemud_channel_recv(QEMU_PIPE_HANDLE pipe, void*  msg, int  msgsize)
 {
     char  header[5];
     int   size;
 
-    if (!ReadFully(fd, header, 4)) {
+    if (qemu_pipe_read_fully(pipe, header, 4)) {
         D("can't read qemud frame header: %s", strerror(errno));
         return -1;
     }
@@ -125,7 +67,7 @@
     if (size > msgsize)
         return -1;
 
-    if (!ReadFully(fd, msg, size)) {
+    if (qemu_pipe_read_fully(pipe, msg, size)) {
         D("can't read qemud frame payload: %s", strerror(errno));
         return -1;
     }
diff --git a/init.ranchu.rc b/init.ranchu.rc
index 08a0c81..1895844 100644
--- a/init.ranchu.rc
+++ b/init.ranchu.rc
@@ -72,6 +72,7 @@
 
 on property:dev.bootcomplete=1
     setprop vendor.qemu.dev.bootcomplete 1
+    start ranchu-setup
 
 service ranchu-net /vendor/bin/init.ranchu-net.sh
     class late_start
diff --git a/input-mt/virtio_input_multi_touch_2.idc b/input-mt/virtio_input_multi_touch_2.idc
index 8e1b02a..548d5b0 100644
--- a/input-mt/virtio_input_multi_touch_2.idc
+++ b/input-mt/virtio_input_multi_touch_2.idc
@@ -9,4 +9,4 @@
 # This displayID matches the unique ID of the virtual display created for Emulator.
 # This will indicate to input flinger than it should link this input device
 # with the virtual display.
-touch.displayId = local:8140900251843329
+touch.displayId = local:1
diff --git a/input-mt/virtio_input_multi_touch_3.idc b/input-mt/virtio_input_multi_touch_3.idc
index 6a11240..d255d5f 100644
--- a/input-mt/virtio_input_multi_touch_3.idc
+++ b/input-mt/virtio_input_multi_touch_3.idc
@@ -9,4 +9,4 @@
 # This displayID matches the unique ID of the virtual display created for Emulator.
 # This will indicate to input flinger than it should link this input device
 # with the virtual display.
-touch.displayId = local:8140940453066754
+touch.displayId = local:2
diff --git a/kernel-tests/advancedFeatures.ini b/kernel-tests/advancedFeatures.ini
index e1f8b6a..b26c18d 100644
--- a/kernel-tests/advancedFeatures.ini
+++ b/kernel-tests/advancedFeatures.ini
@@ -8,3 +8,6 @@
 Wifi = on
 HostComposition = on
 DynamicPartition = on
+GLDirectMem = on
+VulkanNullOptionalStrings = on
+VulkanIgnoredHandles = on
diff --git a/kernel-tests/goldfish_kernel_tests_x86_64.mk b/kernel-tests/goldfish_kernel_tests_x86_64.mk
index e3ccec6..84bc73c 100644
--- a/kernel-tests/goldfish_kernel_tests_x86_64.mk
+++ b/kernel-tests/goldfish_kernel_tests_x86_64.mk
@@ -94,11 +94,9 @@
     toolbox \
     toybox \
     vold \
-    init \
     init_system \
     init_vendor \
     init.environ.rc \
-    init.rc \
     reboot \
     service \
     cmd \
@@ -125,9 +123,8 @@
     mac_permissions.xml \
 
 PRODUCT_COPY_FILES += \
-    $(SYSTEM_CORE_ROOTDIR)/init.usb.rc:root/init.usb.rc \
-    $(SYSTEM_CORE_ROOTDIR)/init.usb.configfs.rc:root/init.usb.configfs.rc \
-    $(SYSTEM_CORE_ROOTDIR)/ueventd.rc:root/ueventd.rc \
+    $(SYSTEM_CORE_ROOTDIR)/init.usb.rc:system/etc/init/hw/init.usb.rc \
+    $(SYSTEM_CORE_ROOTDIR)/init.usb.configfs.rc:system/etc/init/hw/init.usb.configfs.rc \
     $(SYSTEM_CORE_ROOTDIR)/etc/hosts:system/etc/hosts \
 
 PRODUCT_COPY_FILES += \
@@ -138,7 +135,6 @@
     $(GOLDFISH_DIR)/ueventd.ranchu.rc:$(TARGET_COPY_OUT_VENDOR)/ueventd.rc \
 
 PRODUCT_COPY_FILES += \
-    $(THIS_DIR)/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
     $(THIS_DIR)/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
     $(THIS_DIR)/init.ranchu.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.ranchu.rc \
     $(THIS_DIR)/fstab.ranchu:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.ranchu \
@@ -153,3 +149,14 @@
 
 PRODUCT_PROPERTY_OVERRIDES += \
     ro.carrier=unknown
+
+DEVICE_MANIFEST_FILE += $(THIS_DIR)/manifest.xml
+# VINTF stuff for system and vendor (no product / odm / system_ext / etc.)
+PRODUCT_PACKAGES += \
+    system_compatibility_matrix.xml \
+    system_manifest.xml \
+    vendor_compatibility_matrix.xml \
+    vendor_manifest.xml \
+
+# Disable VINTF checks.
+PRODUCT_ENFORCE_VINTF_MANIFEST_OVERRIDE := false
diff --git a/kernel-tests/manifest.xml b/kernel-tests/manifest.xml
index 82ba6d1..1612508 100644
--- a/kernel-tests/manifest.xml
+++ b/kernel-tests/manifest.xml
@@ -25,7 +25,4 @@
         <fqname>@1.1::ICryptoFactory/widevine</fqname>
         <fqname>@1.1::IDrmFactory/widevine</fqname>
     </hal>
-    <sepolicy>
-        <version>27.0</version>
-    </sepolicy>
 </manifest>
diff --git a/keymaster/trusty/Android.mk b/keymaster/trusty/Android.mk
index 1a5c844..63c419c 100644
--- a/keymaster/trusty/Android.mk
+++ b/keymaster/trusty/Android.mk
@@ -12,7 +12,8 @@
                    trusty_keymaster_device.cpp
 
 LOCAL_C_INCLUDES := system/security/keystore \
-                    $(LOCAL_PATH)/../../include
+                    $(LOCAL_PATH)/../../include \
+                    $(LOCAL_PATH)/../../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_CFLAGS = -fvisibility=hidden -Wall -Werror
 LOCAL_SHARED_LIBRARIES := libcrypto liblog libsoftkeymasterdevice libkeymaster_messages libcutils
 LOCAL_HEADER_LIBRARIES := libhardware_headers
diff --git a/keymaster/trusty/trusty_keymaster_ipc.cpp b/keymaster/trusty/trusty_keymaster_ipc.cpp
index 381ba4a..75f75a5 100644
--- a/keymaster/trusty/trusty_keymaster_ipc.cpp
+++ b/keymaster/trusty/trusty_keymaster_ipc.cpp
@@ -28,7 +28,7 @@
 
 #include "keymaster_ipc.h"
 #include "trusty_keymaster_ipc.h"
-#include "qemud.h"
+#include "qemu_pipe.h"
 
 #define KEYMASTER_SERVICE_NAME "KeymasterService3"
 
@@ -36,7 +36,7 @@
 
 int trusty_keymaster_connect() {
     ALOGE("calling %s\n", __func__);
-    handle_ = qemu_pipe_open(KEYMASTER_SERVICE_NAME);
+    handle_ = qemu_pipe_open_ns(NULL, KEYMASTER_SERVICE_NAME, O_RDWR);
     if (handle_ < 0) {
         handle_ = 0;
         ALOGE("failed to open %s pipe service", KEYMASTER_SERVICE_NAME);
@@ -58,14 +58,14 @@
 
     int pipe_command_length = msg_size;
     assert(pipe_command_length > 0);
-    ssize_t rc = WriteFully(handle_, &pipe_command_length, sizeof(pipe_command_length));
-    if (rc < 1) {
+    ssize_t rc = qemu_pipe_write_fully(handle_, &pipe_command_length, sizeof(pipe_command_length));
+    if (rc) {
         ALOGE("failed to send msg_size (%d) for cmd (%d) to %s: %s\n", (int)(sizeof(pipe_command_length)),
                 (int)cmd, KEYMASTER_PORT, strerror(errno));
         return -errno;
     }
 
-    rc = WriteFully(handle_, msg, pipe_command_length);
+    rc = qemu_pipe_write_fully(handle_, msg, pipe_command_length);
     if (in_size == 157 && cmd == KM_FINISH_OPERATION) {
         for (int i=0; i < (int)in_size; ++i) {
             ALOGE("pay[%d]: %d", i, (int)(msg->payload[i]));
@@ -74,20 +74,20 @@
     free(msg);
 
 
-    if (rc < 1) {
+    if (rc) {
         ALOGE("failed to send cmd (%d) to %s: %s\n", cmd, KEYMASTER_PORT, strerror(errno));
         return -errno;
     }
 
-    rc = ReadFully(handle_, &pipe_command_length, sizeof(pipe_command_length));
-    if (rc < 1) {
+    rc = qemu_pipe_read_fully(handle_, &pipe_command_length, sizeof(pipe_command_length));
+    if (rc) {
         ALOGE("failed to retrieve response length for cmd (%d) to %s: %s\n", cmd, KEYMASTER_PORT,
               strerror(errno));
         return -errno;
     }
 
-    rc = ReadFully(handle_, out, pipe_command_length);
-    if (rc < 1) {
+    rc = qemu_pipe_read_fully(handle_, out, pipe_command_length);
+    if (rc) {
         ALOGE("failed to retrieve response for cmd (%d) to %s: %s\n", cmd, KEYMASTER_PORT,
               strerror(errno));
         return -errno;
diff --git a/libqemu/test_guest_1.c b/libqemu/test_guest_1.c
deleted file mode 100644
index 1a81000..0000000
--- a/libqemu/test_guest_1.c
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/* This program uses a QEMUD pipe to exchange data with a test
- * server. It's very simple:
- *
- *    for count in range(0,100):
- *       msg = "Hello Word " + count
- *       qemud_pipe_send(msg)
- *       qemud_pipe_recv(msg2)
- *       if (msg != msg2):
- *          error()
- *
- *
- * See test_host_1.c for the corresponding server code, which simply
- * sends back anything it receives from the client.
- */
-#include "test_util.h"
-#include <errno.h>
-#include <string.h>
-#include <stddef.h>
-#include <stdio.h>
-
-#define  PIPE_NAME  "pingpong"
-
-
-int main(void)
-{
-    Pipe  pipe[1];
-    const int maxCount = 100;
-    int port = 8012;
-
-#if 0
-    if (pipe_openSocket(pipe, port) < 0) {
-        fprintf(stderr, "Could not open tcp socket!\n");
-        return 1;
-    }
-    printf("Connected to tcp:host:%d\n", port);
-#else
-    if (pipe_openQemuPipe(pipe, PIPE_NAME) < 0) {
-        fprintf(stderr, "Could not open '%s' pipe: %s\n", PIPE_NAME, strerror(errno));
-        return 1;
-    }
-    printf("Connected to '%s' pipe\n", PIPE_NAME);
-#endif
-
-    char  buff[64];
-    char  buff2[64];
-    int   count;
-    double time0 = now_secs();
-    size_t total = 0;
-
-    for (count = 0; count < maxCount; count++) {
-        /* First, send a small message */
-        int  len = snprintf(buff, sizeof(buff), "Hello World %d\n", count);
-        printf("%4d: Sending %d bytes\n", count, len);
-        int ret = pipe_send(pipe, buff, len);
-        if (ret < 0) {
-            fprintf(stderr,"Sending %d bytes failed: %s\n", len, strerror(errno));
-            return 1;
-        }
-
-        total += len;
-
-        /* The server is supposed to send the message back */
-        ret = pipe_recv(pipe, buff2, len);
-        if (ret < 0) {
-            fprintf(stderr, "Receiving failed (ret=%d): %s\n", ret, strerror(errno));
-            return 3;
-        }
-        printf("%4d: Received %d bytes\n", count, ret);
-        /* Check the message's content */
-        if (ret != len) {
-            fprintf(stderr, "Message size mismatch sent=%d received=%d\n", len, ret);
-            return 5;
-        }
-        if (memcmp(buff, buff2, len) != 0) {
-            fprintf(stderr, "Message content mismatch!\n");
-            return 6;
-        }
-    }
-
-    double time1 = now_secs();
-
-    printf("Closing pipe\n");
-    pipe_close(pipe);
-
-    printf("Bandwidth: %g MB/s, %g bytes in %g seconds.\n",
-           total*1.0 / (1024.*1024.*(time1-time0)), 1.0*total, time1-time0);
-
-    return 0;
-}
diff --git a/libqemu/test_guest_2.c b/libqemu/test_guest_2.c
deleted file mode 100644
index c834098..0000000
--- a/libqemu/test_guest_2.c
+++ /dev/null
@@ -1,240 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/* This program benchmarks a QEMUD pipe to exchange data with a test
- * server.
- *
- * See test_host_1.c for the corresponding server code, which simply
- * sends back anything it receives from the client.
- */
-#include <stddef.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <string.h>
-#include "test_util.h"
-
-#define  PIPE_NAME  "pingpong"
-
-char* progname;
-
-static void usage(int code)
-{
-    printf("Usage: %s [options]\n\n", progname);
-    printf(
-      "Valid options are:\n\n"
-      "  -? -h --help  Print this message\n"
-      "  -pipe <name>  Use pipe name (default: " PIPE_NAME ")\n"
-      "  -tcp <port>   Use local tcp port\n"
-      "  -size <size>  Specify packet size\n"
-      "\n"
-    );
-    exit(code);
-}
-
-int main(int argc, char** argv)
-{
-    Pipe        pipe[1];
-    const char* tcpPort = NULL;
-    int         localPort = 0;
-    const char* pipeName = NULL;
-    const char* packetSize = NULL;
-    int         port = 8012;
-    int         maxCount   = 1000;
-    int         bufferSize = 16384;
-    uint8_t*    buffer;
-    uint8_t*    buffer2;
-    int         nn, count;
-    double      time0, time1;
-
-    /* Extract program name */
-    {
-        char* p = strrchr(argv[0], '/');
-        if (p == NULL)
-            progname = argv[0];
-        else
-            progname = p+1;
-    }
-
-    /* Parse options */
-    while (argc > 1 && argv[1][0] == '-') {
-        char* arg = argv[1];
-        if (!strcmp(arg, "-?") || !strcmp(arg, "-h") || !strcmp(arg, "--help")) {
-            usage(0);
-        } else if (!strcmp(arg, "-pipe")) {
-            if (argc < 3) {
-                fprintf(stderr, "-pipe option needs an argument! See --help for details.\n");
-                exit(1);
-            }
-            argc--;
-            argv++;
-            pipeName = argv[1];
-        } else if (!strcmp(arg, "-tcp")) {
-            if (argc < 3) {
-                fprintf(stderr, "-tcp option needs an argument! See --help for details.\n");
-                exit(1);
-            }
-            argc--;
-            argv++;
-            tcpPort = argv[1];
-        } else if (!strcmp(arg, "-size")) {
-            if (argc < 3) {
-                fprintf(stderr, "-tcp option needs an argument! See --help for details.\n");
-                exit(1);
-            }
-            argc--;
-            argv++;
-            packetSize = argv[1];
-        } else {
-            fprintf(stderr, "UNKNOWN OPTION: %s\n\n", arg);
-            usage(1);
-        }
-        argc--;
-        argv++;
-    }
-
-    /* Check arguments */
-    if (tcpPort && pipeName) {
-        fprintf(stderr, "You can't use both -pipe and -tcp at the same time\n");
-        exit(2);
-    }
-
-    if (tcpPort != NULL) {
-        localPort = atoi(tcpPort);
-        if (localPort <= 0 || localPort > 65535) {
-            fprintf(stderr, "Invalid port number: %s\n", tcpPort);
-            exit(2);
-        }
-    } else if (pipeName == NULL) {
-        /* Use default pipe name */
-        pipeName = PIPE_NAME;
-    }
-
-    if (packetSize != NULL) {
-        int  size = atoi(packetSize);
-        if (size <= 0) {
-            fprintf(stderr, "Invalid byte size: %s\n", packetSize);
-            exit(3);
-        }
-        bufferSize = size;
-    }
-
-    /* Open the pipe */
-    if (tcpPort != NULL) {
-        if (pipe_openSocket(pipe, localPort) < 0) {
-            fprintf(stderr, "Could not open tcp socket!\n");
-            return 1;
-        }
-        printf("Connected to tcp:localhost:%d\n", port);
-    }
-    else {
-        if (pipe_openQemuPipe(pipe, pipeName) < 0) {
-            fprintf(stderr, "Could not open '%s' pipe: %s\n", pipeName, strerror(errno));
-            return 1;
-        }
-        printf("Connected to '%s' pipe\n", pipeName);
-    }
-
-    /* Allocate buffers, setup their data */
-    buffer  = malloc(bufferSize);
-    buffer2 = malloc(bufferSize);
-
-    for (nn = 0; nn < bufferSize; nn++) {
-        buffer[nn] = (uint8_t)nn;
-    }
-
-    /* Do the work! */
-    time0 = now_secs();
-
-    for (count = 0; count < maxCount; count++) {
-        int ret = pipe_send(pipe, buffer, bufferSize);
-        int pos, len;
-
-        if (ret < 0) {
-            fprintf(stderr,"%d: Sending %d bytes failed: %s\n", count, bufferSize, strerror(errno));
-            return 1;
-        }
-
-#if 1
-        /* The server is supposed to send the message back */
-        pos = 0;
-        len = bufferSize;
-        while (len > 0) {
-            ret = pipe_recv(pipe, buffer2 + pos, len);
-            if (ret < 0) {
-                fprintf(stderr, "Receiving failed (ret=%d): %s\n", ret, strerror(errno));
-                return 3;
-            }
-            if (ret == 0) {
-                fprintf(stderr, "Disconnection while receiving!\n");
-                return 4;
-            }
-            pos += ret;
-            len -= ret;
-        }
-
-        if (memcmp(buffer, buffer2, bufferSize) != 0) {
-            fprintf(stderr, "Message content mismatch!\n");
-            const int maxAvail = 16;
-            const int maxLines = 12;
-            int numLines = 0;
-            for (nn = 0; nn < bufferSize; ) {
-                int avail = bufferSize - nn;
-                int mm;
-                if (avail > maxAvail)
-                    avail = maxAvail;
-
-                if (memcmp(buffer+nn, buffer2+nn, avail) != 0) {
-                    if (++numLines >= maxLines) {
-                        printf(".... to be continued ...\n");
-                        break;
-                    }
-                    printf("%04x:", nn);
-
-                    for (mm = 0; mm < avail; mm++)
-                        printf(" %02x", buffer[nn+mm]);
-                    for ( ; mm < maxAvail; mm++ )
-                        printf("   ");
-
-                    printf( " -- " );
-
-                    for (mm = 0; mm < avail; mm++)
-                        printf(" %02x", buffer2[nn+mm]);
-
-                    printf ("\n");
-                }
-                nn += avail;
-            }
-            return 6;
-        }
-
-#endif
-
-        if (count > 0 && (count % 200) == 0) {
-            printf("... %d\n", count);
-        }
-    }
-
-    time1 = now_secs();
-
-    printf("Closing pipe\n");
-    pipe_close(pipe);
-
-    printf("Total time: %g seconds\n", time1 - time0);
-    printf("Total bytes: %g bytes\n", 1.0*maxCount*bufferSize);
-    printf("Bandwidth: %g MB/s\n", (maxCount*bufferSize/(1024.0*1024.0))/(time1 - time0) );
-    return 0;
-}
diff --git a/libqemu/test_host_1.c b/libqemu/test_host_1.c
deleted file mode 100644
index 8e32bf2..0000000
--- a/libqemu/test_host_1.c
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/* This program is used to test the QEMUD fast pipes.
- * See external/qemu/docs/ANDROID-QEMUD-PIPES.TXT for details.
- *
- * The program acts as a simple TCP server that accepts data and sends
- * them back to the client as is.
- */
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <sys/un.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
-/* Default port number */
-#define  DEFAULT_PORT  8012
-#define  DEFAULT_PATH  "/tmp/libqemu-socket"
-
-/* Try to execute x, looping around EINTR errors. */
-#undef TEMP_FAILURE_RETRY
-#define TEMP_FAILURE_RETRY(exp) ({         \
-    typeof (exp) _rc;                      \
-    do {                                   \
-        _rc = (exp);                       \
-    } while (_rc == -1 && errno == EINTR); \
-    _rc; })
-
-#define TFR TEMP_FAILURE_RETRY
-
-/* Close a socket, preserving the value of errno */
-static void
-socket_close(int  sock)
-{
-    int  old_errno = errno;
-    close(sock);
-    errno = old_errno;
-}
-
-/* Create a server socket bound to a loopback port */
-static int
-socket_loopback_server( int port, int type )
-{
-    struct sockaddr_in  addr;
-
-    int  sock = socket(AF_INET, type, 0);
-    if (sock < 0) {
-        return -1;
-    }
-
-    memset(&addr, 0, sizeof(addr));
-    addr.sin_family      = AF_INET;
-    addr.sin_port        = htons(port);
-    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-
-    int n = 1;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &n, sizeof(n));
-
-    if (TFR(bind(sock, (struct sockaddr*)&addr, sizeof(addr))) < 0) {
-        socket_close(sock);
-        return -1;
-    }
-
-    if (type == SOCK_STREAM) {
-        if (TFR(listen(sock, 4)) < 0) {
-            socket_close(sock);
-            return -1;
-        }
-    }
-
-    return sock;
-}
-
-static int
-socket_unix_server( const char* path, int type )
-{
-    struct sockaddr_un  addr;
-
-    int  sock = socket(AF_UNIX, type, 0);
-    if (sock < 0) {
-        return -1;
-    }
-
-    memset(&addr, 0, sizeof(addr));
-    addr.sun_family = AF_UNIX;
-    snprintf(addr.sun_path, sizeof(addr.sun_path), "%s", path);
-
-    unlink(addr.sun_path);
-
-    printf("Unix path: '%s'\n", addr.sun_path);
-
-    int n = 1;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &n, sizeof(n));
-
-    if (TFR(bind(sock, (struct sockaddr*)&addr, sizeof(addr))) < 0) {
-        socket_close(sock);
-        return -1;
-    }
-
-    if (type == SOCK_STREAM) {
-        if (TFR(listen(sock, 4)) < 0) {
-            socket_close(sock);
-            return -1;
-        }
-    }
-
-    return sock;
-}
-
-char* progname;
-
-static void usage(int code)
-{
-    printf("Usage: %s [options]\n\n", progname);
-    printf(
-      "Valid options are:\n\n"
-      "  -? -h --help  Print this message\n"
-      "  -unix <path>  Use unix server socket\n"
-      "  -tcp <port>   Use local tcp port (default %d)\n"
-      "\n", DEFAULT_PORT
-    );
-    exit(code);
-}
-
-/* Main program */
-int main(int argc, char** argv)
-{
-    int sock, client;
-    int port = DEFAULT_PORT;
-    const char* path = NULL;
-    const char* tcpPort = NULL;
-
-    /* Extract program name */
-    {
-        char* p = strrchr(argv[0], '/');
-        if (p == NULL)
-            progname = argv[0];
-        else
-            progname = p+1;
-    }
-
-    /* Parse options */
-    while (argc > 1 && argv[1][0] == '-') {
-        char* arg = argv[1];
-        if (!strcmp(arg, "-?") || !strcmp(arg, "-h") || !strcmp(arg, "--help")) {
-            usage(0);
-        } else if (!strcmp(arg, "-unix")) {
-            if (argc < 3) {
-                fprintf(stderr, "-unix option needs an argument! See --help for details.\n");
-                exit(1);
-            }
-            argc--;
-            argv++;
-            path = argv[1];
-        } else if (!strcmp(arg, "-tcp")) {
-            if (argc < 3) {
-                fprintf(stderr, "-tcp option needs an argument! See --help for details.\n");
-                exit(1);
-            }
-            argc--;
-            argv++;
-            tcpPort = argv[1];
-        } else {
-            fprintf(stderr, "UNKNOWN OPTION: %s\n\n", arg);
-            usage(1);
-        }
-        argc--;
-        argv++;
-    }
-
-    if (path != NULL) {
-        printf("Starting pipe test server on unix path: %s\n", path);
-        sock = socket_unix_server( path, SOCK_STREAM );
-    } else {
-        printf("Starting pipe test server on local port %d\n", port);
-        sock = socket_loopback_server( port, SOCK_STREAM );
-    }
-    if (sock < 0) {
-        fprintf(stderr, "Could not start server: %s\n", strerror(errno));
-        return 1;
-    }
-    printf("Server ready!\n");
-
-RESTART:
-    client = TFR(accept(sock, NULL, NULL));
-    if (client < 0) {
-        fprintf(stderr, "Server error: %s\n", strerror(errno));
-        return 2;
-    }
-    printf("Client connected!\n");
-
-    /* Now, accept any incoming data, and send it back */
-    for (;;) {
-        char  buff[32768], *p;
-        int   ret, count;
-
-        ret = TFR(read(client, buff, sizeof(buff)));
-        if (ret < 0) {
-            fprintf(stderr, "Client read error: %s\n", strerror(errno));
-            socket_close(client);
-            return 3;
-        }
-        if (ret == 0) {
-            break;
-        }
-        count = ret;
-        p     = buff;
-        //printf("   received: %d bytes\n", count);
-
-        while (count > 0) {
-            ret = TFR(write(client, p, count));
-            if (ret < 0) {
-                fprintf(stderr, "Client write error: %s\n", strerror(errno));
-                socket_close(client);
-                return 4;
-            }
-            //printf("   sent: %d bytes\n", ret);
-
-            p     += ret;
-            count -= ret;
-        }
-    }
-    printf("Client closed connection\n");
-    socket_close(client);
-    goto RESTART;
-
-    return 0;
-}
diff --git a/libqemu/test_host_2.c b/libqemu/test_host_2.c
deleted file mode 100644
index 46a9e8d..0000000
--- a/libqemu/test_host_2.c
+++ /dev/null
@@ -1,129 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/* This program is used to test the QEMUD fast pipes.
- * See external/qemu/docs/ANDROID-QEMUD-PIPES.TXT for details.
- *
- * The program acts as a simple TCP server that accepts any data and
- * discards it immediately.
- */
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
-/* Default port number */
-#define  DEFAULT_PORT  8012
-
-/* Try to execute x, looping around EINTR errors. */
-#undef TEMP_FAILURE_RETRY
-#define TEMP_FAILURE_RETRY(exp) ({         \
-    typeof (exp) _rc;                      \
-    do {                                   \
-        _rc = (exp);                       \
-    } while (_rc == -1 && errno == EINTR); \
-    _rc; })
-
-#define TFR TEMP_FAILURE_RETRY
-
-/* Close a socket, preserving the value of errno */
-static void
-socket_close(int  sock)
-{
-    int  old_errno = errno;
-    close(sock);
-    errno = old_errno;
-}
-
-/* Create a server socket bound to a loopback port */
-static int
-socket_loopback_server( int port, int type )
-{
-    struct sockaddr_in  addr;
-
-    int  sock = socket(AF_INET, type, 0);
-    if (sock < 0) {
-        return -1;
-    }
-
-    memset(&addr, 0, sizeof(addr));
-    addr.sin_family      = AF_INET;
-    addr.sin_port        = htons(port);
-    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-
-    int n = 1;
-    setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &n, sizeof(n));
-
-    if (TFR(bind(sock, (struct sockaddr*)&addr, sizeof(addr))) < 0) {
-        socket_close(sock);
-        return -1;
-    }
-
-    if (type == SOCK_STREAM) {
-        if (TFR(listen(sock, 4)) < 0) {
-            socket_close(sock);
-            return -1;
-        }
-    }
-
-    return sock;
-}
-
-/* Main program */
-int main(void)
-{
-    int sock, client;
-    int port = DEFAULT_PORT;
-
-    printf("Starting pipe test server on local port %d\n", port);
-    sock = socket_loopback_server( port, SOCK_STREAM );
-    if (sock < 0) {
-        fprintf(stderr, "Could not start server: %s\n", strerror(errno));
-        return 1;
-    }
-
-RESTART:
-    client = TFR(accept(sock, NULL, NULL));
-    if (client < 0) {
-        fprintf(stderr, "Server error: %s\n", strerror(errno));
-        return 2;
-    }
-    printf("Client connected!\n");
-
-    /* Now, accept any incoming data, and send it back */
-    for (;;) {
-        char  buff[8192], *p;
-        int   ret, count;
-
-        ret = TFR(read(client, buff, sizeof(buff)));
-        if (ret < 0) {
-            fprintf(stderr, "Client read error: %s\n", strerror(errno));
-            socket_close(client);
-            return 3;
-        }
-        if (ret == 0) {
-            break;
-        }
-    }
-    printf("Client closed connection\n");
-    socket_close(client);
-    goto RESTART;
-
-    return 0;
-}
diff --git a/libqemu/test_util.c b/libqemu/test_util.c
deleted file mode 100644
index 1696796..0000000
--- a/libqemu/test_util.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <errno.h>
-#include <string.h>
-#include <unistd.h>
-#include <stddef.h>
-#include <stdio.h>
-#include "test_util.h"
-
-#ifdef __linux__
-#include <time.h>
-double now_secs(void)
-{
-    struct timespec  tm;
-    clock_gettime(CLOCK_MONOTONIC, &tm);
-    return (double)tm.tv_sec + (double)tm.tv_nsec/1e9;
-}
-#else
-#include <sys/time.h>
-double now_secs(void)
-{
-    struct timeval tv;
-    gettimeofday(&tv, NULL);
-    return tv.sec + (double)tv.usec/1e6;
-}
-#endif
-
-int
-pipe_openSocket( Pipe*  pipe, int port )
-{
-    static int           fd;
-    struct sockaddr_in  addr;
-
-    pipe->socket = -1;
-
-    fd = socket( AF_INET, SOCK_STREAM, 0 );
-    if (fd < 0) {
-        fprintf(stderr, "%s: Can't create socket!!\n", __FUNCTION__);
-        return -1;
-    }
-
-    memset(&addr, 0, sizeof(addr));
-    addr.sin_family      = AF_INET;
-    addr.sin_port        = htons(port);
-    addr.sin_addr.s_addr = htonl(0x0a000202);
-
-    if ( connect(fd, (struct sockaddr*)&addr, sizeof(addr)) < 0 ) {
-        fprintf(stderr, "%s: Can't connect to tcp:local:%d: %s\n",
-                __FUNCTION__, port, strerror(errno));
-        close(fd);
-        return -1;
-    }
-
-    pipe->socket = fd;
-    return 0;
-}
-
-int
-pipe_openQemuPipe( Pipe*  pipe, const char* pipename )
-{
-    pipe->socket = qemu_pipe_open(pipename);
-    if (pipe->socket < 0) {
-        fprintf(stderr, "%s: Could not open '%s' pipe: %s\n", __FUNCTION__, pipename, strerror(errno));
-        return -1;
-    }
-    return 0;
-}
-
-int
-pipe_send( Pipe*  pipe, const void* buff, size_t  bufflen )
-{
-    int ret;
-    const uint8_t* ptr = buff;
-    while (bufflen > 0) {
-        ret = write(pipe->socket, ptr, bufflen);
-        if (ret < 0) {
-            if (errno == EINTR)
-                continue;
-            fprintf(stderr, "%s: error: %s\n", __FUNCTION__, strerror(errno));
-            return -1;
-        }
-        if (ret == 0) {
-            fprintf(stderr, "%s: disconnection!\n", __FUNCTION__);
-            return -1;
-        }
-        ptr     += ret;
-        bufflen -= ret;
-    }
-    return 0;
-}
-
-int
-pipe_recv( Pipe*  pipe, void* buff, size_t bufflen )
-{
-    int  ret;
-
-    for (;;) {
-        ret = read(pipe->socket, buff, bufflen);
-        if (ret < 0) {
-            if (errno == EINTR)
-                continue;
-            fprintf(stderr, "%s: error: %s\n", __FUNCTION__, strerror(errno));
-            return -1;
-        }
-        if (ret == 0) {
-            fprintf(stderr, "%s: disconnection!\n", __FUNCTION__);
-            return -1;
-        }
-        break;
-    }
-    return ret;
-}
-
-void
-pipe_close( Pipe*  pipe )
-{
-    if (pipe->socket >= 0) {
-        close(pipe->socket);
-        pipe->socket = -1;
-    }
-}
diff --git a/libqemu/test_util.h b/libqemu/test_util.h
deleted file mode 100644
index 60caf88..0000000
--- a/libqemu/test_util.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#ifndef TEST_UTIL_H
-#define TEST_UTIL_H
-
-#include <stddef.h>
-#include "qemu_pipe.h"
-
-
-double now_secs(void);
-
-typedef struct {
-    int  socket;
-} Pipe;
-
-int  pipe_openSocket( Pipe*  pipe, int port );
-int  pipe_openQemuPipe( Pipe*  pipe, const char* pipename );
-int  pipe_send( Pipe*  pipe, const void* buff, size_t  bufflen );
-int  pipe_recv( Pipe*  pipe, void* buff, size_t bufflen );
-void pipe_close( Pipe*  pipe );
-
-#endif /* TEST_UTIL_H */
diff --git a/libqemu/tests.mk b/libqemu/tests.mk
deleted file mode 100644
index 45f2e19..0000000
--- a/libqemu/tests.mk
+++ /dev/null
@@ -1,30 +0,0 @@
-# Build libqemu tests, included from main Android.mk
-
-# The first test program is a simple TCP server that will send back
-# anything it receives from the client.
-#
-include $(CLEAR_VARS)
-LOCAL_MODULE := test-libqemu-1
-LOCAL_SRC_FILES := test_host_1.c
-LOCAL_MODULE_TAGS := tests
-include $(BUILD_HOST_EXECUTABLE)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := test-libqemu-2
-LOCAL_SRC_FILES := test_host_2.c
-LOCAL_MODULE_TAGS := tests
-include $(BUILD_HOST_EXECUTABLE)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := test-libqemu-1
-LOCAL_SRC_FILES := test_guest_1.c test_util.c
-LOCAL_MODULE_TAGS := tests
-LOCAL_STATIC_LIBRARIES := libcutils liblog
-include $(BUILD_EXECUTABLE)
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := test-libqemu-2
-LOCAL_SRC_FILES := test_guest_2.c test_util.c
-LOCAL_MODULE_TAGS := tests
-LOCAL_STATIC_LIBRARIES := libcutils liblog
-include $(BUILD_EXECUTABLE)
diff --git a/lights/Android.mk b/lights/Android.mk
index 41ab150..ec56f92 100644
--- a/lights/Android.mk
+++ b/lights/Android.mk
@@ -21,7 +21,9 @@
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SHARED_LIBRARIES := liblog libcutils
 LOCAL_C_INC := lights_qemu.c
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := lights_qemu.c
 LOCAL_MODULE := lights.ranchu
 LOCAL_CFLAGS += -DLIGHT_BACKLIGHT
diff --git a/manifest-arm.xml b/manifest-arm.xml
deleted file mode 100644
index c9bcbaa..0000000
--- a/manifest-arm.xml
+++ /dev/null
@@ -1,194 +0,0 @@
-<manifest version="1.0" type="device" target-level="3">
-    <hal format="hidl">
-        <name>android.hardware.drm</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ICryptoFactory</name>
-            <instance>default</instance>
-        </interface>
-        <interface>
-            <name>IDrmFactory</name>
-            <instance>default</instance>
-        </interface>
-        <fqname>@1.1::ICryptoFactory/clearkey</fqname>
-        <fqname>@1.1::IDrmFactory/clearkey</fqname>
-        <fqname>@1.1::ICryptoFactory/widevine</fqname>
-        <fqname>@1.1::IDrmFactory/widevine</fqname>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.audio.effect</name>
-        <transport>hwbinder</transport>
-        <version>4.0</version>
-        <interface>
-            <name>IEffectsFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.biometrics.fingerprint</name>
-        <transport>hwbinder</transport>
-        <version>2.1</version>
-        <interface>
-            <name>IBiometricsFingerprint</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.configstore</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ISurfaceFlingerConfigs</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.audio</name>
-        <transport>hwbinder</transport>
-        <version>4.0</version>
-        <interface>
-            <name>IDevicesFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.keymaster</name>
-        <transport>hwbinder</transport>
-        <version>4.0</version>
-        <interface>
-            <name>IKeymasterDevice</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.graphics.allocator</name>
-        <transport>hwbinder</transport>
-        <version>2.0</version>
-        <interface>
-            <name>IAllocator</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.graphics.mapper</name>
-        <transport arch="32+64">passthrough</transport>
-        <version>2.0</version>
-        <interface>
-            <name>IMapper</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.graphics.composer</name>
-        <transport>hwbinder</transport>
-        <version>2.3</version>
-        <interface>
-            <name>IComposer</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.power</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IPower</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.broadcastradio</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBroadcastRadioFactory</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.camera.provider</name>
-        <transport>hwbinder</transport>
-        <version>2.4</version>
-        <interface>
-            <name>ICameraProvider</name>
-            <instance>legacy/0</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.sensors</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ISensors</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.gnss</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IGnss</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.media.omx</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IOmx</name>
-            <instance>default</instance>
-        </interface>
-        <interface>
-            <name>IOmxStore</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.radio</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IRadio</name>
-            <instance>slot1</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IWifi</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi.hostapd</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IHostapd</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi.supplicant</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ISupplicant</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.health</name>
-        <transport>hwbinder</transport>
-        <version>2.0</version>
-        <interface>
-            <name>IHealth</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-</manifest>
diff --git a/manifest.camera.xml b/manifest.camera.xml
new file mode 100644
index 0000000..908c05c
--- /dev/null
+++ b/manifest.camera.xml
@@ -0,0 +1,11 @@
+<manifest version="1.0" type="device" target-level="3">
+    <hal format="hidl">
+        <name>android.hardware.camera.provider</name>
+        <transport>hwbinder</transport>
+        <version>2.4</version>
+        <interface>
+            <name>ICameraProvider</name>
+            <instance>legacy/0</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/manifest.gnss.xml b/manifest.gnss.xml
new file mode 100644
index 0000000..69a178f
--- /dev/null
+++ b/manifest.gnss.xml
@@ -0,0 +1,11 @@
+<manifest version="1.0" type="device" target-level="3">
+    <hal format="hidl">
+        <name>android.hardware.gnss</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IGnss</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/manifest.sensors.xml b/manifest.sensors.xml
new file mode 100644
index 0000000..1c0a50b
--- /dev/null
+++ b/manifest.sensors.xml
@@ -0,0 +1,11 @@
+<manifest version="1.0" type="device" target-level="3">
+    <hal format="hidl">
+        <name>android.hardware.sensors</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>ISensors</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/manifest.xml b/manifest.xml
index 5be1a35..7f02c45 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -19,13 +19,22 @@
     <hal format="hidl">
         <name>android.hardware.audio.effect</name>
         <transport>hwbinder</transport>
-        <version>4.0</version>
+        <version>5.0</version>
         <interface>
             <name>IEffectsFactory</name>
             <instance>default</instance>
         </interface>
     </hal>
     <hal format="hidl">
+        <name>android.hardware.authsecret</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>IAuthSecret</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
         <name>android.hardware.biometrics.fingerprint</name>
         <transport>hwbinder</transport>
         <version>2.1</version>
@@ -46,7 +55,7 @@
     <hal format="hidl">
         <name>android.hardware.audio</name>
         <transport>hwbinder</transport>
-        <version>4.0</version>
+        <version>5.0</version>
         <interface>
             <name>IDevicesFactory</name>
             <instance>default</instance>
@@ -64,7 +73,7 @@
     <hal format="hidl">
         <name>android.hardware.graphics.allocator</name>
         <transport>hwbinder</transport>
-        <version>2.0</version>
+        <version>3.0</version>
         <interface>
             <name>IAllocator</name>
             <instance>default</instance>
@@ -73,7 +82,7 @@
     <hal format="hidl">
         <name>android.hardware.graphics.mapper</name>
         <transport arch="32+64">passthrough</transport>
-        <version>2.0</version>
+        <version>3.0</version>
         <interface>
             <name>IMapper</name>
             <instance>default</instance>
@@ -82,7 +91,7 @@
     <hal format="hidl">
         <name>android.hardware.graphics.composer</name>
         <transport>hwbinder</transport>
-        <version>2.3</version>
+        <version>2.1</version>
         <interface>
             <name>IComposer</name>
             <instance>default</instance>
@@ -107,33 +116,6 @@
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.camera.provider</name>
-        <transport>hwbinder</transport>
-        <version>2.4</version>
-        <interface>
-            <name>ICameraProvider</name>
-            <instance>legacy/0</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.sensors</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>ISensors</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.gnss</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IGnss</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
         <name>android.hardware.media.omx</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
diff --git a/network/netmgr/Android.bp b/network/netmgr/Android.bp
index 7530c91..09e90b7 100644
--- a/network/netmgr/Android.bp
+++ b/network/netmgr/Android.bp
@@ -40,6 +40,6 @@
         "libpcap",
     ],
     header_libs: [
-        "goldfish_headers",
+        "goldfish_pipe_headers",
     ],
 }
diff --git a/network/netmgr/commander.cpp b/network/netmgr/commander.cpp
index a2dc1aa..95e5b75 100644
--- a/network/netmgr/commander.cpp
+++ b/network/netmgr/commander.cpp
@@ -144,7 +144,7 @@
 }
 
 void Commander::openPipe() {
-    mPipeFd = qemu_pipe_open(kQemuPipeName);
+    mPipeFd = qemu_pipe_open_ns(NULL, kQemuPipeName, O_RDWR);
     if (mPipeFd == -1) {
         LOGE("Failed to open QEMU pipe '%s': %s",
              kQemuPipeName,
diff --git a/network/netmgr/wifi_forwarder.cpp b/network/netmgr/wifi_forwarder.cpp
index e6997d4..139d467 100644
--- a/network/netmgr/wifi_forwarder.cpp
+++ b/network/netmgr/wifi_forwarder.cpp
@@ -127,7 +127,7 @@
         return Result::error("WifiForwarder already initialized");
     }
 
-    mPipeFd = qemu_pipe_open(kQemuPipeName);
+    mPipeFd = qemu_pipe_open_ns(NULL, kQemuPipeName, O_RDWR);
     if (mPipeFd == -1) {
         // It's OK if this fails, the emulator might not have been started with
         // this feature enabled. If it's not enabled we'll try again later, in
@@ -255,12 +255,12 @@
 
     WifiForwardHeader forwardHeader(header->caplen, radioLen);
 
-    if (!WriteFully(mPipeFd, &forwardHeader, sizeof(forwardHeader))) {
+    if (qemu_pipe_write_fully(mPipeFd, &forwardHeader, sizeof(forwardHeader))) {
         LOGE("WifiForwarder failed to write to pipe: %s", strerror(errno));
         return;
     }
 
-    if (!WriteFully(mPipeFd, data, header->caplen)) {
+    if (qemu_pipe_write_fully(mPipeFd, data, header->caplen)) {
         LOGE("WifiForwarder failed to write to pipe: %s", strerror(errno));
         return;
     }
diff --git a/network/wifi_forwarder/Android.bp b/network/wifi_forwarder/Android.bp
index 6dbc9ca..fee0060 100644
--- a/network/wifi_forwarder/Android.bp
+++ b/network/wifi_forwarder/Android.bp
@@ -41,6 +41,6 @@
         "libutilscallstack",
     ],
     header_libs: [
-        "goldfish_headers",
+        "goldfish_pipe_headers",
     ],
 }
diff --git a/network/wifi_forwarder/remote_connection.cpp b/network/wifi_forwarder/remote_connection.cpp
index 7255e05..852ef00 100644
--- a/network/wifi_forwarder/remote_connection.cpp
+++ b/network/wifi_forwarder/remote_connection.cpp
@@ -99,7 +99,7 @@
         return Result::error("RemoteConnetion already initialized");
     }
 
-    mPipeFd = qemu_pipe_open(kQemuPipeName);
+    mPipeFd = qemu_pipe_open_ns(NULL, kQemuPipeName, O_RDWR);
     if (mPipeFd == -1) {
         return Result::error("RemoteConnection failed to open pipe");
     }
@@ -300,12 +300,12 @@
         iov[current].iov_len -= written;
     }
 #else
-    if (!WriteFully(mPipeFd, &header, sizeof(header))) {
+    if (qemu_pipe_write_fully(mPipeFd, &header, sizeof(header))) {
         ALOGE("RemoteConnection failed to write to pipe: %s", strerror(errno));
         return false;
     }
 
-    if (!WriteFully(mPipeFd, frame->data(), frame->size())) {
+    if (qemu_pipe_write_fully(mPipeFd, frame->data(), frame->size())) {
         ALOGE("RemoteConnection failed to write to pipe: %s", strerror(errno));
         return false;
     }
@@ -327,7 +327,7 @@
                              info.rates().size(),
                              info.rates().data());
 
-    if (!WriteFully(mPipeFd, &header, sizeof(header))) {
+    if (qemu_pipe_write_fully(mPipeFd, &header, sizeof(header))) {
         ALOGE("RemoteConnection failed to write to pipe: %s", strerror(errno));
         return false;
     }
diff --git a/power/Android.mk b/power/Android.mk
index 27f325c..4a0b4d9 100644
--- a/power/Android.mk
+++ b/power/Android.mk
@@ -31,6 +31,7 @@
     libhidlbase \
     liblog \
     libutils \
+    android.hardware.power@1.0 \
     android.hardware.power@1.1 \
 
 include $(BUILD_EXECUTABLE)
diff --git a/qemu-props/Android.mk b/qemu-props/Android.mk
index b1b14db..e6134ab 100644
--- a/qemu-props/Android.mk
+++ b/qemu-props/Android.mk
@@ -24,7 +24,9 @@
 include $(CLEAR_VARS)
 LOCAL_VENDOR_MODULE    := true
 LOCAL_MODULE    := qemu-props
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := qemu-props.c
 LOCAL_SHARED_LIBRARIES := libcutils liblog
 include $(BUILD_EXECUTABLE)
diff --git a/qemu-props/qemu-props.c b/qemu-props/qemu-props.c
index 71e5aac..85aa2b0 100644
--- a/qemu-props/qemu-props.c
+++ b/qemu-props/qemu-props.c
@@ -91,7 +91,7 @@
         char* q;
         char  temp[BUFF_SIZE];
         char  vendortemp[BUFF_SIZE];
-        int   len = qemud_channel_recv(qemud_fd, temp, sizeof temp - 1);
+        int   len = qemud_channel_recv(qemud_fd, temp, sizeof(temp) - 1);
 
         /* lone NUL-byte signals end of properties */
         if (len < 0 || len > BUFF_SIZE-1 || temp[0] == '\0')
@@ -172,7 +172,7 @@
 
 void sendMessage(const char* mesg) {
    if (s_QemuMiscPipe < 0) {
-        s_QemuMiscPipe = qemu_pipe_open(QEMU_MISC_PIPE);
+        s_QemuMiscPipe = qemu_pipe_open_ns(NULL, QEMU_MISC_PIPE, O_RDWR);
         if (s_QemuMiscPipe < 0) {
             ALOGE("failed to open %s", QEMU_MISC_PIPE);
             return;
@@ -181,10 +181,10 @@
     char set[64];
     snprintf(set, sizeof(set), "%s", mesg);
     int pipe_command_length = strlen(set)+1; //including trailing '\0'
-    WriteFully(s_QemuMiscPipe, &pipe_command_length, sizeof(pipe_command_length));
-    WriteFully(s_QemuMiscPipe, set, pipe_command_length);
-    ReadFully(s_QemuMiscPipe, &pipe_command_length, sizeof(pipe_command_length));
+    qemu_pipe_write_fully(s_QemuMiscPipe, &pipe_command_length, sizeof(pipe_command_length));
+    qemu_pipe_write_fully(s_QemuMiscPipe, set, pipe_command_length);
+    qemu_pipe_read_fully(s_QemuMiscPipe, &pipe_command_length, sizeof(pipe_command_length));
     if (pipe_command_length > (int)(sizeof(set)) || pipe_command_length <= 0)
         return;
-    ReadFully(s_QemuMiscPipe, set, pipe_command_length);
+    qemu_pipe_read_fully(s_QemuMiscPipe, set, pipe_command_length);
 }
diff --git a/ril/Android.mk b/ril/Android.mk
index a5423ce..ec3b5cd 100644
--- a/ril/Android.mk
+++ b/ril/Android.mk
@@ -16,13 +16,15 @@
 LOCAL_SHARED_LIBRARIES := \
     liblog libcutils libutils libril librilutils
 
-LOCAL_STATIC_LIBRARIES := libqemu_pipe libbase
+LOCAL_STATIC_LIBRARIES := libbase
 
 # for asprinf
 LOCAL_CFLAGS := -D_GNU_SOURCE
 LOCAL_CFLAGS += -Wall -Wextra -Wno-unused-variable -Wno-unused-function -Werror
 
-LOCAL_C_INCLUDES :=
+LOCAL_C_INCLUDES := \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 
 ifeq ($(TARGET_DEVICE),sooner)
   LOCAL_CFLAGS += -DUSE_TI_COMMANDS
diff --git a/ril/reference-ril.c b/ril/reference-ril.c
index 8566231..030d410 100644
--- a/ril/reference-ril.c
+++ b/ril/reference-ril.c
@@ -15,6 +15,8 @@
 ** limitations under the License.
 */
 
+#define LOG_TAG "RIL"
+
 #include <telephony/ril_cdma_sms.h>
 #include <telephony/librilutils.h>
 #include <stdio.h>
@@ -37,7 +39,7 @@
 #include <cutils/properties.h>
 #include <cutils/sockets.h>
 #include <termios.h>
-#include <qemu_pipe.h>
+#include <qemud.h>
 #include <sys/wait.h>
 #include <stdbool.h>
 #include <net/if.h>
@@ -48,7 +50,7 @@
 #include "ipv6_monitor.h"
 #include "ril.h"
 
-#define LOG_TAG "RIL"
+#define EMULATOR_DUMMY_SIM_CHANNEL_NAME "A00000015144414300"
 #include <utils/Log.h>
 
 #define MAX(x, y) ({\
@@ -233,6 +235,8 @@
 
 static RIL_RadioState sState = RADIO_STATE_UNAVAILABLE;
 
+static int s_sim_update_started = 0;
+
 static pthread_mutex_t s_state_mutex = PTHREAD_MUTEX_INITIALIZER;
 static pthread_cond_t s_state_cond = PTHREAD_COND_INITIALIZER;
 
@@ -1626,6 +1630,11 @@
     int type, startfrom;
 
     RLOGD("requestRegistrationState");
+    if(s_sim_update_started == 0) {
+        RLOGD("too early, sim card is not done yet");
+        goto error;
+    }
+
     if (request == RIL_REQUEST_VOICE_REGISTRATION_STATE) {
         cmd = "AT+CREG?";
         prefix = "+CREG:";
@@ -1949,39 +1958,44 @@
 static void requestSimOpenChannel(void *data, size_t datalen, RIL_Token t)
 {
     ATResponse *p_response = NULL;
-    int32_t session_id;
+    int32_t session_id[3];
     int err;
     char cmd[32];
     char dummy;
     char *line;
 
+    const char *pdata = data ? data : EMULATOR_DUMMY_SIM_CHANNEL_NAME;
+
     // Max length is 16 bytes according to 3GPP spec 27.007 section 8.45
-    if (data == NULL || datalen == 0 || datalen > 16) {
-        ALOGE("Invalid data passed to requestSimOpenChannel");
+    if (pdata == NULL || datalen == 0 || datalen > 16) {
+        RLOGE("Invalid data passed to requestSimOpenChannel");
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
         return;
     }
 
-    snprintf(cmd, sizeof(cmd), "AT+CCHO=%s", data);
+    snprintf(cmd, sizeof(cmd), "AT+CCHO=%s", pdata);
 
     err = at_send_command_numeric(cmd, &p_response);
     if (err < 0 || p_response == NULL || p_response->success == 0) {
-        ALOGE("Error %d opening logical channel: %d",
+        RLOGE("Error %d opening logical channel: %d",
               err, p_response ? p_response->success : 0);
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
         at_response_free(p_response);
         return;
     }
 
+    memset(session_id, 0, sizeof(session_id));
+
     // Ensure integer only by scanning for an extra char but expect one result
     line = p_response->p_intermediates->line;
-    if (sscanf(line, "%" SCNd32 "%c", &session_id, &dummy) != 1) {
-        ALOGE("Invalid AT response, expected integer, was '%s'", line);
+    if (sscanf(line, "%" SCNd32 "%c", session_id, &dummy) != 1) {
+        RLOGE("Invalid AT response, expected integer, was '%s'", line);
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
         return;
     }
 
-    RIL_onRequestComplete(t, RIL_E_SUCCESS, &session_id, sizeof(session_id));
+    session_id[1] = 0x90;
+    RIL_onRequestComplete(t, RIL_E_SUCCESS, session_id, sizeof(session_id));
     at_response_free(p_response);
 }
 
@@ -2029,9 +2043,11 @@
     char *line;
     size_t cmd_size;
     RIL_SIM_IO_Response sim_response;
+    memset(&sim_response, 0, sizeof(sim_response));
     RIL_SIM_APDU *apdu = (RIL_SIM_APDU *)data;
 
     if (apdu == NULL || datalen != sizeof(RIL_SIM_APDU)) {
+        RLOGE("Error input invalid %p %d %d", apdu, (int)datalen, (int)(sizeof(RIL_SIM_APDU)));
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
         return;
     }
@@ -2044,7 +2060,7 @@
     err = at_send_command_singleline(cmd, "+CGLA", &p_response);
     free(cmd);
     if (err < 0 || p_response == NULL || p_response->success == 0) {
-        ALOGE("Error %d transmitting APDU: %d",
+        RLOGE("Error %d transmitting APDU: %d",
               err, p_response ? p_response->success : 0);
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
         at_response_free(p_response);
@@ -2058,7 +2074,7 @@
         RIL_onRequestComplete(t, RIL_E_SUCCESS,
                               &sim_response, sizeof(sim_response));
     } else {
-        ALOGE("Error %d parsing SIM response line: %s", err, line);
+        RLOGE("Error %d parsing SIM response line: %s", err, line);
         RIL_onRequestComplete(t, RIL_E_GENERIC_FAILURE, NULL, 0);
     }
     at_response_free(p_response);
@@ -2252,6 +2268,10 @@
                     p_args->p1, p_args->p2, p_args->p3, p_args->data);
     }
 
+    if (p_args->command == 0xdc) {
+        s_sim_update_started = 1;
+    }
+
     err = at_send_command_singleline(cmd, "+CRSM:", &p_response);
 
     if (err < 0 || p_response->success == 0) {
@@ -2405,6 +2425,7 @@
    // TODO - hook this up with real query/info from radio.
 
    RIL_HardwareConfig hwCfg;
+   memset(&hwCfg, 0, sizeof(hwCfg));
 
    RIL_UNUSED_PARM(data);
    RIL_UNUSED_PARM(datalen);
@@ -2754,6 +2775,9 @@
         case RIL_REQUEST_SIM_TRANSMIT_APDU_CHANNEL:
             requestSimTransmitApduChannel(data, datalen, t);
             break;
+        case RIL_REQUEST_SIM_TRANSMIT_APDU_BASIC:
+            requestSimTransmitApduChannel(data, datalen, t);
+            break;
         case RIL_REQUEST_SETUP_DATA_CALL:
             requestSetupDataCall(data, datalen, t);
             break;
@@ -4075,7 +4099,7 @@
         fd = -1;
         while  (fd < 0) {
             if (isInEmulator()) {
-                fd = qemu_pipe_open("pipe:qemud:gsm");
+                fd = qemud_channel_open("gsm");
             } else if (s_port > 0) {
                 fd = socket_network_client("localhost", s_port, SOCK_STREAM);
             } else if (s_device_socket) {
diff --git a/sensors/Android.mk b/sensors/Android.mk
index ad319e9..d35f337 100644
--- a/sensors/Android.mk
+++ b/sensors/Android.mk
@@ -23,7 +23,9 @@
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SHARED_LIBRARIES := liblog libcutils
 LOCAL_HEADER_LIBRARIES := libhardware_headers
-LOCAL_C_INCLUDES += $(LOCAL_PATH)/../include
+LOCAL_C_INCLUDES += \
+	$(LOCAL_PATH)/../include \
+	$(LOCAL_PATH)/../../goldfish-opengl/shared/OpenglCodecCommon
 LOCAL_SRC_FILES := sensors_qemu.c
 LOCAL_MODULE := sensors.ranchu
 
diff --git a/sensors/sensors_qemu.c b/sensors/sensors_qemu.c
index eaf2bb8..5312260 100644
--- a/sensors/sensors_qemu.c
+++ b/sensors/sensors_qemu.c
@@ -110,21 +110,6 @@
     return "<UNKNOWN>";
 }
 
-static int
-_sensorIdFromName( const char*  name )
-{
-    int  nn;
-
-    if (name == NULL)
-        return -1;
-
-    for (nn = 0; nn < MAX_NUM_SENSORS; nn++)
-        if (!strcmp(name, _sensorIds[nn].name))
-            return _sensorIds[nn].id;
-
-    return -1;
-}
-
 /* return the current time in nanoseconds */
 static int64_t now_ns(void) {
     struct timespec  ts;
@@ -687,6 +672,8 @@
      int flags,
      int64_t sampling_period_ns,
      int64_t max_report_latency_ns) {
+    (void)flags;
+    (void)max_report_latency_ns;
     return sensor_device_set_delay(dev, sensor_handle, sampling_period_ns);
 }
 
diff --git a/sepolicy/common/bootanim.te b/sepolicy/common/bootanim.te
index bc84ee7..4d011e1 100644
--- a/sepolicy/common/bootanim.te
+++ b/sepolicy/common/bootanim.te
@@ -4,6 +4,7 @@
 dontaudit bootanim system_data_file:dir read;
 
 allow bootanim graphics_device:chr_file { read ioctl open };
+allow bootanim gpu_device:chr_file { read ioctl open };
 
 typeattribute bootanim system_writes_vendor_properties_violators;
 set_prop(bootanim, qemu_prop)
diff --git a/sepolicy/common/bug_map b/sepolicy/common/bug_map
index 839b49e..049891e 100644
--- a/sepolicy/common/bug_map
+++ b/sepolicy/common/bug_map
@@ -15,3 +15,4 @@
 vendor_init exported2_default_prop property_service b/131601458
 init serial_device chr_file b/134145307
 gsid device file b/133324244
+gmscore_app varrun_file dir b/131598844
diff --git a/sepolicy/common/file_contexts b/sepolicy/common/file_contexts
index 240bc49..7209f56 100644
--- a/sepolicy/common/file_contexts
+++ b/sepolicy/common/file_contexts
@@ -15,6 +15,9 @@
 /dev/goldfish_sync           u:object_r:qemu_device:s0
 /dev/goldfish_address_space  u:object_r:qemu_device:s0
 /dev/qemu_.*                 u:object_r:qemu_device:s0
+/dev/dri/card0               u:object_r:gpu_device:s0
+/dev/dri/controlD64          u:object_r:gpu_device:s0
+/dev/dri/renderD128          u:object_r:gpu_device:s0
 /dev/ttyGF[0-9]*             u:object_r:serial_device:s0
 /dev/ttyS2                   u:object_r:console_device:s0
 /vendor/bin/init\.ranchu-core\.sh u:object_r:goldfish_setup_exec:s0
@@ -30,14 +33,15 @@
 /vendor/bin/netmgr           u:object_r:netmgr_exec:s0
 /vendor/bin/wifi_forwarder   u:object_r:wifi_forwarder_exec:s0
 
-/vendor/bin/hw/android\.hardware\.drm@1\.0-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
-/vendor/bin/hw/android\.hardware\.drm@1\.2-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
-/vendor/bin/hw/android\.hardware\.drm@1\.2-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
+/vendor/bin/hw/android\.hardware\.drm@[0-9]+\.[0-9]+-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
+/vendor/bin/hw/android\.hardware\.drm@[0-9]+\.[0-9]+-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
 /vendor/bin/hw/android\.hardware\.gatekeeper@1\.0-service.software    u:object_r:hal_gatekeeper_default_exec:s0
 /vendor/bin/hw/android\.hardware\.keymaster@4\.0-strongbox-service u:object_r:hal_keymaster_default_exec:s0
-/vendor/bin/hw/android\.hardware\.health@2\.0-service.goldfish        u:object_r:hal_health_default_exec:s0
 /vendor/bin/hw/android\.hardware\.power@1\.1-service.ranchu           u:object_r:hal_power_default_exec:s0
 /vendor/bin/hw/android\.hardware\.thermal@2\.0-service.mock           u:object_r:hal_thermal_default_exec:s0
+/vendor/bin/hw/android\.hardware\.authsecret@1\.0-service  u:object_r:hal_authsecret_default_exec:s0
+/vendor/bin/hw/android\.hardware\.input\.classifier@1\.0-service.default  u:object_r:hal_input_classifier_default_exec:s0
+/vendor/bin/hw/android\.hardware\.power\.stats@1\.0-service\.mock  u:object_r:hal_power_stats_default_exec:s0
 
 /vendor/lib(64)?/hw/vulkan\.ranchu\.so   u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/hw/gralloc\.ranchu\.so   u:object_r:same_process_hal_file:s0
@@ -55,8 +59,8 @@
 /vendor/lib(64)?/libGLESv2_enc\.so       u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/libvulkan_enc\.so       u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/libandroidemu\.so       u:object_r:same_process_hal_file:s0
+/vendor/lib(64)?/libdrm.so  u:object_r:same_process_hal_file:s0
 
 # data
 /data/vendor/mediadrm(/.*)?            u:object_r:mediadrm_vendor_data_file:s0
 /data/vendor/var/run(/.*)?             u:object_r:varrun_file:s0
-
diff --git a/sepolicy/common/genfs_contexts b/sepolicy/common/genfs_contexts
index bc99f83..a169cac 100644
--- a/sepolicy/common/genfs_contexts
+++ b/sepolicy/common/genfs_contexts
@@ -30,5 +30,52 @@
 # /sys/class/power_supply
 genfscon sysfs /devices/platform/9020000.goldfish_battery/power_supply u:object_r:sysfs_batteryinfo:s0
 
+# symlinks from /sys/class/wakeup
+genfscon sysfs /devices/LNXSYSTM:00/LNXPWRBN:00/wakeup/wakeup                      u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/GFSH0001:00/wakeup/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/GFSH0003:00/wakeup/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/GFSH0004:00/wakeup/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/GFSH0006:00/wakeup/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/GFSH0008:00/wakeup/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:00/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:01/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:03/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:04/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:05/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:07/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0a/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0b/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0c/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0d/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0e/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0f/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:10/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:11/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:12/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:13/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:14/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:15/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:16/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:17/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:18/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:19/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1a/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1b/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1c/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1d/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1e/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1f/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:20/wakeup/wakeup u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/wakeup/wakeup           u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/GFSH0001:00/power_supply/ac/wakeup                u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/GFSH0001:00/power_supply/battery/wakeup           u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/pnp0/00:00/rtc/rtc0/wakeup                                 u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/pnp0/00:00/wakeup/wakeup                                   u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/virtual/wakeup/wakeup                                      u:object_r:sysfs_wakeup:s0
+
 # /proc/<pid>/ns
 genfscon nsfs / u:object_r:nsfs:s0
diff --git a/sepolicy/common/hal_camera_default.te b/sepolicy/common/hal_camera_default.te
index eb88c36..6e02020 100644
--- a/sepolicy/common/hal_camera_default.te
+++ b/sepolicy/common/hal_camera_default.te
@@ -1,3 +1,4 @@
 vndbinder_use(hal_camera_default);
 allow hal_camera_default hal_graphics_mapper_hwservice:hwservice_manager find;
+hal_client_domain(hal_camera_default, hal_graphics_allocator);
 hal_client_domain(hal_camera_default, hal_graphics_composer)
diff --git a/sepolicy/common/hal_drm_clearkey.te b/sepolicy/common/hal_drm_clearkey.te
index 5632c3b..7c3fc3c 100644
--- a/sepolicy/common/hal_drm_clearkey.te
+++ b/sepolicy/common/hal_drm_clearkey.te
@@ -7,3 +7,4 @@
 hal_server_domain(hal_drm_clearkey, hal_drm)
 
 vndbinder_use(hal_drm_clearkey);
+allow hal_drm_clearkey hal_allocator_server:fd use;
diff --git a/sepolicy/common/hal_graphics_allocator_default.te b/sepolicy/common/hal_graphics_allocator_default.te
index c57e452..527cabd 100644
--- a/sepolicy/common/hal_graphics_allocator_default.te
+++ b/sepolicy/common/hal_graphics_allocator_default.te
@@ -1,4 +1,6 @@
 allow hal_graphics_allocator_default graphics_device:dir search;
-allow hal_graphics_allocator_default graphics_device:chr_file { ioctl open read write };
+allow hal_graphics_allocator_default graphics_device:chr_file { ioctl open read write map rw_file_perms };
+allow hal_graphics_allocator_default gpu_device:dir search;
+allow hal_graphics_allocator_default gpu_device:chr_file { ioctl open read write map rw_file_perms };
 allow hal_graphics_allocator_default dumpstate:fd use;
 allow hal_graphics_allocator_default dumpstate:fifo_file write;
diff --git a/sepolicy/common/hal_graphics_composer_default.te b/sepolicy/common/hal_graphics_composer_default.te
index e9205cd..ba7ca64 100644
--- a/sepolicy/common/hal_graphics_composer_default.te
+++ b/sepolicy/common/hal_graphics_composer_default.te
@@ -1,3 +1,6 @@
 #============= hal_graphics_composer_default ==============
-allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write map };
+hal_client_domain(hal_graphics_composer_default, hal_graphics_allocator);
 
+allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write map };
+allow hal_graphics_composer_default graphics_device:chr_file { ioctl open read write map };
+allow hal_graphics_composer_default gpu_device:chr_file { ioctl open read write map };
diff --git a/sepolicy/common/healthd.te b/sepolicy/common/healthd.te
deleted file mode 100644
index 80db9b7..0000000
--- a/sepolicy/common/healthd.te
+++ /dev/null
@@ -1,4 +0,0 @@
-# Allow to read /sys/class/power_supply directory
-allow healthd sysfs:dir r_dir_perms;
-
-allow healthd self:capability2 wake_alarm;
diff --git a/sepolicy/common/netd.te b/sepolicy/common/netd.te
deleted file mode 100644
index 09a28b9..0000000
--- a/sepolicy/common/netd.te
+++ /dev/null
@@ -1,3 +0,0 @@
-dontaudit netd self:capability sys_module;
-#TODO: This can safely be ignored until b/62954877 is fixed
-dontaudit netd kernel:system module_request;
diff --git a/sepolicy/common/surfaceflinger.te b/sepolicy/common/surfaceflinger.te
index 2bba8a7..575ec1b 100644
--- a/sepolicy/common/surfaceflinger.te
+++ b/sepolicy/common/surfaceflinger.te
@@ -1,5 +1,6 @@
 allow surfaceflinger self:process execmem;
 allow surfaceflinger ashmem_device:chr_file execute;
+allow surfaceflinger gpu_device:chr_file { ioctl open read write map };
 
 typeattribute surfaceflinger system_writes_vendor_properties_violators;
 set_prop(surfaceflinger, qemu_prop)
diff --git a/sepolicy/x86/healthd.te b/sepolicy/x86/healthd.te
deleted file mode 100644
index 6efedfb..0000000
--- a/sepolicy/x86/healthd.te
+++ /dev/null
@@ -1,2 +0,0 @@
-allow healthd self:capability sys_nice;
-allow healthd self:global_capability2_class_set wake_alarm;
diff --git a/ueventd.ranchu.rc b/ueventd.ranchu.rc
index 38ad757..db42634 100644
--- a/ueventd.ranchu.rc
+++ b/ueventd.ranchu.rc
@@ -4,3 +4,6 @@
 /dev/ttyS*                0666   system     system
 /dev/goldfish_sync        0666   system     system
 /dev/goldfish_address_space 0666 system     system
+/dev/dri/card0 0660 system graphics
+/dev/dri/controlD64 0660 system graphics
+/dev/dri/renderD128 0666 system graphics
diff --git a/vendor.mk b/vendor.mk
index 712a505..b902b18 100644
--- a/vendor.mk
+++ b/vendor.mk
@@ -16,6 +16,7 @@
 #
 # This file is to configure vendor/data partitions of emulator-related products
 #
+$(call inherit-product-if-exists, frameworks/native/build/phone-xhdpi-2048-dalvik-heap.mk)
 
 ifeq ($(QEMU_DISABLE_AVB),true)
   ifeq ($(QEMU_USE_SYSTEM_EXT_PARTITIONS),true)
@@ -31,6 +32,7 @@
   endif
 endif
 
+PRODUCT_SYSTEM_EXT_PROPERTIES += ro.lockscreen.disable.default=1
 ifeq ($(QEMU_USE_SYSTEM_EXT_PARTITIONS),true)
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/fstab.ranchu.initrd.ex:$(TARGET_COPY_OUT_RAMDISK)/fstab.ranchu \
@@ -40,46 +42,32 @@
 
 DISABLE_RILD_OEM_HOOK := true
 
+DEVICE_MANIFEST_FILE := device/generic/goldfish/manifest.xml
+
 # Device modules
 PRODUCT_PACKAGES += \
     vulkan.ranchu \
-    gralloc.goldfish \
-    gralloc.goldfish.default \
-    gralloc.ranchu \
-    libGLESv1_CM_emulation \
-    lib_renderControl_enc \
-    libEGL_emulation \
-    libGLESv2_enc \
     libandroidemu \
-    libvulkan_enc \
     libOpenglCodecCommon \
     libOpenglSystemCommon \
-    libGLESv2_emulation \
-    libGLESv1_enc \
     libEGL_swiftshader \
     libGLESv1_CM_swiftshader \
     libGLESv2_swiftshader \
     libgoldfish-ril \
     qemu-props \
-    camera.goldfish \
-    camera.goldfish.jpeg \
-    camera.ranchu \
-    camera.ranchu.jpeg \
     gps.goldfish \
     gps.ranchu \
     fingerprint.goldfish \
     audio.primary.goldfish \
     audio.primary.goldfish_legacy \
     power.goldfish \
+    stagefright \
     power.ranchu \
     fingerprint.ranchu \
-    sensors.ranchu \
-    android.hardware.graphics.composer@2.3-impl \
-    android.hardware.graphics.composer@2.3-service \
-    android.hardware.graphics.allocator@2.0-service \
-    android.hardware.graphics.allocator@2.0-impl \
-    android.hardware.graphics.mapper@2.0-impl \
-    hwcomposer.goldfish \
+    android.hardware.graphics.composer@2.1-impl \
+    android.hardware.graphics.composer@2.1-service \
+    android.hardware.graphics.allocator@3.0-service \
+    android.hardware.graphics.mapper@3.0-impl \
     hwcomposer.ranchu \
     toybox_vendor \
     android.hardware.audio@2.0-service \
@@ -91,17 +79,31 @@
     audio.r_submix.default \
     local_time.default \
     SdkSetup \
+    libstagefrighthw \
+    libstagefright_goldfish_vpxdec \
+    libstagefright_goldfish_avcdec \
     MultiDisplayProvider
 
+ifneq ($(BUILD_EMULATOR_OPENGL),false)
 PRODUCT_PACKAGES += \
-    android.hardware.audio@4.0-impl:32 \
-    android.hardware.audio.effect@4.0-impl:32 \
+    libGLESv1_CM_emulation \
+    lib_renderControl_enc \
+    libEGL_emulation \
+    libGLESv2_enc \
+    libvulkan_enc \
+    libGLESv2_emulation \
+    libGLESv1_enc
+endif
+
+PRODUCT_PACKAGES += \
+    android.hardware.audio@5.0-impl:32 \
+    android.hardware.audio.effect@5.0-impl:32 \
     android.hardware.broadcastradio@1.1-service \
     android.hardware.broadcastradio@1.0-impl \
     android.hardware.soundtrigger@2.0-impl
 
 PRODUCT_PACKAGES += \
-    android.hardware.health@2.0-service.goldfish
+    android.hardware.health@2.0-service
 
 PRODUCT_PACKAGES += \
     android.hardware.keymaster@4.0-impl \
@@ -114,12 +116,16 @@
 PRODUCT_PACKAGES += \
     android.hardware.gnss@1.0-service \
     android.hardware.gnss@1.0-impl
+DEVICE_MANIFEST_FILE += device/generic/goldfish/manifest.gnss.xml
 endif
 
-
+ifneq ($(EMULATOR_VENDOR_NO_SENSORS),true)
 PRODUCT_PACKAGES += \
     android.hardware.sensors@1.0-impl \
-    android.hardware.sensors@1.0-service
+    android.hardware.sensors@1.0-service \
+    sensors.ranchu
+DEVICE_MANIFEST_FILE += device/generic/goldfish/manifest.sensors.xml
+endif
 
 PRODUCT_PACKAGES += \
     android.hardware.drm@1.0-service \
@@ -135,10 +141,17 @@
 
 PRODUCT_PROPERTY_OVERRIDES += persist.sys.zram_enabled=1 \
 
+ifneq ($(EMULATOR_VENDOR_NO_CAMERA),true)
 PRODUCT_PACKAGES += \
     camera.device@1.0-impl \
     android.hardware.camera.provider@2.4-service \
     android.hardware.camera.provider@2.4-impl \
+    camera.goldfish \
+    camera.goldfish.jpeg \
+    camera.ranchu \
+    camera.ranchu.jpeg
+DEVICE_MANIFEST_FILE += device/generic/goldfish/manifest.camera.xml
+endif
 
 PRODUCT_PACKAGES += \
     android.hardware.gatekeeper@1.0-service.software
@@ -154,18 +167,34 @@
 	wifi_forwarder \
 	wpa_supplicant \
 
-PRODUCT_PACKAGES += android.hardware.thermal@2.0-service.mock
+# Thermal
+PRODUCT_PACKAGES += \
+	android.hardware.thermal@2.0-service.mock
 
-# Needed for /system/priv-app/SdkSetup/SdkSetup.apk to pass CTS android.permission2.cts.PrivappPermissionsTest.
-PRODUCT_COPY_FILES += \
-    device/generic/goldfish/data/etc/permissions/privapp-permissions-goldfish.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-goldfish.xml
+# Atrace
+PRODUCT_PACKAGES += \
+	android.hardware.atrace@1.0-service
+
+# Vibrator
+PRODUCT_PACKAGES += \
+	android.hardware.vibrator-service.example
+
+# Authsecret
+PRODUCT_PACKAGES += \
+    android.hardware.authsecret@1.0-service
+
+# Input Classifier HAL
+PRODUCT_PACKAGES += \
+    android.hardware.input.classifier@1.0-service.default
+
+# power stats
+PRODUCT_PACKAGES += \
+    android.hardware.power.stats@1.0-service.mock
 
 # Goldfish does not support ION needed for Codec 2.0
 PRODUCT_PROPERTY_OVERRIDES += \
     debug.stagefright.ccodec=0
 
-DEVICE_MANIFEST_FILE := device/generic/goldfish/manifest.xml
-
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/fstab.ranchu.initrd:$(TARGET_COPY_OUT_RAMDISK)/fstab.ranchu \
     device/generic/goldfish/data/etc/apns-conf.xml:data/misc/apns/apns-conf.xml \
@@ -213,7 +242,7 @@
     frameworks/native/data/etc/android.hardware.vulkan.compute-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.compute.xml \
     frameworks/native/data/etc/android.hardware.vulkan.version-1_1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.version.xml \
     frameworks/native/data/etc/android.software.autofill.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.autofill.xml \
-    frameworks/native/data/etc/android.software.verified_boot.xml:system/etc/permissions/android.software.verified_boot.xml \
+    frameworks/native/data/etc/android.software.verified_boot.xml:${TARGET_COPY_OUT_PRODUCT}/etc/permissions/android.software.verified_boot.xml \
     frameworks/av/media/libeffects/data/audio_effects.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_effects.xml \
     device/generic/goldfish/audio_policy.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy.conf \
     frameworks/av/services/audiopolicy/config/audio_policy_configuration_generic.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_configuration.xml \
@@ -222,3 +251,4 @@
     frameworks/av/services/audiopolicy/config/audio_policy_volumes.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes.xml \
     frameworks/av/services/audiopolicy/config/default_volume_tables.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default_volume_tables.xml \
     frameworks/av/services/audiopolicy/config/surround_sound_configuration_5_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/surround_sound_configuration_5_0.xml \
+    device/generic/goldfish/data/etc/permissions/privapp-permissions-goldfish.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/privapp-permissions-goldfish.xml
diff --git a/vibrator/qemu.c b/vibrator/qemu.c
index 8b64b57..315fba1 100644
--- a/vibrator/qemu.c
+++ b/vibrator/qemu.c
@@ -36,7 +36,7 @@
 #  define  D(...)   ((void)0)
 #endif
 
-#include "qemu_pipe.h"
+#include "qemud.h"
 
 int
 qemu_check(void)
@@ -78,8 +78,7 @@
     int   fd;
     char  pipe_name[512];
 
-    snprintf(pipe_name, sizeof(pipe_name), "qemud:%s", name);
-    fd = qemu_pipe_open(pipe_name);
+    fd = qemud_channel_open(name);
     if (fd < 0) {
         D("no qemud pipe: %s", strerror(errno));
         return -1;
@@ -91,43 +90,6 @@
 }
 
 static int
-qemu_channel_open_qemud( QemuChannel*  channel,
-                         const char*   name )
-{
-    int   fd, ret, namelen = strlen(name);
-    char  answer[2];
-
-    fd = socket_local_client( "qemud",
-                              ANDROID_SOCKET_NAMESPACE_RESERVED,
-                              SOCK_STREAM );
-    if (fd < 0) {
-        D("no qemud control socket: %s", strerror(errno));
-        return -1;
-    }
-
-    /* send service name to connect */
-    if (qemu_fd_write(fd, name, namelen) != namelen) {
-        D("can't send service name to qemud: %s",
-           strerror(errno));
-        close(fd);
-        return -1;
-    }
-
-    /* read answer from daemon */
-    if (qemu_fd_read(fd, answer, 2) != 2 ||
-        answer[0] != 'O' || answer[1] != 'K') {
-        D("cant' connect to %s service through qemud", name);
-        close(fd);
-        return -1;
-    }
-
-    channel->is_qemud = 1;
-    channel->fd       = fd;
-    return 0;
-}
-
-
-static int
 qemu_channel_open_qemud_old( QemuChannel*  channel,
                              const char*   name )
 {
@@ -196,9 +158,6 @@
             if (qemu_channel_open_qemud_pipe(channel, name) == 0)
                 break;
 
-            if (qemu_channel_open_qemud(channel, name) == 0)
-                break;
-
             if (qemu_channel_open_qemud_old(channel, name) == 0)
                 break;