diff --git a/drm/libmediadrm/Android.mk b/drm/libmediadrm/Android.mk
index a57fafa..590622e 100644
--- a/drm/libmediadrm/Android.mk
+++ b/drm/libmediadrm/Android.mk
@@ -48,7 +48,8 @@
     android.hidl.base@1.0 \
     android.hardware.drm@1.0 \
     libhidlbase \
-    libhidlmemory
+    libhidlmemory \
+    libhidltransport
 endif
 
 LOCAL_CFLAGS += -Werror -Wno-error=deprecated-declarations -Wall
diff --git a/drm/libmediadrm/CryptoHal.cpp b/drm/libmediadrm/CryptoHal.cpp
index 5732613..1fda06c 100644
--- a/drm/libmediadrm/CryptoHal.cpp
+++ b/drm/libmediadrm/CryptoHal.cpp
@@ -17,10 +17,9 @@
 //#define LOG_NDEBUG 0
 #define LOG_TAG "CryptoHal"
 #include <utils/Log.h>
-#include <dirent.h>
-#include <dlfcn.h>
 
 #include <android/hardware/drm/1.0/types.h>
+#include <android/hidl/manager/1.0/IServiceManager.h>
 
 #include <binder/IMemory.h>
 #include <cutils/native_handle.h>
@@ -47,6 +46,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
+using ::android::hidl::manager::V1_0::IServiceManager;
 using ::android::sp;
 
 
@@ -101,31 +101,52 @@
 
 
 CryptoHal::CryptoHal()
-    : mFactory(makeCryptoFactory()),
-      mInitCheck((mFactory == NULL) ? ERROR_UNSUPPORTED : NO_INIT),
+    : mFactories(makeCryptoFactories()),
+      mInitCheck((mFactories.size() == 0) ? ERROR_UNSUPPORTED : NO_INIT),
       mNextBufferId(0) {
 }
 
 CryptoHal::~CryptoHal() {
 }
 
+Vector<sp<ICryptoFactory>> CryptoHal::makeCryptoFactories() {
+    Vector<sp<ICryptoFactory>> factories;
 
-sp<ICryptoFactory> CryptoHal::makeCryptoFactory() {
-    sp<ICryptoFactory> factory = ICryptoFactory::getService("crypto");
-    if (factory == NULL) {
-        ALOGE("Failed to make crypto factory");
+    auto manager = ::IServiceManager::getService("manager");
+    if (manager != NULL) {
+        manager->listByInterface(ICryptoFactory::descriptor,
+                [&factories](const hidl_vec<hidl_string> &registered) {
+                    for (const auto &instance : registered) {
+                        auto factory = ICryptoFactory::getService(instance);
+                        if (factory != NULL) {
+                            factories.push_back(factory);
+                            ALOGI("makeCryptoFactories: factory instance %s is %s",
+                                    instance.c_str(),
+                                    factory->isRemote() ? "Remote" : "Not Remote");
+                        }
+                    }
+                }
+            );
     }
-    return factory;
+
+    if (factories.size() == 0) {
+        // must be in passthrough mode, load the default passthrough service
+        auto passthrough = ICryptoFactory::getService("crypto");
+        if (passthrough != NULL) {
+            ALOGI("makeCryptoFactories: using default crypto instance");
+            factories.push_back(passthrough);
+        } else {
+            ALOGE("Failed to find any crypto factories");
+        }
+    }
+    return factories;
 }
 
-sp<ICryptoPlugin> CryptoHal::makeCryptoPlugin(const uint8_t uuid[16],
-        const void *initData, size_t initDataSize) {
-    if (mFactory == NULL){
-        return NULL;
-    }
+sp<ICryptoPlugin> CryptoHal::makeCryptoPlugin(const sp<ICryptoFactory>& factory,
+        const uint8_t uuid[16], const void *initData, size_t initDataSize) {
 
     sp<ICryptoPlugin> plugin;
-    Return<void> hResult = mFactory->createPlugin(toHidlArray16(uuid),
+    Return<void> hResult = factory->createPlugin(toHidlArray16(uuid),
             toHidlVec(initData, initDataSize),
             [&](Status status, const sp<ICryptoPlugin>& hPlugin) {
                 if (status != Status::OK) {
@@ -146,17 +167,24 @@
 
 bool CryptoHal::isCryptoSchemeSupported(const uint8_t uuid[16]) {
     Mutex::Autolock autoLock(mLock);
-    if (mFactory != NULL) {
-        return mFactory->isCryptoSchemeSupported(uuid);
+
+    for (size_t i = 0; i < mFactories.size(); i++) {
+        if (mFactories[i]->isCryptoSchemeSupported(uuid)) {
+            return true;
+        }
     }
     return false;
 }
 
-status_t CryptoHal::createPlugin(
-        const uint8_t uuid[16], const void *data, size_t size) {
+status_t CryptoHal::createPlugin(const uint8_t uuid[16], const void *data,
+        size_t size) {
     Mutex::Autolock autoLock(mLock);
 
-    mPlugin = makeCryptoPlugin(uuid, data, size);
+    for (size_t i = 0; i < mFactories.size(); i++) {
+        if (mFactories[i]->isCryptoSchemeSupported(uuid)) {
+            mPlugin = makeCryptoPlugin(mFactories[i], uuid, data, size);
+        }
+    }
 
     if (mPlugin == NULL) {
         mInitCheck = ERROR_UNSUPPORTED;
diff --git a/drm/libmediadrm/DrmHal.cpp b/drm/libmediadrm/DrmHal.cpp
index 8200d55..595b895 100644
--- a/drm/libmediadrm/DrmHal.cpp
+++ b/drm/libmediadrm/DrmHal.cpp
@@ -20,12 +20,11 @@
 
 #include <binder/IPCThreadState.h>
 #include <binder/IServiceManager.h>
-#include <dirent.h>
-#include <dlfcn.h>
 
 #include <android/hardware/drm/1.0/IDrmFactory.h>
 #include <android/hardware/drm/1.0/IDrmPlugin.h>
 #include <android/hardware/drm/1.0/types.h>
+#include <android/hidl/manager/1.0/IServiceManager.h>
 
 #include <media/DrmHal.h>
 #include <media/DrmSessionClientInterface.h>
@@ -52,6 +51,7 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
+using ::android::hidl::manager::V1_0::IServiceManager;
 using ::android::sp;
 
 namespace android {
@@ -110,9 +110,9 @@
     return keyedVector;
 }
 
-static List<Vector<uint8_t> > toSecureStops(const hidl_vec<SecureStop>&
+static List<Vector<uint8_t>> toSecureStops(const hidl_vec<SecureStop>&
         hSecureStops) {
-    List<Vector<uint8_t> > secureStops;
+    List<Vector<uint8_t>> secureStops;
     for (size_t i = 0; i < hSecureStops.size(); i++) {
         secureStops.push_back(toVector(hSecureStops[i].opaqueData));
     }
@@ -189,43 +189,61 @@
 
 DrmHal::DrmHal()
    : mDrmSessionClient(new DrmSessionClient(this)),
-     mFactory(makeDrmFactory()),
-     mInitCheck((mFactory == NULL) ? ERROR_UNSUPPORTED : NO_INIT) {
+     mFactories(makeDrmFactories()),
+     mInitCheck((mFactories.size() == 0) ? ERROR_UNSUPPORTED : NO_INIT) {
 }
 
 DrmHal::~DrmHal() {
     DrmSessionManager::Instance()->removeDrm(mDrmSessionClient);
 }
 
-sp<IDrmFactory> DrmHal::makeDrmFactory() {
-    sp<IDrmFactory> factory = IDrmFactory::getService("drm");
-    if (factory == NULL) {
-        ALOGE("Failed to make drm factory");
-        return NULL;
+Vector<sp<IDrmFactory>> DrmHal::makeDrmFactories() {
+    Vector<sp<IDrmFactory>> factories;
+
+    auto manager = ::IServiceManager::getService("manager");
+
+    if (manager != NULL) {
+        manager->listByInterface(IDrmFactory::descriptor,
+                [&factories](const hidl_vec<hidl_string> &registered) {
+                    for (const auto &instance : registered) {
+                        auto factory = IDrmFactory::getService(instance);
+                        if (factory != NULL) {
+                            factories.push_back(factory);
+                            ALOGI("makeDrmFactories: factory instance %s is %s",
+                                    instance.c_str(),
+                                    factory->isRemote() ? "Remote" : "Not Remote");
+                        }
+                    }
+                }
+            );
     }
 
-    ALOGD("makeDrmFactory: service is %s",
-            factory->isRemote() ? "Remote" : "Not Remote");
-
-    return factory;
+    if (factories.size() == 0) {
+        // must be in passthrough mode, load the default passthrough service
+        auto passthrough = IDrmFactory::getService("drm");
+        if (passthrough != NULL) {
+            ALOGI("makeDrmFactories: using default drm instance");
+            factories.push_back(passthrough);
+        } else {
+            ALOGE("Failed to find any drm factories");
+        }
+    }
+    return factories;
 }
 
-sp<IDrmPlugin> DrmHal::makeDrmPlugin(const uint8_t uuid[16],
-        const String8& appPackageName) {
-    if (mFactory == NULL){
-        return NULL;
-    }
+sp<IDrmPlugin> DrmHal::makeDrmPlugin(const sp<IDrmFactory>& factory,
+        const uint8_t uuid[16], const String8& appPackageName) {
 
     sp<IDrmPlugin> plugin;
-    Return<void> hResult = mFactory->createPlugin(uuid, appPackageName.string(),
+    Return<void> hResult = factory->createPlugin(uuid, appPackageName.string(),
             [&](Status status, const sp<IDrmPlugin>& hPlugin) {
-      if (status != Status::OK) {
-        ALOGD("Failed to make drm plugin");
-        return;
-      }
-      plugin = hPlugin;
-    }
-    );
+                if (status != Status::OK) {
+                    ALOGE("Failed to make drm plugin");
+                    return;
+                }
+                plugin = hPlugin;
+            }
+        );
     return plugin;
 }
 
@@ -346,22 +364,30 @@
 
 bool DrmHal::isCryptoSchemeSupported(const uint8_t uuid[16], const String8 &mimeType) {
     Mutex::Autolock autoLock(mLock);
-    bool result = false;
 
-    if (mFactory != NULL && mFactory->isCryptoSchemeSupported(uuid)) {
-        result = true;
-        if (mimeType != "") {
-            result = mFactory->isContentTypeSupported(mimeType.string());
+    for (size_t i = 0; i < mFactories.size(); i++) {
+        if (mFactories[i]->isCryptoSchemeSupported(uuid)) {
+            if (mimeType != "") {
+                if (mFactories[i]->isContentTypeSupported(mimeType.string())) {
+                    return true;
+                }
+            } else {
+                return true;
+            }
         }
     }
-    return result;
+    return false;
 }
 
 status_t DrmHal::createPlugin(const uint8_t uuid[16],
         const String8& appPackageName) {
     Mutex::Autolock autoLock(mLock);
 
-    mPlugin = makeDrmPlugin(uuid, appPackageName);
+    for (size_t i = 0; i < mFactories.size(); i++) {
+        if (mFactories[i]->isCryptoSchemeSupported(uuid)) {
+            mPlugin = makeDrmPlugin(mFactories[i], uuid, appPackageName);
+        }
+    }
 
     if (mPlugin == NULL) {
         mInitCheck = ERROR_UNSUPPORTED;
@@ -628,7 +654,7 @@
     return hResult.isOk() ? err : DEAD_OBJECT;
 }
 
-status_t DrmHal::getSecureStops(List<Vector<uint8_t> > &secureStops) {
+status_t DrmHal::getSecureStops(List<Vector<uint8_t>> &secureStops) {
     Mutex::Autolock autoLock(mLock);
 
     if (mInitCheck != OK) {
diff --git a/media/libmedia/include/CryptoHal.h b/media/libmedia/include/CryptoHal.h
index 9d0c3e4..28ade20 100644
--- a/media/libmedia/include/CryptoHal.h
+++ b/media/libmedia/include/CryptoHal.h
@@ -20,11 +20,14 @@
 
 #include <android/hardware/drm/1.0/ICryptoFactory.h>
 #include <android/hardware/drm/1.0/ICryptoPlugin.h>
+
 #include <media/ICrypto.h>
 #include <utils/KeyedVector.h>
 #include <utils/threads.h>
 
-#include "SharedLibrary.h"
+using ::android::hardware::drm::V1_0::ICryptoFactory;
+using ::android::hardware::drm::V1_0::ICryptoPlugin;
+using ::android::hardware::drm::V1_0::SharedBuffer;
 
 class IMemoryHeap;
 
@@ -60,9 +63,8 @@
 private:
     mutable Mutex mLock;
 
-    sp<SharedLibrary> mLibrary;
-    sp<::android::hardware::drm::V1_0::ICryptoFactory> mFactory;
-    sp<::android::hardware::drm::V1_0::ICryptoPlugin> mPlugin;
+    const Vector<sp<ICryptoFactory>> mFactories;
+    sp<ICryptoPlugin> mPlugin;
 
     /**
      * mInitCheck is:
@@ -75,16 +77,13 @@
     KeyedVector<void *, uint32_t> mHeapBases;
     uint32_t mNextBufferId;
 
-    sp<::android::hardware::drm::V1_0::ICryptoFactory>
-            makeCryptoFactory();
-    sp<::android::hardware::drm::V1_0::ICryptoPlugin>
-            makeCryptoPlugin(const uint8_t uuid[16], const void *initData,
-                size_t size);
+    Vector<sp<ICryptoFactory>> makeCryptoFactories();
+    sp<ICryptoPlugin> makeCryptoPlugin(const sp<ICryptoFactory>& factory,
+            const uint8_t uuid[16], const void *initData, size_t size);
 
     void setHeapBase(const sp<IMemoryHeap>& heap);
 
-    status_t toSharedBuffer(const sp<IMemory>& memory,
-            ::android::hardware::drm::V1_0::SharedBuffer* buffer);
+    status_t toSharedBuffer(const sp<IMemory>& memory, ::SharedBuffer* buffer);
 
     DISALLOW_EVIL_CONSTRUCTORS(CryptoHal);
 };
diff --git a/media/libmedia/include/DrmHal.h b/media/libmedia/include/DrmHal.h
index 82d2555..e031765 100644
--- a/media/libmedia/include/DrmHal.h
+++ b/media/libmedia/include/DrmHal.h
@@ -87,7 +87,7 @@
                                               Vector<uint8_t> &certificate,
                                               Vector<uint8_t> &wrappedKey);
 
-    virtual status_t getSecureStops(List<Vector<uint8_t> > &secureStops);
+    virtual status_t getSecureStops(List<Vector<uint8_t>> &secureStops);
     virtual status_t getSecureStop(Vector<uint8_t> const &ssid, Vector<uint8_t> &secureStop);
 
     virtual status_t releaseSecureStops(Vector<uint8_t> const &ssRelease);
@@ -158,7 +158,7 @@
     mutable Mutex mEventLock;
     mutable Mutex mNotifyLock;
 
-    sp<IDrmFactory> mFactory;
+    const Vector<sp<IDrmFactory>> mFactories;
     sp<IDrmPlugin> mPlugin;
 
     /**
@@ -169,9 +169,9 @@
      */
     status_t mInitCheck;
 
-    sp<IDrmFactory> makeDrmFactory();
-    sp<IDrmPlugin> makeDrmPlugin(const uint8_t uuid[16],
-                                 const String8 &appPackageName);
+    Vector<sp<IDrmFactory>> makeDrmFactories();
+    sp<IDrmPlugin> makeDrmPlugin(const sp<IDrmFactory>& factory,
+            const uint8_t uuid[16], const String8& appPackageName);
 
     void writeByteArray(Parcel &obj, const hidl_vec<uint8_t>& array);