diff --git a/drm/crypto/1.0/Android.bp b/drm/crypto/1.0/Android.bp
new file mode 100644
index 0000000..dd6805d
--- /dev/null
+++ b/drm/crypto/1.0/Android.bp
@@ -0,0 +1,64 @@
+// This file is autogenerated by hidl-gen. Do not edit manually.
+
+genrule {
+    name: "android.hardware.drm.crypto@1.0_genc++",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.drm.crypto@1.0",
+    srcs: [
+        "types.hal",
+        "ICryptoFactory.hal",
+        "ICryptoPlugin.hal",
+    ],
+    out: [
+        "android/hardware/drm/crypto/1.0/types.cpp",
+        "android/hardware/drm/crypto/1.0/CryptoFactoryAll.cpp",
+        "android/hardware/drm/crypto/1.0/CryptoPluginAll.cpp",
+    ],
+}
+
+genrule {
+    name: "android.hardware.drm.crypto@1.0_genc++_headers",
+    tools: ["hidl-gen"],
+    cmd: "$(location hidl-gen) -o $(genDir) -Lc++ -randroid.hardware:hardware/interfaces -randroid.hidl:system/libhidl/transport android.hardware.drm.crypto@1.0",
+    srcs: [
+        "types.hal",
+        "ICryptoFactory.hal",
+        "ICryptoPlugin.hal",
+    ],
+    out: [
+        "android/hardware/drm/crypto/1.0/types.h",
+        "android/hardware/drm/crypto/1.0/ICryptoFactory.h",
+        "android/hardware/drm/crypto/1.0/IHwCryptoFactory.h",
+        "android/hardware/drm/crypto/1.0/BnCryptoFactory.h",
+        "android/hardware/drm/crypto/1.0/BpCryptoFactory.h",
+        "android/hardware/drm/crypto/1.0/BsCryptoFactory.h",
+        "android/hardware/drm/crypto/1.0/ICryptoPlugin.h",
+        "android/hardware/drm/crypto/1.0/IHwCryptoPlugin.h",
+        "android/hardware/drm/crypto/1.0/BnCryptoPlugin.h",
+        "android/hardware/drm/crypto/1.0/BpCryptoPlugin.h",
+        "android/hardware/drm/crypto/1.0/BsCryptoPlugin.h",
+    ],
+}
+
+cc_library_shared {
+    name: "android.hardware.drm.crypto@1.0",
+    generated_sources: ["android.hardware.drm.crypto@1.0_genc++"],
+    generated_headers: ["android.hardware.drm.crypto@1.0_genc++_headers"],
+    export_generated_headers: ["android.hardware.drm.crypto@1.0_genc++_headers"],
+    shared_libs: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "libutils",
+        "libcutils",
+        "android.hidl.base@1.0",
+    ],
+    export_shared_lib_headers: [
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "libutils",
+        "android.hidl.base@1.0",
+    ],
+}
diff --git a/drm/crypto/1.0/ICryptoFactory.hal b/drm/crypto/1.0/ICryptoFactory.hal
new file mode 100644
index 0000000..58f86df
--- /dev/null
+++ b/drm/crypto/1.0/ICryptoFactory.hal
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.drm.crypto@1.0;
+
+import ICryptoPlugin;
+
+/**
+ * Ref: frameworks/native/include/media/hardware/CryptoAPI.h:CryptoFactory
+ *
+ * ICryptoFactory is the main entry point for interacting with a vendor's
+ * crypto HAL to create crypto plugins. Crypto plugins create crypto sessions
+ * which are used by a codec to decrypt protected video content.
+ */
+interface ICryptoFactory {
+    /*
+     * Determine if a crypto scheme is supported by this HAL
+     *
+     * @param uuid identifies the crypto scheme in question
+     * @return isSupported must be true only if the scheme is supported
+     */
+    isCryptoSchemeSupported(uint8_t[16] uuid) generates(bool isSupported);
+
+    /*
+     * Create a crypto plugin for the specified uuid and scheme-specific
+     * initialization data.
+     *
+     * @param uuid uniquely identifies the drm scheme. See
+     * http://dashif.org/identifiers/protection for uuid assignments
+     * @param initData scheme-specific init data.
+     * @return the status of the call
+     * @return the created ICryptoPlugin
+    */
+    createPlugin(uint8_t[16] uuid, vec<uint8_t> initData)
+        generates (Status status, ICryptoPlugin cryptoPlugin);
+
+    /*
+     * Destroy a previously created crypto plugin
+     *
+     * @return status the status of the call
+     */
+    destroyPlugin() generates(Status status);
+};
diff --git a/drm/crypto/1.0/ICryptoPlugin.hal b/drm/crypto/1.0/ICryptoPlugin.hal
new file mode 100644
index 0000000..1255fdb
--- /dev/null
+++ b/drm/crypto/1.0/ICryptoPlugin.hal
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package android.hardware.drm.crypto@1.0;
+
+import android.hardware.drm.crypto@1.0::types;
+
+/**
+ * Ref: frameworks/native/include/media/hardware/CryptoAPI.h:CryptoPlugin
+ *
+ * ICryptoPlugin is the HAL for vendor-provided crypto plugins.
+ * It allows crypto sessions to be opened and operated on, to
+ * load crypto keys for a codec to decrypt protected video content.
+ */
+interface ICryptoPlugin {
+    /*
+     * Check if the specified mime-type requires a secure decoder
+     * component.
+     *
+     * @param mime The content mime-type
+     * @return secureRequired must be true only if a secure decoder is required
+     * for the specified mime-type
+     */
+    requiresSecureDecoderComponent(string mime)
+        generates(bool secureRequired);
+
+    /*
+     * Notify a plugin of the currently configured resolution
+     *
+     * @param width - the display resolutions's width
+     * @param height - the display resolution's height
+     */
+    notifyResolution(uint32_t width, uint32_t height);
+
+    /*
+     * Associate a mediadrm session with this crypto session
+     *
+     * @param sessionId the MediaDrm session ID to associate with this crypto
+     * session
+     * @return the status of the call
+     */
+    setMediaDrmSession(vec<uint8_t> sessionId) generates(Status status);
+
+    /*
+     * Decrypt an array of subsamples from the source memory buffer to the
+     * destination memory buffer.
+     *
+     * @param secure a flag to indicate if a secure decoder is being used. This
+     * enables the plugin to configure buffer modes to work consistently with
+     * a secure decoder.
+     * @param the keyId for the key that should be used to do the
+     * the decryption. The keyId refers to a key in the associated
+     * MediaDrm instance.
+     * @param iv the initialization vector to use
+     * @param mode the crypto mode to use
+     * @param pattern the crypto pattern to use
+     * @param subSamples a vector of subsamples indicating the number
+     * of clear and encrypted bytes to process. This allows the decrypt
+     * call to operate on a range of subsamples in a single call
+     * @param source the input buffer for the decryption
+     * @param destination the output buffer for the decryption
+     * @return status the status of the call
+     * @return bytesWritten the number of bytes output from the decryption
+     * @return detailedError if the error is a vendor-specific error, the
+     * vendor's crypto HAL may provide a detailed error string to help
+     * describe the error.
+     */
+    decrypt(bool secure, uint8_t[16] keyId, uint8_t[16] iv, Mode mode,
+        Pattern pattern, vec<SubSample> subSamples,
+            memory source, DestinationBuffer destination)
+        generates(Status status, uint32_t bytesWritten, string detailedError);
+};
diff --git a/drm/crypto/1.0/types.hal b/drm/crypto/1.0/types.hal
new file mode 100644
index 0000000..7e853b8
--- /dev/null
+++ b/drm/crypto/1.0/types.hal
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.hardware.drm.crypto@1.0;
+
+enum Status : uint32_t {
+    /**
+     * The Crypto Plugin must return ERROR_DRM_NO_LICENSE if decryption is
+     * attempted when the license keys have not been loaded into the crypto
+     * session.
+     */
+    ERROR_DRM_NO_LICENSE,
+
+    /**
+     * The Crypto Plugin must return ERROR_DRM_LICENSE_EXPIRED if decryption
+     * is attempted when the license keys have expired and are no longer usable.
+     */
+    ERROR_DRM_LICENSE_EXPIRED,
+
+    /**
+     * The Crypto Plugin must return ERROR_DRM_RESOURCE_BUSY when a required
+     * crypto resource cannot be allocated while attempting decryption.
+     */
+    ERROR_DRM_RESOURCE_BUSY,
+
+    /**
+     * The Crypto Plugin must return ERROR_DRM_INSUFFICIENT_OUTPUT_PROTECTION
+     * when the output protection level enabled on the device is not
+     * sufficient to meet the requirements in the license policy.  HDCP is an
+     * example of a form of output protection.
+     */
+    ERROR_DRM_INSUFFICIENT_OUTPUT_PROTECTION,
+
+    /**
+     * The Crypto Plugin must return ERROR_DRM_SESSION_NOT_OPENED when
+     * decryption is attempted on a session that is not opened.
+     */
+    ERROR_DRM_SESSION_NOT_OPENED,
+
+    /**
+     * The Crypto Plugin must return ERROR_DRM_CANNOT_HANDLE when an operation
+     * is attempted that cannot be supported by the crypto system of the device.
+     */
+    ERROR_DRM_CANNOT_HANDLE,
+
+    /**
+     * The Crypto Plugin must return ERROR_UNKNOWN_CRYPTO_EXCEPTION in any
+     * fatal condition that is not covered by the other error messages.
+     */
+    ERROR_UNKNOWN_CRYPTO_EXCEPTION,
+};
+
+/**
+ * Enumerate the supported crypto modes
+ */
+enum Mode : uint32_t {
+    UNENCRYPTED = 0, // Samples are unencrypted
+    AES_CTR     = 1, // Samples are encrypted with AES CTR mode
+    AES_CBC_CTS = 2, // Samples are encrypted with AES CBC CTS mode
+    AES_CBC     = 3, // Samples are encrypted with AES CBC mode
+};
+
+/**
+ * A subsample consists of some number of bytes of clear (unencrypted)
+ * data followed by a number of bytes of encrypted data.
+ */
+struct SubSample {
+    uint32_t numBytesOfClearData;
+    uint32_t numBytesOfEncryptedData;
+};
+
+/**
+ * A crypto Pattern is a repeating sequence of encrypted and clear blocks
+ * occuring within the bytes indicated by mNumBytesOfEncryptedDatad bytes
+ * of a subsample. Patterns are used to reduce the CPU overhead of
+ * decrypting samples. As an example, HLS uses 1:9 patterns where every
+ * 10th block is encrypted.
+ */
+struct Pattern {
+    /**
+     * The number of blocks to be encrypted in the pattern. If zero,
+     * pattern encryption is inoperative.
+     */
+    uint32_t encryptBlocks;
+
+    /**
+     * The number of blocks to be skipped (left clear) in the pattern. If
+     * zero, pattern encryption is inoperative.
+     */
+    uint32_t skipBlocks;
+};
+
+enum BufferType : uint32_t {
+    SHARED_MEMORY = 0,
+    NATIVE_HANDLE = 1,
+};
+
+
+/**
+ * A decrypt destination buffer can be either normal user-space shared
+ * memory for the non-secure decrypt case, or it can be a secure buffer
+ * which is referenced by a native-handle. The native handle is allocated
+ * by the vendor's buffer allocator.
+ */
+struct DestinationBuffer {
+    /**
+     * The type of the buffer
+     */
+    BufferType type;
+
+    /**
+     * If type == SHARED_MEMORY, the decrypted data must be written
+     * to user-space non-secure shared memory.
+     */
+    memory nonsecureMemory;
+
+    /**
+     * If type == NATIVE_HANDLE, the decrypted data must be written
+     * to secure memory referenced by the vendor's buffer allocator.
+     */
+    handle secureMemory;
+};