diff --git a/Android.bp b/Android.bp
index f31b444..6477ee9 100644
--- a/Android.bp
+++ b/Android.bp
@@ -15,4 +15,5 @@
 
 subdirs = [
     "bluetooth",
+    "recovery",
 ]
diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
index e559dad..a7ed59e 100644
--- a/BoardConfigCommon.mk
+++ b/BoardConfigCommon.mk
@@ -20,6 +20,8 @@
 PRODUCT_FULL_TREBLE_OVERRIDE := true
 BOARD_VNDK_VERSION := current
 
+TARGET_ENABLE_MEDIADRM_64 := true
+
 # generic wifi
 WPA_SUPPLICANT_VERSION := VER_0_8_X
 BOARD_WPA_SUPPLICANT_DRIVER := NL80211
@@ -27,7 +29,7 @@
 
 TARGET_NO_BOOTLOADER := true
 TARGET_NO_KERNEL := false
-TARGET_NO_RECOVERY := true
+TARGET_NO_RECOVERY ?= true
 TARGET_HARDWARE_3D := true
 BOARD_USES_GENERIC_AUDIO := true
 USE_CAMERA_STUB := true
@@ -54,3 +56,6 @@
 BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE := squashfs
 endif
 endif
+
+TARGET_RECOVERY_PIXEL_FORMAT := BGRA_8888
+TARGET_RECOVERY_UI_LIB := librecovery_ui_hikey
diff --git a/device-common.mk b/device-common.mk
index 27a5445..a99e15a 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -56,7 +56,7 @@
 PRODUCT_PACKAGES += ssh sftp scp sshd ssh-keygen sshd_config start-ssh
 
 # Add wifi-related packages
-PRODUCT_PACKAGES += libwpa_client wpa_supplicant hostapd wificond wifilogd
+PRODUCT_PACKAGES += libwpa_client wpa_supplicant hostapd wificond
 PRODUCT_PROPERTY_OVERRIDES += wifi.interface=wlan0 \
                               wifi.supplicant_scan_interval=15
 
@@ -80,6 +80,7 @@
 
 PRODUCT_PACKAGES += \
     android.hardware.drm@1.0-impl \
+    android.hardware.drm@1.0-service \
 
 PRODUCT_PACKAGES += libGLES_android
 
diff --git a/hikey-common.mk b/hikey-common.mk
index d4b8797..77ea15b 100644
--- a/hikey-common.mk
+++ b/hikey-common.mk
@@ -1,4 +1,3 @@
-
 ifndef TARGET_KERNEL_USE
 TARGET_KERNEL_USE=4.14
 endif
@@ -11,18 +10,13 @@
 
 PRODUCT_ENFORCE_VINTF_MANIFEST_OVERRIDE := true
 
-ifeq ($(TARGET_KERNEL_USE), 3.18)
-  TARGET_FSTAB := fstab.hikey-$(TARGET_KERNEL_USE)
+ifeq ($(TARGET_KERNEL_USE), 4.4)
   HIKEY_USE_LEGACY_TI_BLUETOOTH := true
 else
-  ifeq ($(TARGET_KERNEL_USE), 4.4)
-    HIKEY_USE_LEGACY_TI_BLUETOOTH := true
-  else
-    HIKEY_USE_LEGACY_TI_BLUETOOTH := false
-    HIKEY_USE_DRM_HWCOMPOSER := true
-  endif
-  TARGET_FSTAB := fstab.hikey
+  HIKEY_USE_LEGACY_TI_BLUETOOTH := false
+  HIKEY_USE_DRM_HWCOMPOSER := true
 endif
+TARGET_FSTAB := fstab.hikey
 
 $(call inherit-product, device/linaro/hikey/hikey/device-hikey.mk)
 $(call inherit-product, device/linaro/hikey/device-common.mk)
diff --git a/hikey/BoardConfig.mk b/hikey/BoardConfig.mk
index 90bbc6c..1e21446 100644
--- a/hikey/BoardConfig.mk
+++ b/hikey/BoardConfig.mk
@@ -6,35 +6,21 @@
 TARGET_CPU_VARIANT := cortex-a53
 TARGET_2ND_CPU_VARIANT := cortex-a53
 
-ifeq ($(TARGET_KERNEL_USE), 3.18)
 BOARD_KERNEL_CMDLINE := console=ttyAMA3,115200 androidboot.console=ttyAMA3 androidboot.hardware=hikey firmware_class.path=/vendor/firmware efi=noruntime
-else
-ifeq ($(TARGET_KERNEL_USE), 4.19)
-BOARD_KERNEL_CMDLINE := console=ttyAMA3,115200 androidboot.console=ttyAMA3 androidboot.hardware=hikey firmware_class.path=/vendor/firmware efi=noruntime
-else
-# FIQ debugger is deprecated and we'll remoeve this once kernel support in prebuilts are yanked
-BOARD_KERNEL_CMDLINE := console=ttyFIQ0 androidboot.console=ttyFIQ0 androidboot.hardware=hikey firmware_class.path=/vendor/firmware efi=noruntime
-endif
-endif
 
-ifneq ($(TARGET_ANDROID_VERITY),)
 # Enable dtb fstab for treble, with verity and system-as-root
 # NOTE: Disabled by default until b/111829702 is fixed
 BOARD_KERNEL_CMDLINE += overlay_mgr.overlay_dt_entry=hardware_cfg_enable_android_fstab_v2
 BOARD_KERNEL_CMDLINE += rootwait ro init=/init root=/dev/dm-0
 BOARD_KERNEL_CMDLINE += dm=\"system none ro,0 1 android-verity 179:9\"
 BOARD_BUILD_SYSTEM_ROOT_IMAGE := true
-else
-# Enable dtb fstab for treble
-BOARD_KERNEL_CMDLINE += overlay_mgr.overlay_dt_entry=hardware_cfg_enable_android_fstab
-endif
 
 ifneq ($(TARGET_SENSOR_MEZZANINE),)
 BOARD_KERNEL_CMDLINE += overlay_mgr.overlay_dt_entry=hardware_cfg_$(TARGET_SENSOR_MEZZANINE)
 endif
 
 ## printk.devkmsg only has meaning for kernel 4.9 and later
-## it would be ignored by kernel 3.18 and kernel 4.4
+## it would be ignored by kernel 4.4
 BOARD_KERNEL_CMDLINE += printk.devkmsg=on
 
 TARGET_NO_DTIMAGE := true
@@ -57,3 +43,5 @@
 BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_VENDORIMAGE_JOURNAL_SIZE := 0
 BOARD_VENDORIMAGE_EXTFS_INODE_COUNT := 2048
+
+TARGET_RECOVERY_FSTAB := device/linaro/hikey/hikey/$(TARGET_FSTAB)
diff --git a/hikey/device-hikey.mk b/hikey/device-hikey.mk
index f04561d..33be0f1 100644
--- a/hikey/device-hikey.mk
+++ b/hikey/device-hikey.mk
@@ -52,3 +52,8 @@
 
 # Include mali blobs from ARM
 PRODUCT_PACKAGES += libGLES_mali.so END_USER_LICENCE_AGREEMENT.txt
+
+ifneq ($(TARGET_NO_RECOVERY),true)
+PRODUCT_COPY_FILES += \
+	device/linaro/hikey/init.recovery.common.rc:recovery/root/init.recovery.hikey.rc
+endif
diff --git a/hikey/fstab.hikey-3.18 b/hikey/fstab.hikey-3.18
deleted file mode 100644
index 84fad07..0000000
--- a/hikey/fstab.hikey-3.18
+++ /dev/null
@@ -1,12 +0,0 @@
-# Android fstab file.
-#<src>                                                  <mnt_point>         <type>    <mnt_flags and options>                               <fs_mgr_flags>
-# The filesystem that contains the filesystem checker binary (typically /system) cannot
-# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
-
-#/dev/block/platform/f723d000.dwmmc0/by-name/system      /system             ext4      ro                                                           wait
-#/dev/block/platform/f723d000.dwmmc0/by-name/system      /system             squashfs  ro                                                           wait
-#/dev/block/platform/f723d000.dwmmc0/by-name/vendor      /vendor             ext4      ro                                                           wait
-/dev/block/platform/f723d000.dwmmc0/by-name/userdata    /data               f2fs      discard,noatime,nosuid,nodev                                 wait,check,fileencryption=software,quota
-/dev/block/platform/f723d000.dwmmc0/by-name/userdata    /data               ext4      discard,noatime,noauto_da_alloc,data=ordered,user_xattr,barrier=1    wait,formattable
-/devices/platform/f723e000.dwmmc1/mmc_host/mmc*                   auto               auto      defaults  voldmanaged=sdcard1:auto,encryptable=userdata
-/devices/platform/f72c0000.usb/usb*               auto               auto      defaults  voldmanaged=usbdisk:auto,encryptable=userdata
diff --git a/hikey960/BoardConfig.mk b/hikey960/BoardConfig.mk
index 9a1e437..bfaa560 100644
--- a/hikey960/BoardConfig.mk
+++ b/hikey960/BoardConfig.mk
@@ -42,3 +42,5 @@
 BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_VENDORIMAGE_JOURNAL_SIZE := 0
 BOARD_VENDORIMAGE_EXTFS_INODE_COUNT := 2048
+
+TARGET_RECOVERY_FSTAB := device/linaro/hikey/hikey960/fstab.hikey960
diff --git a/hikey960/device-hikey960.mk b/hikey960/device-hikey960.mk
index 814dd64..792277f 100644
--- a/hikey960/device-hikey960.mk
+++ b/hikey960/device-hikey960.mk
@@ -87,3 +87,8 @@
 $(warning    https://dl.google.com/dl/android/aosp/hisilicon-hikey960-OPR-3c243263.tgz )
 $(warning And extract in the ANDROID_TOP_DIR)
 endif
+
+ifneq ($(TARGET_NO_RECOVERY),true)
+PRODUCT_COPY_FILES += \
+	device/linaro/hikey/init.recovery.common.rc:recovery/root/init.recovery.hikey960.rc
+endif
diff --git a/init.recovery.common.rc b/init.recovery.common.rc
new file mode 100644
index 0000000..c9cb590
--- /dev/null
+++ b/init.recovery.common.rc
@@ -0,0 +1,32 @@
+service console /system/bin/sh
+    class core
+    console
+    disabled
+    user root
+    group shell log readproc
+    seclabel u:r:shell:s0
+    setenv HOSTNAME console
+
+on property:ro.debuggable=1
+    start console
+
+on init
+    mount configfs none /config
+    mkdir /config/usb_gadget/g1 0770 shell shell
+    write /config/usb_gadget/g1/idVendor 0x18d1
+    write /config/usb_gadget/g1/idProduct 0xd001
+    mkdir /config/usb_gadget/g1/strings/0x409 0770
+    write /config/usb_gadget/g1/strings/0x409/serialnumber ${ro.serialno}
+    write /config/usb_gadget/g1/strings/0x409/manufacturer "HISILICON"
+    write /config/usb_gadget/g1/strings/0x409/product "ADB Gadget"
+    mkdir /config/usb_gadget/g1/functions/ffs.adb
+    write /config/usb_gadget/g1/os_desc/use 1
+    symlink /config/usb_gadget/g1/configs/b.1 /config/usb_gadget/g1/os_desc/b.1
+    setprop sys.usb.configfs 1
+
+on property:sys.usb.ffs.ready=1
+    mkdir /config/usb_gadget/g1/configs/b.1 0777 shell shell
+    symlink /config/usb_gadget/g1/configs/b.1 /config/usb_gadget/g1/os_desc/b.1
+    mkdir /config/usb_gadget/g1/configs/b.1/strings/0x409 0770 shell shell
+    write /config/usb_gadget/g1/configs/b.1/strings/0x409/configuration "adb"
+    symlink /config/usb_gadget/g1/functions/ffs.adb /config/usb_gadget/g1/configs/b.1/f1
diff --git a/manifest.xml b/manifest.xml
index 84d82e9..1459ee8 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -42,7 +42,7 @@
     </hal>
     <hal format="hidl">
         <name>android.hardware.drm</name>
-        <transport arch="32">passthrough</transport>
+        <transport>hwbinder</transport>
         <version>1.0</version>
         <interface>
             <name>ICryptoFactory</name>
diff --git a/recovery/Android.bp b/recovery/Android.bp
new file mode 100644
index 0000000..17dde5f
--- /dev/null
+++ b/recovery/Android.bp
@@ -0,0 +1,32 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_library_static {
+    name: "librecovery_ui_hikey",
+    owner: "linaro",
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-pedantic",
+    ],
+    srcs: [
+        "recovery_ui.cpp",
+    ],
+    include_dirs: [
+        "bootable/recovery"
+    ],
+}
diff --git a/recovery/recovery_ui.cpp b/recovery/recovery_ui.cpp
new file mode 100644
index 0000000..d67ff5f
--- /dev/null
+++ b/recovery/recovery_ui.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <device.h>
+#include <screen_ui.h>
+
+namespace android {
+namespace device {
+namespace linaro {
+namespace hikey {
+
+class HikeyUI : public ::ScreenRecoveryUI
+{
+    RecoveryUI::KeyAction CheckKey(int key, bool is_long_press) {
+        // Recovery core can't tolerate using KEY_POWER as an alias for
+        // KEY_DOWN, and a reboot is always triggered. Remap any power
+        // key press to KEY_DOWN to allow us to use the power key as
+        // a regular key.
+        if (key == KEY_POWER && !is_long_press) {
+            RecoveryUI::EnqueueKey(KEY_DOWN);
+            return RecoveryUI::IGNORE;
+        }
+
+        return RecoveryUI::CheckKey(key, is_long_press);
+    }
+};
+
+} // namespace hikey
+} // namespace linaro
+} // namespace device
+} // namespace android
+
+Device *make_device()
+{
+    return new Device(new ::android::device::linaro::hikey::HikeyUI());
+}
diff --git a/sepolicy/hal_drm_default.te b/sepolicy/hal_drm_default.te
new file mode 100644
index 0000000..5177496
--- /dev/null
+++ b/sepolicy/hal_drm_default.te
@@ -0,0 +1 @@
+vndbinder_use(hal_drm_default);
diff --git a/sepolicy/mediadrmserver.te b/sepolicy/mediadrmserver.te
new file mode 100644
index 0000000..52a8311
--- /dev/null
+++ b/sepolicy/mediadrmserver.te
@@ -0,0 +1 @@
+binder_call(mediadrmserver, mediacodec)
diff --git a/sepolicy/recovery.te b/sepolicy/recovery.te
new file mode 100644
index 0000000..e4677fe
--- /dev/null
+++ b/sepolicy/recovery.te
@@ -0,0 +1 @@
+allow recovery gpu_device:chr_file rw_file_perms;
diff --git a/sepolicy/shell.te b/sepolicy/shell.te
new file mode 100644
index 0000000..3f17a5b
--- /dev/null
+++ b/sepolicy/shell.te
@@ -0,0 +1,4 @@
+recovery_only(`
+allow shell tmpfs:file r_file_perms;
+allow shell sysfs:file r_file_perms;
+')