Merge 10952656tmp_amf_315507370

Merged-In: I23488ea79c90981f48d69aead0bcdfa13f85af48
Change-Id: I343a1e01dad2db510a57345b6f432af1a519bdcb

23 files changed, 467 insertions, 819 deletions

diff --git a/gralloc4/Android.bp b/gralloc4/Android.bp
index d97cbdb..7cdc78f 100644
--- a/gralloc4/Android.bp
+++ b/gralloc4/Android.bp
@@ -93,6 +93,7 @@ arm_gralloc_cc_defaults {
 	},
 	header_libs: [
 		"libgralloc_headers",
+		"pixel-gralloc-headers",
 	],
 	target: {
 		android: {
diff --git a/gralloc4/src/Android.bp b/gralloc4/src/Android.bp
index a813fc8..5f89832 100644
--- a/gralloc4/src/Android.bp
+++ b/gralloc4/src/Android.bp
@@ -44,7 +44,6 @@ cc_library_shared {
 	srcs: [
 		"libGralloc4Wrapper/wrapper.cpp",
 		"allocator/mali_gralloc_ion.cpp",
-		"allocator/mali_gralloc_shared_memory.cpp",
 		"core/format_info.cpp",
 		"core/mali_gralloc_formats.cpp",
 		"core/mali_gralloc_bufferallocation.cpp",
diff --git a/gralloc4/src/allocator/Android.bp b/gralloc4/src/allocator/Android.bp
index fe42411..630735b 100644
--- a/gralloc4/src/allocator/Android.bp
+++ b/gralloc4/src/allocator/Android.bp
@@ -76,7 +76,6 @@ arm_gralloc_allocator_cc_defaults {
 	},
 	srcs: [
 		"mali_gralloc_ion.cpp",
-		"mali_gralloc_shared_memory.cpp",
 	],
 	static_libs: [
 		"libarect",
diff --git a/gralloc4/src/allocator/mali_gralloc_ion.cpp b/gralloc4/src/allocator/mali_gralloc_ion.cpp
index 8bfc6d8..986af11 100644
--- a/gralloc4/src/allocator/mali_gralloc_ion.cpp
+++ b/gralloc4/src/allocator/mali_gralloc_ion.cpp
@@ -48,6 +48,7 @@
 #include "mali_gralloc_ion.h"
 
 #include <array>
+#include <cassert>
 #include <string>
 
 static const char kDmabufSensorDirectHeapName[] = "sensor_direct_heap";
@@ -60,6 +61,8 @@ static const char kDmabufVframeSecureHeapName[] = "vframe-secure";
 static const char kDmabufVstreamSecureHeapName[] = "vstream-secure";
 static const char kDmabufVscalerSecureHeapName[] = "vscaler-secure";
 static const char kDmabufFramebufferSecureHeapName[] = "framebuffer-secure";
+static const char kDmabufGcmaCameraHeapName[] = "gcma_camera";
+static const char kDmabufGcmaCameraUncachedHeapName[] = "gcma_camera-uncached";
 
 BufferAllocator& get_allocator() {
 		static BufferAllocator allocator;
@@ -84,7 +87,7 @@ std::string select_dmabuf_heap(uint64_t usage)
 		std::string   name;
 	};
 
-	static const std::array<HeapSpecifier, 6> exact_usage_heaps =
+	static const std::array<HeapSpecifier, 7> exact_usage_heaps =
 	{{
 		// Faceauth heaps
 		{ // isp_image_heap
@@ -114,9 +117,15 @@ std::string select_dmabuf_heap(uint64_t usage)
 			GRALLOC_USAGE_HW_COMPOSER | GRALLOC_USAGE_HW_FB,
 			find_first_available_heap({kDmabufFramebufferSecureHeapName, kDmabufVframeSecureHeapName})
 		},
+
+		{
+			GRALLOC_USAGE_PROTECTED | GRALLOC_USAGE_HW_TEXTURE | GRALLOC_USAGE_HW_RENDER |
+			GRALLOC_USAGE_HW_COMPOSER,
+			find_first_available_heap({kDmabufFramebufferSecureHeapName, kDmabufVframeSecureHeapName})
+		},
 	}};
 
-	static const std::array<HeapSpecifier, 6> inexact_usage_heaps =
+	static const std::array<HeapSpecifier, 8> inexact_usage_heaps =
 	{{
 		// If GPU, use vframe-secure
 		{
@@ -146,6 +155,18 @@ std::string select_dmabuf_heap(uint64_t usage)
 			kDmabufSensorDirectHeapName
 		},
 
+		// Camera GCMA heap
+		{
+			GRALLOC_USAGE_HW_CAMERA_WRITE,
+			find_first_available_heap({kDmabufGcmaCameraUncachedHeapName, kDmabufSystemUncachedHeapName})
+		},
+
+		// Camera GCMA heap
+		{
+			GRALLOC_USAGE_HW_CAMERA_READ,
+			find_first_available_heap({kDmabufGcmaCameraUncachedHeapName, kDmabufSystemUncachedHeapName})
+		},
+
 		// Catchall to system
 		{
 			0,
@@ -165,7 +186,10 @@ std::string select_dmabuf_heap(uint64_t usage)
 	{
 		if ((usage & heap.usage_bits) == heap.usage_bits)
 		{
-			if (heap.name == kDmabufSystemUncachedHeapName &&
+			if (heap.name == kDmabufGcmaCameraUncachedHeapName &&
+			    ((usage & GRALLOC_USAGE_SW_READ_MASK) == GRALLOC_USAGE_SW_READ_OFTEN))
+				return kDmabufGcmaCameraHeapName;
+			else if (heap.name == kDmabufSystemUncachedHeapName &&
 			    ((usage & GRALLOC_USAGE_SW_READ_MASK) == GRALLOC_USAGE_SW_READ_OFTEN))
 				return kDmabufSystemHeapName;
 
@@ -275,20 +299,8 @@ void mali_gralloc_ion_free(private_handle_t * const hnd)
 {
 	for (int i = 0; i < hnd->fd_count; i++)
 	{
-		void* mapped_addr = reinterpret_cast<void*>(hnd->bases[i]);
-
-		/* Buffer might be unregistered already so we need to assure we have a valid handle */
-		if (mapped_addr != nullptr)
-		{
-			if (munmap(mapped_addr, hnd->alloc_sizes[i]) != 0)
-			{
-				/* TODO: more detailed error logs */
-				MALI_GRALLOC_LOGE("Failed to munmap handle %p", hnd);
-			}
-		}
 		close(hnd->fds[i]);
 		hnd->fds[i] = -1;
-		hnd->bases[i] = 0;
 	}
 	delete hnd;
 }
@@ -340,108 +352,115 @@ int mali_gralloc_ion_allocate(const gralloc_buffer_descriptor_t *descriptors,
                               uint32_t numDescriptors, buffer_handle_t *pHandle,
                               bool *shared_backend, int ion_fd)
 {
+	ATRACE_CALL();
 	GRALLOC_UNUSED(shared_backend);
 
 	unsigned int priv_heap_flag = 0;
 	uint64_t usage;
 	uint32_t i;
-	int fds[MAX_FDS];
-	std::fill(fds, fds + MAX_FDS, -1);
 
 	for (i = 0; i < numDescriptors; i++)
 	{
-		buffer_descriptor_t *bufDescriptor = (buffer_descriptor_t *)(descriptors[i]);
-		usage = bufDescriptor->consumer_usage | bufDescriptor->producer_usage;
-
-		for (int fidx = 0; fidx < bufDescriptor->fd_count; fidx++)
-		{
-			if (ion_fd >= 0 && fidx == 0) {
-				fds[fidx] = ion_fd;
-			} else {
-				fds[fidx] = alloc_from_dmabuf_heap(usage, bufDescriptor->alloc_sizes[fidx], bufDescriptor->name);
-			}
-			if (fds[fidx] < 0)
-			{
-				MALI_GRALLOC_LOGE("ion_alloc failed");
-
-				for (int cidx = 0; cidx < fidx; cidx++)
-				{
-					close(fds[cidx]);
-				}
-
-				/* need to free already allocated memory. not just this one */
-				mali_gralloc_ion_free_internal(pHandle, numDescriptors);
-
-				return -1;
-			}
-		}
+		buffer_descriptor_t *bufDescriptor = reinterpret_cast<buffer_descriptor_t *>(descriptors[i]);
+		assert(bufDescriptor);
+		assert(bufDescriptor->fd_count >= 0);
+		assert(bufDescriptor->fd_count <= MAX_FDS);
 
-		private_handle_t *hnd = new private_handle_t(
+		auto hnd = new private_handle_t(
 		    priv_heap_flag,
 		    bufDescriptor->alloc_sizes,
 		    bufDescriptor->consumer_usage, bufDescriptor->producer_usage,
-		    fds, bufDescriptor->fd_count,
+		    nullptr, bufDescriptor->fd_count,
 		    bufDescriptor->hal_format, bufDescriptor->alloc_format,
 		    bufDescriptor->width, bufDescriptor->height, bufDescriptor->pixel_stride,
 		    bufDescriptor->layer_count, bufDescriptor->plane_info);
 
-		if (NULL == hnd)
+		/* Reset the number of valid filedescriptors, we will increment
+		 * it each time a valid fd is added, so we can rely on the
+		 * cleanup functions to close open fds. */
+		hnd->set_numfds(0);
+
+		if (nullptr == hnd)
 		{
 			MALI_GRALLOC_LOGE("Private handle could not be created for descriptor:%d in non-shared usecase", i);
+			mali_gralloc_ion_free_internal(pHandle, i);
+			return -1;
+		}
+
+		pHandle[i] = hnd;
+		usage = bufDescriptor->consumer_usage | bufDescriptor->producer_usage;
+
+		for (uint32_t fidx = 0; fidx < bufDescriptor->fd_count; fidx++)
+		{
+			int& fd = hnd->fds[fidx];
+
+			if (ion_fd >= 0 && fidx == 0) {
+				fd = ion_fd;
+			} else {
+				fd = alloc_from_dmabuf_heap(usage, bufDescriptor->alloc_sizes[fidx], bufDescriptor->name);
+			}
 
-			/* Close the obtained shared file descriptor for the current handle */
-			for (int j = 0; j < bufDescriptor->fd_count; j++)
+			if (fd < 0)
 			{
-				close(fds[j]);
+				MALI_GRALLOC_LOGE("ion_alloc failed for fds[%u] = %d", fidx, fd);
+				mali_gralloc_ion_free_internal(pHandle, i + 1);
+				return -1;
 			}
 
-			mali_gralloc_ion_free_internal(pHandle, numDescriptors);
-			return -1;
+			hnd->incr_numfds(1);
 		}
-
-		pHandle[i] = hnd;
 	}
 
 #if defined(GRALLOC_INIT_AFBC) && (GRALLOC_INIT_AFBC == 1)
+	ATRACE_NAME("AFBC init block");
 	unsigned char *cpu_ptr = NULL;
 	for (i = 0; i < numDescriptors; i++)
 	{
-		buffer_descriptor_t *bufDescriptor = (buffer_descriptor_t *)(descriptors[i]);
-		private_handle_t *hnd = (private_handle_t *)(pHandle[i]);
+		buffer_descriptor_t *bufDescriptor = reinterpret_cast<buffer_descriptor_t *>(descriptors[i]);
+		const private_handle_t *hnd = static_cast<const private_handle_t *>(pHandle[i]);
 
 		usage = bufDescriptor->consumer_usage | bufDescriptor->producer_usage;
 
 		if ((bufDescriptor->alloc_format & MALI_GRALLOC_INTFMT_AFBCENABLE_MASK)
 			&& !(usage & GRALLOC_USAGE_PROTECTED))
 		{
-			/* TODO: only map for AFBC buffers */
-			cpu_ptr =
-			    (unsigned char *)mmap(NULL, bufDescriptor->alloc_sizes[0], PROT_READ | PROT_WRITE, MAP_SHARED, hnd->fds[0], 0);
-
-			if (MAP_FAILED == cpu_ptr)
 			{
-				MALI_GRALLOC_LOGE("mmap failed for fd ( %d )", hnd->fds[0]);
-				mali_gralloc_ion_free_internal(pHandle, numDescriptors);
-				return -1;
-			}
+				ATRACE_NAME("mmap");
+				/* TODO: only map for AFBC buffers */
+				cpu_ptr =
+				    (unsigned char *)mmap(NULL, bufDescriptor->alloc_sizes[0], PROT_READ | PROT_WRITE, MAP_SHARED, hnd->fds[0], 0);
 
-			mali_gralloc_ion_sync_start(hnd, true, true);
+				if (MAP_FAILED == cpu_ptr)
+				{
+					MALI_GRALLOC_LOGE("mmap failed for fd ( %d )", hnd->fds[0]);
+					mali_gralloc_ion_free_internal(pHandle, numDescriptors);
+					return -1;
+				}
 
-			/* For separated plane YUV, there is a header to initialise per plane. */
-			const plane_info_t *plane_info = bufDescriptor->plane_info;
-			const bool is_multi_plane = hnd->is_multi_plane();
-			for (int i = 0; i < MAX_PLANES && (i == 0 || plane_info[i].byte_stride != 0); i++)
-			{
-				init_afbc(cpu_ptr + plane_info[i].offset,
-				          bufDescriptor->alloc_format,
-				          is_multi_plane,
-				          plane_info[i].alloc_width,
-				          plane_info[i].alloc_height);
+				mali_gralloc_ion_sync_start(hnd, true, true);
 			}
 
-			mali_gralloc_ion_sync_end(hnd, true, true);
+			{
+				ATRACE_NAME("data init");
+				/* For separated plane YUV, there is a header to initialise per plane. */
+				const plane_info_t *plane_info = bufDescriptor->plane_info;
+				assert(plane_info);
+				const bool is_multi_plane = hnd->is_multi_plane();
+				for (int i = 0; i < MAX_PLANES && (i == 0 || plane_info[i].byte_stride != 0); i++)
+				{
+					init_afbc(cpu_ptr + plane_info[i].offset,
+					          bufDescriptor->alloc_format,
+					          is_multi_plane,
+					          plane_info[i].alloc_width,
+					          plane_info[i].alloc_height);
+				}
+			}
 
-			munmap(cpu_ptr, bufDescriptor->alloc_sizes[0]);
+			{
+				ATRACE_NAME("munmap");
+				mali_gralloc_ion_sync_end(hnd, true, true);
+				munmap(cpu_ptr, bufDescriptor->alloc_sizes[0]);
+			}
 		}
 	}
 #endif
@@ -449,15 +468,17 @@ int mali_gralloc_ion_allocate(const gralloc_buffer_descriptor_t *descriptors,
 	return 0;
 }
 
-int mali_gralloc_ion_map(private_handle_t *hnd)
+std::array<void*, MAX_BUFFER_FDS> mali_gralloc_ion_map(private_handle_t *hnd)
 {
-	uint64_t usage = hnd->producer_usage | hnd->consumer_usage;
+	std::array<void*, MAX_BUFFER_FDS> vaddrs;
+	vaddrs.fill(nullptr);
 
+	uint64_t usage = hnd->producer_usage | hnd->consumer_usage;
 	/* Do not allow cpu access to secure buffers */
 	if (usage & (GRALLOC_USAGE_PROTECTED | GRALLOC_USAGE_NOZEROED)
 			&& !(usage & GRALLOC_USAGE_PRIVATE_NONSECURE))
 	{
-		return 0;
+		return vaddrs;
 	}
 
 	for (int fidx = 0; fidx < hnd->fd_count; fidx++) {
@@ -474,38 +495,38 @@ int mali_gralloc_ion_map(private_handle_t *hnd)
 
 			for (int cidx = 0; cidx < fidx; fidx++)
 			{
-				munmap((void*)hnd->bases[cidx], hnd->alloc_sizes[cidx]);
-				hnd->bases[cidx] = 0;
+				munmap((void*)vaddrs[cidx], hnd->alloc_sizes[cidx]);
+				vaddrs[cidx] = 0;
 			}
 
-			return -err;
+			return vaddrs;
 		}
 
-		hnd->bases[fidx] = uintptr_t(mappedAddress);
+		vaddrs[fidx] = mappedAddress;
 	}
 
-	return 0;
+	return vaddrs;
 }
 
-void mali_gralloc_ion_unmap(private_handle_t *hnd)
+void mali_gralloc_ion_unmap(private_handle_t *hnd, std::array<void*, MAX_BUFFER_FDS>& vaddrs)
 {
 	for (int i = 0; i < hnd->fd_count; i++)
 	{
 		int err = 0;
 
-		if (hnd->bases[i])
+		if (vaddrs[i])
 		{
-			err = munmap((void*)hnd->bases[i], hnd->alloc_sizes[i]);
+			err = munmap(vaddrs[i], hnd->alloc_sizes[i]);
 		}
 
 		if (err)
 		{
 			MALI_GRALLOC_LOGE("Could not munmap base:%p size:%" PRIu64 " '%s'",
-					(void*)hnd->bases[i], hnd->alloc_sizes[i], strerror(errno));
+					(void*)vaddrs[i], hnd->alloc_sizes[i], strerror(errno));
 		}
 		else
 		{
-			hnd->bases[i] = 0;
+			vaddrs[i] = 0;
 		}
 	}
 
diff --git a/gralloc4/src/allocator/mali_gralloc_ion.h b/gralloc4/src/allocator/mali_gralloc_ion.h
index 5f55c2f..d826650 100644
--- a/gralloc4/src/allocator/mali_gralloc_ion.h
+++ b/gralloc4/src/allocator/mali_gralloc_ion.h
@@ -30,8 +30,8 @@ int mali_gralloc_ion_sync_start(const private_handle_t * const hnd,
                                 const bool read, const bool write);
 int mali_gralloc_ion_sync_end(const private_handle_t * const hnd,
                               const bool read, const bool write);
-int mali_gralloc_ion_map(private_handle_t *hnd);
-void mali_gralloc_ion_unmap(private_handle_t *hnd);
+std::array<void*, MAX_BUFFER_FDS> mali_gralloc_ion_map(private_handle_t *hnd);
+void mali_gralloc_ion_unmap(private_handle_t *hnd, std::array<void*, MAX_BUFFER_FDS>& vaddrs);
 int mali_gralloc_attr_allocate(void);
 
 #endif /* MALI_GRALLOC_ION_H_ */
diff --git a/gralloc4/src/allocator/mali_gralloc_shared_memory.cpp b/gralloc4/src/allocator/mali_gralloc_shared_memory.cpp
deleted file mode 100644
index b681cd9..0000000
--- a/gralloc4/src/allocator/mali_gralloc_shared_memory.cpp
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2020 Arm Limited. All rights reserved.
- *
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "mali_gralloc_shared_memory.h"
-#include "mali_gralloc_log.h"
-#include "mali_gralloc_buffer.h"
-#include "mali_gralloc_ion.h"
-#include "gralloc_helper.h"
-
-/* TODO: move shared attr memory allocation function here */
-
-void gralloc_shared_memory_free(private_handle_t *hnd)
-{
-	if (hnd->attr_base)
-	{
-		munmap(hnd->attr_base, hnd->attr_size);
-		hnd->attr_base = nullptr;
-	}
-
-	hnd->close_share_attr_fd();
-	hnd->set_share_attr_fd(-1);
-}
diff --git a/gralloc4/src/allocator/mali_gralloc_shared_memory.h b/gralloc4/src/allocator/mali_gralloc_shared_memory.h
deleted file mode 100644
index 28e0a62..0000000
--- a/gralloc4/src/allocator/mali_gralloc_shared_memory.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (C) 2020 Arm Limited. All rights reserved.
- *
- * Copyright (C) 2008 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef GRALLOC_SHARED_MEMORY_H_
-#define GRALLOC_SHARED_MEMORY_H_
-
-#include <stdint.h>
-#include <utility>
-#include "mali_gralloc_buffer.h"
-
-/*
- * Frees resources acquired from gralloc_shared_memory_allocate.
- */
-void gralloc_shared_memory_free(private_handle_t *hnd);
-
-#endif /* GRALLOC_SHARED_MEMORY_H_ */
diff --git a/gralloc4/src/core/mali_gralloc_bufferaccess.cpp b/gralloc4/src/core/mali_gralloc_bufferaccess.cpp
index adda46b..344ab2a 100644
--- a/gralloc4/src/core/mali_gralloc_bufferaccess.cpp
+++ b/gralloc4/src/core/mali_gralloc_bufferaccess.cpp
@@ -221,9 +221,16 @@ int mali_gralloc_lock(buffer_handle_t buffer,
 			return -EINVAL;
 		}
 
-		mali_gralloc_reference_map(buffer);
+		if (mali_gralloc_reference_map(buffer) != 0) {
+			return -EINVAL;
+		}
 
-		*vaddr = (void *)hnd->bases[0];
+		std::optional<void*> buf_addr = mali_gralloc_reference_get_buf_addr(buffer);
+		if (!buf_addr.has_value()) {
+			MALI_GRALLOC_LOGE("BUG: Invalid buffer address on a just mapped buffer");
+			return -EINVAL;
+		}
+		*vaddr = buf_addr.value();
 
 		buffer_sync(hnd, get_tx_direction(usage));
 	}
diff --git a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
index 289db0b..d67eeb8 100644
--- a/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
+++ b/gralloc4/src/core/mali_gralloc_bufferallocation.cpp
@@ -30,7 +30,6 @@
 
 #include "mali_gralloc_bufferallocation.h"
 #include "allocator/mali_gralloc_ion.h"
-#include "allocator/mali_gralloc_shared_memory.h"
 #include "mali_gralloc_buffer.h"
 #include "mali_gralloc_bufferdescriptor.h"
 #include "mali_gralloc_log.h"
@@ -49,6 +48,7 @@
 
 /* IP-specific align values */
 #define GPU_BYTE_ALIGN_DEFAULT 64
+#define BIG_BYTE_ALIGN_DEFAULT 64
 #ifdef SOC_ZUMA
 #define CAMERA_RAW_BUFFER_BYTE_ALIGN 32
 #endif
@@ -246,6 +246,7 @@ void init_afbc(uint8_t *buf, const uint64_t alloc_format,
                const bool is_multi_plane,
                const int w, const int h)
 {
+	ATRACE_CALL();
 	const bool is_tiled = ((alloc_format & MALI_GRALLOC_INTFMT_AFBC_TILED_HEADERS)
 	                         == MALI_GRALLOC_INTFMT_AFBC_TILED_HEADERS);
 	const uint32_t n_headers = (w * h) / AFBC_PIXELS_PER_BLOCK;
@@ -576,7 +577,7 @@ static void calc_allocation_size(const int width,
 		else
 		{
 			assert((plane_info[plane].alloc_width * format.bpp[plane]) % 8 == 0);
-			plane_info[plane].byte_stride = (plane_info[plane].alloc_width * format.bpp[plane]) / 8;
+			plane_info[plane].byte_stride = (static_cast<uint64_t>(plane_info[plane].alloc_width) * format.bpp[plane]) / 8;
 
 			/*
 			 * Align byte stride (uncompressed allocations only).
@@ -622,6 +623,11 @@ static void calc_allocation_size(const int width,
 			}
 #endif
 
+			if (has_BIG_usage) {
+				assert(has_hw_usage);
+				hw_align = lcm(hw_align, static_cast<uint16_t>(BIG_BYTE_ALIGN_DEFAULT));
+			}
+
 			uint32_t cpu_align = 0;
 			if (has_cpu_usage && format.id != MALI_GRALLOC_FORMAT_INTERNAL_RAW10) {
 				assert((format.bpp[plane] * format.align_w_cpu) % 8 == 0);
@@ -978,6 +984,7 @@ static int prepare_descriptor_exynos_formats(
 
 int mali_gralloc_derive_format_and_size(buffer_descriptor_t * const bufDescriptor)
 {
+	ATRACE_CALL();
 	alloc_type_t alloc_type{};
 
 	int alloc_width = bufDescriptor->width;
@@ -1121,7 +1128,16 @@ int mali_gralloc_buffer_allocate(const gralloc_buffer_descriptor_t *descriptors,
                                  uint32_t numDescriptors, buffer_handle_t *pHandle, bool *shared_backend,
                                  int fd)
 {
-	ATRACE_CALL();
+	std::string atrace_log = __FUNCTION__;
+	if (ATRACE_ENABLED()) {
+		buffer_descriptor_t * const bufDescriptor = (buffer_descriptor_t *)(descriptors[0]);
+		std::stringstream ss;
+		ss << __FUNCTION__ << "(f=0x" << std::hex << bufDescriptor->hal_format << ", u=0x" <<
+			bufDescriptor->producer_usage << ", w=" << std::dec << bufDescriptor->width << ", h=" << bufDescriptor->height << ")";
+		atrace_log = ss.str();
+	}
+	ATRACE_NAME(atrace_log.c_str());
+
 	bool shared = false;
 	uint64_t backing_store_id = 0x0;
 	int err;
@@ -1199,8 +1215,8 @@ int mali_gralloc_buffer_free(buffer_handle_t pHandle)
 		return -1;
 	}
 
-	gralloc_shared_memory_free(hnd);
-	mali_gralloc_ion_free(hnd);
+	native_handle_close(hnd);
+	native_handle_delete(hnd);
 
 	return 0;
 }
diff --git a/gralloc4/src/core/mali_gralloc_reference.cpp b/gralloc4/src/core/mali_gralloc_reference.cpp
index b84cbb4..6726895 100644
--- a/gralloc4/src/core/mali_gralloc_reference.cpp
+++ b/gralloc4/src/core/mali_gralloc_reference.cpp
@@ -35,8 +35,12 @@ private:
     // should become the only place where address mapping is maintained and can be
     // queried from.
     struct MappedData {
-        void *bases[MAX_BUFFER_FDS] = {};
+        std::array<void *, MAX_BUFFER_FDS> bases;
         size_t alloc_sizes[MAX_BUFFER_FDS] = {};
+
+        void *metadata_vaddr;
+        size_t metadata_size;
+
         uint64_t ref_count = 0;
     };
 
@@ -52,7 +56,9 @@ private:
         return size;
     }
 
-    static bool dmabuf_sanity_check(buffer_handle_t handle) {
+    // TODO(b/296934447): AION buffers set the size of the buffer themselves. That size exceeds the
+    // size of the actual allocated dmabuf.
+    static bool dmabuf_sanity_check(buffer_handle_t handle, bool skip_buffer_size_check = false) {
         private_handle_t *hnd =
                 static_cast<private_handle_t *>(const_cast<native_handle_t *>(handle));
 
@@ -77,10 +83,13 @@ private:
         };
 
         // Check client facing dmabufs
-        for (auto i = 0; i < hnd->fd_count; i++) {
-            if (!check_pid(hnd->fds[i], hnd->alloc_sizes[i])) {
-                MALI_GRALLOC_LOGE("%s failed: Size check failed for alloc_sizes[%d]", __func__, i);
-                return false;
+        if (!skip_buffer_size_check) {
+            for (auto i = 0; i < hnd->fd_count; i++) {
+                if (!check_pid(hnd->fds[i], hnd->alloc_sizes[i])) {
+                    MALI_GRALLOC_LOGE("%s failed: Size check failed for alloc_sizes[%d]", __func__,
+                                      i);
+                    return false;
+                }
             }
         }
 
@@ -93,75 +102,118 @@ private:
         return true;
     }
 
-    int map_locked(buffer_handle_t handle) REQUIRES(lock) {
-        private_handle_t *hnd = (private_handle_t *)handle;
-        auto it = buffer_map.find(hnd);
-
-        if (it == buffer_map.end()) {
-            MALI_GRALLOC_LOGE("BUG: Map called without importing buffer");
-            return -EINVAL;
-        }
-
-        auto &data = *(it->second.get());
-        if (data.ref_count == 0) {
-            MALI_GRALLOC_LOGE("BUG: Found an imported buffer with ref count 0, expect errors");
+    bool map_buffer_locked(buffer_handle_t handle) REQUIRES(lock) {
+        auto data_oe = get_validated_data_locked(handle);
+        if (!data_oe.has_value()) {
+            return false;
         }
+        MappedData &data = data_oe.value();
 
         // Return early if buffer is already mapped
         if (data.bases[0] != nullptr) {
-            return 0;
+            return true;
         }
 
         if (!dmabuf_sanity_check(handle)) {
-            return -EINVAL;
+            return false;
         }
 
-        int error = mali_gralloc_ion_map(hnd);
-        if (error != 0) {
-            return error;
+        private_handle_t *hnd =
+                reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
+        data.bases = mali_gralloc_ion_map(hnd);
+        if (data.bases[0] == nullptr) {
+            return false;
         }
 
         for (auto i = 0; i < MAX_BUFFER_FDS; i++) {
-            data.bases[i] = reinterpret_cast<void *>(hnd->bases[i]);
             data.alloc_sizes[i] = hnd->alloc_sizes[i];
         }
 
-        return 0;
+        return true;
     }
 
-    int validate_locked(buffer_handle_t handle) REQUIRES(lock) {
+    bool map_metadata_locked(buffer_handle_t handle) REQUIRES(lock) {
+        auto data_oe = get_validated_data_locked(handle);
+        if (!data_oe.has_value()) {
+            return false;
+        }
+        MappedData &data = data_oe.value();
+
+        // Return early if buffer is already mapped
+        if (data.metadata_vaddr != nullptr) {
+            return true;
+        }
+
+        if (!dmabuf_sanity_check(handle, /*skip_buffer_size_check=*/true)) {
+            return false;
+        }
+
+        private_handle_t *hnd =
+                reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
+        data.metadata_vaddr = mmap(nullptr, hnd->attr_size, PROT_READ | PROT_WRITE, MAP_SHARED,
+                                   hnd->get_share_attr_fd(), 0);
+        if (data.metadata_vaddr == nullptr) {
+            return false;
+        }
+
+        data.metadata_size = hnd->attr_size;
+        return true;
+    }
+
+    bool validate_locked(buffer_handle_t handle) REQUIRES(lock) {
         if (private_handle_t::validate(handle) < 0) {
             MALI_GRALLOC_LOGE("Reference invalid buffer %p, returning error", handle);
-            return -EINVAL;
+            return false;
         }
 
-        const auto *hnd = (private_handle_t *)handle;
+        const auto *hnd = reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
         auto it = buffer_map.find(hnd);
         if (it == buffer_map.end()) {
             MALI_GRALLOC_LOGE("Reference unimported buffer %p, returning error", handle);
-            return -EINVAL;
+            return false;
         }
 
         auto &data = *(it->second.get());
         if (data.bases[0] != nullptr) {
             for (auto i = 0; i < MAX_BUFFER_FDS; i++) {
-                if (data.bases[i] != reinterpret_cast<void *>(hnd->bases[i]) ||
-                    data.alloc_sizes[i] != hnd->alloc_sizes[i]) {
+                if (data.alloc_sizes[i] != hnd->alloc_sizes[i]) {
                     MALI_GRALLOC_LOGE(
                             "Validation failed: Buffer attributes inconsistent with mapper");
-                    return -EINVAL;
+                    return false;
                 }
             }
         } else {
             for (auto i = 0; i < MAX_BUFFER_FDS; i++) {
-                if (hnd->bases[i] != 0 || data.bases[i] != nullptr) {
+                if (data.bases[i] != nullptr) {
                     MALI_GRALLOC_LOGE("Validation failed: Expected nullptr for unmapped buffer");
-                    return -EINVAL;
+                    return false;
                 }
             }
         }
 
-        return 0;
+        return true;
+    }
+
+    std::optional<std::reference_wrapper<MappedData>> get_validated_data_locked(
+            buffer_handle_t handle) REQUIRES(lock) {
+        if (!validate_locked(handle)) {
+            return {};
+        }
+
+        private_handle_t *hnd =
+                reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
+        auto it = buffer_map.find(hnd);
+        if (it == buffer_map.end()) {
+            MALI_GRALLOC_LOGE("Trying to release a non-imported buffer");
+            return {};
+        }
+
+        MappedData &data = *(it->second.get());
+        if (data.ref_count == 0) {
+            MALI_GRALLOC_LOGE("BUG: Found an imported buffer with ref count 0, expect errors");
+        }
+
+        return data;
     }
 
 public:
@@ -177,7 +229,8 @@ public:
         }
         std::lock_guard<std::mutex> _l(lock);
 
-        private_handle_t *hnd = (private_handle_t *)handle;
+        private_handle_t *hnd =
+                reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
 
         auto it = buffer_map.find(hnd);
         if (it == buffer_map.end()) {
@@ -189,10 +242,6 @@ public:
                 MALI_GRALLOC_LOGE("Failed to create buffer data mapping");
                 return -EINVAL;
             }
-
-            for (int i = 0; i < MAX_BUFFER_FDS; i++) {
-                hnd->bases[i] = 0;
-            }
         } else if (it->second->ref_count == 0) {
             MALI_GRALLOC_LOGE("BUG: Import counter of an imported buffer is 0, expect errors");
         }
@@ -204,34 +253,22 @@ public:
 
     int map(buffer_handle_t handle) EXCLUDES(lock) {
         std::lock_guard<std::mutex> _l(lock);
-        auto error = validate_locked(handle);
-        if (error != 0) {
-            return error;
+        if (!map_buffer_locked(handle)) {
+            return -EINVAL;
         }
 
-        return map_locked(handle);
+        return 0;
     }
 
     int release(buffer_handle_t handle) EXCLUDES(lock) {
         std::lock_guard<std::mutex> _l(lock);
 
-        // Always call locked variant of validate from this function. On calling
-        // the other validate variant, an attacker might launch a timing attack
-        // where they would try to time their attack between the return of
-        // validate and before taking the lock in this function again.
-        auto error = validate_locked(handle);
-        if (error != 0) {
-            return error;
-        }
-
-        private_handle_t *hnd = (private_handle_t *)handle;
-        auto it = buffer_map.find(hnd);
-        if (it == buffer_map.end()) {
-            MALI_GRALLOC_LOGE("Trying to release a non-imported buffer");
+        auto data_oe = get_validated_data_locked(handle);
+        if (!data_oe.has_value()) {
             return -EINVAL;
         }
+        MappedData &data = data_oe.value();
 
-        auto &data = *(it->second.get());
         if (data.ref_count == 0) {
             MALI_GRALLOC_LOGE("BUG: Reference held for buffer whose counter is 0");
             return -EINVAL;
@@ -239,15 +276,19 @@ public:
 
         data.ref_count--;
         if (data.ref_count == 0) {
+            private_handle_t *hnd =
+                    reinterpret_cast<private_handle_t *>(const_cast<native_handle *>(handle));
+            auto it = buffer_map.find(hnd);
+
             if (data.bases[0] != nullptr) {
-                mali_gralloc_ion_unmap(hnd);
+                mali_gralloc_ion_unmap(hnd, data.bases);
             }
 
-            /* TODO: Make this unmapping of shared meta fd into a function? */
-            if (hnd->attr_base) {
-                munmap(hnd->attr_base, hnd->attr_size);
-                hnd->attr_base = nullptr;
+            if (data.metadata_vaddr != nullptr) {
+                munmap(data.metadata_vaddr, data.metadata_size);
+                data.metadata_vaddr = nullptr;
             }
+
             buffer_map.erase(it);
         }
 
@@ -256,7 +297,47 @@ public:
 
     int validate(buffer_handle_t handle) EXCLUDES(lock) {
         std::lock_guard<std::mutex> _l(lock);
-        return validate_locked(handle);
+
+        if (!validate_locked(handle)) {
+            return -EINVAL;
+        }
+
+        return 0;
+    }
+
+    std::optional<void *> get_buf_addr(buffer_handle_t handle) {
+        std::lock_guard<std::mutex> _l(lock);
+
+        auto data_oe = get_validated_data_locked(handle);
+        if (!data_oe.has_value()) {
+            return {};
+        }
+        MappedData &data = data_oe.value();
+
+        if (data.bases[0] == nullptr) {
+            MALI_GRALLOC_LOGE("BUG: Called %s for an un-mapped buffer", __FUNCTION__);
+            return {};
+        }
+
+        return data.bases[0];
+    }
+
+    std::optional<void *> get_metadata_addr(buffer_handle_t handle) {
+        std::lock_guard<std::mutex> _l(lock);
+
+        auto data_oe = get_validated_data_locked(handle);
+        if (!data_oe.has_value()) {
+            return {};
+        }
+        MappedData &data = data_oe.value();
+
+        if (data.metadata_vaddr == nullptr) {
+            if (!map_metadata_locked(handle)) {
+                return {};
+            }
+        }
+
+        return data.metadata_vaddr;
     }
 };
 
@@ -275,3 +356,11 @@ int mali_gralloc_reference_release(buffer_handle_t handle) {
 int mali_gralloc_reference_validate(buffer_handle_t handle) {
     return BufferManager::getInstance().validate(handle);
 }
+
+std::optional<void *> mali_gralloc_reference_get_buf_addr(buffer_handle_t handle) {
+    return BufferManager::getInstance().get_buf_addr(handle);
+}
+
+std::optional<void *> mali_gralloc_reference_get_metadata_addr(buffer_handle_t handle) {
+    return BufferManager::getInstance().get_metadata_addr(handle);
+}
diff --git a/gralloc4/src/core/mali_gralloc_reference.h b/gralloc4/src/core/mali_gralloc_reference.h
index acf8e82..bddcead 100644
--- a/gralloc4/src/core/mali_gralloc_reference.h
+++ b/gralloc4/src/core/mali_gralloc_reference.h
@@ -19,11 +19,15 @@
 #ifndef MALI_GRALLOC_REFERENCE_H_
 #define MALI_GRALLOC_REFERENCE_H_
 
-#include "gralloc_priv.h"
+#include <cutils/native_handle.h>
+#include <optional>
 
 int mali_gralloc_reference_retain(buffer_handle_t handle);
 int mali_gralloc_reference_release(buffer_handle_t handle);
 int mali_gralloc_reference_validate(buffer_handle_t handle);
 int mali_gralloc_reference_map(buffer_handle_t handle);
 
+std::optional<void*> mali_gralloc_reference_get_buf_addr(buffer_handle_t handle);
+std::optional<void*> mali_gralloc_reference_get_metadata_addr(buffer_handle_t handle);
+
 #endif /* MALI_GRALLOC_REFERENCE_H_ */
diff --git a/gralloc4/src/hidl_common/Allocator.cpp b/gralloc4/src/hidl_common/Allocator.cpp
index 3b8e62a..29cf3ca 100644
--- a/gralloc4/src/hidl_common/Allocator.cpp
+++ b/gralloc4/src/hidl_common/Allocator.cpp
@@ -20,14 +20,13 @@
 
 #include <utils/Trace.h>
 
-#include "SharedMetadata.h"
 #include "Allocator.h"
 #include "core/mali_gralloc_bufferallocation.h"
 #include "core/mali_gralloc_bufferdescriptor.h"
 #include "core/format_info.h"
 #include "allocator/mali_gralloc_ion.h"
-#include "allocator/mali_gralloc_shared_memory.h"
 #include "gralloc_priv.h"
+#include "SharedMetadata.h"
 
 namespace arm
 {
@@ -99,29 +98,27 @@ void allocate(const buffer_descriptor_t &bufferDescriptor, uint32_t count, IAllo
 			mali_gralloc_ion_allocate_attr(hnd);
 
 			/* TODO: error check for failure */
-			hnd->attr_base = mmap(nullptr, hnd->attr_size, PROT_READ | PROT_WRITE,
+			void* metadata_vaddr = mmap(nullptr, hnd->attr_size, PROT_READ | PROT_WRITE,
 					MAP_SHARED, hnd->get_share_attr_fd(), 0);
 
-			memset(hnd->attr_base, 0, hnd->attr_size);
+			memset(metadata_vaddr, 0, hnd->attr_size);
 
-			mapper::common::shared_metadata_init(hnd->attr_base, bufferDescriptor.name);
+			mapper::common::shared_metadata_init(metadata_vaddr, bufferDescriptor.name);
 
 			const uint32_t base_format = bufferDescriptor.alloc_format & MALI_GRALLOC_INTFMT_FMT_MASK;
 			const uint64_t usage = bufferDescriptor.consumer_usage | bufferDescriptor.producer_usage;
 			android_dataspace_t dataspace;
 			get_format_dataspace(base_format, usage, hnd->width, hnd->height, &dataspace);
 
-			mapper::common::set_dataspace(hnd, static_cast<mapper::common::Dataspace>(dataspace));
-
-			/*
-			 * We need to set attr_base to MAP_FAILED before the HIDL callback
-			 * to avoid sending an invalid pointer to the client process.
-			 *
-			 * hnd->attr_base = mmap(...);
-			 * hidl_callback(hnd); // client receives hnd->attr_base = <dangling pointer>
-			 */
-			munmap(hnd->attr_base, hnd->attr_size);
-			hnd->attr_base = 0;
+			// TODO: set_dataspace API in mapper expects a buffer to be first imported before it can set the dataspace
+			{
+				using mapper::common::shared_metadata;
+				using mapper::common::aligned_optional;
+				using mapper::common::Dataspace;
+				(static_cast<shared_metadata*>(metadata_vaddr))->dataspace = aligned_optional(static_cast<Dataspace>(dataspace));
+			}
+
+			munmap(metadata_vaddr, hnd->attr_size);
 		}
 
 		int tmpStride = 0;
diff --git a/gralloc4/src/hidl_common/Mapper.cpp b/gralloc4/src/hidl_common/Mapper.cpp
index f6ebe6f..38d5377 100644
--- a/gralloc4/src/hidl_common/Mapper.cpp
+++ b/gralloc4/src/hidl_common/Mapper.cpp
@@ -245,14 +245,6 @@ static Error unlockBuffer(buffer_handle_t bufferHandle,
 	}
 
 	auto private_handle = private_handle_t::dynamicCast(bufferHandle);
-#if 0
-	if (!private_handle->cpu_write && !private_handle->cpu_read)
-	{
-		MALI_GRALLOC_LOGW("Attempt to call unlock*() on an unlocked buffer (%p)", bufferHandle);
-
-		/* TODO: handle simulatneous locks differently. May be keep a global lock count per buffer? */
-	}
-#endif
 
 	const int result = mali_gralloc_unlock(bufferHandle);
 	if (result)
@@ -294,15 +286,6 @@ void importBuffer(const hidl_handle& rawHandle, IMapper::importBuffer_cb hidl_cb
 	}
 
 	auto *private_handle = static_cast<private_handle_t *>(bufferHandle);
-	private_handle->attr_base = mmap(nullptr, private_handle->attr_size, PROT_READ | PROT_WRITE,
-	                                 MAP_SHARED, private_handle->get_share_attr_fd(), 0);
-	if (private_handle->attr_base == MAP_FAILED)
-	{
-		native_handle_close(bufferHandle);
-		native_handle_delete(bufferHandle);
-		hidl_cb(Error::NO_RESOURCES, nullptr);
-		return;
-	}
 
 	if (gRegisteredHandles->add(bufferHandle) == false)
 	{
@@ -332,16 +315,6 @@ Error freeBuffer(void* buffer)
 		return Error::BAD_BUFFER;
 	}
 
-	{
-		auto *private_handle = static_cast<private_handle_t *>(bufferHandle);
-		int ret = munmap(private_handle->attr_base, private_handle->attr_size);
-		if (ret < 0)
-		{
-			MALI_GRALLOC_LOGW("munmap: %s", strerror(errno));
-		}
-		private_handle->attr_base = MAP_FAILED;
-	}
-
 	const Error status = unregisterBuffer(bufferHandle);
 	if (status != Error::NONE)
 	{
@@ -773,7 +746,13 @@ void getReservedRegion(void *buffer, IMapper::getReservedRegion_cb hidl_cb)
 		hidl_cb(Error::BAD_BUFFER, 0, 0);
 		return;
 	}
-	void *reserved_region = static_cast<std::byte *>(handle->attr_base)
+
+	auto metadata_addr_oe = mali_gralloc_reference_get_metadata_addr(handle);
+	if (!metadata_addr_oe.has_value()) {
+		hidl_cb(Error::BAD_BUFFER, 0, 0);
+	}
+
+	void *reserved_region = static_cast<std::byte *>(metadata_addr_oe.value())
 	    + mapper::common::shared_metadata_size();
 	hidl_cb(Error::NONE, reserved_region, handle->reserved_region_size);
 }
diff --git a/gralloc4/src/hidl_common/MapperMetadata.cpp b/gralloc4/src/hidl_common/MapperMetadata.cpp
index fb79930..81835a3 100644
--- a/gralloc4/src/hidl_common/MapperMetadata.cpp
+++ b/gralloc4/src/hidl_common/MapperMetadata.cpp
@@ -28,9 +28,8 @@
 #include "exynos_format.h"
 #include "mali_gralloc_formats.h"
 
-#if 0
-#include "aidl/arm/graphics/ArmMetadataType.h"
-#endif
+#include <pixel-gralloc/metadata.h>
+
 #include <vector>
 
 namespace arm
@@ -387,67 +386,22 @@ static android::status_t get_plane_layouts(const private_handle_t *handle, std::
 	return android::OK;
 }
 
-#if 0
-static android::status_t get_plane_fds(const private_handle_t *hnd, std::vector<int64_t> *fds)
-{
-	const int num_planes = get_num_planes(hnd);
-
-	fds->resize(num_planes, static_cast<int64_t>(hnd->share_fd));
-
-	return android::OK;
-}
-
-/* Encode the number of fds as an int64_t followed by the int64_t fds themselves */
-static android::status_t encodeArmPlaneFds(const std::vector<int64_t>& fds, hidl_vec<uint8_t>* output)
-{
-	int64_t n_fds = fds.size();
-
-	output->resize((n_fds + 1) * sizeof(int64_t));
-
-	memcpy(output->data(), &n_fds, sizeof(n_fds));
-	memcpy(output->data() + sizeof(n_fds), fds.data(), sizeof(int64_t) * n_fds);
-
-	return android::OK;
-}
-
-/* TODO GPUCORE-22819 Move to test code */
-android::status_t decodeArmPlaneFds(hidl_vec<uint8_t>& input, std::vector<int64_t>* fds)
-{
-	int64_t size = 0;
-
-	memcpy(input.data(), &size, sizeof(int64_t));
-	if (size < 0)
-	{
-		return android::BAD_VALUE;
-	}
-
-	fds->resize(size);
-
-	uint8_t *tmp = input.data() + sizeof(int64_t);
-	memcpy(fds->data(), tmp, sizeof(int64_t) * size);
-
-	return android::OK;
-}
+static hidl_vec<uint8_t> encodePointer(void* ptr) {
+	constexpr uint8_t kPtrSize = sizeof(void*);
 
-static bool isArmMetadataType(const MetadataType& metadataType)
-{
-	return metadataType.name == GRALLOC_ARM_METADATA_TYPE_NAME;
-}
+	hidl_vec<uint8_t> output(kPtrSize);
+	std::memcpy(output.data(), &ptr, kPtrSize);
 
-static ArmMetadataType getArmMetadataTypeValue(const MetadataType& metadataType) {
-	return static_cast<ArmMetadataType>(metadataType.value);
+	return output;
 }
-#endif
 
 void get_metadata(const private_handle_t *handle, const IMapper::MetadataType &metadataType, IMapper::get_cb hidl_cb)
 {
-	/* This will hold the metadata that is returned. */
+	android::status_t err = android::OK;
 	hidl_vec<uint8_t> vec;
 
 	if (android::gralloc4::isStandardMetadataType(metadataType))
 	{
-		android::status_t err = android::OK;
-
 		switch (android::gralloc4::getStandardMetadataTypeValue(metadataType))
 		{
 		case StandardMetadataType::BUFFER_ID:
@@ -614,38 +568,32 @@ void get_metadata(const private_handle_t *handle, const IMapper::MetadataType &m
 		default:
 			err = android::BAD_VALUE;
 		}
-		hidl_cb((err) ? Error::UNSUPPORTED : Error::NONE, vec);
 	}
-	/* TODO: either remove or add support for get_plane_fds */
-#if 0
-	else if (isArmMetadataType(metadataType))
-	{
-		android::status_t err = android::OK;
-
-		switch (getArmMetadataTypeValue(metadataType))
-		{
-		case ArmMetadataType::PLANE_FDS:
-		{
-			std::vector<int64_t> fds;
-
-			err = get_plane_fds(handle, &fds);
-			if (!err)
+	else if (metadataType.name == ::pixel::graphics::kPixelMetadataTypeName) {
+		switch (static_cast<::pixel::graphics::MetadataType>(metadataType.value)) {
+			case ::pixel::graphics::MetadataType::VIDEO_HDR:
+				vec = encodePointer(get_video_hdr(handle));
+				break;
+			case ::pixel::graphics::MetadataType::VIDEO_ROI:
 			{
-				err = encodeArmPlaneFds(fds, &vec);
+				auto roi = get_video_roiinfo(handle);
+				if (roi == nullptr) {
+					err = android::BAD_VALUE;
+				} else {
+					vec = encodePointer(roi);
+				}
+				break;
 			}
-			break;
-		}
-		default:
-			err = android::BAD_VALUE;
+			default:
+				err = android::BAD_VALUE;
 		}
-		hidl_cb((err) ? Error::UNSUPPORTED : Error::NONE, vec);
 	}
-#endif
 	else
 	{
-		/* If known vendor type, return it */
-		hidl_cb(Error::UNSUPPORTED, vec);
+		err = android::BAD_VALUE;
 	}
+
+	hidl_cb((err) ? Error::UNSUPPORTED : Error::NONE, vec);
 }
 
 Error set_metadata(const private_handle_t *handle, const IMapper::MetadataType &metadataType,
diff --git a/gralloc4/src/hidl_common/SharedMetadata.cpp b/gralloc4/src/hidl_common/SharedMetadata.cpp
index b5964f7..6960b08 100644
--- a/gralloc4/src/hidl_common/SharedMetadata.cpp
+++ b/gralloc4/src/hidl_common/SharedMetadata.cpp
@@ -17,7 +17,9 @@
  */
 
 #include "SharedMetadata.h"
+#include "core/mali_gralloc_reference.h"
 #include "mali_gralloc_log.h"
+#include "mali_gralloc_usages.h"
 //#include <VendorVideoAPI.h>
 
 namespace arm
@@ -39,19 +41,19 @@ size_t shared_metadata_size()
 
 void get_name(const private_handle_t *hnd, std::string *name)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*name = metadata->get_name();
 }
 
 void get_crop_rect(const private_handle_t *hnd, std::optional<Rect> *crop)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*crop = metadata->crop.to_std_optional();
 }
 
 android::status_t set_crop_rect(const private_handle_t *hnd, const Rect &crop)
 {
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 
 	if (crop.top < 0 || crop.left < 0 ||
 	    crop.left > crop.right || crop.right > hnd->plane_info[0].alloc_width ||
@@ -69,31 +71,31 @@ android::status_t set_crop_rect(const private_handle_t *hnd, const Rect &crop)
 
 void get_dataspace(const private_handle_t *hnd, std::optional<Dataspace> *dataspace)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*dataspace = metadata->dataspace.to_std_optional();
 }
 
 void set_dataspace(const private_handle_t *hnd, const Dataspace &dataspace)
 {
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	metadata->dataspace = aligned_optional(dataspace);
 }
 
 void get_blend_mode(const private_handle_t *hnd, std::optional<BlendMode> *blend_mode)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*blend_mode = metadata->blend_mode.to_std_optional();
 }
 
 void set_blend_mode(const private_handle_t *hnd, const BlendMode &blend_mode)
 {
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	metadata->blend_mode = aligned_optional(blend_mode);
 }
 
 void get_smpte2086(const private_handle_t *hnd, std::optional<Smpte2086> *smpte2086)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*smpte2086 = metadata->smpte2086.to_std_optional();
 }
 
@@ -104,7 +106,7 @@ android::status_t set_smpte2086(const private_handle_t *hnd, const std::optional
 		return android::BAD_VALUE;
 	}
 
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	metadata->smpte2086 = aligned_optional(smpte2086);
 
 	return android::OK;
@@ -112,7 +114,7 @@ android::status_t set_smpte2086(const private_handle_t *hnd, const std::optional
 
 void get_cta861_3(const private_handle_t *hnd, std::optional<Cta861_3> *cta861_3)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	*cta861_3 = metadata->cta861_3.to_std_optional();
 }
 
@@ -123,7 +125,7 @@ android::status_t set_cta861_3(const private_handle_t *hnd, const std::optional<
 		return android::BAD_VALUE;
 	}
 
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	metadata->cta861_3 = aligned_optional(cta861_3);
 
 	return android::OK;
@@ -131,7 +133,7 @@ android::status_t set_cta861_3(const private_handle_t *hnd, const std::optional<
 
 void get_smpte2094_40(const private_handle_t *hnd, std::optional<std::vector<uint8_t>> *smpte2094_40)
 {
-	auto *metadata = reinterpret_cast<const shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	if (metadata->smpte2094_40.size > 0)
 	{
 		const uint8_t *begin = metadata->smpte2094_40.data();
@@ -146,7 +148,7 @@ void get_smpte2094_40(const private_handle_t *hnd, std::optional<std::vector<uin
 
 android::status_t set_smpte2094_40(const private_handle_t *hnd, const std::optional<std::vector<uint8_t>> &smpte2094_40)
 {
-	auto *metadata = reinterpret_cast<shared_metadata *>(hnd->attr_base);
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
 	const size_t size = smpte2094_40.has_value() ? smpte2094_40->size() : 0;
 	if (size > metadata->smpte2094_40.capacity())
 	{
@@ -160,6 +162,18 @@ android::status_t set_smpte2094_40(const private_handle_t *hnd, const std::optio
 	return android::OK;
 }
 
+void* get_video_hdr(const private_handle_t *hnd) {
+	auto *metadata = reinterpret_cast<shared_metadata *>(mali_gralloc_reference_get_metadata_addr(hnd).value());
+	return &(metadata->video_private_data);
+}
+
+void* get_video_roiinfo(const private_handle_t *hnd) {
+	if (!(hnd->get_usage() & GRALLOC_USAGE_ROIINFO))
+		return nullptr;
+
+	auto *metadata = static_cast<char*>(mali_gralloc_reference_get_metadata_addr(hnd).value());
+	return metadata + sizeof(shared_metadata) + hnd->reserved_region_size;
+}
 } // namespace common
 } // namespace mapper
 } // namespace arm
diff --git a/gralloc4/src/hidl_common/SharedMetadata.h b/gralloc4/src/hidl_common/SharedMetadata.h
index e1f6d0b..f3aad7c 100644
--- a/gralloc4/src/hidl_common/SharedMetadata.h
+++ b/gralloc4/src/hidl_common/SharedMetadata.h
@@ -23,7 +23,6 @@
 #include <vector>
 #include "gralloctypes/Gralloc4.h"
 #include "mali_gralloc_buffer.h"
-#include "allocator/mali_gralloc_shared_memory.h"
 #include "core/mali_gralloc_bufferdescriptor.h"
 #include "gralloc_helper.h"
 
@@ -68,6 +67,10 @@ android::status_t set_cta861_3(const private_handle_t *hnd, const std::optional<
 void get_smpte2094_40(const private_handle_t *hnd, std::optional<std::vector<uint8_t>> *smpte2094_40);
 android::status_t set_smpte2094_40(const private_handle_t *hnd, const std::optional<std::vector<uint8_t>> &smpte2094_40);
 
+void* get_video_hdr(const private_handle_t *hnd);
+
+void* get_video_roiinfo(const private_handle_t *hnd);
+
 } // namespace common
 } // namespace mapper
 } // namespace arm
diff --git a/gralloc4/src/libGralloc4Wrapper/wrapper.cpp b/gralloc4/src/libGralloc4Wrapper/wrapper.cpp
index c9d3381..f9b1b9c 100644
--- a/gralloc4/src/libGralloc4Wrapper/wrapper.cpp
+++ b/gralloc4/src/libGralloc4Wrapper/wrapper.cpp
@@ -5,7 +5,6 @@
 #include "core/format_info.h"
 #include "core/mali_gralloc_bufferdescriptor.h"
 #include "core/mali_gralloc_bufferallocation.h"
-#include "core/mali_gralloc_reference.h"
 #include "allocator/mali_gralloc_ion.h"
 #include "hidl_common/SharedMetadata.h"
 #include "gralloc_priv.h"
@@ -158,27 +157,32 @@ buffer_handle_t createNativeHandle(const Descriptor &descriptor) {
     }
 
     {
-        hnd->attr_base = mmap(nullptr, hnd->attr_size, PROT_READ | PROT_WRITE,
+        auto metadata_vaddr = mmap(nullptr, hnd->attr_size, PROT_READ | PROT_WRITE,
                 MAP_SHARED, hnd->get_share_attr_fd(), 0);
-        if (hnd->attr_base == MAP_FAILED) {
+        if (metadata_vaddr == MAP_FAILED) {
             ALOGE("mmap hnd->get_share_attr_fd() failed");
             mali_gralloc_buffer_free(tmp_buffer);
             return nullptr;
         }
 
-        memset(hnd->attr_base, 0, hnd->attr_size);
+        memset(metadata_vaddr, 0, hnd->attr_size);
 
-        arm::mapper::common::shared_metadata_init(hnd->attr_base, buffer_descriptor.name);
+        arm::mapper::common::shared_metadata_init(metadata_vaddr, buffer_descriptor.name);
 
         const uint32_t base_format = buffer_descriptor.alloc_format & MALI_GRALLOC_INTFMT_FMT_MASK;
         const uint64_t usage = buffer_descriptor.consumer_usage | buffer_descriptor.producer_usage;
         android_dataspace_t dataspace;
         get_format_dataspace(base_format, usage, hnd->width, hnd->height, &dataspace);
 
-        arm::mapper::common::set_dataspace(hnd, static_cast<arm::mapper::common::Dataspace>(dataspace));
+        {
+            using arm::mapper::common::aligned_optional;
+            using arm::mapper::common::Dataspace;
+            using arm::mapper::common::shared_metadata;
+            (static_cast<shared_metadata *>(metadata_vaddr))->dataspace =
+                    aligned_optional(static_cast<Dataspace>(dataspace));
+        }
 
-        munmap(hnd->attr_base, hnd->attr_size);
-        hnd->attr_base = 0;
+        munmap(metadata_vaddr, hnd->attr_size);
     }
 
     // TODO(modan@, handle all plane offsets)
@@ -195,15 +199,6 @@ int freeImportedHandle(void *handle)
 
     const private_handle_t *hnd = static_cast<private_handle_t *>(handle);
 
-    struct UnmapWork { void *base; size_t alloc_size; };
-    std::vector<UnmapWork> work(hnd->fd_count);
-
-    for (size_t i = 0; i < hnd->fd_count; ++i)
-    {
-        work[i].base = reinterpret_cast<void*>(hnd->bases[i]);
-        work[i].alloc_size = hnd->alloc_sizes[i];
-    }
-
     static android::sp<IMapper> mapper = IMapper::getService();
     if (!mapper)
     {
@@ -217,20 +212,6 @@ int freeImportedHandle(void *handle)
         return -1;
     }
 
-    {
-        bool unmapFailed = false;
-        for (const UnmapWork &w : work)
-        {
-            if (!w.base) { continue; }
-            if (int ret = munmap(w.base, w.alloc_size); ret)
-            {
-                ALOGE("libGralloc4Wrapper: %s couldn't unmap address %p (size %zu): %s", __func__, w.base, w.alloc_size, strerror(ret));
-                unmapFailed = true;
-            }
-        }
-        if (unmapFailed) { return -1; }
-    }
-
     return 0;
 }
 
diff --git a/gralloc4/src/mali_gralloc_buffer.h b/gralloc4/src/mali_gralloc_buffer.h
index 9cc7920..09461d7 100644
--- a/gralloc4/src/mali_gralloc_buffer.h
+++ b/gralloc4/src/mali_gralloc_buffer.h
@@ -236,10 +236,8 @@ struct private_handle_t
 	// locally mapped shared attribute area
 
 	int ion_handles[MAX_BUFFER_FDS];
-	uint64_t bases[MAX_BUFFER_FDS];
 	uint64_t alloc_sizes[MAX_BUFFER_FDS];
 
-	void *attr_base __attribute__((aligned (8))) DEFAULT_INITIALIZER(nullptr);
 	off_t offset    __attribute__((aligned (8))) DEFAULT_INITIALIZER(0);
 
 	/* Size of the attribute shared region in bytes. */
@@ -286,11 +284,12 @@ struct private_handle_t
 
 		if (_fds)
 			memcpy(fds, _fds, sizeof(fds));
+		else
+			memset(fds, -1, sizeof(fds));
 
 		if (_alloc_sizes)
 			memcpy(alloc_sizes, _alloc_sizes, sizeof(alloc_sizes));
 
-		memset(bases, 0, sizeof(bases));
 		memset(ion_handles, 0, sizeof(ion_handles));
 	}
 
@@ -404,7 +403,6 @@ struct private_handle_t
 			"alloc_format(0x%" PRIx64 ") "
 			"alloc_sizes(%" PRIu64 " %" PRIu64 " %" PRIu64 ") "
 			"layer_count(%d) "
-			"bases(%p %p %p %p) "
 			"\n",
 			str,
 			numInts, numFds, fd_count,
@@ -419,8 +417,7 @@ struct private_handle_t
 			plane_info[2].size, plane_info[2].byte_stride, plane_info[2].alloc_width, plane_info[2].alloc_height,
 			alloc_format,
 			alloc_sizes[0], alloc_sizes[1], alloc_sizes[2],
-			layer_count,
-			(void*)bases[0], (void*)bases[1], (void*)bases[2], attr_base
+			layer_count
 		);
 	}
 
diff --git a/include/gralloc3_priv.h b/include/gralloc3_priv.h
index ac053a1..f623359 100644
--- a/include/gralloc3_priv.h
+++ b/include/gralloc3_priv.h
@@ -122,273 +122,4 @@ typedef enum
 	MALI_YUV_BT2020_WIDE
 } mali_gralloc_yuv_info;
 
-typedef struct private_module
-{
-	gralloc1_module_t base;
-
-	struct private_handle_t *framebuffer;
-	uint32_t flags;
-	uint32_t numBuffers;
-	uint32_t bufferMask;
-	pthread_mutex_t lock;
-	buffer_handle_t currentBuffer;
-	mali_dpy_type dpy_type;
-
-	struct fb_var_screeninfo info;
-	struct fb_fix_screeninfo finfo;
-	float xdpi;
-	float ydpi;
-	float fps;
-	int swapInterval;
-	uint64_t fbdev_format;
-	int ionfd;
-} private_module_t;
-
-/*
- * Maximum number of pixel format planes.
- * Plane [0]: Single plane formats (inc. RGB, YUV) and Y
- * Plane [1]: U/V, UV
- * Plane [2]: V/U
- */
-#define MAX_PLANES 3
-
-typedef struct plane_info {
-
-	/*
-	 * Offset to plane (in bytes),
-	 * from the start of the allocation.
-	 */
-	uint32_t offset;
-
-	/*
-	 * Byte Stride: number of bytes between two vertically adjacent
-	 * pixels in given plane. This can be mathematically described by:
-	 *
-	 * byte_stride = ALIGN((alloc_width * bpp)/8, alignment)
-	 *
-	 * where,
-	 *
-	 * alloc_width: width of plane in pixels (c.f. pixel_stride)
-	 * bpp: average bits per pixel
-	 * alignment (in bytes): dependent upon pixel format and usage
-	 *
-	 * For uncompressed allocations, byte_stride might contain additional
-	 * padding beyond the alloc_width. For AFBC, alignment is zero.
-	 */
-	uint32_t byte_stride;
-
-	/*
-	 * Dimensions of plane (in pixels).
-	 *
-	 * For single plane formats, pixels equates to luma samples.
-	 * For multi-plane formats, pixels equates to the number of sample sites
-	 * for the corresponding plane, even if subsampled.
-	 *
-	 * AFBC compressed formats: requested width/height are rounded-up
-	 * to a whole AFBC superblock/tile (next superblock at minimum).
-	 * Uncompressed formats: dimensions typically match width and height
-	 * but might require pixel stride alignment.
-	 *
-	 * See 'byte_stride' for relationship between byte_stride and alloc_width.
-	 *
-	 * Any crop rectangle defined by GRALLOC_ARM_BUFFER_ATTR_CROP_RECT must
-	 * be wholly within the allocation dimensions. The crop region top-left
-	 * will be relative to the start of allocation.
-	 */
-	uint32_t alloc_width;
-	uint32_t alloc_height;
-} plane_info_t;
-
-struct private_handle_t : public native_handle
-{
-	enum
-	{
-		PRIV_FLAGS_FRAMEBUFFER            = 1U << 0,
-		PRIV_FLAGS_USES_ION_COMPOUND_HEAP = 1U << 1,
-		PRIV_FLAGS_USES_ION               = 1U << 2,
-		PRIV_FLAGS_USES_ION_DMA_HEAP      = 1U << 3,
-		PRIV_FLAGS_USES_2PRIVATE_DATA     = 1U << 4,
-		PRIV_FLAGS_USES_3PRIVATE_DATA     = 1U << 5,
-	};
-
-	/*
-	 * Shared file descriptor for dma_buf sharing. This must be the first element in the
-	 * structure so that binder knows where it is and can properly share it between
-	 * processes.
-	 * DO NOT MOVE THIS ELEMENT!
-	 */
-	int fd;
-	int fd1;
-	int fd2;
-	int fd3;
-	int fd4;
-
-	// ints
-	int magic;
-	int flags;
-
-	/*
-	 * Input properties.
-	 *
-	 * req_format: Pixel format, base + private modifiers.
-	 * width/height: Buffer dimensions.
-	 * producer/consumer_usage: Buffer usage (indicates IP)
-	 */
-	int width;
-	int height;
-	/* LSI integration: Needed by Camera */
-	int frameworkFormat;
-
-	uint64_t producer_usage;
-	uint64_t consumer_usage;
-
-	union
-	{
-		int format;
-		uint64_t internal_format;
-	};
-
-	/*
-	 * Allocation properties.
-	 *
-	 * alloc_format: Pixel format (base + modifiers). NOTE: base might differ from requested
-	 *               format (req_format) where fallback to single-plane format was required.
-	 * plane_info:   Per plane allocation information.
-	 * size:         Total bytes allocated for buffer (inc. all planes, layers. etc.).
-	 * layer_count:  Number of layers allocated to buffer.
-	 *               All layers are the same size (in bytes).
-	 *               Multi-layers supported in v1.0, where GRALLOC1_CAPABILITY_LAYERED_BUFFERS is enabled.
-	 *               Layer size: 'size' / 'layer_count'.
-	 *               Layer (n) offset: n * ('size' / 'layer_count'), n=0 for the first layer.
-	 *
-	 */
-	uint64_t alloc_format;
-	union
-	{
-		plane_info_t plane_info[MAX_PLANES];
-		struct
-		{
-			int plane_offset;
-			int byte_stride;
-			int alloc_width;
-			int vstride;
-		};
-	};
-	int size;
-	int size1;
-	int size2;
-	uint32_t stride;
-	uint32_t layer_count;
-
-	union
-	{
-		void *base;
-		uint64_t bases[3];
-	};
-
-	uint64_t backing_store_id;
-	int backing_store_size;
-	int cpu_read;               /**< Buffer is locked for CPU read when non-zero. */
-	int cpu_write;              /**< Buffer is locked for CPU write when non-zero. */
-	int allocating_pid;
-	int remote_pid;
-	int ref_count;
-	// locally mapped shared attribute area
-	union
-	{
-		void *attr_base;
-		uint64_t padding3;
-	};
-
-	mali_gralloc_yuv_info yuv_info;
-
-	// Following members is for framebuffer only
-	int fb_fd;
-	union
-	{
-		off_t offset;
-		uint64_t padding4;
-	};
-
-	/*
-	 * min_pgsz denotes minimum phys_page size used by this buffer.
-	 * if buffer memory is physical contiguous set min_pgsz to buff->size
-	 * if not sure buff's real phys_page size, you can use SZ_4K for safe.
-	 */
-	int min_pgsz;
-
-	int is_compressible;
-
-	ion_user_handle_t ion_handles[3];
-
-	int     PRIVATE_1 = 0;
-	int     PRIVATE_2 = 0;
-	int     plane_count = 0;
-
-	static int validate(const native_handle *h)
-	{
-#define GRALLOC_ARM_NUM_FDS 2
-#define NUM_INTS_IN_PRIVATE_HANDLE ((sizeof(struct private_handle_t) - sizeof(native_handle)) / sizeof(int) - GRALLOC_ARM_NUM_FDS)
-
-		static const int sNumFds = GRALLOC_ARM_NUM_FDS;
-		static const int sMagic = 0x3141592;
-		const private_handle_t *hnd = (const private_handle_t *)h;
-
-		if (!h || h->version != sizeof(native_handle) ||
-				hnd->numInts + hnd->numFds != NUM_INTS_IN_PRIVATE_HANDLE + sNumFds ||
-				hnd->magic != sMagic)
-		{
-			return -EINVAL;
-		}
-
-		return 0;
-	}
-
-	static private_handle_t *dynamicCast(const native_handle *in)
-	{
-		if (validate(in) == 0)
-		{
-			return (private_handle_t *)in;
-		}
-
-		return NULL;
-	}
-
-	int get_num_ion_fds() const
-	{
-		return numFds - 1;
-	}
-
-	void dump(const char *str) const
-	{
-		ALOGD("[%s] "
-				"fd(%d %d %d %d) "
-				"flags(%d) "
-				"wh(%d %d) "
-				"req_format(0x%x) "
-				"usage_pc(0x%" PRIx64 " 0x%" PRIx64 ") "
-				"format(0x%x) "
-				"interal_format(0x%" PRIx64 ") "
-				"stride(%d) byte_stride(%d) internal_wh(%d %d) "
-				"alloc_format(0x%" PRIx64 ") "
-				"size(%d %d %d) "
-				"layer_count(%d) plane_count(%d)"
-				"bases(0x%" PRIx64 " 0x%" PRIx64 " 0x%" PRIx64 ") "
-				"\n",
-				str,
-				fd, fd1, fd2, fd3,
-				flags,
-				width, height,
-				frameworkFormat,
-				producer_usage, consumer_usage,
-				format, internal_format,
-				stride, plane_info[0].byte_stride, plane_info[0].alloc_width, plane_info[0].alloc_height,
-				alloc_format,
-				size, size1, size2,
-				layer_count, plane_count,
-				bases[0], bases[1], bases[2]
-			);
-	}
-};
-
 #endif /* GRALLOC3_PRIV_H_ */
diff --git a/libvendorgraphicbuffer/Android.bp b/libvendorgraphicbuffer/Android.bp
index 53e76aa..0230bfb 100644
--- a/libvendorgraphicbuffer/Android.bp
+++ b/libvendorgraphicbuffer/Android.bp
@@ -22,7 +22,6 @@ package {
 cc_library_shared {
 	name: "libvendorgraphicbuffer",
 	srcs: [
-		"gralloc4/vendor_graphicbuffer_mapper.cpp",
 		"gralloc4/vendor_graphicbuffer_meta.cpp",
 	],
 	shared_libs: [
@@ -44,6 +43,7 @@ cc_library_shared {
 	],
 	header_libs: [
 		"libgralloc_headers",
+		"pixel-gralloc-headers",
 	],
 	include_dirs: [
 		"hardware/google/gchips/include",
diff --git a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_mapper.cpp b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_mapper.cpp
deleted file mode 100644
index 713384a..0000000
--- a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_mapper.cpp
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2020 Samsung Electronics Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <ui/Gralloc.h>
-#include "VendorGraphicBuffer.h"
-#include "mali_gralloc_formats.h"
-#include "mali_gralloc_buffer.h"
-#include "exynos_format.h"
-#include "gralloc_helper.h"
-#include <log/log.h>
-
-using namespace android;
-using namespace vendor::graphics;
-
-
-status_t VendorGraphicBufferMapper::lock64(buffer_handle_t handle, uint64_t usage, const Rect& bounds,
-	void** vaddr, int32_t* outBytesPerPixel, int32_t* outBytesPerStride)
-{
-	return lockAsync(handle, usage, usage, bounds, vaddr,
-			-1, outBytesPerPixel, outBytesPerStride);
-}
-
-status_t VendorGraphicBufferMapper::lockYCbCr64(buffer_handle_t handle,
-	uint64_t usage, const Rect& bounds, android_ycbcr *ycbcr)
-{
-	status_t err = getGrallocMapper().lock(handle, usage, bounds, -1, ycbcr);
-
-	if (!(usage & VendorGraphicBufferUsage::VIDEO_PRIVATE_DATA))
-		return err;
-
-	/* TODO: clean this typecasting... */
-	const private_handle_t * const hnd = (private_handle_t *)handle;
-
-	switch (hnd->alloc_format & MALI_GRALLOC_INTFMT_FMT_MASK)
-	{
-	case HAL_PIXEL_FORMAT_EXYNOS_YCrCb_420_SP_M_SBWC:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCrCb_420_SP_M_10B_SBWC:
-			ycbcr->cb = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_SBWC:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_10B_SBWC:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_SBWC_L50:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_SBWC_L75:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_10B_SBWC_L40:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_10B_SBWC_L60:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_10B_SBWC_L80:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_SBWC:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_10B_SBWC:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_YCrCb_420_SP:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_SBWC_L50:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_SBWC_L75:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_10B_SBWC_L40:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_10B_SBWC_L60:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_10B_SBWC_L80:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCrCb_420_SP_M:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCrCb_420_SP_M_FULL:
-			ycbcr->cb = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M:
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SP_M_S10B:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_420_SPN_S10B:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	case HAL_PIXEL_FORMAT_EXYNOS_YCbCr_P010_M:
-			ycbcr->cr = (void *)(hnd->attr_base);
-		break;
-	default:
-		break;
-	}
-
-	return err;
-}
diff --git a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
index 62c550a..eb8d663 100644
--- a/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
+++ b/libvendorgraphicbuffer/gralloc4/vendor_graphicbuffer_meta.cpp
@@ -27,6 +27,8 @@
 #include "hidl_common/SharedMetadata_struct.h"
 #include "exynos_format.h"
 
+#include <pixel-gralloc/metadata.h>
+
 using namespace android;
 using namespace vendor::graphics;
 
@@ -38,6 +40,7 @@ using android::gralloc4::decodePixelFormatFourCC;
 using android::gralloc4::decodePixelFormatModifier;
 using android::hardware::graphics::mapper::V4_0::IMapper;
 using android::hardware::graphics::mapper::V4_0::Error;
+using MapperMetadataType = android::hardware::graphics::mapper::V4_0::IMapper::MetadataType;
 
 #define UNUSED(x) ((void)x)
 #define SZ_4k 0x1000
@@ -69,19 +72,10 @@ android::sp<IMapper> get_mapper() {
 	return mapper;
 }
 
-int VendorGraphicBufferMeta::get_video_metadata_fd(buffer_handle_t hnd)
+int VendorGraphicBufferMeta::get_video_metadata_fd(buffer_handle_t /*hnd*/)
 {
-	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
-
-	if (!gralloc_hnd)
-		return -EINVAL;
-
-	uint64_t usage = gralloc_hnd->producer_usage | gralloc_hnd->consumer_usage;
-
-	if (usage & VendorGraphicBufferUsage::VIDEO_PRIVATE_DATA)
-		return gralloc_hnd->get_share_attr_fd();
-	else
-		return -EINVAL;
+	ALOGE("%s function is obsolete and should not be used", __FUNCTION__);
+	__builtin_trap();
 }
 
 int VendorGraphicBufferMeta::get_dataspace(buffer_handle_t hnd)
@@ -233,28 +227,80 @@ uint64_t VendorGraphicBufferMeta::get_usage(buffer_handle_t hnd)
 	return gralloc_hnd->producer_usage | gralloc_hnd->consumer_usage;
 }
 
+void* decodePointer(const android::hardware::hidl_vec<uint8_t>& tmpVec) {
+	constexpr uint8_t kPtrSize = sizeof(void*);
+	assert(tmpVec.size() == kPtrSize);
+
+	void* data_ptr;
+	std::memcpy(&data_ptr, tmpVec.data(), kPtrSize);
+
+	return data_ptr;
+}
+
 void* VendorGraphicBufferMeta::get_video_metadata(buffer_handle_t hnd)
 {
-	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
+	native_handle_t* handle = const_cast<native_handle_t*>(hnd);
+	if (!handle) {
+		return nullptr;
+	}
+
+	MapperMetadataType metadata_type{
+		.name = ::pixel::graphics::kPixelMetadataTypeName,
+		.value = static_cast<int64_t>(::pixel::graphics::MetadataType::VIDEO_HDR),
+	};
+
+	Error error = Error::NONE;
+	void* output = nullptr;
+
+	get_mapper()->get(handle, metadata_type,
+	                  [&](const auto& tmpError, const android::hardware::hidl_vec<uint8_t>& tmpVec) {
+	                  	error = tmpError;
+	                  	if (error != Error::NONE) {
+	                  		return;
+	                  	}
+	                  	output = decodePointer(tmpVec);
+	                  });
+
 
-	if (gralloc_hnd == nullptr)
+	if (error != Error::NONE) {
+		ALOGE("Failed to get video HDR metadata");
 		return nullptr;
+	}
 
-	return gralloc_hnd->attr_base;
+	return output;
 }
 
 void* VendorGraphicBufferMeta::get_video_metadata_roiinfo(buffer_handle_t hnd)
 {
-	const auto *gralloc_hnd = convertNativeHandleToPrivateHandle(hnd);
-
-	if (gralloc_hnd == nullptr)
+	native_handle_t* handle = const_cast<native_handle_t*>(hnd);
+	if (!handle) {
 		return nullptr;
+	}
+
+	MapperMetadataType metadata_type{
+		.name = ::pixel::graphics::kPixelMetadataTypeName,
+		.value = static_cast<int64_t>(::pixel::graphics::MetadataType::VIDEO_ROI),
+	};
 
-	if (gralloc_hnd->get_usage() & VendorGraphicBufferUsage::ROIINFO)
-		return static_cast<char*>(gralloc_hnd->attr_base) +
-			sizeof(shared_metadata) + gralloc_hnd->reserved_region_size;
+	Error error = Error::NONE;
+	void* output = nullptr;
+
+	get_mapper()->get(handle, metadata_type,
+	                  [&](const auto& tmpError, const android::hardware::hidl_vec<uint8_t>& tmpVec) {
+	                  	error = tmpError;
+	                  	if (error != Error::NONE) {
+	                  		return;
+	                  	}
+	                  	output = decodePointer(tmpVec);
+	                  });
+
+
+	if (error != Error::NONE) {
+		ALOGE("Failed to get video HDR metadata");
+		return nullptr;
+	}
 
-	return nullptr;
+	return output;
 }
 
 uint32_t VendorGraphicBufferMeta::get_format_fourcc(buffer_handle_t hnd) {
diff --git a/libvendorgraphicbuffer/include/VendorGraphicBuffer.h b/libvendorgraphicbuffer/include/VendorGraphicBuffer.h
index 97b0a2c..0f6a104 100644
--- a/libvendorgraphicbuffer/include/VendorGraphicBuffer.h
+++ b/libvendorgraphicbuffer/include/VendorGraphicBuffer.h
@@ -41,6 +41,7 @@ enum VendorGraphicBufferUsage {
 /* S.LSI specific usages */
 	NO_AFBC                         = 1ULL << 29,
 	MFC                             = 1ULL << 50,  /* identical to GRALLOC_USAGE_GOOGLE_IP_MFC */
+	BW                              = 1ULL << 51,  /* identical to GRALLOC_USAGE_GOOGLE_IP_BW */
 	ROIINFO                         = 1ULL << 52,
 	AFBC_PADDING                    = 1ULL << 53,
 	FORCE_BACKBUFFER                = 1ULL << 54,
@@ -146,32 +147,17 @@ public:
 	 * When gralloc3 is used, will always return nullptr
 	 */
 	static void* get_video_metadata_roiinfo(buffer_handle_t);
-	static int get_video_metadata_fd(buffer_handle_t);
 	static int get_dataspace(buffer_handle_t);
 	static int set_dataspace(buffer_handle_t hnd, android_dataspace_t dataspace);
 
+	// There should be no users of this function. It'll generate a trap.
+	static int get_video_metadata_fd(buffer_handle_t);
+
 	static buffer_handle_t import_buffer(buffer_handle_t);
 	static int free_buffer(buffer_handle_t);
 };
 
-
-/* Mapper extension class to allow locking with 64-bit usages */
-class VendorGraphicBufferMapper : public android::GraphicBufferMapper
-{
-public:
-	static inline VendorGraphicBufferMapper& get()
-	{
-		return static_cast<VendorGraphicBufferMapper&>(getInstance());
-	}
-
-	android::status_t lock64(buffer_handle_t handle, uint64_t usage, const android::Rect& bounds,
-		void** vaddr, int32_t* outBytesPerPixel = nullptr,
-		int32_t* outBytesPerStride = nullptr);
-
-	android::status_t lockYCbCr64(buffer_handle_t handle,
-		uint64_t usage, const android::Rect& bounds, android_ycbcr *ycbcr);
-};
-
+typedef class android::GraphicBufferMapper VendorGraphicBufferMapper;
 typedef class android::GraphicBufferAllocator VendorGraphicBufferAllocator;
 
 } /* namespace graphics */