diff --git a/camera/device/1.0/default/Android.bp b/camera/device/1.0/default/Android.bp
index 5688fc1..af94b0f 100644
--- a/camera/device/1.0/default/Android.bp
+++ b/camera/device/1.0/default/Android.bp
@@ -7,6 +7,7 @@
     ],
     shared_libs: [
         "libhidlbase",
+        "libhidlmemory",
         "libhidltransport",
         "libhwbinder",
         "libutils",
@@ -14,12 +15,13 @@
         "android.hardware.camera.common@1.0",
         "android.hardware.graphics.allocator@2.0",
         "android.hardware.graphics.common@1.0",
+        "android.hidl.allocator@1.0",
         "android.hidl.base@1.0",
+        "android.hidl.memory@1.0",
         "libcutils",
         "liblog",
         "libhardware",
         "libcamera_metadata",
-        "libbinder",
     ],
     static_libs: [
         "android.hardware.camera.common@1.0-helper"
diff --git a/camera/device/1.0/default/CameraDevice.cpp b/camera/device/1.0/default/CameraDevice.cpp
index 819525b..8c6031b 100644
--- a/camera/device/1.0/default/CameraDevice.cpp
+++ b/camera/device/1.0/default/CameraDevice.cpp
@@ -18,6 +18,7 @@
 #include <utils/Log.h>
 #include <hardware/camera.h>
 #include <hardware/gralloc1.h>
+#include <hidlmemory/mapping.h>
 #include <utils/Trace.h>
 
 #include "CameraDevice_1_0.h"
@@ -102,6 +103,12 @@
                 __FUNCTION__, mCameraId.c_str());
         mInitFail = true;
     }
+
+    mAshmemAllocator = IAllocator::getService("ashmem");
+    if (mAshmemAllocator == nullptr) {
+        ALOGI("%s: cannot get ashmemAllocator", __FUNCTION__);
+        mInitFail = true;
+    }
 }
 
 CameraDevice::~CameraDevice() {
@@ -289,35 +296,66 @@
     return getStatusT(s);
 }
 
-CameraDevice::CameraHeapMemory::CameraHeapMemory(int fd, size_t buf_size, uint_t num_buffers) :
+CameraDevice::CameraHeapMemory::CameraHeapMemory(
+    int fd, size_t buf_size, uint_t num_buffers) :
         mBufSize(buf_size),
         mNumBufs(num_buffers) {
-    mHeap = new MemoryHeapBase(fd, buf_size * num_buffers);
+    mHidlHandle = native_handle_create(1,0);
+    mHidlHandle->data[0] = fcntl(fd, F_DUPFD_CLOEXEC, 0);
+    const size_t pagesize = getpagesize();
+    size_t size = ((buf_size * num_buffers + pagesize-1) & ~(pagesize-1));
+    mHidlHeap = hidl_memory("ashmem", mHidlHandle, size);
     commonInitialization();
 }
 
-CameraDevice::CameraHeapMemory::CameraHeapMemory(size_t buf_size, uint_t num_buffers) :
+CameraDevice::CameraHeapMemory::CameraHeapMemory(
+    sp<IAllocator> ashmemAllocator,
+    size_t buf_size, uint_t num_buffers) :
         mBufSize(buf_size),
         mNumBufs(num_buffers) {
-    mHeap = new MemoryHeapBase(buf_size * num_buffers);
+    const size_t pagesize = getpagesize();
+    size_t size = ((buf_size * num_buffers + pagesize-1) & ~(pagesize-1));
+    ashmemAllocator->allocate(size,
+        [&](bool success, const hidl_memory& mem) {
+            if (!success) {
+                ALOGE("%s: allocating ashmem of %zu bytes failed!",
+                        __FUNCTION__, buf_size * num_buffers);
+                return;
+            }
+            mHidlHandle = native_handle_clone(mem.handle());
+            mHidlHeap = hidl_memory("ashmem", mHidlHandle, size);
+        });
+
     commonInitialization();
 }
 
 void CameraDevice::CameraHeapMemory::commonInitialization() {
-    handle.data = mHeap->base();
+    mHidlHeapMemory = mapMemory(mHidlHeap);
+    if (mHidlHeapMemory == nullptr) {
+        ALOGE("%s: memory map failed!", __FUNCTION__);
+        native_handle_close(mHidlHandle); // close FD for the shared memory
+        native_handle_delete(mHidlHandle);
+        mHidlHeap = hidl_memory();
+        mHidlHandle = nullptr;
+        return;
+    }
+    mHidlHeapMemData = mHidlHeapMemory->getPointer();
+    handle.data = mHidlHeapMemData;
     handle.size = mBufSize * mNumBufs;
     handle.handle = this;
-
-    mBuffers = new sp<MemoryBase>[mNumBufs];
-    for (uint_t i = 0; i < mNumBufs; i++) {
-        mBuffers[i] = new MemoryBase(mHeap, i * mBufSize, mBufSize);
-    }
-
     handle.release = sPutMemory;
 }
 
 CameraDevice::CameraHeapMemory::~CameraHeapMemory() {
-    delete [] mBuffers;
+    if (mHidlHeapMemory != nullptr) {
+        mHidlHeapMemData = nullptr;
+        mHidlHeapMemory.clear(); // The destructor will trigger munmap
+    }
+
+    if (mHidlHandle) {
+        native_handle_close(mHidlHandle); // close FD for the shared memory
+        native_handle_delete(mHidlHandle);
+    }
 }
 
 // shared memory methods
@@ -330,22 +368,13 @@
     }
 
     CameraHeapMemory* mem;
-    native_handle_t* handle = native_handle_create(1,0);
-
-    if (handle == nullptr) {
-        ALOGE("%s: native_handle_create failed!", __FUNCTION__);
-        return nullptr;
-    }
-
     if (fd < 0) {
-        mem = new CameraHeapMemory(buf_size, num_bufs);
+        mem = new CameraHeapMemory(object->mAshmemAllocator, buf_size, num_bufs);
     } else {
         mem = new CameraHeapMemory(fd, buf_size, num_bufs);
     }
-    handle->data[0] = mem->mHeap->getHeapID();
     mem->incStrong(mem);
-
-    hidl_handle hidlHandle = handle;
+    hidl_handle hidlHandle = mem->mHidlHandle;
     MemoryId id = object->mDeviceCallback->registerMemory(hidlHandle, buf_size, num_bufs);
     mem->handle.mId = id;
     if (object->mMemoryMap.count(id) != 0) {
@@ -353,7 +382,6 @@
     }
     object->mMemoryMap[id] = mem;
     mem->handle.mDevice = object;
-    native_handle_delete(handle);
     return &mem->handle;
 }
 
@@ -438,7 +466,7 @@
     if (object->mMetadataMode) {
         if (mem->mBufSize == sizeof(VideoNativeHandleMetadata)) {
             VideoNativeHandleMetadata* md = (VideoNativeHandleMetadata*)
-                    mem->mBuffers[index]->pointer();
+                    ((uint8_t*) mem->mHidlHeapMemData + index * mem->mBufSize);
             if (md->eType == VideoNativeHandleMetadata::kMetadataBufferTypeNativeHandleSource) {
                 handle = md->pHandle;
             }
@@ -769,27 +797,12 @@
     }
     if (mDevice->ops->release_recording_frame) {
         CameraHeapMemory* camMemory = mMemoryMap.at(memId);
-        sp<MemoryHeapBase> heap = camMemory->mHeap;
         if (bufferIndex >= camMemory->mNumBufs) {
             ALOGE("%s: bufferIndex %d exceeds number of buffers %d",
                     __FUNCTION__, bufferIndex, camMemory->mNumBufs);
             return;
         }
-        sp<IMemory> mem = camMemory->mBuffers[bufferIndex];
-        // TODO: simplify below logic once we verify offset is indeed idx * mBufSize
-        //       and heap == heap2
-        ssize_t offset;
-        size_t size;
-        sp<IMemoryHeap> heap2 = mem->getMemory(&offset, &size);
-        if ((size_t)offset != bufferIndex * camMemory->mBufSize) {
-            ALOGI("%s: unexpected offset %zd (was expecting %zu)",
-                    __FUNCTION__, offset, bufferIndex * camMemory->mBufSize);
-        }
-        if (heap != heap2) {
-            ALOGE("%s: heap mismatch!", __FUNCTION__);
-            return;
-        }
-        void *data = ((uint8_t *)heap->base()) + offset;
+        void *data = ((uint8_t *) camMemory->mHidlHeapMemData) + bufferIndex * camMemory->mBufSize;
         if (handle) {
             VideoNativeHandleMetadata* md = (VideoNativeHandleMetadata*) data;
             if (md->eType == VideoNativeHandleMetadata::kMetadataBufferTypeNativeHandleSource) {
diff --git a/camera/device/1.0/default/CameraDevice_1_0.h b/camera/device/1.0/default/CameraDevice_1_0.h
index 2568f86..66d7519 100644
--- a/camera/device/1.0/default/CameraDevice_1_0.h
+++ b/camera/device/1.0/default/CameraDevice_1_0.h
@@ -20,12 +20,12 @@
 #include <unordered_map>
 #include "utils/Mutex.h"
 #include "utils/SortedVector.h"
-#include <binder/MemoryBase.h>
-#include <binder/MemoryHeapBase.h>
 #include "CameraModule.h"
 #include "HandleImporter.h"
 
 #include <android/hardware/camera/device/1.0/ICameraDevice.h>
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <android/hidl/memory/1.0/IMemory.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
 
@@ -47,7 +47,9 @@
 using ::android::hardware::camera::device::V1_0::ICameraDeviceCallback;
 using ::android::hardware::camera::device::V1_0::ICameraDevicePreviewCallback;
 using ::android::hardware::camera::device::V1_0::MemoryId;
+using ::android::hidl::allocator::V1_0::IAllocator;
 using ::android::hidl::base::V1_0::IBase;
+using ::android::hidl::memory::V1_0::IMemory;
 using ::android::hardware::hidl_array;
 using ::android::hardware::hidl_memory;
 using ::android::hardware::hidl_string;
@@ -111,17 +113,24 @@
     class CameraHeapMemory : public RefBase {
     public:
         CameraHeapMemory(int fd, size_t buf_size, uint_t num_buffers = 1);
-        explicit CameraHeapMemory(size_t buf_size, uint_t num_buffers = 1);
+        explicit CameraHeapMemory(
+            sp<IAllocator> ashmemAllocator, size_t buf_size, uint_t num_buffers = 1);
         void commonInitialization();
         virtual ~CameraHeapMemory();
 
         size_t mBufSize;
         uint_t mNumBufs;
-        // TODO: b/35887419: use hidl_memory instead and get rid of libbinder
-        sp<MemoryHeapBase> mHeap;
-        sp<MemoryBase>* mBuffers;
+
+        // Shared memory related members
+        hidl_memory      mHidlHeap;
+        native_handle_t* mHidlHandle; // contains one shared memory FD
+        void*            mHidlHeapMemData;
+        sp<IMemory>      mHidlHeapMemory; // munmap happens in ~IMemory()
+
         CameraMemory handle;
     };
+    sp<IAllocator> mAshmemAllocator;
+
 
     // TODO: b/35625849
     // Meta data buffer layout for passing a native_handle to codec
diff --git a/camera/provider/2.4/default/Android.bp b/camera/provider/2.4/default/Android.bp
index 42dec4d..9506827 100644
--- a/camera/provider/2.4/default/Android.bp
+++ b/camera/provider/2.4/default/Android.bp
@@ -15,6 +15,8 @@
         "camera.device@3.2-impl",
         "android.hardware.camera.provider@2.4",
         "android.hardware.camera.common@1.0",
+        "android.hidl.allocator@1.0",
+        "android.hidl.memory@1.0",
         "liblog",
         "libhardware",
         "libcamera_metadata"