diff --git a/crypto/fde/cryptfs.cpp b/crypto/fde/cryptfs.cpp
index eeefc29..544d3ec 100644
--- a/crypto/fde/cryptfs.cpp
+++ b/crypto/fde/cryptfs.cpp
@@ -60,6 +60,9 @@
 //#include "f2fs_sparseblock.h"
 //#include "EncryptInplace.h"
 //#include "Process.h"
+#if TW_KEYMASTER_MAX_API > 1
+#include <hardware/keymaster2.h>
+#endif
 #if TW_KEYMASTER_MAX_API == 3
 #include "../ext4crypt/Keymaster3.h"
 #endif
@@ -74,7 +77,6 @@
 #include <openssl/sha.h>
 #include <hardware/keymaster0.h>
 #include <hardware/keymaster1.h>
-#include <hardware/keymaster2.h>
 #endif
 //#include "android-base/properties.h"
 //#include <bootloader_message/bootloader_message.h>
@@ -150,7 +152,7 @@
   }
 }
 
-#if TW_KEYMASTER_MAX_API == 0
+#if TW_KEYMASTER_MAX_API == 0 //TW_KEYMASTER_MAX_API
 static int keymaster_init(keymaster_device_t **keymaster_dev)
 {
     int rc;
@@ -175,7 +177,7 @@
     *keymaster_dev = NULL;
     return rc;
 }
-#else //TW_KEYMASTER_MAX_API == 0
+#elif TW_KEYMASTER_MAX_API > 1
 static int keymaster_init(keymaster0_device_t **keymaster0_dev,
                           keymaster1_device_t **keymaster1_dev,
 			  keymaster2_device_t **keymaster2_dev)
@@ -220,7 +222,46 @@
     *keymaster2_dev = NULL;
     return rc;
 }
-#endif //TW_KEYMASTER_MAX_API == 0
+#else
+static int keymaster_init(keymaster0_device_t **keymaster0_dev,
+                          keymaster1_device_t **keymaster1_dev)
+{
+    int rc;
+
+    const hw_module_t* mod;
+    rc = hw_get_module_by_class(KEYSTORE_HARDWARE_MODULE_ID, NULL, &mod);
+    if (rc) {
+        printf("could not find any keystore module\n");
+        goto err;
+    }
+
+    printf("keymaster module name is %s\n", mod->name);
+    printf("keymaster version is %d\n", mod->module_api_version);
+
+    *keymaster0_dev = NULL;
+    *keymaster1_dev = NULL;
+    if (mod->module_api_version == KEYMASTER_MODULE_API_VERSION_1_0) {
+        printf("Found keymaster1 module, using keymaster1 API.\n");
+        rc = keymaster1_open(mod, keymaster1_dev);
+    } else {
+        printf("Found keymaster0 module, using keymaster0 API.\n");
+        rc = keymaster0_open(mod, keymaster0_dev);
+    }
+
+    if (rc) {
+        printf("could not open keymaster device in %s (%s)\n",
+              KEYSTORE_HARDWARE_MODULE_ID, strerror(-rc));
+        goto err;
+    }
+
+    return 0;
+
+err:
+    *keymaster0_dev = NULL;
+    *keymaster1_dev = NULL;
+    return rc;
+}
+#endif //TW_KEYMASTER_MAX_API
 
 #ifdef CONFIG_HW_DISK_ENCRYPTION
 static int scrypt_keymaster(const char *passwd, const unsigned char *salt,
@@ -431,9 +472,13 @@
 #if TW_KEYMASTER_MAX_API >= 1
     keymaster0_device_t *keymaster0_dev = 0;
     keymaster1_device_t *keymaster1_dev = 0;
+#if TW_KEYMASTER_MAX_API > 1
     keymaster2_device_t *keymaster2_dev = 0;
     if (keymaster_init(&keymaster0_dev, &keymaster1_dev, &keymaster2_dev)) {
 #else
+    if (keymaster_init(&keymaster0_dev, &keymaster1_dev)) {
+#endif
+#else
     keymaster_device_t *keymaster0_dev = 0;
     if (keymaster_init(&keymaster0_dev)) {
 #endif
@@ -512,6 +557,7 @@
         *signature_size = tmp_sig.data_length;
         rc = 0;
     }
+#if TW_KEYMASTER_MAX_API > 1
     else if (keymaster2_dev) {
         keymaster_key_blob_t key = { ftr->keymaster_blob, ftr->keymaster_blob_size };
         keymaster_key_param_t params[] = {
@@ -588,6 +634,7 @@
         *signature_size = tmp_sig.data_length;
         rc = 0;
     }
+#endif // TW_KEYMASTER_API > 1
 #endif // TW_KEYMASTER_API >= 1
 
     out: