diff --git a/Android.mk b/Android.mk
index 0367fef..f04f7dd 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,11 +1,11 @@
+ifneq ($(TARGET_SIMULATOR),true)
+ifeq ($(TARGET_ARCH),arm)
+
 LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
 
 commands_recovery_local_path := $(LOCAL_PATH)
 
-ifneq ($(TARGET_SIMULATOR),true)
-ifeq ($(TARGET_ARCH),arm)
-
 LOCAL_SRC_FILES := \
 	recovery.c \
 	bootloader.c \
@@ -32,7 +32,13 @@
 
 LOCAL_MODULE_TAGS := eng
 
-LOCAL_STATIC_LIBRARIES := libminzip libunz libamend libmtdutils libmincrypt
+LOCAL_STATIC_LIBRARIES :=
+ifeq ($(TARGET_RECOVERY_UI_LIB),)
+  LOCAL_SRC_FILES += default_recovery_ui.c
+else
+  LOCAL_STATIC_LIBRARIES += $(TARGET_RECOVERY_UI_LIB)
+endif
+LOCAL_STATIC_LIBRARIES += libminzip libunz libamend libmtdutils libmincrypt
 LOCAL_STATIC_LIBRARIES += libminui libpixelflinger_static libpng libcutils
 LOCAL_STATIC_LIBRARIES += libstdc++ libc
 
diff --git a/default_recovery_ui.c b/default_recovery_ui.c
new file mode 100644
index 0000000..a2e4bea
--- /dev/null
+++ b/default_recovery_ui.c
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <linux/input.h>
+
+#include "recovery_ui.h"
+#include "common.h"
+
+char* MENU_HEADERS[] = { "Android system recovery utility",
+                         "",
+                         NULL };
+
+char* MENU_ITEMS[] = { "reboot system now",
+                       "apply sdcard:update.zip",
+                       "wipe data/factory reset",
+                       "wipe cache partition",
+                       NULL };
+
+int device_toggle_display(char* key_pressed, int key_code) {
+    return key_code == KEY_HOME;
+}
+
+int device_reboot_now(char* key_pressed, int key_code) {
+    return 0;
+}
+
+int device_handle_key(int key_code, int visible) {
+    if (visible) {
+        switch (key_code) {
+            case KEY_DOWN:
+            case KEY_VOLUMEDOWN:
+                return HIGHLIGHT_DOWN;
+
+            case KEY_UP:
+            case KEY_VOLUMEUP:
+                return HIGHLIGHT_UP;
+
+            case KEY_ENTER:
+                return SELECT_ITEM;
+        }
+    }
+
+    return NO_ACTION;
+}
+
+int device_perform_action(int which) {
+    return which;
+}
+
+int device_wipe_data() {
+    return 0;
+}
diff --git a/minui/graphics.c b/minui/graphics.c
index 06c5fdf..adbfc09 100644
--- a/minui/graphics.c
+++ b/minui/graphics.c
@@ -115,6 +115,7 @@
     if (n > 1) return;
     vi.yres_virtual = vi.yres * 2;
     vi.yoffset = n * vi.yres;
+    vi.bits_per_pixel = 16;
     if (ioctl(gr_fb_fd, FBIOPUT_VSCREENINFO, &vi) < 0) {
         perror("active fb swap failed");
     }
diff --git a/minui/minui.h b/minui/minui.h
index 80b47a4..567d421 100644
--- a/minui/minui.h
+++ b/minui/minui.h
@@ -41,22 +41,6 @@
 // see http://www.mjmwired.net/kernel/Documentation/input/ for info.
 struct input_event;
 
-// Dream-specific key codes
-#define KEY_DREAM_HOME        102  // = KEY_HOME
-#define KEY_DREAM_RED         107  // = KEY_END
-#define KEY_DREAM_VOLUMEDOWN  114  // = KEY_VOLUMEDOWN
-#define KEY_DREAM_VOLUMEUP    115  // = KEY_VOLUMEUP
-#define KEY_DREAM_SYM         127  // = KEY_COMPOSE
-#define KEY_DREAM_MENU        139  // = KEY_MENU
-#define KEY_DREAM_BACK        158  // = KEY_BACK
-#define KEY_DREAM_FOCUS       211  // = KEY_HP (light touch on camera)
-#define KEY_DREAM_CAMERA      212  // = KEY_CAMERA
-#define KEY_DREAM_AT          215  // = KEY_EMAIL
-#define KEY_DREAM_GREEN       231
-#define KEY_DREAM_FATTOUCH    258  // = BTN_2 ???
-#define KEY_DREAM_BALL        272  // = BTN_MOUSE
-#define KEY_DREAM_TOUCH       330  // = BTN_TOUCH
-
 int ev_init(void);
 void ev_exit(void);
 int ev_get(struct input_event *ev, unsigned dont_wait);
diff --git a/recovery.c b/recovery.c
index 5ccd38f..499fda5 100644
--- a/recovery.c
+++ b/recovery.c
@@ -37,6 +37,7 @@
 #include "minui/minui.h"
 #include "minzip/DirUtil.h"
 #include "roots.h"
+#include "recovery_ui.h"
 
 static const struct option OPTIONS[] = {
   { "send_intent", required_argument, NULL, 's' },
@@ -287,26 +288,25 @@
 static void
 prompt_and_wait()
 {
-    char* headers[] = { "Android system recovery <"
+    char* title[] = { "Android system recovery <"
                           EXPAND(RECOVERY_API_VERSION) ">",
-                        "",
-                        "Use trackball to highlight;",
-                        "click to select.",
-                        "",
-                        NULL };
-
-    // these constants correspond to elements of the items[] list.
-#define ITEM_REBOOT        0
-#define ITEM_APPLY_SDCARD  1
-#define ITEM_WIPE_DATA     2
-#define ITEM_WIPE_CACHE    3
-    char* items[] = { "reboot system now [Home+Back]",
-                      "apply sdcard:update.zip [Alt+S]",
-                      "wipe data/factory reset [Alt+W]",
-                      "wipe cache partition",
+                      "",
                       NULL };
 
-    ui_start_menu(headers, items);
+    // count the number of lines in our title, plus the
+    // product-provided headers.
+    int count = 0;
+    char** p;
+    for (p = title; *p; ++p, ++count);
+    for (p = MENU_HEADERS; *p; ++p, ++count);
+
+    char** headers = malloc((count+1) * sizeof(char*));
+    char** h = headers;
+    for (p = title; *p; ++p, ++h) *h = *p;
+    for (p = MENU_HEADERS; *p; ++p, ++h) *h = *p;
+    *h = NULL;
+
+    ui_start_menu(headers, MENU_ITEMS);
     int selected = 0;
     int chosen_item = -1;
 
@@ -314,29 +314,28 @@
     ui_reset_progress();
     for (;;) {
         int key = ui_wait_key();
-        int alt = ui_key_pressed(KEY_LEFTALT) || ui_key_pressed(KEY_RIGHTALT);
         int visible = ui_text_visible();
 
-        if (key == KEY_DREAM_BACK && ui_key_pressed(KEY_DREAM_HOME)) {
-            // Wait for the keys to be released, to avoid triggering
-            // special boot modes (like coming back into recovery!).
-            while (ui_key_pressed(KEY_DREAM_BACK) ||
-                   ui_key_pressed(KEY_DREAM_HOME)) {
-                usleep(1000);
+        int action = device_handle_key(key, visible);
+
+        if (action < 0) {
+            switch (action) {
+                case HIGHLIGHT_UP:
+                    --selected;
+                    selected = ui_menu_select(selected);
+                    break;
+                case HIGHLIGHT_DOWN:
+                    ++selected;
+                    selected = ui_menu_select(selected);
+                    break;
+                case SELECT_ITEM:
+                    chosen_item = selected;
+                    break;
+                case NO_ACTION:
+                    break;
             }
-            chosen_item = ITEM_REBOOT;
-        } else if (alt && key == KEY_W) {
-            chosen_item = ITEM_WIPE_DATA;
-        } else if (alt && key == KEY_S) {
-            chosen_item = ITEM_APPLY_SDCARD;
-        } else if ((key == KEY_DOWN || key == KEY_VOLUMEDOWN) && visible) {
-            ++selected;
-            selected = ui_menu_select(selected);
-        } else if ((key == KEY_UP || key == KEY_VOLUMEUP) && visible) {
-            --selected;
-            selected = ui_menu_select(selected);
-        } else if (key == BTN_MOUSE && visible) {
-            chosen_item = selected;
+        } else {
+            chosen_item = action;
         }
 
         if (chosen_item >= 0) {
@@ -344,12 +343,18 @@
             // on the screen.
             ui_end_menu();
 
+            // device-specific code may take some action here.  It may
+            // return one of the core actions handled in the switch
+            // statement below.
+            chosen_item = device_perform_action(chosen_item);
+
             switch (chosen_item) {
                 case ITEM_REBOOT:
                     return;
 
                 case ITEM_WIPE_DATA:
                     ui_print("\n-- Wiping data...\n");
+                    device_wipe_data();
                     erase_root("DATA:");
                     erase_root("CACHE:");
                     ui_print("Data wipe complete.\n");
@@ -373,8 +378,8 @@
                         return;  // reboot if logs aren't visible
                     } else {
                       if (firmware_update_pending()) {
-                        ui_print("\nReboot via home+back or menu\n"
-                                 "to complete installation.\n");
+                        ui_print("\nReboot via menu to complete\n"
+                                 "installation.\n");
                       } else {
                         ui_print("\nInstall from sdcard complete.\n");
                       }
@@ -384,7 +389,7 @@
 
             // if we didn't return from this function to reboot, show
             // the menu again.
-            ui_start_menu(headers, items);
+            ui_start_menu(headers, MENU_ITEMS);
             selected = 0;
             chosen_item = -1;
 
@@ -459,10 +464,14 @@
     if (update_package != NULL) {
         status = install_package(update_package);
         if (status != INSTALL_SUCCESS) ui_print("Installation aborted.\n");
-    } else if (wipe_data || wipe_cache) {
-        if (wipe_data && erase_root("DATA:")) status = INSTALL_ERROR;
+    } else if (wipe_data) {
+        if (device_wipe_data()) status = INSTALL_ERROR;
+        if (erase_root("DATA:")) status = INSTALL_ERROR;
         if (wipe_cache && erase_root("CACHE:")) status = INSTALL_ERROR;
         if (status != INSTALL_SUCCESS) ui_print("Data wipe failed.\n");
+    } else if (wipe_cache) {
+        if (wipe_cache && erase_root("CACHE:")) status = INSTALL_ERROR;
+        if (status != INSTALL_SUCCESS) ui_print("Cache wipe failed.\n");
     } else {
         status = INSTALL_ERROR;  // No command specified
     }
diff --git a/recovery_ui.h b/recovery_ui.h
new file mode 100644
index 0000000..671fe40
--- /dev/null
+++ b/recovery_ui.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef _RECOVERY_UI_H
+#define _RECOVERY_UI_H
+
+// Called in the input thread when a new key (key_code) is pressed.
+// *key_pressed is an array of KEY_MAX+1 bytes indicating which other
+// keys are already pressed.  Return true if the text display should
+// be toggled.
+extern int device_toggle_display(char* key_pressed, int key_code);
+
+// Called in the input thread when a new key (key_code) is pressed.
+// *key_pressed is an array of KEY_MAX+1 bytes indicating which other
+// keys are already pressed.  Return true if the device should reboot
+// immediately.
+extern int device_reboot_now(char* key_pressed, int key_code);
+
+// Called from the main thread when recovery is waiting for input and
+// a key is pressed.  key is the code of the key pressed; visible is
+// true if the recovery menu is being shown.  Implementations can call
+// ui_key_pressed() to discover if other keys are being held down.
+// Return one of the defined constants below in order to:
+//
+//   - move the menu highlight (HIGHLIGHT_*)
+//   - invoke the highlighted item (SELECT_ITEM)
+//   - do nothing (NO_ACTION)
+//   - invoke a specific action (a menu position: any non-negative number)
+extern int device_handle_key(int key, int visible);
+
+// Perform a recovery action selected from the menu.  'which' will be
+// the item number of the selected menu item, or a non-negative number
+// returned from device_handle_key().  The menu will be hidden when
+// this is called; implementations can call ui_print() to print
+// information to the screen.
+extern int device_perform_action(int which);
+
+// Called when we do a wipe data/factory reset operation (either via a
+// reboot from the main system with the --wipe_data flag, or when the
+// user boots into recovery manually and selects the option from the
+// menu.)  Can perform whatever device-specific wiping actions are
+// needed.  Return 0 on success.  The userdata and cache partitions
+// are erased after this returns (whether it returns success or not).
+int device_wipe_data();
+
+#define NO_ACTION           -1
+
+#define HIGHLIGHT_UP        -2
+#define HIGHLIGHT_DOWN      -3
+#define SELECT_ITEM         -4
+
+#define ITEM_REBOOT          0
+#define ITEM_APPLY_SDCARD    1
+#define ITEM_WIPE_DATA       2
+#define ITEM_WIPE_CACHE      3
+
+// Header text to display above the main menu.
+extern char* MENU_HEADERS[];
+
+// Text of menu items.
+extern char* MENU_ITEMS[];
+
+#endif
diff --git a/roots.c b/roots.c
index 6a6cf8a..8f8dace 100644
--- a/roots.c
+++ b/roots.c
@@ -52,6 +52,7 @@
     { "RECOVERY:", g_mtd_device, NULL, "recovery", "/", g_raw },
     { "SDCARD:", "/dev/block/mmcblk0p1", "/dev/block/mmcblk0", NULL, "/sdcard", "vfat" },
     { "SYSTEM:", g_mtd_device, NULL, "system", "/system", "yaffs2" },
+    { "MBM:", g_mtd_device, NULL, "mbm", NULL, g_raw },
     { "TMP:", NULL, NULL, NULL, "/tmp", NULL },
 };
 #define NUM_ROOTS (sizeof(g_roots) / sizeof(g_roots[0]))
diff --git a/ui.c b/ui.c
index b84f172..039d682 100644
--- a/ui.c
+++ b/ui.c
@@ -307,20 +307,14 @@
         }
         pthread_mutex_unlock(&key_queue_mutex);
 
-        // Alt+L or Home+End: toggle log display
-        int alt = key_pressed[KEY_LEFTALT] || key_pressed[KEY_RIGHTALT];
-        if ((alt && ev.code == KEY_L && ev.value > 0) ||
-            (key_pressed[KEY_HOME] && ev.code == KEY_END && ev.value > 0)) {
+        if (ev.value > 0 && device_toggle_display(key_pressed, ev.code)) {
             pthread_mutex_lock(&gUpdateMutex);
             show_text = !show_text;
             update_screen_locked();
             pthread_mutex_unlock(&gUpdateMutex);
         }
 
-        // Green+Menu+Red: reboot immediately
-        if (ev.code == KEY_DREAM_RED &&
-            key_pressed[KEY_DREAM_MENU] &&
-            key_pressed[KEY_DREAM_GREEN]) {
+        if (ev.value > 0 && device_reboot_now(key_pressed, ev.code)) {
             reboot(RB_AUTOBOOT);
         }
     }
diff --git a/updater/Android.mk b/updater/Android.mk
index 897b9d7..d4a4e33 100644
--- a/updater/Android.mk
+++ b/updater/Android.mk
@@ -18,11 +18,47 @@
 
 LOCAL_SRC_FILES := $(updater_src_files)
 
-LOCAL_STATIC_LIBRARIES := libapplypatch libedify libmtdutils libminzip libz
+LOCAL_STATIC_LIBRARIES := $(TARGET_RECOVERY_UPDATER_LIBS) $(TARGET_RECOVERY_UPDATER_EXTRA_LIBS)
+LOCAL_STATIC_LIBRARIES += libapplypatch libedify libmtdutils libminzip libz
 LOCAL_STATIC_LIBRARIES += libmincrypt libbz
 LOCAL_STATIC_LIBRARIES += libcutils libstdc++ libc
 LOCAL_C_INCLUDES += $(LOCAL_PATH)/..
 
+# Each library in TARGET_RECOVERY_UPDATER_LIBS should have a function
+# named "Register_<libname>()".  Here we emit a little C function that
+# gets #included by updater.c.  It calls all those registration
+# functions.
+
+# Devices can also add libraries to TARGET_RECOVERY_UPDATER_EXTRA_LIBS.
+# These libs are also linked in with updater, but we don't try to call
+# any sort of registration function for these.  Use this variable for
+# any subsidiary static libraries required for your registered
+# extension libs.
+
+inc := $(call intermediates-dir-for,PACKAGING,updater_extensions)/register.inc
+
+# During the first pass of reading the makefiles, we dump the list of
+# extension libs to a temp file, then copy that to the ".list" file if
+# it is different than the existing .list (if any).  The register.inc
+# file then uses the .list as a prerequisite, so it is only rebuilt
+# (and updater.o recompiled) when the list of extension libs changes.
+
+junk := $(shell mkdir -p $(dir $(inc));\
+	        echo $(TARGET_RECOVERY_UPDATER_LIBS) > $(inc).temp;\
+	        diff -q $(inc).temp $(inc).list || cp -f $(inc).temp $(inc).list)
+
+$(inc) : libs := $(TARGET_RECOVERY_UPDATER_LIBS)
+$(inc) : $(inc).list
+	$(hide) mkdir -p $(dir $@)
+	$(hide) echo "" > $@
+	$(hide) $(foreach lib,$(libs),echo "extern void Register_$(lib)(void);" >> $@)
+	$(hide) echo "void RegisterDeviceExtensions() {" >> $@
+	$(hide) $(foreach lib,$(libs),echo "  Register_$(lib)();" >> $@)
+	$(hide) echo "}" >> $@
+
+$(call intermediates-dir-for,EXECUTABLES,updater)/updater.o : $(inc)
+LOCAL_C_INCLUDES += $(dir $(inc))
+
 LOCAL_MODULE := updater
 
 LOCAL_FORCE_STATIC_EXECUTABLE := true
diff --git a/updater/updater.c b/updater/updater.c
index 31d93ae..1aa277c 100644
--- a/updater/updater.c
+++ b/updater/updater.c
@@ -23,6 +23,11 @@
 #include "install.h"
 #include "minzip/Zip.h"
 
+// Generated by the makefile, this function defines the
+// RegisterDeviceExtensions() function, which calls all the
+// registration functions for device-specific extensions.
+#include "register.inc"
+
 // Where in the package we expect to find the edify script to execute.
 // (Note it's "updateR-script", not the older "update-script".)
 #define SCRIPT_NAME "META-INF/com/google/android/updater-script"
@@ -76,6 +81,7 @@
 
     RegisterBuiltins();
     RegisterInstallFunctions();
+    RegisterDeviceExtensions();
     FinishRegistration();
 
     // Parse the script.