diff --git a/include/hardware/keymaster.h b/include/hardware/keymaster.h
index 3c7799a..d4cf124 100644
--- a/include/hardware/keymaster.h
+++ b/include/hardware/keymaster.h
@@ -39,6 +39,20 @@
  */
 #define KEYMASTER_API_VERSION 1
 
+/**
+ * Flags for keymaster_device::flags
+ */
+enum {
+    /*
+     * Indicates this keymaster implementation does not have hardware that
+     * keeps private keys out of user space.
+     *
+     * This should not be implemented on anything other than the default
+     * implementation.
+     */
+    KEYMASTER_SOFTWARE_ONLY = 0x00000001,
+};
+
 struct keystore_module {
     hw_module_t common;
 };
@@ -85,6 +99,11 @@
 
     uint32_t client_version;
 
+    /**
+     * See flags defined for keymaster_device::flags above.
+     */
+    uint32_t flags;
+
     void* context;
 
     /**