diff --git a/debuggerd/libdebuggerd/utility.cpp b/debuggerd/libdebuggerd/utility.cpp
index 22fde5e..7f450e6 100644
--- a/debuggerd/libdebuggerd/utility.cpp
+++ b/debuggerd/libdebuggerd/utility.cpp
@@ -22,16 +22,22 @@
 #include <signal.h>
 #include <string.h>
 #include <sys/ptrace.h>
+#include <sys/uio.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
 #include <string>
 
+#include <android-base/logging.h>
+#include <android-base/properties.h>
 #include <android-base/stringprintf.h>
+#include <android-base/strings.h>
 #include <android-base/unique_fd.h>
 #include <backtrace/Backtrace.h>
 #include <log/log.h>
 
+using android::base::unique_fd;
+
 // Whitelist output desired in the logcat output.
 bool is_allowed_in_logcat(enum logtype ltype) {
   if ((ltype == HEADER)
@@ -42,6 +48,19 @@
   return false;
 }
 
+static bool should_write_to_kmsg() {
+  // Write to kmsg if tombstoned isn't up, and we're able to do so.
+  if (!android::base::GetBoolProperty("ro.debuggable", false)) {
+    return false;
+  }
+
+  if (android::base::GetProperty("init.svc.tombstoned", "") == "running") {
+    return false;
+  }
+
+  return true;
+}
+
 __attribute__((__weak__, visibility("default")))
 void _LOG(log_t* log, enum logtype ltype, const char* fmt, ...) {
   bool write_to_tombstone = (log->tfd != -1);
@@ -49,6 +68,7 @@
                       && log->crashed_tid != -1
                       && log->current_tid != -1
                       && (log->crashed_tid == log->current_tid);
+  static bool write_to_kmsg = should_write_to_kmsg();
 
   char buf[512];
   va_list ap;
@@ -70,6 +90,30 @@
     if (log->amfd_data != nullptr) {
       *log->amfd_data += buf;
     }
+
+    if (write_to_kmsg) {
+      unique_fd kmsg_fd(open("/dev/kmsg_debug", O_WRONLY | O_APPEND | O_CLOEXEC));
+      if (kmsg_fd.get() >= 0) {
+        // Our output might contain newlines which would otherwise be handled by the android logger.
+        // Split the lines up ourselves before sending to the kernel logger.
+        if (buf[len - 1] == '\n') {
+          buf[len - 1] = '\0';
+        }
+
+        std::vector<std::string> fragments = android::base::Split(buf, "\n");
+        for (const std::string& fragment : fragments) {
+          static constexpr char prefix[] = "<3>DEBUG: ";
+          struct iovec iov[3];
+          iov[0].iov_base = const_cast<char*>(prefix);
+          iov[0].iov_len = strlen(prefix);
+          iov[1].iov_base = const_cast<char*>(fragment.c_str());
+          iov[1].iov_len = fragment.length();
+          iov[2].iov_base = const_cast<char*>("\n");
+          iov[2].iov_len = 1;
+          TEMP_FAILURE_RETRY(writev(kmsg_fd.get(), iov, 3));
+        }
+      }
+    }
   }
 }
 
@@ -205,7 +249,7 @@
 }
 
 void read_with_default(const char* path, char* buf, size_t len, const char* default_value) {
-  android::base::unique_fd fd(open(path, O_RDONLY));
+  unique_fd fd(open(path, O_RDONLY | O_CLOEXEC));
   if (fd != -1) {
     int rc = TEMP_FAILURE_RETRY(read(fd.get(), buf, len - 1));
     if (rc != -1) {
diff --git a/init/Android.mk b/init/Android.mk
index 730ffc4..dbbf40a 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -8,12 +8,16 @@
 init_options += \
     -DALLOW_LOCAL_PROP_OVERRIDE=1 \
     -DALLOW_PERMISSIVE_SELINUX=1 \
-    -DREBOOT_BOOTLOADER_ON_PANIC=1
+    -DREBOOT_BOOTLOADER_ON_PANIC=1 \
+    -DWORLD_WRITABLE_KMSG=1 \
+    -DDUMP_ON_UMOUNT_FAILURE=1
 else
 init_options += \
     -DALLOW_LOCAL_PROP_OVERRIDE=0 \
     -DALLOW_PERMISSIVE_SELINUX=0 \
-    -DREBOOT_BOOTLOADER_ON_PANIC=0
+    -DREBOOT_BOOTLOADER_ON_PANIC=0 \
+    -DWORLD_WRITABLE_KMSG=0 \
+    -DDUMP_ON_UMOUNT_FAILURE=0
 endif
 
 ifneq (,$(filter eng,$(TARGET_BUILD_VARIANT)))
diff --git a/init/init.cpp b/init/init.cpp
index 023d727..543f38e 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -890,6 +890,9 @@
     LOG(INFO) << "Running restorecon...";
     restorecon("/dev");
     restorecon("/dev/kmsg");
+    if constexpr (WORLD_WRITABLE_KMSG) {
+      restorecon("/dev/kmsg_debug");
+    }
     restorecon("/dev/socket");
     restorecon("/dev/random");
     restorecon("/dev/urandom");
@@ -1166,7 +1169,13 @@
         setgroups(arraysize(groups), groups);
         mount("sysfs", "/sys", "sysfs", 0, NULL);
         mount("selinuxfs", "/sys/fs/selinux", "selinuxfs", 0, NULL);
+
         mknod("/dev/kmsg", S_IFCHR | 0600, makedev(1, 11));
+
+        if constexpr (WORLD_WRITABLE_KMSG) {
+          mknod("/dev/kmsg_debug", S_IFCHR | 0622, makedev(1, 11));
+        }
+
         mknod("/dev/random", S_IFCHR | 0666, makedev(1, 8));
         mknod("/dev/urandom", S_IFCHR | 0666, makedev(1, 9));
 
diff --git a/init/reboot.cpp b/init/reboot.cpp
index 53bdeb1..8de3c78 100644
--- a/init/reboot.cpp
+++ b/init/reboot.cpp
@@ -18,10 +18,12 @@
 
 #include <dirent.h>
 #include <fcntl.h>
+#include <linux/fs.h>
 #include <mntent.h>
+#include <selinux/selinux.h>
 #include <sys/cdefs.h>
+#include <sys/ioctl.h>
 #include <sys/mount.h>
-#include <sys/quota.h>
 #include <sys/reboot.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
@@ -39,6 +41,7 @@
 #include <android-base/properties.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <android-base/unique_fd.h>
 #include <bootloader_message/bootloader_message.h>
 #include <cutils/android_reboot.h>
 #include <fs_mgr.h>
@@ -67,39 +70,58 @@
 // Utility for struct mntent
 class MountEntry {
   public:
-    explicit MountEntry(const mntent& entry, bool isMounted = true)
+    explicit MountEntry(const mntent& entry)
         : mnt_fsname_(entry.mnt_fsname),
           mnt_dir_(entry.mnt_dir),
           mnt_type_(entry.mnt_type),
-          is_mounted_(isMounted) {}
+          mnt_opts_(entry.mnt_opts) {}
 
-    bool IsF2Fs() const { return mnt_type_ == "f2fs"; }
+    bool Umount() {
+        int r = umount2(mnt_dir_.c_str(), 0);
+        if (r == 0) {
+            LOG(INFO) << "umounted " << mnt_fsname_ << ":" << mnt_dir_ << " opts " << mnt_opts_;
+            return true;
+        } else {
+            PLOG(WARNING) << "cannot umount " << mnt_fsname_ << ":" << mnt_dir_ << " opts "
+                          << mnt_opts_;
+            return false;
+        }
+    }
 
-    bool IsExt4() const { return mnt_type_ == "ext4"; }
-
-    bool is_mounted() const { return is_mounted_; }
-
-    void set_is_mounted() { is_mounted_ = false; }
-
-    const std::string& mnt_fsname() const { return mnt_fsname_; }
-
-    const std::string& mnt_dir() const { return mnt_dir_; }
+    void DoFsck() {
+        int st;
+        if (IsF2Fs()) {
+            const char* f2fs_argv[] = {
+                "/system/bin/fsck.f2fs", "-f", mnt_fsname_.c_str(),
+            };
+            android_fork_execvp_ext(arraysize(f2fs_argv), (char**)f2fs_argv, &st, true, LOG_KLOG,
+                                    true, nullptr, nullptr, 0);
+        } else if (IsExt4()) {
+            const char* ext4_argv[] = {
+                "/system/bin/e2fsck", "-f", "-y", mnt_fsname_.c_str(),
+            };
+            android_fork_execvp_ext(arraysize(ext4_argv), (char**)ext4_argv, &st, true, LOG_KLOG,
+                                    true, nullptr, nullptr, 0);
+        }
+    }
 
     static bool IsBlockDevice(const struct mntent& mntent) {
         return android::base::StartsWith(mntent.mnt_fsname, "/dev/block");
     }
 
     static bool IsEmulatedDevice(const struct mntent& mntent) {
-        static const std::string SDCARDFS_NAME = "sdcardfs";
-        return android::base::StartsWith(mntent.mnt_fsname, "/data/") &&
-               SDCARDFS_NAME == mntent.mnt_type;
+        return android::base::StartsWith(mntent.mnt_fsname, "/data/");
     }
 
   private:
+    bool IsF2Fs() const { return mnt_type_ == "f2fs"; }
+
+    bool IsExt4() const { return mnt_type_ == "ext4"; }
+
     std::string mnt_fsname_;
     std::string mnt_dir_;
     std::string mnt_type_;
-    bool is_mounted_;
+    std::string mnt_opts_;
 };
 
 // Turn off backlight while we are performing power down cleanup activities.
@@ -125,50 +147,6 @@
     }
 }
 
-static void DoFsck(const MountEntry& entry) {
-    static constexpr int UNMOUNT_CHECK_TIMES = 10;
-
-    if (!entry.IsF2Fs() && !entry.IsExt4()) return;
-
-    int count = 0;
-    while (count++ < UNMOUNT_CHECK_TIMES) {
-        int fd = TEMP_FAILURE_RETRY(open(entry.mnt_fsname().c_str(), O_RDONLY | O_EXCL));
-        if (fd >= 0) {
-            /* |entry->mnt_dir| has sucessfully been unmounted. */
-            close(fd);
-            break;
-        } else if (errno == EBUSY) {
-            // Some processes using |entry->mnt_dir| are still alive. Wait for a
-            // while then retry.
-            std::this_thread::sleep_for(5000ms / UNMOUNT_CHECK_TIMES);
-            continue;
-        } else {
-            /* Cannot open the device. Give up. */
-            return;
-        }
-    }
-
-    // NB: With watchdog still running, there is no cap on the time it takes
-    // to complete the fsck, from the users perspective the device graphics
-    // and responses are locked-up and they may choose to hold the power
-    // button in frustration if it drags out.
-
-    int st;
-    if (entry.IsF2Fs()) {
-        const char* f2fs_argv[] = {
-            "/system/bin/fsck.f2fs", "-f", entry.mnt_fsname().c_str(),
-        };
-        android_fork_execvp_ext(arraysize(f2fs_argv), (char**)f2fs_argv, &st, true, LOG_KLOG, true,
-                                nullptr, nullptr, 0);
-    } else if (entry.IsExt4()) {
-        const char* ext4_argv[] = {
-            "/system/bin/e2fsck", "-f", "-y", entry.mnt_fsname().c_str(),
-        };
-        android_fork_execvp_ext(arraysize(ext4_argv), (char**)ext4_argv, &st, true, LOG_KLOG, true,
-                                nullptr, nullptr, 0);
-    }
-}
-
 static void ShutdownVold() {
     const char* vdc_argv[] = {"/system/bin/vdc", "volume", "shutdown"};
     int status;
@@ -202,21 +180,11 @@
     abort();
 }
 
-static void DoSync() {
-    // quota sync is not done by sync call, so should be done separately.
-    // quota sync is in VFS level, so do it before sync, which goes down to fs level.
-    int r = quotactl(QCMD(Q_SYNC, 0), nullptr, 0 /* do not care */, 0 /* do not care */);
-    if (r < 0) {
-        PLOG(ERROR) << "quotactl failed";
-    }
-    sync();
-}
-
 /* Find all read+write block devices and emulated devices in /proc/mounts
  * and add them to correpsponding list.
  */
 static bool FindPartitionsToUmount(std::vector<MountEntry>* blockDevPartitions,
-                                   std::vector<MountEntry>* emulatedPartitions) {
+                                   std::vector<MountEntry>* emulatedPartitions, bool dump) {
     std::unique_ptr<std::FILE, int (*)(std::FILE*)> fp(setmntent("/proc/mounts", "r"), endmntent);
     if (fp == nullptr) {
         PLOG(ERROR) << "Failed to open /proc/mounts";
@@ -224,44 +192,63 @@
     }
     mntent* mentry;
     while ((mentry = getmntent(fp.get())) != nullptr) {
-        if (MountEntry::IsBlockDevice(*mentry) && hasmntopt(mentry, "rw")) {
-            blockDevPartitions->emplace_back(*mentry);
+        if (dump) {
+            LOG(INFO) << "mount entry " << mentry->mnt_fsname << ":" << mentry->mnt_dir << " opts "
+                      << mentry->mnt_opts << " type " << mentry->mnt_type;
+        } else if (MountEntry::IsBlockDevice(*mentry) && hasmntopt(mentry, "rw")) {
+            blockDevPartitions->emplace(blockDevPartitions->begin(), *mentry);
         } else if (MountEntry::IsEmulatedDevice(*mentry)) {
-            emulatedPartitions->emplace_back(*mentry);
+            emulatedPartitions->emplace(emulatedPartitions->begin(), *mentry);
         }
     }
     return true;
 }
 
-static bool UmountPartitions(std::vector<MountEntry>* partitions, int maxRetry, int flags) {
-    static constexpr int SLEEP_AFTER_RETRY_US = 100000;
-
-    bool umountDone;
-    int retryCounter = 0;
-
-    while (true) {
-        umountDone = true;
-        for (auto& entry : *partitions) {
-            if (entry.is_mounted()) {
-                int r = umount2(entry.mnt_dir().c_str(), flags);
-                if (r == 0) {
-                    entry.set_is_mounted();
-                    LOG(INFO) << StringPrintf("umounted %s, flags:0x%x", entry.mnt_fsname().c_str(),
-                                              flags);
-                } else {
-                    umountDone = false;
-                    PLOG(WARNING) << StringPrintf("cannot umount %s, mnt_dir %s, flags:0x%x",
-                                                  entry.mnt_fsname().c_str(),
-                                                  entry.mnt_dir().c_str(), flags);
-                }
-            }
-        }
-        if (umountDone) break;
-        retryCounter++;
-        if (retryCounter >= maxRetry) break;
-        usleep(SLEEP_AFTER_RETRY_US);
+static void DumpUmountDebuggingInfo() {
+    int status;
+    if (!security_getenforce()) {
+        LOG(INFO) << "Run lsof";
+        const char* lsof_argv[] = {"/system/bin/lsof"};
+        android_fork_execvp_ext(arraysize(lsof_argv), (char**)lsof_argv, &status, true, LOG_KLOG,
+                                true, nullptr, nullptr, 0);
     }
-    return umountDone;
+    FindPartitionsToUmount(nullptr, nullptr, true);
+}
+
+static UmountStat UmountPartitions(int timeoutMs) {
+    Timer t;
+    UmountStat stat = UMOUNT_STAT_TIMEOUT;
+    int retry = 0;
+    /* data partition needs all pending writes to be completed and all emulated partitions
+     * umounted.If the current waiting is not good enough, give
+     * up and leave it to e2fsck after reboot to fix it.
+     */
+    while (true) {
+        std::vector<MountEntry> block_devices;
+        std::vector<MountEntry> emulated_devices;
+        if (!FindPartitionsToUmount(&block_devices, &emulated_devices, false)) {
+            return UMOUNT_STAT_ERROR;
+        }
+        if (block_devices.size() == 0) {
+            stat = UMOUNT_STAT_SUCCESS;
+            break;
+        }
+        if ((timeoutMs < t.duration_ms()) && retry > 0) {  // try umount at least once
+            stat = UMOUNT_STAT_TIMEOUT;
+            break;
+        }
+        if (emulated_devices.size() > 0 &&
+            std::all_of(emulated_devices.begin(), emulated_devices.end(),
+                        [](auto& entry) { return entry.Umount(); })) {
+            sync();
+        }
+        for (auto& entry : block_devices) {
+            entry.Umount();
+        }
+        retry++;
+        std::this_thread::sleep_for(100ms);
+    }
+    return stat;
 }
 
 static void KillAllProcesses() { android::base::WriteStringToFile("i", "/proc/sysrq-trigger"); }
@@ -277,56 +264,38 @@
  */
 static UmountStat TryUmountAndFsck(bool runFsck, int timeoutMs) {
     Timer t;
-    std::vector<MountEntry> emulatedPartitions;
-    std::vector<MountEntry> blockDevRwPartitions;
+    std::vector<MountEntry> block_devices;
+    std::vector<MountEntry> emulated_devices;
 
     TurnOffBacklight();  // this part can take time. save power.
 
-    if (!FindPartitionsToUmount(&blockDevRwPartitions, &emulatedPartitions)) {
+    if (runFsck && !FindPartitionsToUmount(&block_devices, &emulated_devices, false)) {
         return UMOUNT_STAT_ERROR;
     }
-    if (emulatedPartitions.size() > 0) {
-        LOG(WARNING) << "emulated partitions still exist, will umount";
-        /* Pending writes in emulated partitions can fail umount. After a few trials, detach
-         * it so that it can be umounted when all writes are done.
-         */
-        if (!UmountPartitions(&emulatedPartitions, 1, 0)) {
-            UmountPartitions(&emulatedPartitions, 1, MNT_DETACH);
-        }
-    }
-    DoSync();  // emulated partition change can lead to update
-    UmountStat stat = UMOUNT_STAT_SUCCESS;
-    /* data partition needs all pending writes to be completed and all emulated partitions
-     * umounted. If umount failed in the above step, it DETACH is requested, so umount can
-     * still happen while waiting for /data. If the current waiting is not good enough, give
-     * up and leave it to e2fsck after reboot to fix it.
-     */
-    int remainingTimeMs = timeoutMs - t.duration_ms();
-    // each retry takes 100ms, and run at least once.
-    int retry = std::max(remainingTimeMs / 100, 1);
-    if (!UmountPartitions(&blockDevRwPartitions, retry, 0)) {
-        /* Last resort, kill all and try again */
-        LOG(WARNING) << "umount still failing, trying kill all";
+
+    UmountStat stat = UmountPartitions(timeoutMs - t.duration_ms());
+    if (stat != UMOUNT_STAT_SUCCESS) {
+        LOG(INFO) << "umount timeout, last resort, kill all and try";
+        if (DUMP_ON_UMOUNT_FAILURE) DumpUmountDebuggingInfo();
         KillAllProcesses();
-        DoSync();
-        if (!UmountPartitions(&blockDevRwPartitions, 1, 0)) {
-            stat = UMOUNT_STAT_TIMEOUT;
-        }
-    }
-    // fsck part is excluded from timeout check. It only runs for user initiated shutdown
-    // and should not affect reboot time.
-    if (stat == UMOUNT_STAT_SUCCESS && runFsck) {
-        for (auto& entry : blockDevRwPartitions) {
-            DoFsck(entry);
-        }
+        // even if it succeeds, still it is timeout and do not run fsck with all processes killed
+        UmountPartitions(0);
+        if (DUMP_ON_UMOUNT_FAILURE) DumpUmountDebuggingInfo();
     }
 
+    if (stat == UMOUNT_STAT_SUCCESS && runFsck) {
+        // fsck part is excluded from timeout check. It only runs for user initiated shutdown
+        // and should not affect reboot time.
+        for (auto& entry : block_devices) {
+            entry.DoFsck();
+        }
+    }
     return stat;
 }
 
 static void __attribute__((noreturn)) DoThermalOff() {
     LOG(WARNING) << "Thermal system shutdown";
-    DoSync();
+    sync();
     RebootSystem(ANDROID_RB_THERMOFF, "");
     abort();
 }
@@ -426,8 +395,8 @@
 
     // minimum safety steps before restarting
     // 2. kill all services except ones that are necessary for the shutdown sequence.
-    ServiceManager::GetInstance().ForEachService([&kill_after_apps](Service* s) {
-        if (!s->IsShutdownCritical() || kill_after_apps.count(s->name())) s->Stop();
+    ServiceManager::GetInstance().ForEachService([](Service* s) {
+        if (!s->IsShutdownCritical()) s->Stop();
     });
     ServiceManager::GetInstance().ReapAnyOutstandingChildren();
 
@@ -435,12 +404,20 @@
     Service* voldService = ServiceManager::GetInstance().FindServiceByName("vold");
     if (voldService != nullptr && voldService->IsRunning()) {
         ShutdownVold();
+        voldService->Stop();
     } else {
         LOG(INFO) << "vold not running, skipping vold shutdown";
     }
+    // logcat stopped here
+    ServiceManager::GetInstance().ForEachService([&kill_after_apps](Service* s) {
+        if (kill_after_apps.count(s->name())) s->Stop();
+    });
     // 4. sync, try umount, and optionally run fsck for user shutdown
-    DoSync();
+    sync();
     UmountStat stat = TryUmountAndFsck(runFsck, shutdownTimeout * 1000 - t.duration_ms());
+    // Follow what linux shutdown is doing: one more sync with little bit delay
+    sync();
+    std::this_thread::sleep_for(100ms);
     LogShutdownTime(stat, &t);
     // Reboot regardless of umount status. If umount fails, fsck after reboot will fix it.
     RebootSystem(cmd, rebootTarget);
diff --git a/liblog/Android.bp b/liblog/Android.bp
index bc262db..e74aa82 100644
--- a/liblog/Android.bp
+++ b/liblog/Android.bp
@@ -108,14 +108,14 @@
 }
 
 ndk_library {
-    name: "liblog.ndk",
+    name: "liblog",
     symbol_file: "liblog.map.txt",
     first_version: "9",
     unversioned_until: "current",
 }
 
 llndk_library {
-    name: "liblog.llndk",
+    name: "liblog",
     symbol_file: "liblog.map.txt",
     unversioned: true,
     export_include_dirs: ["include_vndk"],
diff --git a/libziparchive/zip_archive.cc b/libziparchive/zip_archive.cc
index 0ac6f2c..246575f 100644
--- a/libziparchive/zip_archive.cc
+++ b/libziparchive/zip_archive.cc
@@ -563,6 +563,17 @@
 
   // Paranoia: Match the values specified in the local file header
   // to those specified in the central directory.
+
+  // Verify that the central directory and local file header agree on the use of a trailing
+  // Data Descriptor.
+  if ((lfh->gpb_flags & kGPBDDFlagMask) != (cdr->gpb_flags & kGPBDDFlagMask)) {
+    ALOGW("Zip: gpb flag mismatch. expected {%04" PRIx16 "}, was {%04" PRIx16 "}",
+          cdr->gpb_flags, lfh->gpb_flags);
+    return kInconsistentInformation;
+  }
+
+  // If there is no trailing data descriptor, verify that the central directory and local file
+  // header agree on the crc, compressed, and uncompressed sizes of the entry.
   if ((lfh->gpb_flags & kGPBDDFlagMask) == 0) {
     data->has_data_descriptor = 0;
     if (data->compressed_length != lfh->compressed_size
diff --git a/libziparchive/zip_writer.cc b/libziparchive/zip_writer.cc
index 2edf224..6d28bdb 100644
--- a/libziparchive/zip_writer.cc
+++ b/libziparchive/zip_writer.cc
@@ -479,7 +479,9 @@
   for (FileEntry& file : files_) {
     CentralDirectoryRecord cdr = {};
     cdr.record_signature = CentralDirectoryRecord::kSignature;
-    cdr.gpb_flags |= kGPBDDFlagMask;
+    if ((file.compression_method & kCompressDeflated) || !seekable_) {
+      cdr.gpb_flags |= kGPBDDFlagMask;
+    }
     cdr.compression_method = file.compression_method;
     cdr.last_mod_time = file.last_mod_time;
     cdr.last_mod_date = file.last_mod_date;
diff --git a/rootdir/init.rc b/rootdir/init.rc
index ff96c14..3758362 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -301,9 +301,6 @@
     start logd
     start hwservicemanager
 
-    # HALs required before data is mounted
-    class_start early_hal
-
     # once everything is setup, no need to modify /
     mount rootfs rootfs / ro remount
     # Mount shared so changes propagate into child namespaces
@@ -351,6 +348,10 @@
     # create the lost+found directories, so as to enforce our permissions
     mkdir /cache/lost+found 0770 root root
 
+on late-fs
+    # HALs required before storage encryption can get unlocked (FBE/FDE)
+    class_start early_hal
+
 on post-fs-data
     # We chown/chmod /data again so because mount is run as root + defaults
     chown system system /data
diff --git a/toolbox/Android.mk b/toolbox/Android.mk
index d6ead1a..aa755ed 100644
--- a/toolbox/Android.mk
+++ b/toolbox/Android.mk
@@ -95,3 +95,13 @@
 LOCAL_MODULE := grep
 LOCAL_POST_INSTALL_CMD := $(hide) $(foreach t,egrep fgrep,ln -sf grep $(TARGET_OUT)/bin/$(t);)
 include $(BUILD_EXECUTABLE)
+
+
+# We build gzip separately, so it can provide gunzip and zcat too.
+include $(CLEAR_VARS)
+LOCAL_MODULE := gzip
+LOCAL_SRC_FILES := gzip.c
+LOCAL_CFLAGS += -Wall -Werror
+LOCAL_SHARED_LIBRARIES += libz
+LOCAL_POST_INSTALL_CMD := $(hide) $(foreach t,gunzip zcat,ln -sf gzip $(TARGET_OUT)/bin/$(t);)
+include $(BUILD_EXECUTABLE)
diff --git a/toolbox/gzip.c b/toolbox/gzip.c
new file mode 100644
index 0000000..62c4518
--- /dev/null
+++ b/toolbox/gzip.c
@@ -0,0 +1,261 @@
+/* gzip.c - gzip/gunzip/zcat tools for gzip data
+ *
+ * Copyright 2017 The Android Open Source Project
+ *
+ * GZIP RFC: http://www.ietf.org/rfc/rfc1952.txt
+
+TODO: port to toybox.
+
+*/
+
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <error.h>
+#include <fcntl.h>
+#include <getopt.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+
+#include <zlib.h>
+
+// toybox-style flags/globals.
+#define FLAG_c 1
+#define FLAG_d 2
+#define FLAG_f 4
+#define FLAG_k 8
+static struct {
+  int optflags;
+} toys;
+static struct {
+  int level;
+} TT;
+
+static void xstat(const char *path, struct stat *sb)
+{
+  if (stat(path, sb)) error(1, errno, "stat %s", path);
+}
+
+static void fix_time(const char *path, struct stat *sb)
+{
+  struct timespec times[] = { sb->st_atim, sb->st_mtim };
+
+  if (utimensat(AT_FDCWD, path, times, 0)) error(1, errno, "utimes");
+}
+
+static FILE *xfdopen(const char *name, int flags, mode_t open_mode,
+    const char *mode)
+{
+  FILE *fp;
+  int fd;
+
+  if (!strcmp(name, "-")) fd = dup((*mode == 'r') ? 0 : 1);
+  else fd = open(name, flags, open_mode);
+
+  if (fd == -1) error(1, errno, "open %s (%s)", name, mode);
+  fp = fdopen(fd, mode);
+  if (fp == NULL) error(1, errno, "fopen %s (%s)", name, mode);
+  return fp;
+}
+
+static gzFile xgzopen(const char *name, int flags, mode_t open_mode,
+    const char *mode)
+{
+  gzFile f;
+  int fd;
+
+  if (!strcmp(name, "-")) fd = dup((*mode == 'r') ? 0 : 1);
+  else fd = open(name, flags, open_mode);
+
+  if (fd == -1) error(1, errno, "open %s (%s)", name, mode);
+  f = gzdopen(fd, mode);
+  if (f == NULL) error(1, errno, "gzdopen %s (%s)", name, mode);
+  return f;
+}
+
+static void gzfatal(gzFile f, char *what)
+{
+  int err;
+  const char *msg = gzerror(f, &err);
+
+  error(1, (err == Z_ERRNO) ? errno : 0, "%s: %s", what, msg);
+}
+
+static void gunzip(char *arg)
+{
+  struct stat sb;
+  char buf[BUFSIZ];
+  int len, both_files;
+  char *in_name, *out_name;
+  gzFile in;
+  FILE *out;
+
+  // "gunzip x.gz" will decompress "x.gz" to "x".
+  len = strlen(arg);
+  if (len > 3 && !strcmp(arg+len-3, ".gz")) {
+    in_name = strdup(arg);
+    out_name = strdup(arg);
+    out_name[len-3] = '\0';
+  } else if (!strcmp(arg, "-")) {
+    // "-" means stdin; assume output to stdout.
+    // TODO: require -f to read compressed data from tty?
+    in_name = strdup("-");
+    out_name = strdup("-");
+  } else error(1, 0, "unknown suffix");
+
+  if (toys.optflags&FLAG_c) {
+    free(out_name);
+    out_name = strdup("-");
+  }
+
+  both_files = strcmp(in_name, "-") && strcmp(out_name, "-");
+  if (both_files) xstat(in_name, &sb);
+
+  in = xgzopen(in_name, O_RDONLY, 0, "r");
+  out = xfdopen(out_name, O_CREAT|O_WRONLY|((toys.optflags&FLAG_f)?0:O_EXCL),
+      both_files?sb.st_mode:0666, "w");
+
+  while ((len = gzread(in, buf, sizeof(buf))) > 0) {
+    if (fwrite(buf, 1, len, out) != (size_t) len) error(1, errno, "fwrite");
+  }
+  if (len < 0) gzfatal(in, "gzread");
+  if (fclose(out)) error(1, errno, "fclose");
+  if (gzclose(in) != Z_OK) error(1, 0, "gzclose");
+
+  if (both_files) fix_time(out_name, &sb);
+  if (!(toys.optflags&(FLAG_c|FLAG_k))) unlink(in_name);
+  free(in_name);
+  free(out_name);
+}
+
+static void gzip(char *in_name)
+{
+  char buf[BUFSIZ];
+  size_t len;
+  char *out_name;
+  FILE *in;
+  gzFile out;
+  struct stat sb;
+  int both_files;
+
+  if (toys.optflags&FLAG_c) {
+    out_name = strdup("-");
+  } else {
+    if (asprintf(&out_name, "%s.gz", in_name) == -1) {
+      error(1, errno, "asprintf");
+    }
+  }
+
+  both_files = strcmp(in_name, "-") && strcmp(out_name, "-");
+  if (both_files) xstat(in_name, &sb);
+
+  snprintf(buf, sizeof(buf), "w%d", TT.level);
+  in = xfdopen(in_name, O_RDONLY, 0, "r");
+  out = xgzopen(out_name, O_CREAT|O_WRONLY|((toys.optflags&FLAG_f)?0:O_EXCL),
+      both_files?sb.st_mode:0, buf);
+
+  while ((len = fread(buf, 1, sizeof(buf), in)) > 0) {
+    if (gzwrite(out, buf, len) != (int) len) gzfatal(out, "gzwrite");
+  }
+  if (ferror(in)) error(1, errno, "fread");
+  if (fclose(in)) error(1, errno, "fclose");
+  if (gzclose(out) != Z_OK) error(1, 0, "gzclose");
+
+  if (both_files) fix_time(out_name, &sb);
+  if (!(toys.optflags&(FLAG_c|FLAG_k))) unlink(in_name);
+  free(out_name);
+}
+
+static void do_file(char *arg)
+{
+  if (toys.optflags&FLAG_d) gunzip(arg);
+  else gzip(arg);
+}
+
+static void usage()
+{
+  char *cmd = basename(getprogname());
+
+  printf("usage: %s [-c] [-d] [-f] [-#] [FILE...]\n", cmd);
+  printf("\n");
+  if (!strcmp(cmd, "zcat")) {
+    printf("Decompress files to stdout. Like `gzip -dc`.\n");
+    printf("\n");
+    printf("-c\tOutput to stdout\n");
+    printf("-f\tForce: allow read from tty\n");
+  } else if (!strcmp(cmd, "gunzip")) {
+    printf("Decompress files. With no files, decompresses stdin to stdout.\n");
+    printf("On success, the input files are removed and replaced by new\n");
+    printf("files without the .gz suffix.\n");
+    printf("\n");
+    printf("-c\tOutput to stdout\n");
+    printf("-f\tForce: allow read from tty\n");
+    printf("-k\tKeep input files (don't remove)\n");
+  } else { // gzip
+    printf("Compress files. With no files, compresses stdin to stdout.\n");
+    printf("On success, the input files are removed and replaced by new\n");
+    printf("files with the .gz suffix.\n");
+    printf("\n");
+    printf("-c\tOutput to stdout\n");
+    printf("-d\tDecompress (act as gunzip)\n");
+    printf("-f\tForce: allow overwrite of output file\n");
+    printf("-k\tKeep input files (don't remove)\n");
+    printf("-#\tCompression level 1-9 (1:fastest, 6:default, 9:best)\n");
+  }
+  printf("\n");
+}
+
+int main(int argc, char *argv[])
+{
+  char *cmd = basename(argv[0]);
+  int opt_ch;
+
+  toys.optflags = 0;
+  TT.level = 6;
+
+  if (!strcmp(cmd, "gunzip")) {
+    // gunzip == gzip -d
+    toys.optflags = FLAG_d;
+  } else if (!strcmp(cmd, "zcat")) {
+    // zcat == gzip -dc
+    toys.optflags = (FLAG_c|FLAG_d);
+  }
+
+  while ((opt_ch = getopt(argc, argv, "cdfhk123456789")) != -1) {
+    switch (opt_ch) {
+    case 'c': toys.optflags |= FLAG_c; break;
+    case 'd': toys.optflags |= FLAG_d; break;
+    case 'f': toys.optflags |= FLAG_f; break;
+    case 'k': toys.optflags |= FLAG_k; break;
+
+    case '1':
+    case '2':
+    case '3':
+    case '4':
+    case '5':
+    case '6':
+    case '7':
+    case '8':
+    case '9':
+      TT.level = opt_ch - '0';
+      break;
+
+    default:
+      usage();
+      return 1;
+    }
+  }
+
+  if (optind == argc) {
+    // With no arguments, we go from stdin to stdout.
+    toys.optflags |= FLAG_c;
+    do_file("-");
+    return 0;
+  }
+
+  // Otherwise process each file in turn.
+  while (optind < argc) do_file(argv[optind++]);
+  return 0;
+}
diff --git a/trusty/keymaster/Android.mk b/trusty/keymaster/Android.mk
index 0ebf52d..2d614ae 100644
--- a/trusty/keymaster/Android.mk
+++ b/trusty/keymaster/Android.mk
@@ -32,7 +32,7 @@
 LOCAL_MODULE := trusty_keymaster_tipc
 LOCAL_SRC_FILES := \
 	trusty_keymaster_device.cpp \
-	trusty_keymaster_ipc.c \
+	trusty_keymaster_ipc.cpp \
 	trusty_keymaster_main.cpp
 LOCAL_SHARED_LIBRARIES := \
 	libcrypto \
@@ -40,6 +40,7 @@
 	libkeymaster1 \
 	libtrusty \
 	libkeymaster_messages \
+	libsoftkeymasterdevice \
 	liblog
 
 include $(BUILD_EXECUTABLE)
@@ -53,7 +54,7 @@
 LOCAL_MODULE := keystore.trusty
 LOCAL_MODULE_RELATIVE_PATH := hw
 LOCAL_SRC_FILES := module.cpp \
-	trusty_keymaster_ipc.c \
+	trusty_keymaster_ipc.cpp \
 	trusty_keymaster_device.cpp
 LOCAL_CLFAGS = -fvisibility=hidden -Wall -Werror
 LOCAL_SHARED_LIBRARIES := \
diff --git a/trusty/keymaster/keymaster_ipc.h b/trusty/keymaster/keymaster_ipc.h
index 48fa53d..b38eb05 100644
--- a/trusty/keymaster/keymaster_ipc.h
+++ b/trusty/keymaster/keymaster_ipc.h
@@ -16,13 +16,15 @@
 
 #pragma once
 
+// clang-format off
+
 #define KEYMASTER_PORT "com.android.trusty.keymaster"
 #define KEYMASTER_MAX_BUFFER_LENGTH 4096
 
 // Commands
-enum keymaster_command {
-	KEYMASTER_RESP_BIT              = 1,
-	KEYMASTER_REQ_SHIFT             = 1,
+enum keymaster_command : uint32_t {
+    KEYMASTER_RESP_BIT              = 1,
+    KEYMASTER_REQ_SHIFT             = 1,
 
     KM_GENERATE_KEY                 = (0 << KEYMASTER_REQ_SHIFT),
     KM_BEGIN_OPERATION              = (1 << KEYMASTER_REQ_SHIFT),
@@ -40,6 +42,9 @@
     KM_GET_SUPPORTED_IMPORT_FORMATS = (13 << KEYMASTER_REQ_SHIFT),
     KM_GET_SUPPORTED_EXPORT_FORMATS = (14 << KEYMASTER_REQ_SHIFT),
     KM_GET_KEY_CHARACTERISTICS      = (15 << KEYMASTER_REQ_SHIFT),
+    KM_ATTEST_KEY                   = (16 << KEYMASTER_REQ_SHIFT),
+    KM_UPGRADE_KEY                  = (17 << KEYMASTER_REQ_SHIFT),
+    KM_CONFIGURE                    = (18 << KEYMASTER_REQ_SHIFT),
 };
 
 #ifdef __ANDROID__
@@ -50,8 +55,8 @@
  * @payload: start of the serialized command specific payload
  */
 struct keymaster_message {
-	uint32_t cmd;
-	uint8_t payload[0];
+    uint32_t cmd;
+    uint8_t payload[0];
 };
 
 #endif
diff --git a/trusty/keymaster/module.cpp b/trusty/keymaster/module.cpp
index 81597d9..b472680 100644
--- a/trusty/keymaster/module.cpp
+++ b/trusty/keymaster/module.cpp
@@ -26,14 +26,15 @@
 /*
  * Generic device handling
  */
-static int trusty_keymaster_open(const hw_module_t* module, const char* name,
-                                 hw_device_t** device) {
-    if (strcmp(name, KEYSTORE_KEYMASTER) != 0)
+static int trusty_keymaster_open(const hw_module_t* module, const char* name, hw_device_t** device) {
+    if (strcmp(name, KEYSTORE_KEYMASTER) != 0) {
         return -EINVAL;
+    }
 
     TrustyKeymasterDevice* dev = new TrustyKeymasterDevice(module);
-    if (dev == NULL)
+    if (dev == NULL) {
         return -ENOMEM;
+    }
     *device = dev->hw_device();
     // Do not delete dev; it will get cleaned up when the caller calls device->close(), and must
     // exist until then.
@@ -47,14 +48,14 @@
 struct keystore_module HAL_MODULE_INFO_SYM __attribute__((visibility("default"))) = {
     .common =
         {
-         .tag = HARDWARE_MODULE_TAG,
-         .module_api_version = KEYMASTER_MODULE_API_VERSION_0_3,
-         .hal_api_version = HARDWARE_HAL_API_VERSION,
-         .id = KEYSTORE_HARDWARE_MODULE_ID,
-         .name = "Trusty Keymaster HAL",
-         .author = "The Android Open Source Project",
-         .methods = &keystore_module_methods,
-         .dso = 0,
-         .reserved = {},
+            .tag = HARDWARE_MODULE_TAG,
+            .module_api_version = KEYMASTER_MODULE_API_VERSION_2_0,
+            .hal_api_version = HARDWARE_HAL_API_VERSION,
+            .id = KEYSTORE_HARDWARE_MODULE_ID,
+            .name = "Trusty Keymaster HAL",
+            .author = "The Android Open Source Project",
+            .methods = &keystore_module_methods,
+            .dso = 0,
+            .reserved = {},
         },
 };
diff --git a/trusty/keymaster/trusty_keymaster_device.cpp b/trusty/keymaster/trusty_keymaster_device.cpp
index 1368f88..5f16fd0 100644
--- a/trusty/keymaster/trusty_keymaster_device.cpp
+++ b/trusty/keymaster/trusty_keymaster_device.cpp
@@ -25,49 +25,53 @@
 #include <string.h>
 #include <time.h>
 
+#include <algorithm>
 #include <type_traits>
 
-#include <hardware/keymaster0.h>
+#include <hardware/keymaster2.h>
 #include <keymaster/authorization_set.h>
 #include <log/log.h>
 
+#include "keymaster_ipc.h"
 #include "trusty_keymaster_device.h"
 #include "trusty_keymaster_ipc.h"
-#include "keymaster_ipc.h"
 
-const uint32_t SEND_BUF_SIZE = 8192;
-const uint32_t RECV_BUF_SIZE = 8192;
+const uint32_t RECV_BUF_SIZE = PAGE_SIZE;
+const uint32_t SEND_BUF_SIZE = (PAGE_SIZE - sizeof(struct keymaster_message) - 16 /* tipc header */);
+
+const size_t kMaximumAttestationChallengeLength = 128;
+const size_t kMaximumFinishInputLength = 2048;
 
 namespace keymaster {
 
 static keymaster_error_t translate_error(int err) {
     switch (err) {
-    case 0:
-        return KM_ERROR_OK;
-    case -EPERM:
-    case -EACCES:
-        return KM_ERROR_SECURE_HW_ACCESS_DENIED;
+        case 0:
+            return KM_ERROR_OK;
+        case -EPERM:
+        case -EACCES:
+            return KM_ERROR_SECURE_HW_ACCESS_DENIED;
 
-    case -ECANCELED:
-        return KM_ERROR_OPERATION_CANCELLED;
+        case -ECANCELED:
+            return KM_ERROR_OPERATION_CANCELLED;
 
-    case -ENODEV:
-        return KM_ERROR_UNIMPLEMENTED;
+        case -ENODEV:
+            return KM_ERROR_UNIMPLEMENTED;
 
-    case -ENOMEM:
-        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+        case -ENOMEM:
+            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
 
-    case -EBUSY:
-        return KM_ERROR_SECURE_HW_BUSY;
+        case -EBUSY:
+            return KM_ERROR_SECURE_HW_BUSY;
 
-    case -EIO:
-        return KM_ERROR_SECURE_HW_COMMUNICATION_FAILED;
+        case -EIO:
+            return KM_ERROR_SECURE_HW_COMMUNICATION_FAILED;
 
-    case -EOVERFLOW:
-        return KM_ERROR_INVALID_INPUT_LENGTH;
+        case -EOVERFLOW:
+            return KM_ERROR_INVALID_INPUT_LENGTH;
 
-    default:
-        return KM_ERROR_UNKNOWN_ERROR;
+        default:
+            return KM_ERROR_UNKNOWN_ERROR;
     }
 }
 
@@ -75,31 +79,36 @@
     static_assert(std::is_standard_layout<TrustyKeymasterDevice>::value,
                   "TrustyKeymasterDevice must be standard layout");
     static_assert(offsetof(TrustyKeymasterDevice, device_) == 0,
-                  "device_ must be the first member of KeymasterOpenSsl");
+                  "device_ must be the first member of TrustyKeymasterDevice");
     static_assert(offsetof(TrustyKeymasterDevice, device_.common) == 0,
-                  "common must be the first member of keymaster_device");
+                  "common must be the first member of keymaster2_device");
 
     ALOGI("Creating device");
     ALOGD("Device address: %p", this);
 
-    memset(&device_, 0, sizeof(device_));
+    device_ = {};
 
     device_.common.tag = HARDWARE_DEVICE_TAG;
     device_.common.version = 1;
     device_.common.module = const_cast<hw_module_t*>(module);
     device_.common.close = close_device;
 
-    device_.flags = KEYMASTER_BLOBS_ARE_STANDALONE | KEYMASTER_SUPPORTS_EC;
+    device_.flags = KEYMASTER_SUPPORTS_EC;
 
-    device_.generate_keypair = generate_keypair;
-    device_.import_keypair = import_keypair;
-    device_.get_keypair_public = get_keypair_public;
-    device_.delete_keypair = NULL;
-    device_.delete_all = NULL;
-    device_.sign_data = sign_data;
-    device_.verify_data = verify_data;
-
-    device_.context = NULL;
+    device_.configure = configure;
+    device_.add_rng_entropy = add_rng_entropy;
+    device_.generate_key = generate_key;
+    device_.get_key_characteristics = get_key_characteristics;
+    device_.import_key = import_key;
+    device_.export_key = export_key;
+    device_.attest_key = attest_key;
+    device_.upgrade_key = upgrade_key;
+    device_.delete_key = nullptr;
+    device_.delete_all_keys = nullptr;
+    device_.begin = begin;
+    device_.update = update;
+    device_.finish = finish;
+    device_.abort = abort;
 
     int rc = trusty_keymaster_connect();
     error_ = translate_error(rc);
@@ -110,11 +119,11 @@
 
     GetVersionRequest version_request;
     GetVersionResponse version_response;
-    error_ = Send(version_request, &version_response);
+    error_ = Send(KM_GET_VERSION, version_request, &version_response);
     if (error_ == KM_ERROR_INVALID_ARGUMENT || error_ == KM_ERROR_UNIMPLEMENTED) {
-        ALOGI("\"Bad parameters\" error on GetVersion call.  Assuming version 0.");
-        message_version_ = 0;
-        error_ = KM_ERROR_OK;
+        ALOGE("\"Bad parameters\" error on GetVersion call.  Version 0 is not supported.");
+        error_ = KM_ERROR_VERSION_MISMATCH;
+        return;
     }
     message_version_ = MessageVersion(version_response.major_ver, version_response.minor_ver,
                                       version_response.subminor_ver);
@@ -130,261 +139,510 @@
     trusty_keymaster_disconnect();
 }
 
-const uint64_t HUNDRED_YEARS = 1000LL * 60 * 60 * 24 * 365 * 100;
+namespace {
 
-int TrustyKeymasterDevice::generate_keypair(const keymaster_keypair_t key_type,
-                                            const void* key_params, uint8_t** key_blob,
-                                            size_t* key_blob_length) {
-    ALOGD("Device received generate_keypair");
+// Allocates a new buffer with malloc and copies the contents of |buffer| to it. Caller takes
+// ownership of the returned buffer.
+uint8_t* DuplicateBuffer(const uint8_t* buffer, size_t size) {
+    uint8_t* tmp = reinterpret_cast<uint8_t*>(malloc(size));
+    if (tmp) {
+        memcpy(tmp, buffer, size);
+    }
+    return tmp;
+}
 
-    if (error_ != KM_ERROR_OK)
+template <typename RequestType>
+void AddClientAndAppData(const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
+                         RequestType* request) {
+    request->additional_params.Clear();
+    if (client_id) {
+        request->additional_params.push_back(TAG_APPLICATION_ID, *client_id);
+    }
+    if (app_data) {
+        request->additional_params.push_back(TAG_APPLICATION_DATA, *app_data);
+    }
+}
+
+}  //  unnamed namespace
+
+keymaster_error_t TrustyKeymasterDevice::configure(const keymaster_key_param_set_t* params) {
+    ALOGD("Device received configure\n");
+
+    if (error_ != KM_ERROR_OK) {
         return error_;
-
-    GenerateKeyRequest req(message_version_);
-    StoreNewKeyParams(&req.key_description);
-
-    switch (key_type) {
-    case TYPE_RSA: {
-        req.key_description.push_back(TAG_ALGORITHM, KM_ALGORITHM_RSA);
-        const keymaster_rsa_keygen_params_t* rsa_params =
-            static_cast<const keymaster_rsa_keygen_params_t*>(key_params);
-        ALOGD("Generating RSA pair, modulus size: %u, public exponent: %lu",
-              rsa_params->modulus_size, rsa_params->public_exponent);
-        req.key_description.push_back(TAG_KEY_SIZE, rsa_params->modulus_size);
-        req.key_description.push_back(TAG_RSA_PUBLIC_EXPONENT, rsa_params->public_exponent);
-        break;
+    }
+    if (!params) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
     }
 
-    case TYPE_EC: {
-        req.key_description.push_back(TAG_ALGORITHM, KM_ALGORITHM_EC);
-        const keymaster_ec_keygen_params_t* ec_params =
-            static_cast<const keymaster_ec_keygen_params_t*>(key_params);
-        ALOGD("Generating ECDSA pair, key size: %u", ec_params->field_size);
-        req.key_description.push_back(TAG_KEY_SIZE, ec_params->field_size);
-        break;
-    }
-    default:
-        ALOGD("Received request for unsuported key type %d", key_type);
-        return KM_ERROR_UNSUPPORTED_ALGORITHM;
+    AuthorizationSet params_copy(*params);
+    ConfigureRequest request;
+    if (!params_copy.GetTagValue(TAG_OS_VERSION, &request.os_version) ||
+        !params_copy.GetTagValue(TAG_OS_PATCHLEVEL, &request.os_patchlevel)) {
+        ALOGD("Configuration parameters must contain OS version and patch level");
+        return KM_ERROR_INVALID_ARGUMENT;
     }
 
-    GenerateKeyResponse rsp(message_version_);
-    ALOGD("Sending generate request");
-    keymaster_error_t err = Send(req, &rsp);
+    ConfigureResponse response;
+    keymaster_error_t err = Send(KM_CONFIGURE, request, &response);
     if (err != KM_ERROR_OK) {
-        ALOGE("Got error %d from send", err);
         return err;
     }
 
-    *key_blob_length = rsp.key_blob.key_material_size;
-    *key_blob = static_cast<uint8_t*>(malloc(*key_blob_length));
-    memcpy(*key_blob, rsp.key_blob.key_material, *key_blob_length);
-    ALOGD("Returning %d bytes in key blob\n", (int)*key_blob_length);
-
     return KM_ERROR_OK;
 }
 
-struct EVP_PKEY_Delete {
-    void operator()(EVP_PKEY* p) const { EVP_PKEY_free(p); }
-};
+keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const uint8_t* data, size_t data_length) {
+    ALOGD("Device received add_rng_entropy");
 
-struct PKCS8_PRIV_KEY_INFO_Delete {
-    void operator()(PKCS8_PRIV_KEY_INFO* p) const { PKCS8_PRIV_KEY_INFO_free(p); }
-};
-
-int TrustyKeymasterDevice::import_keypair(const uint8_t* key, const size_t key_length,
-                                          uint8_t** key_blob, size_t* key_blob_length) {
-    ALOGD("Device received import_keypair");
-    if (error_ != KM_ERROR_OK)
+    if (error_ != KM_ERROR_OK) {
         return error_;
+    }
 
-    if (!key)
+    AddEntropyRequest request;
+    request.random_data.Reinitialize(data, data_length);
+    AddEntropyResponse response;
+    return Send(KM_ADD_RNG_ENTROPY, request, &response);
+}
+
+keymaster_error_t TrustyKeymasterDevice::generate_key(
+    const keymaster_key_param_set_t* params, keymaster_key_blob_t* key_blob,
+    keymaster_key_characteristics_t* characteristics) {
+    ALOGD("Device received generate_key");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!params) {
         return KM_ERROR_UNEXPECTED_NULL_POINTER;
-
-    if (!key_blob || !key_blob_length)
+    }
+    if (!key_blob) {
         return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    GenerateKeyRequest request(message_version_);
+    request.key_description.Reinitialize(*params);
+    request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
+
+    GenerateKeyResponse response(message_version_);
+    keymaster_error_t err = Send(KM_GENERATE_KEY, request, &response);
+    if (err != KM_ERROR_OK) {
+        return err;
+    }
+
+    key_blob->key_material_size = response.key_blob.key_material_size;
+    key_blob->key_material =
+        DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
+    if (!key_blob->key_material) {
+        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
+
+    if (characteristics) {
+        response.enforced.CopyToParamSet(&characteristics->hw_enforced);
+        response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
+    }
+
+    return KM_ERROR_OK;
+}
+
+keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
+    const keymaster_key_blob_t* key_blob, const keymaster_blob_t* client_id,
+    const keymaster_blob_t* app_data, keymaster_key_characteristics_t* characteristics) {
+    ALOGD("Device received get_key_characteristics");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!key_blob || !key_blob->key_material) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!characteristics) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    GetKeyCharacteristicsRequest request;
+    request.SetKeyMaterial(*key_blob);
+    AddClientAndAppData(client_id, app_data, &request);
+
+    GetKeyCharacteristicsResponse response;
+    keymaster_error_t err = Send(KM_GET_KEY_CHARACTERISTICS, request, &response);
+    if (err != KM_ERROR_OK) {
+        return err;
+    }
+
+    response.enforced.CopyToParamSet(&characteristics->hw_enforced);
+    response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
+
+    return KM_ERROR_OK;
+}
+
+keymaster_error_t TrustyKeymasterDevice::import_key(
+    const keymaster_key_param_set_t* params, keymaster_key_format_t key_format,
+    const keymaster_blob_t* key_data, keymaster_key_blob_t* key_blob,
+    keymaster_key_characteristics_t* characteristics) {
+    ALOGD("Device received import_key");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!params || !key_data) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!key_blob) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
 
     ImportKeyRequest request(message_version_);
-    StoreNewKeyParams(&request.key_description);
-    keymaster_algorithm_t algorithm;
-    keymaster_error_t err = GetPkcs8KeyAlgorithm(key, key_length, &algorithm);
-    if (err != KM_ERROR_OK)
-        return err;
-    request.key_description.push_back(TAG_ALGORITHM, algorithm);
+    request.key_description.Reinitialize(*params);
+    request.key_description.push_back(TAG_CREATION_DATETIME, java_time(time(NULL)));
 
-    request.SetKeyMaterial(key, key_length);
-    request.key_format = KM_KEY_FORMAT_PKCS8;
+    request.key_format = key_format;
+    request.SetKeyMaterial(key_data->data, key_data->data_length);
+
     ImportKeyResponse response(message_version_);
-    err = Send(request, &response);
-    if (err != KM_ERROR_OK)
+    keymaster_error_t err = Send(KM_IMPORT_KEY, request, &response);
+    if (err != KM_ERROR_OK) {
         return err;
+    }
 
-    *key_blob_length = response.key_blob.key_material_size;
-    *key_blob = static_cast<uint8_t*>(malloc(*key_blob_length));
-    memcpy(*key_blob, response.key_blob.key_material, *key_blob_length);
-    printf("Returning %d bytes in key blob\n", (int)*key_blob_length);
+    key_blob->key_material_size = response.key_blob.key_material_size;
+    key_blob->key_material =
+        DuplicateBuffer(response.key_blob.key_material, response.key_blob.key_material_size);
+    if (!key_blob->key_material) {
+        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
+
+    if (characteristics) {
+        response.enforced.CopyToParamSet(&characteristics->hw_enforced);
+        response.unenforced.CopyToParamSet(&characteristics->sw_enforced);
+    }
 
     return KM_ERROR_OK;
 }
 
-keymaster_error_t TrustyKeymasterDevice::GetPkcs8KeyAlgorithm(const uint8_t* key, size_t key_length,
-                                                              keymaster_algorithm_t* algorithm) {
-    if (key == NULL) {
-        ALOGE("No key specified for import");
+keymaster_error_t TrustyKeymasterDevice::export_key(keymaster_key_format_t export_format,
+                                                    const keymaster_key_blob_t* key_to_export,
+                                                    const keymaster_blob_t* client_id,
+                                                    const keymaster_blob_t* app_data,
+                                                    keymaster_blob_t* export_data) {
+    ALOGD("Device received export_key");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!key_to_export || !key_to_export->key_material) {
         return KM_ERROR_UNEXPECTED_NULL_POINTER;
     }
-
-    UniquePtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_Delete> pkcs8(
-        d2i_PKCS8_PRIV_KEY_INFO(NULL, &key, key_length));
-    if (pkcs8.get() == NULL) {
-        ALOGE("Could not parse PKCS8 key blob");
-        return KM_ERROR_INVALID_KEY_BLOB;
+    if (!export_data) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
     }
 
-    UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(EVP_PKCS82PKEY(pkcs8.get()));
-    if (pkey.get() == NULL) {
-        ALOGE("Could not extract key from PKCS8 key blob");
-        return KM_ERROR_INVALID_KEY_BLOB;
-    }
-
-    switch (EVP_PKEY_type(pkey->type)) {
-    case EVP_PKEY_RSA:
-        *algorithm = KM_ALGORITHM_RSA;
-        break;
-    case EVP_PKEY_EC:
-        *algorithm = KM_ALGORITHM_EC;
-        break;
-    default:
-        ALOGE("Unsupported algorithm %d", EVP_PKEY_type(pkey->type));
-        return KM_ERROR_UNSUPPORTED_ALGORITHM;
-    }
-
-    return KM_ERROR_OK;
-}
-
-int TrustyKeymasterDevice::get_keypair_public(const uint8_t* key_blob, const size_t key_blob_length,
-                                              uint8_t** x509_data, size_t* x509_data_length) {
-    ALOGD("Device received get_keypair_public");
-    if (error_ != KM_ERROR_OK)
-        return error_;
+    export_data->data = nullptr;
+    export_data->data_length = 0;
 
     ExportKeyRequest request(message_version_);
-    request.SetKeyMaterial(key_blob, key_blob_length);
-    request.key_format = KM_KEY_FORMAT_X509;
+    request.key_format = export_format;
+    request.SetKeyMaterial(*key_to_export);
+    AddClientAndAppData(client_id, app_data, &request);
+
     ExportKeyResponse response(message_version_);
-    keymaster_error_t err = Send(request, &response);
-    if (err != KM_ERROR_OK)
+    keymaster_error_t err = Send(KM_EXPORT_KEY, request, &response);
+    if (err != KM_ERROR_OK) {
         return err;
+    }
 
-    *x509_data_length = response.key_data_length;
-    *x509_data = static_cast<uint8_t*>(malloc(*x509_data_length));
-    memcpy(*x509_data, response.key_data, *x509_data_length);
-    printf("Returning %d bytes in x509 key\n", (int)*x509_data_length);
+    export_data->data_length = response.key_data_length;
+    export_data->data = DuplicateBuffer(response.key_data, response.key_data_length);
+    if (!export_data->data) {
+        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
 
     return KM_ERROR_OK;
 }
 
-int TrustyKeymasterDevice::sign_data(const void* signing_params, const uint8_t* key_blob,
-                                     const size_t key_blob_length, const uint8_t* data,
-                                     const size_t data_length, uint8_t** signed_data,
-                                     size_t* signed_data_length) {
-    ALOGD("Device received sign_data, %d", error_);
-    if (error_ != KM_ERROR_OK)
+keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster_key_blob_t* key_to_attest,
+                                                    const keymaster_key_param_set_t* attest_params,
+                                                    keymaster_cert_chain_t* cert_chain) {
+    ALOGD("Device received attest_key");
+
+    if (error_ != KM_ERROR_OK) {
         return error_;
+    }
+    if (!key_to_attest || !attest_params) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!cert_chain) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
 
-    BeginOperationRequest begin_request(message_version_);
-    begin_request.purpose = KM_PURPOSE_SIGN;
-    begin_request.SetKeyMaterial(key_blob, key_blob_length);
-    keymaster_error_t err = StoreSigningParams(signing_params, key_blob, key_blob_length,
-                                               &begin_request.additional_params);
+    cert_chain->entry_count = 0;
+    cert_chain->entries = nullptr;
+
+    AttestKeyRequest request;
+    request.SetKeyMaterial(*key_to_attest);
+    request.attest_params.Reinitialize(*attest_params);
+
+    keymaster_blob_t attestation_challenge = {};
+    request.attest_params.GetTagValue(TAG_ATTESTATION_CHALLENGE, &attestation_challenge);
+    if (attestation_challenge.data_length > kMaximumAttestationChallengeLength) {
+        ALOGE("%zu-byte attestation challenge; only %zu bytes allowed",
+              attestation_challenge.data_length, kMaximumAttestationChallengeLength);
+        return KM_ERROR_INVALID_INPUT_LENGTH;
+    }
+
+    AttestKeyResponse response;
+    keymaster_error_t err = Send(KM_ATTEST_KEY, request, &response);
     if (err != KM_ERROR_OK) {
-        ALOGE("Error extracting signing params: %d", err);
         return err;
     }
 
-    BeginOperationResponse begin_response(message_version_);
-    ALOGD("Sending signing request begin");
-    err = Send(begin_request, &begin_response);
-    if (err != KM_ERROR_OK) {
-        ALOGE("Error sending sign begin: %d", err);
-        return err;
+    // Allocate and clear storage for cert_chain.
+    keymaster_cert_chain_t& rsp_chain = response.certificate_chain;
+    cert_chain->entries = reinterpret_cast<keymaster_blob_t*>(
+        malloc(rsp_chain.entry_count * sizeof(*cert_chain->entries)));
+    if (!cert_chain->entries) {
+        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
+    cert_chain->entry_count = rsp_chain.entry_count;
+    for (keymaster_blob_t& entry : array_range(cert_chain->entries, cert_chain->entry_count)) {
+        entry = {};
     }
 
-    UpdateOperationRequest update_request(message_version_);
-    update_request.op_handle = begin_response.op_handle;
-    update_request.input.Reinitialize(data, data_length);
-    UpdateOperationResponse update_response(message_version_);
-    ALOGD("Sending signing request update");
-    err = Send(update_request, &update_response);
-    if (err != KM_ERROR_OK) {
-        ALOGE("Error sending sign update: %d", err);
-        return err;
+    // Copy cert_chain contents
+    size_t i = 0;
+    for (keymaster_blob_t& entry : array_range(rsp_chain.entries, rsp_chain.entry_count)) {
+        cert_chain->entries[i].data = DuplicateBuffer(entry.data, entry.data_length);
+        if (!cert_chain->entries[i].data) {
+            keymaster_free_cert_chain(cert_chain);
+            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+        }
+        cert_chain->entries[i].data_length = entry.data_length;
+        ++i;
     }
 
-    FinishOperationRequest finish_request(message_version_);
-    finish_request.op_handle = begin_response.op_handle;
-    FinishOperationResponse finish_response(message_version_);
-    ALOGD("Sending signing request finish");
-    err = Send(finish_request, &finish_response);
-    if (err != KM_ERROR_OK) {
-        ALOGE("Error sending sign finish: %d", err);
-        return err;
-    }
-
-    *signed_data_length = finish_response.output.available_read();
-    *signed_data = static_cast<uint8_t*>(malloc(*signed_data_length));
-    if (!finish_response.output.read(*signed_data, *signed_data_length)) {
-        ALOGE("Error reading response data: %d", err);
-        return KM_ERROR_UNKNOWN_ERROR;
-    }
     return KM_ERROR_OK;
 }
 
-int TrustyKeymasterDevice::verify_data(const void* signing_params, const uint8_t* key_blob,
-                                       const size_t key_blob_length, const uint8_t* signed_data,
-                                       const size_t signed_data_length, const uint8_t* signature,
-                                       const size_t signature_length) {
-    ALOGD("Device received verify_data");
-    if (error_ != KM_ERROR_OK)
+keymaster_error_t TrustyKeymasterDevice::upgrade_key(const keymaster_key_blob_t* key_to_upgrade,
+                                                     const keymaster_key_param_set_t* upgrade_params,
+                                                     keymaster_key_blob_t* upgraded_key) {
+    ALOGD("Device received upgrade_key");
+
+    if (error_ != KM_ERROR_OK) {
         return error_;
+    }
+    if (!key_to_upgrade || !upgrade_params) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!upgraded_key) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
 
-    BeginOperationRequest begin_request(message_version_);
-    begin_request.purpose = KM_PURPOSE_VERIFY;
-    begin_request.SetKeyMaterial(key_blob, key_blob_length);
-    keymaster_error_t err = StoreSigningParams(signing_params, key_blob, key_blob_length,
-                                               &begin_request.additional_params);
-    if (err != KM_ERROR_OK)
-        return err;
+    UpgradeKeyRequest request;
+    request.SetKeyMaterial(*key_to_upgrade);
+    request.upgrade_params.Reinitialize(*upgrade_params);
 
-    BeginOperationResponse begin_response(message_version_);
-    err = Send(begin_request, &begin_response);
-    if (err != KM_ERROR_OK)
+    UpgradeKeyResponse response;
+    keymaster_error_t err = Send(KM_UPGRADE_KEY, request, &response);
+    if (err != KM_ERROR_OK) {
         return err;
+    }
 
-    UpdateOperationRequest update_request(message_version_);
-    update_request.op_handle = begin_response.op_handle;
-    update_request.input.Reinitialize(signed_data, signed_data_length);
-    UpdateOperationResponse update_response(message_version_);
-    err = Send(update_request, &update_response);
-    if (err != KM_ERROR_OK)
-        return err;
+    upgraded_key->key_material_size = response.upgraded_key.key_material_size;
+    upgraded_key->key_material = DuplicateBuffer(response.upgraded_key.key_material,
+                                                 response.upgraded_key.key_material_size);
+    if (!upgraded_key->key_material) {
+        return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
 
-    FinishOperationRequest finish_request(message_version_);
-    finish_request.op_handle = begin_response.op_handle;
-    finish_request.signature.Reinitialize(signature, signature_length);
-    FinishOperationResponse finish_response(message_version_);
-    err = Send(finish_request, &finish_response);
-    if (err != KM_ERROR_OK)
-        return err;
     return KM_ERROR_OK;
 }
 
+keymaster_error_t TrustyKeymasterDevice::begin(keymaster_purpose_t purpose,
+                                               const keymaster_key_blob_t* key,
+                                               const keymaster_key_param_set_t* in_params,
+                                               keymaster_key_param_set_t* out_params,
+                                               keymaster_operation_handle_t* operation_handle) {
+    ALOGD("Device received begin");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!key || !key->key_material) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!operation_handle) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    if (out_params) {
+        *out_params = {};
+    }
+
+    BeginOperationRequest request;
+    request.purpose = purpose;
+    request.SetKeyMaterial(*key);
+    request.additional_params.Reinitialize(*in_params);
+
+    BeginOperationResponse response;
+    keymaster_error_t err = Send(KM_BEGIN_OPERATION, request, &response);
+    if (err != KM_ERROR_OK) {
+        return err;
+    }
+
+    if (response.output_params.size() > 0) {
+        if (out_params) {
+            response.output_params.CopyToParamSet(out_params);
+        } else {
+            return KM_ERROR_OUTPUT_PARAMETER_NULL;
+        }
+    }
+    *operation_handle = response.op_handle;
+
+    return KM_ERROR_OK;
+}
+
+keymaster_error_t TrustyKeymasterDevice::update(keymaster_operation_handle_t operation_handle,
+                                                const keymaster_key_param_set_t* in_params,
+                                                const keymaster_blob_t* input,
+                                                size_t* input_consumed,
+                                                keymaster_key_param_set_t* out_params,
+                                                keymaster_blob_t* output) {
+    ALOGD("Device received update");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (!input) {
+        return KM_ERROR_UNEXPECTED_NULL_POINTER;
+    }
+    if (!input_consumed) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    if (out_params) {
+        *out_params = {};
+    }
+    if (output) {
+        *output = {};
+    }
+
+    UpdateOperationRequest request;
+    request.op_handle = operation_handle;
+    if (in_params) {
+        request.additional_params.Reinitialize(*in_params);
+    }
+    if (input && input->data_length > 0) {
+        size_t max_input_size = SEND_BUF_SIZE - request.SerializedSize();
+        request.input.Reinitialize(input->data, std::min(input->data_length, max_input_size));
+    }
+
+    UpdateOperationResponse response;
+    keymaster_error_t err = Send(KM_UPDATE_OPERATION, request, &response);
+    if (err != KM_ERROR_OK) {
+        return err;
+    }
+
+    if (response.output_params.size() > 0) {
+        if (out_params) {
+            response.output_params.CopyToParamSet(out_params);
+        } else {
+            return KM_ERROR_OUTPUT_PARAMETER_NULL;
+        }
+    }
+    *input_consumed = response.input_consumed;
+    if (output) {
+        output->data_length = response.output.available_read();
+        output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
+        if (!output->data) {
+            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+        }
+    } else if (response.output.available_read() > 0) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    return KM_ERROR_OK;
+}
+
+keymaster_error_t TrustyKeymasterDevice::finish(keymaster_operation_handle_t operation_handle,
+                                                const keymaster_key_param_set_t* in_params,
+                                                const keymaster_blob_t* input,
+                                                const keymaster_blob_t* signature,
+                                                keymaster_key_param_set_t* out_params,
+                                                keymaster_blob_t* output) {
+    ALOGD("Device received finish");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+    if (input && input->data_length > kMaximumFinishInputLength) {
+        return KM_ERROR_INVALID_ARGUMENT;
+    }
+
+    if (out_params) {
+        *out_params = {};
+    }
+    if (output) {
+        *output = {};
+    }
+
+    FinishOperationRequest request;
+    request.op_handle = operation_handle;
+    if (signature && signature->data && signature->data_length > 0) {
+        request.signature.Reinitialize(signature->data, signature->data_length);
+    }
+    if (input && input->data && input->data_length) {
+        request.input.Reinitialize(input->data, input->data_length);
+    }
+    if (in_params) {
+        request.additional_params.Reinitialize(*in_params);
+    }
+
+    FinishOperationResponse response;
+    keymaster_error_t err = Send(KM_FINISH_OPERATION, request, &response);
+    if (err != KM_ERROR_OK) {
+        return err;
+    }
+
+    if (response.output_params.size() > 0) {
+        if (out_params) {
+            response.output_params.CopyToParamSet(out_params);
+        } else {
+            return KM_ERROR_OUTPUT_PARAMETER_NULL;
+        }
+    }
+    if (output) {
+        output->data_length = response.output.available_read();
+        output->data = DuplicateBuffer(response.output.peek_read(), output->data_length);
+        if (!output->data) {
+            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+        }
+    } else if (response.output.available_read() > 0) {
+        return KM_ERROR_OUTPUT_PARAMETER_NULL;
+    }
+
+    return KM_ERROR_OK;
+}
+
+keymaster_error_t TrustyKeymasterDevice::abort(keymaster_operation_handle_t operation_handle) {
+    ALOGD("Device received abort");
+
+    if (error_ != KM_ERROR_OK) {
+        return error_;
+    }
+
+    AbortOperationRequest request;
+    request.op_handle = operation_handle;
+    AbortOperationResponse response;
+    return Send(KM_ABORT_OPERATION, request, &response);
+}
+
 hw_device_t* TrustyKeymasterDevice::hw_device() {
     return &device_.common;
 }
 
-static inline TrustyKeymasterDevice* convert_device(const keymaster0_device_t* dev) {
-    return reinterpret_cast<TrustyKeymasterDevice*>(const_cast<keymaster0_device_t*>(dev));
+static inline TrustyKeymasterDevice* convert_device(const keymaster2_device_t* dev) {
+    return reinterpret_cast<TrustyKeymasterDevice*>(const_cast<keymaster2_device_t*>(dev));
 }
 
 /* static */
@@ -394,52 +652,111 @@
 }
 
 /* static */
-int TrustyKeymasterDevice::generate_keypair(const keymaster0_device_t* dev,
-                                            const keymaster_keypair_t key_type,
-                                            const void* key_params, uint8_t** keyBlob,
-                                            size_t* keyBlobLength) {
-    ALOGD("Generate keypair, sending to device: %p", convert_device(dev));
-    return convert_device(dev)->generate_keypair(key_type, key_params, keyBlob, keyBlobLength);
+keymaster_error_t TrustyKeymasterDevice::configure(const keymaster2_device_t* dev,
+                                                   const keymaster_key_param_set_t* params) {
+    return convert_device(dev)->configure(params);
 }
 
 /* static */
-int TrustyKeymasterDevice::import_keypair(const keymaster0_device_t* dev, const uint8_t* key,
-                                          const size_t key_length, uint8_t** key_blob,
-                                          size_t* key_blob_length) {
-    return convert_device(dev)->import_keypair(key, key_length, key_blob, key_blob_length);
+keymaster_error_t TrustyKeymasterDevice::add_rng_entropy(const keymaster2_device_t* dev,
+                                                         const uint8_t* data, size_t data_length) {
+    return convert_device(dev)->add_rng_entropy(data, data_length);
 }
 
 /* static */
-int TrustyKeymasterDevice::get_keypair_public(const keymaster0_device_t* dev,
-                                              const uint8_t* key_blob, const size_t key_blob_length,
-                                              uint8_t** x509_data, size_t* x509_data_length) {
-    return convert_device(dev)
-        ->get_keypair_public(key_blob, key_blob_length, x509_data, x509_data_length);
+keymaster_error_t TrustyKeymasterDevice::generate_key(
+    const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
+    keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
+    return convert_device(dev)->generate_key(params, key_blob, characteristics);
 }
 
 /* static */
-int TrustyKeymasterDevice::sign_data(const keymaster0_device_t* dev, const void* params,
-                                     const uint8_t* keyBlob, const size_t keyBlobLength,
-                                     const uint8_t* data, const size_t dataLength,
-                                     uint8_t** signedData, size_t* signedDataLength) {
-    return convert_device(dev)
-        ->sign_data(params, keyBlob, keyBlobLength, data, dataLength, signedData, signedDataLength);
+keymaster_error_t TrustyKeymasterDevice::get_key_characteristics(
+    const keymaster2_device_t* dev, const keymaster_key_blob_t* key_blob,
+    const keymaster_blob_t* client_id, const keymaster_blob_t* app_data,
+    keymaster_key_characteristics_t* characteristics) {
+    return convert_device(dev)->get_key_characteristics(key_blob, client_id, app_data,
+                                                        characteristics);
 }
 
 /* static */
-int TrustyKeymasterDevice::verify_data(const keymaster0_device_t* dev, const void* params,
-                                       const uint8_t* keyBlob, const size_t keyBlobLength,
-                                       const uint8_t* signedData, const size_t signedDataLength,
-                                       const uint8_t* signature, const size_t signatureLength) {
-    return convert_device(dev)->verify_data(params, keyBlob, keyBlobLength, signedData,
-                                            signedDataLength, signature, signatureLength);
+keymaster_error_t TrustyKeymasterDevice::import_key(
+    const keymaster2_device_t* dev, const keymaster_key_param_set_t* params,
+    keymaster_key_format_t key_format, const keymaster_blob_t* key_data,
+    keymaster_key_blob_t* key_blob, keymaster_key_characteristics_t* characteristics) {
+    return convert_device(dev)->import_key(params, key_format, key_data, key_blob, characteristics);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::export_key(const keymaster2_device_t* dev,
+                                                    keymaster_key_format_t export_format,
+                                                    const keymaster_key_blob_t* key_to_export,
+                                                    const keymaster_blob_t* client_id,
+                                                    const keymaster_blob_t* app_data,
+                                                    keymaster_blob_t* export_data) {
+    return convert_device(dev)->export_key(export_format, key_to_export, client_id, app_data,
+                                           export_data);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::attest_key(const keymaster2_device_t* dev,
+                                                    const keymaster_key_blob_t* key_to_attest,
+                                                    const keymaster_key_param_set_t* attest_params,
+                                                    keymaster_cert_chain_t* cert_chain) {
+    return convert_device(dev)->attest_key(key_to_attest, attest_params, cert_chain);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::upgrade_key(const keymaster2_device_t* dev,
+                                                     const keymaster_key_blob_t* key_to_upgrade,
+                                                     const keymaster_key_param_set_t* upgrade_params,
+                                                     keymaster_key_blob_t* upgraded_key) {
+    return convert_device(dev)->upgrade_key(key_to_upgrade, upgrade_params, upgraded_key);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::begin(const keymaster2_device_t* dev,
+                                               keymaster_purpose_t purpose,
+                                               const keymaster_key_blob_t* key,
+                                               const keymaster_key_param_set_t* in_params,
+                                               keymaster_key_param_set_t* out_params,
+                                               keymaster_operation_handle_t* operation_handle) {
+    return convert_device(dev)->begin(purpose, key, in_params, out_params, operation_handle);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::update(
+    const keymaster2_device_t* dev, keymaster_operation_handle_t operation_handle,
+    const keymaster_key_param_set_t* in_params, const keymaster_blob_t* input,
+    size_t* input_consumed, keymaster_key_param_set_t* out_params, keymaster_blob_t* output) {
+    return convert_device(dev)->update(operation_handle, in_params, input, input_consumed,
+                                       out_params, output);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::finish(const keymaster2_device_t* dev,
+                                                keymaster_operation_handle_t operation_handle,
+                                                const keymaster_key_param_set_t* in_params,
+                                                const keymaster_blob_t* input,
+                                                const keymaster_blob_t* signature,
+                                                keymaster_key_param_set_t* out_params,
+                                                keymaster_blob_t* output) {
+    return convert_device(dev)->finish(operation_handle, in_params, input, signature, out_params,
+                                       output);
+}
+
+/* static */
+keymaster_error_t TrustyKeymasterDevice::abort(const keymaster2_device_t* dev,
+                                               keymaster_operation_handle_t operation_handle) {
+    return convert_device(dev)->abort(operation_handle);
 }
 
 keymaster_error_t TrustyKeymasterDevice::Send(uint32_t command, const Serializable& req,
                                               KeymasterResponse* rsp) {
     uint32_t req_size = req.SerializedSize();
-    if (req_size > SEND_BUF_SIZE)
+    if (req_size > SEND_BUF_SIZE) {
         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
+    }
     uint8_t send_buf[SEND_BUF_SIZE];
     Eraser send_buf_eraser(send_buf, SEND_BUF_SIZE);
     req.Serialize(send_buf, send_buf + req_size);
@@ -448,7 +765,7 @@
     uint8_t recv_buf[RECV_BUF_SIZE];
     Eraser recv_buf_eraser(recv_buf, RECV_BUF_SIZE);
     uint32_t rsp_size = RECV_BUF_SIZE;
-    printf("Sending %d byte request\n", (int)req.SerializedSize());
+    ALOGV("Sending %d byte request\n", (int)req.SerializedSize());
     int rc = trusty_keymaster_call(command, send_buf, req_size, recv_buf, &rsp_size);
     if (rc < 0) {
         ALOGE("tipc error: %d\n", rc);
@@ -458,8 +775,8 @@
         ALOGV("Received %d byte response\n", rsp_size);
     }
 
-    const keymaster_message* msg = (keymaster_message *) recv_buf;
-    const uint8_t *p = msg->payload;
+    const keymaster_message* msg = (keymaster_message*)recv_buf;
+    const uint8_t* p = msg->payload;
     if (!rsp->Deserialize(&p, p + rsp_size)) {
         ALOGE("Error deserializing response of size %d\n", (int)rsp_size);
         return KM_ERROR_UNKNOWN_ERROR;
@@ -470,65 +787,4 @@
     return rsp->error;
 }
 
-keymaster_error_t TrustyKeymasterDevice::StoreSigningParams(const void* signing_params,
-                                                            const uint8_t* key_blob,
-                                                            size_t key_blob_length,
-                                                            AuthorizationSet* auth_set) {
-    uint8_t* pub_key_data;
-    size_t pub_key_data_length;
-    int err = get_keypair_public(&device_, key_blob, key_blob_length, &pub_key_data,
-                                 &pub_key_data_length);
-    if (err < 0) {
-        ALOGE("Error %d extracting public key to determine algorithm", err);
-        return KM_ERROR_INVALID_KEY_BLOB;
-    }
-    UniquePtr<uint8_t, Malloc_Delete> pub_key(pub_key_data);
-
-    const uint8_t* p = pub_key_data;
-    UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(
-        d2i_PUBKEY(nullptr /* allocate new struct */, &p, pub_key_data_length));
-
-    switch (EVP_PKEY_type(pkey->type)) {
-    case EVP_PKEY_RSA: {
-        const keymaster_rsa_sign_params_t* rsa_params =
-            reinterpret_cast<const keymaster_rsa_sign_params_t*>(signing_params);
-        if (rsa_params->digest_type != DIGEST_NONE)
-            return KM_ERROR_UNSUPPORTED_DIGEST;
-        if (rsa_params->padding_type != PADDING_NONE)
-            return KM_ERROR_UNSUPPORTED_PADDING_MODE;
-        if (!auth_set->push_back(TAG_DIGEST, KM_DIGEST_NONE) ||
-            !auth_set->push_back(TAG_PADDING, KM_PAD_NONE))
-            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
-    } break;
-    case EVP_PKEY_EC: {
-        const keymaster_ec_sign_params_t* ecdsa_params =
-            reinterpret_cast<const keymaster_ec_sign_params_t*>(signing_params);
-        if (ecdsa_params->digest_type != DIGEST_NONE)
-            return KM_ERROR_UNSUPPORTED_DIGEST;
-        if (!auth_set->push_back(TAG_DIGEST, KM_DIGEST_NONE))
-            return KM_ERROR_MEMORY_ALLOCATION_FAILED;
-    } break;
-    default:
-        return KM_ERROR_UNSUPPORTED_ALGORITHM;
-    }
-    return KM_ERROR_OK;
-}
-
-void TrustyKeymasterDevice::StoreNewKeyParams(AuthorizationSet* auth_set) {
-    auth_set->push_back(TAG_PURPOSE, KM_PURPOSE_SIGN);
-    auth_set->push_back(TAG_PURPOSE, KM_PURPOSE_VERIFY);
-    auth_set->push_back(TAG_ALL_USERS);
-    auth_set->push_back(TAG_NO_AUTH_REQUIRED);
-    uint64_t now = java_time(time(NULL));
-    auth_set->push_back(TAG_CREATION_DATETIME, now);
-    auth_set->push_back(TAG_ORIGINATION_EXPIRE_DATETIME, now + HUNDRED_YEARS);
-    if (message_version_ == 0) {
-        auth_set->push_back(TAG_DIGEST_OLD, KM_DIGEST_NONE);
-        auth_set->push_back(TAG_PADDING_OLD, KM_PAD_NONE);
-    } else {
-        auth_set->push_back(TAG_DIGEST, KM_DIGEST_NONE);
-        auth_set->push_back(TAG_PADDING, KM_PAD_NONE);
-    }
-}
-
 }  // namespace keymaster
diff --git a/trusty/keymaster/trusty_keymaster_device.h b/trusty/keymaster/trusty_keymaster_device.h
index 68cf40c..cfada1b 100644
--- a/trusty/keymaster/trusty_keymaster_device.h
+++ b/trusty/keymaster/trusty_keymaster_device.h
@@ -14,19 +14,16 @@
  * limitations under the License.
  */
 
-#ifndef EXTERNAL_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
-#define EXTERNAL_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
+#ifndef TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
+#define TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
 
-#include <hardware/keymaster0.h>
-
+#include <hardware/keymaster2.h>
 #include <keymaster/android_keymaster_messages.h>
 
-#include "keymaster_ipc.h"
-
 namespace keymaster {
 
 /**
- * Software OpenSSL-based Keymaster device.
+ * Trusty Keymaster device.
  *
  * IMPORTANT MAINTAINER NOTE: Pointers to instances of this class must be castable to hw_device_t
  * and keymaster_device. This means it must remain a standard layout class (no virtual functions and
@@ -46,79 +43,111 @@
 
     keymaster_error_t session_error() { return error_; }
 
-    int generate_keypair(const keymaster_keypair_t key_type, const void* key_params,
-                         uint8_t** key_blob, size_t* key_blob_length);
-    int import_keypair(const uint8_t* key, const size_t key_length, uint8_t** key_blob,
-                       size_t* key_blob_length);
-    int get_keypair_public(const uint8_t* key_blob, const size_t key_blob_length,
-                           uint8_t** x509_data, size_t* x509_data_length);
-    int sign_data(const void* signing_params, const uint8_t* key_blob, const size_t key_blob_length,
-                  const uint8_t* data, const size_t data_length, uint8_t** signed_data,
-                  size_t* signed_data_length);
-    int verify_data(const void* signing_params, const uint8_t* key_blob,
-                    const size_t key_blob_length, const uint8_t* signed_data,
-                    const size_t signed_data_length, const uint8_t* signature,
-                    const size_t signature_length);
+    keymaster_error_t configure(const keymaster_key_param_set_t* params);
+    keymaster_error_t add_rng_entropy(const uint8_t* data, size_t data_length);
+    keymaster_error_t generate_key(const keymaster_key_param_set_t* params,
+                                   keymaster_key_blob_t* key_blob,
+                                   keymaster_key_characteristics_t* characteristics);
+    keymaster_error_t get_key_characteristics(const keymaster_key_blob_t* key_blob,
+                                              const keymaster_blob_t* client_id,
+                                              const keymaster_blob_t* app_data,
+                                              keymaster_key_characteristics_t* character);
+    keymaster_error_t import_key(const keymaster_key_param_set_t* params,
+                                 keymaster_key_format_t key_format,
+                                 const keymaster_blob_t* key_data, keymaster_key_blob_t* key_blob,
+                                 keymaster_key_characteristics_t* characteristics);
+    keymaster_error_t export_key(keymaster_key_format_t export_format,
+                                 const keymaster_key_blob_t* key_to_export,
+                                 const keymaster_blob_t* client_id,
+                                 const keymaster_blob_t* app_data, keymaster_blob_t* export_data);
+    keymaster_error_t attest_key(const keymaster_key_blob_t* key_to_attest,
+                                 const keymaster_key_param_set_t* attest_params,
+                                 keymaster_cert_chain_t* cert_chain);
+    keymaster_error_t upgrade_key(const keymaster_key_blob_t* key_to_upgrade,
+                                  const keymaster_key_param_set_t* upgrade_params,
+                                  keymaster_key_blob_t* upgraded_key);
+    keymaster_error_t begin(keymaster_purpose_t purpose, const keymaster_key_blob_t* key,
+                            const keymaster_key_param_set_t* in_params,
+                            keymaster_key_param_set_t* out_params,
+                            keymaster_operation_handle_t* operation_handle);
+    keymaster_error_t update(keymaster_operation_handle_t operation_handle,
+                             const keymaster_key_param_set_t* in_params,
+                             const keymaster_blob_t* input, size_t* input_consumed,
+                             keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+    keymaster_error_t finish(keymaster_operation_handle_t operation_handle,
+                             const keymaster_key_param_set_t* in_params,
+                             const keymaster_blob_t* input, const keymaster_blob_t* signature,
+                             keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+    keymaster_error_t abort(keymaster_operation_handle_t operation_handle);
 
   private:
     keymaster_error_t Send(uint32_t command, const Serializable& request,
                            KeymasterResponse* response);
-    keymaster_error_t Send(const GenerateKeyRequest& request, GenerateKeyResponse* response) {
-        return Send(KM_GENERATE_KEY, request, response);
-    }
-    keymaster_error_t Send(const BeginOperationRequest& request, BeginOperationResponse* response) {
-        return Send(KM_BEGIN_OPERATION, request, response);
-    }
-    keymaster_error_t Send(const UpdateOperationRequest& request,
-                           UpdateOperationResponse* response) {
-        return Send(KM_UPDATE_OPERATION, request, response);
-    }
-    keymaster_error_t Send(const FinishOperationRequest& request,
-                           FinishOperationResponse* response) {
-        return Send(KM_FINISH_OPERATION, request, response);
-    }
-    keymaster_error_t Send(const ImportKeyRequest& request, ImportKeyResponse* response) {
-        return Send(KM_IMPORT_KEY, request, response);
-    }
-    keymaster_error_t Send(const ExportKeyRequest& request, ExportKeyResponse* response) {
-        return Send(KM_EXPORT_KEY, request, response);
-    }
-    keymaster_error_t Send(const GetVersionRequest& request, GetVersionResponse* response) {
-        return Send(KM_GET_VERSION, request, response);
-    }
-
-    keymaster_error_t StoreSigningParams(const void* signing_params, const uint8_t* key_blob,
-                                         size_t key_blob_length, AuthorizationSet* auth_set);
-    void StoreNewKeyParams(AuthorizationSet* auth_set);
-    keymaster_error_t GetPkcs8KeyAlgorithm(const uint8_t* key, size_t key_length,
-                                           keymaster_algorithm_t* algorithm);
 
     /*
      * These static methods are the functions referenced through the function pointers in
      * keymaster_device.  They're all trivial wrappers.
      */
     static int close_device(hw_device_t* dev);
-    static int generate_keypair(const keymaster0_device_t* dev, const keymaster_keypair_t key_type,
-                                const void* key_params, uint8_t** keyBlob, size_t* keyBlobLength);
-    static int import_keypair(const keymaster0_device_t* dev, const uint8_t* key,
-                              const size_t key_length, uint8_t** key_blob, size_t* key_blob_length);
-    static int get_keypair_public(const keymaster0_device_t* dev, const uint8_t* key_blob,
-                                  const size_t key_blob_length, uint8_t** x509_data,
-                                  size_t* x509_data_length);
-    static int sign_data(const keymaster0_device_t* dev, const void* signing_params,
-                         const uint8_t* key_blob, const size_t key_blob_length, const uint8_t* data,
-                         const size_t data_length, uint8_t** signed_data,
-                         size_t* signed_data_length);
-    static int verify_data(const keymaster0_device_t* dev, const void* signing_params,
-                           const uint8_t* key_blob, const size_t key_blob_length,
-                           const uint8_t* signed_data, const size_t signed_data_length,
-                           const uint8_t* signature, const size_t signature_length);
+    static keymaster_error_t configure(const keymaster2_device_t* dev,
+                                       const keymaster_key_param_set_t* params);
+    static keymaster_error_t add_rng_entropy(const keymaster2_device_t* dev, const uint8_t* data,
+                                             size_t data_length);
+    static keymaster_error_t generate_key(const keymaster2_device_t* dev,
+                                          const keymaster_key_param_set_t* params,
+                                          keymaster_key_blob_t* key_blob,
+                                          keymaster_key_characteristics_t* characteristics);
+    static keymaster_error_t get_key_characteristics(const keymaster2_device_t* dev,
+                                                     const keymaster_key_blob_t* key_blob,
+                                                     const keymaster_blob_t* client_id,
+                                                     const keymaster_blob_t* app_data,
+                                                     keymaster_key_characteristics_t* character);
+    static keymaster_error_t import_key(const keymaster2_device_t* dev,
+                                        const keymaster_key_param_set_t* params,
+                                        keymaster_key_format_t key_format,
+                                        const keymaster_blob_t* key_data,
+                                        keymaster_key_blob_t* key_blob,
+                                        keymaster_key_characteristics_t* characteristics);
+    static keymaster_error_t export_key(const keymaster2_device_t* dev,
+                                        keymaster_key_format_t export_format,
+                                        const keymaster_key_blob_t* key_to_export,
+                                        const keymaster_blob_t* client_id,
+                                        const keymaster_blob_t* app_data,
+                                        keymaster_blob_t* export_data);
+    static keymaster_error_t attest_key(const keymaster2_device_t* dev,
+                                        const keymaster_key_blob_t* key_to_attest,
+                                        const keymaster_key_param_set_t* attest_params,
+                                        keymaster_cert_chain_t* cert_chain);
+    static keymaster_error_t upgrade_key(const keymaster2_device_t* dev,
+                                         const keymaster_key_blob_t* key_to_upgrade,
+                                         const keymaster_key_param_set_t* upgrade_params,
+                                         keymaster_key_blob_t* upgraded_key);
+    static keymaster_error_t delete_key(const keymaster2_device_t* dev,
+                                        const keymaster_key_blob_t* key);
+    static keymaster_error_t delete_all_keys(const keymaster2_device_t* dev);
+    static keymaster_error_t begin(const keymaster2_device_t* dev, keymaster_purpose_t purpose,
+                                   const keymaster_key_blob_t* key,
+                                   const keymaster_key_param_set_t* in_params,
+                                   keymaster_key_param_set_t* out_params,
+                                   keymaster_operation_handle_t* operation_handle);
+    static keymaster_error_t update(const keymaster2_device_t* dev,
+                                    keymaster_operation_handle_t operation_handle,
+                                    const keymaster_key_param_set_t* in_params,
+                                    const keymaster_blob_t* input, size_t* input_consumed,
+                                    keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+    static keymaster_error_t finish(const keymaster2_device_t* dev,
+                                    keymaster_operation_handle_t operation_handle,
+                                    const keymaster_key_param_set_t* in_params,
+                                    const keymaster_blob_t* input, const keymaster_blob_t* signature,
+                                    keymaster_key_param_set_t* out_params, keymaster_blob_t* output);
+    static keymaster_error_t abort(const keymaster2_device_t* dev,
+                                   keymaster_operation_handle_t operation_handle);
 
-    keymaster0_device_t device_;
+    keymaster2_device_t device_;
     keymaster_error_t error_;
     int32_t message_version_;
 };
 
 }  // namespace keymaster
 
-#endif  // EXTERNAL_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
+#endif  // TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_DEVICE_H_
diff --git a/trusty/keymaster/trusty_keymaster_ipc.c b/trusty/keymaster/trusty_keymaster_ipc.cpp
similarity index 75%
rename from trusty/keymaster/trusty_keymaster_ipc.c
rename to trusty/keymaster/trusty_keymaster_ipc.cpp
index 88546af..cdc2778 100644
--- a/trusty/keymaster/trusty_keymaster_ipc.c
+++ b/trusty/keymaster/trusty_keymaster_ipc.cpp
@@ -26,8 +26,8 @@
 #include <log/log.h>
 #include <trusty/tipc.h>
 
-#include "trusty_keymaster_ipc.h"
 #include "keymaster_ipc.h"
+#include "trusty_keymaster_ipc.h"
 
 #define TRUSTY_DEVICE_NAME "/dev/trusty-ipc-dev0"
 
@@ -43,15 +43,15 @@
     return 0;
 }
 
-int trusty_keymaster_call(uint32_t cmd, void *in, uint32_t in_size, uint8_t *out,
-                          uint32_t *out_size)  {
+int trusty_keymaster_call(uint32_t cmd, void* in, uint32_t in_size, uint8_t* out,
+                          uint32_t* out_size) {
     if (handle_ == 0) {
         ALOGE("not connected\n");
         return -EINVAL;
     }
 
     size_t msg_size = in_size + sizeof(struct keymaster_message);
-    struct keymaster_message *msg = malloc(msg_size);
+    struct keymaster_message* msg = reinterpret_cast<struct keymaster_message*>(malloc(msg_size));
     msg->cmd = cmd;
     memcpy(msg->payload, in, in_size);
 
@@ -59,31 +59,30 @@
     free(msg);
 
     if (rc < 0) {
-        ALOGE("failed to send cmd (%d) to %s: %s\n", cmd,
-                KEYMASTER_PORT, strerror(errno));
+        ALOGE("failed to send cmd (%d) to %s: %s\n", cmd, KEYMASTER_PORT, strerror(errno));
         return -errno;
     }
 
     rc = read(handle_, out, *out_size);
     if (rc < 0) {
-        ALOGE("failed to retrieve response for cmd (%d) to %s: %s\n",
-                cmd, KEYMASTER_PORT, strerror(errno));
+        ALOGE("failed to retrieve response for cmd (%d) to %s: %s\n", cmd, KEYMASTER_PORT,
+              strerror(errno));
         return -errno;
     }
 
-    if ((size_t) rc < sizeof(struct keymaster_message)) {
-        ALOGE("invalid response size (%d)\n", (int) rc);
+    if ((size_t)rc < sizeof(struct keymaster_message)) {
+        ALOGE("invalid response size (%d)\n", (int)rc);
         return -EINVAL;
     }
 
-    msg = (struct keymaster_message *) out;
+    msg = (struct keymaster_message*)out;
 
     if ((cmd | KEYMASTER_RESP_BIT) != msg->cmd) {
         ALOGE("invalid command (%d)", msg->cmd);
         return -EINVAL;
     }
 
-    *out_size = ((size_t) rc) - sizeof(struct keymaster_message);
+    *out_size = ((size_t)rc) - sizeof(struct keymaster_message);
     return rc;
 }
 
@@ -92,4 +91,3 @@
         tipc_close(handle_);
     }
 }
-
diff --git a/trusty/keymaster/trusty_keymaster_ipc.h b/trusty/keymaster/trusty_keymaster_ipc.h
index 9785247..c15f7c1 100644
--- a/trusty/keymaster/trusty_keymaster_ipc.h
+++ b/trusty/keymaster/trusty_keymaster_ipc.h
@@ -14,11 +14,16 @@
  * limitations under the License.
  */
 
+#ifndef TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_IPC_H_
+#define TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_IPC_H_
+
 __BEGIN_DECLS
 
 int trusty_keymaster_connect(void);
-int trusty_keymaster_call(uint32_t cmd, void *in, uint32_t in_size, uint8_t *out,
-         uint32_t *out_size);
+int trusty_keymaster_call(uint32_t cmd, void* in, uint32_t in_size, uint8_t* out,
+                          uint32_t* out_size);
 void trusty_keymaster_disconnect(void);
 
 __END_DECLS
+
+#endif  // TRUSTY_KEYMASTER_TRUSTY_KEYMASTER_IPC_H_
diff --git a/trusty/keymaster/trusty_keymaster_main.cpp b/trusty/keymaster/trusty_keymaster_main.cpp
index 7ed880e..9c2ae2d 100644
--- a/trusty/keymaster/trusty_keymaster_main.cpp
+++ b/trusty/keymaster/trusty_keymaster_main.cpp
@@ -14,7 +14,10 @@
  * limitations under the License.
  */
 
+#include <keymaster/keymaster_configuration.h>
+
 #include <stdio.h>
+#include <memory>
 
 #include <openssl/evp.h>
 #include <openssl/x509.h>
@@ -102,6 +105,28 @@
     0xd1, 0x1f, 0xd4, 0x49, 0x49, 0xe0, 0xb2, 0x18, 0x3b, 0xfe};
 unsigned int ec_privkey_pk8_der_len = 138;
 
+keymaster_key_param_t ec_params[] = {
+    keymaster_param_enum(KM_TAG_ALGORITHM, KM_ALGORITHM_EC),
+    keymaster_param_long(KM_TAG_EC_CURVE, KM_EC_CURVE_P_521),
+    keymaster_param_enum(KM_TAG_PURPOSE, KM_PURPOSE_SIGN),
+    keymaster_param_enum(KM_TAG_PURPOSE, KM_PURPOSE_VERIFY),
+    keymaster_param_enum(KM_TAG_DIGEST, KM_DIGEST_NONE),
+    keymaster_param_bool(KM_TAG_NO_AUTH_REQUIRED),
+};
+keymaster_key_param_set_t ec_param_set = {ec_params, sizeof(ec_params) / sizeof(*ec_params)};
+
+keymaster_key_param_t rsa_params[] = {
+    keymaster_param_enum(KM_TAG_ALGORITHM, KM_ALGORITHM_RSA),
+    keymaster_param_int(KM_TAG_KEY_SIZE, 1024),
+    keymaster_param_long(KM_TAG_RSA_PUBLIC_EXPONENT, 65537),
+    keymaster_param_enum(KM_TAG_PURPOSE, KM_PURPOSE_SIGN),
+    keymaster_param_enum(KM_TAG_PURPOSE, KM_PURPOSE_VERIFY),
+    keymaster_param_enum(KM_TAG_PADDING, KM_PAD_NONE),
+    keymaster_param_enum(KM_TAG_DIGEST, KM_DIGEST_NONE),
+    keymaster_param_bool(KM_TAG_NO_AUTH_REQUIRED),
+};
+keymaster_key_param_set_t rsa_param_set = {rsa_params, sizeof(rsa_params) / sizeof(*rsa_params)};
+
 struct EVP_PKEY_Delete {
     void operator()(EVP_PKEY* p) const { EVP_PKEY_free(p); }
 };
@@ -110,41 +135,70 @@
     void operator()(EVP_PKEY_CTX* p) { EVP_PKEY_CTX_free(p); }
 };
 
+static bool do_operation(TrustyKeymasterDevice* device, keymaster_purpose_t purpose,
+                         keymaster_key_blob_t* key, keymaster_blob_t* input,
+                         keymaster_blob_t* signature, keymaster_blob_t* output) {
+    keymaster_key_param_t params[] = {
+        keymaster_param_enum(KM_TAG_PADDING, KM_PAD_NONE),
+        keymaster_param_enum(KM_TAG_DIGEST, KM_DIGEST_NONE),
+    };
+    keymaster_key_param_set_t param_set = {params, sizeof(params) / sizeof(*params)};
+    keymaster_operation_handle_t op_handle;
+    keymaster_error_t error = device->begin(purpose, key, &param_set, nullptr, &op_handle);
+    if (error != KM_ERROR_OK) {
+        printf("Keymaster begin() failed: %d\n", error);
+        return false;
+    }
+    size_t input_consumed;
+    error = device->update(op_handle, nullptr, input, &input_consumed, nullptr, nullptr);
+    if (error != KM_ERROR_OK) {
+        printf("Keymaster update() failed: %d\n", error);
+        return false;
+    }
+    if (input_consumed != input->data_length) {
+        // This should never happen. If it does, it's a bug in the keymaster implementation.
+        printf("Keymaster update() did not consume all data.\n");
+        device->abort(op_handle);
+        return false;
+    }
+    error = device->finish(op_handle, nullptr, nullptr, signature, nullptr, output);
+    if (error != KM_ERROR_OK) {
+        printf("Keymaster finish() failed: %d\n", error);
+        return false;
+    }
+    return true;
+}
+
 static bool test_import_rsa(TrustyKeymasterDevice* device) {
     printf("===================\n");
     printf("= RSA Import Test =\n");
     printf("===================\n\n");
 
     printf("=== Importing RSA keypair === \n");
-    uint8_t* key;
-    size_t size;
-    int error = device->import_keypair(rsa_privkey_pk8_der, rsa_privkey_pk8_der_len, &key, &size);
+    keymaster_key_blob_t key;
+    keymaster_blob_t private_key = {rsa_privkey_pk8_der, rsa_privkey_pk8_der_len};
+    int error = device->import_key(&rsa_param_set, KM_KEY_FORMAT_PKCS8, &private_key, &key, nullptr);
     if (error != KM_ERROR_OK) {
-        printf("Error importing key pair: %d\n\n", error);
+        printf("Error importing RSA key: %d\n\n", error);
         return false;
     }
-    UniquePtr<uint8_t[]> key_deleter(key);
+    std::unique_ptr<const uint8_t[]> key_deleter(key.key_material);
 
     printf("=== Signing with imported RSA key ===\n");
-    keymaster_rsa_sign_params_t sign_params = {DIGEST_NONE, PADDING_NONE};
     size_t message_len = 1024 / 8;
-    UniquePtr<uint8_t[]> message(new uint8_t[message_len]);
+    std::unique_ptr<uint8_t[]> message(new uint8_t[message_len]);
     memset(message.get(), 'a', message_len);
-    uint8_t* signature;
-    size_t signature_len;
-    error = device->sign_data(&sign_params, key, size, message.get(), message_len, &signature,
-                              &signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error signing data with imported RSA key: %d\n\n", error);
+    keymaster_blob_t input = {message.get(), message_len}, signature;
+
+    if (!do_operation(device, KM_PURPOSE_SIGN, &key, &input, nullptr, &signature)) {
+        printf("Error signing data with imported RSA key\n\n");
         return false;
     }
-    UniquePtr<uint8_t[]> signature_deleter(signature);
+    std::unique_ptr<const uint8_t[]> signature_deleter(signature.data);
 
     printf("=== Verifying with imported RSA key === \n");
-    error = device->verify_data(&sign_params, key, size, message.get(), message_len, signature,
-                                signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error verifying data with imported RSA key: %d\n\n", error);
+    if (!do_operation(device, KM_PURPOSE_VERIFY, &key, &input, &signature, nullptr)) {
+        printf("Error verifying data with imported RSA key\n\n");
         return false;
     }
 
@@ -158,67 +212,58 @@
     printf("============\n\n");
 
     printf("=== Generating RSA key pair ===\n");
-    keymaster_rsa_keygen_params_t params;
-    params.public_exponent = 65537;
-    params.modulus_size = 2048;
-
-    uint8_t* key;
-    size_t size;
-    int error = device->generate_keypair(TYPE_RSA, &params, &key, &size);
+    keymaster_key_blob_t key;
+    int error = device->generate_key(&rsa_param_set, &key, nullptr);
     if (error != KM_ERROR_OK) {
         printf("Error generating RSA key pair: %d\n\n", error);
         return false;
     }
-    UniquePtr<uint8_t[]> deleter(key);
+    std::unique_ptr<const uint8_t[]> key_deleter(key.key_material);
 
     printf("=== Signing with RSA key === \n");
-    keymaster_rsa_sign_params_t sign_params = {DIGEST_NONE, PADDING_NONE};
-    size_t message_len = params.modulus_size / 8;
-    UniquePtr<uint8_t[]> message(new uint8_t[message_len]);
+    size_t message_len = 1024 / 8;
+    std::unique_ptr<uint8_t[]> message(new uint8_t[message_len]);
     memset(message.get(), 'a', message_len);
-    uint8_t* signature;
-    size_t signature_len;
-    error = device->sign_data(&sign_params, key, size, message.get(), message_len, &signature,
-                              &signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error signing data with RSA key: %d\n\n", error);
+    keymaster_blob_t input = {message.get(), message_len}, signature;
+
+    if (!do_operation(device, KM_PURPOSE_SIGN, &key, &input, nullptr, &signature)) {
+        printf("Error signing data with RSA key\n\n");
         return false;
     }
-    UniquePtr<uint8_t[]> signature_deleter(signature);
+    std::unique_ptr<const uint8_t[]> signature_deleter(signature.data);
 
     printf("=== Verifying with RSA key === \n");
-    error = device->verify_data(&sign_params, key, size, message.get(), message_len, signature,
-                                signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error verifying data with RSA key: %d\n\n", error);
+    if (!do_operation(device, KM_PURPOSE_VERIFY, &key, &input, &signature, nullptr)) {
+        printf("Error verifying data with RSA key\n\n");
         return false;
     }
 
     printf("=== Exporting RSA public key ===\n");
-    uint8_t* exported_key;
-    size_t exported_size;
-    error = device->get_keypair_public(key, size, &exported_key, &exported_size);
+    keymaster_blob_t exported_key;
+    error = device->export_key(KM_KEY_FORMAT_X509, &key, nullptr, nullptr, &exported_key);
     if (error != KM_ERROR_OK) {
         printf("Error exporting RSA public key: %d\n\n", error);
         return false;
     }
 
     printf("=== Verifying with exported key ===\n");
-    const uint8_t* tmp = exported_key;
-    UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(d2i_PUBKEY(NULL, &tmp, exported_size));
-    UniquePtr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx(EVP_PKEY_CTX_new(pkey.get(), NULL));
+    const uint8_t* tmp = exported_key.data;
+    std::unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey(
+        d2i_PUBKEY(NULL, &tmp, exported_key.data_length));
+    std::unique_ptr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx(EVP_PKEY_CTX_new(pkey.get(), NULL));
     if (EVP_PKEY_verify_init(ctx.get()) != 1) {
-        printf("Error initializing openss EVP context\n");
+        printf("Error initializing openss EVP context\n\n");
         return false;
     }
     if (EVP_PKEY_type(pkey->type) != EVP_PKEY_RSA) {
-        printf("Exported key was the wrong type?!?\n");
+        printf("Exported key was the wrong type?!?\n\n");
         return false;
     }
 
     EVP_PKEY_CTX_set_rsa_padding(ctx.get(), RSA_NO_PADDING);
-    if (EVP_PKEY_verify(ctx.get(), signature, signature_len, message.get(), message_len) != 1) {
-        printf("Verification with exported pubkey failed.\n");
+    if (EVP_PKEY_verify(ctx.get(), signature.data, signature.data_length, message.get(),
+                        message_len) != 1) {
+        printf("Verification with exported pubkey failed.\n\n");
         return false;
     } else {
         printf("Verification succeeded\n");
@@ -234,35 +279,31 @@
     printf("=====================\n\n");
 
     printf("=== Importing ECDSA keypair === \n");
-    uint8_t* key;
-    size_t size;
-    int error = device->import_keypair(ec_privkey_pk8_der, ec_privkey_pk8_der_len, &key, &size);
+    keymaster_key_blob_t key;
+    keymaster_blob_t private_key = {ec_privkey_pk8_der, ec_privkey_pk8_der_len};
+    int error = device->import_key(&ec_param_set, KM_KEY_FORMAT_PKCS8, &private_key, &key, nullptr);
     if (error != KM_ERROR_OK) {
-        printf("Error importing key pair: %d\n\n", error);
+        printf("Error importing ECDSA key: %d\n\n", error);
         return false;
     }
-    UniquePtr<uint8_t[]> deleter(key);
+    std::unique_ptr<const uint8_t[]> deleter(key.key_material);
 
     printf("=== Signing with imported ECDSA key ===\n");
     keymaster_ec_sign_params_t sign_params = {DIGEST_NONE};
     size_t message_len = 30 /* arbitrary */;
-    UniquePtr<uint8_t[]> message(new uint8_t[message_len]);
+    std::unique_ptr<uint8_t[]> message(new uint8_t[message_len]);
     memset(message.get(), 'a', message_len);
-    uint8_t* signature;
-    size_t signature_len;
-    error = device->sign_data(&sign_params, key, size, message.get(), message_len, &signature,
-                              &signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error signing data with imported ECDSA key: %d\n\n", error);
+    keymaster_blob_t input = {message.get(), message_len}, signature;
+
+    if (!do_operation(device, KM_PURPOSE_SIGN, &key, &input, nullptr, &signature)) {
+        printf("Error signing data with imported ECDSA key\n\n");
         return false;
     }
-    UniquePtr<uint8_t[]> signature_deleter(signature);
+    std::unique_ptr<const uint8_t[]> signature_deleter(signature.data);
 
     printf("=== Verifying with imported ECDSA key === \n");
-    error = device->verify_data(&sign_params, key, size, message.get(), message_len, signature,
-                                signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error verifying data with imported ECDSA key: %d\n\n", error);
+    if (!do_operation(device, KM_PURPOSE_VERIFY, &key, &input, &signature, nullptr)) {
+        printf("Error verifying data with imported ECDSA key\n\n");
         return false;
     }
 
@@ -276,64 +317,57 @@
     printf("==============\n\n");
 
     printf("=== Generating ECDSA key pair ===\n");
-    keymaster_ec_keygen_params_t params;
-    params.field_size = 521;
-    uint8_t* key;
-    size_t size;
-    int error = device->generate_keypair(TYPE_EC, &params, &key, &size);
-    if (error != 0) {
+    keymaster_key_blob_t key;
+    int error = device->generate_key(&ec_param_set, &key, nullptr);
+    if (error != KM_ERROR_OK) {
         printf("Error generating ECDSA key pair: %d\n\n", error);
         return false;
     }
-    UniquePtr<uint8_t[]> deleter(key);
+    std::unique_ptr<const uint8_t[]> key_deleter(key.key_material);
 
     printf("=== Signing with ECDSA key === \n");
-    keymaster_ec_sign_params_t sign_params = {DIGEST_NONE};
     size_t message_len = 30 /* arbitrary */;
-    UniquePtr<uint8_t[]> message(new uint8_t[message_len]);
+    std::unique_ptr<uint8_t[]> message(new uint8_t[message_len]);
     memset(message.get(), 'a', message_len);
-    uint8_t* signature;
-    size_t signature_len;
-    error = device->sign_data(&sign_params, key, size, message.get(), message_len, &signature,
-                              &signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error signing data with ECDSA key: %d\n\n", error);
+    keymaster_blob_t input = {message.get(), message_len}, signature;
+
+    if (!do_operation(device, KM_PURPOSE_SIGN, &key, &input, nullptr, &signature)) {
+        printf("Error signing data with ECDSA key\n\n");
         return false;
     }
-    UniquePtr<uint8_t[]> signature_deleter(signature);
+    std::unique_ptr<const uint8_t[]> signature_deleter(signature.data);
 
     printf("=== Verifying with ECDSA key === \n");
-    error = device->verify_data(&sign_params, key, size, message.get(), message_len, signature,
-                                signature_len);
-    if (error != KM_ERROR_OK) {
-        printf("Error verifying data with ECDSA key: %d\n\n", error);
+    if (!do_operation(device, KM_PURPOSE_VERIFY, &key, &input, &signature, nullptr)) {
+        printf("Error verifying data with ECDSA key\n\n");
         return false;
     }
 
     printf("=== Exporting ECDSA public key ===\n");
-    uint8_t* exported_key;
-    size_t exported_size;
-    error = device->get_keypair_public(key, size, &exported_key, &exported_size);
+    keymaster_blob_t exported_key;
+    error = device->export_key(KM_KEY_FORMAT_X509, &key, nullptr, nullptr, &exported_key);
     if (error != KM_ERROR_OK) {
         printf("Error exporting ECDSA public key: %d\n\n", error);
         return false;
     }
 
     printf("=== Verifying with exported key ===\n");
-    const uint8_t* tmp = exported_key;
-    UniquePtr<EVP_PKEY, EVP_PKEY_Delete> pkey(d2i_PUBKEY(NULL, &tmp, exported_size));
-    UniquePtr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx(EVP_PKEY_CTX_new(pkey.get(), NULL));
+    const uint8_t* tmp = exported_key.data;
+    std::unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey(
+        d2i_PUBKEY(NULL, &tmp, exported_key.data_length));
+    std::unique_ptr<EVP_PKEY_CTX, EVP_PKEY_CTX_Delete> ctx(EVP_PKEY_CTX_new(pkey.get(), NULL));
     if (EVP_PKEY_verify_init(ctx.get()) != 1) {
-        printf("Error initializing openss EVP context\n");
+        printf("Error initializing openssl EVP context\n\n");
         return false;
     }
     if (EVP_PKEY_type(pkey->type) != EVP_PKEY_EC) {
-        printf("Exported key was the wrong type?!?\n");
+        printf("Exported key was the wrong type?!?\n\n");
         return false;
     }
 
-    if (EVP_PKEY_verify(ctx.get(), signature, signature_len, message.get(), message_len) != 1) {
-        printf("Verification with exported pubkey failed.\n");
+    if (EVP_PKEY_verify(ctx.get(), signature.data, signature.data_length, message.get(),
+                        message_len) != 1) {
+        printf("Verification with exported pubkey failed.\n\n");
         return false;
     } else {
         printf("Verification succeeded\n");
@@ -344,8 +378,8 @@
 }
 
 int main(void) {
-
     TrustyKeymasterDevice device(NULL);
+    keymaster::ConfigureDevice(reinterpret_cast<keymaster2_device_t*>(&device));
     if (device.session_error() != KM_ERROR_OK) {
         printf("Failed to initialize Trusty session: %d\n", device.session_error());
         return 1;