Snap for 8564071 from cae413c97b4b9c533508c1daf349d9cd51889f72 to mainline-os-statsd-releaseaml_sta_331910000aml_sta_331811000aml_sta_331711010aml_sta_331610000aml_sta_331511000aml_sta_331410000aml_sta_331311000aml_sta_331010010aml_sta_330910000android13-mainline-os-statsd-release

Change-Id: Idf45e5f32c069d7b2a1a2ffabe65b0179c6d9c73

19 files changed, 609 insertions, 19 deletions

diff --git a/Android.bp b/Android.bp
new file mode 100644
index 0000000..0574832
--- /dev/null
+++ b/Android.bp
@@ -0,0 +1,35 @@
+//
+// Copyright (C) 2021 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["device_generic_trusty_license"],
+}
+
+// Added automatically by a large-scale-change
+// See: http://go/android-license-faq
+license {
+    name: "device_generic_trusty_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+    ],
+    // large-scale-change unable to identify any license_text files
+}
+
+prebuilt_etc {
+    name: "keymaster_soft_wrapped_attestation_keys.xml",
+    vendor: true,
+    src: "keymaster_soft_wrapped_attestation_keys.xml",
+}
diff --git a/Android.mk b/Android.mk
new file mode 100644
index 0000000..16cd238
--- /dev/null
+++ b/Android.mk
@@ -0,0 +1 @@
+$(eval $(call declare-1p-copy-files,device/generic/trusty,))
diff --git a/BoardConfig.mk b/BoardConfig.mk
index d39346e..903cb3d 100644
--- a/BoardConfig.mk
+++ b/BoardConfig.mk
@@ -40,11 +40,11 @@ QEMU_CUSTOMIZATIONS := true
 
 TARGET_USERIMAGES_USE_EXT4 := true
 BOARD_SYSTEMIMAGE_PARTITION_SIZE := 536870912 # 512M
-BOARD_USERDATAIMAGE_PARTITION_SIZE := 67108864 # 64M
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 134217728 # 128M
 TARGET_COPY_OUT_VENDOR := vendor
 # ~100 MB vendor image. Please adjust system image / vendor image sizes
 # when finalizing them.
-BOARD_VENDORIMAGE_PARTITION_SIZE := 4194304 # 4M
+BOARD_VENDORIMAGE_PARTITION_SIZE := 8388608 # 8M
 BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_FLASH_BLOCK_SIZE := 512
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
@@ -59,3 +59,6 @@ BOARD_BUILD_SYSTEM_ROOT_IMAGE := true
 
 # Specify HALs
 DEVICE_MANIFEST_FILE := device/generic/trusty/manifest.xml
+
+# Enable full VNDK support
+BOARD_VNDK_VERSION := current
diff --git a/METADATA b/METADATA
new file mode 100644
index 0000000..d97975c
--- /dev/null
+++ b/METADATA
@@ -0,0 +1,3 @@
+third_party {
+  license_type: NOTICE
+}
diff --git a/keymaster_soft_wrapped_attestation_keys.xml b/keymaster_soft_wrapped_attestation_keys.xml
new file mode 100644
index 0000000..8a7b75b
--- /dev/null
+++ b/keymaster_soft_wrapped_attestation_keys.xml
@@ -0,0 +1,110 @@
+<?xml version="1.0"?>
+<AndroidAttestation>
+  <NumberOfKeyboxes>10</NumberOfKeyboxes>
+  <Keybox DeviceID="dev1">
+    <Key algorithm="rsa">
+      <PrivateKey format="iecs">
+csBAH0BDQkDDw0KCwWGeFMpZ+nJiK7fyxyOErPw9R6C36gBGyPzJBfw0vOywHrDZaLhwQlZUQwDb
+y+MdjYTDHPEhGn5tkLBJptpwwZ/DCVSVo8cDOKcI/msoeC/3gkZKeSqHFIOyYXvTJlvEDxL1DwLs
+iAoONXcuyxhOZRj97gvfHz9hILDeHECqM0BBQ0JDQMPDQvzESUnb6kDkuVgbAcg59VdEGUvhL4Sr
+iI4psYJudpWV3NaEIiZqms45PSc1g4+oJkUI/MwwxJ1dSlOe1WpkSiqc15FsvtT0ksa9ZVgdIpy+
+hUGl4cwsa/jYfh2AgMI09OrU7V92lcpqjNmf87EN3tZGAUXDa8xiUVQwGf/+23gDQANCo4SbZSYu
+S1SudMAvGwvBNk5js/I2huPn2iWEKzsex5GeBA4Z0NzW/fEMT44SVvNNUXZY9b+XtEZWkOFkiJZe
+h0ADQpgKG9U6HpchTfK/zhAWu8wRzFraeOzcKTwoGDkfdnUX+2PM/wJwT2p6PzrdNLhjyY5vySrn
+tAPN+a7nVdjx7f9AAhK8vnAm1xsjLJQRDFcHS3Df0eGaUpmn//vAa261yZr4mcJi7M8VtvVfR3ot
+vNzf8DOIdjXhC9uZNLqnrquClt9AAlf1DrA+jL3J8SmyD9/BBPLYbTKQtgHZTWTuPEG1q5O1PwnT
+HZDZamGyeIkfEEKixz2w6kGrfKzUlGEeqxYA/mNAA0LS5QeYyzLwjybUInAAaoe6ahS9lCf42MeK
+lE1ZyawzPI9uMKiiX+/E+DQWlo0H7/ezsPFf3cNgjeez5xVN2W9nGw==
+      </PrivateKey>
+      <CertificateChain>
+        <NumberOfCertificates>2</NumberOfCertificates>
+        <Certificate format="pem">
+-----BEGIN CERTIFICATE-----
+MIICtjCCAh+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwYzELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFTAT
+BgNVBAoMDEdvb2dsZSwgSW5jLjEQMA4GA1UECwwHQW5kcm9pZDAeFw0xNjAxMDQx
+MjQwNTNaFw0zNTEyMzAxMjQwNTNaMHYxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD
+YWxpZm9ybmlhMRUwEwYDVQQKDAxHb29nbGUsIEluYy4xEDAOBgNVBAsMB0FuZHJv
+aWQxKTAnBgNVBAMMIEFuZHJvaWQgU29mdHdhcmUgQXR0ZXN0YXRpb24gS2V5MIGf
+MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAgyPcVogbuDAgafWwhWHG7r5/BeL1
+qEIEir6LR752/q7yXPKbKvoyABQWAUKZiaFfz8aBXrNjWDwv0vIL5Jgyg92BSxbX
+4YVBeuVKvClqOm21wAQIO2jFVsHwIzmRZBmGTVC3TUCuykhMdzVsiVoMJ1q/rEmd
+XX0jYvKcXgLocQIDAQABo2YwZDAdBgNVHQ4EFgQU1AwQG/jNY7n3OVK1DhNcpteZ
+k4YwHwYDVR0jBBgwFoAUKfrxrMxN0kyWQCd1trDpMuUH/i4wEgYDVR0TAQH/BAgw
+BgEB/wIBADAOBgNVHQ8BAf8EBAMCAoQwDQYJKoZIhvcNAQELBQADgYEAni1IX4xn
+M9waha2Z11Aj6hTsQ7DhnerCI0YecrUZ3GAi5KVoMWwLVcTmnKItnzpPk2sxixZ4
+Fg2Iy9mLzICdhPDCJ+NrOPH90ecXcjFZNX2W88V/q52PlmEmT7K+gbsNSQQiis6f
+9/VCLiVE+iEHElqDtVWtGIL4QBSbnCBjBH8=
+-----END CERTIFICATE-----
+        </Certificate>
+        <Certificate format="pem">
+-----BEGIN CERTIFICATE-----
+MIICpzCCAhCgAwIBAgIJAP+U2d2fB8gMMA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBW
+aWV3MRUwEwYDVQQKDAxHb29nbGUsIEluYy4xEDAOBgNVBAsMB0FuZHJvaWQwHhcN
+MTYwMTA0MTIzMTA4WhcNMzUxMjMwMTIzMTA4WjBjMQswCQYDVQQGEwJVUzETMBEG
+A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzEVMBMGA1UE
+CgwMR29vZ2xlLCBJbmMuMRAwDgYDVQQLDAdBbmRyb2lkMIGfMA0GCSqGSIb3DQEB
+AQUAA4GNADCBiQKBgQCia63rbi5EYe/VDoLmt5TRdSMfd5tjkWP/96r/C3JHTsAs
+Q+wzfNes7UA+jCigZtX3hwszl94OuE4TQKuvpSe/lWmgMdsGUmX4RFlXYfC78hdL
+t0GAZMAoDo9Sd47b0ke2RekZyOmLw9vCkT/X11DEHTVm+Vfkl5YLCazOkjWFmwID
+AQABo2MwYTAdBgNVHQ4EFgQUKfrxrMxN0kyWQCd1trDpMuUH/i4wHwYDVR0jBBgw
+FoAUKfrxrMxN0kyWQCd1trDpMuUH/i4wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8B
+Af8EBAMCAoQwDQYJKoZIhvcNAQELBQADgYEAT3LzNlmNDsG5dFsxWfbwjSVJMJ6j
+HBwp0kUtILlNX2S06IDHeHqcOd6os/W/L3BfRxBcxebrTQaZYdKumgf/93y4q+uc
+DyQHXrF/unlx/U1bnt8Uqf7f7XzAiF343ZtkMlbVNZriE/mPzsF83O+kqrJVw4Op
+Lvtc9mL1J1IXvmM=
+-----END CERTIFICATE-----
+        </Certificate>
+      </CertificateChain>
+    </Key>
+  </Keybox>
+  <Keybox DeviceID="dev1">
+    <Key algorithm="ecdsa">
+      <PrivateKey format="iecs">
+cjVAQ0NGYmOixAFoV1vGG410eBK+VouY77t3t2WAnZVcDy/+AKcG4khESmjECox/QUNF4wZBAEJG
+qdw7ugAhG+6JaNMOy8SOMu/SJNHA6zFkUbzuibpjZQ5jNtUIaLzn+w89JJaiJ1Ikd/4R9eLh5DMa
+fJl8U+xSVik=
+      </PrivateKey>
+      <CertificateChain>
+        <NumberOfCertificates>2</NumberOfCertificates>
+        <Certificate format="pem">
+-----BEGIN CERTIFICATE-----
+MIICeDCCAh6gAwIBAgICEAEwCgYIKoZIzj0EAwIwgZgxCzAJBgNVBAYTAlVTMRMw
+EQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1Nb3VudGFpbiBWaWV3MRUwEwYD
+VQQKDAxHb29nbGUsIEluYy4xEDAOBgNVBAsMB0FuZHJvaWQxMzAxBgNVBAMMKkFu
+ZHJvaWQgS2V5c3RvcmUgU29mdHdhcmUgQXR0ZXN0YXRpb24gUm9vdDAeFw0xNjAx
+MTEwMDQ2MDlaFw0yNjAxMDgwMDQ2MDlaMIGIMQswCQYDVQQGEwJVUzETMBEGA1UE
+CAwKQ2FsaWZvcm5pYTEVMBMGA1UECgwMR29vZ2xlLCBJbmMuMRAwDgYDVQQLDAdB
+bmRyb2lkMTswOQYDVQQDDDJBbmRyb2lkIEtleXN0b3JlIFNvZnR3YXJlIEF0dGVz
+dGF0aW9uIEludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABOue
+efhCY1msyyqRTImGzHCtkGaTgqlzJhP+rMv4ISdMIXSXSir+pblNf2bU4GUQZjW8
+U7ego6ZxWD7bPhGuEBSjZjBkMB0GA1UdDgQWBBQ//KzWGrE6noEguNUlHMVlux6R
+qTAfBgNVHSMEGDAWgBTIrel3TEXDo88NFhDkeUM6IVowzzASBgNVHRMBAf8ECDAG
+AQH/AgEAMA4GA1UdDwEB/wQEAwIChDAKBggqhkjOPQQDAgNIADBFAiBLipt77oK8
+wDOHri/AiZi03cONqycqRZ9pDMfDktQPjgIhAO7aAV229DLp1IQ7YkyUBO86fMy9
+Xvsiu+f+uXc/WT/7
+-----END CERTIFICATE-----
+        </Certificate>
+        <Certificate format="pem">
+-----BEGIN CERTIFICATE-----
+MIICizCCAjKgAwIBAgIJAKIFntEOQ1tXMAoGCCqGSM49BAMCMIGYMQswCQYDVQQG
+EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNTW91bnRhaW4gVmll
+dzEVMBMGA1UECgwMR29vZ2xlLCBJbmMuMRAwDgYDVQQLDAdBbmRyb2lkMTMwMQYD
+VQQDDCpBbmRyb2lkIEtleXN0b3JlIFNvZnR3YXJlIEF0dGVzdGF0aW9uIFJvb3Qw
+HhcNMTYwMTExMDA0MzUwWhcNMzYwMTA2MDA0MzUwWjCBmDELMAkGA1UEBhMCVVMx
+EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxFTAT
+BgNVBAoMDEdvb2dsZSwgSW5jLjEQMA4GA1UECwwHQW5kcm9pZDEzMDEGA1UEAwwq
+QW5kcm9pZCBLZXlzdG9yZSBTb2Z0d2FyZSBBdHRlc3RhdGlvbiBSb290MFkwEwYH
+KoZIzj0CAQYIKoZIzj0DAQcDQgAE7l1ex+HA220Dpn7mthvsTWpdamguD/9/SQ59
+dx9EIm29sa/6FsvHrcV30lacqrewLVQBXT5DKyqO107sSHVBpKNjMGEwHQYDVR0O
+BBYEFMit6XdMRcOjzw0WEOR5QzohWjDPMB8GA1UdIwQYMBaAFMit6XdMRcOjzw0W
+EOR5QzohWjDPMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgKEMAoGCCqG
+SM49BAMCA0cAMEQCIDUho++LNEYenNVg8x1YiSBq3KNlQfYNns6KGYxmSGB7AiBN
+C/NR2TB8fVvaNTQdqEcbY6WFZTytTySn502vQX3xvw==
+-----END CERTIFICATE-----
+        </Certificate>
+      </CertificateChain>
+    </Key>
+  </Keybox>
+</AndroidAttestation>
diff --git a/qemu_trusty_base.mk b/qemu_trusty_base.mk
index f5f21f3..c3ac377 100644
--- a/qemu_trusty_base.mk
+++ b/qemu_trusty_base.mk
@@ -18,11 +18,17 @@
 # it supports a few Android virtual devices. Note that this is _not_ the
 # same as running under the Android emulator.
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/default_art_config.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
+
 PRODUCT_SOONG_NAMESPACES += device/generic/goldfish
 
 PRODUCT_PACKAGES += \
     com.android.adbd \
+    adbd_system_api \
+    android.hardware.confirmationui@1.0-service.trusty \
     android.hidl.allocator@1.0-service \
+    android.system.suspend@1.0-service \
     apexd \
     com.android.art \
     com.android.i18n \
@@ -33,22 +39,29 @@ PRODUCT_PACKAGES += \
     init_system \
     init_vendor \
     init.environ.rc \
+    keymaster_soft_wrapped_attestation_keys.xml \
+    libandroid_servers \
     libc.bootstrap \
     libdl.bootstrap \
     libdl_android.bootstrap \
     libm.bootstrap \
     linker \
     linker64 \
+    linkerconfig \
     logcat \
     logd \
     logwrapper \
+    mediaserver \
     mdnsd \
+    odsign \
     reboot \
+    securedpud \
     servicemanager \
     sh \
     su \
     toolbox \
     toybox \
+    vdc \
     vndservicemanager \
     vold \
 
@@ -59,6 +72,16 @@ PRODUCT_PACKAGES += \
     vendor_compatibility_matrix.xml \
     vendor_manifest.xml \
 
+# Devices that inherit from build/make/target/product/base.mk always have
+# /system/system_ext/etc/vintf/manifest.xml generated. And build-time VINTF
+# checks assume that. Since we don't inherit from base.mk, add the dependency
+# here manually.
+PRODUCT_PACKAGES += \
+    system_ext_manifest.xml \
+
+# Skip VINTF checks for kernel configs
+PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := false
+
 # Ensure boringssl NIAP check won't reboot us
 PRODUCT_PACKAGES += \
     com.android.conscrypt \
@@ -73,7 +96,6 @@ PRODUCT_HOST_PACKAGES += \
     adb \
     e2fsdroid \
     make_f2fs \
-    mdnsd \
     mke2fs \
     sload_f2fs \
     toybox \
@@ -87,8 +109,8 @@ PRODUCT_FULL_TREBLE_OVERRIDE := true
 
 PRODUCT_COPY_FILES += \
     device/generic/trusty/fstab.ranchu:root/fstab.qemu_trusty \
-    device/generic/trusty/init.qemu_trusty.rc:root/init.qemu_trusty.rc \
-    device/generic/trusty/ueventd.qemu_trusty.rc:root/ueventd.qemu_trusty.rc \
+    device/generic/trusty/init.qemu_trusty.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.qemu_trusty.rc \
+    device/generic/trusty/ueventd.qemu_trusty.rc:$(TARGET_COPY_OUT_VENDOR)/etc/ueventd.rc \
 
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/data/etc/config.ini:config.ini \
@@ -97,25 +119,16 @@ PRODUCT_COPY_FILES += \
 # for Trusty
 $(call inherit-product, system/core/trusty/trusty-base.mk)
 $(call inherit-product, system/core/trusty/trusty-storage.mk)
+$(call inherit-product, system/core/trusty/trusty-test.mk)
 
 # Test Utilities
 PRODUCT_PACKAGES += \
     tipc-test \
+    libtrusty_metrics_test \
     trusty-ut-ctrl \
+    VtsAidlKeyMintTargetTest \
+    VtsHalConfirmationUIV1_0TargetTest \
     VtsHalGatekeeperV1_0TargetTest \
     VtsHalKeymasterV3_0TargetTest \
     VtsHalKeymasterV4_0TargetTest \
-
-PRODUCT_BOOT_JARS := \
-    $(ART_APEX_JARS) \
-    ext \
-    framework-minus-apex \
-    telephony-common \
-    voip-common \
-    ims-common \
-    android.test.base \
-
-PRODUCT_UPDATABLE_BOOT_JARS := \
-    com.android.conscrypt:conscrypt \
-    com.android.tethering:framework-tethering \
-
+    VtsHalRemotelyProvisionedComponentTargetTest \
diff --git a/secure_dpu/Android.bp b/secure_dpu/Android.bp
new file mode 100644
index 0000000..31088a0
--- /dev/null
+++ b/secure_dpu/Android.bp
@@ -0,0 +1,49 @@
+// Copyright (C) 2020 The Android Open-Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "device_generic_trusty_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: ["device_generic_trusty_license"],
+}
+
+cc_binary {
+    name: "securedpud",
+    vendor: true,
+
+    srcs: [
+        "main.cpp",
+        "EmulatorDPUHandler.cpp",
+    ],
+
+    shared_libs: [
+        "libbase",
+        "libdmabufheap",
+        "libtrusty",
+        "libutils",
+    ],
+
+    header_libs: ["secure_dpu_headers"],
+
+    init_rc: ["securedpud.rc"],
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+}
diff --git a/secure_dpu/DPUHandler.h b/secure_dpu/DPUHandler.h
new file mode 100644
index 0000000..41f8f07
--- /dev/null
+++ b/secure_dpu/DPUHandler.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "trusty/secure_dpu/SecureDpu.h"
+#include <android-base/result.h>
+#include <string>
+#include <trusty/tipc.h>
+
+#include <BufferAllocator/BufferAllocatorWrapper.h>
+
+namespace android {
+namespace trusty {
+namespace secure_dpu {
+
+class DPUHandler {
+  private:
+    static constexpr const int kInvalidFd = -1;
+
+    int dpu_handle_;
+    BufferAllocator* buf_allocator_;
+
+    android::base::Result<void> HandleStartSecureDisplay();
+    android::base::Result<void> HandleStopSecureDisplay();
+    android::base::Result<void> AllocateBuffer(size_t req_buffer_len, size_t* allocated_buffer_len,
+                                               int* buf_fd);
+    android::base::Result<void> HandleAllocateBuffer(const secure_dpu_allocate_buffer_req* req);
+    android::base::Result<void> HandleCmd(const void* in_buf, const size_t in_size);
+
+  public:
+    DPUHandler();
+    ~DPUHandler();
+    android::base::Result<void> Init(std::string device_name);
+    android::base::Result<void> Handle();
+};
+
+}  // namespace secure_dpu
+}  // namespace trusty
+}  // namespace android
diff --git a/secure_dpu/EmulatorDPUHandler.cpp b/secure_dpu/EmulatorDPUHandler.cpp
new file mode 100644
index 0000000..2898bfe
--- /dev/null
+++ b/secure_dpu/EmulatorDPUHandler.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright 2020, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "DPUHandler.h"
+#include "trusty/secure_dpu/SecureDpu.h"
+
+#include <android-base/logging.h>
+#include <errno.h>
+#include <poll.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#include <sys/uio.h>
+#include <unistd.h>
+#include <trusty/tipc.h>
+
+#include <BufferAllocator/BufferAllocatorWrapper.h>
+
+#define countof(arr) (sizeof(arr) / sizeof(arr[0]))
+
+namespace android {
+namespace trusty {
+namespace secure_dpu {
+
+DPUHandler::DPUHandler() : buf_allocator_(nullptr) {}
+
+DPUHandler::~DPUHandler() {
+    tipc_close(dpu_handle_);
+    if (buf_allocator_) {
+        FreeDmabufHeapBufferAllocator(buf_allocator_);
+    }
+}
+
+android::base::Result<void> DPUHandler::Init(std::string device_name) {
+    buf_allocator_ = CreateDmabufHeapBufferAllocator();
+    if (!buf_allocator_) {
+        return base::Error() << "Failed to create buffer allocator";
+    }
+
+    dpu_handle_ = tipc_connect(device_name.c_str(),
+                               SECURE_DPU_PORT_NAME);
+    if (dpu_handle_ < 0) {
+        return base::Error() << "Failed to connect to: " << device_name;
+    }
+    return {};
+}
+
+android::base::Result<void> DPUHandler::HandleStartSecureDisplay() {
+    secure_dpu_resp rsp;
+    rsp.cmd = SECURE_DPU_CMD_START_SECURE_DISPLAY | SECURE_DPU_CMD_RESP_BIT;
+    rsp.status = SECURE_DPU_ERROR_OK;
+
+    auto write_len = write(dpu_handle_, &rsp, sizeof(rsp));
+    if (write_len != sizeof(rsp)) {
+        return base::Error() << "Failed to write command";
+    }
+    return {};
+}
+
+android::base::Result<void> DPUHandler::HandleStopSecureDisplay() {
+    secure_dpu_resp rsp;
+    rsp.cmd = SECURE_DPU_CMD_STOP_SECURE_DISPLAY | SECURE_DPU_CMD_RESP_BIT;
+    rsp.status = SECURE_DPU_ERROR_OK;
+
+    auto write_len = write(dpu_handle_, &rsp, sizeof(rsp));
+    if (write_len != sizeof(rsp)) {
+        return base::Error() << "Failed to write command";
+    }
+    return {};
+}
+
+android::base::Result<void> DPUHandler::AllocateBuffer(size_t req_buffer_len,
+                                                       size_t* allocated_buffer_len, int* buf_fd) {
+    auto dma_buf_fd =
+        DmabufHeapAlloc(buf_allocator_, "system", req_buffer_len, 0, 0 /* legacy align */);
+    if (dma_buf_fd < 0) {
+        return base::Error() << "Failed to allocate buffer."
+                             << " rc = " << dma_buf_fd << " size = " << req_buffer_len;
+    }
+
+    *buf_fd = dma_buf_fd;
+    *allocated_buffer_len = req_buffer_len;
+    return {};
+}
+
+android::base::Result<void>
+DPUHandler::HandleAllocateBuffer(const secure_dpu_allocate_buffer_req* req) {
+    size_t req_buffer_len = static_cast<size_t>(req->buffer_len);
+    LOG(DEBUG) << "Requested buffer length: " << req_buffer_len;
+
+    secure_dpu_resp rsp;
+    secure_dpu_allocate_buffer_resp msg_rsp;
+
+    iovec iov[] = {
+        {
+            .iov_base = &rsp,
+            .iov_len = sizeof(rsp),
+        },
+        {
+            .iov_base = &msg_rsp,
+            .iov_len = sizeof(msg_rsp),
+        },
+    };
+    trusty_shm shm;
+    size_t allocated_buffer_len = 0;
+    int buf_fd = kInvalidFd;
+    auto result = AllocateBuffer(req_buffer_len, &allocated_buffer_len, &buf_fd);
+    if (result.ok()) {
+        rsp.status = SECURE_DPU_ERROR_OK;
+    } else {
+        LOG(ERROR) << result.error();
+        rsp.status = SECURE_DPU_ERROR_FAIL;
+    }
+
+    rsp.cmd = SECURE_DPU_CMD_ALLOCATE_BUFFER | SECURE_DPU_CMD_RESP_BIT;
+
+    msg_rsp.buffer_len = allocated_buffer_len;
+    shm.fd = buf_fd;
+    shm.transfer = TRUSTY_SHARE;
+
+    auto rc = tipc_send(dpu_handle_, iov, countof(iov), &shm, 1);
+    if (buf_fd != kInvalidFd) close(buf_fd);
+    if (rc != sizeof(rsp) + sizeof(msg_rsp)) {
+        return base::Error() << "Failed to do tipc_send: " << rc;
+    }
+    return {};
+}
+
+android::base::Result<void> DPUHandler::HandleCmd(const void* in_buf, const size_t in_size) {
+    if (in_size < sizeof(secure_dpu_req)) {
+        return base::Error() << "Invalid payload";
+    }
+    const secure_dpu_req* req = reinterpret_cast<const secure_dpu_req*>(in_buf);
+    switch (req->cmd) {
+        case SECURE_DPU_CMD_START_SECURE_DISPLAY: {
+            return HandleStartSecureDisplay();
+        }
+        case SECURE_DPU_CMD_STOP_SECURE_DISPLAY: {
+            return HandleStopSecureDisplay();
+        }
+        case SECURE_DPU_CMD_ALLOCATE_BUFFER: {
+            if (in_size != sizeof(secure_dpu_req) + sizeof(secure_dpu_allocate_buffer_req)) {
+                return base::Error() << "Invalid payload";
+            }
+            const secure_dpu_allocate_buffer_req* req_args =
+                reinterpret_cast<const secure_dpu_allocate_buffer_req*>((uint8_t*)in_buf +
+                                                                        sizeof(secure_dpu_req));
+            return HandleAllocateBuffer(req_args);
+        }
+        default:
+            LOG(ERROR) << "Unknown command: " << (uint32_t)req->cmd;
+            return base::Error() << "Unknown command";
+    }
+    return {};
+}
+
+android::base::Result<void> DPUHandler::Handle() {
+    uint8_t in_buf[SECURE_DPU_MAX_MSG_SIZE];
+
+    auto read_len = read(dpu_handle_, in_buf, sizeof(in_buf));
+    if (read_len < 0) {
+        return base::Error() << "Failed to read command";
+    }
+    auto result = HandleCmd(in_buf, read_len);
+    if (!result.ok()) {
+        return base::Error() << "Failed to handle command. "
+                             << "Reason: " << result.error();
+    }
+    return {};
+}
+
+}  // namespace secure_dpu
+}  // namespace trusty
+}  // namespace android
diff --git a/secure_dpu/main.cpp b/secure_dpu/main.cpp
new file mode 100644
index 0000000..dce2eb4
--- /dev/null
+++ b/secure_dpu/main.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/logging.h>
+#include <errno.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <cutils/android_filesystem_config.h>
+
+#include "DPUHandler.h"
+
+static void show_usage_and_exit(int code) {
+    LOG(ERROR) << "usage: securedpud -d <trusty_dev>";
+    exit(code);
+}
+
+static void parse_device_name(int argc, char* argv[], char*& device_name) {
+    static const char* _sopts = "h:d:";
+    static const struct option _lopts[] = {{"help", no_argument, NULL, 'h'},
+                                           {"trusty_dev", required_argument, NULL, 'd'},
+                                           {0, 0, 0, 0}};
+    int opt;
+    int oidx = 0;
+
+    while ((opt = getopt_long(argc, argv, _sopts, _lopts, &oidx)) != -1) {
+        switch (opt) {
+            case 'd':
+                device_name = strdup(optarg);
+                break;
+
+            default:
+                LOG(ERROR) << "unrecognized option: " << opt;
+                show_usage_and_exit(EXIT_FAILURE);
+        }
+    }
+
+    if (device_name == nullptr) {
+        LOG(ERROR) << "missing required argument(s)";
+        show_usage_and_exit(EXIT_FAILURE);
+    }
+
+    LOG(INFO) << "starting securedpud";
+    LOG(INFO) << "trusty dev: " << device_name;
+}
+
+int main(int argc, char* argv[])
+{
+    char* device_name;
+    /* parse arguments */
+    parse_device_name(argc, argv, device_name);
+
+    android::trusty::secure_dpu::DPUHandler dpu_handler;
+    auto rc = dpu_handler.Init(std::string(device_name));
+    if (!rc.ok()) {
+        LOG(ERROR) << rc.error();
+        return EXIT_FAILURE;
+    }
+
+    /* main loop */
+    while (1) {
+        auto result = dpu_handler.Handle();
+        if (!result.ok()) {
+          LOG(ERROR) << result.error();
+        }
+    }
+    LOG(ERROR) << "exiting securedpud loop";
+
+    return EXIT_FAILURE;
+}
diff --git a/secure_dpu/securedpud.rc b/secure_dpu/securedpud.rc
new file mode 100644
index 0000000..86df222
--- /dev/null
+++ b/secure_dpu/securedpud.rc
@@ -0,0 +1,18 @@
+# Copyright (C) 2020 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+service securedpud /vendor/bin/securedpud -d /dev/trusty-ipc-dev0
+    class main
+    user system
+    group system
diff --git a/sepolicy/device.te b/sepolicy/device.te
new file mode 100644
index 0000000..92eda83
--- /dev/null
+++ b/sepolicy/device.te
@@ -0,0 +1 @@
+type logbuffer_device, dev_type;
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 1c80402..ccfee13 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -1,8 +1,14 @@
 /dev/trusty-ipc-dev0                 u:object_r:tee_device:s0
+/dev/trusty-log0                     u:object_r:logbuffer_device:s0
 /dev/vport3p1                        u:object_r:rpmb_virt_device:s0
+/dev/vport3p2                        u:object_r:spi_virt_device:s0
 /vendor/bin/dhcpclient               u:object_r:dhcpclient_exec:s0
+/vendor/bin/securedpud               u:object_r:securedpud_exec:s0
+/vendor/bin/spiproxyd                u:object_r:tee_exec:s0
 /vendor/bin/storageproxyd            u:object_r:tee_exec:s0
 /data/vendor/var/run(/.*)?           u:object_r:varrun_file:s0
 /data/vendor/ss(/.*)?                u:object_r:tee_data_file:s0
+/vendor/bin/hw/android.hardware.confirmationui@1.0-service.trusty       u:object_r:hal_confirmationui_default_exec:s0
 /vendor/bin/hw/android.hardware.gatekeeper@1.0-service.trusty           u:object_r:hal_gatekeeper_default_exec:s0
 /vendor/bin/hw/android.hardware.keymaster@4.0-service.trusty            u:object_r:hal_keymaster_default_exec:s0
+/vendor/bin/hw/android.hardware.security.keymint-service.trusty         u:object_r:hal_keymint_default_exec:s0
diff --git a/sepolicy/hal_confirmationui.te b/sepolicy/hal_confirmationui.te
new file mode 100644
index 0000000..ffded15
--- /dev/null
+++ b/sepolicy/hal_confirmationui.te
@@ -0,0 +1,5 @@
+allow hal_confirmationui ion_device:chr_file rw_file_perms;
+allow hal_confirmationui tee_device:chr_file rw_file_perms;
+
+allow hal_confirmationui input_device:dir r_dir_perms;
+allow hal_confirmationui input_device:chr_file rw_file_perms;
diff --git a/sepolicy/logd.te b/sepolicy/logd.te
new file mode 100644
index 0000000..cc55e20
--- /dev/null
+++ b/sepolicy/logd.te
@@ -0,0 +1,2 @@
+r_dir_file(logd, logbuffer_device)
+allow logd logbuffer_device:chr_file r_file_perms;
diff --git a/sepolicy/securedpud.te b/sepolicy/securedpud.te
new file mode 100644
index 0000000..73fe8de
--- /dev/null
+++ b/sepolicy/securedpud.te
@@ -0,0 +1,8 @@
+type securedpud, domain;
+type securedpud_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(securedpud)
+
+allow securedpud dmabuf_system_heap_device:chr_file r_file_perms;
+allow securedpud ion_device:chr_file rw_file_perms;
+allow securedpud tee_device:chr_file rw_file_perms;
diff --git a/sepolicy/spiproxyd.te b/sepolicy/spiproxyd.te
new file mode 100644
index 0000000..af35110
--- /dev/null
+++ b/sepolicy/spiproxyd.te
@@ -0,0 +1,3 @@
+type spi_virt_device, dev_type;
+
+allow tee spi_virt_device:chr_file { open read write };
diff --git a/sepolicy/storageproxyd.te b/sepolicy/storageproxyd.te
index 578106b..d394b60 100644
--- a/sepolicy/storageproxyd.te
+++ b/sepolicy/storageproxyd.te
@@ -2,3 +2,8 @@ type rpmb_virt_device, dev_type;
 
 allow tee rpmb_virt_device:chr_file { open read write };
 allow tee self:capability { setgid setuid };
+
+allow tee tee_data_file:dir rw_dir_perms;
+
+# Allow storageproxyd access to gsi_public_metadata_file
+read_fstab(tee)
diff --git a/ueventd.qemu_trusty.rc b/ueventd.qemu_trusty.rc
index 0fd832e..7e46bba 100644
--- a/ueventd.qemu_trusty.rc
+++ b/ueventd.qemu_trusty.rc
@@ -1,2 +1,5 @@
+/dev/ion                  0660   system     system
 /dev/vport3p1             0660   system     system
+/dev/vport3p2             0660   system     system
 /dev/trusty-ipc-dev0      0660   system     drmrpc
+/dev/trusty-log0          0660   system     system