diff --git a/hwcrypto/common.h b/hwcrypto/common.h
new file mode 100644
index 0000000..f40b518
--- /dev/null
+++ b/hwcrypto/common.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <compiler.h>
+#include <sys/types.h>
+#include <trusty_std.h>
+
+#define TLOGE(fmt, ...) \
+    fprintf(stderr, "%s: %d: " fmt, LOG_TAG, __LINE__,  ## __VA_ARGS__)
+
+#if LOCAL_TRACE
+#define TLOGI(fmt, ...) \
+    fprintf(stderr, "%s: %d: " fmt, LOG_TAG, __LINE__,  ## __VA_ARGS__)
+#else
+#define TLOGI(fmt, ...)
+#endif
+
+typedef void (*event_handler_proc_t) (const uevent_t *ev, void *ctx);
+
+typedef struct tipc_event_handler {
+	event_handler_proc_t proc;
+	void *priv;
+} tipc_event_handler_t;
+
+
+__BEGIN_CDECLS
+
+/*
+ *  tipc helpers
+ */
+void tipc_handle_port_errors(const uevent_t *ev);
+void tipc_handle_chan_errors(const uevent_t *ev);
+
+int tipc_send_single_buf(handle_t chan, const void *buf, size_t len);
+int tipc_recv_single_buf(handle_t chan, void *buf, size_t len);
+
+int tipc_send_two_segments(handle_t chan, const void *hdr, size_t hdr_len,
+			   const void *payload, size_t payload_len);
+
+int tipc_recv_two_segments(handle_t chan, void *hdr, size_t hdr_len,
+			   void *payload, size_t payload_len);
+
+/*
+ * tipc services
+ */
+int hwrng_setup_service(void);
+int hwkey_setup_service(void);
+
+__END_CDECLS
+
diff --git a/hwcrypto/hwkey_srv.c b/hwcrypto/hwkey_srv.c
new file mode 100644
index 0000000..b0984ae
--- /dev/null
+++ b/hwcrypto/hwkey_srv.c
@@ -0,0 +1,353 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <assert.h>
+#include <compiler.h>
+#include <err.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <trusty_std.h>
+#include <interface/hwkey/hwkey.h>
+
+#include "common.h"
+#include "uuids.h"
+#include "hwkey_srv_priv.h"
+
+#define LOCAL_TRACE  1
+#define LOG_TAG      "hwkey_srv"
+
+#define HWKEY_MAX_PAYLOAD_SIZE 2048
+
+struct hwkey_chan_ctx {
+	tipc_event_handler_t evt_handler;
+	handle_t chan;
+	uuid_t uuid;
+};
+
+static void hwkey_port_handler(const uevent_t *ev, void *priv);
+static void hwkey_chan_handler(const uevent_t *ev, void *priv);
+
+static tipc_event_handler_t hwkey_port_evt_handler = {
+	.proc = hwkey_port_handler,
+};
+
+static uint8_t req_data[HWKEY_MAX_PAYLOAD_SIZE+1];
+static uint8_t key_data[HWKEY_MAX_PAYLOAD_SIZE];
+
+static uint key_slot_cnt;
+static const struct hwkey_keyslot *key_slots;
+
+
+#if WITH_HWCRYPTO_UNITTEST
+/*
+ *  Support for hwcrypto unittest keys should be only enabled
+ *  to test hwcrypto related APIs
+ */
+
+/* UUID of HWCRYPTO_UNITTEST application */
+static const uuid_t hwcrypto_unittest_uuid = HWCRYPTO_UNITTEST_APP_UUID;
+
+static uint8_t _unittest_key32[32] = "unittestkeyslotunittestkeyslotun";
+static uint32_t get_unittest_key32(const struct hwkey_keyslot *slot,
+				   uint8_t *kbuf, size_t kbuf_len, size_t *klen)
+{
+	assert(kbuf);
+	assert(klen);
+	assert(kbuf_len >= sizeof(_unittest_key32));
+
+	/* just return predefined key */
+	memcpy(kbuf, _unittest_key32, sizeof(_unittest_key32));
+	*klen = sizeof(_unittest_key32);
+
+	return HWKEY_NO_ERROR;
+}
+
+static const struct hwkey_keyslot test_key_slots[] = {
+	{
+		.uuid = &hwcrypto_unittest_uuid,
+		.key_id = "com.android.trusty.hwcrypto.unittest.key32",
+		.handler = get_unittest_key32,
+	},
+};
+#endif /* WITH_HWCRYPTO_UNITTEST */
+
+/*
+ * Close specified hwkey context
+ */
+static void hwkey_ctx_close(struct hwkey_chan_ctx *ctx)
+{
+	close(ctx->chan);
+	free(ctx);
+}
+
+/*
+ * Send response message
+ */
+static int hwkey_send_rsp(struct hwkey_chan_ctx *ctx,
+			  struct hwkey_msg *rsp_hdr,
+			  uint8_t *rsp_data, size_t rsp_data_len)
+{
+	rsp_hdr->cmd |= HWKEY_RESP_BIT;
+	return tipc_send_two_segments(ctx->chan,
+				      rsp_hdr, sizeof(*rsp_hdr),
+				      rsp_data, rsp_data_len);
+}
+
+
+static uint32_t _handle_slots(struct hwkey_chan_ctx *ctx,
+			      const char *slot_id,
+			      const struct hwkey_keyslot *slots, uint slot_cnt,
+			      uint8_t *kbuf, size_t kbuf_len, size_t *klen)
+{
+	if (!slots)
+		return HWKEY_ERR_NOT_FOUND;
+
+	for (uint i = 0; i < slot_cnt; i++, slots++) {
+
+		/* check key id */
+		if (strcmp(slots->key_id, slot_id))
+			continue;
+
+		/* Check if the caller is allowed to get that key */
+		if (memcmp(&ctx->uuid, slots->uuid, sizeof(uuid_t)) == 0) {
+			if (slots->handler) {
+				return slots->handler(slots, kbuf, kbuf_len, klen);
+			}
+		}
+	}
+	return HWKEY_ERR_NOT_FOUND;
+}
+
+
+/*
+ * Handle get key slot command
+ */
+static int hwkey_handle_get_keyslot_cmd(struct hwkey_chan_ctx *ctx,
+					struct hwkey_msg *hdr,
+					const char *slot_id)
+{
+	int rc;
+	size_t klen = 0;
+
+	hdr->status = _handle_slots(ctx, slot_id,
+				    key_slots, key_slot_cnt,
+				    key_data,  sizeof(key_data), &klen);
+
+#if WITH_HWCRYPTO_UNITTEST
+	if (hdr->status == HWKEY_ERR_NOT_FOUND) {
+		/* also search test keys */
+		hdr->status  = _handle_slots(ctx, slot_id,
+					     test_key_slots, countof(test_key_slots),
+					     key_data,  sizeof(key_data), &klen);
+	}
+#endif
+
+	rc = hwkey_send_rsp(ctx, hdr, key_data, klen);
+	if (klen) {
+		/* sanitize key buffer */
+		memset(key_data, 0, klen);
+	}
+	return rc;
+}
+
+/*
+ * Handle Derive key cmd
+ */
+static int hwkey_handle_derive_key_cmd(struct hwkey_chan_ctx *ctx,
+				       struct hwkey_msg *hdr,
+				       const uint8_t *ikm_data, size_t ikm_len)
+{
+	int rc;
+	size_t key_len = sizeof(key_data);
+
+	/* check requested key derivation function */
+	if (hdr->arg1 == HWKEY_KDF_VERSION_BEST)
+		hdr->arg1 = HWKEY_KDF_VERSION_1; /* we only support V1 */
+
+	switch (hdr->arg1) {
+	case HWKEY_KDF_VERSION_1:
+		hdr->status = derive_key_v1(&ctx->uuid, ikm_data, ikm_len,
+					    key_data, &key_len);
+		break;
+
+	default:
+		TLOGE("%u is unsupported KDF function\n", hdr->arg1);
+		key_len = 0;
+		hdr->status = HWKEY_ERR_NOT_IMPLEMENTED;
+	}
+
+	rc = hwkey_send_rsp(ctx, hdr, key_data, key_len);
+	if (key_len) {
+		/* sanitize key buffer */
+		memset(key_data, 0, key_len);
+	}
+	return rc;
+}
+
+/*
+ *  Read and queue HWKEY request message
+ */
+static int hwkey_chan_handle_msg(struct hwkey_chan_ctx *ctx)
+{
+	int rc;
+	size_t req_data_len;
+	struct hwkey_msg hdr;
+
+	rc = tipc_recv_two_segments(ctx->chan, &hdr, sizeof(hdr),
+				    req_data, sizeof(req_data) - 1);
+	if (rc < 0) {
+		TLOGE("failed (%d) to recv msg from chan %d\n", rc, ctx->chan);
+		return rc;
+	}
+
+	/* calculate payload length */
+	req_data_len = (size_t)rc - sizeof(hdr);
+
+	/* handle it */
+	switch (hdr.cmd) {
+	case HWKEY_GET_KEYSLOT:
+		req_data[req_data_len] = 0; /* force zero termination */
+		rc = hwkey_handle_get_keyslot_cmd(ctx, &hdr, (const char *)req_data);
+		break;
+
+	case HWKEY_DERIVE:
+		rc = hwkey_handle_derive_key_cmd(ctx, &hdr, req_data, req_data_len);
+		memset(req_data, 0, req_data_len); /* sanitize request buffer */
+		break;
+
+	default:
+		TLOGE("Unsupported request: %d\n", (int)hdr.cmd);
+		hdr.status = HWKEY_ERR_NOT_IMPLEMENTED;
+		rc = hwkey_send_rsp(ctx, &hdr, NULL, 0);
+	}
+
+	return rc;
+}
+
+/*
+ *  HWKEY service channel event handler
+ */
+static void hwkey_chan_handler(const uevent_t *ev, void *priv)
+{
+	struct hwkey_chan_ctx *ctx = priv;
+
+	assert(ctx);
+	assert(ev->handle == ctx->chan);
+
+	tipc_handle_chan_errors(ev);
+
+	if (ev->event & IPC_HANDLE_POLL_HUP) {
+		/* closed by peer. */
+		hwkey_ctx_close(ctx);
+		return;
+	}
+
+	if (ev->event & IPC_HANDLE_POLL_MSG) {
+		int rc = hwkey_chan_handle_msg(ctx);
+		if (rc < 0) {
+			/* report an error and close channel */
+			TLOGE("failed (%d) to handle event on channel %d\n",
+			      rc, ev->handle);
+			hwkey_ctx_close(ctx);
+		}
+	}
+}
+
+/*
+ * HWKEY service port event handler
+ */
+static void hwkey_port_handler(const uevent_t *ev, void *priv)
+{
+	uuid_t peer_uuid;
+
+	tipc_handle_port_errors(ev);
+
+	if (ev->event & IPC_HANDLE_POLL_READY) {
+		/* incoming connection: accept it */
+		int rc = accept(ev->handle, &peer_uuid);
+		if (rc < 0) {
+			TLOGE("failed (%d) to accept on port %d\n", rc, ev->handle);
+			return;
+		}
+
+		handle_t chan = (handle_t) rc;
+		struct hwkey_chan_ctx *ctx = calloc(1, sizeof(*ctx));
+		if (!ctx) {
+			TLOGE("failed (%d) to allocate context on chan %d\n", rc, chan);
+			close(chan);
+			return;
+		}
+
+		/* init channel state */
+		ctx->evt_handler.priv = ctx;
+		ctx->evt_handler.proc = hwkey_chan_handler;
+		ctx->chan = chan;
+		ctx->uuid = peer_uuid;
+
+		rc = set_cookie(chan, &ctx->evt_handler);
+		if (rc < 0) {
+			TLOGE("failed (%d) to set_cookie on chan %d\n",
+			       rc, chan);
+			hwkey_ctx_close(ctx);
+			return;
+		}
+	}
+}
+
+/*
+ *  Install Key slot provider
+ */
+void hwkey_install_keys(const struct hwkey_keyslot *keys, uint kcnt)
+{
+	assert(key_slots == NULL);
+	assert(key_slot_cnt == 0);
+	assert(keys && kcnt);
+
+	key_slots = keys;
+	key_slot_cnt = kcnt;
+}
+
+/*
+ *  Initialize HWKEY service
+ */
+int hwkey_start_service(void)
+{
+	int rc;
+	handle_t port;
+
+	TLOGI("Start HWKEY service\n");
+
+	/* Initialize service */
+	rc = port_create(HWKEY_PORT, 1, sizeof(struct hwkey_msg) + HWKEY_MAX_PAYLOAD_SIZE,
+			 IPC_PORT_ALLOW_TA_CONNECT);
+	if (rc < 0) {
+		TLOGE("Failed (%d) to create port %s\n", rc, HWKEY_PORT);
+		return rc;
+	}
+
+	port = (handle_t) rc;
+	rc = set_cookie(port, &hwkey_port_evt_handler);
+	if (rc) {
+		TLOGE("failed (%d) to set_cookie on port %d\n", rc, port);
+		close(port);
+		return rc;
+	}
+
+	return NO_ERROR;
+}
diff --git a/hwcrypto/hwkey_srv_fake_provider.c b/hwcrypto/hwkey_srv_fake_provider.c
new file mode 100644
index 0000000..c8c1a85
--- /dev/null
+++ b/hwcrypto/hwkey_srv_fake_provider.c
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <assert.h>
+#include <err.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <trusty_std.h>
+#include <interface/hwkey/hwkey.h>
+#include <openssl/cipher.h>
+#include <openssl/aes.h>
+#include <openssl/digest.h>
+#include <openssl/err.h>
+#include <openssl/hkdf.h>
+
+#include "common.h"
+#include "uuids.h"
+#include "hwkey_srv_priv.h"
+
+#define LOCAL_TRACE  1
+#define LOG_TAG      "hwkey_fake_srv"
+
+#warning "Compiling FAKE HWKEY provider"
+
+/*
+ *  This module is a sample only. For real device, this code
+ *  needs to be rewritten to operate on real per device key that
+ *  should come directly or indirectly from hardware.
+ */
+static uint8_t fake_device_key[32] = "this is a fake unique device key";
+
+/* This input vector is taken from RFC 5869 (Extract-and-Expand HKDF) */
+static const uint8_t IKM[] = { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+			       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+			       0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b };
+
+static const uint8_t salt[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
+				0x08, 0x09, 0x0a, 0x0b, 0x0c };
+
+static const uint8_t info[] = { 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9 };
+
+/* Expected pseudorandom key */
+static const uint8_t exp_PRK[] = { 0x07, 0x77, 0x09, 0x36, 0x2c, 0x2e, 0x32, 0xdf,
+				   0x0d, 0xdc, 0x3f, 0x0d, 0xc4, 0x7b, 0xba, 0x63,
+				   0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
+				   0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5 };
+
+/* Expected Output Key */
+static const uint8_t exp_OKM[42]= { 0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
+				    0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
+				    0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
+				    0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
+				    0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
+				    0x58, 0x65 };
+
+static bool hkdf_self_test(void)
+{
+	int res;
+	uint8_t OKM[sizeof(exp_OKM)];
+
+	TLOGI("hkdf self test\n");
+
+	/* Check if OKM is OK */
+	memset(OKM, 0x55, sizeof(OKM));
+
+	res = HKDF(OKM, sizeof(OKM), EVP_sha256(),
+		   IKM, sizeof(IKM), salt, sizeof(salt), info, sizeof(info));
+	if (!res) {
+		TLOGE("hkdf: failed 0x%x\n", ERR_get_error());
+		return false;
+	}
+
+	res = memcmp(OKM, exp_OKM, sizeof(OKM));
+	if (res) {
+		TLOGE("hkdf: data mismatch\n");
+		return false;
+	}
+
+	TLOGI("hkdf self test: PASSED\n");
+	return true;
+}
+
+/*
+ * Derive key V1 - HMAC SHA256 based Key derivation function
+ */
+uint32_t derive_key_v1(const uuid_t *uuid,
+		       const uint8_t *ikm_data, size_t ikm_len,
+		       uint8_t *key_buf, size_t *key_len)
+{
+	if (!ikm_len) {
+		*key_len = 0;
+		return HWKEY_ERR_BAD_LEN;
+	}
+
+	if (!HKDF(key_buf, ikm_len, EVP_sha256(),
+		  (const uint8_t *)fake_device_key, sizeof(fake_device_key),
+		  (const uint8_t *)uuid, sizeof(uuid),
+		  ikm_data, ikm_len)) {
+		TLOGE("HDKF failed 0x%x\n", ERR_get_error());
+		*key_len = 0;
+		memset(key_buf, 0, ikm_len);
+		return HWKEY_ERR_GENERIC;
+	}
+
+	*key_len = ikm_len;
+
+	return HWKEY_NO_ERROR;
+}
+
+/*
+ *  RPMB Key support
+ */
+#define RPMB_SS_AUTH_KEY_SIZE    32
+#define RPMB_SS_AUTH_KEY_ID      "com.android.trusty.storage_auth.rpmb"
+
+/* Secure storage service app uuid */
+static const uuid_t ss_uuid = SECURE_STORAGE_SERVER_APP_UUID;
+
+static uint8_t rpmb_salt[RPMB_SS_AUTH_KEY_SIZE] = {
+	0x42, 0x18, 0xa9, 0xf2, 0xf6, 0xb1, 0xf5, 0x35,
+	0x06, 0x37, 0x9f, 0xba, 0xcc, 0x1a, 0xc9, 0x36,
+	0xf4, 0x83, 0x04, 0xd4, 0xf1, 0x65, 0x91, 0x32,
+	0xa6, 0xae, 0xda, 0x27, 0x4d, 0x21, 0xdb, 0x40
+};
+
+/*
+ * Generate RPMB Secure Storage Authentication key
+ */
+static uint32_t get_rpmb_ss_auth_key(const struct hwkey_keyslot *slot,
+				     uint8_t *kbuf, size_t kbuf_len, size_t *klen)
+{
+	int rc;
+	int out_len;
+	EVP_CIPHER_CTX evp;
+
+	assert(kbuf);
+	assert(klen);
+
+	EVP_CIPHER_CTX_init(&evp);
+
+	rc = EVP_EncryptInit_ex(&evp, EVP_aes_256_cbc(), NULL, fake_device_key, NULL);
+	if (!rc)
+		goto evp_err;
+
+	rc = EVP_CIPHER_CTX_set_padding(&evp, 0);
+	if (!rc)
+		goto evp_err;
+
+	uint min_kbuf_len = RPMB_SS_AUTH_KEY_SIZE + EVP_CIPHER_CTX_key_length(&evp);
+	if (kbuf_len < min_kbuf_len) {
+		TLOGE("buffer too small: (%zd vs. %zd )\n", kbuf_len,  min_kbuf_len);
+		goto other_err;
+	}
+
+	rc = EVP_EncryptUpdate(&evp, kbuf, &out_len, rpmb_salt, sizeof(rpmb_salt));
+	if (!rc)
+		goto evp_err;
+
+	if ((size_t)out_len != RPMB_SS_AUTH_KEY_SIZE) {
+		TLOGE("output length mismatch (%zd vs %zd)\n",
+			(size_t)out_len, sizeof(rpmb_salt));
+		goto other_err;
+	}
+
+	rc = EVP_EncryptFinal_ex(&evp, NULL, &out_len);
+	if (!rc)
+		goto evp_err;
+
+	*klen = RPMB_SS_AUTH_KEY_SIZE;
+
+	EVP_CIPHER_CTX_cleanup(&evp);
+	return HWKEY_NO_ERROR;
+
+evp_err:
+	TLOGE("EVP err 0x%x\n", ERR_get_error());
+other_err:
+	EVP_CIPHER_CTX_cleanup(&evp);
+	return HWKEY_ERR_GENERIC;
+}
+
+/*
+ *  List of keys slots that hwkey service supports
+ */
+static const struct hwkey_keyslot _keys[] = {
+	{
+		.uuid = &ss_uuid,
+		.key_id = RPMB_SS_AUTH_KEY_ID,
+		.handler = get_rpmb_ss_auth_key,
+	},
+};
+
+/*
+ *  Run Self test
+ */
+static bool hwkey_self_test(void)
+{
+	TLOGI("hwkey self test\n");
+
+	if (!hkdf_self_test())
+		return false;
+
+	TLOGI("hwkey self test: PASSED\n");
+	return true;
+}
+
+/*
+ *  Initialize Fake HWKEY service provider
+ */
+void hwkey_init_srv_provider(void)
+{
+	int rc;
+
+	TLOGE("Init FAKE!!!! HWKEY service provider\n");
+	TLOGE("FAKE HWKEY service provider MUST be replaced with the REAL one\n");
+
+	/* run self test */
+	if (!hwkey_self_test()) {
+		TLOGE("hwkey_self_test failed\n");
+		abort();
+	}
+
+	/* install key handlers */
+	hwkey_install_keys(_keys, countof(_keys));
+
+	/* start service */
+	rc = hwkey_start_service();
+	if (rc != NO_ERROR ) {
+		TLOGE("failed (%d) to start HWKEY service\n", rc);
+	}
+}
diff --git a/hwcrypto/hwkey_srv_priv.h b/hwcrypto/hwkey_srv_priv.h
new file mode 100644
index 0000000..1836bb6
--- /dev/null
+++ b/hwcrypto/hwkey_srv_priv.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <compiler.h>
+#include <sys/types.h>
+#include <trusty_uuid.h>
+
+struct hwkey_keyslot {
+	const char *key_id;
+	const uuid_t *uuid;
+	const void *priv;
+	uint32_t (*handler)(const struct hwkey_keyslot *slot,
+			    uint8_t *kbuf, size_t kbuf_len, size_t *klen);
+};
+
+__BEGIN_CDECLS
+
+void hwkey_init_srv_provider(void);
+
+void hwkey_install_keys(const struct hwkey_keyslot *keys, uint kcnt);
+
+int  hwkey_start_service(void);
+
+uint32_t derive_key_v1(const uuid_t *uuid,
+		       const uint8_t *ikm_data, size_t ikm_len,
+		       uint8_t *key_data, size_t *key_len);
+
+__END_CDECLS
+
+
diff --git a/hwcrypto/hwrng_srv.c b/hwcrypto/hwrng_srv.c
new file mode 100644
index 0000000..9f6e4e9
--- /dev/null
+++ b/hwcrypto/hwrng_srv.c
@@ -0,0 +1,281 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <assert.h>
+#include <err.h>
+#include <list.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <trusty_std.h>
+#include <interface/hwrng/hwrng.h>
+
+#include "common.h"
+#include "hwrng_srv_priv.h"
+
+#define LOCAL_TRACE       1
+#define LOG_TAG           "hwrng_srv"
+
+#define HWRNG_SRV_NAME       HWRNG_PORT
+#define MAX_HWRNG_MSG_SIZE   4096
+
+struct hwrng_chan_ctx {
+	tipc_event_handler_t evt_handler;
+	struct list_node node;
+	handle_t chan;
+	size_t req_size;
+	bool send_blocked;
+};
+
+static void hwrng_port_handler(const uevent_t *ev, void *priv);
+static void hwrng_chan_handler(const uevent_t *ev, void *priv);
+
+static handle_t hwrng_port  = INVALID_IPC_HANDLE;
+
+static tipc_event_handler_t hwrng_port_evt_handler = {
+	.proc = hwrng_port_handler,
+};
+
+static uint8_t rng_data[MAX_HWRNG_MSG_SIZE];
+
+static struct list_node hwrng_req_list = LIST_INITIAL_VALUE(hwrng_req_list);
+
+/****************************************************************************/
+
+/*
+ *  Hexdump content of memory region
+ */
+static void _hexdump8(const void *ptr, size_t len)
+{
+	addr_t address = (addr_t)ptr;
+	size_t count;
+	size_t i;
+
+	for (count = 0 ; count < len; count += 16) {
+		fprintf(stderr, "0x%08lx: ", address);
+		for (i=0; i < MIN(len - count, 16); i++) {
+			fprintf(stderr, "0x%02hhx ", *(const uint8_t *)(address + i));
+		}
+		fprintf(stderr, "\n");
+		address += 16;
+	}
+}
+
+/*
+ * Close specified HWRNG service channel
+ */
+static void hwrng_close_chan(struct hwrng_chan_ctx *ctx)
+{
+	close(ctx->chan);
+
+	if (list_in_list(&ctx->node))
+		list_delete(&ctx->node);
+
+	free(ctx);
+}
+
+/*
+ * Handle HWRNG request queue
+ */
+static bool hwrng_handle_req_queue(void)
+{
+	struct hwrng_chan_ctx *ctx;
+	struct hwrng_chan_ctx *temp;
+
+	/* service channels */
+	bool need_more = false;
+
+	/* for all pending requests */
+	list_for_every_entry_safe(&hwrng_req_list, ctx, temp,
+				  struct hwrng_chan_ctx, node) {
+
+		if (ctx->send_blocked)
+			continue; /* cant service it rignt now */
+
+		size_t len = ctx->req_size;
+
+		if (len > MAX_HWRNG_MSG_SIZE)
+			len = MAX_HWRNG_MSG_SIZE;
+
+		/* get rng data */
+		hwrng_dev_get_rng_data(rng_data, len);
+
+		/* send reply */
+		int rc = tipc_send_single_buf(ctx->chan, rng_data, len);
+		if (rc < 0) {
+			if (rc == ERR_NOT_ENOUGH_BUFFER) {
+				/* mark it as send_blocked */
+				ctx->send_blocked = true;
+			} else {
+				/* just close HWRNG request channel */
+				TLOGE("failed (%d) to send_reply\n", rc);
+				hwrng_close_chan(ctx);
+			}
+			continue;
+		}
+
+		ctx->req_size -= len;
+
+		if (ctx->req_size == 0) {
+			/* remove it from pending list */
+			list_delete(&ctx->node);
+		} else {
+			need_more = true;
+		}
+	}
+
+	return need_more;
+}
+
+/*
+ * Check if we can handle request queue
+ */
+static void hwrng_kick_req_queue(void)
+{
+	hwrng_handle_req_queue();
+}
+
+/*
+ *  Read and queue HWRNG request message
+ */
+static int hwrng_chan_handle_msg(struct hwrng_chan_ctx *ctx)
+{
+	int rc;
+	struct hwrng_req req;
+
+	assert(ctx);
+
+	/* read request */
+	rc = tipc_recv_single_buf(ctx->chan, &req, sizeof(req));
+	if (rc != sizeof(req)) {
+		TLOGE("failed (%d) to receive msg for chan %d\n",
+		      rc, ctx->chan);
+		return rc;
+	}
+
+	/* check if we already have request in progress */
+	if (list_in_list(&ctx->node)) {
+		/* extend it */
+		ctx->req_size += req.len;
+	} else {
+		/* queue it */
+		ctx->req_size = req.len;
+		list_add_tail(&hwrng_req_list, &ctx->node);
+	}
+
+	return 0;
+}
+
+/*
+ *  Channel handler where HWRNG requests are coming from
+ */
+static void hwrng_chan_handler(const uevent_t *ev, void *priv)
+{
+	struct hwrng_chan_ctx *ctx = priv;
+
+	assert(ctx);
+	assert(ev->handle == ctx->chan);
+
+	tipc_handle_chan_errors(ev);
+
+	if (ev->event & IPC_HANDLE_POLL_HUP) {
+		hwrng_close_chan(ctx);
+	} else {
+		if (ev->event & IPC_HANDLE_POLL_SEND_UNBLOCKED) {
+			ctx->send_blocked = false;
+		}
+
+		if (ev->event & IPC_HANDLE_POLL_MSG) {
+			int rc = hwrng_chan_handle_msg(ctx);
+			if (rc) {
+				hwrng_close_chan(ctx);
+			}
+		}
+	}
+
+	/* kick state machine */
+	hwrng_kick_req_queue();
+}
+
+/*
+ * Port were HWRNG requests are coming from
+ */
+static void hwrng_port_handler(const uevent_t *ev, void *priv)
+{
+	uuid_t peer_uuid;
+
+	tipc_handle_port_errors(ev);
+
+	if (ev->event & IPC_HANDLE_POLL_READY) {
+		handle_t chan;
+
+		/* incoming connection: accept it */
+		int rc = accept(ev->handle, &peer_uuid);
+		if (rc < 0) {
+			TLOGE("failed (%d) to accept on port %d\n",
+			       rc, ev->handle);
+			return;
+		}
+		chan = (handle_t) rc;
+
+		/* allocate state */
+		struct hwrng_chan_ctx *ctx = calloc(1, sizeof(*ctx));
+		if (!ctx) {
+			TLOGE("failed to alloc state for chan %d\n", chan);
+			close(chan);
+			return;
+		}
+
+		/* init channel state */
+		ctx->evt_handler.priv = ctx;
+		ctx->evt_handler.proc = hwrng_chan_handler;
+		ctx->chan = chan;
+
+		/* attach channel handler */
+		rc = set_cookie(chan, &ctx->evt_handler);
+		if (rc) {
+			TLOGE("failed (%d) to set_cookie on chan %d\n",
+			       rc, chan);
+			free(ctx);
+			close(chan);
+			return;
+		}
+	}
+}
+
+/*
+ *  Initialize HWRNG services
+ */
+int hwrng_start_service(void)
+{
+	int rc;
+
+	TLOGI("Start HWRNG service\n");
+
+	/* create HWRNG port */
+	rc = port_create(HWRNG_SRV_NAME, 1, MAX_HWRNG_MSG_SIZE,
+			 IPC_PORT_ALLOW_TA_CONNECT);
+	if (rc < 0) {
+		TLOGE("Failed (%d) to create port '%s'\n", rc, HWRNG_SRV_NAME);
+		return rc;
+	} else {
+		hwrng_port = (handle_t)rc;
+		set_cookie(hwrng_port, &hwrng_port_evt_handler);
+	}
+
+	return NO_ERROR;
+}
diff --git a/hwcrypto/hwrng_srv_fake_provider.c b/hwcrypto/hwrng_srv_fake_provider.c
new file mode 100644
index 0000000..cc26858
--- /dev/null
+++ b/hwcrypto/hwrng_srv_fake_provider.c
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "common.h"
+#include "hwrng_srv_priv.h"
+
+#define LOCAL_TRACE  1
+#define LOG_TAG      "hwrng_fake_srv"
+
+#warning "Compiling FAKE HWRNG provider"
+
+void hwrng_dev_get_rng_data(uint8_t *buf, size_t buf_len)
+{
+	memset(buf, 0, buf_len);
+}
+
+void hwrng_init_srv_provider(void)
+{
+	int rc;
+
+	TLOGE("Init FAKE!!!! HWRNG service provider\n");
+	TLOGE("FAKE HWRNG service provider MUST be replaced with the REAL one\n");
+
+	/* Nothing to initialize here, just start service */
+	rc = hwrng_start_service();
+	if (rc != NO_ERROR) {
+		TLOGE("failed (%d) to start HWRNG service\n", rc);
+	}
+}
+
diff --git a/hwcrypto/hwrng_srv_priv.h b/hwcrypto/hwrng_srv_priv.h
new file mode 100644
index 0000000..1fa3690
--- /dev/null
+++ b/hwcrypto/hwrng_srv_priv.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <compiler.h>
+
+__BEGIN_CDECLS
+
+void hwrng_init_srv_provider(void);
+int  hwrng_start_service(void);
+
+void hwrng_dev_get_rng_data(uint8_t *buf, size_t buf_len);
+
+__END_CDECLS
diff --git a/hwcrypto/main.c b/hwcrypto/main.c
new file mode 100644
index 0000000..cf4e25b
--- /dev/null
+++ b/hwcrypto/main.c
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+#include <assert.h>
+#include <err.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <trusty_std.h>
+
+
+#define LOCAL_TRACE  1
+#define LOG_TAG      "hwcrypto_srv"
+
+#include "common.h"
+#include "hwrng_srv_priv.h"
+#include "hwkey_srv_priv.h"
+
+
+/*
+ *  Hexdump content of memory region
+ */
+void _hexdump8(const void *ptr, size_t len)
+{
+	addr_t address = (addr_t)ptr;
+	size_t count;
+	size_t i;
+
+	for (count = 0 ; count < len; count += 16) {
+		fprintf(stderr, "0x%08lx: ", address);
+		for (i=0; i < MIN(len - count, 16); i++) {
+			fprintf(stderr, "0x%02hhx ", *(const uint8_t *)(address + i));
+		}
+		fprintf(stderr, "\n");
+		address += 16;
+	}
+}
+
+
+/*
+ * Handle common unexpected port events
+ */
+void tipc_handle_port_errors(const uevent_t *ev)
+{
+	if ((ev->event & IPC_HANDLE_POLL_ERROR) ||
+	    (ev->event & IPC_HANDLE_POLL_HUP) ||
+	    (ev->event & IPC_HANDLE_POLL_MSG) ||
+	    (ev->event & IPC_HANDLE_POLL_SEND_UNBLOCKED)) {
+		/* should never happen with port handles */
+		TLOGE("error event (0x%x) for port (%d)\n",
+		       ev->event, ev->handle);
+		abort();
+	}
+}
+
+/*
+ * Handle common unexpected channel events
+ */
+void tipc_handle_chan_errors(const uevent_t *ev)
+{
+	if ((ev->event & IPC_HANDLE_POLL_ERROR) ||
+	    (ev->event & IPC_HANDLE_POLL_READY)) {
+		/* close it as it is in an error state */
+		TLOGE("error event (0x%x) for chan (%d)\n",
+		       ev->event, ev->handle);
+		abort();
+	}
+}
+
+/*
+ *  Send single buf message
+ */
+int tipc_send_single_buf(handle_t chan, const void *buf, size_t len)
+{
+	iovec_t iov = {
+			.base = (void *)buf,
+			.len  = len,
+	};
+	ipc_msg_t msg = {
+			.iov = &iov,
+			.num_iov = 1,
+
+	};
+	return send_msg(chan, &msg);
+}
+
+/*
+ *  Receive single buf message
+ */
+int tipc_recv_single_buf(handle_t chan, void *buf, size_t len)
+{
+	int rc;
+	ipc_msg_info_t msg_inf;
+
+	rc = get_msg(chan, &msg_inf);
+	if (rc)
+		return rc;
+
+	if (msg_inf.len != len) {
+		/* unexpected msg size */
+		rc = ERR_BAD_LEN;
+	} else {
+		iovec_t iov = {
+				.base = buf,
+				.len  = len,
+		};
+		ipc_msg_t msg = {
+				.iov = &iov,
+				.num_iov = 1,
+		};
+		rc = read_msg(chan, msg_inf.id, 0, &msg);
+	}
+
+	put_msg(chan, msg_inf.id);
+	return rc;
+}
+
+/*
+ * Send message consisting of two segments (header and payload)
+ */
+int tipc_send_two_segments(handle_t chan, const void *hdr, size_t hdr_len,
+			   const void *payload, size_t payload_len)
+{
+	iovec_t iovs[2] = {
+		{
+			.base = (void *)hdr,
+			.len =  hdr_len,
+		},
+		{
+			.base = (void *)payload,
+			.len  = payload_len,
+		},
+	};
+	ipc_msg_t msg = {
+		.iov = iovs,
+		.num_iov = countof(iovs),
+	};
+	return send_msg(chan, &msg);
+}
+
+/*
+ * Receive message consisting of two segments (header and payload).
+ */
+int tipc_recv_two_segments(handle_t chan, void *hdr, size_t hdr_len,
+			   void *payload, size_t payload_len)
+{
+	int rc;
+	ipc_msg_info_t msg_inf;
+
+	rc = get_msg(chan, &msg_inf);
+	if (rc)
+		return rc;
+
+	if (msg_inf.len < hdr_len) {
+		/* unexpected msg size */
+		rc = ERR_BAD_LEN;
+	} else {
+		iovec_t iovs[2] = {
+			{
+				.base = hdr,
+				.len =  hdr_len,
+			},
+			{
+				.base = payload,
+				.len =  payload_len,
+			}
+		};
+		ipc_msg_t msg = {
+				.iov = iovs,
+				.num_iov = countof(iovs),
+		};
+		rc = read_msg(chan, msg_inf.id, 0, &msg);
+	}
+
+	put_msg(chan, msg_inf.id);
+	return rc;
+}
+
+/*
+ *  Dispatch event
+ */
+static void dispatch_event(const uevent_t *ev)
+{
+	assert(ev);
+
+	if (ev->event == IPC_HANDLE_POLL_NONE) {
+		/* not really an event, do nothing */
+		TLOGI("got an empty event\n");
+		return;
+	}
+
+	/* check if we have handler */
+	struct tipc_event_handler *handler = ev->cookie;
+	if (handler && handler->proc) {
+		/* invoke it */
+		handler->proc(ev, handler->priv);
+		return;
+	}
+
+	/* no handler? close it */
+	TLOGE("no handler for event (0x%x) with handle %d\n",
+	       ev->event, ev->handle);
+
+	close(ev->handle);
+
+	return;
+}
+
+/*
+ *  Main application event loop
+ */
+int main(void)
+{
+	int rc;
+	uevent_t event;
+
+	TLOGI("Initializing\n");
+
+	/* initialize service providers */
+	hwrng_init_srv_provider();
+	hwkey_init_srv_provider();
+
+	TLOGI("enter main event loop\n");
+
+	/* enter main event loop */
+	while (true) {
+		event.handle = INVALID_IPC_HANDLE;
+		event.event  = 0;
+		event.cookie = NULL;
+
+		rc = wait_any(&event, -1);
+		if (rc < 0) {
+			TLOGE("wait_any failed (%d)\n", rc);
+			break;
+		}
+
+		if (rc == NO_ERROR) { /* got an event */
+			dispatch_event(&event);
+		}
+	}
+
+	return rc;
+}
diff --git a/hwcrypto/manifest.c b/hwcrypto/manifest.c
new file mode 100644
index 0000000..1f6c175
--- /dev/null
+++ b/hwcrypto/manifest.c
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <stdio.h>
+#include <trusty_app_manifest.h>
+
+#include "uuids.h"
+
+trusty_app_manifest_t TRUSTY_APP_MANIFEST_ATTRS trusty_app_manifest =
+{
+	.uuid = GEN_HWCRYPTO_UUID,
+
+	.config_options =
+	/* optional configuration options here */
+	{
+		TRUSTY_APP_CONFIG_MIN_HEAP_SIZE(6 * 4096),
+	},
+};
diff --git a/hwcrypto/rules.mk b/hwcrypto/rules.mk
new file mode 100644
index 0000000..bcb1c0d
--- /dev/null
+++ b/hwcrypto/rules.mk
@@ -0,0 +1,42 @@
+#
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+MODULE := $(LOCAL_DIR)
+
+MODULE_SRCS := \
+	$(LOCAL_DIR)/manifest.c \
+	$(LOCAL_DIR)/main.c \
+	$(LOCAL_DIR)/hwrng_srv.c \
+	$(LOCAL_DIR)/hwkey_srv.c \
+
+ifeq (true,$(call TOBOOL,$(WITH_FAKE_HWRNG)))
+MODULE_SRCS += $(LOCAL_DIR)/hwrng_srv_fake_provider.c
+endif
+
+ifeq (true,$(call TOBOOL,$(WITH_FAKE_HWKEY)))
+MODULE_SRCS += $(LOCAL_DIR)/hwkey_srv_fake_provider.c
+endif
+
+MODULE_DEPS := \
+	app/trusty \
+	lib/libc-trusty \
+	interface/hwrng \
+	interface/hwkey \
+	openssl \
+
+include make/module.mk
diff --git a/hwcrypto/uuids.h b/hwcrypto/uuids.h
new file mode 100644
index 0000000..c8866a9
--- /dev/null
+++ b/hwcrypto/uuids.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2015 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+/* This App UUID:   {23fe5938-ccd5-4a78-8baf-0f3d05ffc2df} */
+#define GEN_HWCRYPTO_UUID \
+	{ 0x23fe5938, 0xccd5, 0x4a78, \
+		{ 0x8b, 0xaf, 0x0f, 0x3d, 0x05, 0xff, 0xc2, 0xdf }}
+
+/* HWCRYPTO unittest App UUID */
+#define HWCRYPTO_UNITTEST_APP_UUID \
+	{ 0xab742471, 0xd6e6, 0x4806, \
+		{ 0x85, 0xf6, 0x05, 0x55, 0xb0, 0x24, 0xf4, 0xda }}
+
+/* Secure Storage Server App UUID */
+#define SECURE_STORAGE_SERVER_APP_UUID \
+	{0xcea8706d, 0x6cb4, 0x49f3,\
+		{ 0xb9, 0x94, 0x29, 0xe0, 0xe4, 0x78, 0xbd, 0x29 }}