rtwo: port QTI FBE decryption stack

BoardConfig.mk

@@ -129,7 +129,7 @@ VENDOR_SECURITY_PATCH := 2029-12-31
 PLATFORM_VERSION := 12.1.0
 TW_INCLUDE_CRYPTO := true
 TW_INCLUDE_CRYPTO_FBE := true
-BOARD_USES_QCOM_FBE_DECRYPTION := false
+BOARD_USES_QCOM_FBE_DECRYPTION := true
 TW_INCLUDE_FBE_METADATA_DECRYPT := true
 BOARD_USES_METADATA_PARTITION := true
 

device.mk

@@ -31,10 +31,18 @@ PRODUCT_PACKAGES += \
 
 # Dependencies
 TARGET_RECOVERY_DEVICE_MODULES += \
+    android.hidl.allocator@1.0 \
+    android.hidl.memory@1.0 \
+    android.hidl.memory.token@1.0 \
+    libhidlmemory \
     libion \
     libdmabufheap
 
 RECOVERY_LIBRARY_SOURCE_FILES += \
+    $(TARGET_OUT_SHARED_LIBRARIES)/android.hidl.allocator@1.0.so \
+    $(TARGET_OUT_SHARED_LIBRARIES)/android.hidl.memory@1.0.so \
+    $(TARGET_OUT_SHARED_LIBRARIES)/android.hidl.memory.token@1.0.so \
+    $(TARGET_OUT_SHARED_LIBRARIES)/libhidlmemory.so \
     $(TARGET_OUT_SHARED_LIBRARIES)/libion.so \
     $(TARGET_OUT_SHARED_LIBRARIES)/libdmabufheap.so
 

recovery/root/init.recovery.qcom.rc

@@ -26,18 +26,38 @@
 #
 
 import /init.recovery.qcom_decrypt.rc
+import /vendor/etc/init/init.spdaemon.rc
+import /vendor/etc/init/init.vendor.qti.spu@1.1-service.rc
+import /vendor/etc/init/init.spuservice.rc
+import /init.recovery.rtwo.gatekeeper.rc
+
+service rtwo-crypto-identity /system/bin/rtwo-crypto-identity.sh
+    user root
+    group root
+    disabled
+    oneshot
+    seclabel u:r:recovery:s0
+
+on early-init
+    exec_start rtwo-crypto-identity
 
 on init
-    setprop twrp.defer.decrypt true
+    setprop twrp.defer.decrypt false
     # to cut charging battery path
     write /sys/class/power_supply/battery/siop_level 0
-    setprop prepdecrypt.setpatch true
+    setprop prepdecrypt.setpatch false
     setprop sys.usb.configfs 1
 
 on fs
     wait /dev/block/platform/soc/${ro.boot.bootdevice}
     symlink /dev/block/platform/soc/${ro.boot.bootdevice} /dev/block/bootdevice
 
+    mkdir /persist 0771 root system
+    mkdir /mnt/vendor 0755 root root
+    mkdir /mnt/vendor/persist 0771 root system
+    mount ext4 /dev/block/bootdevice/by-name/persist /persist
+    mount none /persist /mnt/vendor/persist bind
+
     # Mount firmware
     mkdir /vendor/firmware_mnt
     mount vfat /dev/block/bootdevice/by-name/apnhlos /vendor/firmware_mnt
@@ -48,14 +68,6 @@ on fs
 on boot
     start health-hal-2-1
 
-on property:crypto.ready=1
-    start keymint-default
-    start keymaster-sb-4-0
-
-on property:crypto.ready=0
-    stop keymaster-sb-4-0
-    stop keymint-default
-
 on property:twrp.user.0.decrypt=0
     umount /vendor/firmware_mnt
 

recovery/root/init.recovery.rtwo.gatekeeper.rc

@@ -0,0 +1,20 @@
+service gatekeeper-rtwo /system/bin/android.hardware.gatekeeper@1.0-service-qti
+    class early_hal
+    user system
+    group system
+    setenv LD_LIBRARY_PATH /vendor/lib64:/vendor/lib:/system/lib64:/system/lib:/sbin
+    disabled
+    seclabel u:r:recovery:s0
+
+on property:vendor.sys.listeners.registered=true
+    stop gatekeeper-1-0
+    stop gatekeeper-1-0-qti
+    stop qseecomd
+    setprop vendor.gatekeeper.is_security_level_spu 0
+    start vendor.spdaemon
+    start vendor.sec_nvm
+    start spu_service
+    start spuservice
+
+on property:init.svc.vendor.spdaemon=running && property:init.svc.vendor.sec_nvm=running && property:init.svc.spu_service=running && property:init.svc.spuservice=running && property:vendor.sys.listeners.registered=true
+    start gatekeeper-rtwo

recovery/root/system/bin/rtwo-crypto-identity.sh

@@ -0,0 +1,14 @@
+#!/system/bin/sh
+
+resetprop ro.build.version.release 16
+resetprop ro.build.version.sdk 36
+resetprop ro.build.version.security_patch 2026-06-01
+
+resetprop ro.vendor.build.version.release 16
+resetprop ro.vendor.build.version.sdk 36
+resetprop ro.vendor.build.security_patch 2025-09-01
+
+resetprop ro.product.first_api_level 33
+resetprop ro.board.first_api_level 33
+
+resetprop ro.crypto.type file

recovery/root/vendor/etc/init/android.hardware.keymaster@4.0-strongbox-service-qti.rc

@@ -1,18 +1,10 @@
-on property:sys.listeners.registered=true
-    start keymaster-sb-4-0
+on init
+    start vendor.keymaster-sb-4-0
 
-on property:vendor.sys.listeners.registered=true
-    start keymaster-sb-4-0
-
-on property:ro.crypto.type=block && property:ro.crypto.fs_crypto_blkdev=*
-    stop keymaster-sb-4-0
-
-on property:twrp.all.users.decrypted=true
-    stop keymaster-sb-4-0
-
-service keymaster-sb-4-0 /system/bin/android.hardware.keymaster@4.0-strongbox-service-qti
+service vendor.keymaster-sb-4-0 /system/bin/android.hardware.keymaster@4.0-strongbox-service-qti
+    class early_hal
     user root
-    group root
-    setenv LD_LIBRARY_PATH /vendor/lib64:/vendor/lib:/system/lib64:/system/lib:/sbin
+    group root drmrpc
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
     disabled
     seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/android.hardware.security.keymint-service-qti.rc

@@ -0,0 +1,10 @@
+on init
+    start vendor.keymint-qti
+
+service vendor.keymint-qti /system/bin/android.hardware.security.keymint-service-qti
+    class early_hal
+    user root
+    group root
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    disabled
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/android.hardware.security.keymint-service.rc

@@ -1,27 +0,0 @@
-on property:sys.listeners.registered=true
-    start keymint-default
-
-on property:vendor.sys.listeners.registered=true
-    start keymint-default
-
-on property:ro.crypto.type=block && property:ro.crypto.fs_crypto_blkdev=*
-    stop keymint-default
-
-on property:twrp.all.users.decrypted=true
-    stop keymint-default
-
-service keymint-default /system/bin/android.hardware.security.keymint-service
-    user root
-    group root
-    setenv LD_LIBRARY_PATH /vendor/lib64:/vendor/lib:/system/lib64:/system/lib:/sbin
-    disabled
-    seclabel u:r:recovery:s0
-
-on post-fs
-    mkdir /mnt/vendor/efs/DAK 0775 system system
-    restorecon -R /mnt/vendor/efs/DAK
-    chown system system /mnt/vendor/efs/DAK/gakkeybox
-    chmod 0644 /mnt/vendor/efs/DAK/gakkeybox
-
-on post-fs-data
-    mkdir /data/vendor/keymaster 0775 system system

recovery/root/vendor/etc/init/init.spdaemon.rc

@@ -0,0 +1,20 @@
+on post-fs && property:ro.boot.product.vendor.sku=kalama
+    start vendor.spdaemon
+    start vendor.sec_nvm
+
+service vendor.spdaemon /system/bin/spdaemon
+    class core
+    user system
+    group system
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    disabled
+    shutdown critical
+    seclabel u:r:recovery:s0
+
+service vendor.sec_nvm /system/bin/sec_nvm
+    class core
+    user system
+    group system
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    disabled
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/init.spuservice.rc

@@ -0,0 +1,9 @@
+on boot && property:ro.boot.product.vendor.sku=kalama
+    start spuservice
+
+service spuservice /system/bin/vendor.qti.spu@2.0-service
+    class hal
+    user system
+    group system
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/init.vendor.qti.spu@1.1-service.rc

@@ -0,0 +1,9 @@
+on boot && property:ro.boot.product.vendor.sku=kalama
+    start spu_service
+
+service spu_service /system/bin/vendor.qti.spu@1.1-service
+    class hal
+    user system
+    group system
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/qseecomd.rc

@@ -0,0 +1,11 @@
+on init
+    start vendor.qseecomd
+
+service vendor.qseecomd /system/bin/qseecomd
+    socket notify-topology stream 660 system drmrpc
+    class core
+    user root
+    group root drmrpc
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    disabled
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/init/vendor.qti.hardware.qseecom@1.0-service.rc

@@ -0,0 +1,9 @@
+on init
+    start qseecom-service
+
+service qseecom-service /system/bin/vendor.qti.hardware.qseecom@1.0-service
+    class hal
+    user root
+    group root drmrpc
+    setenv LD_LIBRARY_PATH /vendor/lib64:/system/lib64:/sbin
+    seclabel u:r:recovery:s0

recovery/root/vendor/etc/vintf/manifest.xml

@@ -418,24 +418,6 @@
         </interface>
         <fqname>@1.0::ISehBluetoothA2dpSinkProvidersFactory/default</fqname>
     </hal>
-    <hal format="aidl">
-        <name>vendor.samsung.hardware.keymint</name>
-        <version>2</version>
-        <interface>
-            <name>ISehKeyMintExtension</name>
-            <instance>default</instance>
-        </interface>
-        <fqname>ISehKeyMintExtension/default</fqname>
-    </hal>
-    <hal format="aidl">
-        <name>vendor.samsung.hardware.keymint</name>
-        <version>2</version>
-        <interface>
-            <name>ISehKeyMintFactory</name>
-            <instance>default</instance>
-        </interface>
-        <fqname>ISehKeyMintFactory/default</fqname>
-    </hal>
     <hal format="aidl">
         <name>vendor.samsung.hardware.media.converter</name>
         <fqname>ISehColorConverterStore/default</fqname>