diff --git a/.gitignore b/.gitignore
index f100b4d..9cdc58a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,5 @@
 _auto_*
 
-# GYP-generated files.
-Makefile
-*.Makefile
-*.mk
-*.xcodeproj
-
 # Output directory.
 out/
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1013646..93720df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 [TOC]
 
+## [Version 17 plus test updates and OPK v17][v17+test-updates+opk+mk]
+
+Add makefiles to partner visible git repo.
+
 ## [Version 17 plus test updates and OPK v17][v17+test-updates+opk]
 
 This release contains the first partner release version of OPK, which is also
@@ -119,3 +123,4 @@ Public release for OEMCrypto API and ODK library version 16.4.
 [v16.4+opk-beta2]: https://widevine-partner.googlesource.com/oemcrypto/+/refs/tags/v16.4+opk-beta2
 [v17-initial-release]: https://widevine-partner.googlesource.com/oemcrypto/+/refs/tags/v17-initial-release
 [v17+test-updates+opk]: https://widevine-partner.googlesource.com/oemcrypto/+/refs/tags/v17+test-updates+opk
+[v17+test-updates+opk+mk]: https://widevine-partner.googlesource.com/oemcrypto/+/refs/tags/v17+test-updates+opk+mk
diff --git a/oemcrypto/opk/build/Makefile.rules b/oemcrypto/opk/build/Makefile.rules
new file mode 100644
index 0000000..02c4be6
--- /dev/null
+++ b/oemcrypto/opk/build/Makefile.rules
@@ -0,0 +1,354 @@
+# We borrow heavily from the kernel build setup, though we are simpler since
+# we don't have Kconfig tweaking settings on us.
+
+# The implicit make rules have it looking for RCS files, among other things.
+# We instead explicitly write all the rules we care about.
+# It's even quicker (saves ~200ms) to pass -r on the command line.
+MAKEFLAGS=-r
+
+# The source directory tree.
+srcdir := ../../..
+abs_srcdir := $(abspath $(srcdir))
+
+# The name of the builddir.
+builddir_name ?= out
+
+# The V=1 flag on command line makes us verbosely print command lines.
+ifdef V
+  quiet=
+else
+  quiet=quiet_
+endif
+
+# Specify BUILDTYPE=Release on the command line for a release build.
+BUILDTYPE ?= debug
+
+# Directory all our build output goes into.
+# Note that this must be two directories beneath src/ for unit tests to pass,
+# as they reach into the src/ directory for data with relative paths.
+builddir ?= $(builddir_name)/$(BUILDTYPE)
+abs_builddir := $(abspath $(builddir))
+depsdir := $(builddir)/.deps
+
+# Object output directory.
+obj := $(builddir)/obj
+abs_obj := $(abspath $(obj))
+
+# We build up a list of every single one of the targets so we can slurp in the
+# generated dependency rule Makefiles in one pass.
+all_deps :=
+
+
+
+CC.target ?= $(CC_target)
+CFLAGS.target ?= $(CPPFLAGS) $(CFLAGS)
+CXX.target ?= $(CXX_target)
+CXXFLAGS.target ?= $(CPPFLAGS) $(CXXFLAGS)
+LINK.target ?= $(LINK)
+LDFLAGS.target ?= $(LDFLAGS)
+AR.target ?= $(AR)
+
+# C++ apps need to be linked with g++.
+LINK ?= $(CXX.target)
+
+# TODO(evan): move all cross-compilation logic to gyp-time so we don't need
+# to replicate this environment fallback in make as well.
+CC.host ?= $(CC_host)
+CFLAGS.host ?= $(CPPFLAGS_host) $(CFLAGS_host)
+CXX.host ?= $(CXX_host)
+CXXFLAGS.host ?= $(CPPFLAGS_host) $(CXXFLAGS_host)
+LINK.host ?= $(CXX.host)
+LDFLAGS.host ?= $(LDFLAGS_host)
+AR.host ?= $(AR_host)
+
+# Define a dir function that can handle spaces.
+# http://www.gnu.org/software/make/manual/make.html#Syntax-of-Functions
+# "leading spaces cannot appear in the text of the first argument as written.
+# These characters can be put into the argument value by variable substitution."
+empty :=
+space := $(empty) $(empty)
+
+# http://stackoverflow.com/questions/1189781/using-make-dir-or-notdir-on-a-path-with-spaces
+replace_spaces = $(subst $(space),?,$1)
+unreplace_spaces = $(subst ?,$(space),$1)
+dirx = $(call unreplace_spaces,$(dir $(call replace_spaces,$1)))
+
+# Flags to make gcc output dependency info.  Note that you need to be
+# careful here to use the flags that ccache and distcc can understand.
+# We write to a dep file on the side first and then rename at the end
+# so we can't end up with a broken dep file.
+depfile = $(depsdir)/$(call replace_spaces,$@).d
+DEPFLAGS = -MMD -MF $(depfile).raw
+
+# We have to fixup the deps output in a few ways.
+# (1) the file output should mention the proper .o file.
+# ccache or distcc lose the path to the target, so we convert a rule of
+# the form:
+#   foobar.o: DEP1 DEP2
+# into
+#   path/to/foobar.o: DEP1 DEP2
+# (2) we want missing files not to cause us to fail to build.
+# We want to rewrite
+#   foobar.o: DEP1 DEP2 \
+#               DEP3
+# to
+#   DEP1:
+#   DEP2:
+#   DEP3:
+# so if the files are missing, they're just considered phony rules.
+# We have to do some pretty insane escaping to get those backslashes
+# and dollar signs past make, the shell, and sed at the same time.
+# Doesn't work with spaces, but that's fine: .d files have spaces in
+# their names replaced with other characters.
+define fixup_dep
+# The depfile may not exist if the input file didn't have any #includes.
+touch $(depfile).raw
+# Fixup path as in (1).
+sed -e "s|^$(notdir $@)|$@|" $(depfile).raw >> $(depfile)
+# Add extra rules as in (2).
+# We remove slashes and replace spaces with new lines;
+# remove blank lines;
+# delete the first line and append a colon to the remaining lines.
+sed -e 's|\\||' -e 'y| |\n|' $(depfile).raw |\
+  grep -v '^$$'                             |\
+  sed -e 1d -e 's|$$|:|'                     \
+    >> $(depfile)
+rm $(depfile).raw
+endef
+
+# Command definitions:
+# - cmd_foo is the actual command to run;
+# - quiet_cmd_foo is the brief-output summary of the command.
+
+quiet_cmd_cc = CC($(TOOLSET)) $@
+cmd_cc = $(CC.$(TOOLSET)) $(GYP_CFLAGS) $(DEPFLAGS) $(CFLAGS.$(TOOLSET)) -c -o $@ $<
+
+quiet_cmd_cxx = CXX($(TOOLSET)) $@
+cmd_cxx = $(CXX.$(TOOLSET)) $(GYP_CXXFLAGS) $(DEPFLAGS) $(CXXFLAGS.$(TOOLSET)) -c -o $@ $<
+
+quiet_cmd_touch = TOUCH $@
+cmd_touch = touch $@
+
+quiet_cmd_copy = COPY $@
+# send stderr to /dev/null to ignore messages when linking directories.
+cmd_copy = ln -f "$<" "$@" 2>/dev/null || (rm -rf "$@" && cp -af "$<" "$@")
+
+quiet_cmd_alink = AR($(TOOLSET)) $@
+cmd_alink = rm -f $@ && $(AR.$(TOOLSET)) crs $@ $(filter %.o,$^)
+
+quiet_cmd_alink_thin = AR($(TOOLSET)) $@
+cmd_alink_thin = rm -f $@ && $(AR.$(TOOLSET)) crsT $@ $(filter %.o,$^)
+
+# Due to circular dependencies between libraries :(, we wrap the
+# special "figure out circular dependencies" flags around the entire
+# input list during linking.
+quiet_cmd_link = LINK($(TOOLSET)) $@
+cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ -Wl,--start-group $(LD_INPUTS) -Wl,--end-group $(LIBS)
+
+# We support two kinds of shared objects (.so):
+# 1) shared_library, which is just bundling together many dependent libraries
+# into a link line.
+# 2) loadable_module, which is generating a module intended for dlopen().
+#
+# They differ only slightly:
+# In the former case, we want to package all dependent code into the .so.
+# In the latter case, we want to package just the API exposed by the
+# outermost module.
+# This means shared_library uses --whole-archive, while loadable_module doesn't.
+# (Note that --whole-archive is incompatible with the --start-group used in
+# normal linking.)
+
+# Other shared-object link notes:
+# - Set SONAME to the library filename so our binaries don't reference
+# the local, absolute paths used on the link command-line.
+quiet_cmd_solink = SOLINK($(TOOLSET)) $@
+cmd_solink = $(LINK.$(TOOLSET)) -shared $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -Wl,-soname=$(@F) -o $@ -Wl,--whole-archive $(LD_INPUTS) -Wl,--no-whole-archive $(LIBS)
+
+quiet_cmd_solink_module = SOLINK_MODULE($(TOOLSET)) $@
+cmd_solink_module = $(LINK.$(TOOLSET)) -shared $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -Wl,-soname=$(@F) -o $@ -Wl,--start-group $(filter-out FORCE_DO_CMD, $^) -Wl,--end-group $(LIBS)
+
+
+# Define an escape_quotes function to escape single quotes.
+# This allows us to handle quotes properly as long as we always use
+# use single quotes and escape_quotes.
+escape_quotes = $(subst ','\'',$(1))
+# This comment is here just to include a ' to unconfuse syntax highlighting.
+# Define an escape_vars function to escape '$' variable syntax.
+# This allows us to read/write command lines with shell variables (e.g.
+# $LD_LIBRARY_PATH), without triggering make substitution.
+escape_vars = $(subst $$,$$$$,$(1))
+# Helper that expands to a shell command to echo a string exactly as it is in
+# make. This uses printf instead of echo because printf's behaviour with respect
+# to escape sequences is more portable than echo's across different shells
+# (e.g., dash, bash).
+exact_echo = printf '%s\n' '$(call escape_quotes,$(1))'
+
+# Helper to compare the command we're about to run against the command
+# we logged the last time we ran the command.  Produces an empty
+# string (false) when the commands match.
+# Tricky point: Make has no string-equality test function.
+# The kernel uses the following, but it seems like it would have false
+# positives, where one string reordered its arguments.
+#   arg_check = $(strip $(filter-out $(cmd_$(1)), $(cmd_$@)) \
+#                       $(filter-out $(cmd_$@), $(cmd_$(1))))
+# We instead substitute each for the empty string into the other, and
+# say they're equal if both substitutions produce the empty string.
+# .d files contain ? instead of spaces, take that into account.
+command_changed = $(or $(subst $(cmd_$(1)),,$(cmd_$(call replace_spaces,$@))),\
+                       $(subst $(cmd_$(call replace_spaces,$@)),,$(cmd_$(1))))
+
+# Helper that is non-empty when a prerequisite changes.
+# Normally make does this implicitly, but we force rules to always run
+# so we can check their command lines.
+#   $? -- new prerequisites
+#   $| -- order-only dependencies
+prereq_changed = $(filter-out FORCE_DO_CMD,$(filter-out $|,$?))
+
+# Helper that executes all postbuilds until one fails.
+define do_postbuilds
+  @E=0;\
+  for p in $(POSTBUILDS); do\
+    eval $$p;\
+    E=$$?;\
+    if [ $$E -ne 0 ]; then\
+      break;\
+    fi;\
+  done;\
+  if [ $$E -ne 0 ]; then\
+    rm -rf "$@";\
+    exit $$E;\
+  fi
+endef
+
+# do_cmd: run a command via the above cmd_foo names, if necessary.
+# Should always run for a given target to handle command-line changes.
+# Second argument, if non-zero, makes it do asm/C/C++ dependency munging.
+# Third argument, if non-zero, makes it do POSTBUILDS processing.
+# Note: We intentionally do NOT call dirx for depfile, since it contains ? for
+# spaces already and dirx strips the ? characters.
+define do_cmd
+$(if $(or $(command_changed),$(prereq_changed)),
+  @$(call exact_echo,  $($(quiet)cmd_$(1)))
+  @mkdir -p "$(call dirx,$@)" "$(dir $(depfile))"
+  $(if $(findstring flock,$(word 1,$(cmd_$1))),
+    @$(cmd_$(1))
+    @echo "  $(quiet_cmd_$(1)): Finished",
+    @$(cmd_$(1))
+  )
+  @$(call exact_echo,$(call escape_vars,cmd_$(call replace_spaces,$@) := $(cmd_$(1)))) > $(depfile)
+  @$(if $(2),$(fixup_dep))
+  $(if $(and $(3), $(POSTBUILDS)),
+    $(call do_postbuilds)
+  )
+)
+endef
+
+# Declare the "all" target first so it is the default,
+# even though we don't have the deps yet.
+.PHONY: all
+all:
+
+# make looks for ways to re-generate included makefiles, but in our case, we
+# don't have a direct way. Explicitly telling make that it has nothing to do
+# for them makes it go faster.
+%.d: ;
+
+# Use FORCE_DO_CMD to force a target to run.  Should be coupled with
+# do_cmd.
+.PHONY: FORCE_DO_CMD
+FORCE_DO_CMD:
+
+TOOLSET := target
+# Suffix rules, putting all outputs into $(obj).
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.cxx FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.s FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(srcdir)/%.S FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.cxx FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.s FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(obj).$(TOOLSET)/%.S FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(obj)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj)/%.cxx FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+$(obj).$(TOOLSET)/%.o: $(obj)/%.s FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+$(obj).$(TOOLSET)/%.o: $(obj)/%.S FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/odk/src/odk.target.mk)))),)
+  include oemcrypto/odk/src/odk.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/build/ta.target.mk)))),)
+  include oemcrypto/opk/build/ta.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/oemcrypto_ta/oemcrypto_ta.target.mk)))),)
+  include oemcrypto/opk/oemcrypto_ta/oemcrypto_ta.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_clock.target.mk)))),)
+  include oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_clock.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_crypto.target.mk)))),)
+  include oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_crypto.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_root_of_trust.target.mk)))),)
+  include oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_root_of_trust.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,oemcrypto/opk/serialization/tee/opk_tee.target.mk)))),)
+  include oemcrypto/opk/serialization/tee/opk_tee.target.mk
+endif
+ifeq ($(strip $(foreach prefix,$(NO_LOAD),\
+    $(findstring $(join ^,$(prefix)),\
+                 $(join ^,third_party/boringssl/crypto.target.mk)))),)
+  include third_party/boringssl/crypto.target.mk
+endif
+
+# "all" is a concatenation of the "all" targets from all the included
+# sub-makefiles. This is just here to clarify.
+all:
+
+# Add in dependency-tracking rules.  $(all_deps) is the list of every single
+# target in our tree. Only consider the ones with .d (dependency) info:
+d_files := $(wildcard $(foreach f,$(all_deps),$(depsdir)/$(f).d))
+ifneq ($(d_files),)
+  include $(d_files)
+endif
diff --git a/oemcrypto/opk/build/oemcrypto/odk/src/odk.target.mk b/oemcrypto/opk/build/oemcrypto/odk/src/odk.target.mk
new file mode 100644
index 0000000..09000f4
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/odk/src/odk.target.mk
@@ -0,0 +1,143 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := odk
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error=cast-qual \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error=cast-qual \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_message.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_overflow.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_serialize.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_timer.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/serialization_base.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/odk/src/libodk.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/odk/src/libodk.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/odk/src/libodk.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/odk/src/libodk.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/odk/src/libodk.a
+# Add target alias
+.PHONY: odk
+odk: $(obj).target/oemcrypto/odk/src/libodk.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: odk
+
+# Add target alias
+.PHONY: odk
+odk: $(builddir)/libodk.a
+
+# Copy this to the static library output path.
+$(builddir)/libodk.a: TOOLSET := $(TOOLSET)
+$(builddir)/libodk.a: $(obj).target/oemcrypto/odk/src/libodk.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libodk.a
+# Short alias for building this static library.
+.PHONY: libodk.a
+libodk.a: $(obj).target/oemcrypto/odk/src/libodk.a $(builddir)/libodk.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libodk.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/build/liboemcrypto.target.mk b/oemcrypto/opk/build/oemcrypto/opk/build/liboemcrypto.target.mk
new file mode 100644
index 0000000..b77e430
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/build/liboemcrypto.target.mk
@@ -0,0 +1,49 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := liboemcrypto
+### Rules for final target.
+LDFLAGS_debug := \
+	$(LIBOEMCRYPTO_LDFLAGS)
+
+LDFLAGS_release := \
+	$(LIBOEMCRYPTO_LDFLAGS) \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS := \
+	$(TRUSTED_OS_SDK_LIBS) \
+	$(builddir)/libree_tos.a
+
+$(obj).target/oemcrypto/opk/build/liboemcrypto.so: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/build/liboemcrypto.so: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/build/liboemcrypto.so: LD_INPUTS := $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a
+$(obj).target/oemcrypto/opk/build/liboemcrypto.so: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/build/liboemcrypto.so: $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a FORCE_DO_CMD
+	$(call do_cmd,solink)
+
+all_deps += $(obj).target/oemcrypto/opk/build/liboemcrypto.so
+# Add target alias
+.PHONY: liboemcrypto
+liboemcrypto: $(builddir)/lib.target/liboemcrypto.so
+
+# Copy this to the shared library output path.
+$(builddir)/lib.target/liboemcrypto.so: TOOLSET := $(TOOLSET)
+$(builddir)/lib.target/liboemcrypto.so: $(obj).target/oemcrypto/opk/build/liboemcrypto.so FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/lib.target/liboemcrypto.so
+# Short alias for building this shared library.
+.PHONY: liboemcrypto.so
+liboemcrypto.so: $(obj).target/oemcrypto/opk/build/liboemcrypto.so $(builddir)/lib.target/liboemcrypto.so
+
+# Add shared library to "all" target.
+.PHONY: all
+all: $(builddir)/lib.target/liboemcrypto.so
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/build/ta.target.mk b/oemcrypto/opk/build/oemcrypto/opk/build/ta.target.mk
new file mode 100644
index 0000000..002167d
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/build/ta.target.mk
@@ -0,0 +1,52 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := ta
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/build/libta.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/build/libta.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/build/libta.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/build/libta.a:  FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/build/libta.a
+# Add target alias
+.PHONY: ta
+ta: $(obj).target/oemcrypto/opk/build/libta.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: ta
+
+# Add target alias
+.PHONY: ta
+ta: $(builddir)/libta.a
+
+# Copy this to the static library output path.
+$(builddir)/libta.a: TOOLSET := $(TOOLSET)
+$(builddir)/libta.a: $(obj).target/oemcrypto/opk/build/libta.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libta.a
+# Short alias for building this static library.
+.PHONY: libta.a
+libta.a: $(obj).target/oemcrypto/opk/build/libta.a $(builddir)/libta.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libta.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/oemcrypto_ta.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/oemcrypto_ta.target.mk
new file mode 100644
index 0000000..afae255
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/oemcrypto_ta.target.mk
@@ -0,0 +1,165 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_ta
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_asymmetric_key_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_entitled_key_session.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_entitled_key_session_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_key.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_key_control_block.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_key_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_object_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_output.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_overflow.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_serialized_usage_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_session.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_session_key_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_session_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_session_type.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_usage_table.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/oemcrypto_wall_clock.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a
+# Add target alias
+.PHONY: oemcrypto_ta
+oemcrypto_ta: $(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: oemcrypto_ta
+
+# Add target alias
+.PHONY: oemcrypto_ta
+oemcrypto_ta: $(builddir)/liboemcrypto_ta.a
+
+# Copy this to the static library output path.
+$(builddir)/liboemcrypto_ta.a: TOOLSET := $(TOOLSET)
+$(builddir)/liboemcrypto_ta.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/liboemcrypto_ta.a
+# Short alias for building this static library.
+.PHONY: liboemcrypto_ta.a
+liboemcrypto_ta.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/liboemcrypto_ta.a $(builddir)/liboemcrypto_ta.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/liboemcrypto_ta.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_clock.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_clock.target.mk
new file mode 100644
index 0000000..b2629bd
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_clock.target.mk
@@ -0,0 +1,149 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_ta_reference_clock
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_clock_and_gn_layer1.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a
+# Add target alias
+.PHONY: oemcrypto_ta_reference_clock
+oemcrypto_ta_reference_clock: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: oemcrypto_ta_reference_clock
+
+# Add target alias
+.PHONY: oemcrypto_ta_reference_clock
+oemcrypto_ta_reference_clock: $(builddir)/liboemcrypto_ta_reference_clock.a
+
+# Copy this to the static library output path.
+$(builddir)/liboemcrypto_ta_reference_clock.a: TOOLSET := $(TOOLSET)
+$(builddir)/liboemcrypto_ta_reference_clock.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/liboemcrypto_ta_reference_clock.a
+# Short alias for building this static library.
+.PHONY: liboemcrypto_ta_reference_clock.a
+liboemcrypto_ta_reference_clock.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_clock.a $(builddir)/liboemcrypto_ta_reference_clock.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/liboemcrypto_ta_reference_clock.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_crypto.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_crypto.target.mk
new file mode 100644
index 0000000..9d5f80e
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_crypto.target.mk
@@ -0,0 +1,166 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_ta_reference_crypto
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c11
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/third_party/open-dice/include \
+	-I$(srcdir)/third_party/open-dice/include/dice/config/boringssl_ed25519 \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c11
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/third_party/open-dice/include \
+	-I$(srcdir)/third_party/open-dice/include/dice/config/boringssl_ed25519 \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/crypto_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/cose_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/ecc_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/rsa_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crc32.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crypto_asymmetric.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_decrypt_sample.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crypto_and_key_management_layer1_openssl.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a
+# Add target alias
+.PHONY: oemcrypto_ta_reference_crypto
+oemcrypto_ta_reference_crypto: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: oemcrypto_ta_reference_crypto
+
+# Add target alias
+.PHONY: oemcrypto_ta_reference_crypto
+oemcrypto_ta_reference_crypto: $(builddir)/liboemcrypto_ta_reference_crypto.a
+
+# Copy this to the static library output path.
+$(builddir)/liboemcrypto_ta_reference_crypto.a: TOOLSET := $(TOOLSET)
+$(builddir)/liboemcrypto_ta_reference_crypto.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/liboemcrypto_ta_reference_crypto.a
+# Short alias for building this static library.
+.PHONY: liboemcrypto_ta_reference_crypto.a
+liboemcrypto_ta_reference_crypto.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_crypto.a $(builddir)/liboemcrypto_ta_reference_crypto.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/liboemcrypto_ta_reference_crypto.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_renewal.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_renewal.target.mk
new file mode 100644
index 0000000..1f3704c
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_renewal.target.mk
@@ -0,0 +1,150 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_ta_reference_renewal
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_renewal_layer1.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_renewal_layer2.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a
+# Add target alias
+.PHONY: oemcrypto_ta_reference_renewal
+oemcrypto_ta_reference_renewal: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: oemcrypto_ta_reference_renewal
+
+# Add target alias
+.PHONY: oemcrypto_ta_reference_renewal
+oemcrypto_ta_reference_renewal: $(builddir)/liboemcrypto_ta_reference_renewal.a
+
+# Copy this to the static library output path.
+$(builddir)/liboemcrypto_ta_reference_renewal.a: TOOLSET := $(TOOLSET)
+$(builddir)/liboemcrypto_ta_reference_renewal.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/liboemcrypto_ta_reference_renewal.a
+# Short alias for building this static library.
+.PHONY: liboemcrypto_ta_reference_renewal.a
+liboemcrypto_ta_reference_renewal.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_renewal.a $(builddir)/liboemcrypto_ta_reference_renewal.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/liboemcrypto_ta_reference_renewal.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_root_of_trust.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_root_of_trust.target.mk
new file mode 100644
index 0000000..d1be0da
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_reference/oemcrypto_ta_reference_root_of_trust.target.mk
@@ -0,0 +1,154 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_ta_reference_root_of_trust
+DEFS_debug := \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+DEFS_release := \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-pedantic \
+	-pedantic-errors \
+	-Werror=pedantic \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-D_POSIX_C_SOURCE=200809L \
+	-std=c99
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(WTPI_CONFIG_MACRO_DIR) \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/renewal_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crypto_wrap_asymmetric.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_key.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_root_of_trust_layer1.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a
+# Add target alias
+.PHONY: oemcrypto_ta_reference_root_of_trust
+oemcrypto_ta_reference_root_of_trust: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: oemcrypto_ta_reference_root_of_trust
+
+# Add target alias
+.PHONY: oemcrypto_ta_reference_root_of_trust
+oemcrypto_ta_reference_root_of_trust: $(builddir)/liboemcrypto_ta_reference_root_of_trust.a
+
+# Copy this to the static library output path.
+$(builddir)/liboemcrypto_ta_reference_root_of_trust.a: TOOLSET := $(TOOLSET)
+$(builddir)/liboemcrypto_ta_reference_root_of_trust.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/liboemcrypto_ta_reference_root_of_trust.a
+# Short alias for building this static library.
+.PHONY: liboemcrypto_ta_reference_root_of_trust.a
+liboemcrypto_ta_reference_root_of_trust.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_reference/liboemcrypto_ta_reference_root_of_trust.a $(builddir)/liboemcrypto_ta_reference_root_of_trust.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/liboemcrypto_ta_reference_root_of_trust.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/opk_ree_api.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/opk_ree_api.target.mk
new file mode 100644
index 0000000..22e683e
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/opk_ree_api.target.mk
@@ -0,0 +1,157 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := opk_ree_api
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/GEN_ree_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/GEN_oemcrypto_tee_test_api.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/ree_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common/GEN_common_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common/common_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_message.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_overflow.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/bump_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/log_macros.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/length_types.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/marshaller_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_init.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_serialization_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/shared_buffer_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/api_support.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a
+# Add target alias
+.PHONY: opk_ree_api
+opk_ree_api: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: opk_ree_api
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/opk_tee_wtpi_test.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/opk_tee_wtpi_test.target.mk
new file mode 100644
index 0000000..ed23214
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/opk_tee_wtpi_test.target.mk
@@ -0,0 +1,160 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := opk_tee_wtpi_test
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/oemcrypto/opk/serialization/tee/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/generator
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/oemcrypto/opk/serialization/tee/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/generator
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/GEN_dispatcher.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/GEN_tee_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/tee_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common/GEN_common_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common/common_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_message.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_overflow.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/bump_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/length_types.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/log_macros.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/marshaller_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_init.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_serialization_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/shared_buffer_allocator.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a
+# Add target alias
+.PHONY: opk_tee_wtpi_test
+opk_tee_wtpi_test: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee/libopk_tee_wtpi_test.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: opk_tee_wtpi_test
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test.target.mk
new file mode 100644
index 0000000..1498ff6
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test.target.mk
@@ -0,0 +1,164 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := wtpi_test
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/third_party/googletest/googlemock/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/third_party/googletest/googlemock/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test_main.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# Make sure our dependencies are built before any of us.
+$(OBJS): | $(obj).target/third_party/libgtest.a $(builddir)/libwtpi_test_lib.a $(builddir)/libcrypto.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/boringssl/libcrypto.a
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug := \
+	-Wl,--whole-archive \
+	libwtpi_test_lib.a \
+	-Wl,--no-whole-archive
+
+LDFLAGS_release := \
+	-Wl,--whole-archive \
+	libwtpi_test_lib.a \
+	-Wl,--no-whole-archive \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS := \
+	-lrt \
+	-lpthread \
+	-ldl
+
+$(builddir)/wtpi_test: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(builddir)/wtpi_test: LIBS := $(LIBS)
+$(builddir)/wtpi_test: LD_INPUTS := $(OBJS) $(obj).target/third_party/libgtest.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/boringssl/libcrypto.a
+$(builddir)/wtpi_test: TOOLSET := $(TOOLSET)
+$(builddir)/wtpi_test: $(OBJS) $(obj).target/third_party/libgtest.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/boringssl/libcrypto.a FORCE_DO_CMD
+	$(call do_cmd,link)
+
+all_deps += $(builddir)/wtpi_test
+# Add target alias
+.PHONY: wtpi_test
+wtpi_test: $(builddir)/wtpi_test
+
+# Add executable to "all" target.
+.PHONY: all
+all: $(builddir)/wtpi_test
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test_lib.target.mk b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test_lib.target.mk
new file mode 100644
index 0000000..755cfe6
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test_lib.target.mk
@@ -0,0 +1,174 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := wtpi_test_lib
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DMIN_LOG_LEVEL=LOG_LEVEL_DEBUG' \
+	'-DENABLE_ANSI_COLORS=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_test/common \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/oemcrypto/opk/serialization/generator \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/clock_interface_test.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/crypto_test.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/generation_number_interface_test.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/ssl_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/test_rsa_key.o \
+	$(obj).target/$(TARGET)/linux/src/log.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a
+# Add target alias
+.PHONY: wtpi_test_lib
+wtpi_test_lib: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: wtpi_test_lib
+
+# Add target alias
+.PHONY: wtpi_test_lib
+wtpi_test_lib: $(builddir)/libwtpi_test_lib.a
+
+# Copy this to the static library output path.
+$(builddir)/libwtpi_test_lib.a: TOOLSET := $(TOOLSET)
+$(builddir)/libwtpi_test_lib.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libwtpi_test_lib.a
+# Short alias for building this static library.
+.PHONY: libwtpi_test_lib.a
+libwtpi_test_lib.a: $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(builddir)/libwtpi_test_lib.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libwtpi_test_lib.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/serialization/ree/opk_ree.target.mk b/oemcrypto/opk/build/oemcrypto/opk/serialization/ree/opk_ree.target.mk
new file mode 100644
index 0000000..0a8b63e
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/serialization/ree/opk_ree.target.mk
@@ -0,0 +1,173 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := opk_ree
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/api_support.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/GEN_ree_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/GEN_oemcrypto_api.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/ree_os_type.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/ree_version.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/ree_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/ree/special_case_apis.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/bump_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/common_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/GEN_common_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/log_macros.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/length_types.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/marshaller_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/message_debug.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_init.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_serialization_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/shared_buffer_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_message.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_overflow.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a
+# Add target alias
+.PHONY: opk_ree
+opk_ree: $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: opk_ree
+
+# Add target alias
+.PHONY: opk_ree
+opk_ree: $(builddir)/libopk_ree.a
+
+# Copy this to the static library output path.
+$(builddir)/libopk_ree.a: TOOLSET := $(TOOLSET)
+$(builddir)/libopk_ree.a: $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libopk_ree.a
+# Short alias for building this static library.
+.PHONY: libopk_ree.a
+libopk_ree.a: $(obj).target/oemcrypto/opk/serialization/ree/libopk_ree.a $(builddir)/libopk_ree.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libopk_ree.a
+
diff --git a/oemcrypto/opk/build/oemcrypto/opk/serialization/tee/opk_tee.target.mk b/oemcrypto/opk/build/oemcrypto/opk/serialization/tee/opk_tee.target.mk
new file mode 100644
index 0000000..356c7ee
--- /dev/null
+++ b/oemcrypto/opk/build/oemcrypto/opk/serialization/tee/opk_tee.target.mk
@@ -0,0 +1,174 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := opk_tee
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/tee/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/serialization/tee/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/GEN_dispatcher.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/GEN_tee_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/tee_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/tee_os_type.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/tee_version.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/tee/tee_tos_stubs.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/bump_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/common_special_cases.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/GEN_common_serializer.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/length_types.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/log_macros.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/marshaller_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/message_debug.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_init.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/opk_serialization_base.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/serialization/common/shared_buffer_allocator.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_message.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/odk_overflow.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a
+# Add target alias
+.PHONY: opk_tee
+opk_tee: $(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: opk_tee
+
+# Add target alias
+.PHONY: opk_tee
+opk_tee: $(builddir)/libopk_tee.a
+
+# Copy this to the static library output path.
+$(builddir)/libopk_tee.a: TOOLSET := $(TOOLSET)
+$(builddir)/libopk_tee.a: $(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libopk_tee.a
+# Short alias for building this static library.
+.PHONY: libopk_tee.a
+libopk_tee.a: $(obj).target/oemcrypto/opk/serialization/tee/libopk_tee.a $(builddir)/libopk_tee.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libopk_tee.a
+
diff --git a/oemcrypto/opk/build/third_party/boringssl/crypto.target.mk b/oemcrypto/opk/build/third_party/boringssl/crypto.target.mk
new file mode 100644
index 0000000..ee1adb9
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/boringssl/crypto.target.mk
@@ -0,0 +1,368 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := crypto
+DEFS_debug := \
+	'-DOPENSSL_NO_ASM' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fvisibility=hidden \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+DEFS_release := \
+	'-DOPENSSL_NO_ASM' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fvisibility=hidden \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/err_data.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_bitstr.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_bool.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_d2i_fp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_dup.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_enum.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_gentm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_i2d_fp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_int.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_mbstr.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_object.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_octet.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_print.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_strex.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_strnid.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_time.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_type.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_utctm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/a_utf8.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/asn1_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/asn1_par.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/asn_pack.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/f_int.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/f_string.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_dec.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_enc.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_fre.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_new.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_typ.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/tasn_utl.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/asn1/time_support.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/base64/base64.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/bio.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/bio_mem.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/connect.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/fd.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/file.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/hexdump.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/pair.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/printf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/socket.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bio/socket_helper.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/blake2/blake2.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bn_extra/bn_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bn_extra/convert.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/buf/buf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bytestring/asn1_compat.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bytestring/ber.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bytestring/cbb.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bytestring/cbs.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/bytestring/unicode.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/chacha/chacha.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/cipher_extra.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/derive_key.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_aesccm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_aesctrhmac.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_aesgcmsiv.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_chacha20poly1305.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_null.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_rc2.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_rc4.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/e_tls.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cipher_extra/tls_cbc.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cmac/cmac.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/conf/conf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-aarch64-fuchsia.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-aarch64-linux.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-aarch64-win.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-arm-linux.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-arm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-intel.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/cpu-ppc64le.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/crypto.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/curve25519/curve25519.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/curve25519/spake25519.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/dh_extra/dh_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/dh_extra/params.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/digest_extra/digest_extra.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/dsa/dsa.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/dsa/dsa_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ec_extra/ec_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ec_extra/ec_derive.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ec_extra/hash_to_curve.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ecdh_extra/ecdh_extra.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ecdsa_extra/ecdsa_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/engine/engine.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/err/err.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/digestsign.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/evp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/evp_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/evp_ctx.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_dsa_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_ec.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_ec_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_ed25519.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_ed25519_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_rsa.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_rsa_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_x25519.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/p_x25519_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/pbkdf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/print.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/scrypt.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/evp/sign.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/ex_data.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/fipsmodule/bcm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/fipsmodule/fips_shared_support.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/hkdf/hkdf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/hpke/hpke.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/hrss/hrss.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/lhash/lhash.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/mem.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/obj/obj.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/obj/obj_xref.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_all.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_info.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_oth.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_pk8.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_pkey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pem/pem_xaux.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pkcs7/pkcs7.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pkcs7/pkcs7_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pkcs8/p5_pbev2.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pkcs8/pkcs8.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pkcs8/pkcs8_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/poly1305/poly1305.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/poly1305/poly1305_arm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/poly1305/poly1305_vec.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/pool/pool.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/deterministic.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/forkunsafe.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/fuchsia.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/passive.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/rand_extra.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rand_extra/windows.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rc4/rc4.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/refcount_c11.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/refcount_lock.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rsa_extra/rsa_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/rsa_extra/rsa_print.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/siphash/siphash.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/stack/stack.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/thread.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/thread_none.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/thread_pthread.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/thread_win.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/trust_token/pmbtoken.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/trust_token/trust_token.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/trust_token/voprf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/a_digest.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/a_sign.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/a_verify.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/algorithm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/asn1_gen.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/by_dir.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/by_file.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/i2d_pr.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/name_print.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/rsa_pss.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/t_crl.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/t_req.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/t_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/t_x509a.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_att.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_cmp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_d2.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_def.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_ext.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_lu.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_obj.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_req.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_set.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_trs.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_txt.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_v3.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_vfy.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509_vpm.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509cset.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509name.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509rset.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x509spki.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_algor.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_all.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_attrib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_crl.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_exten.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_info.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_name.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_pkey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_pubkey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_req.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_sig.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_spki.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_val.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509/x_x509a.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_cache.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_data.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_map.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_node.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/pcy_tree.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_akey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_akeya.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_alt.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_bcons.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_bitst.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_conf.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_cpols.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_crld.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_enum.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_extku.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_genn.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_ia5.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_info.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_int.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_ncons.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_ocsp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_pci.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_pcia.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_pcons.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_pmaps.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_prn.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_purp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_skey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/crypto/x509v3/v3_utl.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/boringssl/libcrypto.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/boringssl/libcrypto.a: LIBS := $(LIBS)
+$(obj).target/third_party/boringssl/libcrypto.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/boringssl/libcrypto.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/third_party/boringssl/libcrypto.a
+# Add target alias
+.PHONY: crypto
+crypto: $(obj).target/third_party/boringssl/libcrypto.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: crypto
+
+# Add target alias
+.PHONY: crypto
+crypto: $(builddir)/libcrypto.a
+
+# Copy this to the static library output path.
+$(builddir)/libcrypto.a: TOOLSET := $(TOOLSET)
+$(builddir)/libcrypto.a: $(obj).target/third_party/boringssl/libcrypto.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libcrypto.a
+# Short alias for building this static library.
+.PHONY: libcrypto.a
+libcrypto.a: $(obj).target/third_party/boringssl/libcrypto.a $(builddir)/libcrypto.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libcrypto.a
+
diff --git a/oemcrypto/opk/build/third_party/boringssl/ssl.target.mk b/oemcrypto/opk/build/third_party/boringssl/ssl.target.mk
new file mode 100644
index 0000000..d743050
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/boringssl/ssl.target.mk
@@ -0,0 +1,165 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := ssl
+DEFS_debug := \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fvisibility=hidden \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+DEFS_release := \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fvisibility=hidden \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/bio_ssl.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/d1_both.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/d1_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/d1_pkt.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/d1_srtp.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/dtls_method.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/dtls_record.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/encrypted_client_hello.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/extensions.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/handoff.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/handshake.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/handshake_client.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/handshake_server.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/s3_both.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/s3_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/s3_pkt.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_aead_ctx.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_asn1.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_buffer.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_cert.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_cipher.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_file.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_key_share.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_lib.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_privkey.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_session.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_stat.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_transcript.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_versions.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/ssl_x509.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/t1_enc.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls13_both.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls13_client.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls13_enc.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls13_server.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls_method.o \
+	$(obj).target/$(TARGET)/third_party/boringssl/kit/src/ssl/tls_record.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/boringssl/libssl.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/boringssl/libssl.a: LIBS := $(LIBS)
+$(obj).target/third_party/boringssl/libssl.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/boringssl/libssl.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/third_party/boringssl/libssl.a
+# Add target alias
+.PHONY: ssl
+ssl: $(obj).target/third_party/boringssl/libssl.a
+
+# Add target alias
+.PHONY: ssl
+ssl: $(builddir)/libssl.a
+
+# Copy this to the static library output path.
+$(builddir)/libssl.a: TOOLSET := $(TOOLSET)
+$(builddir)/libssl.a: $(obj).target/third_party/boringssl/libssl.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libssl.a
+# Short alias for building this static library.
+.PHONY: libssl.a
+libssl.a: $(obj).target/third_party/boringssl/libssl.a $(builddir)/libssl.a
+
diff --git a/oemcrypto/opk/build/third_party/cbor.target.mk b/oemcrypto/opk/build/third_party/cbor.target.mk
new file mode 100644
index 0000000..d473399
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/cbor.target.mk
@@ -0,0 +1,118 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := cbor
+DEFS_debug := \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/open-dice/include \
+	-I$(srcdir)/third_party/open-dice/include/dice/config/boringssl_ed25519
+
+DEFS_release := \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/open-dice/include \
+	-I$(srcdir)/third_party/open-dice/include/dice/config/boringssl_ed25519
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/open-dice/src/cbor_writer.o \
+	$(obj).target/$(TARGET)/third_party/open-dice/src/clear_memory.o \
+	$(obj).target/$(TARGET)/third_party/open-dice/src/dice.o \
+	$(obj).target/$(TARGET)/third_party/open-dice/src/utils.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/libcbor.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/libcbor.a: LIBS := $(LIBS)
+$(obj).target/third_party/libcbor.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/libcbor.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/third_party/libcbor.a
+# Add target alias
+.PHONY: cbor
+cbor: $(obj).target/third_party/libcbor.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: cbor
+
diff --git a/oemcrypto/opk/build/third_party/gmock.target.mk b/oemcrypto/opk/build/third_party/gmock.target.mk
new file mode 100644
index 0000000..f2653fa
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/gmock.target.mk
@@ -0,0 +1,119 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := gmock
+DEFS_debug := \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+DEFS_release := \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/googletest/googlemock/src/gmock-all.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/libgmock.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/libgmock.a: LIBS := $(LIBS)
+$(obj).target/third_party/libgmock.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/libgmock.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/third_party/libgmock.a
+# Add target alias
+.PHONY: gmock
+gmock: $(obj).target/third_party/libgmock.a
+
diff --git a/oemcrypto/opk/build/third_party/gmock_main.target.mk b/oemcrypto/opk/build/third_party/gmock_main.target.mk
new file mode 100644
index 0000000..668c245
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/gmock_main.target.mk
@@ -0,0 +1,119 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := gmock_main
+DEFS_debug := \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+DEFS_release := \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/googletest/googlemock/src/gmock_main.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/libgmock_main.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/libgmock_main.a: LIBS := $(LIBS)
+$(obj).target/third_party/libgmock_main.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/libgmock_main.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/third_party/libgmock_main.a
+# Add target alias
+.PHONY: gmock_main
+gmock_main: $(obj).target/third_party/libgmock_main.a
+
diff --git a/oemcrypto/opk/build/third_party/gtest.target.mk b/oemcrypto/opk/build/third_party/gtest.target.mk
new file mode 100644
index 0000000..176c864
--- /dev/null
+++ b/oemcrypto/opk/build/third_party/gtest.target.mk
@@ -0,0 +1,123 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := gtest
+DEFS_debug := \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+DEFS_release := \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-Wno-error \
+	-w \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/third_party/googletest/googlemock \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/third_party/googletest/googletest/src/gtest-all.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cc FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/third_party/libgtest.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/third_party/libgtest.a: LIBS := $(LIBS)
+$(obj).target/third_party/libgtest.a: TOOLSET := $(TOOLSET)
+$(obj).target/third_party/libgtest.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink_thin)
+
+all_deps += $(obj).target/third_party/libgtest.a
+# Add target alias
+.PHONY: gtest
+gtest: $(obj).target/third_party/libgtest.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: gtest
+
diff --git a/oemcrypto/opk/ports/optee/host/common/tos/ree_tos.target.mk b/oemcrypto/opk/ports/optee/host/common/tos/ree_tos.target.mk
new file mode 100644
index 0000000..98a6a5a
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/host/common/tos/ree_tos.target.mk
@@ -0,0 +1,162 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := ree_tos
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/include \
+	-I$(OPTEE_DIR)/optee_client/public
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/include \
+	-I$(OPTEE_DIR)/optee_client/public
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/load_library.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_ree_tos.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_secure_buffers.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_tos_log.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a
+# Add target alias
+.PHONY: ree_tos
+ree_tos: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: ree_tos
+
+# Add target alias
+.PHONY: ree_tos
+ree_tos: $(builddir)/libree_tos.a
+
+# Copy this to the static library output path.
+$(builddir)/libree_tos.a: TOOLSET := $(TOOLSET)
+$(builddir)/libree_tos.a: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libree_tos.a
+# Short alias for building this static library.
+.PHONY: libree_tos.a
+libree_tos.a: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos.a $(builddir)/libree_tos.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libree_tos.a
+
diff --git a/oemcrypto/opk/ports/optee/host/common/tos/ree_tos_wtpi.target.mk b/oemcrypto/opk/ports/optee/host/common/tos/ree_tos_wtpi.target.mk
new file mode 100644
index 0000000..f31fb9f
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/host/common/tos/ree_tos_wtpi.target.mk
@@ -0,0 +1,161 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := ree_tos_wtpi
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/include \
+	-I$(OPTEE_DIR)/optee_client/public
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/include \
+	-I$(OPTEE_DIR)/optee_client/public
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_ree_tos.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_secure_buffers.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_tos_log.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug :=
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a
+# Add target alias
+.PHONY: ree_tos_wtpi
+ree_tos_wtpi: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: ree_tos_wtpi
+
+# Add target alias
+.PHONY: ree_tos_wtpi
+ree_tos_wtpi: $(builddir)/libree_tos_wtpi.a
+
+# Copy this to the static library output path.
+$(builddir)/libree_tos_wtpi.a: TOOLSET := $(TOOLSET)
+$(builddir)/libree_tos_wtpi.a: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libree_tos_wtpi.a
+# Short alias for building this static library.
+.PHONY: libree_tos_wtpi.a
+libree_tos_wtpi.a: $(obj).target/oemcrypto/opk/ports/optee/build/libree_tos_wtpi.a $(builddir)/libree_tos_wtpi.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libree_tos_wtpi.a
+
diff --git a/oemcrypto/opk/ports/optee/host/oemcrypto_helloworld/oemcrypto_helloworld.target.mk b/oemcrypto/opk/ports/optee/host/oemcrypto_helloworld/oemcrypto_helloworld.target.mk
new file mode 100644
index 0000000..a994023
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/host/oemcrypto_helloworld/oemcrypto_helloworld.target.mk
@@ -0,0 +1,149 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_helloworld
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/oemcrypto_helloworld/main.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# Make sure our dependencies are built before any of us.
+$(OBJS): | $(builddir)/lib.target/liboemcrypto.so $(obj).target/oemcrypto/opk/build/liboemcrypto.so
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug := \
+	-Wl,-rpath=\$$ORIGIN/lib.target/ \
+	-Wl,-rpath-link=\$(builddir)/lib.target/
+
+LDFLAGS_release := \
+	-O2 \
+	-Wl,--strip-debug \
+	-Wl,-rpath=\$$ORIGIN/lib.target/ \
+	-Wl,-rpath-link=\$(builddir)/lib.target/
+
+LIBS := \
+	$(TRUSTED_OS_SDK_LIBS) \
+	$(builddir)/libree_tos.a
+
+$(builddir)/oemcrypto_helloworld: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(builddir)/oemcrypto_helloworld: LIBS := $(LIBS)
+$(builddir)/oemcrypto_helloworld: LD_INPUTS := $(OBJS) $(obj).target/oemcrypto/opk/build/liboemcrypto.so
+$(builddir)/oemcrypto_helloworld: TOOLSET := $(TOOLSET)
+$(builddir)/oemcrypto_helloworld: $(OBJS) $(obj).target/oemcrypto/opk/build/liboemcrypto.so FORCE_DO_CMD
+	$(call do_cmd,link)
+
+all_deps += $(builddir)/oemcrypto_helloworld
+# Add target alias
+.PHONY: oemcrypto_helloworld
+oemcrypto_helloworld: $(builddir)/oemcrypto_helloworld
+
+# Add executable to "all" target.
+.PHONY: all
+all: $(builddir)/oemcrypto_helloworld
+
diff --git a/oemcrypto/opk/ports/optee/host/oemcrypto_unittests/oemcrypto_unittests.target.mk b/oemcrypto/opk/ports/optee/host/oemcrypto_unittests/oemcrypto_unittests.target.mk
new file mode 100644
index 0000000..945a36b
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/host/oemcrypto_unittests/oemcrypto_unittests.target.mk
@@ -0,0 +1,199 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := oemcrypto_unittests
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-DOEMCRYPTO_TESTS' \
+	'-D_DEFAULT_SOURCE' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/util/test \
+	-I$(srcdir)/oemcrypto/ref/src \
+	-I$(srcdir)/oemcrypto/test \
+	-I$(srcdir)/oemcrypto/test/fuzz_tests \
+	-I$(srcdir)/oemcrypto/util/include \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DOEMCRYPTO_TESTS' \
+	'-D_DEFAULT_SOURCE' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/util/include \
+	-I$(srcdir)/util/test \
+	-I$(srcdir)/oemcrypto/ref/src \
+	-I$(srcdir)/oemcrypto/test \
+	-I$(srcdir)/oemcrypto/test/fuzz_tests \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/util/include \
+	-I$(srcdir)/third_party/boringssl/kit/src/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/test/oemcrypto_test_main.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/core_message_deserialize.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/core_message_serialize.o \
+	$(obj).target/$(TARGET)/linux/src/file_store.o \
+	$(obj).target/$(TARGET)/linux/src/log.o \
+	$(obj).target/$(TARGET)/util/src/cdm_random.o \
+	$(obj).target/$(TARGET)/util/src/platform.o \
+	$(obj).target/$(TARGET)/util/src/rw_lock.o \
+	$(obj).target/$(TARGET)/util/src/string_conversions.o \
+	$(obj).target/$(TARGET)/util/test/test_sleep.o \
+	$(obj).target/$(TARGET)/util/test/test_clock.o \
+	$(obj).target/$(TARGET)/oemcrypto/odk/src/core_message_features.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oec_device_features.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oec_decrypt_fallback_chain.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oec_key_deriver.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oec_session_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oemcrypto_corpus_generator_helper.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oemcrypto_session_tests_helper.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/oemcrypto_test.o \
+	$(obj).target/$(TARGET)/oemcrypto/test/wvcrc.o \
+	$(obj).target/$(TARGET)/oemcrypto/util/src/oemcrypto_ecc_key.o \
+	$(obj).target/$(TARGET)/oemcrypto/util/src/oemcrypto_rsa_key.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# Make sure our dependencies are built before any of us.
+$(OBJS): | $(builddir)/lib.target/liboemcrypto.so $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(builddir)/libodk.a $(builddir)/libssl.a $(builddir)/libcrypto.a $(obj).target/oemcrypto/opk/build/liboemcrypto.so $(obj).target/oemcrypto/odk/src/libodk.a $(obj).target/third_party/boringssl/libssl.a $(obj).target/third_party/boringssl/libcrypto.a
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug := \
+	$(OEMCRYPTO_UNITTEST_LDFLAGS) \
+	-Wl,-rpath=\$$ORIGIN/lib.target/ \
+	-Wl,-rpath-link=\$(builddir)/lib.target/
+
+LDFLAGS_release := \
+	$(OEMCRYPTO_UNITTEST_LDFLAGS) \
+	-O2 \
+	-Wl,--strip-debug \
+	-Wl,-rpath=\$$ORIGIN/lib.target/ \
+	-Wl,-rpath-link=\$(builddir)/lib.target/
+
+LIBS := \
+	$(TRUSTED_OS_SDK_LIBS) \
+	$(builddir)/libree_tos.a \
+	-lpthread
+
+$(builddir)/oemcrypto_unittests: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(builddir)/oemcrypto_unittests: LIBS := $(LIBS)
+$(builddir)/oemcrypto_unittests: LD_INPUTS := $(OBJS) $(obj).target/oemcrypto/opk/build/liboemcrypto.so $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(obj).target/oemcrypto/odk/src/libodk.a $(obj).target/third_party/boringssl/libssl.a $(obj).target/third_party/boringssl/libcrypto.a
+$(builddir)/oemcrypto_unittests: TOOLSET := $(TOOLSET)
+$(builddir)/oemcrypto_unittests: $(OBJS) $(obj).target/oemcrypto/opk/build/liboemcrypto.so $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(obj).target/oemcrypto/odk/src/libodk.a $(obj).target/third_party/boringssl/libssl.a $(obj).target/third_party/boringssl/libcrypto.a FORCE_DO_CMD
+	$(call do_cmd,link)
+
+all_deps += $(builddir)/oemcrypto_unittests
+# Add target alias
+.PHONY: oemcrypto_unittests
+oemcrypto_unittests: $(builddir)/oemcrypto_unittests
+
+# Add executable to "all" target.
+.PHONY: all
+all: $(builddir)/oemcrypto_unittests
+
diff --git a/oemcrypto/opk/ports/optee/host/wtpi_unittests/wtpi_unittests.target.mk b/oemcrypto/opk/ports/optee/host/wtpi_unittests/wtpi_unittests.target.mk
new file mode 100644
index 0000000..2076fcc
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/host/wtpi_unittests/wtpi_unittests.target.mk
@@ -0,0 +1,148 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := wtpi_unittests
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/third_party/googletest/googlemock/include \
+	-I$(srcdir)/third_party/googletest/googletest/include
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_test/wtpi_test_main.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# Make sure our dependencies are built before any of us.
+$(OBJS): | $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a $(builddir)/libwtpi_test_lib.a $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(builddir)/libcrypto.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/boringssl/libcrypto.a
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.cpp FORCE_DO_CMD
+	@$(call do_cmd,cxx,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug := \
+	$(WTPI_UNITTEST_LDFLAGS)
+
+LDFLAGS_release := \
+	$(WTPI_UNITTEST_LDFLAGS) \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS := \
+	-lpthread
+
+$(builddir)/wtpi_unittests: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(builddir)/wtpi_unittests: LIBS := $(LIBS)
+$(builddir)/wtpi_unittests: LD_INPUTS := $(OBJS) $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(obj).target/third_party/boringssl/libcrypto.a
+$(builddir)/wtpi_unittests: TOOLSET := $(TOOLSET)
+$(builddir)/wtpi_unittests: $(OBJS) $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/ree/libopk_ree_api.a $(obj).target/oemcrypto/opk/oemcrypto_ta/wtpi_test/libwtpi_test_lib.a $(obj).target/third_party/libgtest.a $(obj).target/third_party/libgmock.a $(obj).target/third_party/boringssl/libcrypto.a FORCE_DO_CMD
+	$(call do_cmd,link)
+
+all_deps += $(builddir)/wtpi_unittests
+# Add target alias
+.PHONY: wtpi_unittests
+wtpi_unittests: $(builddir)/wtpi_unittests
+
+# Add executable to "all" target.
+.PHONY: all
+all: $(builddir)/wtpi_unittests
+
diff --git a/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_impl.target.mk b/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_impl.target.mk
new file mode 100644
index 0000000..e348846
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_impl.target.mk
@@ -0,0 +1,195 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+
+# This file is generated by gyp; do not edit.
+
+TOOLSET := target
+TARGET := wtpi_impl
+DEFS_debug := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEFAULT_SOURCE' \
+	'-D__USE_MISC' \
+	'-D_DEBUG' \
+	'-D_GLIBCXX_DEBUG'
+
+# Flags passed to all source files.
+CFLAGS_debug := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-g \
+	-Og
+
+# Flags passed to only C files.
+CFLAGS_C_debug := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_debug := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_debug := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/common \
+	-I$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/include \
+	-I$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/include/mbedtls
+
+DEFS_release := \
+	'-DENABLE_LOGGING=1' \
+	'-D_DEFAULT_SOURCE' \
+	'-D__USE_MISC' \
+	'-DNDEBUG'
+
+# Flags passed to all source files.
+CFLAGS_release := \
+	-fPIC \
+	-fvisibility=hidden \
+	-fno-common \
+	-g \
+	-Werror=all \
+	-O2 \
+	-g0
+
+# Flags passed to only C files.
+CFLAGS_C_release := \
+	-std=c11 \
+	-D_POSIX_C_SOURCE=200809L
+
+# Flags passed to only C++ files.
+CFLAGS_CC_release := \
+	-std=c++11 \
+	-Wnon-virtual-dtor \
+	-fno-exceptions \
+	-fno-rtti
+
+INCS_release := \
+	-I$(srcdir)/oemcrypto/opk/serialization \
+	-I$(srcdir)/oemcrypto/opk/serialization/common \
+	-I$(srcdir)/oemcrypto/opk/serialization/common/include \
+	-I$(srcdir)/third_party/nlohmann-json/single_include \
+	-I$(srcdir)/oemcrypto/odk/include \
+	-I$(srcdir)/oemcrypto/odk/src \
+	-I$(srcdir)/oemcrypto/include \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi \
+	-I$(srcdir)/oemcrypto/opk/serialization/os_interfaces \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl \
+	-I$(srcdir)/oemcrypto/opk/oemcrypto_ta/wtpi_reference \
+	-I$(srcdir)/oemcrypto/opk/ports/optee/ta/common \
+	-I$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/include \
+	-I$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/include/mbedtls
+
+OBJS := \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/ta_log.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/der_parse.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/host/common/tos/optee_secure_buffers.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_abort.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_clock_layer2.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_config.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_crypto_and_key_management_layer1.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_crypto_asymmetric.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_decrypt_sample.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_initialize_terminate_interface.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_logging.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_persistent_storage_layer2.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_useless/wtpi_root_of_trust_layer2.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_useless/wtpi_secure_buffer_access.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/renewal_util.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_clock_and_gn_layer1.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crc32.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_crypto_wrap_asymmetric.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_key.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_idle.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_renewal_layer1.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_device_renewal_layer2.o \
+	$(obj).target/$(TARGET)/oemcrypto/opk/oemcrypto_ta/wtpi_reference/wtpi_root_of_trust_layer1.o
+
+# Add to the list of files we specially track dependencies for.
+all_deps += $(OBJS)
+
+# CFLAGS et al overrides must be target-local.
+# See "Target-specific Variable Values" in the GNU Make manual.
+$(OBJS): TOOLSET := $(TOOLSET)
+$(OBJS): GYP_CFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_C_$(BUILDTYPE))
+$(OBJS): GYP_CXXFLAGS := $(DEFS_$(BUILDTYPE)) $(INCS_$(BUILDTYPE))  $(CFLAGS_$(BUILDTYPE)) $(CFLAGS_CC_$(BUILDTYPE))
+
+# Suffix rules, putting all outputs into $(obj).
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(srcdir)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# Try building from generated source, too.
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj).$(TOOLSET)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+$(obj).$(TOOLSET)/$(TARGET)/%.o: $(obj)/%.c FORCE_DO_CMD
+	@$(call do_cmd,cc,1)
+
+# End of this set of suffix rules
+### Rules for final target.
+LDFLAGS_debug := \
+	-L$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/lib \
+	-lmbedtls
+
+LDFLAGS_release := \
+	-L$(OPTEE_DIR)/optee_os/out/arm/export-ta_arm32/lib \
+	-lmbedtls \
+	-O2 \
+	-Wl,--strip-debug
+
+LIBS :=
+
+$(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a: GYP_LDFLAGS := $(LDFLAGS_$(BUILDTYPE))
+$(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a: LIBS := $(LIBS)
+$(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a: TOOLSET := $(TOOLSET)
+$(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a: $(OBJS) FORCE_DO_CMD
+	$(call do_cmd,alink)
+
+all_deps += $(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a
+# Add target alias
+.PHONY: wtpi_impl
+wtpi_impl: $(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a
+
+# Add target alias to "all" target.
+.PHONY: all
+all: wtpi_impl
+
+# Add target alias
+.PHONY: wtpi_impl
+wtpi_impl: $(builddir)/libwtpi_impl.a
+
+# Copy this to the static library output path.
+$(builddir)/libwtpi_impl.a: TOOLSET := $(TOOLSET)
+$(builddir)/libwtpi_impl.a: $(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a FORCE_DO_CMD
+	$(call do_cmd,copy)
+
+all_deps += $(builddir)/libwtpi_impl.a
+# Short alias for building this static library.
+.PHONY: libwtpi_impl.a
+libwtpi_impl.a: $(obj).target/oemcrypto/opk/ports/optee/build/libwtpi_impl.a $(builddir)/libwtpi_impl.a
+
+# Add static library to "all" target.
+.PHONY: all
+all: $(builddir)/libwtpi_impl.a
+
diff --git a/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_root_of_trust_layer1.c b/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_root_of_trust_layer1.c
new file mode 100644
index 0000000..8ca08d5
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/common/wtpi_impl/wtpi_root_of_trust_layer1.c
@@ -0,0 +1,251 @@
+/* Copyright 2019 Google LLC. All Rights Reserved. This file and proprietary
+   source code may only be used and distributed under the Widevine
+   License Agreement. */
+
+#include "wtpi_root_of_trust_interface_layer1.h"
+#include "wtpi_root_of_trust_interface_layer2.h"
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+#include "odk_endian.h"
+#include "oemcrypto_key_types.h"
+#include "renewal_util.h"
+#include "wtpi_abort_interface.h"
+#include "wtpi_config_interface.h"
+#include "wtpi_crc32_interface.h"
+#include "wtpi_crypto_and_key_management_interface_layer1.h"
+#include "wtpi_device_renewal_interface_layer1.h"
+#include "wtpi_logging_interface.h"
+
+// This layer keeps a copy of the keybox in volatile memory.  A more secure
+// implementation of this would only keep the device key in memory while it is
+// in use, or keep it obscured.
+static WidevineKeybox gKeybox;  // The current keybox.
+
+// If the device has been renewed, we need to perform different steps in certain
+// functions and need to store a renewed block of key data.
+static bool perform_renewal;
+static uint8_t renewed_key_data[sizeof(gKeybox.data)];
+
+static uint32_t GetSystemId(const uint8_t* key_data) {
+  uint32_t nbo_system_id;
+  memcpy(&nbo_system_id, &key_data[4], sizeof(nbo_system_id));
+  return oemcrypto_be32toh(nbo_system_id);
+}
+
+static OEMCryptoResult CalculateRenewedKeyData(void) {
+  // Keybox renewal is split into two phases. We renew the key data here and
+  // store the renewed data in renewed_key_data. However, deriving the renewed
+  // key must be done every time the TA requests that it be loaded into a key
+  // handle, and so that step is deferred until
+  // WTPI_CreateKeyHandleFromKeybox().
+
+  uint32_t new_system_id;
+  OEMCryptoResult result = WTPI_GetRenewalSystemId(&new_system_id);
+  if (result != OEMCrypto_SUCCESS) {
+    LOGE("Failed to get renewal system ID with %u", result);
+    return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+  }
+
+  // The new key data is the same as the old key data, but with the version
+  // field at offset 0 and the system ID field at offset 4 modified.
+  memcpy(renewed_key_data, gKeybox.data, sizeof(renewed_key_data));
+  static const uint8_t kVersion3[4] = {0x00, 0x00, 0x00, 0x03};
+  memcpy(&renewed_key_data[0], &kVersion3, sizeof(kVersion3));
+  const uint32_t nbo_system_id = oemcrypto_htobe32(new_system_id);
+  memcpy(&renewed_key_data[4], &nbo_system_id, sizeof(nbo_system_id));
+  return OEMCrypto_SUCCESS;
+}
+
+static OEMCryptoResult InitializeRenewal(void) {
+  OEMCryptoResult result =
+      WTPI_InitializeDeviceRenewal(GetSystemId(gKeybox.data));
+  if (result == OEMCrypto_SUCCESS) {
+    // Success indicates that renewal is needed.
+    perform_renewal = true;
+    result = CalculateRenewedKeyData();
+  } else if (result == OEMCrypto_ERROR_NOT_IMPLEMENTED) {
+    // This is a benign error indicating renewal is not necessary.
+    perform_renewal = false;
+    result = OEMCrypto_SUCCESS;
+  }
+  return result;
+}
+
+OEMCryptoResult WTPI_InitializeKeybox(void) {
+  memset(&gKeybox, 0, sizeof(gKeybox));
+  size_t length = sizeof(gKeybox);
+  OEMCryptoResult result = WTPI_LoadRootOfTrust((uint8_t*)&gKeybox, &length);
+  if (result != OEMCrypto_SUCCESS) {
+    LOGD("Trouble loading the keybox: %u", result);
+    goto cleanup;
+  }
+  if (length == 0) {
+    LOGD("No keybox file loaded.");
+    result = OEMCrypto_ERROR_NO_DEVICE_KEY;
+    goto cleanup;
+  }
+  if (length != sizeof(gKeybox)) {
+    LOGD("That's odd. Keybox was wrong size: %zu != %zu", length,
+         sizeof(gKeybox));
+    result = OEMCrypto_ERROR_KEYBOX_INVALID;
+    goto cleanup;
+  }
+  result = InitializeRenewal();
+cleanup:
+  if (result != OEMCrypto_SUCCESS) {
+    memset(&gKeybox, 0, sizeof(gKeybox));
+    perform_renewal = false;
+    memset(&renewed_key_data, 0, sizeof(renewed_key_data));
+  }
+  return result;
+}
+
+OEMCryptoResult WTPI_TerminateKeybox(void) {
+  memset(&gKeybox, 0, sizeof(gKeybox));
+  perform_renewal = false;
+  memset(&renewed_key_data, 0, sizeof(renewed_key_data));
+  return WTPI_TerminateDeviceRenewal();
+}
+
+OEMCryptoResult WTPI_UnwrapValidateAndInstallKeybox(const uint8_t* input,
+                                                    size_t length) {
+  size_t output_length = sizeof(gKeybox);
+  OEMCryptoResult result;
+  if (length < output_length) {
+    result = OEMCrypto_ERROR_SHORT_BUFFER;
+    goto cleanup;
+  }
+  // First, try the buffer as if is a clear keybox.
+  memcpy(&gKeybox, input, output_length);
+  result = WTPI_ValidateKeybox();
+  if (result != OEMCrypto_SUCCESS) {
+    // If that didn't work, we unwrap the encrypted data that was in input, and
+    // store it in gKeybox.
+    result = WTPI_UnwrapRootOfTrust(input, length, (uint8_t*)&gKeybox,
+                                    &output_length);
+    if (result != OEMCrypto_SUCCESS) goto cleanup;
+    // Keyboxes have a fixed size. This might not be true in the future if we
+    // use a certificate.
+    if (output_length != sizeof(gKeybox)) {
+      result = OEMCrypto_ERROR_SHORT_BUFFER;
+      goto cleanup;
+    }
+    if (result != OEMCrypto_SUCCESS) goto cleanup;
+    // Use the layer above to validate the keybox.
+    result = WTPI_ValidateKeybox();
+    if (result != OEMCrypto_SUCCESS) goto cleanup;
+  }
+  // Since the keybox changed, the renewal info may have changed as well. We
+  // shut down the renewal component and reinitialize it to pick up any changes
+  // to gKeybox.
+  perform_renewal = false;
+  WTPI_TerminateDeviceRenewal();
+  result = InitializeRenewal();
+  if (result != OEMCrypto_SUCCESS) goto cleanup;
+  // If the keybox was valid, then we ask the layer below us to store the keybox
+  // into persistent memory.
+  result = WTPI_SaveRootOfTrust((uint8_t*)&gKeybox, sizeof(gKeybox));
+cleanup:
+  if (result != OEMCrypto_SUCCESS) {
+    WTPI_TerminateKeybox();
+  }
+  return result;
+}
+
+OEMCryptoResult WTPI_ValidateKeybox(void) {
+  if (memcmp(gKeybox.magic, "kbox", 4) != 0) {
+    return OEMCrypto_ERROR_BAD_MAGIC;
+  }
+  uint32_t crc_computed;
+  uint32_t crc_stored;
+  memcpy(&crc_stored, gKeybox.crc, sizeof(uint32_t));
+  crc_stored = oemcrypto_be32toh(crc_stored);
+  OEMCryptoResult result = WTPI_Crc32Init(&crc_computed);
+  if (OEMCrypto_SUCCESS != result) return result;
+  // Compute the CRC-32 of everything but the crc itself.
+  result =
+      WTPI_Crc32Cont((uint8_t*)&gKeybox, sizeof(gKeybox) - sizeof(uint32_t),
+                     crc_computed, &crc_computed);
+  if (result != OEMCrypto_SUCCESS) return result;
+  if (crc_computed != crc_stored) {
+    LOGD("CRC Computed = %08x, stored = %08x", crc_computed, crc_stored);
+    return OEMCrypto_ERROR_BAD_CRC;
+  }
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult WTPI_GetDeviceID(uint8_t* device_id, size_t device_id_length) {
+  if (device_id == NULL) return OEMCrypto_ERROR_INVALID_CONTEXT;
+
+  if (WTPI_GetProvisioningMethod() != OEMCrypto_Keybox) {
+    return OEMCrypto_ERROR_NOT_IMPLEMENTED;
+  }
+
+  if (device_id_length < KEYBOX_DEVICE_ID_SIZE) {
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  memcpy(device_id, gKeybox.device_id, KEYBOX_DEVICE_ID_SIZE);
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult WTPI_GetDeviceIDLength(size_t* device_id_length) {
+  if (device_id_length == NULL) {
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  if (WTPI_GetProvisioningMethod() == OEMCrypto_Keybox) {
+    *device_id_length = KEYBOX_DEVICE_ID_SIZE;
+  } else {
+    return OEMCrypto_ERROR_NOT_IMPLEMENTED;
+  }
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult WTPI_GetKeyDataFromKeybox(uint8_t* key_data, size_t length) {
+  if (key_data == NULL) return OEMCrypto_ERROR_INVALID_CONTEXT;
+  if (length != sizeof(gKeybox.data)) return OEMCrypto_ERROR_INVALID_CONTEXT;
+  if (perform_renewal) {
+    memcpy(key_data, renewed_key_data, length);
+  } else {
+    memcpy(key_data, gKeybox.data, length);
+  }
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult WTPI_LoadTestKeybox(const uint8_t* test_keybox, size_t length) {
+  if (test_keybox == NULL) return OEMCrypto_ERROR_INVALID_CONTEXT;
+  if (length != sizeof(gKeybox)) {
+    LOGD("Wrong keybox size: %zu", length);
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
+  memcpy(&gKeybox, test_keybox, length);
+  // Renewal is not used with the test keybox.
+  perform_renewal = false;
+  return OEMCrypto_SUCCESS;
+}
+
+OEMCryptoResult WTPI_K1_CreateKeyHandleFromKeybox(
+    WTPI_K1_SymmetricKey_Handle* out) {
+  static const size_t kKeyboxKeySize = sizeof(gKeybox.device_key);
+  ABORT_IF(kKeyboxKeySize != KEY_SIZE_128, "Keybox key is an impossible size.");
+  if (perform_renewal) {
+    WTPI_K1_SymmetricKey_Handle renewal_key = NULL;
+    OEMCryptoResult result = WTPI_LoadRenewalKey(&renewal_key);
+    if (result != OEMCrypto_SUCCESS) {
+      LOGE("Failed to load renewal key with %u", result);
+      return OEMCrypto_ERROR_UNKNOWN_FAILURE;
+    }
+
+    result = OPKI_DeriveRenewedKeyboxKey(
+        renewal_key, gKeybox.device_key, kKeyboxKeySize, renewed_key_data,
+        sizeof(renewed_key_data), kKeyboxKeySize, DERIVING_KEY, out);
+    WTPI_K1_FreeKeyHandle(renewal_key);
+    return result;
+  } else {
+    return WTPI_K1_CreateKeyHandle(gKeybox.device_key, kKeyboxKeySize,
+                                   DERIVING_KEY, out);
+  }
+}
diff --git a/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/Makefile b/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/Makefile
new file mode 100644
index 0000000..50dba94
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/Makefile
@@ -0,0 +1,31 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+CFG_TEE_TA_LOG_LEVEL := 4
+
+# The UUID for the Trusted Application
+BINARY=a92d116c-ce27-4917-b30c-4a416e2d9351
+
+# OP-TEE-specifc defines for the target build
+# Must have the following defined for OP-TEE's build system. These are defined
+# by the top level makefile, but can be overridden locally if desired.
+# - CROSS_COMPILE: prefix of compiler, eg arm-linux-gnueabihf-
+# - PLATFORM: OP-TEE platform enumeration, eg vexpress-qemu_virt
+# - TEEC_EXPORT: path to libteec.so in OP-TEE client build output
+# - TA_DEV_KIT_DIR: path to OP-TEE TA dev kit makefiles
+# - O: optional output directory specification
+.EXPORT_ALL_VARIABLES:
+TEEC_EXPORT ?= $(OPTEE_DIR)/out-br/build/optee_client_ext-1.0/libteec
+PATH := $(PATH):$(OPTEE_DIR)/toolchains/aarch32/bin/:$(OPTEE_DIR)/toolchains/aarch64/bin/
+O := ./out
+CFG_TEE_TA_MALLOC_DEBUG:=y
+
+include $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk
+
+ifeq ($(wildcard $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk), )
+clean:
+	@echo 'Note: $$(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk not found, cannot clean TA'
+	@echo 'Note: TA_DEV_KIT_DIR=$(TA_DEV_KIT_DIR)'
+endif
diff --git a/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/sub.mk b/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/sub.mk
new file mode 100644
index 0000000..ea100b4
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/oemcrypto_ta/sub.mk
@@ -0,0 +1,48 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+OEMCRYPTO=../../../../..
+ODK=$(OEMCRYPTO)/odk
+OPK=$(OEMCRYPTO)/opk
+SER=$(OPK)/serialization
+OEMCRYPTO_TA=$(OPK)/oemcrypto_ta
+OPTEE_PORT=$(OPK)/ports/optee
+MAIN_TA=$(OPTEE_PORT)/ta/oemcrypto_ta
+COMMON=$(OPTEE_PORT)/ta/common
+
+global-incdirs-y += $(OEMCRYPTO)/include
+global-incdirs-y += $(ODK)/include
+global-incdirs-y += $(ODK)/src
+global-incdirs-y += $(SER)/common/include
+global-incdirs-y += $(SER)/os_interfaces
+global-incdirs-y += $(OEMCRYPTO_TA)
+global-incdirs-y += $(OEMCRYPTO_TA)/wtpi
+global-incdirs-y += $(MAIN_TA)/include
+global-incdirs-y += $(COMMON)
+
+srcs-y += oemcrypto_ta.c
+
+libdirs += $(OEMCRYPTO)/../out/opk_optee/debug
+
+libnames += odk
+libnames += opk_tee
+libnames += oemcrypto_ta
+libnames += wtpi_impl
+
+ifeq ($(USE_TA_REFERENCE_CRYPTO),yes)
+  libnames += oemcrypto_ta_reference_crypto
+endif
+
+ifeq ($(USE_TA_REFERENCE_CLOCK),yes)
+  libnames += oemcrypto_ta_reference_clock
+endif
+
+ifeq ($(USE_TA_REFERENCE_RENEWAL),yes)
+  libnames += oemcrypto_ta_reference_renewal
+endif
+
+ifeq ($(USE_TA_REFERENCE_ROOT_OF_TRUST),yes)
+  libnames += oemcrypto_ta_reference_root_of_trust
+endif
diff --git a/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/Makefile b/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/Makefile
new file mode 100644
index 0000000..14c27a9
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/Makefile
@@ -0,0 +1,30 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+CFG_TEE_TA_LOG_LEVEL ?= 4
+
+# The UUID for the Trusted Application
+BINARY=b0f42504-01ec-11ec-9a03-0242ac130003
+
+# OP-TEE-specifc defines for the target build
+# Must have the following defined for OP-TEE's build system. These are defined
+# by the top level makefile, but can be overridden locally if desired.
+# - CROSS_COMPILE: prefix of compiler, eg arm-linux-gnueabihf-
+# - PLATFORM: OP-TEE platform enumeration, eg vexpress-qemu_virt
+# - TEEC_EXPORT: path to libteec.so in OP-TEE client build output
+# - TA_DEV_KIT_DIR: path to OP-TEE TA dev kit makefiles
+# - O: optional output directory specification
+.EXPORT_ALL_VARIABLES:
+TEEC_EXPORT ?= $(OPTEE_DIR)/out-br/build/optee_client_ext-1.0/libteec
+PATH := $(PATH):$(OPTEE_DIR)/toolchains/aarch32/bin/:$(OPTEE_DIR)/toolchains/aarch64/bin/
+O := ./out
+
+include $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk
+
+ifeq ($(wildcard $(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk), )
+clean:
+	@echo 'Note: $$(TA_DEV_KIT_DIR)/mk/ta_dev_kit.mk not found, cannot clean TA'
+	@echo 'Note: TA_DEV_KIT_DIR=$(TA_DEV_KIT_DIR)'
+endif
diff --git a/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/sub.mk b/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/sub.mk
new file mode 100644
index 0000000..49898ac
--- /dev/null
+++ b/oemcrypto/opk/ports/optee/ta/wtpi_test_ta/sub.mk
@@ -0,0 +1,34 @@
+#
+# Copyright 2021 Google LLC. All Rights Reserved. This file and proprietary
+# source code may only be used and distributed under the Widevine
+# License Agreement.
+#
+OEMCRYPTO=../../../../..
+ODK=$(OEMCRYPTO)/odk
+OPK=$(OEMCRYPTO)/opk
+SER=$(OPK)/serialization
+OEMCRYPTO_TA=$(OPK)/oemcrypto_ta
+OPTEE_PORT=$(OPK)/ports/optee
+TEST_TA=$(OPTEE_PORT)/ta/wtpi_test_ta
+COMMON=$(OPTEE_PORT)/ta/common
+
+global-incdirs-y += $(OEMCRYPTO)/include
+global-incdirs-y += $(ODK)/include
+global-incdirs-y += $(ODK)/src
+global-incdirs-y += $(SER)/common/include
+global-incdirs-y += $(SER)/os_interfaces
+global-incdirs-y += $(OEMCRYPTO_TA)
+global-incdirs-y += $(OEMCRYPTO_TA)/wtpi
+global-incdirs-y += $(TEST_TA)/include
+global-incdirs-y += $(COMMON)
+
+srcs-y += wtpi_test_ta.c
+srcs-y += $(SER)/tee/tee_tos_stubs.c
+
+libdirs += $(OEMCRYPTO)/../out/opk_optee/debug
+libdirs += $(OEMCRYPTO)/../out/opk_optee/debug/obj.target/oemcrypto/opk/oemcrypto_ta/wtpi_test/tee
+
+libnames += odk
+libnames += opk_tee_wtpi_test
+libnames += oemcrypto_ta
+libnames += wtpi_impl
diff --git a/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Android.mk b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Android.mk
new file mode 100644
index 0000000..2ed63b5
--- /dev/null
+++ b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Android.mk
@@ -0,0 +1,75 @@
+# Unified binary
+LOCAL_PATH:= $(call my-dir)
+SHARED_DIR := $(LOCAL_PATH)/../shared
+CDM_DIR := $(LOCAL_PATH)/../../../../../../
+
+SERIALIZATION_DIR := $(CDM_DIR)/oemcrypto/opk/serialization
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := oemcrypto
+
+LOCAL_CFLAGS:= -DNO_OEMCRYPTO_VARIABLE_DEFINITIONS -fvisibility=hidden
+
+LOCAL_CFLAGS += -Werror
+
+# Trusty-specific code
+LOCAL_SRC_FILES:= \
+	secure_buffer.c \
+	transport.c \
+	$(SHARED_DIR)/shared_memory.c \
+	$(SHARED_DIR)/widevine_ipc_protocol.c \
+
+LOCAL_C_INCLUDES += \
+	include \
+	$(SHARED_DIR)/include \
+
+
+# libtrusty
+# TODO use a common version of libtrusty once this is integrated into Android
+LOCAL_SRC_FILES += \
+	libtrusty/trusty.c \
+
+LOCAL_C_INCLUDES += \
+	libtrusty/include \
+
+
+# Widevine code
+LOCAL_SRC_FILES += \
+	$(CDM_DIR)/oemcrypto/odk/src/odk_message.c \
+	$(CDM_DIR)/oemcrypto/odk/src/odk_overflow.c \
+	$(CDM_DIR)/oemcrypto/odk/src/serialization_base.c \
+	$(SERIALIZATION_DIR)/common/bump_allocator.c \
+	$(SERIALIZATION_DIR)/common/common_special_cases.c \
+	$(SERIALIZATION_DIR)/common/GEN_common_serializer.c \
+	$(SERIALIZATION_DIR)/common/length_types.c \
+	$(SERIALIZATION_DIR)/common/log_macros.c \
+	$(SERIALIZATION_DIR)/common/marshaller_base.c \
+	$(SERIALIZATION_DIR)/common/opk_init.c \
+	$(SERIALIZATION_DIR)/common/opk_serialization_base.c \
+	$(SERIALIZATION_DIR)/common/shared_buffer_allocator.c \
+	$(SERIALIZATION_DIR)/ree/api_support.c \
+	$(SERIALIZATION_DIR)/ree/GEN_oemcrypto_api.c \
+	$(SERIALIZATION_DIR)/ree/GEN_ree_serializer.c \
+	$(SERIALIZATION_DIR)/ree/ree_os_type.c \
+	$(SERIALIZATION_DIR)/ree/ree_special_cases.c \
+	$(SERIALIZATION_DIR)/ree/ree_version.c \
+	$(SERIALIZATION_DIR)/ree/special_case_apis.c \
+
+LOCAL_C_INCLUDES += \
+	$(CDM_DIR)/oemcrypto/include \
+	$(CDM_DIR)/oemcrypto/odk/include \
+	$(CDM_DIR)/oemcrypto/opk/serialization/common \
+	$(CDM_DIR)/oemcrypto/opk/serialization/common/include \
+	$(CDM_DIR)/oemcrypto/odk/src \
+	$(SERIALIZATION_DIR) \
+	$(SERIALIZATION_DIR)/os_interfaces \
+	$(SERIALIZATION_DIR)/ree \
+
+
+# HACK to get oemcrypto_overflow.h
+LOCAL_C_INCLUDES += \
+	$(CDM_DIR)/oemcrypto/opk/oemcrypto_ta \
+
+LOCAL_LDLIBS := -llog
+
+include $(BUILD_SHARED_LIBRARY)
diff --git a/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Application.mk b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Application.mk
new file mode 100644
index 0000000..777b2af
--- /dev/null
+++ b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/Application.mk
@@ -0,0 +1,6 @@
+APP_PLATFORM := android-19
+APP_ABI := arm64-v8a
+APP_STL := c++_static
+APP_CFLAGS := -Werror -Wall -Wextra -Wno-unused-function -Wno-unused-label -Wvla
+APP_CONLYFLAGS += -std=c17
+APP_CPPFLAGS += -std=c++17
diff --git a/oemcrypto/opk/ports/trusty/ta/liboemcrypto/liboemcrypto-inc.mk b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/liboemcrypto-inc.mk
new file mode 100644
index 0000000..c9e2e6c
--- /dev/null
+++ b/oemcrypto/opk/ports/trusty/ta/liboemcrypto/liboemcrypto-inc.mk
@@ -0,0 +1,39 @@
+#
+# Copyright (c) 2021, Google, Inc. All rights reserved
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+ifeq ($(strip $(LIBOEMCRYPTO_BUILD_DIR)),)
+$(error LIBOEMCRYPTO_BUILD_DIR must be specified)
+endif
+
+ifeq ($(strip $(LIBOEMCRYPTO_OUT_DIR)),)
+$(error LIBOEMCRYPTO_OUT_DIR must be specified)
+endif
+
+LIBOEMCRYPTO_SO := $(LIBOEMCRYPTO_OUT_DIR)/lib/arm64-v8a/liboemcrypto.so
+
+$(LIBOEMCRYPTO_SO): LOCAL_DIR := $(GET_LOCAL_DIR)
+$(LIBOEMCRYPTO_SO): LIBOEMCRYPTO_BUILD_DIR := $(LIBOEMCRYPTO_BUILD_DIR)
+$(LIBOEMCRYPTO_SO): LIBOEMCRYPTO_OUT_DIR := $(LIBOEMCRYPTO_OUT_DIR)
+$(LIBOEMCRYPTO_SO): NDK_ROOT := $(TRUSTY_TOP)/prebuilts/ndk/r21
+$(LIBOEMCRYPTO_SO): .PHONY
+	 $(NOECHO)(cd $(LOCAL_DIR) && $(NDK_ROOT)/ndk-build NDK_PROJECT_PATH=$(LIBOEMCRYPTO_BUILD_DIR) NDK_LIBS_OUT=$(LIBOEMCRYPTO_OUT_DIR)/lib APP_BUILD_SCRIPT=Android.mk NDK_APPLICATION_MK=Application.mk -j`nproc`)
+
+# Ensure liboemcrypto.so is built
+EXTRA_BUILDDEPS += $(LIBOEMCRYPTO_SO)
+
+LIBOEMCRYPTO_SO :=
+LIBOEMCRYPTO_OUT_DIR :=
+LIBOEMCRYPTO_BUILD_DIR :=
diff --git a/oemcrypto/opk/ports/trusty/ta/rules.mk b/oemcrypto/opk/ports/trusty/ta/rules.mk
new file mode 100644
index 0000000..eba6526
--- /dev/null
+++ b/oemcrypto/opk/ports/trusty/ta/rules.mk
@@ -0,0 +1,171 @@
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+MODULE := $(LOCAL_DIR)
+
+MANIFEST := $(LOCAL_DIR)/manifest.json
+
+SHARED_DIR := $(LOCAL_DIR)/shared
+IMPL_DIR := $(LOCAL_DIR)/interface_impls
+CDM_DIR := ../../
+APP_DIR := $(CDM_DIR)/oemcrypto/opk/oemcrypto_ta
+SERIALIZATION_DIR := $(CDM_DIR)/oemcrypto/opk/serialization
+ODK_DIR := $(CDM_DIR)/oemcrypto/odk
+
+ifndef WIDEVINE_PROVISION_METHOD
+$(error WIDEVINE_PROVISION_METHOD is not set. \
+        Please set it in the [target_name]-inc.mk file of your project)
+endif
+
+# oemcrypto.h will declare constants as C++-style statics.
+# C sources do not like this, so change the behavior.
+MODULE_CFLAGS += -DNO_OEMCRYPTO_VARIABLE_DEFINITIONS
+
+# Ensure API entry points are renamed in a predictable manner.
+# TODO: can we remove  this?
+MODULE_CFLAGS += -DOEMCRYPTO_TA_TEST_ONLY
+
+# TODO: remove when the prototypes in oemcrypto.h are strict.
+MODULE_CFLAGS += -Wno-strict-prototypes
+
+MODULE_DEFINES += \
+	WIDEVINE_PROVISION_METHOD=$(WIDEVINE_PROVISION_METHOD) \
+
+# The base Trusty app.
+MODULE_SRCS += \
+	$(LOCAL_DIR)/widevine_app.c \
+	$(LOCAL_DIR)/secure_buffer.c \
+	$(LOCAL_DIR)/tee_context.c \
+	$(IMPL_DIR)/device_key_v0.c \
+	$(IMPL_DIR)/wtpi_clock_layer2.c \
+	$(IMPL_DIR)/wtpi_crypto_and_key_management_layer1_openssl.c \
+	$(IMPL_DIR)/wtpi_crypto_asymmetric.c \
+	$(IMPL_DIR)/wtpi_device_key.c \
+	$(IMPL_DIR)/wtpi_secure_buffer_access.c \
+	$(IMPL_DIR)/wtpi_initialize_terminate.c \
+	$(IMPL_DIR)/wtpi_config.c \
+	$(IMPL_DIR)/wtpi_persistent_storage.c \
+	$(IMPL_DIR)/wtpi_root_of_trust_layer2.c \
+	$(IMPL_DIR)/transport_interface.c \
+	$(SHARED_DIR)/shared_memory.c \
+	$(SHARED_DIR)/widevine_ipc_protocol.c \
+
+MODULE_INCLUDES += \
+	$(LOCAL_DIR)/include \
+	$(SHARED_DIR)/include \
+
+
+# Code to deserialize API calls across IPC and serialize responses.
+MODULE_SRCS += \
+	$(ODK_DIR)/src/odk.c \
+	$(ODK_DIR)/src/odk_message.c \
+	$(ODK_DIR)/src/odk_overflow.c \
+	$(ODK_DIR)/src/odk_serialize.c \
+	$(ODK_DIR)/src/odk_timer.c \
+	$(ODK_DIR)/src/odk_util.c \
+	$(ODK_DIR)/src/serialization_base.c \
+	$(SERIALIZATION_DIR)/common/bump_allocator.c \
+	$(SERIALIZATION_DIR)/common/common_special_cases.c \
+	$(SERIALIZATION_DIR)/common/GEN_common_serializer.c \
+	$(SERIALIZATION_DIR)/common/length_types.c \
+	$(SERIALIZATION_DIR)/common/log_macros.c \
+	$(SERIALIZATION_DIR)/common/marshaller_base.c \
+	$(SERIALIZATION_DIR)/common/opk_init.c \
+	$(SERIALIZATION_DIR)/common/opk_serialization_base.c \
+	$(SERIALIZATION_DIR)/common/shared_buffer_allocator.c \
+	$(SERIALIZATION_DIR)/tee/GEN_dispatcher.c \
+	$(SERIALIZATION_DIR)/tee/GEN_tee_serializer.c \
+	$(SERIALIZATION_DIR)/tee/tee_os_type.c \
+	$(SERIALIZATION_DIR)/tee/tee_version.c \
+	$(SERIALIZATION_DIR)/tee/tee_special_cases.c \
+
+# HACK: include dirs out of order to deal with header file masking.
+
+MODULE_INCLUDES += \
+	$(CDM_DIR)/oemcrypto/include \
+	$(ODK_DIR)/include \
+	$(SERIALIZATION_DIR)/common \
+	$(SERIALIZATION_DIR)/common/include \
+	$(CDM_DIR)/oemcrypto/odk/src \
+	$(SERIALIZATION_DIR)/os_interfaces \
+
+# Generic Widevine app code
+MODULE_SRCS += \
+	$(APP_DIR)/oemcrypto.c \
+	$(APP_DIR)/oemcrypto_asymmetric_key_table.c \
+	$(APP_DIR)/oemcrypto_entitled_key_session.c \
+	$(APP_DIR)/oemcrypto_entitled_key_session_table.c \
+	$(APP_DIR)/oemcrypto_key.c \
+	$(APP_DIR)/oemcrypto_key_control_block.c \
+	$(APP_DIR)/oemcrypto_key_table.c \
+	$(APP_DIR)/oemcrypto_object_table.c \
+	$(APP_DIR)/oemcrypto_output.c \
+	$(APP_DIR)/oemcrypto_overflow.c \
+	$(APP_DIR)/oemcrypto_serialized_usage_table.c \
+	$(APP_DIR)/oemcrypto_session.c \
+	$(APP_DIR)/oemcrypto_session_key_table.c \
+	$(APP_DIR)/oemcrypto_session_table.c \
+	$(APP_DIR)/oemcrypto_session_type.c \
+	$(APP_DIR)/oemcrypto_usage_table.c \
+	$(APP_DIR)/oemcrypto_wall_clock.c \
+	$(APP_DIR)/wtpi_reference/crypto_util.c \
+	$(APP_DIR)/wtpi_reference/ecc_util.c \
+	$(APP_DIR)/wtpi_reference/rsa_util.c \
+	$(APP_DIR)/wtpi_reference/wtpi_abort.c \
+	$(APP_DIR)/wtpi_reference/wtpi_clock_and_gn_layer1.c \
+	$(APP_DIR)/wtpi_reference/wtpi_crc32.c \
+	$(APP_DIR)/wtpi_reference/wtpi_crypto_wrap_asymmetric.c \
+	$(APP_DIR)/wtpi_reference/wtpi_decrypt_sample.c \
+	$(APP_DIR)/wtpi_reference/wtpi_idle.c \
+	$(APP_DIR)/wtpi_reference/wtpi_logging.c \
+	$(APP_DIR)/wtpi_reference/wtpi_root_of_trust_layer1.c \
+	$(APP_DIR)/wtpi_reference/wtpi_device_renewal_layer1.c \
+	$(APP_DIR)/wtpi_reference/wtpi_device_renewal_layer2.c \
+	$(APP_DIR)/wtpi_reference/renewal_util.c \
+
+MODULE_INCLUDES += \
+	$(APP_DIR) \
+	$(APP_DIR)/wtpi \
+	$(APP_DIR)/wtpi_reference \
+
+MODULE_LIBRARY_DEPS += \
+	trusty/user/base/interface/hwbcc \
+	trusty/user/base/interface/keybox \
+	trusty/user/base/lib/hwbcc/client \
+	trusty/user/base/lib/hwkey \
+	trusty/user/base/lib/keybox/client \
+	trusty/user/base/lib/libc-trusty \
+	trusty/user/base/lib/storage \
+	trusty/user/base/lib/system_state \
+	trusty/user/base/lib/tipc \
+	external/boringssl \
+
+
+# TODO: abstract out system-specific customization.
+MODULE_SRCS += \
+	$(LOCAL_DIR)/system_specific.c \
+
+# Before including trusted_app.mk, this is the root build directory
+LIBOEMCRYPTO_OUT_DIR := $(BUILDDIR)
+
+LIBOEMCRYPTO_SRC_DIR := $(LOCAL_DIR)/liboemcrypto
+
+include make/trusted_app.mk
+
+# Build liboemcrypto.so
+LIBOEMCRYPTO_BUILD_DIR := $(BUILDDIR)/liboemcrypto
+include $(LIBOEMCRYPTO_SRC_DIR)/liboemcrypto-inc.mk
diff --git a/oemcrypto/renewal/Makefile b/oemcrypto/renewal/Makefile
new file mode 100644
index 0000000..f2bdd38
--- /dev/null
+++ b/oemcrypto/renewal/Makefile
@@ -0,0 +1,3 @@
+derive_key: derive_key.cpp
+	g++ -g -o derive_key derive_key.cpp -lssl -lcrypto
+
diff --git a/oemcrypto/test/Android.mk b/oemcrypto/test/Android.mk
new file mode 100644
index 0000000..5d86cda
--- /dev/null
+++ b/oemcrypto/test/Android.mk
@@ -0,0 +1,25 @@
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_C_INCLUDES := \
+  vendor/widevine/libwvdrmengine/cdm/util/include \
+
+LOCAL_MODULE:=oemcrypto_test
+LOCAL_LICENSE_KINDS:=legacy_by_exception_only
+LOCAL_LICENSE_CONDITIONS:=by_exception_only
+LOCAL_MODULE_TAGS := tests
+
+LOCAL_MODULE_OWNER := widevine
+LOCAL_PROPRIETARY_MODULE := true
+
+# When built, explicitly put it in the DATA/nativetest directory.
+LOCAL_MODULE_PATH := $(TARGET_OUT_DATA)/nativetest
+
+ifneq ($(TARGET_ENABLE_MEDIADRM_64), true)
+LOCAL_MODULE_TARGET_ARCH := arm x86 mips
+endif
+
+include $(LOCAL_PATH)/common.mk
+
+include $(BUILD_EXECUTABLE)
diff --git a/oemcrypto/test/common.mk b/oemcrypto/test/common.mk
new file mode 100644
index 0000000..d154967
--- /dev/null
+++ b/oemcrypto/test/common.mk
@@ -0,0 +1,66 @@
+LOCAL_PATH:= $(call my-dir)
+
+WV_UNITTESTS_BUILD_TARGET?=
+ifeq ($(WV_UNITTESTS_BUILD_TARGET), hidl)
+HIDL_EXTENSION := _hidl
+LIB_BINDER := libhidlbase
+else
+HIDL_EXTENSION :=
+LIB_BINDER := libbinder
+endif
+
+ifeq ($(filter mips mips64, $(TARGET_ARCH)),)
+# Tests need to be compatible with devices that do not support gnu hash-style
+LOCAL_LDFLAGS+=-Wl,--hash-style=both
+endif
+
+# The unit tests can access v15 functions through the dynamic adapter:
+LOCAL_CFLAGS += -DTEST_OEMCRYPTO_V15
+
+LOCAL_SRC_FILES:= \
+  oec_device_features.cpp \
+  oec_decrypt_fallback_chain.cpp \
+  oec_key_deriver.cpp \
+  oec_session_util.cpp \
+  oemcrypto_corpus_generator_helper.cpp \
+  oemcrypto_session_tests_helper.cpp \
+  oemcrypto_test.cpp \
+  oemcrypto_test_android.cpp \
+  oemcrypto_test_main.cpp \
+  ota_keybox_test.cpp \
+  wvcrc.cpp \
+  ../../cdm/util/test/test_sleep.cpp \
+  ../util/src/oemcrypto_ecc_key.cpp \
+  ../util/src/oemcrypto_rsa_key.cpp \
+
+LOCAL_C_INCLUDES += \
+  $(LOCAL_PATH)/fuzz_tests \
+  $(LOCAL_PATH)/../include \
+  $(LOCAL_PATH)/../odk/include \
+  $(LOCAL_PATH)/../odk/kdo/include \
+  $(LOCAL_PATH)/../ref/src \
+  vendor/widevine/libwvdrmengine/cdm/core/include \
+  vendor/widevine/libwvdrmengine/cdm/util/include \
+  vendor/widevine/libwvdrmengine/cdm/util/test \
+
+LOCAL_STATIC_LIBRARIES := \
+  libcdm \
+  libgtest \
+  libgtest_main \
+  libwvlevel3 \
+  libcdm_protos \
+  libcdm_utils_hidl \
+  libwv_kdo \
+  libwv_odk \
+
+LOCAL_SHARED_LIBRARIES := \
+  libbase \
+  libcrypto \
+  libdl \
+  libhidlbase \
+  liblog \
+  libmedia_omx \
+  libprotobuf-cpp-lite \
+  libstagefright_foundation \
+  libutils \
+  libz \