xref: /optee_os/lib/libutee/tee_api_operations.c (revision 325a21556891f408c1319d873d4e414038d1a92b)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <stdlib.h>
28 #include <string.h>
29 #include <string_ext.h>
30 
31 #include <tee_api.h>
32 #include <tee_api_defines_extensions.h>
33 #include <tee_internal_api_extensions.h>
34 #include <utee_syscalls.h>
35 #include <utee_defines.h>
36 #include <util.h>
37 
38 struct __TEE_OperationHandle {
39 	TEE_OperationInfo info;
40 	TEE_ObjectHandle key1;
41 	TEE_ObjectHandle key2;
42 	uint32_t operationState;
43 	uint8_t *buffer;	/* buffer to collect complete blocks */
44 	bool buffer_two_blocks;	/* True if two blocks need to be buffered */
45 	size_t block_size;	/* Block size of cipher */
46 	size_t buffer_offs;	/* Offset in buffer */
47 	uint32_t state;		/* Handle to state in TEE Core */
48 	uint32_t ae_tag_len;	/*
49 				 * tag_len in bytes for AE operation else unused
50 				 */
51 };
52 
53 /* Cryptographic Operations API - Generic Operation Functions */
54 
55 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation,
56 				 uint32_t algorithm, uint32_t mode,
57 				 uint32_t maxKeySize)
58 {
59 	TEE_Result res;
60 	TEE_OperationHandle op = TEE_HANDLE_NULL;
61 	uint32_t handle_state = 0;
62 	size_t block_size = 1;
63 	uint32_t req_key_usage;
64 	bool with_private_key = false;
65 	bool buffer_two_blocks = false;
66 
67 	if (!operation)
68 		TEE_Panic(0);
69 
70 	if (algorithm == TEE_ALG_AES_XTS)
71 		handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS;
72 
73 	/* Check algorithm max key size */
74 	switch (algorithm) {
75 	case TEE_ALG_DSA_SHA1:
76 		if (maxKeySize < 512)
77 			return TEE_ERROR_NOT_SUPPORTED;
78 		if (maxKeySize > 1024)
79 			return TEE_ERROR_NOT_SUPPORTED;
80 		if (maxKeySize % 64 != 0)
81 			return TEE_ERROR_NOT_SUPPORTED;
82 		break;
83 
84 	case TEE_ALG_DSA_SHA224:
85 		if (maxKeySize != 2048)
86 			return TEE_ERROR_NOT_SUPPORTED;
87 		break;
88 
89 	case TEE_ALG_DSA_SHA256:
90 		if (maxKeySize != 2048 && maxKeySize != 3072)
91 			return TEE_ERROR_NOT_SUPPORTED;
92 		break;
93 
94 	case TEE_ALG_ECDSA_P192:
95 	case TEE_ALG_ECDH_P192:
96 		if (maxKeySize != 192)
97 			return TEE_ERROR_NOT_SUPPORTED;
98 		break;
99 
100 	case TEE_ALG_ECDSA_P224:
101 	case TEE_ALG_ECDH_P224:
102 		if (maxKeySize != 224)
103 			return TEE_ERROR_NOT_SUPPORTED;
104 		break;
105 
106 	case TEE_ALG_ECDSA_P256:
107 	case TEE_ALG_ECDH_P256:
108 		if (maxKeySize != 256)
109 			return TEE_ERROR_NOT_SUPPORTED;
110 		break;
111 
112 	case TEE_ALG_ECDSA_P384:
113 	case TEE_ALG_ECDH_P384:
114 		if (maxKeySize != 384)
115 			return TEE_ERROR_NOT_SUPPORTED;
116 		break;
117 
118 	case TEE_ALG_ECDSA_P521:
119 	case TEE_ALG_ECDH_P521:
120 		if (maxKeySize != 521)
121 			return TEE_ERROR_NOT_SUPPORTED;
122 		break;
123 
124 	default:
125 		break;
126 	}
127 
128 	/* Check algorithm mode */
129 	switch (algorithm) {
130 	case TEE_ALG_AES_CTS:
131 	case TEE_ALG_AES_XTS:
132 		buffer_two_blocks = true;
133 	 /*FALLTHROUGH*/ case TEE_ALG_AES_ECB_NOPAD:
134 	case TEE_ALG_AES_CBC_NOPAD:
135 	case TEE_ALG_AES_CTR:
136 	case TEE_ALG_AES_CCM:
137 	case TEE_ALG_AES_GCM:
138 	case TEE_ALG_DES_ECB_NOPAD:
139 	case TEE_ALG_DES_CBC_NOPAD:
140 	case TEE_ALG_DES3_ECB_NOPAD:
141 	case TEE_ALG_DES3_CBC_NOPAD:
142 		if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES)
143 			block_size = TEE_AES_BLOCK_SIZE;
144 		else
145 			block_size = TEE_DES_BLOCK_SIZE;
146 
147 		if (mode == TEE_MODE_ENCRYPT)
148 			req_key_usage = TEE_USAGE_ENCRYPT;
149 		else if (mode == TEE_MODE_DECRYPT)
150 			req_key_usage = TEE_USAGE_DECRYPT;
151 		else
152 			return TEE_ERROR_NOT_SUPPORTED;
153 		break;
154 
155 	case TEE_ALG_RSASSA_PKCS1_V1_5_MD5:
156 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1:
157 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224:
158 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256:
159 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384:
160 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512:
161 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1:
162 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224:
163 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256:
164 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384:
165 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512:
166 	case TEE_ALG_DSA_SHA1:
167 	case TEE_ALG_DSA_SHA224:
168 	case TEE_ALG_DSA_SHA256:
169 	case TEE_ALG_ECDSA_P192:
170 	case TEE_ALG_ECDSA_P224:
171 	case TEE_ALG_ECDSA_P256:
172 	case TEE_ALG_ECDSA_P384:
173 	case TEE_ALG_ECDSA_P521:
174 		if (mode == TEE_MODE_SIGN) {
175 			with_private_key = true;
176 			req_key_usage = TEE_USAGE_SIGN;
177 		} else if (mode == TEE_MODE_VERIFY) {
178 			req_key_usage = TEE_USAGE_VERIFY;
179 		} else {
180 			return TEE_ERROR_NOT_SUPPORTED;
181 		}
182 		break;
183 
184 	case TEE_ALG_RSAES_PKCS1_V1_5:
185 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1:
186 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224:
187 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256:
188 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384:
189 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512:
190 		if (mode == TEE_MODE_ENCRYPT) {
191 			req_key_usage = TEE_USAGE_ENCRYPT;
192 		} else if (mode == TEE_MODE_DECRYPT) {
193 			with_private_key = true;
194 			req_key_usage = TEE_USAGE_DECRYPT;
195 		} else {
196 			return TEE_ERROR_NOT_SUPPORTED;
197 		}
198 		break;
199 
200 	case TEE_ALG_RSA_NOPAD:
201 		if (mode == TEE_MODE_ENCRYPT) {
202 			req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY;
203 		} else if (mode == TEE_MODE_DECRYPT) {
204 			with_private_key = true;
205 			req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN;
206 		} else {
207 			return TEE_ERROR_NOT_SUPPORTED;
208 		}
209 		break;
210 
211 	case TEE_ALG_DH_DERIVE_SHARED_SECRET:
212 	case TEE_ALG_ECDH_P192:
213 	case TEE_ALG_ECDH_P224:
214 	case TEE_ALG_ECDH_P256:
215 	case TEE_ALG_ECDH_P384:
216 	case TEE_ALG_ECDH_P521:
217 	case TEE_ALG_HKDF_MD5_DERIVE_KEY:
218 	case TEE_ALG_HKDF_SHA1_DERIVE_KEY:
219 	case TEE_ALG_HKDF_SHA224_DERIVE_KEY:
220 	case TEE_ALG_HKDF_SHA256_DERIVE_KEY:
221 	case TEE_ALG_HKDF_SHA384_DERIVE_KEY:
222 	case TEE_ALG_HKDF_SHA512_DERIVE_KEY:
223 	case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY:
224 	case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY:
225 	case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY:
226 	case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY:
227 	case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY:
228 	case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY:
229 		if (mode != TEE_MODE_DERIVE)
230 			return TEE_ERROR_NOT_SUPPORTED;
231 		with_private_key = true;
232 		req_key_usage = TEE_USAGE_DERIVE;
233 		break;
234 
235 	case TEE_ALG_MD5:
236 	case TEE_ALG_SHA1:
237 	case TEE_ALG_SHA224:
238 	case TEE_ALG_SHA256:
239 	case TEE_ALG_SHA384:
240 	case TEE_ALG_SHA512:
241 		if (mode != TEE_MODE_DIGEST)
242 			return TEE_ERROR_NOT_SUPPORTED;
243 		/* v1.1: flags always set for digest operations */
244 		handle_state |= TEE_HANDLE_FLAG_KEY_SET;
245 		req_key_usage = 0;
246 		break;
247 
248 	case TEE_ALG_DES_CBC_MAC_NOPAD:
249 	case TEE_ALG_AES_CBC_MAC_NOPAD:
250 	case TEE_ALG_AES_CBC_MAC_PKCS5:
251 	case TEE_ALG_AES_CMAC:
252 	case TEE_ALG_DES_CBC_MAC_PKCS5:
253 	case TEE_ALG_DES3_CBC_MAC_NOPAD:
254 	case TEE_ALG_DES3_CBC_MAC_PKCS5:
255 	case TEE_ALG_HMAC_MD5:
256 	case TEE_ALG_HMAC_SHA1:
257 	case TEE_ALG_HMAC_SHA224:
258 	case TEE_ALG_HMAC_SHA256:
259 	case TEE_ALG_HMAC_SHA384:
260 	case TEE_ALG_HMAC_SHA512:
261 		if (mode != TEE_MODE_MAC)
262 			return TEE_ERROR_NOT_SUPPORTED;
263 		req_key_usage = TEE_USAGE_MAC;
264 		break;
265 
266 	default:
267 		return TEE_ERROR_NOT_SUPPORTED;
268 	}
269 
270 	op = TEE_Malloc(sizeof(*op), 0);
271 	if (!op)
272 		return TEE_ERROR_OUT_OF_MEMORY;
273 
274 	op->info.algorithm = algorithm;
275 	op->info.operationClass = TEE_ALG_GET_CLASS(algorithm);
276 	op->info.mode = mode;
277 	op->info.maxKeySize = maxKeySize;
278 	op->info.requiredKeyUsage = req_key_usage;
279 	op->info.handleState = handle_state;
280 
281 	if (block_size > 1) {
282 		size_t buffer_size = block_size;
283 
284 		if (buffer_two_blocks)
285 			buffer_size *= 2;
286 
287 		op->buffer = TEE_Malloc(buffer_size,
288 					TEE_USER_MEM_HINT_NO_FILL_ZERO);
289 		if (op->buffer == NULL) {
290 			res = TEE_ERROR_OUT_OF_MEMORY;
291 			goto err0;
292 		}
293 	}
294 	op->block_size = block_size;
295 	op->buffer_two_blocks = buffer_two_blocks;
296 
297 	if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) {
298 		uint32_t mks = maxKeySize;
299 		TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm,
300 						       with_private_key);
301 
302 		/*
303 		 * If two keys are expected the max key size is the sum of
304 		 * the size of both keys.
305 		 */
306 		if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS)
307 			mks /= 2;
308 
309 		res = TEE_AllocateTransientObject(key_type, mks, &op->key1);
310 		if (res != TEE_SUCCESS)
311 			goto err1;
312 
313 		if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) {
314 			res = TEE_AllocateTransientObject(key_type, mks,
315 							  &op->key2);
316 			if (res != TEE_SUCCESS)
317 				goto err2;
318 		}
319 	}
320 
321 	res = utee_cryp_state_alloc(algorithm, mode, (uint32_t) op->key1,
322 				    (uint32_t) op->key2, &op->state);
323 	if (res != TEE_SUCCESS) {
324 		if ((op->info.handleState &
325 		     TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 0)
326 			goto err2;
327 		goto err1;
328 	}
329 
330 	/*
331 	 * Initialize digest operations
332 	 * Other multi-stage operations initialized w/ TEE_xxxInit functions
333 	 * Non-applicable on asymmetric operations
334 	 */
335 	if (TEE_ALG_GET_CLASS(algorithm) == TEE_OPERATION_DIGEST) {
336 		res = utee_hash_init(op->state, NULL, 0);
337 		if (res != TEE_SUCCESS)
338 			goto err0;
339 		/* v1.1: flags always set for digest operations */
340 		op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
341 	}
342 
343 	*operation = op;
344 	goto out;
345 
346 err2:
347 	TEE_FreeTransientObject(op->key2);
348 err1:
349 	TEE_FreeTransientObject(op->key1);
350 err0:
351 	TEE_FreeOperation(op);
352 
353 	if (res != TEE_SUCCESS &&
354 	    res != TEE_ERROR_OUT_OF_MEMORY &&
355 	    res != TEE_ERROR_NOT_SUPPORTED)
356 		TEE_Panic(0);
357 out:
358 	return res;
359 }
360 
361 void TEE_FreeOperation(TEE_OperationHandle operation)
362 {
363 	TEE_Result res;
364 
365 	if (operation == TEE_HANDLE_NULL)
366 		TEE_Panic(0);
367 
368 	/*
369 	 * Note that keys should not be freed here, since they are
370 	 * claimed by the operation they will be freed by
371 	 * utee_cryp_state_free().
372 	 */
373 	res = utee_cryp_state_free(operation->state);
374 	if (res != TEE_SUCCESS)
375 		TEE_Panic(0);
376 
377 	TEE_Free(operation->buffer);
378 	TEE_Free(operation);
379 }
380 
381 void TEE_GetOperationInfo(TEE_OperationHandle operation,
382 			  TEE_OperationInfo *operationInfo)
383 {
384 	if (operation == TEE_HANDLE_NULL)
385 		TEE_Panic(0);
386 
387 	if (!operationInfo)
388 		TEE_Panic(0);
389 
390 	*operationInfo = operation->info;
391 }
392 
393 TEE_Result TEE_GetOperationInfoMultiple(TEE_OperationHandle operation,
394 			  TEE_OperationInfoMultiple *operationInfoMultiple,
395 			  uint32_t *operationSize)
396 {
397 	TEE_Result res = TEE_SUCCESS;
398 	TEE_ObjectInfo key_info1;
399 	TEE_ObjectInfo key_info2;
400 	uint32_t num_of_keys;
401 	size_t n;
402 
403 	if (operation == TEE_HANDLE_NULL) {
404 		res = TEE_ERROR_BAD_PARAMETERS;
405 		goto out;
406 	}
407 
408 	if (!operationInfoMultiple) {
409 		res = TEE_ERROR_BAD_PARAMETERS;
410 		goto out;
411 	}
412 
413 	if (!operationSize) {
414 		res = TEE_ERROR_BAD_PARAMETERS;
415 		goto out;
416 	}
417 
418 	num_of_keys = (*operationSize-sizeof(TEE_OperationInfoMultiple))/
419 			sizeof(TEE_OperationInfoKey);
420 
421 	if (num_of_keys > 2) {
422 		res = TEE_ERROR_BAD_PARAMETERS;
423 		goto out;
424 	}
425 
426 	/* Two keys flag (TEE_ALG_AES_XTS only) */
427 	if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) !=
428 	    0 &&
429 	    (num_of_keys != 2)) {
430 		res = TEE_ERROR_SHORT_BUFFER;
431 		goto out;
432 	}
433 
434 	/* Clear */
435 	for (n = 0; n < num_of_keys; n++) {
436 		operationInfoMultiple->keyInformation[n].keySize = 0;
437 		operationInfoMultiple->keyInformation[n].requiredKeyUsage = 0;
438 	}
439 
440 	if (num_of_keys == 2) {
441 		res = TEE_GetObjectInfo1(operation->key2, &key_info2);
442 		/* Key2 is not a valid handle */
443 		if (res != TEE_SUCCESS)
444 			goto out;
445 
446 		operationInfoMultiple->keyInformation[1].keySize =
447 			key_info2.keySize;
448 		operationInfoMultiple->keyInformation[1].requiredKeyUsage =
449 			operation->info.requiredKeyUsage;
450 	}
451 
452 	if (num_of_keys >= 1) {
453 		res = TEE_GetObjectInfo1(operation->key1, &key_info1);
454 		/* Key1 is not a valid handle */
455 		if (res != TEE_SUCCESS) {
456 			if (num_of_keys == 2) {
457 				operationInfoMultiple->keyInformation[1].
458 							keySize = 0;
459 				operationInfoMultiple->keyInformation[1].
460 							requiredKeyUsage = 0;
461 			}
462 			goto out;
463 		}
464 
465 		operationInfoMultiple->keyInformation[0].keySize =
466 			key_info1.keySize;
467 		operationInfoMultiple->keyInformation[0].requiredKeyUsage =
468 			operation->info.requiredKeyUsage;
469 	}
470 
471 	/* No key */
472 	operationInfoMultiple->algorithm = operation->info.algorithm;
473 	operationInfoMultiple->operationClass = operation->info.operationClass;
474 	operationInfoMultiple->mode = operation->info.mode;
475 	operationInfoMultiple->digestLength = operation->info.digestLength;
476 	operationInfoMultiple->maxKeySize = operation->info.maxKeySize;
477 	operationInfoMultiple->handleState = operation->info.handleState;
478 	operationInfoMultiple->operationState = operation->operationState;
479 	operationInfoMultiple->numberOfKeys = num_of_keys;
480 
481 out:
482 	if (res != TEE_SUCCESS &&
483 	    res != TEE_ERROR_SHORT_BUFFER)
484 		TEE_Panic(0);
485 
486 	return res;
487 }
488 
489 void TEE_ResetOperation(TEE_OperationHandle operation)
490 {
491 	TEE_Result res;
492 
493 	if (operation == TEE_HANDLE_NULL)
494 		TEE_Panic(0);
495 
496 	if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0)
497 			TEE_Panic(0);
498 
499 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
500 		res = utee_hash_init(operation->state, NULL, 0);
501 		if (res != TEE_SUCCESS)
502 			TEE_Panic(res);
503 		operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
504 	} else {
505 		operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
506 	}
507 }
508 
509 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation,
510 			       TEE_ObjectHandle key)
511 {
512 	TEE_Result res;
513 	uint32_t key_size = 0;
514 	TEE_ObjectInfo key_info;
515 
516 	/* Operation is not a valid handle */
517 	if (operation == TEE_HANDLE_NULL) {
518 		res = TEE_ERROR_BAD_PARAMETERS;
519 		goto out;
520 	}
521 
522 	/* Key is not initialized */
523 	if (key == TEE_HANDLE_NULL) {
524 		/* Operation key cleared */
525 		TEE_ResetTransientObject(operation->key1);
526 		res = TEE_ERROR_BAD_PARAMETERS;
527 		goto out;
528 	}
529 
530 	/* No key for digest operation */
531 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
532 		res = TEE_ERROR_BAD_PARAMETERS;
533 		goto out;
534 	}
535 
536 	/* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */
537 	if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) !=
538 	    0) {
539 		res = TEE_ERROR_BAD_PARAMETERS;
540 		goto out;
541 	}
542 
543 	res = TEE_GetObjectInfo1(key, &key_info);
544 	/* Key is not a valid handle */
545 	if (res != TEE_SUCCESS)
546 		goto out;
547 
548 	/* Supplied key has to meet required usage */
549 	if ((key_info.objectUsage & operation->info.requiredKeyUsage) !=
550 	    operation->info.requiredKeyUsage) {
551 		res = TEE_ERROR_BAD_PARAMETERS;
552 		goto out;
553 	}
554 
555 	if (operation->info.maxKeySize < key_info.keySize) {
556 		res = TEE_ERROR_BAD_PARAMETERS;
557 		goto out;
558 	}
559 
560 	key_size = key_info.keySize;
561 
562 	TEE_ResetTransientObject(operation->key1);
563 	operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET;
564 
565 	res = TEE_CopyObjectAttributes1(operation->key1, key);
566 	if (res != TEE_SUCCESS)
567 		goto out;
568 
569 	operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET;
570 
571 	operation->info.keySize = key_size;
572 
573 out:
574 	if (res != TEE_SUCCESS  &&
575 	    res != TEE_ERROR_CORRUPT_OBJECT &&
576 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE)
577 		TEE_Panic(0);
578 
579 	return res;
580 }
581 
582 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation,
583 				TEE_ObjectHandle key1, TEE_ObjectHandle key2)
584 {
585 	TEE_Result res;
586 	uint32_t key_size = 0;
587 	TEE_ObjectInfo key_info1;
588 	TEE_ObjectInfo key_info2;
589 
590 	/* Operation is not a valid handle */
591 	if (operation == TEE_HANDLE_NULL) {
592 		res = TEE_ERROR_BAD_PARAMETERS;
593 		goto out;
594 	}
595 
596 	/*
597 	 * Key1/Key2 and/or are not initialized and
598 	 * Either both keys are NULL or both are not NULL
599 	 */
600 	if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) {
601 		/* Clear operation key1 (if needed) */
602 		if (key1 == TEE_HANDLE_NULL)
603 			TEE_ResetTransientObject(operation->key1);
604 		/* Clear operation key2 (if needed) */
605 		if (key2 == TEE_HANDLE_NULL)
606 			TEE_ResetTransientObject(operation->key2);
607 		res = TEE_ERROR_BAD_PARAMETERS;
608 		goto out;
609 	}
610 
611 	/* No key for digest operation */
612 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
613 		res = TEE_ERROR_BAD_PARAMETERS;
614 		goto out;
615 	}
616 
617 	/* Two keys flag expected (TEE_ALG_AES_XTS only) */
618 	if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) ==
619 	    0) {
620 		res = TEE_ERROR_BAD_PARAMETERS;
621 		goto out;
622 	}
623 
624 	res = TEE_GetObjectInfo1(key1, &key_info1);
625 	/* Key1 is not a valid handle */
626 	if (res != TEE_SUCCESS)
627 		goto out;
628 
629 	/* Supplied key has to meet required usage */
630 	if ((key_info1.objectUsage & operation->info.
631 	     requiredKeyUsage) != operation->info.requiredKeyUsage) {
632 		res = TEE_ERROR_BAD_PARAMETERS;
633 		goto out;
634 	}
635 
636 	res = TEE_GetObjectInfo1(key2, &key_info2);
637 	/* Key2 is not a valid handle */
638 	if (res != TEE_SUCCESS) {
639 		if (res == TEE_ERROR_CORRUPT_OBJECT)
640 			res = TEE_ERROR_CORRUPT_OBJECT_2;
641 		goto out;
642 	}
643 
644 	/* Supplied key has to meet required usage */
645 	if ((key_info2.objectUsage & operation->info.
646 	     requiredKeyUsage) != operation->info.requiredKeyUsage) {
647 		res = TEE_ERROR_BAD_PARAMETERS;
648 		goto out;
649 	}
650 
651 	/*
652 	 * AES-XTS (the only multi key algorithm supported, requires the
653 	 * keys to be of equal size.
654 	 */
655 	if (operation->info.algorithm == TEE_ALG_AES_XTS &&
656 	    key_info1.keySize != key_info2.keySize) {
657 		res = TEE_ERROR_BAD_PARAMETERS;
658 		goto out;
659 
660 	}
661 
662 	if (operation->info.maxKeySize < key_info1.keySize) {
663 		res = TEE_ERROR_BAD_PARAMETERS;
664 		goto out;
665 	}
666 
667 	/*
668 	 * Odd that only the size of one key should be reported while
669 	 * size of two key are used when allocating the operation.
670 	 */
671 	key_size = key_info1.keySize;
672 
673 	TEE_ResetTransientObject(operation->key1);
674 	TEE_ResetTransientObject(operation->key2);
675 	operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET;
676 
677 	res = TEE_CopyObjectAttributes1(operation->key1, key1);
678 	if (res != TEE_SUCCESS)
679 		goto out;
680 
681 	res = TEE_CopyObjectAttributes1(operation->key2, key2);
682 	if (res != TEE_SUCCESS) {
683 		if (res == TEE_ERROR_CORRUPT_OBJECT)
684 			res = TEE_ERROR_CORRUPT_OBJECT_2;
685 		goto out;
686 	}
687 
688 	operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET;
689 
690 	operation->info.keySize = key_size;
691 
692 out:
693 	if (res != TEE_SUCCESS  &&
694 	    res != TEE_ERROR_CORRUPT_OBJECT &&
695 	    res != TEE_ERROR_CORRUPT_OBJECT_2 &&
696 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE &&
697 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2)
698 		TEE_Panic(0);
699 
700 	return res;
701 }
702 
703 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op)
704 {
705 	TEE_Result res;
706 
707 	if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL)
708 		TEE_Panic(0);
709 	if (dst_op->info.algorithm != src_op->info.algorithm)
710 		TEE_Panic(0);
711 	if (src_op->info.operationClass != TEE_OPERATION_DIGEST) {
712 		TEE_ObjectHandle key1 = TEE_HANDLE_NULL;
713 		TEE_ObjectHandle key2 = TEE_HANDLE_NULL;
714 
715 		if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) {
716 			key1 = src_op->key1;
717 			key2 = src_op->key2;
718 		}
719 
720 		if ((src_op->info.handleState &
721 		     TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) {
722 			TEE_SetOperationKey(dst_op, key1);
723 		} else {
724 			TEE_SetOperationKey2(dst_op, key1, key2);
725 		}
726 	}
727 	dst_op->info.handleState = src_op->info.handleState;
728 	dst_op->info.keySize = src_op->info.keySize;
729 
730 	if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks ||
731 	    dst_op->block_size != src_op->block_size)
732 		TEE_Panic(0);
733 
734 	if (dst_op->buffer != NULL) {
735 		if (src_op->buffer == NULL)
736 			TEE_Panic(0);
737 
738 		memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs);
739 		dst_op->buffer_offs = src_op->buffer_offs;
740 	} else if (src_op->buffer != NULL) {
741 		TEE_Panic(0);
742 	}
743 
744 	res = utee_cryp_state_copy(dst_op->state, src_op->state);
745 	if (res != TEE_SUCCESS)
746 		TEE_Panic(res);
747 }
748 
749 /* Cryptographic Operations API - Message Digest Functions */
750 
751 static void init_hash_operation(TEE_OperationHandle operation, void *IV,
752 				uint32_t IVLen)
753 {
754 	TEE_Result res;
755 
756 	/*
757 	 * Note : IV and IVLen are never used in current implementation
758 	 * This is why coherent values of IV and IVLen are not checked
759 	 */
760 	res = utee_hash_init(operation->state, IV, IVLen);
761 	if (res != TEE_SUCCESS)
762 		TEE_Panic(res);
763 	operation->buffer_offs = 0;
764 	operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
765 }
766 
767 void TEE_DigestUpdate(TEE_OperationHandle operation,
768 		      void *chunk, uint32_t chunkSize)
769 {
770 	TEE_Result res = TEE_ERROR_GENERIC;
771 
772 	if (operation == TEE_HANDLE_NULL ||
773 	    operation->info.operationClass != TEE_OPERATION_DIGEST)
774 		TEE_Panic(0);
775 
776 	res = utee_hash_update(operation->state, chunk, chunkSize);
777 	if (res != TEE_SUCCESS)
778 		TEE_Panic(res);
779 }
780 
781 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk,
782 			     uint32_t chunkLen, void *hash, uint32_t *hashLen)
783 {
784 	TEE_Result res;
785 
786 	if ((operation == TEE_HANDLE_NULL) ||
787 	    (!chunk && chunkLen) ||
788 	    !hash ||
789 	    !hashLen ||
790 	    (operation->info.operationClass != TEE_OPERATION_DIGEST)) {
791 		res = TEE_ERROR_BAD_PARAMETERS;
792 		goto out;
793 	}
794 
795 	res = utee_hash_final(operation->state, chunk, chunkLen, hash,
796 			       hashLen);
797 	if (res != TEE_SUCCESS)
798 		goto out;
799 
800 	/* Reset operation state */
801 	init_hash_operation(operation, NULL, 0);
802 
803 out:
804 	if (res != TEE_SUCCESS &&
805 	    res != TEE_ERROR_SHORT_BUFFER)
806 		TEE_Panic(0);
807 
808 	return res;
809 }
810 
811 /* Cryptographic Operations API - Symmetric Cipher Functions */
812 
813 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen)
814 {
815 	TEE_Result res;
816 
817 	if (operation == TEE_HANDLE_NULL)
818 		TEE_Panic(0);
819 	if (operation->info.operationClass != TEE_OPERATION_CIPHER)
820 		TEE_Panic(0);
821 	res = utee_cipher_init(operation->state, IV, IVLen);
822 	if (res != TEE_SUCCESS)
823 		TEE_Panic(res);
824 	operation->buffer_offs = 0;
825 	operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
826 }
827 
828 static TEE_Result tee_buffer_update(
829 		TEE_OperationHandle op,
830 		TEE_Result(*update_func) (uint32_t state, const void *src,
831 					  size_t slen, void *dst, uint32_t *dlen),
832 		const void *src_data, size_t src_len,
833 		void *dest_data, uint32_t *dest_len)
834 {
835 	TEE_Result res;
836 	const uint8_t *src = src_data;
837 	size_t slen = src_len;
838 	uint8_t *dst = dest_data;
839 	size_t dlen = *dest_len;
840 	size_t acc_dlen = 0;
841 	uint32_t tmp_dlen;
842 	size_t l;
843 	size_t buffer_size;
844 	size_t buffer_left;
845 
846 	if (op->buffer_two_blocks) {
847 		buffer_size = op->block_size * 2;
848 		buffer_left = 1;
849 	} else {
850 		buffer_size = op->block_size;
851 		buffer_left = 0;
852 	}
853 
854 	if (op->buffer_offs > 0) {
855 		/* Fill up complete block */
856 		if (op->buffer_offs < op->block_size)
857 			l = MIN(slen, op->block_size - op->buffer_offs);
858 		else
859 			l = MIN(slen, buffer_size - op->buffer_offs);
860 		memcpy(op->buffer + op->buffer_offs, src, l);
861 		op->buffer_offs += l;
862 		src += l;
863 		slen -= l;
864 		if ((op->buffer_offs % op->block_size) != 0)
865 			goto out;	/* Nothing left to do */
866 	}
867 
868 	/* If we can feed from buffer */
869 	if ((op->buffer_offs > 0) &&
870 	    ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) {
871 		l = ROUNDUP(op->buffer_offs + slen - buffer_size,
872 				op->block_size);
873 		l = MIN(op->buffer_offs, l);
874 		tmp_dlen = dlen;
875 		res = update_func(op->state, op->buffer, l, dst, &tmp_dlen);
876 		if (res != TEE_SUCCESS)
877 			TEE_Panic(res);
878 		dst += tmp_dlen;
879 		dlen -= tmp_dlen;
880 		acc_dlen += tmp_dlen;
881 		op->buffer_offs -= l;
882 		if (op->buffer_offs > 0) {
883 			/*
884 			 * Slen is small enough to be contained in rest buffer.
885 			 */
886 			memcpy(op->buffer, op->buffer + l, buffer_size - l);
887 			memcpy(op->buffer + op->buffer_offs, src, slen);
888 			op->buffer_offs += slen;
889 			goto out;	/* Nothing left to do */
890 		}
891 	}
892 
893 	if (slen >= (buffer_size + buffer_left)) {
894 		/* Buffer is empty, feed as much as possible from src */
895 		l = ROUNDUP(slen - buffer_size + 1, op->block_size);
896 
897 		tmp_dlen = dlen;
898 		res = update_func(op->state, src, l, dst, &tmp_dlen);
899 		if (res != TEE_SUCCESS)
900 			TEE_Panic(res);
901 		src += l;
902 		slen -= l;
903 		dst += tmp_dlen;
904 		dlen -= tmp_dlen;
905 		acc_dlen += tmp_dlen;
906 	}
907 
908 	/* Slen is small enough to be contained in buffer. */
909 	memcpy(op->buffer + op->buffer_offs, src, slen);
910 	op->buffer_offs += slen;
911 
912 out:
913 	*dest_len = acc_dlen;
914 	return TEE_SUCCESS;
915 }
916 
917 TEE_Result TEE_CipherUpdate(TEE_OperationHandle op, const void *srcData,
918 			    uint32_t srcLen, void *destData, uint32_t *destLen)
919 {
920 	TEE_Result res;
921 	size_t req_dlen;
922 
923 	if (op == TEE_HANDLE_NULL ||
924 	    (srcData == NULL && srcLen != 0) ||
925 	    destLen == NULL ||
926 	    (destData == NULL && *destLen != 0)) {
927 		res = TEE_ERROR_BAD_PARAMETERS;
928 		goto out;
929 	}
930 
931 	if (op->info.operationClass != TEE_OPERATION_CIPHER) {
932 		res = TEE_ERROR_BAD_PARAMETERS;
933 		goto out;
934 	}
935 
936 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
937 		res = TEE_ERROR_BAD_PARAMETERS;
938 		goto out;
939 	}
940 
941 	/* Calculate required dlen */
942 	req_dlen = ((op->buffer_offs + srcLen) / op->block_size) *
943 	    op->block_size;
944 	if (op->buffer_two_blocks) {
945 		if (req_dlen > op->block_size * 2)
946 			req_dlen -= op->block_size * 2;
947 		else
948 			req_dlen = 0;
949 	}
950 	/*
951 	 * Check that required destLen is big enough before starting to feed
952 	 * data to the algorithm. Errors during feeding of data are fatal as we
953 	 * can't restore sync with this API.
954 	 */
955 	if (*destLen < req_dlen) {
956 		*destLen = req_dlen;
957 		res = TEE_ERROR_SHORT_BUFFER;
958 		goto out;
959 	}
960 
961 	res = tee_buffer_update(op, utee_cipher_update, srcData, srcLen,
962 				destData, destLen);
963 
964 out:
965 	if (res != TEE_SUCCESS &&
966 	    res != TEE_ERROR_SHORT_BUFFER)
967 		TEE_Panic(0);
968 
969 	return res;
970 }
971 
972 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle op,
973 			     const void *srcData, uint32_t srcLen, void *destData,
974 			     uint32_t *destLen)
975 {
976 	TEE_Result res;
977 	uint8_t *dst = destData;
978 	size_t acc_dlen = 0;
979 	uint32_t tmp_dlen;
980 	size_t req_dlen;
981 
982 	if (op == TEE_HANDLE_NULL ||
983 	    (srcData == NULL && srcLen != 0) ||
984 	    destLen == NULL ||
985 	    (destData == NULL && *destLen != 0)) {
986 		res = TEE_ERROR_BAD_PARAMETERS;
987 		goto out;
988 	}
989 
990 	if (op->info.operationClass != TEE_OPERATION_CIPHER) {
991 		res = TEE_ERROR_BAD_PARAMETERS;
992 		goto out;
993 	}
994 
995 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
996 		res = TEE_ERROR_BAD_PARAMETERS;
997 		goto out;
998 	}
999 
1000 	/*
1001 	 * Check that the final block doesn't require padding for those
1002 	 * algorithms that requires client to supply padding.
1003 	 */
1004 	if (op->info.algorithm == TEE_ALG_AES_ECB_NOPAD ||
1005 	    op->info.algorithm == TEE_ALG_AES_CBC_NOPAD ||
1006 	    op->info.algorithm == TEE_ALG_DES_ECB_NOPAD ||
1007 	    op->info.algorithm == TEE_ALG_DES_CBC_NOPAD ||
1008 	    op->info.algorithm == TEE_ALG_DES3_ECB_NOPAD ||
1009 	    op->info.algorithm == TEE_ALG_DES3_CBC_NOPAD) {
1010 		if (((op->buffer_offs + srcLen) % op->block_size) != 0) {
1011 			res = TEE_ERROR_BAD_PARAMETERS;
1012 			goto out;
1013 		}
1014 	}
1015 
1016 	/*
1017 	 * Check that required destLen is big enough before starting to feed
1018 	 * data to the algorithm. Errors during feeding of data are fatal as we
1019 	 * can't restore sync with this API.
1020 	 */
1021 	req_dlen = op->buffer_offs + srcLen;
1022 	if (*destLen < req_dlen) {
1023 		*destLen = req_dlen;
1024 		res = TEE_ERROR_SHORT_BUFFER;
1025 		goto out;
1026 	}
1027 
1028 	tmp_dlen = *destLen - acc_dlen;
1029 	res = tee_buffer_update(op, utee_cipher_update, srcData, srcLen, dst,
1030 				&tmp_dlen);
1031 	if (res != TEE_SUCCESS)
1032 		goto out;
1033 
1034 	dst += tmp_dlen;
1035 	acc_dlen += tmp_dlen;
1036 
1037 	tmp_dlen = *destLen - acc_dlen;
1038 	res = utee_cipher_final(op->state, op->buffer, op->buffer_offs,
1039 				dst, &tmp_dlen);
1040 	if (res != TEE_SUCCESS)
1041 		goto out;
1042 
1043 	acc_dlen += tmp_dlen;
1044 
1045 	op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1046 	*destLen = acc_dlen;
1047 
1048 out:
1049 	if (res != TEE_SUCCESS &&
1050 	    res != TEE_ERROR_SHORT_BUFFER)
1051 		TEE_Panic(0);
1052 
1053 	return res;
1054 }
1055 
1056 /* Cryptographic Operations API - MAC Functions */
1057 
1058 void TEE_MACInit(TEE_OperationHandle operation, void *IV, uint32_t IVLen)
1059 {
1060 	if (operation == TEE_HANDLE_NULL)
1061 		TEE_Panic(0);
1062 	if (!operation->key1)
1063 		TEE_Panic(0);
1064 	if (operation->info.operationClass != TEE_OPERATION_MAC)
1065 		TEE_Panic(0);
1066 	init_hash_operation(operation, IV, IVLen);
1067 }
1068 
1069 void TEE_MACUpdate(TEE_OperationHandle operation, void *chunk,
1070 		   uint32_t chunkSize)
1071 {
1072 	TEE_Result res;
1073 
1074 	if (operation == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0))
1075 		TEE_Panic(0);
1076 	if (operation->info.operationClass != TEE_OPERATION_MAC)
1077 		TEE_Panic(0);
1078 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1079 		TEE_Panic(0);
1080 
1081 	res = utee_hash_update(operation->state, chunk, chunkSize);
1082 	if (res != TEE_SUCCESS)
1083 		TEE_Panic(res);
1084 }
1085 
1086 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle operation,
1087 			       void *message, uint32_t messageLen,
1088 			       void *mac, uint32_t *macLen)
1089 {
1090 	TEE_Result res;
1091 
1092 	if (operation == TEE_HANDLE_NULL ||
1093 	    (message == NULL && messageLen != 0) ||
1094 	    mac == NULL ||
1095 	    macLen == NULL) {
1096 		res = TEE_ERROR_BAD_PARAMETERS;
1097 		goto out;
1098 	}
1099 
1100 	if (operation->info.operationClass != TEE_OPERATION_MAC) {
1101 		res = TEE_ERROR_BAD_PARAMETERS;
1102 		goto out;
1103 	}
1104 
1105 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
1106 		res = TEE_ERROR_BAD_PARAMETERS;
1107 		goto out;
1108 	}
1109 
1110 	res = utee_hash_final(operation->state, message, messageLen, mac,
1111 			      macLen);
1112 	if (res != TEE_SUCCESS)
1113 		goto out;
1114 
1115 	operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1116 
1117 out:
1118 	if (res != TEE_SUCCESS &&
1119 	    res != TEE_ERROR_SHORT_BUFFER)
1120 		TEE_Panic(res);
1121 
1122 	return res;
1123 }
1124 
1125 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation,
1126 			       void *message, uint32_t messageLen,
1127 			       void *mac, uint32_t macLen)
1128 {
1129 	TEE_Result res;
1130 	uint8_t computed_mac[TEE_MAX_HASH_SIZE];
1131 	uint32_t computed_mac_size = TEE_MAX_HASH_SIZE;
1132 
1133 	if (operation->info.operationClass != TEE_OPERATION_MAC) {
1134 		res = TEE_ERROR_BAD_PARAMETERS;
1135 		goto out;
1136 	}
1137 
1138 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
1139 		res = TEE_ERROR_BAD_PARAMETERS;
1140 		goto out;
1141 	}
1142 
1143 	res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac,
1144 				  &computed_mac_size);
1145 	if (res != TEE_SUCCESS)
1146 		goto out;
1147 
1148 	if (computed_mac_size != macLen) {
1149 		res = TEE_ERROR_MAC_INVALID;
1150 		goto out;
1151 	}
1152 
1153 	if (buf_compare_ct(mac, computed_mac, computed_mac_size) != 0) {
1154 		res = TEE_ERROR_MAC_INVALID;
1155 		goto out;
1156 	}
1157 
1158 out:
1159 	if (res != TEE_SUCCESS &&
1160 	    res != TEE_ERROR_MAC_INVALID)
1161 		TEE_Panic(res);
1162 
1163 	return res;
1164 }
1165 
1166 /* Cryptographic Operations API - Authenticated Encryption Functions */
1167 
1168 TEE_Result TEE_AEInit(TEE_OperationHandle operation, void *nonce,
1169 		      uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen,
1170 		      uint32_t payloadLen)
1171 {
1172 	TEE_Result res;
1173 
1174 	if (operation == TEE_HANDLE_NULL || nonce == NULL) {
1175 		res = TEE_ERROR_BAD_PARAMETERS;
1176 		goto out;
1177 	}
1178 
1179 	if (operation->info.operationClass != TEE_OPERATION_AE) {
1180 		res = TEE_ERROR_BAD_PARAMETERS;
1181 		goto out;
1182 	}
1183 
1184 	/*
1185 	 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core
1186 	 * in the implementation. But AES-GCM spec doesn't specify the tag len
1187 	 * according to the same principle so we have to check here instead to
1188 	 * be GP compliant.
1189 	 */
1190 	if (operation->info.algorithm == TEE_ALG_AES_GCM) {
1191 		/*
1192 		 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96
1193 		 */
1194 		if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0)) {
1195 			res = TEE_ERROR_NOT_SUPPORTED;
1196 			goto out;
1197 		}
1198 	}
1199 
1200 	res = utee_authenc_init(operation->state, nonce, nonceLen,
1201 				tagLen / 8, AADLen, payloadLen);
1202 	if (res != TEE_SUCCESS)
1203 		goto out;
1204 
1205 	operation->ae_tag_len = tagLen / 8;
1206 	operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
1207 
1208 out:
1209 	if (res != TEE_SUCCESS &&
1210 	    res != TEE_ERROR_NOT_SUPPORTED)
1211 			TEE_Panic(res);
1212 
1213 	return res;
1214 }
1215 
1216 void TEE_AEUpdateAAD(TEE_OperationHandle operation, void *AADdata,
1217 		     uint32_t AADdataLen)
1218 {
1219 	TEE_Result res;
1220 
1221 	if (operation == TEE_HANDLE_NULL ||
1222 	    (AADdata == NULL && AADdataLen != 0))
1223 		TEE_Panic(0);
1224 	if (operation->info.operationClass != TEE_OPERATION_AE)
1225 		TEE_Panic(0);
1226 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1227 		TEE_Panic(0);
1228 
1229 	res = utee_authenc_update_aad(operation->state, AADdata, AADdataLen);
1230 	if (res != TEE_SUCCESS)
1231 		TEE_Panic(res);
1232 }
1233 
1234 TEE_Result TEE_AEUpdate(TEE_OperationHandle operation, void *srcData,
1235 			uint32_t srcLen, void *destData, uint32_t *destLen)
1236 {
1237 	TEE_Result res;
1238 	size_t req_dlen;
1239 
1240 	if (operation == TEE_HANDLE_NULL ||
1241 	    (srcData == NULL && srcLen != 0) ||
1242 	    destLen == NULL ||
1243 	    (destData == NULL && *destLen != 0)) {
1244 		res = TEE_ERROR_BAD_PARAMETERS;
1245 		goto out;
1246 	}
1247 
1248 	if (operation->info.operationClass != TEE_OPERATION_AE) {
1249 		res = TEE_ERROR_BAD_PARAMETERS;
1250 		goto out;
1251 	}
1252 
1253 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
1254 		res = TEE_ERROR_BAD_PARAMETERS;
1255 		goto out;
1256 	}
1257 
1258 	/*
1259 	 * Check that required destLen is big enough before starting to feed
1260 	 * data to the algorithm. Errors during feeding of data are fatal as we
1261 	 * can't restore sync with this API.
1262 	 */
1263 	req_dlen = ROUNDDOWN(operation->buffer_offs + srcLen,
1264 			     operation->block_size);
1265 	if (*destLen < req_dlen) {
1266 		*destLen = req_dlen;
1267 		res = TEE_ERROR_SHORT_BUFFER;
1268 		goto out;
1269 	}
1270 
1271 	res = tee_buffer_update(operation, utee_authenc_update_payload, srcData,
1272 				srcLen, destData, destLen);
1273 
1274 out:
1275 	if (res != TEE_SUCCESS &&
1276 	    res != TEE_ERROR_SHORT_BUFFER)
1277 			TEE_Panic(res);
1278 
1279 	return res;
1280 }
1281 
1282 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle operation,
1283 			      void *srcData, uint32_t srcLen,
1284 			      void *destData, uint32_t *destLen, void *tag,
1285 			      uint32_t *tagLen)
1286 {
1287 	TEE_Result res;
1288 	uint8_t *dst = destData;
1289 	size_t acc_dlen = 0;
1290 	uint32_t tmp_dlen;
1291 	size_t req_dlen;
1292 
1293 	if (operation == TEE_HANDLE_NULL ||
1294 	    (srcData == NULL && srcLen != 0) ||
1295 	    destLen == NULL ||
1296 	    (destData == NULL && *destLen != 0) ||
1297 	    tag == NULL || tagLen == NULL) {
1298 		res = TEE_ERROR_BAD_PARAMETERS;
1299 		goto out;
1300 	}
1301 
1302 	if (operation->info.operationClass != TEE_OPERATION_AE) {
1303 		res = TEE_ERROR_BAD_PARAMETERS;
1304 		goto out;
1305 	}
1306 
1307 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
1308 		res = TEE_ERROR_BAD_PARAMETERS;
1309 		goto out;
1310 	}
1311 
1312 	/*
1313 	 * Check that required destLen is big enough before starting to feed
1314 	 * data to the algorithm. Errors during feeding of data are fatal as we
1315 	 * can't restore sync with this API.
1316 	 */
1317 	req_dlen = operation->buffer_offs + srcLen;
1318 	if (*destLen < req_dlen) {
1319 		*destLen = req_dlen;
1320 		res = TEE_ERROR_SHORT_BUFFER;
1321 		goto out;
1322 	}
1323 
1324 	/*
1325 	 * Need to check this before update_payload since sync would be lost if
1326 	 * we return short buffer after that.
1327 	 */
1328 	if (*tagLen < operation->ae_tag_len) {
1329 		*tagLen = operation->ae_tag_len;
1330 		res = TEE_ERROR_SHORT_BUFFER;
1331 		goto out;
1332 	}
1333 
1334 	tmp_dlen = *destLen - acc_dlen;
1335 	res = tee_buffer_update(operation, utee_authenc_update_payload, srcData,
1336 				srcLen, dst, &tmp_dlen);
1337 	if (res != TEE_SUCCESS)
1338 		goto out;
1339 
1340 	dst += tmp_dlen;
1341 	acc_dlen += tmp_dlen;
1342 
1343 	tmp_dlen = *destLen - acc_dlen;
1344 	res = utee_authenc_enc_final(operation->state, operation->buffer,
1345 				     operation->buffer_offs, dst, &tmp_dlen,
1346 				     tag, tagLen);
1347 	if (res != TEE_SUCCESS)
1348 		goto out;
1349 
1350 	acc_dlen += tmp_dlen;
1351 	*destLen = acc_dlen;
1352 	operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1353 
1354 out:
1355 	if (res != TEE_SUCCESS &&
1356 	    res != TEE_ERROR_SHORT_BUFFER)
1357 			TEE_Panic(res);
1358 
1359 	return res;
1360 }
1361 
1362 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle operation,
1363 			      void *srcData, uint32_t srcLen,
1364 			      void *destData, uint32_t *destLen, void *tag,
1365 			      uint32_t tagLen)
1366 {
1367 	TEE_Result res;
1368 	uint8_t *dst = destData;
1369 	size_t acc_dlen = 0;
1370 	uint32_t tmp_dlen;
1371 	size_t req_dlen;
1372 
1373 	if (operation == TEE_HANDLE_NULL ||
1374 	    (srcData == NULL && srcLen != 0) ||
1375 	    destLen == NULL ||
1376 	    (destData == NULL && *destLen != 0) ||
1377 	    (tag == NULL && tagLen != 0)) {
1378 		res = TEE_ERROR_BAD_PARAMETERS;
1379 		goto out;
1380 	}
1381 
1382 	if (operation->info.operationClass != TEE_OPERATION_AE) {
1383 		res = TEE_ERROR_BAD_PARAMETERS;
1384 		goto out;
1385 	}
1386 
1387 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0) {
1388 		res = TEE_ERROR_BAD_PARAMETERS;
1389 		goto out;
1390 	}
1391 
1392 	/*
1393 	 * Check that required destLen is big enough before starting to feed
1394 	 * data to the algorithm. Errors during feeding of data are fatal as we
1395 	 * can't restore sync with this API.
1396 	 */
1397 	req_dlen = operation->buffer_offs + srcLen;
1398 	if (*destLen < req_dlen) {
1399 		*destLen = req_dlen;
1400 		res = TEE_ERROR_SHORT_BUFFER;
1401 		goto out;
1402 	}
1403 
1404 	tmp_dlen = *destLen - acc_dlen;
1405 	res = tee_buffer_update(operation, utee_authenc_update_payload, srcData,
1406 				srcLen, dst, &tmp_dlen);
1407 	if (res != TEE_SUCCESS)
1408 		goto out;
1409 
1410 	dst += tmp_dlen;
1411 	acc_dlen += tmp_dlen;
1412 
1413 	tmp_dlen = *destLen - acc_dlen;
1414 	res = utee_authenc_dec_final(operation->state, operation->buffer,
1415 				     operation->buffer_offs, dst, &tmp_dlen,
1416 				     tag, tagLen);
1417 	if (res != TEE_SUCCESS)
1418 		goto out;
1419 
1420 	/* Supplied tagLen should match what we initiated with */
1421 	if (tagLen != operation->ae_tag_len)
1422 		res = TEE_ERROR_MAC_INVALID;
1423 
1424 	acc_dlen += tmp_dlen;
1425 
1426 	*destLen = acc_dlen;
1427 	operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1428 
1429 out:
1430 	if (res != TEE_SUCCESS &&
1431 	    res != TEE_ERROR_SHORT_BUFFER &&
1432 	    res != TEE_ERROR_MAC_INVALID)
1433 			TEE_Panic(res);
1434 
1435 	return res;
1436 }
1437 
1438 /* Cryptographic Operations API - Asymmetric Functions */
1439 
1440 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle operation,
1441 				 TEE_Attribute *params,
1442 				 uint32_t paramCount, void *srcData,
1443 				 uint32_t srcLen, void *destData,
1444 				 uint32_t *destLen)
1445 {
1446 	TEE_Result res;
1447 
1448 	if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1449 	    destLen == NULL || (destData == NULL && *destLen != 0))
1450 		TEE_Panic(0);
1451 	if (params == NULL && paramCount != 0)
1452 		TEE_Panic(0);
1453 	if (!operation->key1)
1454 		TEE_Panic(0);
1455 	if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER)
1456 		TEE_Panic(0);
1457 	if (operation->info.mode != TEE_MODE_ENCRYPT)
1458 		TEE_Panic(0);
1459 
1460 	res = utee_asymm_operate(operation->state, params, paramCount, srcData,
1461 				 srcLen, destData, destLen);
1462 
1463 	if (res != TEE_SUCCESS &&
1464 	    res != TEE_ERROR_SHORT_BUFFER &&
1465 	    res != TEE_ERROR_BAD_PARAMETERS)
1466 		TEE_Panic(res);
1467 
1468 	return res;
1469 }
1470 
1471 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle operation,
1472 				 TEE_Attribute *params,
1473 				 uint32_t paramCount, void *srcData,
1474 				 uint32_t srcLen, void *destData,
1475 				 uint32_t *destLen)
1476 {
1477 	TEE_Result res;
1478 
1479 	if (operation == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1480 	    destLen == NULL || (destData == NULL && *destLen != 0))
1481 		TEE_Panic(0);
1482 	if (params == NULL && paramCount != 0)
1483 		TEE_Panic(0);
1484 	if (!operation->key1)
1485 		TEE_Panic(0);
1486 	if (operation->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER)
1487 		TEE_Panic(0);
1488 	if (operation->info.mode != TEE_MODE_DECRYPT)
1489 		TEE_Panic(0);
1490 
1491 	res = utee_asymm_operate(operation->state, params, paramCount, srcData,
1492 				 srcLen, destData, destLen);
1493 
1494 	if (res != TEE_SUCCESS &&
1495 	    res != TEE_ERROR_SHORT_BUFFER &&
1496 	    res != TEE_ERROR_BAD_PARAMETERS)
1497 		TEE_Panic(res);
1498 
1499 	return res;
1500 }
1501 
1502 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle operation,
1503 				    TEE_Attribute *params,
1504 				    uint32_t paramCount, void *digest,
1505 				    uint32_t digestLen, void *signature,
1506 				    uint32_t *signatureLen)
1507 {
1508 	TEE_Result res;
1509 
1510 	if (operation == TEE_HANDLE_NULL ||
1511 	    (digest == NULL && digestLen != 0) ||
1512 	    signature == NULL || signatureLen == NULL)
1513 		TEE_Panic(0);
1514 	if (params == NULL && paramCount != 0)
1515 		TEE_Panic(0);
1516 	if (!operation->key1)
1517 		TEE_Panic(0);
1518 	if (operation->info.operationClass !=
1519 	    TEE_OPERATION_ASYMMETRIC_SIGNATURE)
1520 		TEE_Panic(0);
1521 	if (operation->info.mode != TEE_MODE_SIGN)
1522 		TEE_Panic(0);
1523 
1524 	res = utee_asymm_operate(operation->state, params, paramCount, digest,
1525 				 digestLen, signature, signatureLen);
1526 
1527 	if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER)
1528 		TEE_Panic(res);
1529 
1530 	return res;
1531 }
1532 
1533 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle operation,
1534 				      TEE_Attribute *params,
1535 				      uint32_t paramCount, void *digest,
1536 				      uint32_t digestLen, void *signature,
1537 				      uint32_t signatureLen)
1538 {
1539 	TEE_Result res;
1540 
1541 	if (operation == TEE_HANDLE_NULL ||
1542 	    (digest == NULL && digestLen != 0) ||
1543 	    (signature == NULL && signatureLen != 0))
1544 		TEE_Panic(0);
1545 	if (params == NULL && paramCount != 0)
1546 		TEE_Panic(0);
1547 	if (!operation->key1)
1548 		TEE_Panic(0);
1549 	if (operation->info.operationClass !=
1550 	    TEE_OPERATION_ASYMMETRIC_SIGNATURE)
1551 		TEE_Panic(0);
1552 	if (operation->info.mode != TEE_MODE_VERIFY)
1553 		TEE_Panic(0);
1554 
1555 	res = utee_asymm_verify(operation->state, params, paramCount, digest,
1556 				digestLen, signature, signatureLen);
1557 
1558 	if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID)
1559 		TEE_Panic(res);
1560 
1561 	return res;
1562 }
1563 
1564 /* Cryptographic Operations API - Key Derivation Functions */
1565 
1566 void TEE_DeriveKey(TEE_OperationHandle operation,
1567 		   const TEE_Attribute *params, uint32_t paramCount,
1568 		   TEE_ObjectHandle derivedKey)
1569 {
1570 	TEE_Result res;
1571 	TEE_ObjectInfo key_info;
1572 
1573 	if (operation == TEE_HANDLE_NULL || derivedKey == 0)
1574 		TEE_Panic(0);
1575 	if (params == NULL && paramCount != 0)
1576 		TEE_Panic(0);
1577 	if (TEE_ALG_GET_CLASS(operation->info.algorithm) !=
1578 	    TEE_OPERATION_KEY_DERIVATION)
1579 		TEE_Panic(0);
1580 
1581 	if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION)
1582 		TEE_Panic(0);
1583 	if (!operation->key1)
1584 		TEE_Panic(0);
1585 	if (operation->info.mode != TEE_MODE_DERIVE)
1586 		TEE_Panic(0);
1587 	if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0)
1588 		TEE_Panic(0);
1589 
1590 	res = utee_cryp_obj_get_info((uint32_t) derivedKey, &key_info);
1591 	if (res != TEE_SUCCESS)
1592 		TEE_Panic(0);
1593 
1594 	if (key_info.objectType != TEE_TYPE_GENERIC_SECRET)
1595 		TEE_Panic(0);
1596 	if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0)
1597 		TEE_Panic(0);
1598 
1599 	res = utee_cryp_derive_key(operation->state, params, paramCount,
1600 				   (uint32_t) derivedKey);
1601 	if (res != TEE_SUCCESS)
1602 		TEE_Panic(res);
1603 }
1604 
1605 /* Cryptographic Operations API - Random Number Generation Functions */
1606 
1607 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen)
1608 {
1609 	TEE_Result res;
1610 
1611 	res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen);
1612 	if (res != TEE_SUCCESS)
1613 		TEE_Panic(res);
1614 }
1615