xref: /optee_os/lib/libutee/tee_api_operations.c (revision 8707ec0f1b3303d8a65a3ae8a2b0efde28bbd3aa)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <stdlib.h>
28 #include <string.h>
29 #include <string_ext.h>
30 
31 #include <tee_api.h>
32 #include <tee_api_defines_extensions.h>
33 #include <tee_internal_api_extensions.h>
34 #include <utee_syscalls.h>
35 #include <utee_defines.h>
36 #include <util.h>
37 
38 struct __TEE_OperationHandle {
39 	TEE_OperationInfo info;
40 	TEE_ObjectHandle key1;
41 	TEE_ObjectHandle key2;
42 	uint8_t *buffer;	/* buffer to collect complete blocks */
43 	bool buffer_two_blocks;	/* True if two blocks need to be buffered */
44 	size_t block_size;	/* Block size of cipher */
45 	size_t buffer_offs;	/* Offset in buffer */
46 	uint32_t state;		/* Handle to state in TEE Core */
47 	uint32_t ae_tag_len;	/*
48 				 * tag_len in bytes for AE operation else unused
49 				 */
50 };
51 
52 /* Cryptographic Operations API - Generic Operation Functions */
53 
54 TEE_Result TEE_AllocateOperation(TEE_OperationHandle *operation,
55 				 uint32_t algorithm, uint32_t mode,
56 				 uint32_t maxKeySize)
57 {
58 	TEE_Result res;
59 	TEE_OperationHandle op = TEE_HANDLE_NULL;
60 	uint32_t handle_state = 0;
61 	size_t block_size = 1;
62 	uint32_t req_key_usage;
63 	bool with_private_key = false;
64 	bool buffer_two_blocks = false;
65 
66 	if (!operation)
67 		TEE_Panic(0);
68 
69 	if (algorithm == TEE_ALG_AES_XTS)
70 		handle_state = TEE_HANDLE_FLAG_EXPECT_TWO_KEYS;
71 
72 	/* Check algorithm max key size */
73 	switch (algorithm) {
74 	case TEE_ALG_DSA_SHA1:
75 		if (maxKeySize < 512)
76 			return TEE_ERROR_NOT_SUPPORTED;
77 		if (maxKeySize > 1024)
78 			return TEE_ERROR_NOT_SUPPORTED;
79 		if (maxKeySize % 64 != 0)
80 			return TEE_ERROR_NOT_SUPPORTED;
81 		break;
82 
83 	case TEE_ALG_DSA_SHA224:
84 		if (maxKeySize != 2048)
85 			return TEE_ERROR_NOT_SUPPORTED;
86 		break;
87 
88 	case TEE_ALG_DSA_SHA256:
89 		if (maxKeySize != 2048 && maxKeySize != 3072)
90 			return TEE_ERROR_NOT_SUPPORTED;
91 		break;
92 
93 	case TEE_ALG_ECDSA_P192:
94 	case TEE_ALG_ECDH_P192:
95 		if (maxKeySize != 192)
96 			return TEE_ERROR_NOT_SUPPORTED;
97 		break;
98 
99 	case TEE_ALG_ECDSA_P224:
100 	case TEE_ALG_ECDH_P224:
101 		if (maxKeySize != 224)
102 			return TEE_ERROR_NOT_SUPPORTED;
103 		break;
104 
105 	case TEE_ALG_ECDSA_P256:
106 	case TEE_ALG_ECDH_P256:
107 		if (maxKeySize != 256)
108 			return TEE_ERROR_NOT_SUPPORTED;
109 		break;
110 
111 	case TEE_ALG_ECDSA_P384:
112 	case TEE_ALG_ECDH_P384:
113 		if (maxKeySize != 384)
114 			return TEE_ERROR_NOT_SUPPORTED;
115 		break;
116 
117 	case TEE_ALG_ECDSA_P521:
118 	case TEE_ALG_ECDH_P521:
119 		if (maxKeySize != 521)
120 			return TEE_ERROR_NOT_SUPPORTED;
121 		break;
122 
123 	default:
124 		break;
125 	}
126 
127 	/* Check algorithm mode */
128 	switch (algorithm) {
129 	case TEE_ALG_AES_CTS:
130 	case TEE_ALG_AES_XTS:
131 		buffer_two_blocks = true;
132 	 /*FALLTHROUGH*/ case TEE_ALG_AES_ECB_NOPAD:
133 	case TEE_ALG_AES_CBC_NOPAD:
134 	case TEE_ALG_AES_CTR:
135 	case TEE_ALG_AES_CCM:
136 	case TEE_ALG_AES_GCM:
137 	case TEE_ALG_DES_ECB_NOPAD:
138 	case TEE_ALG_DES_CBC_NOPAD:
139 	case TEE_ALG_DES3_ECB_NOPAD:
140 	case TEE_ALG_DES3_CBC_NOPAD:
141 		if (TEE_ALG_GET_MAIN_ALG(algorithm) == TEE_MAIN_ALGO_AES)
142 			block_size = TEE_AES_BLOCK_SIZE;
143 		else
144 			block_size = TEE_DES_BLOCK_SIZE;
145 
146 		if (mode == TEE_MODE_ENCRYPT)
147 			req_key_usage = TEE_USAGE_ENCRYPT;
148 		else if (mode == TEE_MODE_DECRYPT)
149 			req_key_usage = TEE_USAGE_DECRYPT;
150 		else
151 			return TEE_ERROR_NOT_SUPPORTED;
152 		break;
153 
154 	case TEE_ALG_RSASSA_PKCS1_V1_5_MD5:
155 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA1:
156 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA224:
157 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA256:
158 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA384:
159 	case TEE_ALG_RSASSA_PKCS1_V1_5_SHA512:
160 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA1:
161 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA224:
162 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA256:
163 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA384:
164 	case TEE_ALG_RSASSA_PKCS1_PSS_MGF1_SHA512:
165 	case TEE_ALG_DSA_SHA1:
166 	case TEE_ALG_DSA_SHA224:
167 	case TEE_ALG_DSA_SHA256:
168 	case TEE_ALG_ECDSA_P192:
169 	case TEE_ALG_ECDSA_P224:
170 	case TEE_ALG_ECDSA_P256:
171 	case TEE_ALG_ECDSA_P384:
172 	case TEE_ALG_ECDSA_P521:
173 		if (mode == TEE_MODE_SIGN) {
174 			with_private_key = true;
175 			req_key_usage = TEE_USAGE_SIGN;
176 		} else if (mode == TEE_MODE_VERIFY) {
177 			req_key_usage = TEE_USAGE_VERIFY;
178 		} else {
179 			return TEE_ERROR_NOT_SUPPORTED;
180 		}
181 		break;
182 
183 	case TEE_ALG_RSAES_PKCS1_V1_5:
184 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA1:
185 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA224:
186 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA256:
187 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA384:
188 	case TEE_ALG_RSAES_PKCS1_OAEP_MGF1_SHA512:
189 		if (mode == TEE_MODE_ENCRYPT) {
190 			req_key_usage = TEE_USAGE_ENCRYPT;
191 		} else if (mode == TEE_MODE_DECRYPT) {
192 			with_private_key = true;
193 			req_key_usage = TEE_USAGE_DECRYPT;
194 		} else {
195 			return TEE_ERROR_NOT_SUPPORTED;
196 		}
197 		break;
198 
199 	case TEE_ALG_RSA_NOPAD:
200 		if (mode == TEE_MODE_ENCRYPT) {
201 			req_key_usage = TEE_USAGE_ENCRYPT | TEE_USAGE_VERIFY;
202 		} else if (mode == TEE_MODE_DECRYPT) {
203 			with_private_key = true;
204 			req_key_usage = TEE_USAGE_DECRYPT | TEE_USAGE_SIGN;
205 		} else {
206 			return TEE_ERROR_NOT_SUPPORTED;
207 		}
208 		break;
209 
210 	case TEE_ALG_DH_DERIVE_SHARED_SECRET:
211 	case TEE_ALG_ECDH_P192:
212 	case TEE_ALG_ECDH_P224:
213 	case TEE_ALG_ECDH_P256:
214 	case TEE_ALG_ECDH_P384:
215 	case TEE_ALG_ECDH_P521:
216 	case TEE_ALG_HKDF_MD5_DERIVE_KEY:
217 	case TEE_ALG_HKDF_SHA1_DERIVE_KEY:
218 	case TEE_ALG_HKDF_SHA224_DERIVE_KEY:
219 	case TEE_ALG_HKDF_SHA256_DERIVE_KEY:
220 	case TEE_ALG_HKDF_SHA384_DERIVE_KEY:
221 	case TEE_ALG_HKDF_SHA512_DERIVE_KEY:
222 	case TEE_ALG_CONCAT_KDF_SHA1_DERIVE_KEY:
223 	case TEE_ALG_CONCAT_KDF_SHA224_DERIVE_KEY:
224 	case TEE_ALG_CONCAT_KDF_SHA256_DERIVE_KEY:
225 	case TEE_ALG_CONCAT_KDF_SHA384_DERIVE_KEY:
226 	case TEE_ALG_CONCAT_KDF_SHA512_DERIVE_KEY:
227 	case TEE_ALG_PBKDF2_HMAC_SHA1_DERIVE_KEY:
228 		if (mode != TEE_MODE_DERIVE)
229 			return TEE_ERROR_NOT_SUPPORTED;
230 		with_private_key = true;
231 		req_key_usage = TEE_USAGE_DERIVE;
232 		break;
233 
234 	case TEE_ALG_MD5:
235 	case TEE_ALG_SHA1:
236 	case TEE_ALG_SHA224:
237 	case TEE_ALG_SHA256:
238 	case TEE_ALG_SHA384:
239 	case TEE_ALG_SHA512:
240 		if (mode != TEE_MODE_DIGEST)
241 			return TEE_ERROR_NOT_SUPPORTED;
242 		handle_state |= TEE_HANDLE_FLAG_KEY_SET;
243 		req_key_usage = 0;
244 		break;
245 
246 	case TEE_ALG_DES_CBC_MAC_NOPAD:
247 	case TEE_ALG_AES_CBC_MAC_NOPAD:
248 	case TEE_ALG_AES_CBC_MAC_PKCS5:
249 	case TEE_ALG_AES_CMAC:
250 	case TEE_ALG_DES_CBC_MAC_PKCS5:
251 	case TEE_ALG_DES3_CBC_MAC_NOPAD:
252 	case TEE_ALG_DES3_CBC_MAC_PKCS5:
253 	case TEE_ALG_HMAC_MD5:
254 	case TEE_ALG_HMAC_SHA1:
255 	case TEE_ALG_HMAC_SHA224:
256 	case TEE_ALG_HMAC_SHA256:
257 	case TEE_ALG_HMAC_SHA384:
258 	case TEE_ALG_HMAC_SHA512:
259 		if (mode != TEE_MODE_MAC)
260 			return TEE_ERROR_NOT_SUPPORTED;
261 		req_key_usage = TEE_USAGE_MAC;
262 		break;
263 
264 	default:
265 		return TEE_ERROR_NOT_SUPPORTED;
266 	}
267 
268 	op = TEE_Malloc(sizeof(*op), 0);
269 	if (!op)
270 		return TEE_ERROR_OUT_OF_MEMORY;
271 
272 	op->info.algorithm = algorithm;
273 	op->info.operationClass = TEE_ALG_GET_CLASS(algorithm);
274 	op->info.mode = mode;
275 	op->info.maxKeySize = maxKeySize;
276 	op->info.requiredKeyUsage = req_key_usage;
277 	op->info.handleState = handle_state;
278 
279 	if (block_size > 1) {
280 		size_t buffer_size = block_size;
281 
282 		if (buffer_two_blocks)
283 			buffer_size *= 2;
284 
285 		op->buffer = TEE_Malloc(buffer_size,
286 					TEE_USER_MEM_HINT_NO_FILL_ZERO);
287 		if (op->buffer == NULL) {
288 			res = TEE_ERROR_OUT_OF_MEMORY;
289 			goto err0;
290 		}
291 	}
292 	op->block_size = block_size;
293 	op->buffer_two_blocks = buffer_two_blocks;
294 
295 	if (TEE_ALG_GET_CLASS(algorithm) != TEE_OPERATION_DIGEST) {
296 		uint32_t mks = maxKeySize;
297 		TEE_ObjectType key_type = TEE_ALG_GET_KEY_TYPE(algorithm,
298 						       with_private_key);
299 
300 		/*
301 		 * If two keys are expected the max key size is the sum of
302 		 * the size of both keys.
303 		 */
304 		if (op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS)
305 			mks /= 2;
306 
307 		res = TEE_AllocateTransientObject(key_type, mks, &op->key1);
308 		if (res != TEE_SUCCESS)
309 			goto err1;
310 
311 		if ((op->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) !=
312 		    0) {
313 			res = TEE_AllocateTransientObject(key_type, mks,
314 							  &op->key2);
315 			if (res != TEE_SUCCESS)
316 				goto err2;
317 		}
318 	}
319 
320 	res = utee_cryp_state_alloc(algorithm, mode, (uint32_t) op->key1,
321 				    (uint32_t) op->key2, &op->state);
322 	if (res != TEE_SUCCESS) {
323 		if ((op->info.handleState &
324 		     TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) != 0)
325 			goto err2;
326 		goto err1;
327 	}
328 
329 	/* For multi-stage operation do an "init". */
330 	TEE_ResetOperation(op);
331 	*operation = op;
332 	goto out;
333 
334 err2:
335 	TEE_FreeTransientObject(op->key2);
336 err1:
337 	TEE_FreeTransientObject(op->key1);
338 err0:
339 	TEE_FreeOperation(op);
340 
341 	if (res != TEE_SUCCESS &&
342 	    res != TEE_ERROR_OUT_OF_MEMORY &&
343 	    res != TEE_ERROR_NOT_SUPPORTED)
344 		TEE_Panic(0);
345 out:
346 	return res;
347 }
348 
349 void TEE_FreeOperation(TEE_OperationHandle operation)
350 {
351 	TEE_Result res;
352 
353 	if (operation == TEE_HANDLE_NULL)
354 		TEE_Panic(0);
355 
356 	/*
357 	 * Note that keys should not be freed here, since they are
358 	 * claimed by the operation they will be freed by
359 	 * utee_cryp_state_free().
360 	 */
361 	res = utee_cryp_state_free(operation->state);
362 	if (res != TEE_SUCCESS)
363 		TEE_Panic(0);
364 
365 	TEE_Free(operation->buffer);
366 	TEE_Free(operation);
367 }
368 
369 void TEE_GetOperationInfo(TEE_OperationHandle operation,
370 			  TEE_OperationInfo *operationInfo)
371 {
372 	if (operation == TEE_HANDLE_NULL)
373 		TEE_Panic(0);
374 
375 	if (operationInfo == NULL)
376 		TEE_Panic(0);
377 
378 	*operationInfo = operation->info;
379 }
380 
381 void TEE_ResetOperation(TEE_OperationHandle operation)
382 {
383 	TEE_Result res;
384 
385 	if (operation == TEE_HANDLE_NULL)
386 		TEE_Panic(0);
387 
388 	if ((operation->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) != 0) {
389 		if (operation->info.keySize == 0)
390 			TEE_Panic(0);
391 	}
392 
393 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
394 		res = utee_hash_init(operation->state, NULL, 0);
395 		if (res != TEE_SUCCESS)
396 			TEE_Panic(res);
397 	}
398 	operation->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
399 }
400 
401 TEE_Result TEE_SetOperationKey(TEE_OperationHandle operation,
402 			       TEE_ObjectHandle key)
403 {
404 	TEE_Result res;
405 	uint32_t key_size = 0;
406 	TEE_ObjectInfo key_info;
407 
408 	/* Operation is not a valid handle */
409 	if (operation == TEE_HANDLE_NULL) {
410 		res = TEE_ERROR_BAD_PARAMETERS;
411 		goto out;
412 	}
413 
414 	/* Key is not initialized */
415 	if (key == TEE_HANDLE_NULL) {
416 		/* Operation key cleared */
417 		TEE_ResetTransientObject(operation->key1);
418 		res = TEE_ERROR_BAD_PARAMETERS;
419 		goto out;
420 	}
421 
422 	/* No key for digest operation */
423 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
424 		res = TEE_ERROR_BAD_PARAMETERS;
425 		goto out;
426 	}
427 
428 	/* Two keys flag not expected (TEE_ALG_AES_XTS excluded) */
429 	if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) !=
430 	    0) {
431 		res = TEE_ERROR_BAD_PARAMETERS;
432 		goto out;
433 	}
434 
435 	res = TEE_GetObjectInfo1(key, &key_info);
436 	/* Key is not a valid handle */
437 	if (res != TEE_SUCCESS)
438 		goto out;
439 
440 	/* Supplied key has to meet required usage */
441 	if ((key_info.objectUsage & operation->info.requiredKeyUsage) !=
442 	    operation->info.requiredKeyUsage) {
443 		res = TEE_ERROR_BAD_PARAMETERS;
444 		goto out;
445 	}
446 
447 	if (operation->info.maxKeySize < key_info.keySize) {
448 		res = TEE_ERROR_BAD_PARAMETERS;
449 		goto out;
450 	}
451 
452 	key_size = key_info.keySize;
453 
454 	TEE_ResetTransientObject(operation->key1);
455 	operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET;
456 
457 	res = TEE_CopyObjectAttributes1(operation->key1, key);
458 	if (res != TEE_SUCCESS)
459 		goto out;
460 
461 	operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET;
462 
463 	operation->info.keySize = key_size;
464 
465 out:
466 	if (res != TEE_SUCCESS  &&
467 	    res != TEE_ERROR_CORRUPT_OBJECT &&
468 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE)
469 		TEE_Panic(0);
470 
471 	return res;
472 }
473 
474 TEE_Result TEE_SetOperationKey2(TEE_OperationHandle operation,
475 				TEE_ObjectHandle key1, TEE_ObjectHandle key2)
476 {
477 	TEE_Result res;
478 	uint32_t key_size = 0;
479 	TEE_ObjectInfo key_info1;
480 	TEE_ObjectInfo key_info2;
481 
482 	/* Operation is not a valid handle */
483 	if (operation == TEE_HANDLE_NULL) {
484 		res = TEE_ERROR_BAD_PARAMETERS;
485 		goto out;
486 	}
487 
488 	/*
489 	 * Key1/Key2 and/or are not initialized and
490 	 * Either both keys are NULL or both are not NULL
491 	 */
492 	if (key1 == TEE_HANDLE_NULL || key2 == TEE_HANDLE_NULL) {
493 		/* Clear operation key1 (if needed) */
494 		if (key1 == TEE_HANDLE_NULL)
495 			TEE_ResetTransientObject(operation->key1);
496 		/* Clear operation key2 (if needed) */
497 		if (key2 == TEE_HANDLE_NULL)
498 			TEE_ResetTransientObject(operation->key2);
499 		res = TEE_ERROR_BAD_PARAMETERS;
500 		goto out;
501 	}
502 
503 	/* No key for digest operation */
504 	if (operation->info.operationClass == TEE_OPERATION_DIGEST) {
505 		res = TEE_ERROR_BAD_PARAMETERS;
506 		goto out;
507 	}
508 
509 	/* Two keys flag expected (TEE_ALG_AES_XTS only) */
510 	if ((operation->info.handleState & TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) ==
511 	    0) {
512 		res = TEE_ERROR_BAD_PARAMETERS;
513 		goto out;
514 	}
515 
516 	res = TEE_GetObjectInfo1(key1, &key_info1);
517 	/* Key1 is not a valid handle */
518 	if (res != TEE_SUCCESS)
519 		goto out;
520 
521 	/* Supplied key has to meet required usage */
522 	if ((key_info1.objectUsage & operation->info.
523 	     requiredKeyUsage) != operation->info.requiredKeyUsage) {
524 		res = TEE_ERROR_BAD_PARAMETERS;
525 		goto out;
526 	}
527 
528 	res = TEE_GetObjectInfo1(key2, &key_info2);
529 	/* Key2 is not a valid handle */
530 	if (res != TEE_SUCCESS) {
531 		if (res == TEE_ERROR_CORRUPT_OBJECT)
532 			res = TEE_ERROR_CORRUPT_OBJECT_2;
533 		goto out;
534 	}
535 
536 	/* Supplied key has to meet required usage */
537 	if ((key_info2.objectUsage & operation->info.
538 	     requiredKeyUsage) != operation->info.requiredKeyUsage) {
539 		res = TEE_ERROR_BAD_PARAMETERS;
540 		goto out;
541 	}
542 
543 	/*
544 	 * AES-XTS (the only multi key algorithm supported, requires the
545 	 * keys to be of equal size.
546 	 */
547 	if (operation->info.algorithm == TEE_ALG_AES_XTS &&
548 	    key_info1.keySize != key_info2.keySize) {
549 		res = TEE_ERROR_BAD_PARAMETERS;
550 		goto out;
551 
552 	}
553 
554 	if (operation->info.maxKeySize < key_info1.keySize) {
555 		res = TEE_ERROR_BAD_PARAMETERS;
556 		goto out;
557 	}
558 
559 	/*
560 	 * Odd that only the size of one key should be reported while
561 	 * size of two key are used when allocating the operation.
562 	 */
563 	key_size = key_info1.keySize;
564 
565 	TEE_ResetTransientObject(operation->key1);
566 	TEE_ResetTransientObject(operation->key2);
567 	operation->info.handleState &= ~TEE_HANDLE_FLAG_KEY_SET;
568 
569 	res = TEE_CopyObjectAttributes1(operation->key1, key1);
570 	if (res != TEE_SUCCESS)
571 		goto out;
572 
573 	res = TEE_CopyObjectAttributes1(operation->key2, key2);
574 	if (res != TEE_SUCCESS) {
575 		if (res == TEE_ERROR_CORRUPT_OBJECT)
576 			res = TEE_ERROR_CORRUPT_OBJECT_2;
577 		goto out;
578 	}
579 
580 	operation->info.handleState |= TEE_HANDLE_FLAG_KEY_SET;
581 
582 	operation->info.keySize = key_size;
583 
584 out:
585 	if (res != TEE_SUCCESS  &&
586 	    res != TEE_ERROR_CORRUPT_OBJECT &&
587 	    res != TEE_ERROR_CORRUPT_OBJECT_2 &&
588 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE &&
589 	    res != TEE_ERROR_STORAGE_NOT_AVAILABLE_2)
590 		TEE_Panic(0);
591 
592 	return res;
593 }
594 
595 void TEE_CopyOperation(TEE_OperationHandle dst_op, TEE_OperationHandle src_op)
596 {
597 	TEE_Result res;
598 
599 	if (dst_op == TEE_HANDLE_NULL || src_op == TEE_HANDLE_NULL)
600 		TEE_Panic(0);
601 	if (dst_op->info.algorithm != src_op->info.algorithm)
602 		TEE_Panic(0);
603 	if (src_op->info.operationClass != TEE_OPERATION_DIGEST) {
604 		TEE_ObjectHandle key1 = TEE_HANDLE_NULL;
605 		TEE_ObjectHandle key2 = TEE_HANDLE_NULL;
606 
607 		if (src_op->info.handleState & TEE_HANDLE_FLAG_KEY_SET) {
608 			key1 = src_op->key1;
609 			key2 = src_op->key2;
610 		}
611 
612 		if ((src_op->info.handleState &
613 		     TEE_HANDLE_FLAG_EXPECT_TWO_KEYS) == 0) {
614 			TEE_SetOperationKey(dst_op, key1);
615 		} else {
616 			TEE_SetOperationKey2(dst_op, key1, key2);
617 		}
618 	}
619 	dst_op->info.handleState = src_op->info.handleState;
620 	dst_op->info.keySize = src_op->info.keySize;
621 
622 	if (dst_op->buffer_two_blocks != src_op->buffer_two_blocks ||
623 	    dst_op->block_size != src_op->block_size)
624 		TEE_Panic(0);
625 
626 	if (dst_op->buffer != NULL) {
627 		if (src_op->buffer == NULL)
628 			TEE_Panic(0);
629 
630 		memcpy(dst_op->buffer, src_op->buffer, src_op->buffer_offs);
631 		dst_op->buffer_offs = src_op->buffer_offs;
632 	} else if (src_op->buffer != NULL) {
633 		TEE_Panic(0);
634 	}
635 
636 	res = utee_cryp_state_copy(dst_op->state, src_op->state);
637 	if (res != TEE_SUCCESS)
638 		TEE_Panic(res);
639 }
640 
641 /* Cryptographic Operations API - Message Digest Functions */
642 
643 void TEE_DigestUpdate(TEE_OperationHandle operation,
644 		      void *chunk, uint32_t chunkSize)
645 {
646 	TEE_Result res = TEE_ERROR_GENERIC;
647 
648 	if (operation == TEE_HANDLE_NULL ||
649 	    operation->info.operationClass != TEE_OPERATION_DIGEST)
650 		TEE_Panic(0);
651 
652 	res = utee_hash_update(operation->state, chunk, chunkSize);
653 	if (res != TEE_SUCCESS)
654 		TEE_Panic(res);
655 }
656 
657 TEE_Result TEE_DigestDoFinal(TEE_OperationHandle operation, const void *chunk,
658 			     uint32_t chunkLen, void *hash, uint32_t *hashLen)
659 {
660 	if ((operation == TEE_HANDLE_NULL) || (!chunk && chunkLen) ||
661 	    !hash || !hashLen ||
662 	    (operation->info.operationClass != TEE_OPERATION_DIGEST))
663 		TEE_Panic(0);
664 
665 	return utee_hash_final(operation->state, chunk, chunkLen, hash,
666 			       hashLen);
667 }
668 
669 /* Cryptographic Operations API - Symmetric Cipher Functions */
670 
671 void TEE_CipherInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen)
672 {
673 	TEE_Result res;
674 
675 	if (operation == TEE_HANDLE_NULL)
676 		TEE_Panic(0);
677 	if (operation->info.operationClass != TEE_OPERATION_CIPHER)
678 		TEE_Panic(0);
679 	res = utee_cipher_init(operation->state, IV, IVLen);
680 	if (res != TEE_SUCCESS)
681 		TEE_Panic(res);
682 	operation->buffer_offs = 0;
683 	operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
684 }
685 
686 static TEE_Result tee_buffer_update(
687 		TEE_OperationHandle op,
688 		TEE_Result(*update_func) (uint32_t state, const void *src,
689 					  size_t slen, void *dst, uint32_t *dlen),
690 		const void *src_data, size_t src_len,
691 		void *dest_data, uint32_t *dest_len)
692 {
693 	TEE_Result res;
694 	const uint8_t *src = src_data;
695 	size_t slen = src_len;
696 	uint8_t *dst = dest_data;
697 	size_t dlen = *dest_len;
698 	size_t acc_dlen = 0;
699 	uint32_t tmp_dlen;
700 	size_t l;
701 	size_t buffer_size;
702 	size_t buffer_left;
703 
704 	if (op->buffer_two_blocks) {
705 		buffer_size = op->block_size * 2;
706 		buffer_left = 1;
707 	} else {
708 		buffer_size = op->block_size;
709 		buffer_left = 0;
710 	}
711 
712 	if (op->buffer_offs > 0) {
713 		/* Fill up complete block */
714 		if (op->buffer_offs < op->block_size)
715 			l = MIN(slen, op->block_size - op->buffer_offs);
716 		else
717 			l = MIN(slen, buffer_size - op->buffer_offs);
718 		memcpy(op->buffer + op->buffer_offs, src, l);
719 		op->buffer_offs += l;
720 		src += l;
721 		slen -= l;
722 		if ((op->buffer_offs % op->block_size) != 0)
723 			goto out;	/* Nothing left to do */
724 	}
725 
726 	/* If we can feed from buffer */
727 	if ((op->buffer_offs > 0) &&
728 	    ((op->buffer_offs + slen) >= (buffer_size + buffer_left))) {
729 		l = ROUNDUP(op->buffer_offs + slen - buffer_size,
730 				op->block_size);
731 		l = MIN(op->buffer_offs, l);
732 		tmp_dlen = dlen;
733 		res = update_func(op->state, op->buffer, l, dst, &tmp_dlen);
734 		if (res != TEE_SUCCESS)
735 			TEE_Panic(res);
736 		dst += tmp_dlen;
737 		dlen -= tmp_dlen;
738 		acc_dlen += tmp_dlen;
739 		op->buffer_offs -= l;
740 		if (op->buffer_offs > 0) {
741 			/*
742 			 * Slen is small enough to be contained in rest buffer.
743 			 */
744 			memcpy(op->buffer, op->buffer + l, buffer_size - l);
745 			memcpy(op->buffer + op->buffer_offs, src, slen);
746 			op->buffer_offs += slen;
747 			goto out;	/* Nothing left to do */
748 		}
749 	}
750 
751 	if (slen >= (buffer_size + buffer_left)) {
752 		/* Buffer is empty, feed as much as possible from src */
753 		if (TEE_ALIGNMENT_IS_OK(src, uint32_t)) {
754 			l = ROUNDUP(slen - buffer_size + 1, op->block_size);
755 
756 			tmp_dlen = dlen;
757 			res = update_func(op->state, src, l, dst, &tmp_dlen);
758 			if (res != TEE_SUCCESS)
759 				TEE_Panic(res);
760 			src += l;
761 			slen -= l;
762 			dst += tmp_dlen;
763 			dlen -= tmp_dlen;
764 			acc_dlen += tmp_dlen;
765 		} else {
766 			/*
767 			 * Supplied data isn't well aligned, we're forced to
768 			 * feed through the buffer.
769 			 */
770 			while (slen >= op->block_size) {
771 				memcpy(op->buffer, src, op->block_size);
772 
773 				tmp_dlen = dlen;
774 				res =
775 				    update_func(op->state, op->buffer,
776 						op->block_size, dst, &tmp_dlen);
777 				if (res != TEE_SUCCESS)
778 					TEE_Panic(res);
779 				src += op->block_size;
780 				slen -= op->block_size;
781 				dst += tmp_dlen;
782 				dlen -= tmp_dlen;
783 				acc_dlen += tmp_dlen;
784 			}
785 		}
786 	}
787 
788 	/* Slen is small enough to be contained in buffer. */
789 	memcpy(op->buffer + op->buffer_offs, src, slen);
790 	op->buffer_offs += slen;
791 
792 out:
793 	*dest_len = acc_dlen;
794 	return TEE_SUCCESS;
795 }
796 
797 TEE_Result TEE_CipherUpdate(TEE_OperationHandle op, const void *srcData,
798 			    uint32_t srcLen, void *destData, uint32_t *destLen)
799 {
800 	size_t req_dlen;
801 
802 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
803 	    destLen == NULL || (destData == NULL && *destLen != 0))
804 		TEE_Panic(0);
805 	if (op->info.operationClass != TEE_OPERATION_CIPHER)
806 		TEE_Panic(0);
807 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
808 		TEE_Panic(0);
809 
810 	/* Calculate required dlen */
811 	req_dlen = ((op->buffer_offs + srcLen) / op->block_size) *
812 	    op->block_size;
813 	if (op->buffer_two_blocks) {
814 		if (req_dlen > op->block_size * 2)
815 			req_dlen -= op->block_size * 2;
816 		else
817 			req_dlen = 0;
818 	}
819 	/*
820 	 * Check that required destLen is big enough before starting to feed
821 	 * data to the algorithm. Errors during feeding of data are fatal as we
822 	 * can't restore sync with this API.
823 	 */
824 	if (*destLen < req_dlen) {
825 		*destLen = req_dlen;
826 		return TEE_ERROR_SHORT_BUFFER;
827 	}
828 
829 	tee_buffer_update(op, utee_cipher_update, srcData, srcLen, destData,
830 			  destLen);
831 
832 	return TEE_SUCCESS;
833 }
834 
835 TEE_Result TEE_CipherDoFinal(TEE_OperationHandle op,
836 			     const void *srcData, uint32_t srcLen, void *destData,
837 			     uint32_t *destLen)
838 {
839 	TEE_Result res;
840 	uint8_t *dst = destData;
841 	size_t acc_dlen = 0;
842 	uint32_t tmp_dlen;
843 	size_t req_dlen;
844 
845 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
846 	    destLen == NULL || (destData == NULL && *destLen != 0))
847 		TEE_Panic(0);
848 	if (op->info.operationClass != TEE_OPERATION_CIPHER)
849 		TEE_Panic(0);
850 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
851 		TEE_Panic(0);
852 
853 	/*
854 	 * Check that the final block doesn't require padding for those
855 	 * algorithms that requires client to supply padding.
856 	 */
857 	if (op->info.algorithm == TEE_ALG_AES_ECB_NOPAD ||
858 	    op->info.algorithm == TEE_ALG_AES_CBC_NOPAD ||
859 	    op->info.algorithm == TEE_ALG_DES_ECB_NOPAD ||
860 	    op->info.algorithm == TEE_ALG_DES_CBC_NOPAD ||
861 	    op->info.algorithm == TEE_ALG_DES3_ECB_NOPAD ||
862 	    op->info.algorithm == TEE_ALG_DES3_CBC_NOPAD) {
863 		if (((op->buffer_offs + srcLen) % op->block_size) != 0)
864 			return TEE_ERROR_BAD_PARAMETERS;
865 	}
866 
867 	/*
868 	 * Check that required destLen is big enough before starting to feed
869 	 * data to the algorithm. Errors during feeding of data are fatal as we
870 	 * can't restore sync with this API.
871 	 */
872 	req_dlen = op->buffer_offs + srcLen;
873 	if (*destLen < req_dlen) {
874 		*destLen = req_dlen;
875 		return TEE_ERROR_SHORT_BUFFER;
876 	}
877 
878 	tmp_dlen = *destLen - acc_dlen;
879 	tee_buffer_update(op, utee_cipher_update, srcData, srcLen, dst,
880 			  &tmp_dlen);
881 	dst += tmp_dlen;
882 	acc_dlen += tmp_dlen;
883 
884 	tmp_dlen = *destLen - acc_dlen;
885 	res = utee_cipher_final(op->state, op->buffer, op->buffer_offs,
886 				dst, &tmp_dlen);
887 	if (res != TEE_SUCCESS)
888 		TEE_Panic(res);
889 	acc_dlen += tmp_dlen;
890 
891 	op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
892 	*destLen = acc_dlen;
893 	return TEE_SUCCESS;
894 }
895 
896 /* Cryptographic Operations API - MAC Functions */
897 
898 void TEE_MACInit(TEE_OperationHandle operation, const void *IV, uint32_t IVLen)
899 {
900 	TEE_Result res;
901 
902 	if (operation == TEE_HANDLE_NULL)
903 		TEE_Panic(0);
904 	if (IV == NULL && IVLen != 0)
905 		TEE_Panic(0);
906 	if (operation->info.operationClass != TEE_OPERATION_MAC)
907 		TEE_Panic(0);
908 	res = utee_hash_init(operation->state, IV, IVLen);
909 	if (res != TEE_SUCCESS)
910 		TEE_Panic(res);
911 	operation->buffer_offs = 0;
912 	operation->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
913 }
914 
915 void TEE_MACUpdate(TEE_OperationHandle op, const void *chunk, uint32_t chunkSize)
916 {
917 	TEE_Result res;
918 
919 	if (op == TEE_HANDLE_NULL || (chunk == NULL && chunkSize != 0))
920 		TEE_Panic(0);
921 	if (op->info.operationClass != TEE_OPERATION_MAC)
922 		TEE_Panic(0);
923 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
924 		TEE_Panic(0);
925 
926 	res = utee_hash_update(op->state, chunk, chunkSize);
927 	if (res != TEE_SUCCESS)
928 		TEE_Panic(res);
929 }
930 
931 TEE_Result TEE_MACComputeFinal(TEE_OperationHandle op,
932 			       const void *message, uint32_t messageLen,
933 			       void *mac, uint32_t *macLen)
934 {
935 	TEE_Result res;
936 
937 	if (op == TEE_HANDLE_NULL || (message == NULL && messageLen != 0) ||
938 	    mac == NULL || macLen == NULL)
939 		TEE_Panic(0);
940 	if (op->info.operationClass != TEE_OPERATION_MAC)
941 		TEE_Panic(0);
942 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
943 		TEE_Panic(0);
944 
945 	res = utee_hash_final(op->state, message, messageLen, mac, macLen);
946 	op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
947 	return res;
948 }
949 
950 TEE_Result TEE_MACCompareFinal(TEE_OperationHandle operation,
951 			       const void *message, uint32_t messageLen,
952 			       const void *mac, uint32_t macLen)
953 {
954 	TEE_Result res;
955 	uint8_t computed_mac[TEE_MAX_HASH_SIZE];
956 	uint32_t computed_mac_size = TEE_MAX_HASH_SIZE;
957 
958 	res = TEE_MACComputeFinal(operation, message, messageLen, computed_mac,
959 				  &computed_mac_size);
960 	if (res != TEE_SUCCESS)
961 		return res;
962 	if (computed_mac_size != macLen)
963 		return TEE_ERROR_MAC_INVALID;
964 	if (buf_compare_ct(mac, computed_mac, computed_mac_size) != 0)
965 		return TEE_ERROR_MAC_INVALID;
966 	return TEE_SUCCESS;
967 }
968 
969 /* Cryptographic Operations API - Authenticated Encryption Functions */
970 
971 TEE_Result TEE_AEInit(TEE_OperationHandle op, const void *nonce,
972 		      uint32_t nonceLen, uint32_t tagLen, uint32_t AADLen,
973 		      uint32_t payloadLen)
974 {
975 	TEE_Result res;
976 
977 	if (op == TEE_HANDLE_NULL || nonce == NULL)
978 		TEE_Panic(0);
979 	if (op->info.operationClass != TEE_OPERATION_AE)
980 		TEE_Panic(0);
981 
982 	/*
983 	 * AES-CCM tag len is specified by AES-CCM spec and handled in TEE Core
984 	 * in the implementation. But AES-GCM spec doesn't specify the tag len
985 	 * according to the same principle so we have to check here instead to
986 	 * be GP compliant.
987 	 */
988 	if (op->info.algorithm == TEE_ALG_AES_GCM) {
989 		/*
990 		 * From GP spec: For AES-GCM, can be 128, 120, 112, 104, or 96
991 		 */
992 		if (tagLen < 96 || tagLen > 128 || (tagLen % 8 != 0))
993 			return TEE_ERROR_NOT_SUPPORTED;
994 	}
995 
996 	res = utee_authenc_init(op->state, nonce, nonceLen, tagLen / 8, AADLen,
997 				payloadLen);
998 	if (res != TEE_SUCCESS) {
999 		if (res != TEE_ERROR_NOT_SUPPORTED)
1000 			TEE_Panic(res);
1001 		return res;
1002 	}
1003 	op->ae_tag_len = tagLen / 8;
1004 
1005 	op->info.handleState |= TEE_HANDLE_FLAG_INITIALIZED;
1006 	return TEE_SUCCESS;
1007 }
1008 
1009 void TEE_AEUpdateAAD(TEE_OperationHandle op, const void *AADdata,
1010 		     uint32_t AADdataLen)
1011 {
1012 	TEE_Result res;
1013 
1014 	if (op == TEE_HANDLE_NULL || (AADdata == NULL && AADdataLen != 0))
1015 		TEE_Panic(0);
1016 	if (op->info.operationClass != TEE_OPERATION_AE)
1017 		TEE_Panic(0);
1018 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1019 		TEE_Panic(0);
1020 
1021 	res = utee_authenc_update_aad(op->state, AADdata, AADdataLen);
1022 	if (res != TEE_SUCCESS)
1023 		TEE_Panic(res);
1024 }
1025 
1026 TEE_Result TEE_AEUpdate(TEE_OperationHandle op, const void *srcData,
1027 			uint32_t srcLen, void *destData, uint32_t *destLen)
1028 {
1029 	size_t req_dlen;
1030 
1031 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1032 	    destLen == NULL || (destData == NULL && *destLen != 0))
1033 		TEE_Panic(0);
1034 	if (op->info.operationClass != TEE_OPERATION_AE)
1035 		TEE_Panic(0);
1036 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1037 		TEE_Panic(0);
1038 
1039 	/*
1040 	 * Check that required destLen is big enough before starting to feed
1041 	 * data to the algorithm. Errors during feeding of data are fatal as we
1042 	 * can't restore sync with this API.
1043 	 */
1044 	req_dlen = ROUNDDOWN(op->buffer_offs + srcLen, op->block_size);
1045 	if (*destLen < req_dlen) {
1046 		*destLen = req_dlen;
1047 		return TEE_ERROR_SHORT_BUFFER;
1048 	}
1049 
1050 	tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen,
1051 			  destData, destLen);
1052 
1053 	return TEE_SUCCESS;
1054 }
1055 
1056 TEE_Result TEE_AEEncryptFinal(TEE_OperationHandle op,
1057 			      const void *srcData, uint32_t srcLen,
1058 			      void *destData, uint32_t *destLen, void *tag,
1059 			      uint32_t *tagLen)
1060 {
1061 	TEE_Result res;
1062 	uint8_t *dst = destData;
1063 	size_t acc_dlen = 0;
1064 	uint32_t tmp_dlen;
1065 	size_t req_dlen;
1066 
1067 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1068 	    destLen == NULL || (destData == NULL && *destLen != 0) ||
1069 	    tag == NULL || tagLen == NULL)
1070 		TEE_Panic(0);
1071 	if (op->info.operationClass != TEE_OPERATION_AE)
1072 		TEE_Panic(0);
1073 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1074 		TEE_Panic(0);
1075 
1076 	/*
1077 	 * Check that required destLen is big enough before starting to feed
1078 	 * data to the algorithm. Errors during feeding of data are fatal as we
1079 	 * can't restore sync with this API.
1080 	 */
1081 	req_dlen = op->buffer_offs + srcLen;
1082 	if (*destLen < req_dlen) {
1083 		*destLen = req_dlen;
1084 		return TEE_ERROR_SHORT_BUFFER;
1085 	}
1086 
1087 	/*
1088 	 * Need to check this before update_payload since sync would be lost if
1089 	 * we return short buffer after that.
1090 	 */
1091 	if (*tagLen < op->ae_tag_len) {
1092 		*tagLen = op->ae_tag_len;
1093 		return TEE_ERROR_SHORT_BUFFER;
1094 	}
1095 
1096 	tmp_dlen = *destLen - acc_dlen;
1097 	tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen,
1098 			  dst, &tmp_dlen);
1099 	dst += tmp_dlen;
1100 	acc_dlen += tmp_dlen;
1101 
1102 	tmp_dlen = *destLen - acc_dlen;
1103 	res =
1104 	    utee_authenc_enc_final(op->state, op->buffer, op->buffer_offs, dst,
1105 				   &tmp_dlen, tag, tagLen);
1106 	if (res != TEE_SUCCESS)
1107 		TEE_Panic(res);
1108 	acc_dlen += tmp_dlen;
1109 
1110 	*destLen = acc_dlen;
1111 	op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1112 
1113 	return res;
1114 }
1115 
1116 TEE_Result TEE_AEDecryptFinal(TEE_OperationHandle op,
1117 			      const void *srcData, uint32_t srcLen,
1118 			      void *destData, uint32_t *destLen, const void *tag,
1119 			      uint32_t tagLen)
1120 {
1121 	TEE_Result res;
1122 	uint8_t *dst = destData;
1123 	size_t acc_dlen = 0;
1124 	uint32_t tmp_dlen;
1125 	size_t req_dlen;
1126 
1127 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1128 	    destLen == NULL || (destData == NULL && *destLen != 0) ||
1129 	    (tag == NULL && tagLen != 0))
1130 		TEE_Panic(0);
1131 	if (op->info.operationClass != TEE_OPERATION_AE)
1132 		TEE_Panic(0);
1133 	if ((op->info.handleState & TEE_HANDLE_FLAG_INITIALIZED) == 0)
1134 		TEE_Panic(0);
1135 
1136 	/*
1137 	 * Check that required destLen is big enough before starting to feed
1138 	 * data to the algorithm. Errors during feeding of data are fatal as we
1139 	 * can't restore sync with this API.
1140 	 */
1141 	req_dlen = op->buffer_offs + srcLen;
1142 	if (*destLen < req_dlen) {
1143 		*destLen = req_dlen;
1144 		return TEE_ERROR_SHORT_BUFFER;
1145 	}
1146 
1147 	tmp_dlen = *destLen - acc_dlen;
1148 	tee_buffer_update(op, utee_authenc_update_payload, srcData, srcLen,
1149 			  dst, &tmp_dlen);
1150 	dst += tmp_dlen;
1151 	acc_dlen += tmp_dlen;
1152 
1153 	tmp_dlen = *destLen - acc_dlen;
1154 	res =
1155 	    utee_authenc_dec_final(op->state, op->buffer, op->buffer_offs, dst,
1156 				   &tmp_dlen, tag, tagLen);
1157 	if (res != TEE_SUCCESS && res != TEE_ERROR_MAC_INVALID)
1158 		TEE_Panic(res);
1159 	/* Supplied tagLen should match what we initiated with */
1160 	if (tagLen != op->ae_tag_len)
1161 		res = TEE_ERROR_MAC_INVALID;
1162 
1163 	acc_dlen += tmp_dlen;
1164 
1165 	*destLen = acc_dlen;
1166 	op->info.handleState &= ~TEE_HANDLE_FLAG_INITIALIZED;
1167 
1168 	return res;
1169 }
1170 
1171 /* Cryptographic Operations API - Asymmetric Functions */
1172 
1173 TEE_Result TEE_AsymmetricEncrypt(TEE_OperationHandle op,
1174 				 const TEE_Attribute *params,
1175 				 uint32_t paramCount, const void *srcData,
1176 				 uint32_t srcLen, void *destData,
1177 				 uint32_t *destLen)
1178 {
1179 	TEE_Result res;
1180 
1181 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1182 	    destLen == NULL || (destData == NULL && *destLen != 0))
1183 		TEE_Panic(0);
1184 	if (paramCount != 0 && params == NULL)
1185 		TEE_Panic(0);
1186 	if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER)
1187 		TEE_Panic(0);
1188 	if (op->info.mode != TEE_MODE_ENCRYPT)
1189 		TEE_Panic(0);
1190 
1191 	res = utee_asymm_operate(op->state, params, paramCount, srcData, srcLen,
1192 				 destData, destLen);
1193 	if (res != TEE_SUCCESS &&
1194 	    res != TEE_ERROR_SHORT_BUFFER &&
1195 	    res != TEE_ERROR_BAD_PARAMETERS)
1196 		TEE_Panic(res);
1197 	return res;
1198 }
1199 
1200 TEE_Result TEE_AsymmetricDecrypt(TEE_OperationHandle op,
1201 				 const TEE_Attribute *params,
1202 				 uint32_t paramCount, const void *srcData,
1203 				 uint32_t srcLen, void *destData,
1204 				 uint32_t *destLen)
1205 {
1206 	TEE_Result res;
1207 
1208 	if (op == TEE_HANDLE_NULL || (srcData == NULL && srcLen != 0) ||
1209 	    destLen == NULL || (destData == NULL && *destLen != 0))
1210 		TEE_Panic(0);
1211 	if (paramCount != 0 && params == NULL)
1212 		TEE_Panic(0);
1213 	if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_CIPHER)
1214 		TEE_Panic(0);
1215 	if (op->info.mode != TEE_MODE_DECRYPT)
1216 		TEE_Panic(0);
1217 
1218 	res = utee_asymm_operate(op->state, params, paramCount, srcData, srcLen,
1219 				 destData, destLen);
1220 	if (res != TEE_SUCCESS &&
1221 	    res != TEE_ERROR_SHORT_BUFFER &&
1222 	    res != TEE_ERROR_BAD_PARAMETERS)
1223 		TEE_Panic(res);
1224 	return res;
1225 }
1226 
1227 TEE_Result TEE_AsymmetricSignDigest(TEE_OperationHandle op,
1228 				    const TEE_Attribute *params,
1229 				    uint32_t paramCount, const void *digest,
1230 				    uint32_t digestLen, void *signature,
1231 				    uint32_t *signatureLen)
1232 {
1233 	TEE_Result res;
1234 
1235 	if (op == TEE_HANDLE_NULL || (digest == NULL && digestLen != 0) ||
1236 	    signature == NULL || signatureLen == NULL)
1237 		TEE_Panic(0);
1238 	if (paramCount != 0 && params == NULL)
1239 		TEE_Panic(0);
1240 	if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_SIGNATURE)
1241 		TEE_Panic(0);
1242 	if (op->info.mode != TEE_MODE_SIGN)
1243 		TEE_Panic(0);
1244 
1245 	res =
1246 	    utee_asymm_operate(op->state, params, paramCount, digest, digestLen,
1247 			       signature, signatureLen);
1248 	if (res != TEE_SUCCESS && res != TEE_ERROR_SHORT_BUFFER)
1249 		TEE_Panic(res);
1250 	return res;
1251 }
1252 
1253 TEE_Result TEE_AsymmetricVerifyDigest(TEE_OperationHandle op,
1254 				      const TEE_Attribute *params,
1255 				      uint32_t paramCount, const void *digest,
1256 				      uint32_t digestLen, const void *signature,
1257 				      uint32_t signatureLen)
1258 {
1259 	TEE_Result res;
1260 
1261 	if (op == TEE_HANDLE_NULL || (digest == NULL && digestLen != 0) ||
1262 	    (signature == NULL && signatureLen != 0))
1263 		TEE_Panic(0);
1264 	if (paramCount != 0 && params == NULL)
1265 		TEE_Panic(0);
1266 	if (op->info.operationClass != TEE_OPERATION_ASYMMETRIC_SIGNATURE)
1267 		TEE_Panic(0);
1268 	if (op->info.mode != TEE_MODE_VERIFY)
1269 		TEE_Panic(0);
1270 
1271 	res =
1272 	    utee_asymm_verify(op->state, params, paramCount, digest, digestLen,
1273 			      signature, signatureLen);
1274 	if (res != TEE_SUCCESS && res != TEE_ERROR_SIGNATURE_INVALID)
1275 		TEE_Panic(res);
1276 	return res;
1277 }
1278 
1279 /* Cryptographic Operations API - Key Derivation Functions */
1280 
1281 void TEE_DeriveKey(TEE_OperationHandle operation,
1282 		   const TEE_Attribute *params, uint32_t paramCount,
1283 		   TEE_ObjectHandle derivedKey)
1284 {
1285 	TEE_Result res;
1286 	TEE_ObjectInfo key_info;
1287 
1288 	if (operation == TEE_HANDLE_NULL || derivedKey == 0)
1289 		TEE_Panic(0);
1290 	if (paramCount != 0 && params == NULL)
1291 		TEE_Panic(0);
1292 	if (TEE_ALG_GET_CLASS(operation->info.algorithm) !=
1293 			TEE_OPERATION_KEY_DERIVATION)
1294 		TEE_Panic(0);
1295 
1296 	if (operation->info.operationClass != TEE_OPERATION_KEY_DERIVATION)
1297 		TEE_Panic(0);
1298 	if (operation->info.mode != TEE_MODE_DERIVE)
1299 		TEE_Panic(0);
1300 	if ((operation->info.handleState & TEE_HANDLE_FLAG_KEY_SET) == 0)
1301 		TEE_Panic(0);
1302 
1303 	res = utee_cryp_obj_get_info((uint32_t) derivedKey, &key_info);
1304 	if (res != TEE_SUCCESS)
1305 		TEE_Panic(0);
1306 
1307 	if (key_info.objectType != TEE_TYPE_GENERIC_SECRET)
1308 		TEE_Panic(0);
1309 	if ((key_info.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) != 0)
1310 		TEE_Panic(0);
1311 
1312 	res = utee_cryp_derive_key(operation->state, params, paramCount,
1313 				   (uint32_t) derivedKey);
1314 	if (res != TEE_SUCCESS)
1315 		TEE_Panic(res);
1316 }
1317 
1318 /* Cryptographic Operations API - Random Number Generation Functions */
1319 
1320 void TEE_GenerateRandom(void *randomBuffer, uint32_t randomBufferLen)
1321 {
1322 	TEE_Result res;
1323 
1324 	res = utee_cryp_random_number_generate(randomBuffer, randomBufferLen);
1325 	if (res != TEE_SUCCESS)
1326 		TEE_Panic(res);
1327 }
1328