1 /*
2  * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "hks_param.h"
17 
18 #include <stddef.h>
19 
20 #include "hks_log.h"
21 #include "hks_mem.h"
22 #include "hks_template.h"
23 #include "hks_type_inner.h"
24 
25 #include "securec.h"
26 
27 static uint32_t g_validTags[] = {
28     HKS_TAG_ALGORITHM,
29     HKS_TAG_PURPOSE,
30     HKS_TAG_KEY_SIZE,
31     HKS_TAG_DIGEST,
32     HKS_TAG_PADDING,
33     HKS_TAG_BLOCK_MODE,
34     HKS_TAG_KEY_TYPE,
35     HKS_TAG_ASSOCIATED_DATA,
36     HKS_TAG_NONCE,
37     HKS_TAG_IV,
38 
39     HKS_TAG_SALT,
40     HKS_TAG_PWD,
41     HKS_TAG_INFO,
42     HKS_TAG_ITERATION,
43 
44     HKS_TAG_KEY_GENERATE_TYPE,
45     HKS_TAG_DERIVE_MAIN_KEY,
46     HKS_TAG_DERIVE_FACTOR,
47     HKS_TAG_DERIVE_ALG,
48     HKS_TAG_AGREE_ALG,
49     HKS_TAG_AGREE_PUBLIC_KEY_IS_KEY_ALIAS,
50     HKS_TAG_AGREE_PRIVATE_KEY_ALIAS,
51     HKS_TAG_AGREE_PUBLIC_KEY,
52     HKS_TAG_KEY_ALIAS,
53     HKS_TAG_DERIVE_KEY_SIZE,
54     HKS_TAG_IMPORT_KEY_TYPE,
55     HKS_TAG_UNWRAP_ALGORITHM_SUITE,
56     HKS_TAG_DERIVE_AGREE_KEY_STORAGE_FLAG,
57     HKS_TAG_RSA_PSS_SALT_LEN_TYPE,
58     HKS_TAG_MGF_DIGEST,
59 
60     HKS_TAG_ACTIVE_DATETIME,
61     HKS_TAG_ORIGINATION_EXPIRE_DATETIME,
62     HKS_TAG_USAGE_EXPIRE_DATETIME,
63     HKS_TAG_CREATION_DATETIME,
64 
65     HKS_TAG_ALL_USERS,
66     HKS_TAG_USER_ID,
67     HKS_TAG_FRONT_USER_ID,
68     HKS_TAG_NO_AUTH_REQUIRED,
69     HKS_TAG_USER_AUTH_TYPE,
70     HKS_TAG_AUTH_TIMEOUT,
71     HKS_TAG_AUTH_TOKEN,
72     HKS_TAG_AUTH_STORAGE_LEVEL,
73     HKS_TAG_SPECIFIC_USER_ID,
74 
75     HKS_TAG_OS_VERSION,
76     HKS_TAG_OS_PATCHLEVEL,
77 
78     HKS_TAG_ATTESTATION_CHALLENGE,
79     HKS_TAG_ATTESTATION_APPLICATION_ID,
80     HKS_TAG_ATTESTATION_APPLICATION_ID_TYPE,
81     HKS_TAG_ATTESTATION_ID_BRAND,
82     HKS_TAG_ATTESTATION_ID_DEVICE,
83     HKS_TAG_ATTESTATION_ID_PRODUCT,
84     HKS_TAG_ATTESTATION_ID_SERIAL,
85     HKS_TAG_ATTESTATION_ID_IMEI,
86     HKS_TAG_ATTESTATION_ID_MEID,
87     HKS_TAG_ATTESTATION_ID_MANUFACTURER,
88     HKS_TAG_ATTESTATION_ID_MODEL,
89     HKS_TAG_ATTESTATION_ID_ALIAS,
90     HKS_TAG_ATTESTATION_ID_SOCID,
91     HKS_TAG_ATTESTATION_ID_UDID,
92     HKS_TAG_ATTESTATION_ID_SEC_LEVEL_INFO,
93     HKS_TAG_ATTESTATION_ID_VERSION_INFO,
94     HKS_TAG_ATTESTATION_BASE64,
95     HKS_TAG_ATTESTATION_MODE,
96     HKS_TAG_ATTESTATION_CERT_TYPE,
97 
98     HKS_TAG_IS_KEY_ALIAS,
99     HKS_TAG_KEY_STORAGE_FLAG,
100     HKS_TAG_IS_ALLOWED_WRAP,
101     HKS_TAG_KEY_WRAP_TYPE,
102     HKS_TAG_WRAP_KEY_VERSION,
103     HKS_TAG_IS_ALLOWED_DATA_WRAP,
104     HKS_TAG_DATA_WRAP_TYPE,
105     HKS_TAG_KEY_AUTH_ID,
106     HKS_TAG_KEY_ROLE,
107     HKS_TAG_KEY_FLAG,
108     HKS_TAG_KEY_DOMAIN,
109 
110     HKS_TAG_KEY_AUTH_ACCESS_TYPE,
111     HKS_TAG_KEY_SECURE_SIGN_TYPE,
112     HKS_TAG_CHALLENGE_TYPE,
113     HKS_TAG_CHALLENGE_POS,
114     HKS_TAG_KEY_AUTH_PURPOSE,
115     HKS_TAG_BATCH_PURPOSE,
116     HKS_TAG_IS_BATCH_OPERATION,
117     HKS_TAG_BATCH_OPERATION_TIMEOUT,
118     HKS_TAG_USER_AUTH_MODE,
119 
120     HKS_TAG_KEY_INIT_CHALLENGE,
121     HKS_TAG_IS_USER_AUTH_ACCESS,
122     HKS_TAG_USER_AUTH_CHALLENGE,
123     HKS_TAG_USER_AUTH_ENROLL_ID_INFO,
124     HKS_TAG_USER_AUTH_SECURE_UID,
125     HKS_TAG_KEY_AUTH_RESULT,
126     HKS_TAG_IF_NEED_APPEND_AUTH_INFO,
127     HKS_TAG_VERIFIED_AUTH_TOKEN,
128     HKS_TAG_IS_APPEND_UPDATE_DATA,
129     HKS_TAG_IS_COPY_NEW_KEY,
130 
131     HKS_TAG_PROCESS_NAME,
132     HKS_TAG_PACKAGE_NAME,
133     HKS_TAG_PAYLOAD_LEN,
134     HKS_TAG_AE_TAG,
135     HKS_TAG_CRYPTO_CTX,
136     HKS_TAG_KEY,
137     HKS_TAG_KEY_VERSION,
138     HKS_TAG_IS_KEY_HANDLE,
139     HKS_TAG_SYMMETRIC_KEY_DATA,
140     HKS_TAG_ASYMMETRIC_PUBLIC_KEY_DATA,
141     HKS_TAG_ASYMMETRIC_PRIVATE_KEY_DATA,
142     HKS_TAG_KEY_ACCESS_TIME,
143 
144     HKS_TAG_ACCESS_TOKEN_ID,
145     HKS_TAG_BUNDLE_NAME,
146     HKS_TAG_IS_DEVICE_PASSWORD_SET,
147     HKS_TAG_ACCOUNT_ID,
148     HKS_TAG_OWNER_ID,
149     HKS_TAG_OWNER_TYPE,
150     HKS_TAG_AGREE_PUBKEY_TYPE,
151     HKS_TAG_IS_CHANGE_STORAGE_LEVEL,
152 };
153 
GetTagType(enum HksTag tag)154 HKS_API_EXPORT enum HksTagType GetTagType(enum HksTag tag)
155 {
156     return (enum HksTagType)((uint32_t)tag & (uint32_t)HKS_TAG_TYPE_MASK);
157 }
158 
IsValidTag(uint32_t tag)159 static bool IsValidTag(uint32_t tag)
160 {
161     uint32_t tagSize = HKS_ARRAY_SIZE(g_validTags);
162     for (uint32_t i = 0; i < tagSize; ++i) {
163         if (tag == g_validTags[i]) {
164             return true;
165         }
166     }
167     return false;
168 }
169 
HksCheckParamSetTag(const struct HksParamSet *paramSet)170 HKS_API_EXPORT int32_t HksCheckParamSetTag(const struct HksParamSet *paramSet)
171 {
172     HKS_IF_NULL_RETURN(paramSet, HKS_ERROR_NULL_POINTER)
173 
174     for (uint32_t i = 0; i < paramSet->paramsCnt; ++i) {
175         uint32_t curTag = paramSet->params[i].tag;
176         if (!IsValidTag(curTag)) {
177             HKS_LOG_E("paramSet contains invalid tag! 0x%" LOG_PUBLIC "x", curTag);
178             return HKS_ERROR_INVALID_ARGUMENT;
179         }
180 
181         for (uint32_t j = i + 1; j < paramSet->paramsCnt; ++j) {
182             if (curTag == paramSet->params[j].tag) {
183                 HKS_LOG_E("paramSet contains multi-tags! 0x%" LOG_PUBLIC "x", curTag);
184                 return HKS_ERROR_INVALID_ARGUMENT;
185             }
186         }
187     }
188 
189     return HKS_SUCCESS;
190 }
191 
CheckBeforeAddParams(const struct HksParamSet *paramSet, const struct HksParam *params, uint32_t paramCnt)192 static int32_t CheckBeforeAddParams(const struct HksParamSet *paramSet, const struct HksParam *params,
193     uint32_t paramCnt)
194 {
195     if ((params == NULL) || (paramSet == NULL) || (paramSet->paramSetSize > HKS_PARAM_SET_MAX_SIZE) ||
196         (paramCnt > HKS_DEFAULT_PARAM_CNT) || (paramSet->paramsCnt > (HKS_DEFAULT_PARAM_CNT - paramCnt))) {
197         HKS_LOG_E("invalid params or paramset!");
198         return HKS_ERROR_INVALID_ARGUMENT;
199     }
200 
201     for (uint32_t i = 0; i < paramCnt; i++) {
202         if ((GetTagType((enum HksTag)(params[i].tag)) == HKS_TAG_TYPE_BYTES) &&
203             (params[i].blob.data == NULL)) {
204             HKS_LOG_E("invalid blob param!");
205             return HKS_ERROR_INVALID_ARGUMENT;
206         }
207     }
208     return HKS_SUCCESS;
209 }
210 
BuildParamSet(struct HksParamSet **paramSet)211 static int32_t BuildParamSet(struct HksParamSet **paramSet)
212 {
213     struct HksParamSet *freshParamSet = *paramSet;
214     uint32_t size = freshParamSet->paramSetSize;
215     uint32_t offset = sizeof(struct HksParamSet) + sizeof(struct HksParam) * freshParamSet->paramsCnt;
216 
217     if (size > HKS_DEFAULT_PARAM_SET_SIZE) {
218         freshParamSet = (struct HksParamSet *)HksMalloc(size);
219         HKS_IF_NULL_LOGE_RETURN(freshParamSet, HKS_ERROR_MALLOC_FAIL, "malloc params failed!")
220 
221         if (memcpy_s(freshParamSet, size, *paramSet, offset) != EOK) {
222             HKS_FREE(freshParamSet);
223             HKS_LOG_E("copy params failed!");
224             return HKS_ERROR_INSUFFICIENT_MEMORY;
225         }
226         HKS_FREE(*paramSet);
227         *paramSet = freshParamSet;
228     }
229 
230     return HksFreshParamSet(freshParamSet, true);
231 }
232 
HksCheckParamSet(const struct HksParamSet *paramSet, uint32_t size)233 HKS_API_EXPORT int32_t HksCheckParamSet(const struct HksParamSet *paramSet, uint32_t size)
234 {
235     HKS_IF_NULL_RETURN(paramSet, HKS_ERROR_NULL_POINTER)
236 
237     if ((size < sizeof(struct HksParamSet)) || (size > HKS_PARAM_SET_MAX_SIZE) ||
238         (paramSet->paramSetSize != size) ||
239         (paramSet->paramsCnt > ((size - sizeof(struct HksParamSet)) / sizeof(struct HksParam)))) {
240         HKS_LOG_E("invalid param set!");
241         return HKS_ERROR_INVALID_ARGUMENT;
242     }
243     return HKS_SUCCESS;
244 }
245 
HksInitParamSet(struct HksParamSet **paramSet)246 HKS_API_EXPORT int32_t HksInitParamSet(struct HksParamSet **paramSet)
247 {
248     HKS_IF_NULL_LOGE_RETURN(paramSet, HKS_ERROR_NULL_POINTER, "invalid init params!")
249 
250     *paramSet = (struct HksParamSet *)HksMalloc(HKS_DEFAULT_PARAM_SET_SIZE);
251     HKS_IF_NULL_LOGE_RETURN(*paramSet, HKS_ERROR_MALLOC_FAIL, "malloc init param set failed!")
252 
253     (*paramSet)->paramsCnt = 0;
254     (*paramSet)->paramSetSize = sizeof(struct HksParamSet);
255     return HKS_SUCCESS;
256 }
257 
HksAddParams(struct HksParamSet *paramSet, const struct HksParam *params, uint32_t paramCnt)258 HKS_API_EXPORT int32_t HksAddParams(struct HksParamSet *paramSet,
259     const struct HksParam *params, uint32_t paramCnt)
260 {
261     int32_t ret = CheckBeforeAddParams(paramSet, params, paramCnt);
262     HKS_IF_NOT_SUCC_RETURN(ret, ret)
263 
264     for (uint32_t i = 0; i < paramCnt; i++) {
265         paramSet->paramSetSize += sizeof(struct HksParam);
266         if (GetTagType((enum HksTag)(params[i].tag)) == HKS_TAG_TYPE_BYTES) {
267             if (IsAdditionOverflow(paramSet->paramSetSize, params[i].blob.size)) {
268                 HKS_LOG_E("params size overflow!");
269                 paramSet->paramSetSize -= sizeof(struct HksParam);
270                 return HKS_ERROR_INVALID_ARGUMENT;
271             }
272             paramSet->paramSetSize += params[i].blob.size;
273         }
274         if (memcpy_s(&paramSet->params[paramSet->paramsCnt++], sizeof(struct HksParam), &params[i],
275             sizeof(struct HksParam)) != EOK) {
276             HKS_LOG_E("copy paramSet failed!");
277             return HKS_ERROR_INSUFFICIENT_MEMORY;
278         }
279     }
280     return HKS_SUCCESS;
281 }
282 
HksBuildParamSet(struct HksParamSet **paramSet)283 HKS_API_EXPORT int32_t HksBuildParamSet(struct HksParamSet **paramSet)
284 {
285     if ((paramSet == NULL) || (*paramSet == NULL)) {
286         return HKS_ERROR_NULL_POINTER;
287     }
288 
289     int ret = HksCheckParamSet(*paramSet, (*paramSet)->paramSetSize);
290     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "invalid build params!")
291 
292     return BuildParamSet(paramSet);
293 }
294 
HksFreeParamSet(struct HksParamSet **paramSet)295 HKS_API_EXPORT void HksFreeParamSet(struct HksParamSet **paramSet)
296 {
297     if (paramSet == NULL) {
298         HKS_LOG_E("invalid free paramset!");
299         return;
300     }
301     HKS_FREE(*paramSet);
302 }
303 
HksFreeKeyAliasSet(struct HksKeyAliasSet *aliasSet)304 HKS_API_EXPORT void HksFreeKeyAliasSet(struct HksKeyAliasSet *aliasSet)
305 {
306     if (aliasSet == NULL) {
307         return;
308     }
309 
310     if (aliasSet->aliasesCnt > 0 && aliasSet->aliases != NULL) {
311         for (uint32_t i = 0; i < aliasSet->aliasesCnt; i++) {
312             HKS_FREE_BLOB(aliasSet->aliases[i]);
313         }
314     }
315     aliasSet->aliasesCnt = 0;
316 
317     HKS_FREE(aliasSet->aliases);
318     HKS_FREE(aliasSet);
319     aliasSet = NULL;
320 }
321 
FreshParamSet(struct HksParamSet *paramSet, bool isCopy)322 static int32_t FreshParamSet(struct HksParamSet *paramSet, bool isCopy)
323 {
324     uint32_t size = paramSet->paramSetSize;
325     uint32_t offset = sizeof(struct HksParamSet) + sizeof(struct HksParam) * paramSet->paramsCnt;
326 
327     for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
328         if (offset > size) {
329             HKS_LOG_E("invalid param set offset!");
330             return HKS_ERROR_INVALID_ARGUMENT;
331         }
332         if (GetTagType((enum HksTag)(paramSet->params[i].tag)) == HKS_TAG_TYPE_BYTES) {
333             if (IsAdditionOverflow(offset, paramSet->params[i].blob.size)) {
334                 HKS_LOG_E("blob size overflow!");
335                 return HKS_ERROR_INVALID_ARGUMENT;
336             }
337             if (isCopy && (memcpy_s((uint8_t *)paramSet + offset, size - offset,
338                 paramSet->params[i].blob.data, paramSet->params[i].blob.size) != EOK)) {
339                 HKS_LOG_E("copy param blob failed!");
340                 return HKS_ERROR_INSUFFICIENT_MEMORY;
341             }
342             paramSet->params[i].blob.data = (uint8_t *)paramSet + offset;
343             offset += paramSet->params[i].blob.size;
344         }
345     }
346 
347     if (paramSet->paramSetSize != offset) {
348         HKS_LOG_E("invalid param set size!");
349         return HKS_ERROR_INVALID_ARGUMENT;
350     }
351     return HKS_SUCCESS;
352 }
353 
354 
HksFreshParamSet(struct HksParamSet *paramSet, bool isCopy)355 HKS_API_EXPORT int32_t HksFreshParamSet(struct HksParamSet *paramSet, bool isCopy)
356 {
357     HKS_IF_NULL_LOGE_RETURN(paramSet, HKS_ERROR_NULL_POINTER, "invalid NULL paramSet")
358 
359     int32_t ret = HksCheckParamSet(paramSet, paramSet->paramSetSize);
360     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "invalid fresh paramSet")
361 
362     return FreshParamSet(paramSet, isCopy);
363 }
364 
HksGetParam(const struct HksParamSet *paramSet, uint32_t tag, struct HksParam **param)365 HKS_API_EXPORT int32_t HksGetParam(const struct HksParamSet *paramSet, uint32_t tag, struct HksParam **param)
366 {
367     if ((paramSet == NULL) || (param == NULL)) {
368         HKS_LOG_E("invalid params!");
369         return HKS_ERROR_INVALID_ARGUMENT;
370     }
371 
372     HKS_IF_NOT_SUCC_LOGE_RETURN(HksCheckParamSet(paramSet, paramSet->paramSetSize),
373         HKS_ERROR_INVALID_ARGUMENT, "invalid paramSet!")
374 
375     for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
376         if (tag == paramSet->params[i].tag) {
377             *param = (struct HksParam *)&paramSet->params[i];
378             if ((GetTagType((enum HksTag)tag) == HKS_TAG_TYPE_BYTES) &&
379                 (CheckBlob(&(*param)->blob) != HKS_SUCCESS)) {
380                 HKS_LOG_E("invalid paramSet!");
381                 return HKS_ERROR_INVALID_ARGUMENT;
382             }
383             return HKS_SUCCESS;
384         }
385     }
386 
387     return HKS_ERROR_PARAM_NOT_EXIST;
388 }
389 
HksGetParamSet(const struct HksParamSet *inParamSet, uint32_t inParamSetSize, struct HksParamSet **outParamSet)390 HKS_API_EXPORT int32_t HksGetParamSet(const struct HksParamSet *inParamSet,
391     uint32_t inParamSetSize, struct HksParamSet **outParamSet)
392 {
393     int32_t ret = HksCheckParamSet(inParamSet, inParamSetSize);
394     HKS_IF_NOT_SUCC_RETURN(ret, ret)
395 
396     HKS_IF_NULL_RETURN(outParamSet, HKS_ERROR_NULL_POINTER)
397 
398     uint32_t size = inParamSet->paramSetSize;
399     struct HksParamSet *buf = (struct HksParamSet *)HksMalloc(size);
400     HKS_IF_NULL_LOGE_RETURN(buf, HKS_ERROR_MALLOC_FAIL, "malloc from param set failed!")
401 
402     (void)memcpy_s(buf, size, inParamSet, size);
403 
404     ret = FreshParamSet(buf, false);
405     if (ret != HKS_SUCCESS) {
406         HKS_FREE(buf);
407         return ret;
408     }
409     *outParamSet = buf;
410     return HKS_SUCCESS;
411 }
412 
HksCheckParamMatch(const struct HksParam *baseParam, const struct HksParam *param)413 HKS_API_EXPORT int32_t HksCheckParamMatch(const struct HksParam *baseParam, const struct HksParam *param)
414 {
415     if (baseParam == NULL || param == NULL) {
416         return HKS_ERROR_NULL_POINTER;
417     }
418 
419     if (baseParam->tag != param->tag) {
420         HKS_LOG_E("unmatch param type!");
421         return HKS_ERROR_INVALID_ARGUMENT;
422     }
423 
424     switch (GetTagType((enum HksTag)(baseParam->tag))) {
425         case HKS_TAG_TYPE_INT:
426             return (baseParam->int32Param == param->int32Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
427         case HKS_TAG_TYPE_UINT:
428             return (baseParam->uint32Param == param->uint32Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
429         case HKS_TAG_TYPE_ULONG:
430             return (baseParam->uint64Param == param->uint64Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
431         case HKS_TAG_TYPE_BOOL:
432             return (baseParam->boolParam == param->boolParam) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
433         case HKS_TAG_TYPE_BYTES:
434             if (baseParam->blob.size != param->blob.size ||
435                 baseParam->blob.data == NULL ||(param->blob.data == NULL)) {
436                 HKS_LOG_E("unmatch byte type len!");
437                 return HKS_ERROR_INVALID_ARGUMENT;
438             }
439             if (HksMemCmp(baseParam->blob.data, param->blob.data, baseParam->blob.size)) {
440                 HKS_LOG_E("unmatch byte type content!");
441                 return HKS_ERROR_INVALID_ARGUMENT;
442             }
443             return HKS_SUCCESS;
444         default:
445             HKS_LOG_E("invalid tag type:%" LOG_PUBLIC "x", GetTagType((enum HksTag)(baseParam->tag)));
446             return HKS_ERROR_INVALID_ARGUMENT;
447     }
448 }
449 
HksCheckIsTagAlreadyExist(const struct HksParam *params, uint32_t paramsCnt, const struct HksParamSet *targetParamSet)450 HKS_API_EXPORT int32_t HksCheckIsTagAlreadyExist(const struct HksParam *params, uint32_t paramsCnt,
451     const struct HksParamSet *targetParamSet)
452 {
453     if (params == NULL || targetParamSet == NULL) {
454         return HKS_ERROR_NULL_POINTER;
455     }
456 
457     int32_t ret = HksCheckParamSet(targetParamSet, targetParamSet->paramSetSize);
458     HKS_IF_NOT_SUCC_RETURN(ret, ret)
459 
460     for (uint32_t i = 0; i < targetParamSet->paramsCnt; ++i) {
461         for (uint32_t j = 0; j < paramsCnt; ++j) {
462             if (params[j].tag == targetParamSet->params[i].tag) {
463                 return HKS_ERROR_INVALID_ARGUMENT;
464             }
465         }
466     }
467 
468     return HKS_SUCCESS;
469 }
470 
HksDeleteTagsFromParamSet(const uint32_t *tag, uint32_t tagCount, const struct HksParamSet *paramSet, struct HksParamSet **outParamSet)471 HKS_API_EXPORT int32_t HksDeleteTagsFromParamSet(const uint32_t *tag, uint32_t tagCount,
472     const struct HksParamSet *paramSet, struct HksParamSet **outParamSet)
473 {
474     if (tag == NULL || paramSet == NULL || outParamSet == NULL) {
475         return HKS_ERROR_NULL_POINTER;
476     }
477     int32_t ret = HksFreshParamSet((struct HksParamSet *)paramSet, false);
478     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "fresh paramset failed")
479 
480     struct HksParamSet *newParamSet = NULL;
481     ret = HksInitParamSet(&newParamSet);
482     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "init param set failed")
483 
484     for (uint32_t i = 0; i < paramSet->paramsCnt; ++i) {
485         bool isDeleteTag = false;
486         for (uint32_t j = 0; j < tagCount; ++j) {
487             if (paramSet->params[i].tag == tag[j]) {
488                 isDeleteTag = true;
489                 break;
490             }
491         }
492         if (!isDeleteTag) {
493             ret = HksAddParams(newParamSet, &paramSet->params[i], 1);
494             if (ret != HKS_SUCCESS) {
495                 HKS_LOG_E("add in params failed");
496                 HksFreeParamSet(&newParamSet);
497                 return ret;
498             }
499         }
500     }
501 
502     ret = HksBuildParamSet(&newParamSet);
503     if (ret != HKS_SUCCESS) {
504         HKS_LOG_E("build paramset failed");
505         HksFreeParamSet(&newParamSet);
506         return ret;
507     }
508 
509     *outParamSet = newParamSet;
510     return HKS_SUCCESS;
511 }
512