1 /*
2  * Copyright (c) 2021-2023 Huawei Device Co., Ltd.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at
6  *
7  *    http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include "hks_param.h"
17 
18 #include <stddef.h>
19 
20 #include "hks_log.h"
21 #include "hks_mem.h"
22 #include "hks_template.h"
23 #include "hks_type_inner.h"
24 
25 #include "securec.h"
26 
27 static uint32_t g_validTags[] = {
28     HKS_TAG_ALGORITHM,
29     HKS_TAG_PURPOSE,
30     HKS_TAG_KEY_SIZE,
31     HKS_TAG_DIGEST,
32     HKS_TAG_PADDING,
33     HKS_TAG_BLOCK_MODE,
34     HKS_TAG_KEY_TYPE,
35     HKS_TAG_ASSOCIATED_DATA,
36     HKS_TAG_NONCE,
37     HKS_TAG_IV,
38 
39     HKS_TAG_SALT,
40     HKS_TAG_PWD,
41     HKS_TAG_INFO,
42     HKS_TAG_ITERATION,
43 
44     HKS_TAG_KEY_GENERATE_TYPE,
45     HKS_TAG_DERIVE_MAIN_KEY,
46     HKS_TAG_DERIVE_FACTOR,
47     HKS_TAG_DERIVE_ALG,
48     HKS_TAG_AGREE_ALG,
49     HKS_TAG_AGREE_PUBLIC_KEY_IS_KEY_ALIAS,
50     HKS_TAG_AGREE_PRIVATE_KEY_ALIAS,
51     HKS_TAG_AGREE_PUBLIC_KEY,
52     HKS_TAG_KEY_ALIAS,
53     HKS_TAG_DERIVE_KEY_SIZE,
54     HKS_TAG_IMPORT_KEY_TYPE,
55     HKS_TAG_UNWRAP_ALGORITHM_SUITE,
56     HKS_TAG_DERIVE_AGREE_KEY_STORAGE_FLAG,
57     HKS_TAG_RSA_PSS_SALT_LEN_TYPE,
58     HKS_TAG_MGF_DIGEST,
59 
60     HKS_TAG_ACTIVE_DATETIME,
61     HKS_TAG_ORIGINATION_EXPIRE_DATETIME,
62     HKS_TAG_USAGE_EXPIRE_DATETIME,
63     HKS_TAG_CREATION_DATETIME,
64 
65     HKS_TAG_ALL_USERS,
66     HKS_TAG_USER_ID,
67     HKS_TAG_FRONT_USER_ID,
68     HKS_TAG_NO_AUTH_REQUIRED,
69     HKS_TAG_USER_AUTH_TYPE,
70     HKS_TAG_AUTH_TIMEOUT,
71     HKS_TAG_AUTH_TOKEN,
72     HKS_TAG_AUTH_STORAGE_LEVEL,
73     HKS_TAG_SPECIFIC_USER_ID,
74 
75     HKS_TAG_OS_VERSION,
76     HKS_TAG_OS_PATCHLEVEL,
77 
78     HKS_TAG_ATTESTATION_CHALLENGE,
79     HKS_TAG_ATTESTATION_APPLICATION_ID,
80     HKS_TAG_ATTESTATION_APPLICATION_ID_TYPE,
81     HKS_TAG_ATTESTATION_ID_BRAND,
82     HKS_TAG_ATTESTATION_ID_DEVICE,
83     HKS_TAG_ATTESTATION_ID_PRODUCT,
84     HKS_TAG_ATTESTATION_ID_SERIAL,
85     HKS_TAG_ATTESTATION_ID_IMEI,
86     HKS_TAG_ATTESTATION_ID_MEID,
87     HKS_TAG_ATTESTATION_ID_MANUFACTURER,
88     HKS_TAG_ATTESTATION_ID_MODEL,
89     HKS_TAG_ATTESTATION_ID_ALIAS,
90     HKS_TAG_ATTESTATION_ID_SOCID,
91     HKS_TAG_ATTESTATION_ID_UDID,
92     HKS_TAG_ATTESTATION_ID_SEC_LEVEL_INFO,
93     HKS_TAG_ATTESTATION_ID_VERSION_INFO,
94     HKS_TAG_ATTESTATION_BASE64,
95     HKS_TAG_ATTESTATION_MODE,
96     HKS_TAG_ATTESTATION_CERT_TYPE,
97 
98     HKS_TAG_IS_KEY_ALIAS,
99     HKS_TAG_KEY_STORAGE_FLAG,
100     HKS_TAG_IS_ALLOWED_WRAP,
101     HKS_TAG_KEY_WRAP_TYPE,
102     HKS_TAG_WRAP_KEY_VERSION,
103     HKS_TAG_IS_ALLOWED_DATA_WRAP,
104     HKS_TAG_DATA_WRAP_TYPE,
105     HKS_TAG_KEY_AUTH_ID,
106     HKS_TAG_KEY_ROLE,
107     HKS_TAG_KEY_FLAG,
108     HKS_TAG_KEY_DOMAIN,
109 
110     HKS_TAG_KEY_AUTH_ACCESS_TYPE,
111     HKS_TAG_KEY_SECURE_SIGN_TYPE,
112     HKS_TAG_CHALLENGE_TYPE,
113     HKS_TAG_CHALLENGE_POS,
114     HKS_TAG_KEY_AUTH_PURPOSE,
115     HKS_TAG_BATCH_PURPOSE,
116     HKS_TAG_IS_BATCH_OPERATION,
117     HKS_TAG_BATCH_OPERATION_TIMEOUT,
118     HKS_TAG_USER_AUTH_MODE,
119 
120     HKS_TAG_KEY_INIT_CHALLENGE,
121     HKS_TAG_IS_USER_AUTH_ACCESS,
122     HKS_TAG_USER_AUTH_CHALLENGE,
123     HKS_TAG_USER_AUTH_ENROLL_ID_INFO,
124     HKS_TAG_USER_AUTH_SECURE_UID,
125     HKS_TAG_KEY_AUTH_RESULT,
126     HKS_TAG_IF_NEED_APPEND_AUTH_INFO,
127     HKS_TAG_VERIFIED_AUTH_TOKEN,
128     HKS_TAG_IS_APPEND_UPDATE_DATA,
129     HKS_TAG_IS_COPY_NEW_KEY,
130 
131     HKS_TAG_PROCESS_NAME,
132     HKS_TAG_PACKAGE_NAME,
133     HKS_TAG_PAYLOAD_LEN,
134     HKS_TAG_AE_TAG,
135     HKS_TAG_CRYPTO_CTX,
136     HKS_TAG_KEY,
137     HKS_TAG_KEY_VERSION,
138     HKS_TAG_IS_KEY_HANDLE,
139     HKS_TAG_SYMMETRIC_KEY_DATA,
140     HKS_TAG_ASYMMETRIC_PUBLIC_KEY_DATA,
141     HKS_TAG_ASYMMETRIC_PRIVATE_KEY_DATA,
142     HKS_TAG_KEY_ACCESS_TIME,
143 
144     HKS_TAG_ACCESS_TOKEN_ID,
145     HKS_TAG_BUNDLE_NAME,
146     HKS_TAG_IS_DEVICE_PASSWORD_SET,
147     HKS_TAG_ACCOUNT_ID,
148     HKS_TAG_OWNER_ID,
149     HKS_TAG_OWNER_TYPE,
150     HKS_TAG_AGREE_PUBKEY_TYPE,
151     HKS_TAG_IS_CHANGE_STORAGE_LEVEL,
152 };
153 
GetTagType(enum HksTag tag)154 HKS_API_EXPORT enum HksTagType GetTagType(enum HksTag tag)
155 {
156     return (enum HksTagType)((uint32_t)tag & (uint32_t)HKS_TAG_TYPE_MASK);
157 }
158 
IsValidTag(uint32_t tag)159 static bool IsValidTag(uint32_t tag)
160 {
161     uint32_t tagSize = HKS_ARRAY_SIZE(g_validTags);
162     for (uint32_t i = 0; i < tagSize; ++i) {
163         if (tag == g_validTags[i]) {
164             return true;
165         }
166     }
167     return false;
168 }
169 
HksCheckParamSetTag(const struct HksParamSet * paramSet)170 HKS_API_EXPORT int32_t HksCheckParamSetTag(const struct HksParamSet *paramSet)
171 {
172     HKS_IF_NULL_RETURN(paramSet, HKS_ERROR_NULL_POINTER)
173 
174     for (uint32_t i = 0; i < paramSet->paramsCnt; ++i) {
175         uint32_t curTag = paramSet->params[i].tag;
176         if (!IsValidTag(curTag)) {
177             HKS_LOG_E("paramSet contains invalid tag! 0x%" LOG_PUBLIC "x", curTag);
178             return HKS_ERROR_INVALID_ARGUMENT;
179         }
180 
181         for (uint32_t j = i + 1; j < paramSet->paramsCnt; ++j) {
182             if (curTag == paramSet->params[j].tag) {
183                 HKS_LOG_E("paramSet contains multi-tags! 0x%" LOG_PUBLIC "x", curTag);
184                 return HKS_ERROR_INVALID_ARGUMENT;
185             }
186         }
187     }
188 
189     return HKS_SUCCESS;
190 }
191 
CheckBeforeAddParams(const struct HksParamSet * paramSet,const struct HksParam * params,uint32_t paramCnt)192 static int32_t CheckBeforeAddParams(const struct HksParamSet *paramSet, const struct HksParam *params,
193     uint32_t paramCnt)
194 {
195     if ((params == NULL) || (paramSet == NULL) || (paramSet->paramSetSize > HKS_PARAM_SET_MAX_SIZE) ||
196         (paramCnt > HKS_DEFAULT_PARAM_CNT) || (paramSet->paramsCnt > (HKS_DEFAULT_PARAM_CNT - paramCnt))) {
197         HKS_LOG_E("invalid params or paramset!");
198         return HKS_ERROR_INVALID_ARGUMENT;
199     }
200 
201     for (uint32_t i = 0; i < paramCnt; i++) {
202         if ((GetTagType((enum HksTag)(params[i].tag)) == HKS_TAG_TYPE_BYTES) &&
203             (params[i].blob.data == NULL)) {
204             HKS_LOG_E("invalid blob param!");
205             return HKS_ERROR_INVALID_ARGUMENT;
206         }
207     }
208     return HKS_SUCCESS;
209 }
210 
BuildParamSet(struct HksParamSet ** paramSet)211 static int32_t BuildParamSet(struct HksParamSet **paramSet)
212 {
213     struct HksParamSet *freshParamSet = *paramSet;
214     uint32_t size = freshParamSet->paramSetSize;
215     uint32_t offset = sizeof(struct HksParamSet) + sizeof(struct HksParam) * freshParamSet->paramsCnt;
216 
217     if (size > HKS_DEFAULT_PARAM_SET_SIZE) {
218         freshParamSet = (struct HksParamSet *)HksMalloc(size);
219         HKS_IF_NULL_LOGE_RETURN(freshParamSet, HKS_ERROR_MALLOC_FAIL, "malloc params failed!")
220 
221         if (memcpy_s(freshParamSet, size, *paramSet, offset) != EOK) {
222             HKS_FREE(freshParamSet);
223             HKS_LOG_E("copy params failed!");
224             return HKS_ERROR_INSUFFICIENT_MEMORY;
225         }
226         HKS_FREE(*paramSet);
227         *paramSet = freshParamSet;
228     }
229 
230     return HksFreshParamSet(freshParamSet, true);
231 }
232 
HksCheckParamSet(const struct HksParamSet * paramSet,uint32_t size)233 HKS_API_EXPORT int32_t HksCheckParamSet(const struct HksParamSet *paramSet, uint32_t size)
234 {
235     HKS_IF_NULL_RETURN(paramSet, HKS_ERROR_NULL_POINTER)
236 
237     if ((size < sizeof(struct HksParamSet)) || (size > HKS_PARAM_SET_MAX_SIZE) ||
238         (paramSet->paramSetSize != size) ||
239         (paramSet->paramsCnt > ((size - sizeof(struct HksParamSet)) / sizeof(struct HksParam)))) {
240         HKS_LOG_E("invalid param set!");
241         return HKS_ERROR_INVALID_ARGUMENT;
242     }
243     return HKS_SUCCESS;
244 }
245 
HksInitParamSet(struct HksParamSet ** paramSet)246 HKS_API_EXPORT int32_t HksInitParamSet(struct HksParamSet **paramSet)
247 {
248     HKS_IF_NULL_LOGE_RETURN(paramSet, HKS_ERROR_NULL_POINTER, "invalid init params!")
249 
250     *paramSet = (struct HksParamSet *)HksMalloc(HKS_DEFAULT_PARAM_SET_SIZE);
251     HKS_IF_NULL_LOGE_RETURN(*paramSet, HKS_ERROR_MALLOC_FAIL, "malloc init param set failed!")
252 
253     (*paramSet)->paramsCnt = 0;
254     (*paramSet)->paramSetSize = sizeof(struct HksParamSet);
255     return HKS_SUCCESS;
256 }
257 
HksAddParams(struct HksParamSet * paramSet,const struct HksParam * params,uint32_t paramCnt)258 HKS_API_EXPORT int32_t HksAddParams(struct HksParamSet *paramSet,
259     const struct HksParam *params, uint32_t paramCnt)
260 {
261     int32_t ret = CheckBeforeAddParams(paramSet, params, paramCnt);
262     HKS_IF_NOT_SUCC_RETURN(ret, ret)
263 
264     for (uint32_t i = 0; i < paramCnt; i++) {
265         paramSet->paramSetSize += sizeof(struct HksParam);
266         if (GetTagType((enum HksTag)(params[i].tag)) == HKS_TAG_TYPE_BYTES) {
267             if (IsAdditionOverflow(paramSet->paramSetSize, params[i].blob.size)) {
268                 HKS_LOG_E("params size overflow!");
269                 paramSet->paramSetSize -= sizeof(struct HksParam);
270                 return HKS_ERROR_INVALID_ARGUMENT;
271             }
272             paramSet->paramSetSize += params[i].blob.size;
273         }
274         (void)memcpy_s(&paramSet->params[paramSet->paramsCnt++], sizeof(struct HksParam), &params[i],
275             sizeof(struct HksParam));
276     }
277     return HKS_SUCCESS;
278 }
279 
HksBuildParamSet(struct HksParamSet ** paramSet)280 HKS_API_EXPORT int32_t HksBuildParamSet(struct HksParamSet **paramSet)
281 {
282     if ((paramSet == NULL) || (*paramSet == NULL)) {
283         return HKS_ERROR_NULL_POINTER;
284     }
285 
286     int ret = HksCheckParamSet(*paramSet, (*paramSet)->paramSetSize);
287     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "invalid build params!")
288 
289     return BuildParamSet(paramSet);
290 }
291 
HksFreeParamSet(struct HksParamSet ** paramSet)292 HKS_API_EXPORT void HksFreeParamSet(struct HksParamSet **paramSet)
293 {
294     if (paramSet == NULL) {
295         HKS_LOG_E("invalid free paramset!");
296         return;
297     }
298     HKS_FREE(*paramSet);
299 }
300 
HksFreeKeyAliasSet(struct HksKeyAliasSet * aliasSet)301 HKS_API_EXPORT void HksFreeKeyAliasSet(struct HksKeyAliasSet *aliasSet)
302 {
303     if (aliasSet == NULL) {
304         return;
305     }
306 
307     if (aliasSet->aliasesCnt > 0 && aliasSet->aliases != NULL) {
308         for (uint32_t i = 0; i < aliasSet->aliasesCnt; i++) {
309             HKS_FREE_BLOB(aliasSet->aliases[i]);
310         }
311     }
312     aliasSet->aliasesCnt = 0;
313 
314     HKS_FREE(aliasSet->aliases);
315     HKS_FREE(aliasSet);
316     aliasSet = NULL;
317 }
318 
FreshParamSet(struct HksParamSet * paramSet,bool isCopy)319 static int32_t FreshParamSet(struct HksParamSet *paramSet, bool isCopy)
320 {
321     uint32_t size = paramSet->paramSetSize;
322     uint32_t offset = sizeof(struct HksParamSet) + sizeof(struct HksParam) * paramSet->paramsCnt;
323 
324     for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
325         if (offset > size) {
326             HKS_LOG_E("invalid param set offset!");
327             return HKS_ERROR_INVALID_ARGUMENT;
328         }
329         if (GetTagType((enum HksTag)(paramSet->params[i].tag)) == HKS_TAG_TYPE_BYTES) {
330             if (IsAdditionOverflow(offset, paramSet->params[i].blob.size)) {
331                 HKS_LOG_E("blob size overflow!");
332                 return HKS_ERROR_INVALID_ARGUMENT;
333             }
334             if (isCopy && (memcpy_s((uint8_t *)paramSet + offset, size - offset,
335                 paramSet->params[i].blob.data, paramSet->params[i].blob.size) != EOK)) {
336                 HKS_LOG_E("copy param blob failed!");
337                 return HKS_ERROR_INSUFFICIENT_MEMORY;
338             }
339             paramSet->params[i].blob.data = (uint8_t *)paramSet + offset;
340             offset += paramSet->params[i].blob.size;
341         }
342     }
343 
344     if (paramSet->paramSetSize != offset) {
345         HKS_LOG_E("invalid param set size!");
346         return HKS_ERROR_INVALID_ARGUMENT;
347     }
348     return HKS_SUCCESS;
349 }
350 
351 
HksFreshParamSet(struct HksParamSet * paramSet,bool isCopy)352 HKS_API_EXPORT int32_t HksFreshParamSet(struct HksParamSet *paramSet, bool isCopy)
353 {
354     HKS_IF_NULL_LOGE_RETURN(paramSet, HKS_ERROR_NULL_POINTER, "invalid NULL paramSet")
355 
356     int32_t ret = HksCheckParamSet(paramSet, paramSet->paramSetSize);
357     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "invalid fresh paramSet")
358 
359     return FreshParamSet(paramSet, isCopy);
360 }
361 
HksGetParam(const struct HksParamSet * paramSet,uint32_t tag,struct HksParam ** param)362 HKS_API_EXPORT int32_t HksGetParam(const struct HksParamSet *paramSet, uint32_t tag, struct HksParam **param)
363 {
364     if ((paramSet == NULL) || (param == NULL)) {
365         HKS_LOG_E("invalid params!");
366         return HKS_ERROR_INVALID_ARGUMENT;
367     }
368 
369     HKS_IF_NOT_SUCC_LOGE_RETURN(HksCheckParamSet(paramSet, paramSet->paramSetSize),
370         HKS_ERROR_INVALID_ARGUMENT, "invalid paramSet!")
371 
372     for (uint32_t i = 0; i < paramSet->paramsCnt; i++) {
373         if (tag == paramSet->params[i].tag) {
374             *param = (struct HksParam *)&paramSet->params[i];
375             if ((GetTagType((enum HksTag)tag) == HKS_TAG_TYPE_BYTES) &&
376                 (CheckBlob(&(*param)->blob) != HKS_SUCCESS)) {
377                 HKS_LOG_E("invalid paramSet!");
378                 return HKS_ERROR_INVALID_ARGUMENT;
379             }
380             return HKS_SUCCESS;
381         }
382     }
383 
384     return HKS_ERROR_PARAM_NOT_EXIST;
385 }
386 
HksGetParamSet(const struct HksParamSet * inParamSet,uint32_t inParamSetSize,struct HksParamSet ** outParamSet)387 HKS_API_EXPORT int32_t HksGetParamSet(const struct HksParamSet *inParamSet,
388     uint32_t inParamSetSize, struct HksParamSet **outParamSet)
389 {
390     int32_t ret = HksCheckParamSet(inParamSet, inParamSetSize);
391     HKS_IF_NOT_SUCC_RETURN(ret, ret)
392 
393     HKS_IF_NULL_RETURN(outParamSet, HKS_ERROR_NULL_POINTER)
394 
395     uint32_t size = inParamSet->paramSetSize;
396     struct HksParamSet *buf = (struct HksParamSet *)HksMalloc(size);
397     HKS_IF_NULL_LOGE_RETURN(buf, HKS_ERROR_MALLOC_FAIL, "malloc from param set failed!")
398 
399     (void)memcpy_s(buf, size, inParamSet, size);
400 
401     ret = FreshParamSet(buf, false);
402     if (ret != HKS_SUCCESS) {
403         HKS_FREE(buf);
404         return ret;
405     }
406     *outParamSet = buf;
407     return HKS_SUCCESS;
408 }
409 
HksCheckParamMatch(const struct HksParam * baseParam,const struct HksParam * param)410 HKS_API_EXPORT int32_t HksCheckParamMatch(const struct HksParam *baseParam, const struct HksParam *param)
411 {
412     if (baseParam == NULL || param == NULL) {
413         return HKS_ERROR_NULL_POINTER;
414     }
415 
416     if (baseParam->tag != param->tag) {
417         HKS_LOG_E("unmatch param type!");
418         return HKS_ERROR_INVALID_ARGUMENT;
419     }
420 
421     switch (GetTagType((enum HksTag)(baseParam->tag))) {
422         case HKS_TAG_TYPE_INT:
423             return (baseParam->int32Param == param->int32Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
424         case HKS_TAG_TYPE_UINT:
425             return (baseParam->uint32Param == param->uint32Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
426         case HKS_TAG_TYPE_ULONG:
427             return (baseParam->uint64Param == param->uint64Param) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
428         case HKS_TAG_TYPE_BOOL:
429             return (baseParam->boolParam == param->boolParam) ? HKS_SUCCESS : HKS_ERROR_INVALID_ARGUMENT;
430         case HKS_TAG_TYPE_BYTES:
431             if (baseParam->blob.size != param->blob.size ||
432                 baseParam->blob.data == NULL ||(param->blob.data == NULL)) {
433                 HKS_LOG_E("unmatch byte type len!");
434                 return HKS_ERROR_INVALID_ARGUMENT;
435             }
436             if (HksMemCmp(baseParam->blob.data, param->blob.data, baseParam->blob.size)) {
437                 HKS_LOG_E("unmatch byte type content!");
438                 return HKS_ERROR_INVALID_ARGUMENT;
439             }
440             return HKS_SUCCESS;
441         default:
442             HKS_LOG_E("invalid tag type:%" LOG_PUBLIC "x", GetTagType((enum HksTag)(baseParam->tag)));
443             return HKS_ERROR_INVALID_ARGUMENT;
444     }
445 }
446 
HksCheckIsTagAlreadyExist(const struct HksParam * params,uint32_t paramsCnt,const struct HksParamSet * targetParamSet)447 HKS_API_EXPORT int32_t HksCheckIsTagAlreadyExist(const struct HksParam *params, uint32_t paramsCnt,
448     const struct HksParamSet *targetParamSet)
449 {
450     if (params == NULL || targetParamSet == NULL) {
451         return HKS_ERROR_NULL_POINTER;
452     }
453 
454     int32_t ret = HksCheckParamSet(targetParamSet, targetParamSet->paramSetSize);
455     HKS_IF_NOT_SUCC_RETURN(ret, ret)
456 
457     for (uint32_t i = 0; i < targetParamSet->paramsCnt; ++i) {
458         for (uint32_t j = 0; j < paramsCnt; ++j) {
459             if (params[j].tag == targetParamSet->params[i].tag) {
460                 return HKS_ERROR_INVALID_ARGUMENT;
461             }
462         }
463     }
464 
465     return HKS_SUCCESS;
466 }
467 
HksDeleteTagsFromParamSet(const uint32_t * tag,uint32_t tagCount,const struct HksParamSet * paramSet,struct HksParamSet ** outParamSet)468 HKS_API_EXPORT int32_t HksDeleteTagsFromParamSet(const uint32_t *tag, uint32_t tagCount,
469     const struct HksParamSet *paramSet, struct HksParamSet **outParamSet)
470 {
471     if (tag == NULL || paramSet == NULL || outParamSet == NULL) {
472         return HKS_ERROR_NULL_POINTER;
473     }
474     int32_t ret = HksFreshParamSet((struct HksParamSet *)paramSet, false);
475     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "fresh paramset failed")
476 
477     struct HksParamSet *newParamSet = NULL;
478     ret = HksInitParamSet(&newParamSet);
479     HKS_IF_NOT_SUCC_LOGE_RETURN(ret, ret, "init param set failed")
480 
481     for (uint32_t i = 0; i < paramSet->paramsCnt; ++i) {
482         bool isDeleteTag = false;
483         for (uint32_t j = 0; j < tagCount; ++j) {
484             if (paramSet->params[i].tag == tag[j]) {
485                 isDeleteTag = true;
486                 break;
487             }
488         }
489         if (!isDeleteTag) {
490             ret = HksAddParams(newParamSet, &paramSet->params[i], 1);
491             if (ret != HKS_SUCCESS) {
492                 HKS_LOG_E("add in params failed");
493                 HksFreeParamSet(&newParamSet);
494                 return ret;
495             }
496         }
497     }
498 
499     ret = HksBuildParamSet(&newParamSet);
500     if (ret != HKS_SUCCESS) {
501         HKS_LOG_E("build paramset failed");
502         HksFreeParamSet(&newParamSet);
503         return ret;
504     }
505 
506     *outParamSet = newParamSet;
507     return HKS_SUCCESS;
508 }
509