mfg.c

Go to the documentation of this file.

/*
 * Microsemi Switchtec(tm) PCIe Management Library
 * Copyright (c) 2019, Microsemi Corporation
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included
 * in all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
 * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 *
 */

#include "switchtec_priv.h"
#include "switchtec/switchtec.h"
#include "switchtec/mfg.h"
#include "switchtec/errors.h"
#include "switchtec/endian.h"
#include "switchtec/mrpc.h"
#include "switchtec/errors.h"
#include <unistd.h>

#include <errno.h>
#include <stdio.h>
#include <string.h>

#include "lib/crc.h"
#include "config.h"

#if HAVE_LIBCRYPTO
#include <openssl/pem.h>
#endif

#define SWITCHTEC_ACTV_IMG_ID_KMAN      1
#define SWITCHTEC_ACTV_IMG_ID_BL2       2
#define SWITCHTEC_ACTV_IMG_ID_CFG       3
#define SWITCHTEC_ACTV_IMG_ID_FW        4

#define SWITCHTEC_MB_MAX_ENTRIES        8
#define SWITCHTEC_ACTV_IDX_MAX_ENTRIES      32
#define SWITCHTEC_ACTV_IDX_SET_ENTRIES      4

#define SWITCHTEC_CLK_RATE_BITSHIFT     10
#define SWITCHTEC_CLK_RATE_BITMASK      0x0f
#define SWITCHTEC_RC_TMO_BITSHIFT       14
#define SWITCHTEC_RC_TMO_BITMASK        0x0f
#define SWITCHTEC_I2C_PORT_BITSHIFT     18
#define SWITCHTEC_I2C_PORT_BITMASK      0x0f
#define SWITCHTEC_I2C_ADDR_BITSHIFT     22
#define SWITCHTEC_I2C_ADDR_BITMASK      0x7f
#define SWITCHTEC_CMD_MAP_BITSHIFT      29
#define SWITCHTEC_CMD_MAP_BITMASK       0xfff

#define SWITCHTEC_JTAG_LOCK_AFT_RST_BITMASK 0x40
#define SWITCHTEC_JTAG_LOCK_AFT_BL1_BITMASK 0x80
#define SWITCHTEC_JTAG_UNLOCK_BL1_BITMASK   0x0100
#define SWITCHTEC_JTAG_UNLOCK_AFT_BL1_BITMASK   0x0200

#if (HAVE_LIBCRYPTO && !HAVE_DECL_RSA_GET0_KEY)

static void RSA_get0_key(const RSA *r, const BIGNUM **n,
             const BIGNUM **e, const BIGNUM **d)
{
    if (n != NULL)
        *n = r->n;
    if (e != NULL)
        *e = r->e;
    if (d != NULL)
        *d = r->d;
}
#endif

static int switchtec_mfg_cmd(struct switchtec_dev *dev, uint32_t cmd,
                 const void *payload, size_t payload_len,
                 void *resp, size_t resp_len)
{
    if (dev->ops->flags & SWITCHTEC_OPS_FLAG_NO_MFG) {
        errno = ERR_UART_NOT_SUPPORTED | SWITCHTEC_ERRNO_MRPC_FLAG_BIT;
        return -1;
    }

    return switchtec_cmd(dev, cmd, payload, payload_len,
                 resp, resp_len);
}

int switchtec_sn_ver_get(struct switchtec_dev *dev,
             struct switchtec_sn_ver_info *info)
{
    int ret;

    ret = switchtec_mfg_cmd(dev, MRPC_SN_VER_GET, NULL, 0, info,
                sizeof(struct switchtec_sn_ver_info));
    if (ret)
        return ret;

    info->chip_serial = le32toh(info->chip_serial);
    info->ver_bl2 = le32toh(info->ver_bl2);
    info->ver_km = le32toh(info->ver_km);
    info->ver_main = le32toh(info->ver_main);
    info->ver_sec_unlock = le32toh(info->ver_sec_unlock);

    return 0;
}

int switchtec_security_config_get(struct switchtec_dev *dev,
                  struct switchtec_security_cfg_state *state)
{
    int ret;
    struct cfg_reply {
        uint32_t valid;
        uint32_t rsvd1;
        uint64_t cfg;
        uint32_t  public_key_exponent;
        uint8_t  rsvd2;
        uint8_t  public_key_num;
        uint8_t  public_key_ver;
        uint8_t  rsvd3;
        uint8_t  public_key[SWITCHTEC_KMSK_NUM][SWITCHTEC_KMSK_LEN];
        uint8_t  rsvd4[32];
    } reply;

    ret = switchtec_mfg_cmd(dev, MRPC_SECURITY_CONFIG_GET, NULL, 0,
                &reply, sizeof(reply));
    if (ret)
        return ret;

    reply.valid = le32toh(reply.valid);
    reply.cfg = le64toh(reply.cfg);
    reply.public_key_exponent = le32toh(reply.public_key_exponent);

    state->basic_setting_valid = !!(reply.valid & 0x01);
    state->public_key_exp_valid = !!(reply.valid & 0x02);
    state->public_key_num_valid = !!(reply.valid & 0x04);
    state->public_key_ver_valid = !!(reply.valid & 0x08);
    state->public_key_valid = !!(reply.valid & 0x10);

    state->debug_mode = reply.cfg & 0x03;
    state->secure_state = (reply.cfg>>2) & 0x03;

    state->jtag_lock_after_reset = !!(reply.cfg & 0x40);
    state->jtag_lock_after_bl1 = !!(reply.cfg & 0x80);
    state->jtag_bl1_unlock_allowed = !!(reply.cfg & 0x0100);
    state->jtag_post_bl1_unlock_allowed = !!(reply.cfg & 0x0200);

    state->spi_clk_rate =
        (reply.cfg >> SWITCHTEC_CLK_RATE_BITSHIFT) & 0x0f;
    if (state->spi_clk_rate == 0)
        state->spi_clk_rate = SWITCHTEC_SPI_RATE_25M;

    state->i2c_recovery_tmo =
        (reply.cfg >> SWITCHTEC_RC_TMO_BITSHIFT) & 0x0f;
    state->i2c_port = (reply.cfg >> SWITCHTEC_I2C_PORT_BITSHIFT) & 0xf;
    state->i2c_addr = (reply.cfg >> SWITCHTEC_I2C_ADDR_BITSHIFT) & 0x7f;
    state->i2c_cmd_map =
        (reply.cfg >> SWITCHTEC_CMD_MAP_BITSHIFT) & 0xfff;

    state->public_key_exponent = reply.public_key_exponent;
    state->public_key_num = reply.public_key_num;
    state->public_key_ver = reply.public_key_ver;
    memcpy(state->public_key, reply.public_key,
           SWITCHTEC_KMSK_NUM * SWITCHTEC_KMSK_LEN);

    return 0;
}

int switchtec_mailbox_to_file(struct switchtec_dev *dev, int fd)
{
    int ret;
    int num_to_read = htole32(SWITCHTEC_MB_MAX_ENTRIES);
    struct mb_reply {
        uint8_t num_returned;
        uint8_t num_remaining;
        uint8_t rsvd[2];
        uint8_t data[SWITCHTEC_MB_MAX_ENTRIES *
                 SWITCHTEC_MB_LOG_LEN];
    } reply;

    do {
        ret = switchtec_mfg_cmd(dev, MRPC_MAILBOX_GET, &num_to_read,
                    sizeof(int), &reply,  sizeof(reply));
        if (ret)
            return ret;

        reply.num_remaining = le32toh(reply.num_remaining);
        reply.num_returned = le32toh(reply.num_returned);

        ret = write(fd, reply.data,
                (reply.num_returned) * SWITCHTEC_MB_LOG_LEN);
        if (ret < 0)
            return ret;
    } while (reply.num_remaining > 0);

    return 0;
}

int switchtec_security_config_set(struct switchtec_dev *dev,
                  struct switchtec_security_cfg_set *setting)
{
    int ret;
    struct setting_data {
        uint64_t cfg;
        uint32_t pub_key_exponent;
        uint8_t rsvd[4];
    } sd;
    uint64_t ldata = 0;

    memset(&sd, 0, sizeof(sd));

    sd.cfg |= setting->jtag_lock_after_reset?
            SWITCHTEC_JTAG_LOCK_AFT_RST_BITMASK : 0;
    sd.cfg |= setting->jtag_lock_after_bl1?
            SWITCHTEC_JTAG_LOCK_AFT_BL1_BITMASK : 0;
    sd.cfg |= setting->jtag_bl1_unlock_allowed?
            SWITCHTEC_JTAG_UNLOCK_BL1_BITMASK : 0;
    sd.cfg |= setting->jtag_post_bl1_unlock_allowed?
            SWITCHTEC_JTAG_UNLOCK_AFT_BL1_BITMASK : 0;

    sd.cfg |= (setting->spi_clk_rate & SWITCHTEC_CLK_RATE_BITMASK) <<
            SWITCHTEC_CLK_RATE_BITSHIFT;

    sd.cfg |= (setting->i2c_recovery_tmo & SWITCHTEC_RC_TMO_BITMASK) <<
            SWITCHTEC_RC_TMO_BITSHIFT;
    sd.cfg |= (setting->i2c_port & SWITCHTEC_I2C_PORT_BITMASK) <<
            SWITCHTEC_I2C_PORT_BITSHIFT;
    sd.cfg |= (setting->i2c_addr & SWITCHTEC_I2C_ADDR_BITMASK) <<
            SWITCHTEC_I2C_ADDR_BITSHIFT;

    ldata = setting->i2c_cmd_map & SWITCHTEC_CMD_MAP_BITMASK;
    ldata <<= SWITCHTEC_CMD_MAP_BITSHIFT;
    sd.cfg |= ldata;

    sd.cfg = htole64(sd.cfg);

    sd.pub_key_exponent = htole32(setting->public_key_exponent);

    ret = switchtec_mfg_cmd(dev, MRPC_SECURITY_CONFIG_SET, &sd, sizeof(sd),
                NULL, 0);
    return ret;
}

int switchtec_active_image_index_get(struct switchtec_dev *dev,
                     struct switchtec_active_index *index)
{
    int ret;
    struct active_indices {
        uint8_t index[SWITCHTEC_ACTV_IDX_MAX_ENTRIES];
    } reply;

    ret = switchtec_mfg_cmd(dev, MRPC_ACT_IMG_IDX_GET, NULL,
                0, &reply, sizeof(reply));
    if (ret)
        return ret;

    index->keyman = reply.index[SWITCHTEC_ACTV_IMG_ID_KMAN];
    index->bl2 = reply.index[SWITCHTEC_ACTV_IMG_ID_BL2];
    index->config = reply.index[SWITCHTEC_ACTV_IMG_ID_CFG];
    index->firmware = reply.index[SWITCHTEC_ACTV_IMG_ID_FW];

    return 0;
}

int switchtec_active_image_index_set(struct switchtec_dev *dev,
                     struct switchtec_active_index *index)
{
    int ret;
    int i = 0;
    struct active_idx {
        uint32_t count;
        struct entry {
            uint8_t image_id;
            uint8_t index;
        } idx[SWITCHTEC_ACTV_IDX_SET_ENTRIES];
    } set;

    memset(&set, 0, sizeof(set));

    if (index->keyman != SWITCHTEC_ACTIVE_INDEX_NOT_SET) {
        set.idx[i].image_id = SWITCHTEC_ACTV_IMG_ID_KMAN;
        set.idx[i].index = index->keyman;
        i++;
    }

    if (index->bl2 != SWITCHTEC_ACTIVE_INDEX_NOT_SET) {
        set.idx[i].image_id = SWITCHTEC_ACTV_IMG_ID_BL2;
        set.idx[i].index = index->bl2;
        i++;
    }

    if (index->config != SWITCHTEC_ACTIVE_INDEX_NOT_SET) {
        set.idx[i].image_id =  SWITCHTEC_ACTV_IMG_ID_CFG;
        set.idx[i].index = index->config;
        i++;
    }

    if (index->firmware != SWITCHTEC_ACTIVE_INDEX_NOT_SET) {
        set.idx[i].image_id = SWITCHTEC_ACTV_IMG_ID_FW;
        set.idx[i].index = index->firmware;
        i++;
    }

    if (i == 0)
        return 0;

    set.count = htole32(i);

    ret = switchtec_mfg_cmd(dev, MRPC_ACT_IMG_IDX_SET, &set,
                sizeof(set), NULL, 0);
    return ret;
}

int switchtec_fw_exec(struct switchtec_dev *dev,
              enum switchtec_bl2_recovery_mode recovery_mode)
{
    struct fw_exec_struct {
        uint8_t subcmd;
        uint8_t recovery_mode;
        uint8_t rsvd[2];
    } cmd;

    memset(&cmd, 0, sizeof(cmd));
    cmd.subcmd = MRPC_FW_TX_EXEC;
    cmd.recovery_mode = recovery_mode;

    return switchtec_mfg_cmd(dev, MRPC_FW_TX, &cmd, sizeof(cmd), NULL, 0);
}

int switchtec_boot_resume(struct switchtec_dev *dev)
{
    return switchtec_mfg_cmd(dev, MRPC_BOOTUP_RESUME, NULL, 0,
                 NULL, 0);
}

int switchtec_secure_state_set(struct switchtec_dev *dev,
                   enum switchtec_secure_state state)
{
    uint32_t data;

    if ((state != SWITCHTEC_INITIALIZED_UNSECURED)
       && (state != SWITCHTEC_INITIALIZED_SECURED)) {
        return ERR_PARAM_INVALID;
    }
    data = htole32(state);

    return switchtec_mfg_cmd(dev, MRPC_SECURE_STATE_SET, &data,
                 sizeof(data), NULL, 0);
}

static int dbg_unlock_send_pubkey(struct switchtec_dev *dev,
                  struct switchtec_pubkey *public_key)
{
    struct public_key_cmd {
        uint8_t subcmd;
        uint8_t rsvd[3];
        uint8_t pub_key[SWITCHTEC_PUB_KEY_LEN];
        uint32_t pub_key_exp;
    } cmd = {};

    cmd.subcmd = MRPC_DBG_UNLOCK_PKEY;
    memcpy(cmd.pub_key, public_key->pubkey, SWITCHTEC_PUB_KEY_LEN);
    cmd.pub_key_exp = htole32(public_key->pubkey_exp);

    return switchtec_mfg_cmd(dev, MRPC_DBG_UNLOCK, &cmd,
                 sizeof(cmd), NULL, 0);
}

int switchtec_dbg_unlock(struct switchtec_dev *dev, uint32_t serial,
             uint32_t ver_sec_unlock,
             struct switchtec_pubkey *public_key,
             struct switchtec_signature *signature)
{
    int ret;
    struct unlock_cmd {
        uint8_t subcmd;
        uint8_t rsvd[3];
        uint32_t serial;
        uint32_t unlock_ver;
        uint8_t signature[SWITCHTEC_SIG_LEN];
    } cmd = {};

    ret = dbg_unlock_send_pubkey(dev, public_key);
    if (ret)
        return ret;

    cmd.subcmd = MRPC_DBG_UNLOCK_DATA;
    cmd.serial = htole32(serial);
    cmd.unlock_ver = htole32(ver_sec_unlock);
    memcpy(cmd.signature, signature->signature, SWITCHTEC_SIG_LEN);

    return switchtec_mfg_cmd(dev, MRPC_DBG_UNLOCK, &cmd,
                 sizeof(cmd), NULL, 0);
}

int switchtec_dbg_unlock_version_update(struct switchtec_dev *dev,
                    uint32_t serial,
                    uint32_t ver_sec_unlock,
                    struct switchtec_pubkey *public_key,
                    struct switchtec_signature *signature)
{
    int ret;
    struct update_cmd {
        uint8_t subcmd;
        uint8_t rsvd[3];
        uint32_t serial;
        uint32_t unlock_ver;
        uint8_t signature[SWITCHTEC_SIG_LEN];
    } cmd = {};

    ret = dbg_unlock_send_pubkey(dev, public_key);
    if (ret)
        return ret;

    cmd.subcmd = MRPC_DBG_UNLOCK_UPDATE;
    cmd.serial = htole32(serial);
    cmd.unlock_ver = htole32(ver_sec_unlock);
    memcpy(cmd.signature, signature->signature, SWITCHTEC_SIG_LEN);

    return switchtec_mfg_cmd(dev, MRPC_DBG_UNLOCK, &cmd, sizeof(cmd),
                 NULL, 0);
}

int switchtec_read_sec_cfg_file(FILE *setting_file,
                    struct switchtec_security_cfg_set *set)
{
    ssize_t rlen;
    char magic[4] = {'S', 'S', 'F', 'F'};
    uint32_t crc;
    struct setting_file_header {
        uint8_t magic[4];
        uint32_t version;
        uint32_t rsvd;
        uint32_t crc;
    };
    struct setting_file_data {
        uint64_t cfg;
        uint32_t pub_key_exponent;
        uint8_t rsvd[36];
    };
    struct setting_file {
        struct setting_file_header header;
        struct setting_file_data data;
    } file_data;

    rlen = fread(&file_data, 1, sizeof(file_data), setting_file);

    if (rlen < sizeof(file_data))
        return -EBADF;

    if (memcmp(file_data.header.magic, magic, sizeof(magic)))
        return -EBADF;

    crc = crc32((uint8_t*)&file_data.data,
            sizeof(file_data.data), 0, 1, 1);
    if (crc != le32toh(file_data.header.crc))
        return -EBADF;

    memset(set, 0, sizeof(struct switchtec_security_cfg_set));

    file_data.data.cfg = le64toh(file_data.data.cfg);

    set->jtag_lock_after_reset =
        !!(file_data.data.cfg & SWITCHTEC_JTAG_LOCK_AFT_RST_BITMASK);
    set->jtag_lock_after_bl1 =
        !!(file_data.data.cfg & SWITCHTEC_JTAG_LOCK_AFT_BL1_BITMASK);
    set->jtag_bl1_unlock_allowed =
        !!(file_data.data.cfg & SWITCHTEC_JTAG_UNLOCK_BL1_BITMASK);
    set->jtag_post_bl1_unlock_allowed =
        !!(file_data.data.cfg & SWITCHTEC_JTAG_UNLOCK_AFT_BL1_BITMASK);

    set->spi_clk_rate =
        (file_data.data.cfg >> SWITCHTEC_CLK_RATE_BITSHIFT) &
        SWITCHTEC_CLK_RATE_BITMASK;
    set->i2c_recovery_tmo =
        (file_data.data.cfg >> SWITCHTEC_RC_TMO_BITSHIFT) &
        SWITCHTEC_RC_TMO_BITMASK;
    set->i2c_port =
        (file_data.data.cfg >> SWITCHTEC_I2C_PORT_BITSHIFT) &
        SWITCHTEC_I2C_PORT_BITMASK;
    set->i2c_addr =
        (file_data.data.cfg >> SWITCHTEC_I2C_ADDR_BITSHIFT) &
        SWITCHTEC_I2C_ADDR_BITMASK;
    set->i2c_cmd_map =
        (file_data.data.cfg >> SWITCHTEC_CMD_MAP_BITSHIFT) &
        SWITCHTEC_CMD_MAP_BITMASK;

    set->public_key_exponent = le32toh(file_data.data.pub_key_exponent);

    return 0;
}

static int kmsk_set_send_pubkey(struct switchtec_dev *dev,
                struct switchtec_pubkey *public_key)
{
    struct kmsk_pubk_cmd {
        uint8_t subcmd;
        uint8_t reserved[3];
        uint8_t pub_key[SWITCHTEC_PUB_KEY_LEN];
        uint32_t pub_key_exponent;
    } cmd = {};

    cmd.subcmd = MRPC_KMSK_ENTRY_SET_PKEY;
    memcpy(cmd.pub_key, public_key->pubkey,
           SWITCHTEC_PUB_KEY_LEN);
    cmd.pub_key_exponent = htole32(public_key->pubkey_exp);

    return switchtec_mfg_cmd(dev, MRPC_KMSK_ENTRY_SET, &cmd,
                 sizeof(cmd), NULL, 0);
}

static int kmsk_set_send_signature(struct switchtec_dev *dev,
                   struct switchtec_signature *signature)
{
    struct kmsk_signature_cmd {
        uint8_t subcmd;
        uint8_t reserved[3];
        uint8_t signature[SWITCHTEC_SIG_LEN];
    } cmd = {};

    cmd.subcmd = MRPC_KMSK_ENTRY_SET_SIG;
    memcpy(cmd.signature, signature->signature,
           SWITCHTEC_SIG_LEN);

    return switchtec_mfg_cmd(dev, MRPC_KMSK_ENTRY_SET, &cmd,
                 sizeof(cmd), NULL, 0);
}

static int kmsk_set_send_kmsk(struct switchtec_dev *dev,
                  struct switchtec_kmsk *kmsk)
{
    struct kmsk_kmsk_cmd {
        uint8_t subcmd;
        uint8_t num_entries;
        uint8_t reserved[2];
        uint8_t kmsk[SWITCHTEC_KMSK_LEN];
    } cmd = {};

    cmd.subcmd = MRPC_KMSK_ENTRY_SET_KMSK;
    cmd.num_entries = 1;
    memcpy(cmd.kmsk, kmsk->kmsk, SWITCHTEC_KMSK_LEN);

    return switchtec_mfg_cmd(dev, MRPC_KMSK_ENTRY_SET, &cmd, sizeof(cmd),
                 NULL, 0);
}

int switchtec_kmsk_set(struct switchtec_dev *dev,
               struct switchtec_pubkey *public_key,
               struct switchtec_signature *signature,
               struct switchtec_kmsk *kmsk)
{
    int ret;

    if (public_key) {
        ret = kmsk_set_send_pubkey(dev, public_key);
        if (ret)
            return ret;
    }

    if (signature) {
        ret = kmsk_set_send_signature(dev, signature);
        if (ret)
            return ret;
    }

    return kmsk_set_send_kmsk(dev, kmsk);
}

#if HAVE_LIBCRYPTO

int switchtec_read_pubk_file(FILE *pubk_file, struct switchtec_pubkey *pubk)
{
    RSA *RSAKey = NULL;
    const BIGNUM *modulus_bn;
    const BIGNUM *exponent_bn;
    uint32_t exponent_tmp = 0;

    RSAKey = PEM_read_RSA_PUBKEY(pubk_file, NULL, NULL, NULL);
    if (RSAKey == NULL) {
        fseek(pubk_file, 0L, SEEK_SET);
        RSAKey = PEM_read_RSAPrivateKey(pubk_file, NULL, NULL, NULL);
        if (RSAKey == NULL)
            return -1;
    }

    RSA_get0_key(RSAKey, &modulus_bn, &exponent_bn, NULL);

    BN_bn2bin(modulus_bn, pubk->pubkey);
    BN_bn2bin(exponent_bn, (uint8_t *)&exponent_tmp);

    pubk->pubkey_exp = be32toh(exponent_tmp);
    RSA_free(RSAKey);

    return 0;
}
#endif

int switchtec_read_kmsk_file(FILE *kmsk_file, struct switchtec_kmsk *kmsk)
{
    ssize_t rlen;
    struct kmsk_struct {
        uint8_t magic[4];
        uint32_t version;
        uint32_t reserved;
        uint32_t crc32;
        uint8_t kmsk[SWITCHTEC_KMSK_LEN];
    } data;

    char magic[4] = {'K', 'M', 'S', 'K'};
    uint32_t crc;

    rlen = fread(&data, 1, sizeof(data), kmsk_file);

    if (rlen < sizeof(data))
        return -EBADF;

    if (memcmp(data.magic, magic, sizeof(magic)))
        return -EBADF;

    crc = crc32(data.kmsk, SWITCHTEC_KMSK_LEN, 0, 1, 1);
    if (crc != le32toh(data.crc32))
        return -EBADF;

    memcpy(kmsk->kmsk, data.kmsk, SWITCHTEC_KMSK_LEN);

    return 0;
}

int switchtec_read_signature_file(FILE *sig_file,
                  struct switchtec_signature *signature)
{
    ssize_t rlen;

    rlen = fread(signature->signature, 1, SWITCHTEC_SIG_LEN, sig_file);

    if (rlen < SWITCHTEC_SIG_LEN)
        return -EBADF;

    return 0;
}

int
switchtec_security_state_has_kmsk(struct switchtec_security_cfg_state *state,
                  struct switchtec_kmsk *kmsk)
{
    int key_idx;

    for(key_idx = 0; key_idx < state->public_key_num; key_idx++) {
        if (memcmp(state->public_key[key_idx], kmsk->kmsk,
               SWITCHTEC_KMSK_LEN) == 0)
            return 1;
    }

    return 0;
}