[v2,0/4] aspeed: ast2700: Add Caliptra ECDSA driver

Aspeed AST2700 SoCs integrates the Caliptra secure IP, where an ECDSA384
signature verification HW interface is exported for SoC crypto needs.

This patch series firstly extends the FIT image signing/verify common
code to support the ECDSA384 algorithm. For better convenience, the
device tree for ECDSA public key storage is also revised by referring
to RSA implementations.

After the FIT common code revision, the driver is implemented for
AST2700 to leverage the Caliptra ECDSA384 signature verification.

These are verified by signed FIT images with the algorithm "sha384,ecdsa384".

v2 change:
  - revise the commit message of padding check removal for better explanation
  - remove redundant check in static function
  - revise errno and error message as suggested by Simon
  - collect Reviewed-by tags

Chia-Wei Wang (4):
  lib: ecdsa: Add ECDSA384 support
  lib: ecdsa: Create device tree node automatically
  image-fit-sig: Remove padding check
  drivers/crypto: aspeed: Add Caliptra ECDSA384 support

 boot/image-fit-sig.c                |   2 +-
 drivers/crypto/aspeed/Kconfig       |  10 ++
 drivers/crypto/aspeed/Makefile      |   1 +
 drivers/crypto/aspeed/cptra_ecdsa.c | 184 ++++++++++++++++++++++++++++
 include/u-boot/ecdsa.h              |   1 +
 lib/ecdsa/ecdsa-libcrypto.c         |  25 ++--
 lib/ecdsa/ecdsa-verify.c            |  14 ++-
 tools/image-sig-host.c              |   7 ++
 8 files changed, 233 insertions(+), 11 deletions(-)
 create mode 100644 drivers/crypto/aspeed/cptra_ecdsa.c

On Fri, Sep 27, 2024 at 11:07:22AM +0800, Chia-Wei Wang wrote:

> Aspeed AST2700 SoCs integrates the Caliptra secure IP, where an ECDSA384
> signature verification HW interface is exported for SoC crypto needs.
> 
> This patch series firstly extends the FIT image signing/verify common
> code to support the ECDSA384 algorithm. For better convenience, the
> device tree for ECDSA public key storage is also revised by referring
> to RSA implementations.
> 
> After the FIT common code revision, the driver is implemented for
> AST2700 to leverage the Caliptra ECDSA384 signature verification.
> 
> These are verified by signed FIT images with the algorithm "sha384,ecdsa384".
> 
> v2 change:
>   - revise the commit message of padding check removal for better explanation
>   - remove redundant check in static function
>   - revise errno and error message as suggested by Simon
>   - collect Reviewed-by tags

Please rebase on top of current master, thanks.

> From: Tom Rini <trini@konsulko.com>
> Sent: Saturday, October 12, 2024 1:34 AM
> To: ChiaWei Wang <chiawei_wang@aspeedtech.com>
> 
> On Fri, Sep 27, 2024 at 11:07:22AM +0800, Chia-Wei Wang wrote:
> 
> > Aspeed AST2700 SoCs integrates the Caliptra secure IP, where an
> > ECDSA384 signature verification HW interface is exported for SoC crypto
> needs.
> >
> > This patch series firstly extends the FIT image signing/verify common
> > code to support the ECDSA384 algorithm. For better convenience, the
> > device tree for ECDSA public key storage is also revised by referring
> > to RSA implementations.
> >
> > After the FIT common code revision, the driver is implemented for
> > AST2700 to leverage the Caliptra ECDSA384 signature verification.
> >
> > These are verified by signed FIT images with the algorithm
> "sha384,ecdsa384".
> >
> > v2 change:
> >   - revise the commit message of padding check removal for better
> explanation
> >   - remove redundant check in static function
> >   - revise errno and error message as suggested by Simon
> >   - collect Reviewed-by tags
> 
> Please rebase on top of current master, thanks.

I will rebase the patch and send v3. Thanks!

Regards,
Chiawei