binman: test: Move security test files to test/security/

Move about 20 test files for signing, encryption, hash, pre-load,
x509, and Xilinx bootgen entries into a security/ subdirectory. Drop
the numeric prefixes and update all references.

Signed-off-by: Simon Glass <[email protected]>

23 files changed, 519 insertions, 0 deletions

diff --git a/tools/binman/test/security/encrypted_invalid_iv_file.dts b/tools/binman/test/security/encrypted_invalid_iv_file.dts
new file mode 100644
index 00000000000..388a0a6ad90
--- /dev/null
+++ b/tools/binman/test/security/encrypted_invalid_iv_file.dts
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		fit {
+			images {
+				u-boot {
+					encrypted {
+						algo = "some-algo";
+						key-source = "key";
+						iv-filename = "invalid-iv-file";
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/encrypted_key_file.dts b/tools/binman/test/security/encrypted_key_file.dts
new file mode 100644
index 00000000000..efd7ee5f35a
--- /dev/null
+++ b/tools/binman/test/security/encrypted_key_file.dts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		fit {
+			description = "test desc";
+
+			images {
+				u-boot {
+					encrypted {
+						algo = "algo-name";
+						iv-filename = "encrypted-file.iv";
+						key-filename = "encrypted-file.key";
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/encrypted_key_source.dts b/tools/binman/test/security/encrypted_key_source.dts
new file mode 100644
index 00000000000..884ec508db8
--- /dev/null
+++ b/tools/binman/test/security/encrypted_key_source.dts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		fit {
+			description = "test desc";
+
+			images {
+				u-boot {
+					encrypted {
+						algo = "algo-name";
+						key-source = "key-source-value";
+						iv-filename = "encrypted-file.iv";
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/encrypted_missing_key.dts b/tools/binman/test/security/encrypted_missing_key.dts
new file mode 100644
index 00000000000..d1daaa08851
--- /dev/null
+++ b/tools/binman/test/security/encrypted_missing_key.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		fit {
+			description = "test desc";
+
+			images {
+				u-boot {
+					encrypted {
+						algo = "algo-name";
+						iv-filename = "encrypted-file.iv";
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/encrypted_no_algo.dts b/tools/binman/test/security/encrypted_no_algo.dts
new file mode 100644
index 00000000000..03f7ffee90f
--- /dev/null
+++ b/tools/binman/test/security/encrypted_no_algo.dts
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		fit {
+			images {
+				u-boot {
+					encrypted {
+					};
+				};
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/hash.dts b/tools/binman/test/security/hash.dts
new file mode 100644
index 00000000000..200304599dc
--- /dev/null
+++ b/tools/binman/test/security/hash.dts
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		u-boot {
+			hash {
+				algo = "sha256";
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/hash_bad_algo.dts b/tools/binman/test/security/hash_bad_algo.dts
new file mode 100644
index 00000000000..d2402000db6
--- /dev/null
+++ b/tools/binman/test/security/hash_bad_algo.dts
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		u-boot {
+			hash {
+				algo = "invalid";
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/hash_no_algo.dts b/tools/binman/test/security/hash_no_algo.dts
new file mode 100644
index 00000000000..b64df205117
--- /dev/null
+++ b/tools/binman/test/security/hash_no_algo.dts
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		u-boot {
+			hash {
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/hash_section.dts b/tools/binman/test/security/hash_section.dts
new file mode 100644
index 00000000000..dcd8683d642
--- /dev/null
+++ b/tools/binman/test/security/hash_section.dts
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0+
+/dts-v1/;
+
+/ {
+	binman {
+		section {
+			u-boot {
+			};
+			fill {
+				size = <0x10>;
+				fill-byte = [61];
+			};
+			hash {
+				algo = "sha256";
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/key_name_hint_dir_spl_pubkey_dtb.dts b/tools/binman/test/security/key_name_hint_dir_spl_pubkey_dtb.dts
new file mode 100644
index 00000000000..85ebd58b6c0
--- /dev/null
+++ b/tools/binman/test/security/key_name_hint_dir_spl_pubkey_dtb.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		u-boot-spl-pubkey-dtb {
+			algo = "sha384,rsa4096";
+			required = "conf";
+			key-name-hint = "keys/key";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load.dts b/tools/binman/test/security/pre_load.dts
new file mode 100644
index 00000000000..e6d9ef40c6c
--- /dev/null
+++ b/tools/binman/test/security/pre_load.dts
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa2048";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <0x11223344>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_invalid_algo.dts b/tools/binman/test/security/pre_load_invalid_algo.dts
new file mode 100644
index 00000000000..d6f6dd20cd9
--- /dev/null
+++ b/tools/binman/test/security/pre_load_invalid_algo.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa20480";
+			 padding-name = "pkcs-1.5";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <1>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_invalid_key.dts b/tools/binman/test/security/pre_load_invalid_key.dts
new file mode 100644
index 00000000000..f93bc9792cd
--- /dev/null
+++ b/tools/binman/test/security/pre_load_invalid_key.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa4096";
+			 padding-name = "pkcs-1.5";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <1>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_invalid_padding.dts b/tools/binman/test/security/pre_load_invalid_padding.dts
new file mode 100644
index 00000000000..bbe2d1ba869
--- /dev/null
+++ b/tools/binman/test/security/pre_load_invalid_padding.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa2048";
+			 padding-name = "padding";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <1>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_invalid_sha.dts b/tools/binman/test/security/pre_load_invalid_sha.dts
new file mode 100644
index 00000000000..29afd2e37e4
--- /dev/null
+++ b/tools/binman/test/security/pre_load_invalid_sha.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha2560,rsa2048";
+			 padding-name = "pkcs-1.5";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <1>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_pkcs.dts b/tools/binman/test/security/pre_load_pkcs.dts
new file mode 100644
index 00000000000..66268cdb212
--- /dev/null
+++ b/tools/binman/test/security/pre_load_pkcs.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa2048";
+			 padding-name = "pkcs-1.5";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <0x11223344>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/pre_load_pss.dts b/tools/binman/test/security/pre_load_pss.dts
new file mode 100644
index 00000000000..3008d3f4649
--- /dev/null
+++ b/tools/binman/test/security/pre_load_pss.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		pre-load {
+			content = <&image>;
+			 algo-name = "sha256,rsa2048";
+			 padding-name = "pss";
+			 key-name = "dev.key";
+			 header-size = <4096>;
+			 version = <0x11223344>;
+		};
+
+		image: blob-ext {
+			filename = "refcode.bin";
+		};
+	};
+};
diff --git a/tools/binman/test/security/section_ignore_hash_signature.dts b/tools/binman/test/security/section_ignore_hash_signature.dts
new file mode 100644
index 00000000000..8adbe25512a
--- /dev/null
+++ b/tools/binman/test/security/section_ignore_hash_signature.dts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		section@0 {
+			u-boot {
+			};
+			hash {
+				algo = "sha256";
+			};
+			signature {
+				algo = "sha256,rsa2048";
+				key-name-hint = "dev";
+			};
+		};
+		section@1 {
+			u-boot {
+			};
+			hash-1 {
+				algo = "sha1";
+			};
+			hash-2 {
+				algo = "sha256";
+			};
+			signature-1 {
+				algo = "sha1,rsa2048";
+				key-name-hint = "dev";
+			};
+			signature-2 {
+				algo = "sha256,rsa2048";
+				key-name-hint = "dev";
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/sign_non_fit.dts b/tools/binman/test/security/sign_non_fit.dts
new file mode 100644
index 00000000000..e16c954246d
--- /dev/null
+++ b/tools/binman/test/security/sign_non_fit.dts
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		size = <0x100000>;
+		allow-repack;
+
+		u-boot {
+		};
+		fit {
+			description = "U-Boot";
+			offset = <0x10000>;
+			images {
+				u-boot-1 {
+					description = "U-Boot";
+					type = "standalone";
+					arch = "arm64";
+					os = "u-boot";
+					compression = "none";
+					hash-1 {
+						algo = "sha256";
+					};
+					u-boot {
+					};
+				};
+
+				fdt-1 {
+					description = "test.dtb";
+					type = "flat_dt";
+					arch = "arm64";
+					compression = "none";
+					hash-1 {
+						algo = "sha256";
+					};
+					u-boot-spl-dtb {
+					};
+				};
+
+			};
+
+			configurations {
+				default = "conf-1";
+				conf-1 {
+					description = "u-boot with fdt";
+					firmware = "u-boot-1";
+					fdt = "fdt-1";
+					signature-1 {
+						algo = "sha256,rsa4096";
+						key-name-hint = "test_key";
+						sign-images = "firmware", "fdt";
+					};
+
+				};
+			};
+		};
+
+		fdtmap {
+		};
+	};
+};
diff --git a/tools/binman/test/security/spl_pubkey_dtb.dts b/tools/binman/test/security/spl_pubkey_dtb.dts
new file mode 100644
index 00000000000..3256ff970cd
--- /dev/null
+++ b/tools/binman/test/security/spl_pubkey_dtb.dts
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		u-boot-spl-pubkey-dtb {
+			algo = "sha384,rsa4096";
+			required = "conf";
+			key-name-hint = "key";
+		};
+	};
+};
diff --git a/tools/binman/test/security/x509_cert.dts b/tools/binman/test/security/x509_cert.dts
new file mode 100644
index 00000000000..71238172717
--- /dev/null
+++ b/tools/binman/test/security/x509_cert.dts
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		x509-cert {
+			cert-ca = "IOT2050 Firmware Signature";
+			cert-revision-int = <0>;
+			content = <&u_boot>;
+		};
+
+		u_boot: u-boot {
+		};
+	};
+};
diff --git a/tools/binman/test/security/xilinx_bootgen_sign.dts b/tools/binman/test/security/xilinx_bootgen_sign.dts
new file mode 100644
index 00000000000..02acf8652a5
--- /dev/null
+++ b/tools/binman/test/security/xilinx_bootgen_sign.dts
@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		xilinx-bootgen {
+			auth-params = "ppk_select=0", "spk_id=0x00000000";
+			pmufw-filename = "pmu-firmware.elf";
+			psk-key-name-hint = "psk";
+			ssk-key-name-hint = "ssk";
+
+			u-boot-spl-nodtb {
+			};
+			u-boot-spl-dtb {
+			};
+		};
+	};
+};
diff --git a/tools/binman/test/security/xilinx_bootgen_sign_enc.dts b/tools/binman/test/security/xilinx_bootgen_sign_enc.dts
new file mode 100644
index 00000000000..5d7ce4c1f5a
--- /dev/null
+++ b/tools/binman/test/security/xilinx_bootgen_sign_enc.dts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	binman {
+		xilinx-bootgen {
+			auth-params = "ppk_select=0", "spk_id=0x00000000";
+			fsbl-config = "auth_only";
+			keysrc-enc = "efuse_red_key";
+			pmufw-filename = "pmu-firmware.elf";
+			psk-key-name-hint = "psk";
+			ssk-key-name-hint = "ssk";
+
+			u-boot-spl-nodtb {
+			};
+			u-boot-spl-dtb {
+			};
+		};
+	};
+};