feat(espefuse): Support XTS_AES_256_KEY key_purpose for ESP32P4

espefuse/efuse/esp32p4/fields.py

@@ -387,6 +387,7 @@ class EfuseKeyPurposeField(EfuseField):
         ("SECURE_BOOT_DIGEST1",          10, "DIGEST",   None,      "no_need_rd_protect"),   # SECURE_BOOT_DIGEST1 (Secure Boot key digest)
         ("SECURE_BOOT_DIGEST2",          11, "DIGEST",   None,      "no_need_rd_protect"),   # SECURE_BOOT_DIGEST2 (Secure Boot key digest)
         ("KM_INIT_KEY",                  12, None,       None,      "need_rd_protect"),      # init key that is used for the generation of AES/ECDSA key
+        ("XTS_AES_256_KEY",              -1, "VIRTUAL",  None,      "no_need_rd_protect"),   # Virtual purpose splits to XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
     ]
 # fmt: on
     KEY_PURPOSES_NAME = [name[0] for name in KEY_PURPOSES]

espefuse/efuse/esp32p4/operations.py

@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import argparse
+import io
 import os  # noqa: F401. It is used in IDF scripts
 import traceback
 
@@ -191,6 +192,67 @@ def adc_info(esp, efuses, args):
     print("not supported yet")
 
 
+def key_block_is_unused(block, key_purpose_block):
+    if not block.is_readable() or not block.is_writeable():
+        return False
+
+    if key_purpose_block.get() != "USER" or not key_purpose_block.is_writeable():
+        return False
+
+    if not block.get_bitstring().all(False):
+        return False
+
+    return True
+
+
+def get_next_key_block(efuses, current_key_block, block_name_list):
+    key_blocks = [b for b in efuses.blocks if b.key_purpose_name]
+    start = key_blocks.index(current_key_block)
+
+    # Sort key blocks so that we pick the next free block (and loop around if necessary)
+    key_blocks = key_blocks[start:] + key_blocks[0:start]
+
+    # Exclude any other blocks that will be be burned
+    key_blocks = [b for b in key_blocks if b.name not in block_name_list]
+
+    for block in key_blocks:
+        key_purpose_block = efuses[block.key_purpose_name]
+        if key_block_is_unused(block, key_purpose_block):
+            return block
+
+    return None
+
+
+def split_512_bit_key(efuses, block_name_list, datafile_list, keypurpose_list):
+    i = keypurpose_list.index("XTS_AES_256_KEY")
+    block_name = block_name_list[i]
+
+    block_num = efuses.get_index_block_by_name(block_name)
+    block = efuses.blocks[block_num]
+
+    data = datafile_list[i].read()
+    if len(data) != 64:
+        raise esptool.FatalError(
+            "Incorrect key file size %d, XTS_AES_256_KEY should be 64 bytes" % len(data)
+        )
+
+    key_block_2 = get_next_key_block(efuses, block, block_name_list)
+    if not key_block_2:
+        raise esptool.FatalError("XTS_AES_256_KEY requires two free keyblocks")
+
+    keypurpose_list.append("XTS_AES_256_KEY_1")
+    datafile_list.append(io.BytesIO(data[:32]))
+    block_name_list.append(block_name)
+
+    keypurpose_list.append("XTS_AES_256_KEY_2")
+    datafile_list.append(io.BytesIO(data[32:]))
+    block_name_list.append(key_block_2.name)
+
+    keypurpose_list.pop(i)
+    datafile_list.pop(i)
+    block_name_list.pop(i)
+
+
 def burn_key(esp, efuses, args, digest=None):
     if digest is None:
         datafile_list = args.keyfile[
@@ -206,6 +268,11 @@ def burn_key(esp, efuses, args, digest=None):
         0 : len([name for name in args.keypurpose if name is not None]) :
     ]
 
+    if "XTS_AES_256_KEY" in keypurpose_list:
+        # XTS_AES_256_KEY is not an actual HW key purpose, needs to be split into
+        # XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
+        split_512_bit_key(efuses, block_name_list, datafile_list, keypurpose_list)
+
     util.check_duplicate_name_in_list(block_name_list)
     if len(block_name_list) != len(datafile_list) or len(block_name_list) != len(
         keypurpose_list

test/test_espefuse.py

@@ -962,8 +962,8 @@ def test_burn_key_with_34_coding_scheme(self):
         self.check_data_block_in_log(output, f"{IMAGES_DIR}/192bit_2")
 
     @pytest.mark.skipif(
-        arg_chip not in ["esp32s2", "esp32s3"],
-        reason="512 bit keys are only supported on ESP32-S2 and S3",
+        arg_chip not in ["esp32s2", "esp32s3", "esp32p4"],
+        reason="512 bit keys are only supported on ESP32-S2, S3, and P4",
     )
     def test_burn_key_512bit(self):
         self.espefuse_py(
@@ -980,8 +980,8 @@ def test_burn_key_512bit(self):
         )
 
     @pytest.mark.skipif(
-        arg_chip not in ["esp32s2", "esp32s3"],
-        reason="512 bit keys are only supported on ESP32-S2 and S3",
+        arg_chip not in ["esp32s2", "esp32s3", "esp32p4"],
+        reason="512 bit keys are only supported on ESP32-S2, S3, and P4",
     )
     def test_burn_key_512bit_non_consecutive_blocks(self):
         # Burn efuses seperately to test different kinds
@@ -1023,8 +1023,8 @@ def test_burn_key_512bit_non_consecutive_blocks(self):
         ) in output
 
     @pytest.mark.skipif(
-        arg_chip not in ["esp32s2", "esp32s3"],
-        reason="512 bit keys are only supported on ESP32-S2 and S3",
+        arg_chip not in ["esp32s2", "esp32s3", "esp32p4"],
+        reason="512 bit keys are only supported on ESP32-S2, S3, and P4",
     )
     def test_burn_key_512bit_non_consecutive_blocks_loop_around(self):
         self.espefuse_py(