esptool 4.9.dev8__tar.gz → 4.10.0__tar.gz

{esptool-4.9.dev8/esptool.egg-info → esptool-4.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: esptool
-Version: 4.9.dev8
+Version: 4.10.0
 Summary: A serial utility to communicate & flash code to Espressif chips.
 Author: Fredrik Ahlberg (themadinventor), Angus Gratton (projectgus), Espressif Systems
 License: GPLv2+

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/base_fields.py

@@ -488,8 +488,14 @@ class EspEfusesBase(object):
         print("Re-connecting...")
         baudrate = esp._port.baudrate
         port = esp._port.port
+        connect_mode = (
+            "usb-reset"
+            if esp._get_pid() == esp.USB_JTAG_SERIAL_PID
+            else "default-reset"
+        )
+        print(f"Port: {port}, Baudrate: {baudrate}, Connect mode: {connect_mode}")
         esp._port.close()
-        return esptool.cmds.detect_chip(port, baudrate)
+        return esptool.cmds.detect_chip(port, baudrate, connect_mode)
 
     def get_index_block_by_name(self, name):
         for block in self.blocks:

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/base_operations.py

@@ -5,12 +5,14 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import argparse
+import io
 import os
 import json
 import sys
 
 from bitstring import BitStream
 
+import espsecure
 import esptool
 
 from . import base_fields
@@ -802,3 +804,162 @@ def check_error(esp, efuses, args):
     if error_in_blocks:
         raise esptool.FatalError("Error(s) were detected in eFuses")
     print("No errors detected")
+
+
+def _key_block_is_unused(block, key_purpose_block):
+    """Helper method to check if a key block is available for use"""
+    if not block.is_readable() or not block.is_writeable():
+        return False
+
+    if key_purpose_block.get() != "USER" or not key_purpose_block.is_writeable():
+        return False
+
+    if not block.get_bitstring().all(False):
+        return False
+
+    return True
+
+
+def _get_next_key_block(efuses, current_key_block, block_name_list):
+    """Helper method to get the next available key block"""
+    key_blocks = [b for b in efuses.blocks if b.key_purpose_name]
+    start = key_blocks.index(current_key_block)
+
+    # Sort key blocks so that we pick the next free block
+    # (and loop around if necessary)
+    key_blocks = key_blocks[start:] + key_blocks[0:start]
+
+    # Exclude any other blocks that will be be burned
+    key_blocks = [b for b in key_blocks if b.name not in block_name_list]
+
+    for block in key_blocks:
+        key_purpose_block = efuses[block.key_purpose_name]
+        if _key_block_is_unused(block, key_purpose_block):
+            return block
+
+    return None
+
+
+def adjust_key_data_for_blocks(efuses, block_names, datafiles, keypurposes):
+    """Split a key that takes more than one efuse block into two blocks.
+    It handles all key purposes that require splitting into two blocks.
+
+    This method checks if key purposes require splitting into two blocks,
+    such as "XTS_AES_256_KEY", "XTS_AES_256_PSRAM_KEY", and "ECDSA_KEY_P384".
+
+    Args:
+        block_names: List of block names.
+        datafiles: List of BinaryIO objects containing key data.
+        keypurposes: List of key purposes.
+
+    Returns:
+        A tuple containing updated block names, datafiles, and keypurposes.
+    """
+    keypurposes = list(keypurposes)
+    datafiles = list(datafiles)
+    block_names = list(block_names)
+
+    if "XTS_AES_256_KEY" in keypurposes:
+        # XTS_AES_256_KEY is not an actual HW key purpose, needs to be split into
+        # XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
+        block_names, datafiles, keypurposes = _split_multiblock_key(
+            efuses,
+            block_names,
+            datafiles,  # type: ignore
+            keypurposes,
+            "XTS_AES_256_KEY",
+        )
+
+    if "XTS_AES_256_PSRAM_KEY" in keypurposes:
+        # XTS_AES_256_PSRAM_KEY -> XTS_AES_256_PSRAM_KEY_1 and ..._KEY_2
+        block_names, datafiles, keypurposes = _split_multiblock_key(
+            efuses,
+            block_names,
+            datafiles,  # type: ignore
+            keypurposes,
+            "XTS_AES_256_PSRAM_KEY",
+        )
+
+    # ECDSA keys can be present in a command multiple times
+    i = 0
+    while i < len(keypurposes):
+        if "ECDSA_KEY" in keypurposes[i]:
+            if keypurposes[i] not in ["ECDSA_KEY_P384_L", "ECDSA_KEY_P384_H"]:
+                sk = espsecure.load_ecdsa_signing_key(datafiles[i])  # type: ignore
+                data = sk.to_string()
+                if "ECDSA_KEY_P384" == keypurposes[i]:
+                    assert (
+                        len(data) == 48
+                    ), "NIST384p private key should be 48 bytes long"
+                    datafiles[i] = io.BytesIO(b"\x00" * 16 + data)
+                    # ECDSA_KEY_P384 -> ECDSA_KEY_P384_L and ECDSA_KEY_P384_H
+                    block_names, datafiles, keypurposes = _split_multiblock_key(
+                        efuses,
+                        block_names,
+                        datafiles,  # type: ignore
+                        keypurposes,
+                        "ECDSA_KEY_P384",
+                    )
+                else:
+                    # the private key is 24 bytes long for NIST192p,
+                    # and 8 bytes of padding
+                    datafiles[i] = (
+                        io.BytesIO(b"\x00" * 8 + data)
+                        if len(data) == 24
+                        else io.BytesIO(data)
+                    )
+
+        i += 1
+
+    # Check that all block names are unique
+    util.check_duplicate_name_in_list(block_names)
+
+    # Check that the number of blocks, datafiles, and keypurposes is equal
+    if len(block_names) != len(datafiles) or len(block_names) != len(keypurposes):
+        raise esptool.FatalError(
+            f"The number of blocks ({len(block_names)}), "
+            f"datafile ({len(datafiles)}) and keypurpose ({len(keypurposes)}) "
+            "should be the same."
+        )
+
+    return block_names, datafiles, keypurposes
+
+
+def _split_multiblock_key(
+    efuses, block_names, datafiles, keypurposes, base_keypurpose="XTS_AES_256_KEY"
+):
+    """Helper method to split 512-bit key into two 256-bit keys"""
+
+    keypurpose_list = list(keypurposes)
+    datafile_list = list(datafiles)
+    block_name_list = list(block_names)
+
+    i = keypurpose_list.index(base_keypurpose)
+    block_name = block_name_list[i]
+
+    block_num = efuses.get_index_block_by_name(block_name)
+    block = efuses.blocks[block_num]
+
+    data = datafile_list[i].read()
+    if len(data) != 64:
+        raise esptool.FatalError(
+            f"Incorrect key file size {len(data)}, {base_keypurpose} "
+            "should be 64 bytes"
+        )
+
+    key_block_2 = _get_next_key_block(efuses, block, block_name_list)
+    if not key_block_2:
+        raise esptool.FatalError(f"{base_keypurpose} requires two free keyblocks")
+
+    postfix = (
+        ["_1", "_2"] if base_keypurpose.startswith("XTS_AES_256") else ["_H", "_L"]
+    )
+    keypurpose_list[i] = f"{base_keypurpose}{postfix[0]}"
+    datafile_list[i] = io.BytesIO(data[:32])
+    block_name_list[i] = block_name
+
+    keypurpose_list.insert(i + 1, f"{base_keypurpose}{postfix[1]}")
+    datafile_list.insert(i + 1, io.BytesIO(data[32:]))
+    block_name_list.insert(i + 1, key_block_2.name)
+
+    return block_name_list, datafile_list, keypurpose_list

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/emulate_efuse_controller_base.py

@@ -18,6 +18,7 @@ class EmulateEfuseControllerBase(object):
     Blocks = None
     Fields = None
     REGS = None
+    USB_JTAG_SERIAL_PID = 0x1001
 
     def __init__(self, efuse_file=None, debug=False):
         self.debug = debug
@@ -75,6 +76,9 @@ class EmulateEfuseControllerBase(object):
         blk = self.Blocks.get(self.Blocks.BLOCKS[block])
         self.write_reg(blk.wr_addr + (4 * n), value)
 
+    def _get_pid(self):
+        return -1
+
     """ << esptool method end """
 
     def handle_writing_event(self, addr, value):

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/esp32c3/fields.py

@@ -450,5 +450,6 @@ class EfuseKeyPurposeField(EfuseField):
         raw_val = int(self.check_format(str(new_value)))
         str_new_value = self.get_name(raw_val)
         if self.name == "KEY_PURPOSE_5" and str_new_value.startswith("XTS_AES"):
+            # see SOC_EFUSE_BLOCK9_KEY_PURPOSE_QUIRK in esp-idf
             raise esptool.FatalError(f"{self.name} can not have {str_new_value} key due to a hardware bug (please see TRM for more details)")
         return super(EfuseKeyPurposeField, self).save(raw_val)

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/esp32c3/operations.py

@@ -26,6 +26,7 @@ from ..base_operations import (
     read_protect_efuse,
     summary,
     write_protect_efuse,
+    adjust_key_data_for_blocks,
 )
 
 
@@ -224,15 +225,12 @@ def burn_key(esp, efuses, args, digest=None):
         0 : len([name for name in args.keypurpose if name is not None]) :
     ]
 
-    util.check_duplicate_name_in_list(block_name_list)
-    if len(block_name_list) != len(datafile_list) or len(block_name_list) != len(
-        keypurpose_list
-    ):
-        raise esptool.FatalError(
-            "The number of blocks (%d), datafile (%d) and keypurpose (%d) "
-            "should be the same."
-            % (len(block_name_list), len(datafile_list), len(keypurpose_list))
-        )
+    block_name_list, datafile_list, keypurpose_list = adjust_key_data_for_blocks(
+        efuses,
+        block_name_list,
+        datafile_list,
+        keypurpose_list,
+    )
 
     print("Burn keys to blocks:")
     for block_name, datafile, keypurpose in zip(

{esptool-4.9.dev8 → esptool-4.10.0}/espefuse/efuse/esp32c5/fields.py

@@ -8,7 +8,7 @@ import binascii
 import struct
 import sys
 import time
-
+from typing import List, Tuple, Optional
 from bitstring import BitArray
 
 import esptool
@@ -403,14 +403,13 @@ class EfuseMacField(EfuseField):
 
 # fmt: off
 class EfuseKeyPurposeField(EfuseField):
-    KEY_PURPOSES = [
+    key_purpose_len = 5  # bits for key purpose
+    KeyPurposeType = Tuple[str, int, Optional[str], Optional[str], str]
+    KEY_PURPOSES: List[KeyPurposeType] = [
         ("USER",                         0,  None,       None,      "no_need_rd_protect"),   # User purposes (software-only use)
-        ("ECDSA_KEY",                    1,  None,       "Reverse", "need_rd_protect"),      # ECDSA key P256
         ("ECDSA_KEY_P256",               1,  None,       "Reverse", "need_rd_protect"),      # ECDSA key P256
+        ("ECDSA_KEY",                    1,  None,       "Reverse", "need_rd_protect"),      # ECDSA key P256
         ("RESERVED",                     1,  None,       None,      "no_need_rd_protect"),   # Reserved
-        ("XTS_AES_256_KEY_1",            2,  None,       "Reverse", "need_rd_protect"),      # XTS_AES_256_KEY_1 (flash/PSRAM encryption)
-        ("XTS_AES_256_KEY_2",            3,  None,       "Reverse", "need_rd_protect"),      # XTS_AES_256_KEY_2 (flash/PSRAM encryption)
-        ("XTS_AES_256_KEY",             -1, "VIRTUAL",   None,      "no_need_rd_protect"),   # Virtual purpose splits to XTS_AES_256_KEY_1 and XTS_AES_256_KEY_2
         ("XTS_AES_128_KEY",              4,  None,       "Reverse", "need_rd_protect"),      # XTS_AES_128_KEY (flash/PSRAM encryption)
         ("HMAC_DOWN_ALL",                5,  None,       None,      "need_rd_protect"),      # HMAC Downstream mode
         ("HMAC_DOWN_JTAG",               6,  None,       None,      "need_rd_protect"),      # JTAG soft enable key (uses HMAC Downstream mode)
@@ -420,14 +419,20 @@ class EfuseKeyPurposeField(EfuseField):
         ("SECURE_BOOT_DIGEST1",          10, "DIGEST",   None,      "no_need_rd_protect"),   # SECURE_BOOT_DIGEST1 (Secure Boot key digest)
         ("SECURE_BOOT_DIGEST2",          11, "DIGEST",   None,      "no_need_rd_protect"),   # SECURE_BOOT_DIGEST2 (Secure Boot key digest)
         ("KM_INIT_KEY",                  12, None,       None,      "need_rd_protect"),      # init key that is used for the generation of AES/ECDSA key
-        ("XTS_AES_256_PSRAM_KEY_1",      13, None,       "Reverse", "need_rd_protect"),      # XTS_AES_256_PSRAM_KEY_1 (PSRAM encryption)
-        ("XTS_AES_256_PSRAM_KEY_2",      14, None,       "Reverse", "need_rd_protect"),      # XTS_AES_256_PSRAM_KEY_1 (PSRAM encryption)
-        # ("XTS_AES_256_PSRAM_KEY",        -2, "VIRTUAL",  None,      "no_need_rd_protect"),   # Virtual purpose splits to XTS_AES_256_PSRAM_KEY_1 and XTS_AES_256_PSRAM_KEY_1
         ("XTS_AES_128_PSRAM_KEY",        15, None,       "Reverse", "need_rd_protect"),      # XTS_AES_128_PSRAM_KEY (PSRAM encryption)
         ("ECDSA_KEY_P192",               16, None,       "Reverse", "need_rd_protect"),      # ECDSA key P192
         ("ECDSA_KEY_P384_L",             17, None,       "Reverse", "need_rd_protect"),      # ECDSA key P384 low
         ("ECDSA_KEY_P384_H",             18, None,       "Reverse", "need_rd_protect"),      # ECDSA key P384 high
+        ("ECDSA_KEY_P384",               -3, "VIRTUAL",  None,      "need_rd_protect"),      # Virtual purpose splits to ECDSA_KEY_P384_L and ECDSA_KEY_P384_H
     ]
+    CUSTOM_KEY_PURPOSES: List[KeyPurposeType] = []
+    for id in range(0, 1 << key_purpose_len):
+        if id not in [p[1] for p in KEY_PURPOSES]:
+            CUSTOM_KEY_PURPOSES.append((f"CUSTOM_{id}", id, None, None, "no_need_rd_protect"))
+            CUSTOM_KEY_PURPOSES.append((f"CUSTOM_DIGEST_{id}", id, "DIGEST", None, "no_need_rd_protect"))
+    CUSTOM_KEY_PURPOSES.append(("CUSTOM_MAX", (1 << key_purpose_len) - 1, None, None, "no_need_rd_protect"))
+    CUSTOM_KEY_PURPOSES.append(("CUSTOM_DIGEST_MAX", (1 << key_purpose_len) - 1, "DIGEST", None, "no_need_rd_protect"))
+    KEY_PURPOSES += CUSTOM_KEY_PURPOSES
 # fmt: on
     KEY_PURPOSES_NAME = [name[0] for name in KEY_PURPOSES]
     DIGEST_KEY_PURPOSES = [name[0] for name in KEY_PURPOSES if name[2] == "DIGEST"]
@@ -470,7 +475,4 @@ class EfuseKeyPurposeField(EfuseField):
 
     def save(self, new_value):
         raw_val = int(self.check_format(str(new_value)))
-        str_new_value = self.get_name(raw_val)
-        if self.name == "KEY_PURPOSE_5" and str_new_value.startswith("XTS_AES"):
-            raise esptool.FatalError(f"{self.name} can not have {str_new_value} key due to a hardware bug (please see TRM for more details)")
         return super(EfuseKeyPurposeField, self).save(raw_val)