fix(esp_security): guard key manager APIs against unsupported chip revs

On ESP32-P4 rev < 3.0, Key Manager is software-disabled, but the public
esp_key_mgr.h APIs had no runtime check.
Calls using HMAC/DS/PSRAM key types fell through to
HAL_ASSERT("Unsupported ...") paths in key_mgr_ll.h. Gate
each public API with key_mgr_ll_is_supported() and return
ESP_ERR_NOT_SUPPORTED cleanly instead.

components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c

@@ -510,6 +510,9 @@ TEST_GROUP(key_manager);
 
 TEST_SETUP(key_manager)
 {
+    if (!key_mgr_ll_is_supported()) {
+        TEST_IGNORE_MESSAGE("Key Manager not supported on this chip");
+    }
     test_utils_record_free_mem();
     TEST_ESP_OK(test_utils_set_leak_level(800, ESP_LEAK_TYPE_CRITICAL, ESP_COMP_LEAK_GENERAL));
 }

components/esp_hal_security/test_apps/crypto/pytest_crypto.py

@@ -109,12 +109,24 @@ def test_ecdsa_key(
         raise
 
 
-@pytest.mark.generic
-@pytest.mark.parametrize('config', ['long_aes_operations'], indirect=True)
-@idf_parametrize('target', ['supported_targets'], indirect=['target'])
 def test_crypto_long_aes_operations(dut: Dut) -> None:
     # if the env variable IDF_FPGA_ENV is set, we would need a longer timeout
     # as tests for efuses burning security peripherals would be run
     timeout = 600 if os.environ.get('IDF_ENV_FPGA') else 60
 
     dut.expect('Tests finished', timeout=timeout)
+
+
+@pytest.mark.generic
+@pytest.mark.parametrize('config', ['long_aes_operations'], indirect=True)
+@idf_parametrize('target', ['supported_targets'], indirect=['target'])
+def test_crypto_long_aes_operations_generic(dut: Dut) -> None:
+    test_crypto_long_aes_operations(dut)
+
+
+@pytest.mark.generic
+@pytest.mark.esp32p4_rev1
+@pytest.mark.parametrize('config', ['long_aes_operations_esp32p4_rev1'], indirect=True)
+@idf_parametrize('target', ['esp32p4'], indirect=['target'])
+def test_crypto_long_aes_operations_esp32p4_rev1(dut: Dut) -> None:
+    test_crypto_long_aes_operations(dut)

components/esp_hal_security/test_apps/crypto/sdkconfig.ci.long_aes_operations_esp32p4_rev1

@@ -0,0 +1,8 @@
+#
+# Example Configuration
+#
+CONFIG_IDF_TARGET="esp32p4"
+CONFIG_ESP32P4_SELECTS_REV_LESS_V3=y
+
+CONFIG_CRYPTO_TESTAPP_USE_AES_INTERRUPT=y
+# end of Example Configuration

components/esp_security/src/esp_key_mgr.c

@@ -15,6 +15,7 @@
 #include "esp_efuse.h"
 #include "hal/key_mgr_types.h"
 #include "hal/key_mgr_hal.h"
+#include "hal/key_mgr_ll.h"
 #include "hal/huk_types.h"
 #include "hal/huk_hal.h"
 #include "rom/key_mgr.h"
@@ -438,6 +439,10 @@ static esp_err_t key_mgr_deploy_key_aes_mode(aes_deploy_config_t *config)
 
 esp_err_t esp_key_mgr_deploy_key_in_aes_mode(const esp_key_mgr_aes_key_config_t *key_config, esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -557,6 +562,10 @@ static esp_err_t key_mgr_recover_key(key_recovery_config_t *config)
 
 esp_err_t esp_key_mgr_activate_key(esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -713,6 +722,10 @@ static esp_err_t key_mgr_deploy_key_ecdh0_mode(ecdh0_deploy_config_t *config)
 esp_err_t esp_key_mgr_deploy_key_in_ecdh0_mode(const esp_key_mgr_ecdh0_key_config_t *key_config,
                                                esp_key_mgr_key_recovery_info_t *key_info, esp_key_mgr_ecdh0_info_t *ecdh0_key_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_info == NULL || ecdh0_key_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }
@@ -842,6 +855,10 @@ static esp_err_t key_mgr_deploy_key_random_mode(random_deploy_config_t *config)
 
 esp_err_t esp_key_mgr_deploy_key_in_random_mode(const esp_key_mgr_random_key_config_t *key_config, esp_key_mgr_key_recovery_info_t *key_recovery_info)
 {
+    if (!key_mgr_ll_is_supported()) {
+        return ESP_ERR_NOT_SUPPORTED;
+    }
+
     if (key_config == NULL || key_recovery_info == NULL) {
         return ESP_ERR_INVALID_ARG;
     }

components/esp_security/test_apps/.build-test-rules.yml

@@ -2,7 +2,7 @@
 
 components/esp_security/test_apps/crypto_drivers:
   enable:
-    - if: ((SOC_HMAC_SUPPORTED == 1) or (SOC_DIG_SIGN_SUPPORTED == 1)) or (SOC_KEY_MANAGER_SUPPORTED == 1)g
+    - if: ((SOC_HMAC_SUPPORTED == 1) or (SOC_DIG_SIGN_SUPPORTED == 1)) or (SOC_KEY_MANAGER_SUPPORTED == 1)
   depends_components:
     - esp_security
     - esp_hal_security

components/esp_security/test_apps/crypto_drivers/main/test_key_mgr.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Unlicense OR CC0-1.0
  */
@@ -61,6 +61,13 @@ static const uint8_t k1_ds_encrypt[] = {
 
 static const char *TAG = "key_mgr_test";
 
+#define SKIP_IF_KEY_MGR_NOT_SUPPORTED()                                                   \
+    do {                                                                                  \
+        if (!key_mgr_ll_is_supported()) {                                                 \
+            TEST_IGNORE_MESSAGE("Key Manager not supported on this chip");                \
+        }                                                                                 \
+    } while (0)
+
 #define ENCRYPTED_DATA_SIZE 128
 static const uint8_t plaintext_data[ENCRYPTED_DATA_SIZE] = {
     0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
@@ -147,6 +154,8 @@ static esp_err_t test_xts_aes_key(bool verify)
 
 TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -171,6 +180,8 @@ TEST_CASE("Key Manager AES mode: XTS-AES-128 key deployment", "[hw_crypto] [key_
 
 TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -196,6 +207,8 @@ TEST_CASE("Key Manager ECDH0 mode: XTS-AES-128 key deployment", "[hw_crypto] [ke
 
 TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -218,6 +231,8 @@ TEST_CASE("Key Manager Random mode: XTS-AES-128 key deployment", "[hw_crypto] [k
 #if SOC_KEY_MANAGER_ECDSA_KEY_DEPLOY
 TEST_CASE("Key Manager random mode: ECDSA key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -249,6 +264,8 @@ static esp_err_t test_hmac_key(bool verify)
 
 TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -272,6 +289,8 @@ TEST_CASE("Key Manager AES mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -296,6 +315,8 @@ TEST_CASE("Key Manager ECDH0 mode: HMAC key deployment", "[hw_crypto] [key_mgr]"
 
 TEST_CASE("Key Manager random mode: HMAC key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -344,6 +365,8 @@ static esp_err_t test_ds_key(void)
 
 TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_aes_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_aes_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -367,6 +390,8 @@ TEST_CASE("Key Manager AES mode: DS key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_ecdh0_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_ecdh0_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);
 
@@ -391,6 +416,8 @@ TEST_CASE("Key Manager ECDH0 mode: DS key deployment", "[hw_crypto] [key_mgr]")
 
 TEST_CASE("Key Manager random mode: DS key deployment", "[hw_crypto] [key_mgr]")
 {
+    SKIP_IF_KEY_MGR_NOT_SUPPORTED();
+
     esp_key_mgr_random_key_config_t *key_config = calloc(1, sizeof(esp_key_mgr_random_key_config_t));
     TEST_ASSERT_NOT_NULL(key_config);