The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
heap_caps_calloc_base() calls heap_caps_malloc_base() from the same
translation unit (heap_caps_base.c). GNU ld --wrap only redirects
undefined references, so that intra-object call binds to the real
heap_caps_malloc_base and never enters __wrap_heap_caps_malloc_base.
As a result, allocations made through heap_caps_calloc() were never
recorded by heap tracing, silently hiding potentially large INTERNAL
leaks (e.g. mbedtls SSL buffers via MALLOC_CAP_INTERNAL).
Add heap_caps_calloc_base to the --wrap list and implement
__wrap_heap_caps_calloc_base, which records the allocation via a
noinline trace_calloc helper (mirroring trace_malloc so the recorded
call stack depth stays consistent) and calls __real_heap_caps_calloc_base.
The inner malloc_base call remains same-TU and unwrapped, so each
calloc produces exactly one trace record (no double counting).
Remove ~50 duplicate local definitions of ALIGN_UP/ALIGN_DOWN/ALIGN_UP_BY/
ALIGN_DOWN_BY across the codebase and replace them with canonical
ESP_ALIGN_UP/ESP_ALIGN_DOWN from esp_macros.h.
Add KASAN support for detecting heap memory safety bugs (buffer
overflows, underflows, use-after-free) at runtime using compiler
instrumentation and shadow memory. Gated behind
CONFIG_IDF_EXPERIMENTAL_FEATURES, with touch points kept to esp_system
and heap so other components stay untouched.
- Core runtime (esp_system/kasan.c, esp_kasan.h): nibble-based shadow
memory in DRAM, poison/unpoison, per-access validation, and __asan_*
stubs; hot-path stubs in IRAM so they stay valid with the flash cache
off. Shadow init runs before heap bring-up.
- Heap integration (heap/heap_kasan*.c): alloc/free hooks add redzones,
a quarantine FIFO, and shadow updates.
- Panic handling: disable checks once at the panic handler entry so
backtrace and stack dumps can read redzones without nested reports.
- Build system: -fsanitize=kernel-address for app code, with HAL, SoC,
esp_rom, SPI flash, esp_hw_support, bootloader_support, FreeRTOS, and
heap internals excluded from instrumentation.
- Test app (tools/test_apps/system/kasan_test): Unity tests for
overflow, underflow, use-after-free, and all sized __asan_* stubs,
with halt and no-halt configurations.
- Docs: document KASAN in the heap memory debugging guide (EN and CN).
After startup is done and app_main is reached, all calls to
heap_caps_add_region_with_caps (adding a new heap to the list of registered
heaps) will not affect the minimum free heap size value.
For heaps created before startup, this won't apply and their size will
end up being taken into account in the calculation of the minimum.
Adds CONFIG_SPIRAM_ENC_EXEMPT, available on chips that support per-page
PSRAM encryption configuration (esp32c5, esp32c61, esp32p4). When
enabled, esp_psram carves CONFIG_SPIRAM_ENC_EXEMPT_SIZE off the top of
PSRAM and maps it via the new mmu_hal_map_region_no_enc() helper, which
writes MMU entries without the SENSITIVE bit. The region is registered
as a separate heap pool reachable only through the new
MALLOC_CAP_SPIRAM_NO_ENC capability bit, so default SPIRAM allocations
cannot accidentally land there.
PSRAM encryption imposes alignment constraints that some DMA engines
(e.g. 2D-DMA) cannot satisfy. This option lets such workloads place
their buffers in unencrypted PSRAM while keeping the rest of PSRAM
(and flash) encrypted. Default disabled; security implications are
documented in the Kconfig help text.
The TLSF ROM patch code (rom_patch_tlsf.c, rom_patch_multi_heap.c),
their headers, and the per-target *.rom.heap.ld linker scripts are
semantically owned by the heap component, not esp_rom. Move them
accordingly:
- components/esp_rom/patches/esp_rom_tlsf.c
→ components/heap/rom_patches/rom_patch_tlsf.c
- components/esp_rom/patches/esp_rom_multi_heap.c
→ components/heap/rom_patches/rom_patch_multi_heap.c
- components/esp_rom/include/esp_rom_tlsf.h
→ components/heap/rom_patches/include/rom_patch_tlsf.h
- components/esp_rom/include/esp_rom_multi_heap.h
→ components/heap/rom_patches/include/rom_patch_multi_heap.h
- components/esp_rom/<target>/ld/<target>.rom.heap.ld (×8)
→ components/heap/port/<target>/ld/<target>.rom.heap.ld
Update heap/CMakeLists.txt to:
- use target_linker_script() directly for *.rom.heap.ld
- guard post-registration ROM patch setup with NOT BOOTLOADER_BUILD
- drop stale CONFIG_HEAP_TLSF_CHECK_PATCH symbol reference
- drop esp_rom_include_multi_heap_patch from TLSF_CHECK_PATCH guard
Remove the corresponding entries from esp_rom/CMakeLists.txt.
Fixed compilation error when building with -Wwrite-strings or
-Wdiscarded-qualifiers by adding const qualifier to char pointers with
string literals.
Closes https://github.com/espressif/esp-idf/issues/18120
Split the idf_performance.h and target ver, which hold the performance
thresholds, into the headers of each testing.
In the past pytest also parse the common header to get the thresholds.
Now the logic is also removed. Performance thresholds are supposed to be
in the pytest scripts.
"RTC memory should be lowest priority and its free size should be big enough"
was failing because the expected size of RTC heap left after init was bigger
than the total RTC size itself.
The test was updated to:
- check that the minimum free RTC heap size matches the current size
- the current RTC heap size is bigger than 80% of the total RTC memory region
IDF_BUILD_V2 does not have BUILD_COMPONENTS build property. Therefore,
when IDF_BUILD_V2 is defined, use a generator expressions instead. I
believe that the one-liner should also work with IDF_BUILD_V1, but the
change is kept separate to clearly show the difference between
IDF_BUILD_V1 and IDF_BUILD_V2.
Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
Add a condition on the definition of the MALLOC_CAP_EXEC macro to
prevent it from being defined if ESP_SYSTEM_MEMPROT_FEATURE or
ESP_SYSTEM_PMP_IDRAM_SPLIT is enabled, thus throwing a compile time
error when using it.
Closes https://github.com/espressif/esp-idf/issues/14837
