Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
48,744 Commits 25 Branches 192 Tags
1bbf17f87b8f4e14d2c70b5d45ac6e31cb2f72e4
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
harshal.patil 88fc8952e5 test(ota): Add tests for verifying app build's SBv2 ECDSA signature verify APIs 2025-12-26 11:49:15 +05:30
harshal.patil c2dffd77fa fix(mbedtls/aes): Reallocate buffers only if in external RAM 2025-12-12 14:17:06 +05:30
harshal.patil 4504fa267b fix(secure_boot): Application's Secure Boot verify API support ECDSA-P384 2025-12-12 12:37:48 +05:30
harshal.patil b2dabf6f86 test(mbedtls): add more tests for alignment, buffer size related 
- Also, enabled Flash Encryption enabled tests for ESP32-C5
- Removed ESP32-P4 specific configs, as those configs are set as default now
 2025-12-11 16:48:25 +05:30
harshal.patil bb0354aecf fix(mbedtls/port): Use internal buffers to perform chunkwise operations 
when the external input and output buffers are unaligned.
This also fixes as a recursion loop that occurs when the size of the input
buffer is not aligned to dcache_line_size but is aligned to AES_BLOCK_BYTES
 2025-12-11 16:48:16 +05:30
harshal.patil 71084705c9 fix(key_mgr): Correct XTS-AES key length register configuration 
The key_mgr_ll_set_xts_aes_key_len() function was incorrectly using
REG_SET_FIELD() with the key_len enum value directly. Since
KEYMNG_FLASH_KEY_LEN is a 1-bit register field (0=128-bit, 1=256-bit),
writing ESP_KEY_MGR_XTS_AES_LEN_128 (value 3) resulted in the LSB (1)
being stored, incorrectly configuring 256-bit mode.

Fixed by using a switch statement to properly map:
- ESP_KEY_MGR_XTS_AES_LEN_128 → REG_CLR_BIT (0)
- ESP_KEY_MGR_XTS_AES_LEN_256 → REG_SET_BIT (1)

Thus, matching the correct ESP32-C5 implementation.
 2025-11-26 15:40:09 +05:30
harshal.patil 9a18386202 feat(esp_security): Support ECDSA-P384 key deployment using Key Manager 2025-11-20 11:37:07 +05:30
harshal.patil 792c93c597 change(mbedtls): Generalize key source union for the hardware ECDSA context 2025-11-20 11:37:07 +05:30
harshal.patil cd0770cd39 change(esp_key_mgr): Store key_len field in the key_info 
- Update the Key Manager key types to be generic
- Define a new enum to determine the length of the keys
- Refactor the Key Manager driver support generic key types and key lengths
- Also store key deployment mode in the key recovery info
 2025-11-20 11:37:07 +05:30
harshal.patil 172f904e23 feat(bootloader_support): Support FE XTS-AES-256 using Key Manager for ESP32-C5 2025-11-20 11:37:07 +05:30
harshal.patil 9c823cdf38 fix(hal): Force HUK power up when configuring HUK for ESP32-C5 2025-11-20 11:37:07 +05:30
harshal.patil 7cefae573a feat(flash_encryption): Remove mspi reset when switching the XTS-AES key source 2025-11-20 11:37:07 +05:30
harshal.patil 92e5cfa47e change(bootloader_support): Rename the esp_flash_encryption_enable_key_mgr() API 2025-11-20 11:37:07 +05:30
harshal.patil 7212b517d4 change(esp_key_mgr): Make Key Manager driver bootloader compatible 
- Independent of heap
 2025-11-20 11:37:07 +05:30
harshal.patil c1503cd847 feat(bootloader_support): Support Flash Encryption using Key Manager 2025-11-20 11:37:05 +05:30
harshal.patil 46e2cd21d4 fix(esp_security/esp_key_mgr): Fix missed error codes and some cleanup 2025-11-20 11:35:22 +05:30
harshal.patil 6815f7a71b test(examples): Fix cert bundle stress test 2025-11-14 09:46:28 +05:30
harshal.patil 3e7602a2e4 feat(cpu_region_protect): Extend PMP memprot for ESP32-P4 V3 2025-11-11 17:54:17 +05:30
harshal.patil 54c5c760ba fix(esp_security): Set WR_DIS_SECURE_BOOT_SHA384_EN by default when 
Flash Encryption Release mode is enabled and Secure Boot P384 scheme not is enabled.
 2025-11-11 17:52:21 +05:30
harshal.patil 488dcb58e1 fix(esp_security): Fix undefined efuse build failure in case of ESP32-P4 
- The `wr_dis` efuse bit corresponding to `SECURE_BOOT_SHA384_EN` is absent in P4
 2025-11-11 17:52:21 +05:30
harshal.patil 10cefdd975 fix(mbedtls/port): Align AES and SHA DMA buffers to 16 when SPIRAM encryption is enabled 
- Targets that support GDMA and MSPI encryption module need data and addresses aligned to 16
 2025-11-11 17:39:39 +05:30
harshal.patil beb0303ad6 fix(hal): Fix MMU PSRAM anti-fi MMU target check 
In case of ESP32-C5 and ESP32-C61, mmu_ids for PSRAM and Flash
MMU are the same due to their shared memory space. Thus, instead of
mmu_id we should use mmu_target_t.
 2025-11-03 11:29:27 +05:30
harshal.patil 7338c5179b fix(build_system): Add Bootloader and Partition Table as dependencies for encrypted-flash 
- If ESP-TEE is enabled, also add it as the dependency for the encrypted-flash target
 2025-11-03 11:15:25 +05:30
harshal.patil 609d52c6bf feat(esp32p4): Support newer Key Manager key sources for ESP32-P4 V3 2025-10-15 15:49:20 +05:30
Harshal Patil f088a128ac Merge branch 'test/set_minimal_build_for_security_test_apps' into 'master' 
test(security): Use minimal build in the security test apps

Closes IDF-14203

See merge request espressif/esp-idf!42292
 2025-09-30 11:38:21 +05:30
harshal.patil 1d4a634b98 test(security): Use minimal build in the security test apps 2025-09-30 10:52:03 +05:30
Harshal Patil fd7d9c9ee9 Merge branch 'fix/key_mgr_use_default_efuse_key' into 'master' 
Configure the Key Manager to use XTS-AES efuse key by-default

Closes IDFCI-3135 and IDFCI-3136

See merge request espressif/esp-idf!42032
 2025-09-26 12:34:19 +05:30
Harshal Patil c6e65586e3 Merge branch 'feat/support_aes_block_and_dma_modes_during_runtime' into 'master' 
Support AES block and DMA modes during runtime

Closes IDFGH-15251 and IDF-2594

See merge request espressif/esp-idf!40917
 2025-09-23 19:46:49 +05:30
harshal.patil 8b663ebe4d fix(esp_security): Configure the Key Manager to use XTS-AES efuse key by-default 2025-09-22 12:22:07 +05:30
harshal.patil ade76189c5 test(hal/crypto): Update AES test app to remove redundant block operation 2025-09-20 10:55:07 +05:30
harshal.patil c36aef9c19 change(mbedtls/port): Wrap headers with relevant soc_caps 
- Needed to fix builds for the targets that are yet to supported
 2025-09-20 10:55:07 +05:30
harshal.patil 8992f08bef feat(mbedtls/aes): Add config to support AES block and DMA modes during runtime 
- Dynamically switch the AES operation modes based on the buffer operating length
- Shorter AES and SHA operations can now run faster and concurrently as well

Closes https://github.com/espressif/esp-idf/issues/15914
 2025-09-20 10:55:07 +05:30
harshal.patil 5aa5366e7f fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-09-19 17:01:23 +05:30
harshal.patil 6be7a17ce0 fix(bootloader_support): Allow pre-programmed XTS-AES psuedo round level efuses 
- The API esp_flash_encryption_set_release_mode() by defualt programs
the XTS-AES pseudo round level efuse to level low but did not considered
any existing value that would have been programmed in the efuse bit.
 2025-09-19 13:55:50 +05:30
harshal.patil d6c1184676 fix(bootloader_support): Reorder write protection bits of some shared security efuses 2025-09-19 13:02:00 +05:30
Harshal Patil de36c80335 Merge branch 'fix/key_mgr_state_management' into 'master' 
Fix incorrect key manager state management

See merge request espressif/esp-idf!41796
 2025-09-12 17:09:52 +05:30
harshal.patil 854ec3590f fix(esp_key_mgr): Fix incorrect key manager state management 2025-09-12 11:02:45 +05:30
Harshal Patil 511292ba41 Merge branch 'fix/disable_efuse_xts_aes_256_esp32c5' into 'master' 
Disable XTS-AES-256 using efuse key for ESP32-C5

See merge request espressif/esp-idf!41348
 2025-08-20 21:33:39 +05:30
harshal.patil d59bcb633c fix(soc): Disable XTS-AES-256 using efuse key for ESP32-C5 2025-08-19 21:54:26 +05:30
harshal.patil da5dda1131 fix(esp_tee): Fix build failure due to ECDSA-P384 2025-08-15 12:10:36 +05:30
Harshal Patil 2f15501cae Merge branch 'ci/enable_flash_enc_test_esp32p4' into 'master' 
Enable flash encryption test case for ESP32-P4 in the CI

Closes IDF-10982

See merge request espressif/esp-idf!41026
 2025-08-13 09:46:04 +05:30
harshal.patil 16873520fd ci(flash_enc): Extend flash encryption and mbedtls test case to test PSRAM encryption 2025-08-12 11:29:00 +05:30
harshal.patil 9e87b50307 change(mbedtls/ecdsa): The ECDSA module of ESP32-H2 ECO5 does not use MPI module 2025-08-11 12:08:51 +05:30
Harshal Patil eae2f70381 Merge branch 'change/remove_esp_security_dependency_from_esp_hw_support' into 'master' 
Move security-related modules present in esp_hw_support component to esp_security

Closes IDF-10733

See merge request espressif/esp-idf!39490
 2025-08-06 06:27:12 +05:30
harshal.patil 60ff4bca9b refactor(esp_system): Update all references of the memory protection configs 2025-08-04 11:43:01 +05:30
harshal.patil abaef73667 refactor(esp_system): Place all memory protection options under one option 2025-08-04 11:43:01 +05:30
harshal.patil 5c6c73ece4 change(riscv): Remove redundant definition of MEMPROT_ISR 2025-08-04 11:43:01 +05:30
harshal.patil d70b5000cc remove(esp_hw_support): Remove redundant and unsupported memprot mentions 2025-08-04 11:43:01 +05:30
harshal.patil 55e0730a8d change(esp_hw_support): Move security-related modules to the esp_security component 
- Also adds support to whitelist target specific expected dependency violations
in check_dependencies.py
 2025-08-04 11:43:01 +05:30
Harshal Patil 7043cbf615 Merge branch 'docs/update_bootloader_max_size' into 'master' 
docs(bootloader): Update the maximum supported bootloader size

See merge request espressif/esp-idf!40787
 2025-07-24 17:34:06 +05:30
harshal.patil 35944b8a4d docs(bootloader): Change the default value of maximum supported bootloader size 2025-07-24 15:56:41 +05:30
Harshal Patil 8ab9e36eec Merge branch 'docs/update_bootloader_max_size' into 'master' 
Update the maximum supported bootloader size

See merge request espressif/esp-idf!40506
 2025-07-24 15:42:40 +05:30
harshal.patil c8e4b69e7f fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-24 12:42:57 +05:30
harshal.patil f4b329386f docs(bootloader): Update the maximum supported bootloader size 2025-07-23 11:17:54 +05:30
harshal.patil 4fc9fd4891 fix(esp_system): Remove redundant crypto clock source selection 2025-07-21 09:19:42 +05:30
harshal.patil 94019776bd ci(security): Security test app updated yml 
- Also fixes the errors generated by the check-test-scripts command
 2025-07-21 09:19:42 +05:30
harshal.patil dbcaddb745 docs(secure-boot-v2): Update the signature verification timings 
- THe timings are calculated for the ROM verifying the bootloader's signature
 2025-07-21 09:19:42 +05:30
harshal.patil 37e5c0701a docs(secure_boot_v2): Add documentation for Secure Boot V2 using ECDSA-P384 2025-07-21 09:19:42 +05:30
harshal.patil 0f51640674 test(secure_boot): Add tests for ECDSA-based secure boot scheme 2025-07-21 09:19:42 +05:30
harshal.patil 5699619606 test(examples/efuse): Add test for secure boot v2 using ecdsa-p384 2025-07-21 09:19:42 +05:30
harshal.patil 130e72f82b feat(bootloader_support): Support Secure Boot using ECDSA-P384 curve 2025-07-21 09:19:42 +05:30
harshal.patil 03ea07155a change(bootloader_support/secure_boot): Allow NULL as verified_digest for app build 
The esp_secure_boot_verify_sbv2_signature_block() and esp_secure_boot_verify_rsa_signature_block()
APIs need and use the verified_digest argument only for BOOTLOADER_BUILD, but the argument is
not used in the application code, and the value present in verified_digest is considered invalid.
Thus, allow passing NULL as the verified_digest parameter to help some save space.
 2025-07-21 09:19:42 +05:30
harshal.patil 3f9ab5d5e7 fix(bootloader_support/secure_boot): Fix incorrect usage of ESP_SECURE_BOOT_KEY_DIGEST_LEN 2025-07-21 09:19:42 +05:30
harshal.patil dce0925f40 fix(esp_security/esp_key_mgr): Incorrect overlapping comparisons 2025-07-03 15:05:50 +05:30
Harshal Patil 78faa2535c Merge branch 'feat/support_key_manager_esp32c5' into 'master' 
Support key manager esp32c5

Closes IDF-12626, IDF-12628, IDF-12629, IDF-8621, IDF-9007, IDF-12855, IDF-9070, IDF-7902, and IDF-7548

See merge request espressif/esp-idf!38894
 2025-07-01 11:36:19 +05:30
harshal.patil bba1448128 feat(esp_key_mgr): Support PSRAM XTS-AES key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil ffefa9902d test(mbedtls): Extend the mbedtls ecdsa tests 2025-06-27 15:15:26 +05:30
harshal.patil eb7c5654f6 test(esp_security): Extend the key manager tests 2025-06-27 15:15:26 +05:30
harshal.patil ea322ee6ef test(hal/crypto): Add HMAC and DS using Key Manager key tests 
- Also updated the test app to use esp_crypto_periph_clk.h
 2025-06-27 15:15:26 +05:30
harshal.patil 6ca4d621b5 test(crypto): Change partition address and update the test cases 
- Also format key manager test cases generation script
 2025-06-27 15:15:26 +05:30
harshal.patil 50c41c3b59 change(esp_key_mgr): Refactor Key Manager driver to reduce logs 2025-06-27 15:15:26 +05:30
harshal.patilandLi HongXi a7af364112 fix(esp_security): Power up MPI memory registers when enabling MPI 
Co-authored-by: Li HongXi <lihongxi@espressif.com>
 2025-06-27 15:15:26 +05:30
harshal.patil 33d8c05d95 feat(esp_key_mgr): Support Digital Signature key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 265b0d7579 feat(esp_key_mgr): Support HMAC key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 8ab6b4d694 fix(esp_security/esp_key_mgr): Recharge HUK before the first usage 2025-06-27 15:15:26 +05:30
harshal.patil a7c7b75dfd feat(soc): Update ESP32-C5's key manager reg and struct files to ECO2 
- Also added a new soc_cap to denote if key manager key deployment is available
 2025-06-27 15:15:26 +05:30
harshal.patil 8de2eb01da fix(bootlaoder): Fix documentation as ESP32 does not support secure download mode 2025-06-20 10:50:28 +05:30
harshal.patil 6fe38c7efd fix(mbedtls): re-include Comodo AAA Services root 2025-06-16 15:55:39 +05:30
Harshal Patil c85075dc12 Merge branch 'update/update_cmn_crt_authorities_csv' into 'master' 
Update common cert authorities csv

See merge request espressif/esp-idf!39564
 2025-06-09 12:08:03 +05:30
harshal.patil 85ec4df4db change(mbedlts/port): Remove deprecated header files 2025-06-06 14:52:03 +05:30
harshal.patil fe78370ec9 feat(mbedtls/sha): New API for setting SHA mode 2025-06-06 14:51:44 +05:30
harshal.patil afdf1a31c8 feat(soc): Update ESP32-C5 ECO2 to support SHA512 2025-06-06 14:51:44 +05:30
Harshal Patil e05390f338 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!39302
 2025-05-29 11:12:38 +05:30
harshal.patil 65642866bc change(mbedtls/esp_crt_bundle): Remove deprecated certs for the major release version (v6.0) 2025-05-28 23:16:47 +05:30
Harshal Patil fe40cc8f8b Merge branch 'fix/suppress_cert_bundle_serial_number_warning' into 'master' 
fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning

Closes IDFCI-2945

See merge request espressif/esp-idf!39381
 2025-05-26 13:19:00 +05:30
Harshal Patil d8d8e91a80 Merge branch 'fix/all_crypto_periphs_reset_cause_sec_reset' into 'master' 
fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals

Closes IDF-13064, IDFCI-2878, and IDFCI-2877

See merge request espressif/esp-idf!39357
 2025-05-26 11:40:06 +05:30
harshal.patilandMahavir Jain 5ae42e6f0b fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-23 09:28:42 +05:30
harshal.patil e08189f37b fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals 2025-05-22 16:01:02 +05:30
Harshal Patil e70f2705f3 Merge branch 'fix/enable_ecdsa_verify_sw_fallback_when_p192_disabled' into 'master' 
Enable signature verification s/w fallback when ECDSA-P192 is disabled

See merge request espressif/esp-idf!39039
 2025-05-14 21:06:03 +08:00
harshal.patil 0154c7cfe3 fix(mbedtls): Enable signature verification s/w fallback when ECDSA curve is disabled 2025-05-14 12:31:56 +05:30
Harshal Patil 51fef26287 Merge branch 'fix/configure_xip_psram_alignment_gaps_heap_by_default' into 'master' 
Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled

See merge request espressif/esp-idf!38888
 2025-05-12 15:07:07 +08:00
harshal.patil 3123fff18a fix(esp_psram): Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled 2025-05-05 10:50:19 +05:30
Harshal Patil d898c2398b Merge branch 'feat/some_xip_psram_related_optimisations_and_fixes' into 'master' 
feat(esp_psram): Fix late PSRAM init and add some wasted XIP PSRAM memory in heap

Closes IDF-11463 and IDF-10555

See merge request espressif/esp-idf!37116
 2025-04-30 00:02:19 +08:00
harshal.patil 43a0026701 fix(hal/sha): Fix unaligned memory access in case of non-byte aligned regions 2025-04-29 14:08:42 +05:30
harshal.patil 003b54ebfe feat(esp_psram): XIP from PSRAM can be used only when SPIRAM_BOOT_INIT=y for ESP32P4 
In case of ESP32-P4, if SPIRAM memory initialisations are not performed during
boot-up, XIP PSRAM can be setup because of different virtual range of PSRAM and Flash
 2025-04-29 11:48:28 +05:30
harshal.patil c67901fc07 ci(esp_psram): Add a test to validate non-bootup PSRAM initialisation 
- Also adds a test for the newly added PSRAM helper APIs:
esp_psram_get_heap_pool_size() and esp_psram_get_effective_mapped_size()
 2025-04-29 11:48:28 +05:30
harshal.patil f58c78b644 fix(esp_psram): Fix loading PSRAM XIP segments after PMP split has been configured 2025-04-29 11:48:27 +05:30
harshal.patil ab229a34b3 feat(cpu_region_protect): Enable basic memory protection for SPIRAM 2025-04-29 11:48:27 +05:30
harshal.patil 49f253361e feat(esp_psram): Add the gap created due to alignment of XIP segments in heap 2025-04-29 11:48:27 +05:30
harshal.patil 0f628496c8 feat(esp_psram): Add some helper APIs to get usable PSRAM memory size 2025-04-29 11:48:27 +05:30