Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
52,372 Commits 25 Branches 192 Tags
2c5fa76a804b4eaa4d3aa1279da74daa169a2a0e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Laukik Hase a8c30b7d6f Merge branch 'feat/tee_post_srv_stack_cleanup' into 'master' 
feat(esp_tee): Clear out all sensitive buffers explicitly after TEE cryptographic operations

Closes IDF-15671

See merge request espressif/esp-idf!48004
 2026-05-13 11:57:26 +05:30
Laukik Hase 281d219fac feat(esp_tee): Clear out all sensitive buffers explicitly after TEE crypto operations 2026-05-12 13:56:28 +05:30
Laukik Hase 51ac92e737 ci(esp_tee): Add test-case for verifying the TEE Secure Storage encryption 2026-05-11 16:56:57 +05:30
Laukik Hase 4f3f1dff5a feat(esp_tee): Add some required fields in the attestation token 
- Chip ID from the ROM
- Device MAC address from eFuse BLK1
- Device Optional Unique ID from eFuse BLK2
 2026-05-11 16:29:19 +05:30
Laukik Hase d4308fa9f9 fix(esp_hw_support): Add PMP entry for LP peripherals region on P4 v3+ 2026-04-28 18:13:16 +05:30
Laukik Hase 764626a1b7 change(esp_tee): Move the internal memory secure service call table to IRAM 
- Using PMA, the TEE IRAM is marked as R/X while TEE DRAM is marked as R/W.
  Moving the internal memory secure service call table from DRAM to IRAM
  makes it immutable.
 2026-04-13 12:43:26 +05:30
Laukik Hase 145ba4c42d fix(esp_tee): Add missing input validation checks for TEE service calls 
- MULTI_HEAP_ASSERT for TEE now aborts on failure, instead of ignoring the condition
- Prevent potential TEE OTA write bounds overflow
 2026-04-07 10:05:06 +05:30
Laukik Hase aa89395a9c Merge branch 'fix/esp32c61_rom_stack_addr' into 'master' 
fix(soc): Correct the ESP32-C61 ROM stack start address

See merge request espressif/esp-idf!47099
 2026-03-30 18:16:20 +05:30
Laukik Hase fc67c01995 ci(esp_tee): Fix TEE test-suite failures with Secure Boot enabled 2026-03-30 13:56:35 +05:30
Laukik Hase 9e21a52202 fix(soc): Correct the ESP32-C61 ROM stack start address 2026-03-30 12:46:58 +05:30
Laukik Hase 9f671697e2 Merge branch 'ci/esp_tee_fixes' into 'master' 
feat(esp_tee): Miscellaneous fixes and improvements

Closes IDFCI-7275, IDFCI-7699, IDFCI-8744, IDF-14975, and IDF-15028

See merge request espressif/esp-idf!46598
 2026-03-18 07:19:51 +05:30
Laukik Hase 250d757bb9 feat(esp_tee): Miscellaneous fixes and improvements 
- Fix intermittent TEE stack underflow test failures
- Fix out-of-bounds access Coverity report from the attestation
  component
- Add appropriate checks and asserts for TEE flash memory regions'
  sizes
 2026-03-16 10:46:11 +05:30
Laukik Hase 1246224a92 Merge branch 'ci/tee_intr_tests_p4' into 'master' 
ci(hal): Enable the TEE-based interrupt test-cases for ESP32-P4

Closes IDF-13510, IDF-13788, and IDF-13789

See merge request espressif/esp-idf!44986
 2026-03-05 18:27:55 +05:30
Laukik Hase 99f6d7cd56 ci(hal): Enable the TEE-based interrupt test-cases for ESP32-P4 2026-02-18 11:46:15 +05:30
Laukik Hase a84acc0706 Merge branch 'fix/tee_sec_stg_aes_iv_leftovers' into 'master' 
refactor(esp_tee): Remove leftover references to the secure storage AES-GCM IV

See merge request espressif/esp-idf!45825
 2026-02-16 14:30:55 +05:30
Laukik Hase 3593995a43 refactor(esp_tee): Remove leftover references to the secure storage AES-GCM IV 2026-02-14 16:19:57 +05:30
Laukik Hase c5d72691e6 Merge branch 'feat/esp_tee_misc_optim' into 'master' 
feat(esp_tee): Miscellaneous updates and optimizations

See merge request espressif/esp-idf!45634
 2026-02-11 11:31:08 +05:30
Laukik Hase 1d425cee8e feat(esp_tee): Remove unused components from the PSA Crypto library 2026-02-10 13:52:30 +05:30
Laukik Hase c0523c7771 ci(esp_tee): Removed common_components dependency from ESP-TEE test-apps 2026-02-10 13:52:30 +05:30
Laukik Hase db63407d64 Merge branch 'fix/tee_sec_stg_aes_gcm_iv_reuse' into 'master' 
fix(esp_tee): Prevent IV reuse in the TEE secure storage AES-GCM service

See merge request espressif/esp-idf!45064
 2026-02-06 09:35:24 +05:30
Laukik Hase 85e66d726d fix(esp_tee): Prevent IV reuse in the TEE secure storage AES-GCM service 2026-02-05 14:53:21 +05:30
Laukik Hase b6c54be94f fix(esp_tee): Fix incorrect path of APM HAL in the TEE linker scripts 2026-01-28 10:12:48 +05:30
Laukik Hase 31b113b649 fix(esp_tee): Fix TEE attestation stack protection fault with secure boot enabled 
- Increased the TEE stack when secure boot is enabled
- Also, generate a build error when the generated TEE binary image size is
  greater than the TEE partition size
 2026-01-20 16:40:03 +05:30
Laukik Hase 4007acade6 Merge branch 'feat/esp_tee_attestation_psa' into 'master' 
feat(esp_tee): Migrate TEE attestation to the PSA interface

See merge request espressif/esp-idf!44706
 2026-01-17 11:03:10 +05:30
Laukik Hase 2d1b8de05e feat(esp_tee): Remove unused components from the PSA Crypto library 2026-01-16 17:53:16 +05:30
Laukik Hase 85681d7586 refactor(esp_tee): Remove support for ECDSA secp192r1 keys in TEE secure storage 2026-01-16 17:53:16 +05:30
Laukik Hase 2a0dffc437 docs(esp_tee): Update the TEE attestation documentation for the PSA interface 2026-01-16 12:28:59 +05:30
Laukik Hase 169f40658d refactor(esp_tee): Update TEE attestation tests and examples to use the PSA interface 2026-01-16 12:28:58 +05:30
Laukik Hase 89f555d698 feat(esp_tee): Migrate TEE attestation to the PSA interface 2026-01-16 12:28:57 +05:30
Laukik Hase 66ed9d2b4b ci(esp_tee): Optimize the TEE pytest script 2026-01-12 18:29:44 +05:30
Laukik Hase b15334600d Merge branch 'refactor/esp_tee_picolibc' into 'master' 
refactor(esp_tee): Adopt `Picolibc` as the default LibC for ESP-TEE build

See merge request espressif/esp-idf!44050
 2026-01-02 10:38:47 +05:30
Laukik Hase 406ca9aa92 ci(esp_tee): Enable the tee_cli_app test-app for ESP32-H2 
- Also set the RX burst size correctly for AES/SHA DMA operations
  with ESP-TEE
- Fix the compile-time minimum chip revision check for patching
  the `ets_delay_us` API
 2025-12-30 16:03:43 +05:30
Laukik Hase 0964024484 refactor(esp_tee): Adopt Picolibc as the default LibC for ESP-TEE build 
- Also fixed an issue where NewLib ROM APIs, when called from TEE, were
  using the syscall table located in the REE SRAM. This could be abused
  as an attack vector to invoke illegal functions from the TEE.
  To prevent this, the syscall table is now switched to the TEE-specific
  copy during every M-U mode transition.
 2025-12-30 16:03:41 +05:30
Laukik Hase f6b8795435 ci(esp_tee): Sync the build manifest file and test scripts for ESP-TEE examples 2025-12-08 18:26:03 +05:30
Laukik Hase 90d6394911 feat(esp_tee): Support ECDSA secp384r1 keys in TEE secure storage 2025-12-04 11:16:29 +05:30
Laukik Hase 1eeb2e7476 Merge branch 'feat/esp_tee_enable_gdma_burst' into 'master' 
feat(esp_tee): Enable GDMA burst mode for AES/SHA operations

See merge request espressif/esp-idf!43801
 2025-12-02 14:32:25 +05:30
Laukik HaseandHarshal Patil 150418fb5d feat(esp_tee): Enable GDMA burst mode for AES/SHA operations 
Co-authored-by: Harshal Patil <harshal.patil@espressif.com>
 2025-12-01 12:31:17 +05:30
Laukik Hase c88f9c3be1 feat(esp_tee): Mark ESP32-H2 as a supported target for ESP-TEE 2025-11-25 10:13:31 +05:30
Laukik Hase 7c24682643 feat(esp_tee): Add support for the RISC-V H/W stack guard mechanism 2025-11-24 18:49:06 +05:30
Laukik Hase 9ee468a096 Merge branch 'feat/tee_c61_examples_and_docs' into 'master' 
feat(esp_tee): Enable ESP-TEE examples and documentation for ESP32-C61

Closes IDF-14254 and IDF-14255

See merge request espressif/esp-idf!43251
 2025-11-13 15:18:42 +05:30
Laukik Hase 7a1ab62cf7 docs(esp_tee): Enable ESP-TEE documentation for ESP32-C61 2025-11-12 12:48:27 +05:30
Laukik Hase b6a51f0ff6 ci(esp_tee): Enable the TEE examples for ESP32-C61 2025-11-12 12:48:26 +05:30
Laukik Hase d2f8a8f86a Merge branch 'feat/esp_tee_c61' into 'master' 
feat(esp_tee): Support for ESP32-C61

Closes IDF-14253

See merge request espressif/esp-idf!42054
 2025-11-11 11:42:37 +05:30
Laukik Hase 5b80a58953 ci(esp_tee): Enable the TEE test-apps for ESP32-C61 2025-11-07 14:54:16 +05:30
Laukik Hase f533502324 feat(esp_tee): Add support for TEE secure storage encryption for ESP32-C61 2025-11-07 14:54:16 +05:30
Laukik Hase b9a503e9ec feat(esp_tee): Support for ESP32-C61 - the rest of the components 2025-11-07 14:54:16 +05:30
Laukik Hase bbdd1499f1 feat(esp_tee): Support for ESP32-C61 - the esp_tee component 2025-11-07 14:54:11 +05:30
Laukik Hase 32eb85066e Merge branch 'ci/tee_flash_prot_failures' into 'master' 
ci(esp_tee): Remove incorrect error checks for TEE flash protection tests

Closes IDFCI-3299, IDFCI-4947, IDFCI-4092, IDFCI-4093, and IDF-14283

See merge request espressif/esp-idf!43140
 2025-11-06 17:14:21 +05:30
Laukik Hase fdc86f8f7d Merge branch 'fix/tee_hal_ci_failures' into 'master' 
ci(hal/tee): Fix intermittent hang-ups in `PERI_APM` tests on ESP32-C5

Closes IDFCI-3274, IDFCI-4807, and IDFCI-4808

See merge request espressif/esp-idf!42937
 2025-11-06 16:39:09 +05:30
Laukik Hase e27e0eb6a7 ci(esp_tee): Remove incorrect error checks for TEE flash protection tests 
- Also fixed coverity issue from TEE secure storage
 2025-11-06 12:22:36 +05:30
Laukik Hase 905913a8db Merge branch 'ci/esp_tee_c5_enable' into 'master' 
ci(esp_tee): Re-enable test-apps and examples for ESP32-C5

Closes IDF-10431, IDFCI-3086, and IDFCI-3097

See merge request espressif/esp-idf!42791
 2025-11-05 16:06:04 +05:30
Laukik Hase bcfe915b74 ci(hal/tee): Fix intermittent hang-ups in PERI_APM tests on ESP32-C5 2025-11-04 11:35:52 +05:30
Laukik Hase 3f82eaed0f ci(esp_tee): Enable the TEE examples for ESP32-C5 2025-11-04 11:33:52 +05:30
Laukik Hase 052f380262 ci(esp_tee): Re-enable the TEE test-apps for ESP32-C5 2025-11-04 11:33:51 +05:30
Laukik Hase eb74a5f9dd feat(esp_tee): Enable MSPI tuning for Flash and PSRAM 2025-10-22 11:44:34 +05:30
Laukik Hase 02cb0425b9 fix(esp_tee): Handle the SPI1 WB mode incompatibility in TEE flash APIs on ESP32-C5 
- When `esp_flash_read()` is invoked from REE, it internally enables WB mode
  via `spi_flash_ll_wb_mode_enable()`. However, the ROM flash APIs used by TEE
  do not support WB mode, resulting in failures when TEE attempts to access
  flash after this call.
- This commit adds a workaround in the TEE flash layer by saving WB mode state,
  temporarily disabling it for ROM API calls, and restoring it afterward.
 2025-10-22 11:44:34 +05:30
Laukik Hase 71aff04c0d fix(esp_tee): Use HAL APIs instead of ROM APIs for SPI flash service calls 
Currently, REE SPI flash HAL operations are routed as service calls to TEE,
but the TEE implementation incorrectly uses ROM APIs instead of HAL APIs.
This leads to issues and is not the recommended approach.
 2025-10-22 11:44:33 +05:30
Laukik Hase 66c16561f5 Merge branch 'fix/c5_tee_sram_prot' into 'master' 
fix(esp_tee): Split TEE SRAM as I/DRAM for ESP32-C5 with PMA

See merge request espressif/esp-idf!42347
 2025-10-17 10:21:09 +05:30
Laukik Hase 9de1d631b4 feat(esp_tee): Reclaim unused TEE IRAM memory as heap 
- Changed the default TEE code placement to use the flash
  text section instead of IRAM text, making it consistent
  with the default data placement.
 2025-10-15 18:22:44 +05:30
Laukik Hase 20344640e3 fix(esp_tee): Split TEE SRAM as I/DRAM for ESP32-C5 with PMA 2025-10-15 18:22:43 +05:30
Laukik Hase 8770ae9db4 fix(esp_tee): Sync TEE-REE intr thresholds during service calls from critical sections 
- Previously, only the U-mode interrupt threshold was raised in REE critical sections,
  leaving M-mode at the lowest level.
- As a result, when a service call transitioned to M-mode, all interrupts were still
  allowed to fire, including those that should have been masked.
 2025-10-15 12:33:31 +05:30
Laukik Hase 6e51fac96e Merge branch 'fix/esp_tee_flash_op_bound_checks' into 'master' 
fix(esp_tee): Correct flash operation bound checks to handle all overlap cases

Closes IDF-14129

See merge request espressif/esp-idf!41946
 2025-10-13 13:31:03 +05:30
Laukik Hase 88444df58b Merge branch 'docs/esp_tee_c5' into 'master' 
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5

Closes IDF-10432

See merge request espressif/esp-idf!42390
 2025-10-13 09:29:20 +05:30
Laukik Hase afe8fea489 docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5 2025-10-06 18:49:01 +05:30
Laukik Hase 466c1d66b6 refactor(esp_tee): Remove the spi_flash_erase_chip service call 
- Also fix coverity bug from TEE HMAC-PBKDF2 routine
 2025-09-30 12:22:26 +05:30
Laukik Hase 8b92f3603f fix(esp_tee): Correct flash operation bound checks to handle all overlap cases 
- Ensure bound checks correctly handle all scenarios, including
  when a requested operation's (SPI0/1) range fully contains the
  TEE-protected region.
- Disable delegation of INTWDT timeout and Cache error interrupts as they reset
  the device after the panic handler
 2025-09-30 12:22:25 +05:30
Laukik Hase 649741fa9d Merge branch 'feat/nvs_flash_deregister_sec_scheme' into 'master' 
feat(nvs_flash): Added an API to deregister the NVS security scheme context

Closes IDF-12456 and IDFGH-16210

See merge request espressif/esp-idf!41073
 2025-09-22 11:11:34 +05:30
Laukik Hase ac89a6f896 Merge branch 'feature/esp_tee_sec_stg_sign_w_pbkdf2' into 'master' 
feat(esp_tee): Support for PBKDF2-based (HMAC) ECDSA signing

See merge request espressif/esp-idf!41074
 2025-09-20 10:28:00 +05:30
Laukik Hase c152663408 feat(esp_tee): Added support for PBKDF2-based (HMAC) ECDSA signing 2025-09-19 12:06:02 +05:30
Laukik Hase 1ea0fc261d change(nvs_sec_provider): Make the HMAC-based NVS security scheme default for supported SoCs 
- When NVS encryption is enabled on SoCs with the HMAC peripheral that have flash encryption
  enabled, the HMAC-based NVS encryption scheme is now selected as default instead of the
  flash encryption-based scheme.
- If your application previously used the flash encryption-based scheme, you need to manually
  configure the NVS encryption scheme to flash encryption from HMAC through ``menuconfig``
  or your project's ``sdkconfig`` (i.e., setting ``CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y``).
 2025-09-19 10:38:38 +05:30
Laukik Hase f565fc2481 change(nvs_flash): Add a private dependency of the nvs_sec_provider component 
- Closes https://github.com/espressif/esp-idf/issues/17256
 2025-09-19 10:17:46 +05:30
Laukik Hase f60bcaaa4d feat(nvs_flash): Added an API to deregister the NVS security scheme context 2025-09-19 10:17:45 +05:30
Laukik Hase 537b36de7a Merge branch 'fix/esp_tee_misc' into 'master' 
feat(esp_tee): Miscellaneous fixes and updates

Closes IDF-13856, IDFCI-3085, IDFCI-3094, and IDFCI-3105

See merge request espressif/esp-idf!41433
 2025-09-17 13:36:22 +05:30
Laukik Hase 57432bb336 fix(esp_tee): Skip taking the service call mutex when in critical sections 
- Fixes INT_WDT timeouts with mmap operations
- Add test-case for verifying parallel service calls
 2025-09-16 14:57:27 +05:30
Laukik Hase d8edbc8acf feat(esp_tee): ASM routine fixes and improvements 
- Fix incorrect setting in the edge interrupt acknowledgement API
- Avoid executing the service call dispatcher in the U-mode ecall,
  rather execute `mret` to jump it
- Avoid `t1` register corruption when processing `ecall`
- Switch back to the bootloader stack from TEE stack after the
  execution of the entire TEE initialization routine
 2025-09-16 14:57:10 +05:30
Laukik Hase 8b812d4192 feat(esp_tee): Miscellaneous fixes and updates 
- Rename `tee_test_fw` app configs for better CI tracking
- Decrease the lower bound of TEE I/DRAM config options
- Trim the TEE test-apps build
- Improve the TEE/REE OTA pytest script with additional checks
- Fix build issues when `tee_sec_storage`/`tee_ota_ops` are a
  a part of the project build but ESP-TEE is disabled
 2025-09-16 14:54:06 +05:30
Laukik Hase ba80256748 Merge branch 'ci/esp_tee_disable_c5_temp' into 'master' 
ci(esp_tee): Disable the TEE test-apps for ESP32-C5 temporarily

See merge request espressif/esp-idf!41356
 2025-08-19 16:37:16 +05:30
Laukik Hase 9b807a253d ci(esp_tee): Disable the TEE test-apps for ESP32-C5 temporarily 2025-08-18 18:42:02 +05:30
Laukik Hase bb55b0cefc ci(esp_tee): Enable the TEE test-apps for ESP32-C5 2025-08-13 14:09:00 +05:30
Laukik Hase ab8400df4a ci(esp_tee): Refactor the ESP-TEE test-cases 
- Improve the interrupt-related test cases
- Fix potential issues in the task-switching test
  during secure service calls
 2025-08-13 14:09:00 +05:30
Laukik Hase 340de9823a feat(esp_tee): Support for ESP32-C5 - the rest of the components 2025-08-13 14:08:59 +05:30
Laukik Hase 11d3a2480f feat(esp_tee): Support for ESP32-C5 - the esp_tee component 2025-08-13 14:08:58 +05:30
Laukik Hase f2b0f256ab fix(esp_rom): Patch the esp_rom_delay_us API to use U-mode cycle CSR 2025-07-25 09:54:42 +05:30
Laukik Hase 3d402ca938 ci(hal): Extend the PMS hal test-app for verifying TEE-based interrupt scenarios 2025-07-23 10:00:24 +05:30
Laukik Hase 95efe53cde Merge branch 'ci/tee_apm_pms_test_app' into 'master' 
ci(hal): Add HAL/LL-based test app for the TEE and APM peripherals

Closes IDF-8614, IDF-8615, IDF-9229, IDF-9230, IDF-10422, IDF-12646, IDF-12647, IDF-12648, IDF-12649, and IDF-12877

See merge request espressif/esp-idf!39873
 2025-07-03 10:08:58 +05:30
Laukik Hase 15a4d63441 ci(hal): Add HAL/LL-based test app for the TEE and APM peripherals 2025-07-01 17:27:46 +05:30
Laukik Hase d8601f8245 feat(hal): Add CPU_APM support for ESP32-C61 2025-07-01 17:27:45 +05:30
Laukik Hase 7f7d0afe40 Merge branch 'fix/esp_tee_coverity_issues' into 'master' 
fix(esp_tee): Fix coverity issue from the `attestation` component

Closes IDF-12867

See merge request espressif/esp-idf!40054
 2025-06-27 18:24:24 +05:30
Laukik Hase 9b1aaa2778 fix(esp_tee): Fix coverity issues from the attestation component 
- Also fix the incorrect marker set for TEE OTA tests
 2025-06-23 11:45:12 +05:30
Laukik Hase 5b7922b028 Merge branch 'refactor/apm_tee_ll_hal' into 'master' 
refactor(hal): Refactor the APM LL/HAL APIs

Closes IDF-10423 and IDF-12830

See merge request espressif/esp-idf!38522
 2025-06-09 09:13:26 +05:30
Laukik Hase 0d8a1f5427 refactor(hal): Refactor the APM LL/HAL APIs 2025-06-06 18:28:47 +05:30
Laukik Hase a1c6d2a458 fix(esp_tee): Fix failing SPI1 flash protection test-cases 2025-05-22 17:35:09 +08:00
Laukik Hase b8e48fbfc0 ci(esp_tee): Enable the tee_test_fw test app for ESP32-H2 2025-05-20 16:31:23 +05:30
Laukik Hase 12e2df2d74 feat(esp_tee): Support for ESP32-H2 - the rest of the components 2025-05-20 16:31:23 +05:30
Laukik Hase 958f4b8900 feat(esp_tee): Support for ESP32-H2 - the esp_tee component 2025-05-20 16:31:22 +05:30
Laukik Hase e5a8ea0ab1 Merge branch 'fix/c5_default_apm_cfg' into 'master' 
fix(security): Set all APM masters to operate in TEE mode by default

See merge request espressif/esp-idf!39006
 2025-05-12 12:14:00 +08:00
Laukik Hase 8a999ea19e fix(security): Set all APM masters to operate in TEE mode by default 2025-05-11 10:01:11 +05:30
Laukik Hase 7411eafb2e Merge branch 'refactor/esp_tee_sec_stg' into 'master' 
refactor(esp_tee): Revamp the TEE Secure Storage format

Closes IDF-9180

See merge request espressif/esp-idf!36878
 2025-05-07 13:40:06 +08:00
Laukik Hase c16fc04c2d docs(esp_tee): Revise TEE secure storage and related documentation 2025-05-04 18:22:22 +05:30
Laukik Hase 033397b877 fix(esp_tee): Add standard newlib function stubs to resolve build warnings 
- Disable C++ exceptions for TEE build to reduce flash footprint
 2025-05-04 18:03:30 +05:30