Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
46,828 Commits 25 Branches 192 Tags
35f5dcf16d11bb6e2c90822e232cdc65e0a86b21
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
harshal.patil 5aa5366e7f fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-09-19 17:01:23 +05:30
harshal.patil d6c1184676 fix(bootloader_support): Reorder write protection bits of some shared security efuses 2025-09-19 13:02:00 +05:30
Harshal Patil de36c80335 Merge branch 'fix/key_mgr_state_management' into 'master' 
Fix incorrect key manager state management

See merge request espressif/esp-idf!41796
 2025-09-12 17:09:52 +05:30
harshal.patil 854ec3590f fix(esp_key_mgr): Fix incorrect key manager state management 2025-09-12 11:02:45 +05:30
Harshal Patil 511292ba41 Merge branch 'fix/disable_efuse_xts_aes_256_esp32c5' into 'master' 
Disable XTS-AES-256 using efuse key for ESP32-C5

See merge request espressif/esp-idf!41348
 2025-08-20 21:33:39 +05:30
harshal.patil d59bcb633c fix(soc): Disable XTS-AES-256 using efuse key for ESP32-C5 2025-08-19 21:54:26 +05:30
harshal.patil da5dda1131 fix(esp_tee): Fix build failure due to ECDSA-P384 2025-08-15 12:10:36 +05:30
Harshal Patil 2f15501cae Merge branch 'ci/enable_flash_enc_test_esp32p4' into 'master' 
Enable flash encryption test case for ESP32-P4 in the CI

Closes IDF-10982

See merge request espressif/esp-idf!41026
 2025-08-13 09:46:04 +05:30
harshal.patil 16873520fd ci(flash_enc): Extend flash encryption and mbedtls test case to test PSRAM encryption 2025-08-12 11:29:00 +05:30
harshal.patil 9e87b50307 change(mbedtls/ecdsa): The ECDSA module of ESP32-H2 ECO5 does not use MPI module 2025-08-11 12:08:51 +05:30
Harshal Patil eae2f70381 Merge branch 'change/remove_esp_security_dependency_from_esp_hw_support' into 'master' 
Move security-related modules present in esp_hw_support component to esp_security

Closes IDF-10733

See merge request espressif/esp-idf!39490
 2025-08-06 06:27:12 +05:30
harshal.patil 60ff4bca9b refactor(esp_system): Update all references of the memory protection configs 2025-08-04 11:43:01 +05:30
harshal.patil abaef73667 refactor(esp_system): Place all memory protection options under one option 2025-08-04 11:43:01 +05:30
harshal.patil 5c6c73ece4 change(riscv): Remove redundant definition of MEMPROT_ISR 2025-08-04 11:43:01 +05:30
harshal.patil d70b5000cc remove(esp_hw_support): Remove redundant and unsupported memprot mentions 2025-08-04 11:43:01 +05:30
harshal.patil 55e0730a8d change(esp_hw_support): Move security-related modules to the esp_security component 
- Also adds support to whitelist target specific expected dependency violations
in check_dependencies.py
 2025-08-04 11:43:01 +05:30
Harshal Patil 7043cbf615 Merge branch 'docs/update_bootloader_max_size' into 'master' 
docs(bootloader): Update the maximum supported bootloader size

See merge request espressif/esp-idf!40787
 2025-07-24 17:34:06 +05:30
harshal.patil 35944b8a4d docs(bootloader): Change the default value of maximum supported bootloader size 2025-07-24 15:56:41 +05:30
Harshal Patil 8ab9e36eec Merge branch 'docs/update_bootloader_max_size' into 'master' 
Update the maximum supported bootloader size

See merge request espressif/esp-idf!40506
 2025-07-24 15:42:40 +05:30
harshal.patil c8e4b69e7f fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-24 12:42:57 +05:30
harshal.patil f4b329386f docs(bootloader): Update the maximum supported bootloader size 2025-07-23 11:17:54 +05:30
harshal.patil 4fc9fd4891 fix(esp_system): Remove redundant crypto clock source selection 2025-07-21 09:19:42 +05:30
harshal.patil 94019776bd ci(security): Security test app updated yml 
- Also fixes the errors generated by the check-test-scripts command
 2025-07-21 09:19:42 +05:30
harshal.patil dbcaddb745 docs(secure-boot-v2): Update the signature verification timings 
- THe timings are calculated for the ROM verifying the bootloader's signature
 2025-07-21 09:19:42 +05:30
harshal.patil 37e5c0701a docs(secure_boot_v2): Add documentation for Secure Boot V2 using ECDSA-P384 2025-07-21 09:19:42 +05:30
harshal.patil 0f51640674 test(secure_boot): Add tests for ECDSA-based secure boot scheme 2025-07-21 09:19:42 +05:30
harshal.patil 5699619606 test(examples/efuse): Add test for secure boot v2 using ecdsa-p384 2025-07-21 09:19:42 +05:30
harshal.patil 130e72f82b feat(bootloader_support): Support Secure Boot using ECDSA-P384 curve 2025-07-21 09:19:42 +05:30
harshal.patil 03ea07155a change(bootloader_support/secure_boot): Allow NULL as verified_digest for app build 
The esp_secure_boot_verify_sbv2_signature_block() and esp_secure_boot_verify_rsa_signature_block()
APIs need and use the verified_digest argument only for BOOTLOADER_BUILD, but the argument is
not used in the application code, and the value present in verified_digest is considered invalid.
Thus, allow passing NULL as the verified_digest parameter to help some save space.
 2025-07-21 09:19:42 +05:30
harshal.patil 3f9ab5d5e7 fix(bootloader_support/secure_boot): Fix incorrect usage of ESP_SECURE_BOOT_KEY_DIGEST_LEN 2025-07-21 09:19:42 +05:30
harshal.patil dce0925f40 fix(esp_security/esp_key_mgr): Incorrect overlapping comparisons 2025-07-03 15:05:50 +05:30
Harshal Patil 78faa2535c Merge branch 'feat/support_key_manager_esp32c5' into 'master' 
Support key manager esp32c5

Closes IDF-12626, IDF-12628, IDF-12629, IDF-8621, IDF-9007, IDF-12855, IDF-9070, IDF-7902, and IDF-7548

See merge request espressif/esp-idf!38894
 2025-07-01 11:36:19 +05:30
harshal.patil bba1448128 feat(esp_key_mgr): Support PSRAM XTS-AES key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil ffefa9902d test(mbedtls): Extend the mbedtls ecdsa tests 2025-06-27 15:15:26 +05:30
harshal.patil eb7c5654f6 test(esp_security): Extend the key manager tests 2025-06-27 15:15:26 +05:30
harshal.patil ea322ee6ef test(hal/crypto): Add HMAC and DS using Key Manager key tests 
- Also updated the test app to use esp_crypto_periph_clk.h
 2025-06-27 15:15:26 +05:30
harshal.patil 6ca4d621b5 test(crypto): Change partition address and update the test cases 
- Also format key manager test cases generation script
 2025-06-27 15:15:26 +05:30
harshal.patil 50c41c3b59 change(esp_key_mgr): Refactor Key Manager driver to reduce logs 2025-06-27 15:15:26 +05:30
harshal.patilandLi HongXi a7af364112 fix(esp_security): Power up MPI memory registers when enabling MPI 
Co-authored-by: Li HongXi <lihongxi@espressif.com>
 2025-06-27 15:15:26 +05:30
harshal.patil 33d8c05d95 feat(esp_key_mgr): Support Digital Signature key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 265b0d7579 feat(esp_key_mgr): Support HMAC key deployments using Key Manager 2025-06-27 15:15:26 +05:30
harshal.patil 8ab6b4d694 fix(esp_security/esp_key_mgr): Recharge HUK before the first usage 2025-06-27 15:15:26 +05:30
harshal.patil a7c7b75dfd feat(soc): Update ESP32-C5's key manager reg and struct files to ECO2 
- Also added a new soc_cap to denote if key manager key deployment is available
 2025-06-27 15:15:26 +05:30
harshal.patil 8de2eb01da fix(bootlaoder): Fix documentation as ESP32 does not support secure download mode 2025-06-20 10:50:28 +05:30
harshal.patil 6fe38c7efd fix(mbedtls): re-include Comodo AAA Services root 2025-06-16 15:55:39 +05:30
Harshal Patil c85075dc12 Merge branch 'update/update_cmn_crt_authorities_csv' into 'master' 
Update common cert authorities csv

See merge request espressif/esp-idf!39564
 2025-06-09 12:08:03 +05:30
harshal.patil 85ec4df4db change(mbedlts/port): Remove deprecated header files 2025-06-06 14:52:03 +05:30
harshal.patil fe78370ec9 feat(mbedtls/sha): New API for setting SHA mode 2025-06-06 14:51:44 +05:30
harshal.patil afdf1a31c8 feat(soc): Update ESP32-C5 ECO2 to support SHA512 2025-06-06 14:51:44 +05:30
Harshal Patil e05390f338 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!39302
 2025-05-29 11:12:38 +05:30
harshal.patil 65642866bc change(mbedtls/esp_crt_bundle): Remove deprecated certs for the major release version (v6.0) 2025-05-28 23:16:47 +05:30
Harshal Patil fe40cc8f8b Merge branch 'fix/suppress_cert_bundle_serial_number_warning' into 'master' 
fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning

Closes IDFCI-2945

See merge request espressif/esp-idf!39381
 2025-05-26 13:19:00 +05:30
Harshal Patil d8d8e91a80 Merge branch 'fix/all_crypto_periphs_reset_cause_sec_reset' into 'master' 
fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals

Closes IDF-13064, IDFCI-2878, and IDFCI-2877

See merge request espressif/esp-idf!39357
 2025-05-26 11:40:06 +05:30
harshal.patilandMahavir Jain 5ae42e6f0b fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-23 09:28:42 +05:30
harshal.patil e08189f37b fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals 2025-05-22 16:01:02 +05:30
Harshal Patil e70f2705f3 Merge branch 'fix/enable_ecdsa_verify_sw_fallback_when_p192_disabled' into 'master' 
Enable signature verification s/w fallback when ECDSA-P192 is disabled

See merge request espressif/esp-idf!39039
 2025-05-14 21:06:03 +08:00
harshal.patil 0154c7cfe3 fix(mbedtls): Enable signature verification s/w fallback when ECDSA curve is disabled 2025-05-14 12:31:56 +05:30
Harshal Patil 51fef26287 Merge branch 'fix/configure_xip_psram_alignment_gaps_heap_by_default' into 'master' 
Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled

See merge request espressif/esp-idf!38888
 2025-05-12 15:07:07 +08:00
harshal.patil 3123fff18a fix(esp_psram): Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled 2025-05-05 10:50:19 +05:30
Harshal Patil d898c2398b Merge branch 'feat/some_xip_psram_related_optimisations_and_fixes' into 'master' 
feat(esp_psram): Fix late PSRAM init and add some wasted XIP PSRAM memory in heap

Closes IDF-11463 and IDF-10555

See merge request espressif/esp-idf!37116
 2025-04-30 00:02:19 +08:00
harshal.patil 43a0026701 fix(hal/sha): Fix unaligned memory access in case of non-byte aligned regions 2025-04-29 14:08:42 +05:30
harshal.patil 003b54ebfe feat(esp_psram): XIP from PSRAM can be used only when SPIRAM_BOOT_INIT=y for ESP32P4 
In case of ESP32-P4, if SPIRAM memory initialisations are not performed during
boot-up, XIP PSRAM can be setup because of different virtual range of PSRAM and Flash
 2025-04-29 11:48:28 +05:30
harshal.patil c67901fc07 ci(esp_psram): Add a test to validate non-bootup PSRAM initialisation 
- Also adds a test for the newly added PSRAM helper APIs:
esp_psram_get_heap_pool_size() and esp_psram_get_effective_mapped_size()
 2025-04-29 11:48:28 +05:30
harshal.patil f58c78b644 fix(esp_psram): Fix loading PSRAM XIP segments after PMP split has been configured 2025-04-29 11:48:27 +05:30
harshal.patil ab229a34b3 feat(cpu_region_protect): Enable basic memory protection for SPIRAM 2025-04-29 11:48:27 +05:30
harshal.patil 49f253361e feat(esp_psram): Add the gap created due to alignment of XIP segments in heap 2025-04-29 11:48:27 +05:30
harshal.patil 0f628496c8 feat(esp_psram): Add some helper APIs to get usable PSRAM memory size 2025-04-29 11:48:27 +05:30
harshal.patil 46225a4026 feat(esp_psram): Add a new API to just detect and enable the PSRAM 
- esp_psram_chip_init() just detects and does basic initialisations of PSRAM
- esp_psram_init() initialises and maps/loads the PSRAM pages
 2025-04-29 11:48:27 +05:30
harshal.patil b0d9ccf6e3 fix(mbedtls): Fix config dependencies when ROM mbedtls is used 2025-04-21 13:38:29 +05:30
harshal.patil a42be5b1dd fix(wpa_supplicant): Disable fastpbkdf2 when s/w and h/w SHA1 is disabled 2025-04-21 13:38:29 +05:30
harshal.patil e738ec5ccd fix(esp-tls): Fix build failure when CONFIG_MBEDTLS_SHA1_C is disabled 2025-04-21 13:38:29 +05:30
harshal.patil 75fd14efbc fix(docs): Fix unterminated quotes in secure-boot-v2.rst 2025-04-21 11:18:22 +05:30
harshal.patil 9221c4eecd fix(examples): Example CA certs must contain the Key Usage parameter 
- Example CA certificates that are used for self-signed client certificates
need to include the Key Usage parameter.
- Python3.13 changed the default context of the SSL context that is
generated using ssl.create_default_context() by enabling the VERIFY_X509_STRICT
flag by default
 2025-04-03 09:20:35 +05:30
harshal.patil 4edd6c1f6d fix(bootloader_support): Fix sha handle memory leak when returning error 2025-03-27 09:18:30 +05:30
Harshal Patil a45d713b03 Merge branch 'refactor/unify_bootloader_sha' into 'master' 
Unify the bootloader_sha layer

Closes IDF-12704

See merge request espressif/esp-idf!37927
 2025-03-26 19:15:25 +08:00
harshal.patil a02dec09ca refactor(bootloader_support): Unify bootloader_sha layer 2025-03-21 16:37:20 +05:30
harshal.patil e442f11320 feat(mbedtls): Make mbedtls SHA1 support configurable 2025-03-19 14:28:40 +05:30
harshal.patil a6ea9bcd41 fix(secure_boot): Fix SB verification failure when sig block and key digest mismatch 
- Secure boot V2 verification failed when multiple keys are used to sign the bootloader
  and the application is signed with a key other than the first key that is used to
  sign the bootloader.
- The issue was introduced as a regression from the commit `ff16ce43`.
- Added a QEMU test for recreating the issue.
- Made SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT independent of SECURE_BOOT_BUILD_SIGNED_BINARIES.
 2025-03-04 11:26:51 +05:30
harshal.patil 700f62e206 feat(wpa_supplicant): Support all targets generically in fastpsk 2025-03-03 14:04:45 +05:30
harshal.patil a1e6387c16 fix(esp_psram): Fix incorrect calculation of used XIP PSRAM pages 
The functions mmu_config_psram_text_segment() and mmu_config_psram_rodata_segment()
used to return the value of next start page in *out_page instead of the number
of pages used as mentioned in the documentation
 2025-02-21 11:07:39 +05:30
harshal.patil d403005afc change(mbedtls/sha): Change the legacy formatting in the SHA port layers 2025-02-11 11:04:57 +05:30
harshal.patil 2717e5b62e fix(mbedtls/sha): Fix some local variable's types to avoid any substraction overflow error 
- Though such a case would not occur given the way it is used the driver layer
 2025-02-11 10:58:16 +05:30
Harshal Patil 7c9c2537ed Merge branch 'feat/support_both_aes_and_sha_block_and_dma_modes_during_runtime' into 'master' 
feat(mbedtls): Support both SHA block and DMA modes during runtime

Closes IDF-11848

See merge request espressif/esp-idf!36589
 2025-02-06 11:19:51 +08:00
harshal.patil 7d8211bf87 feat(mbedtls): Support both SHA block and DMA modes during runtime 
Dynamically switch the SHA operation modes based on the buffer operating length
 2025-02-04 16:49:30 +05:30
harshal.patil 62df1017ad change(nvs_sec_provider): Change NVS encryption's default efuse HMAC key ID to -1 2025-01-29 18:51:29 +05:30
harshal.patil f205476ffe fix(nvs_flash): Add encrypted-flash as the dependency in nvs_create_partition_image() 2025-01-29 18:51:29 +05:30
harshal.patil c7f86301e6 change(bootloader): Increase the iram_seg size of bootloader to fit NVS encryption 2025-01-29 18:51:29 +05:30
harshal.patil 5b17375aca test(nvs_flash): Extend the nvs_flash test app to support encrypted NVS reads 2025-01-29 18:51:29 +05:30
harshal.patil 3b7d71eca2 feat(examples): Extend the bootloader_nvs example to support encrypted NVS reads 2025-01-29 18:51:29 +05:30
harshal.patil cadd6b8bcc feat(nvs_flash): Support reading encrypted NVS partitions in the bootloader 2025-01-29 18:51:29 +05:30
harshal.patil 37de702e97 feat(nvs_flash): Enable the usage of mbedtls from ROM for bootloader NVS decryption 
Bootloader NVS decryption uses hardware ROM APIs to decrypt the NVS contents,
but for targets that do not support AES hardware we could benefit by using the
software mbedtls library that is present in the ROM directly.
 2025-01-29 18:51:29 +05:30
harshal.patil 7c3832ff2a feat(nvs_flash): Add a minimal XTS-AES layer for the bootloader 2025-01-29 18:51:29 +05:30
harshal.patil 4c38499303 fix(esp_partition): Support reading unencrypted partitions by the bootloader 
- When flash encryption is enable to support reading a partition that is not
marked as "encrypted", the `esp_partition_read()` API of bootloader build
should be redirected to the `bootloader_flash_read()` API.
 2025-01-29 18:51:28 +05:30
harshal.patil eb05db30fc fix(esptool_py): Fix NVS partition being incorrectly marked as encrypted 
- The CMake function esptool_py_partition_needs_encryption() in the esptool_py
component used to mark NVS partition as encrypted, instead it should have marked
the NVS keys partition as encrypted.
 2025-01-29 18:51:28 +05:30
harshal.patil 2ee22f968a fix(nvs_flash): Allow matching with partition when label provided is NULL 
- When esp_parition_find_first() is called with the partition label provided
as NULL by the bootloader, allowing matching to the first partition that matches
partition_type and partition_subtype as done in the app variant.
 2025-01-29 18:51:28 +05:30
harshal.patil 21c11caf70 fix(soc): Add the unavailable TRM mentioned RNG_DATA_REG register for C2 and C3 2025-01-24 10:50:05 +05:30
Harshal Patil 9cabe79385 Merge branch 'fix/incorrect_reserved_bits_calculation_in_xts_pseudo_round_conf' into 'master' 
fix(soc): Fix incorrect reserved bits calculation in xts_pseudo_round_conf

See merge request espressif/esp-idf!36473
 2025-01-23 18:49:03 +08:00
harshal.patil f6be421a48 fix(bootloader_support): Enable pseudo round function in flash enc release mode for H2-ECO5 2025-01-21 12:21:42 +05:30
harshal.patil 5863b66ba5 fix(soc): Fix incorrect reserved bits calculation in xts_pseudo_round_conf 2025-01-20 13:30:03 +05:30
Harshal Patil a45b6e7b72 Merge branch 'feat/support_aes_pseudo_round_func_in_esp32h2_eco5' into 'master' 
Support AES and XTS-AES's pseudo round function in ESP32H2-ECO5

Closes IDF-11400 and IDF-11401

See merge request espressif/esp-idf!36041
 2025-01-15 23:22:18 +08:00