Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
48,406 Commits 25 Branches 192 Tags
5fbac0ecf0db69d7d1cdaf0cfd330c5e41cda7cb
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Laukik Hase d0f66bad0e docs(esp_tee): Enable ESP-TEE documentation for ESP32-C61 2025-11-20 11:01:30 +05:30
Laukik Hase 01f5050f6f ci(esp_tee): Enable the TEE examples for ESP32-C61 2025-11-20 11:01:29 +05:30
Laukik Hase 46de215007 ci(esp_tee): Enable the TEE test-apps for ESP32-C61 2025-11-19 10:57:43 +05:30
Laukik Hase 65436262d5 feat(esp_tee): Add support for TEE secure storage encryption for ESP32-C61 2025-11-19 10:57:43 +05:30
Laukik Hase 2cb0fa5c34 feat(esp_tee): Support for ESP32-C61 - the rest of the components 2025-11-19 10:57:42 +05:30
Laukik Hase 2394e9451d feat(esp_tee): Support for ESP32-C61 - the esp_tee component 2025-11-19 10:57:42 +05:30
Laukik Hase f307e80fe2 feat(esp_tee): Enable MSPI tuning for Flash and PSRAM 2025-11-13 15:38:13 +05:30
Laukik Hase cf36853d0d fix(esp_tee): Handle the SPI1 WB mode incompatibility in TEE flash APIs on ESP32-C5 
- When `esp_flash_read()` is invoked from REE, it internally enables WB mode
  via `spi_flash_ll_wb_mode_enable()`. However, the ROM flash APIs used by TEE
  do not support WB mode, resulting in failures when TEE attempts to access
  flash after this call.
- This commit adds a workaround in the TEE flash layer by saving WB mode state,
  temporarily disabling it for ROM API calls, and restoring it afterward.
 2025-11-13 15:38:13 +05:30
Laukik Hase f20351eb3b fix(esp_tee): Use HAL APIs instead of ROM APIs for SPI flash service calls 
Currently, REE SPI flash HAL operations are routed as service calls to TEE,
but the TEE implementation incorrectly uses ROM APIs instead of HAL APIs.
This leads to issues and is not the recommended approach.
 2025-11-13 15:38:12 +05:30
Laukik Hase 73b6e718f2 ci(esp_tee): Remove incorrect error checks for TEE flash protection tests 
- Also fixed coverity issue from TEE secure storage
 2025-11-06 17:19:56 +05:30
Laukik Hase 66c16561f5 Merge branch 'fix/c5_tee_sram_prot' into 'master' 
fix(esp_tee): Split TEE SRAM as I/DRAM for ESP32-C5 with PMA

See merge request espressif/esp-idf!42347
 2025-10-17 10:21:09 +05:30
Laukik Hase 9de1d631b4 feat(esp_tee): Reclaim unused TEE IRAM memory as heap 
- Changed the default TEE code placement to use the flash
  text section instead of IRAM text, making it consistent
  with the default data placement.
 2025-10-15 18:22:44 +05:30
Laukik Hase 20344640e3 fix(esp_tee): Split TEE SRAM as I/DRAM for ESP32-C5 with PMA 2025-10-15 18:22:43 +05:30
Laukik Hase 8770ae9db4 fix(esp_tee): Sync TEE-REE intr thresholds during service calls from critical sections 
- Previously, only the U-mode interrupt threshold was raised in REE critical sections,
  leaving M-mode at the lowest level.
- As a result, when a service call transitioned to M-mode, all interrupts were still
  allowed to fire, including those that should have been masked.
 2025-10-15 12:33:31 +05:30
Laukik Hase 6e51fac96e Merge branch 'fix/esp_tee_flash_op_bound_checks' into 'master' 
fix(esp_tee): Correct flash operation bound checks to handle all overlap cases

Closes IDF-14129

See merge request espressif/esp-idf!41946
 2025-10-13 13:31:03 +05:30
Laukik Hase 88444df58b Merge branch 'docs/esp_tee_c5' into 'master' 
docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5

Closes IDF-10432

See merge request espressif/esp-idf!42390
 2025-10-13 09:29:20 +05:30
Laukik Hase afe8fea489 docs(esp_tee): Enable ESP-TEE documentation for ESP32-C5 2025-10-06 18:49:01 +05:30
Laukik Hase 466c1d66b6 refactor(esp_tee): Remove the spi_flash_erase_chip service call 
- Also fix coverity bug from TEE HMAC-PBKDF2 routine
 2025-09-30 12:22:26 +05:30
Laukik Hase 8b92f3603f fix(esp_tee): Correct flash operation bound checks to handle all overlap cases 
- Ensure bound checks correctly handle all scenarios, including
  when a requested operation's (SPI0/1) range fully contains the
  TEE-protected region.
- Disable delegation of INTWDT timeout and Cache error interrupts as they reset
  the device after the panic handler
 2025-09-30 12:22:25 +05:30
Laukik Hase 649741fa9d Merge branch 'feat/nvs_flash_deregister_sec_scheme' into 'master' 
feat(nvs_flash): Added an API to deregister the NVS security scheme context

Closes IDF-12456 and IDFGH-16210

See merge request espressif/esp-idf!41073
 2025-09-22 11:11:34 +05:30
Laukik Hase ac89a6f896 Merge branch 'feature/esp_tee_sec_stg_sign_w_pbkdf2' into 'master' 
feat(esp_tee): Support for PBKDF2-based (HMAC) ECDSA signing

See merge request espressif/esp-idf!41074
 2025-09-20 10:28:00 +05:30
Laukik Hase c152663408 feat(esp_tee): Added support for PBKDF2-based (HMAC) ECDSA signing 2025-09-19 12:06:02 +05:30
Laukik Hase 1ea0fc261d change(nvs_sec_provider): Make the HMAC-based NVS security scheme default for supported SoCs 
- When NVS encryption is enabled on SoCs with the HMAC peripheral that have flash encryption
  enabled, the HMAC-based NVS encryption scheme is now selected as default instead of the
  flash encryption-based scheme.
- If your application previously used the flash encryption-based scheme, you need to manually
  configure the NVS encryption scheme to flash encryption from HMAC through ``menuconfig``
  or your project's ``sdkconfig`` (i.e., setting ``CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y``).
 2025-09-19 10:38:38 +05:30
Laukik Hase f565fc2481 change(nvs_flash): Add a private dependency of the nvs_sec_provider component 
- Closes https://github.com/espressif/esp-idf/issues/17256
 2025-09-19 10:17:46 +05:30
Laukik Hase f60bcaaa4d feat(nvs_flash): Added an API to deregister the NVS security scheme context 2025-09-19 10:17:45 +05:30
Laukik Hase 537b36de7a Merge branch 'fix/esp_tee_misc' into 'master' 
feat(esp_tee): Miscellaneous fixes and updates

Closes IDF-13856, IDFCI-3085, IDFCI-3094, and IDFCI-3105

See merge request espressif/esp-idf!41433
 2025-09-17 13:36:22 +05:30
Laukik Hase 57432bb336 fix(esp_tee): Skip taking the service call mutex when in critical sections 
- Fixes INT_WDT timeouts with mmap operations
- Add test-case for verifying parallel service calls
 2025-09-16 14:57:27 +05:30
Laukik Hase d8edbc8acf feat(esp_tee): ASM routine fixes and improvements 
- Fix incorrect setting in the edge interrupt acknowledgement API
- Avoid executing the service call dispatcher in the U-mode ecall,
  rather execute `mret` to jump it
- Avoid `t1` register corruption when processing `ecall`
- Switch back to the bootloader stack from TEE stack after the
  execution of the entire TEE initialization routine
 2025-09-16 14:57:10 +05:30
Laukik Hase 8b812d4192 feat(esp_tee): Miscellaneous fixes and updates 
- Rename `tee_test_fw` app configs for better CI tracking
- Decrease the lower bound of TEE I/DRAM config options
- Trim the TEE test-apps build
- Improve the TEE/REE OTA pytest script with additional checks
- Fix build issues when `tee_sec_storage`/`tee_ota_ops` are a
  a part of the project build but ESP-TEE is disabled
 2025-09-16 14:54:06 +05:30
Laukik Hase ba80256748 Merge branch 'ci/esp_tee_disable_c5_temp' into 'master' 
ci(esp_tee): Disable the TEE test-apps for ESP32-C5 temporarily

See merge request espressif/esp-idf!41356
 2025-08-19 16:37:16 +05:30
Laukik Hase 9b807a253d ci(esp_tee): Disable the TEE test-apps for ESP32-C5 temporarily 2025-08-18 18:42:02 +05:30
Laukik Hase bb55b0cefc ci(esp_tee): Enable the TEE test-apps for ESP32-C5 2025-08-13 14:09:00 +05:30
Laukik Hase ab8400df4a ci(esp_tee): Refactor the ESP-TEE test-cases 
- Improve the interrupt-related test cases
- Fix potential issues in the task-switching test
  during secure service calls
 2025-08-13 14:09:00 +05:30
Laukik Hase 340de9823a feat(esp_tee): Support for ESP32-C5 - the rest of the components 2025-08-13 14:08:59 +05:30
Laukik Hase 11d3a2480f feat(esp_tee): Support for ESP32-C5 - the esp_tee component 2025-08-13 14:08:58 +05:30
Laukik Hase f2b0f256ab fix(esp_rom): Patch the esp_rom_delay_us API to use U-mode cycle CSR 2025-07-25 09:54:42 +05:30
Laukik Hase 3d402ca938 ci(hal): Extend the PMS hal test-app for verifying TEE-based interrupt scenarios 2025-07-23 10:00:24 +05:30
Laukik Hase 95efe53cde Merge branch 'ci/tee_apm_pms_test_app' into 'master' 
ci(hal): Add HAL/LL-based test app for the TEE and APM peripherals

Closes IDF-8614, IDF-8615, IDF-9229, IDF-9230, IDF-10422, IDF-12646, IDF-12647, IDF-12648, IDF-12649, and IDF-12877

See merge request espressif/esp-idf!39873
 2025-07-03 10:08:58 +05:30
Laukik Hase 15a4d63441 ci(hal): Add HAL/LL-based test app for the TEE and APM peripherals 2025-07-01 17:27:46 +05:30
Laukik Hase d8601f8245 feat(hal): Add CPU_APM support for ESP32-C61 2025-07-01 17:27:45 +05:30
Laukik Hase 7f7d0afe40 Merge branch 'fix/esp_tee_coverity_issues' into 'master' 
fix(esp_tee): Fix coverity issue from the `attestation` component

Closes IDF-12867

See merge request espressif/esp-idf!40054
 2025-06-27 18:24:24 +05:30
Laukik Hase 9b1aaa2778 fix(esp_tee): Fix coverity issues from the attestation component 
- Also fix the incorrect marker set for TEE OTA tests
 2025-06-23 11:45:12 +05:30
Laukik Hase 5b7922b028 Merge branch 'refactor/apm_tee_ll_hal' into 'master' 
refactor(hal): Refactor the APM LL/HAL APIs

Closes IDF-10423 and IDF-12830

See merge request espressif/esp-idf!38522
 2025-06-09 09:13:26 +05:30
Laukik Hase 0d8a1f5427 refactor(hal): Refactor the APM LL/HAL APIs 2025-06-06 18:28:47 +05:30
Laukik Hase a1c6d2a458 fix(esp_tee): Fix failing SPI1 flash protection test-cases 2025-05-22 17:35:09 +08:00
Laukik Hase b8e48fbfc0 ci(esp_tee): Enable the tee_test_fw test app for ESP32-H2 2025-05-20 16:31:23 +05:30
Laukik Hase 12e2df2d74 feat(esp_tee): Support for ESP32-H2 - the rest of the components 2025-05-20 16:31:23 +05:30
Laukik Hase 958f4b8900 feat(esp_tee): Support for ESP32-H2 - the esp_tee component 2025-05-20 16:31:22 +05:30
Laukik Hase e5a8ea0ab1 Merge branch 'fix/c5_default_apm_cfg' into 'master' 
fix(security): Set all APM masters to operate in TEE mode by default

See merge request espressif/esp-idf!39006
 2025-05-12 12:14:00 +08:00
Laukik Hase 8a999ea19e fix(security): Set all APM masters to operate in TEE mode by default 2025-05-11 10:01:11 +05:30
Laukik Hase 7411eafb2e Merge branch 'refactor/esp_tee_sec_stg' into 'master' 
refactor(esp_tee): Revamp the TEE Secure Storage format

Closes IDF-9180

See merge request espressif/esp-idf!36878
 2025-05-07 13:40:06 +08:00
Laukik Hase c16fc04c2d docs(esp_tee): Revise TEE secure storage and related documentation 2025-05-04 18:22:22 +05:30
Laukik Hase 033397b877 fix(esp_tee): Add standard newlib function stubs to resolve build warnings 
- Disable C++ exceptions for TEE build to reduce flash footprint
 2025-05-04 18:03:30 +05:30
Laukik Hase 3bb3f9362e refactor(esp_tee): Update TEE secure storage examples and test-apps 2025-05-04 18:03:30 +05:30
Laukik Hase 41bf07e6ce refactor(esp_tee): Remove the deprecated TEE secure storage partition subtype 2025-05-04 18:03:30 +05:30
Laukik Hase d116567a66 refactor(esp_tee): Update TEE secure storage interface APIs 2025-05-04 18:03:29 +05:30
Laukik Hase c9f7bcd452 feat(esp_tee): Support the nvs_flash for the ESP-TEE build 2025-05-04 18:03:28 +05:30
Laukik Hase cb4c738193 Merge branch 'refactor/esp_tee_ss_layer_in_flash' into 'master' 
refactor(esp_tee): Place the secure services `_ss_` layer in the flash by default

See merge request espressif/esp-idf!38336
 2025-04-17 19:58:47 +08:00
Laukik Hase a0031cff9f refactor(esp_tee): Remove the redudant eFuse-related service calls 2025-04-17 11:04:29 +05:30
Laukik Hase 832124f198 fix(esp_tee): Place APM HAL in TEE IRAM when SPI1 protection is enabled 
- Place the APM HAL into TEE IRAM when `CONFIG_SECURE_TEE_EXT_FLASH_MEMPROT_SPI1`
  is enabled, as APM violations related to SPI1 can occur with the flash cache disabled.
- Also fix an issue where flash protection tests were passing due to incorrect checks
 2025-04-17 11:03:50 +05:30
Laukik Hase a845be0149 refactor(esp_tee): Reduce the default TEE DRAM size 
- Decreased from 32KB to 24KB, keeping in mind the current maximum TEE heap
  usage and some overhead
- Make the TEE panic handler logs concise, saving some DRAM
 2025-04-17 11:03:17 +05:30
Laukik Hase 8e27be344b refactor(esp_tee): Place the secure services _ss_ layer in the flash by default 2025-04-17 11:03:16 +05:30
Laukik Hase ecc547f4b0 Merge branch 'feat/esp_tee_hmac_ds_prot' into 'master' 
feat(esp_tee): Protect the HMAC, DS and ECC peripherals from REE access

See merge request espressif/esp-idf!38285
 2025-04-17 13:20:54 +08:00
Laukik Hase 4a4d63d36e feat(esp_tee): Protect the ECC peripheral from REE access 2025-04-16 19:19:04 +05:30
Laukik Hase fc4802c0d6 feat(esp_tee): Protect the HMAC and DS peripherals from REE access 2025-04-16 19:19:04 +05:30
Laukik Hase d7d78f6238 fix(esp_tee): Correct the input validation checks for secure services 2025-04-16 19:19:04 +05:30
Laukik Hase 1c4969bc47 feat(esp_security): Add a TEE-specific crypto lock layer with stub implementations 2025-04-16 19:19:03 +05:30
Laukik Hase 1c6405eb9b Merge branch 'fix/esp_tee_coverity_bugs' into 'master' 
fix(security): Fixed coverity warnings related to the `esp_tee` component

Closes IDF-12803, IDF-12804, and IDF-12826

See merge request espressif/esp-idf!38360
 2025-04-14 15:05:27 +08:00
Laukik Hase 13aff0b216 fix(security): Fixed coverity warnings related to the esp_tee component 
- Also, disable the SECP192R1 curve (Mbed TLS config) when TEE Secure Storage
  does not require it
 2025-04-14 10:12:51 +05:30
Laukik Hase 7daa16d437 Merge branch 'refactor/esp_tee_heap_rom' into 'master' 
feat(esp_tee): Use the ROM TLSF implementation for the TEE build

See merge request espressif/esp-idf!37277
 2025-04-09 12:33:15 +08:00
Laukik Hase d26e18cb49 ci(esp_tee): Verify the malloc-write-free cycle in the TEE heap 2025-04-08 19:50:27 +05:30
Laukik Hase 223c0d5f9d feat(esp_tee): Use the ROM TLSF implementation for the TEE build 2025-04-08 19:50:27 +05:30
Laukik Hase d442886918 refactor(esp_tee): Refactor the TEE heap-related APIs 2025-04-08 19:50:26 +05:30
Laukik Hase bd314c2460 refactor(esp_tee): Update the SHA clock configuration service call 2025-04-04 10:31:28 +05:30
Laukik Hase 3e95020c59 refactor(esp_security): Introduce dedicated APIs for crypto clock configuration 2025-04-04 10:31:27 +05:30
Laukik Hase 3fd107aa04 feat(mbedtls): Add support for ECDSA signing with TEE secure storage 2025-04-03 15:35:15 +05:30
Laukik Hase 1e8933d296 feat(esp_tee): Add support for SECP192R1 curve in TEE secure storage 2025-04-03 15:35:14 +05:30
Laukik Hase 1f54af8186 Merge branch 'docs/esp_tee_logo' into 'master' 
docs(esp_tee): Add the ESP-TEE logo to the TEE documentation

See merge request espressif/esp-idf!37948
 2025-03-28 14:43:30 +08:00
Laukik Hase a5eca671c3 docs(esp_tee): Add the ESP-TEE logo to the user-guide 2025-03-28 09:54:46 +05:30
Laukik Hase 6f95f7ff0c Merge branch 'fix/esp_tee_sha_op' into 'master' 
fix(esp_tee): Utilize the SHA H/W for hashing operations in the TEE

See merge request espressif/esp-idf!37929
 2025-03-22 15:35:12 +08:00
Laukik Hase 6b1f4fe46c fix(esp_tee): Utilize the SHA H/W for hashing operations in the TEE 2025-03-22 10:02:24 +05:30
Laukik Hase 98e16412a7 refactor(esp_tee): Use the AES-GCM port layer for operations in the TEE 2025-03-19 14:30:52 +05:30
Laukik Hase 6e5513b8ad refactor(esp_tee): Component dependency cleanup for the TEE build 2025-03-19 14:30:52 +05:30
Laukik Hase 873409da6b refactor(esp_tee): Simplify service call ASM routine 
- Remove `mret` for jumping to the service call dispatcher; instead, enable
  interrupts and execute directly
- Fix potential corruption of the `t3` register when returning from a service
  call
- Simplify the secure service dispatcher function
 2025-02-25 17:18:08 +05:30
Laukik Hase 5c4a527750 refactor(esp_tee): Remove explicit setting of the HP_CPU APM/TEE security mode 2025-02-25 16:49:08 +05:30
Laukik Hase 26fa7109f3 fix(esp_tee): Protect the AES/SHA clock registers from REE access 2025-02-25 16:49:08 +05:30
Laukik Hase 1f6d450d19 fix(security): Fixed coverity warnings from nvs_sec_provider and esp_tee components 2025-02-11 13:01:13 +05:30
Laukik Hase 7d49f696c1 ci(esp_tee): Add tests for verifying behaviour for illegal flash accesses (SPI1) 2025-02-11 12:30:06 +05:30
Laukik Hase c23714f775 feat(esp_tee): Add support for flash memory isolation and protection (SPI1) 2025-02-11 12:30:05 +05:30
Laukik Hase 37525c605d refactor(esp_tee): Migrate secure services list from TBL to YAML 2025-02-11 10:15:20 +05:30
Laukik Hase 8f117c7f4c refactor(esp_tee): Add local components in TEE examples via idf_component.yml 2025-02-11 10:15:19 +05:30
Laukik Hase c4eec756f3 refactor(esp_tee): Revised the secure service ID numbering scheme 
Also:
- Split the secure service table into two parts: one DRAM-resident and the
  other DROM-resident. The former holds the services invoked when the cache is
  disabled or suspended while the latter holds rest of the services.
 2025-01-23 12:39:19 +05:30
Laukik Hase a745100bef refactor(esp_tee): Add argument count checks for secure services in the dispatcher 
Also:
- Unified the TEE build system-related scripts into a single script
 2025-01-23 12:39:18 +05:30
Laukik Hase a91f89026c feat(esp_tee): Make the attestation service configurable 2025-01-23 12:39:17 +05:30
Laukik Hase 4d9358703a refactor(esp_tee): Move the REE address validation check to a separate header 2025-01-23 12:39:16 +05:30
Laukik Hase cb84119600 docs(esp_tee): Added documentation for the ESP-TEE framework 
- Co-authored-by: Shen Meng Jing <shenmengjing@espressif.com>
 2025-01-08 11:37:42 +05:30
Laukik Hase 86125aeb98 ci(esp_tee): Add tests for verifying behaviour for illegal flash accesses (SPI0) 2025-01-03 11:44:27 +05:30
Laukik Hase 1499c65754 feat(esp_tee): Add support for flash memory isolation and protection (SPI0) 2025-01-03 11:44:01 +05:30
Laukik Hase 5063de64db refactor(esp_tee): Disable the cache and interrupts in the TEE panic handler 2025-01-03 10:41:16 +05:30
Laukik Hase d24e09393d Merge branch 'feature/esp_tee_examples' into 'master' 
feat(esp_tee): Added examples demonstrating the ESP-TEE framework

See merge request espressif/esp-idf!35834
 2024-12-24 15:03:49 +08:00