Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
55,259 Commits 25 Branches 192 Tags
752db18455dfec9e307301aec00e24cf99d2e5e2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Mahavir Jain 7fc2aafb21 Merge branch 'fix/ecdsa_hmac_ds_locking' into 'master' 
fix(esp_security): Stop ECDSA and Key Manager resets from corrupting concurrent crypto

See merge request espressif/esp-idf!52183
 2026-09-08 17:28:54 +05:30
Mahavir Jain 84a6967aa1 Merge branch 'feat/add_sm3_hash_support_and_testcases' into 'master' 
add SM3 hash support and testcases

See merge request espressif/esp-idf!44830
 2026-09-08 09:02:41 +05:30
Mahavir Jain e220bc08dd Merge branch 'fix/esp_crt_bundle_allocator_symmetry' into 'master' 
fix(esp_crt_bundle): match memory allocator in cross-signed callback

Closes IDFGH-18243

See merge request espressif/esp-idf!52487
 2026-09-07 17:40:31 +05:30
Mahavir Jain 96f54947e0 Merge branch 'fix/http_server_chunked_501' into 'master' 
Fix(esp_http_server): Fail cleanly on incoming chunked request

See merge request espressif/esp-idf!52126
 2026-09-06 15:55:17 +05:30
Mahavir Jain a482934bff Merge branch 'fix/esp_http_server-ws-close-and-utf8-strictness' into 'master' 
Fix(esp_http_server): ws close and utf8 strictness

See merge request espressif/esp-idf!48908
 2026-09-06 15:53:31 +05:30
Mahavir Jain e33568b60a Merge branch 'fix/anti-rollback-update' into 'master' 
fix(efuse): Reliably update anti-rollback secure version

Closes IDF-16141

See merge request espressif/esp-idf!52406
 2026-09-04 18:09:02 +05:30
Mahavir Jain 20c9c74c48 Merge branch 'contrib/github_pr_18818' into 'master' 
fix(esp_http_client): fix parser wedge and dead error-classification branches on read timeout (GitHub PR)

Closes IDFGH-17949
Closes https://github.com/espressif/esp-idf/pull/18818

See merge request espressif/esp-idf!50758
 2026-09-04 10:43:54 +05:30
Mahavir Jain 8952de37bb Merge branch 'fix/add_cve_items' into 'master' 
docs: update vulnerabilities guide to mention CVE-2026-81507 & CVE-2026-81508

See merge request espressif/esp-idf!52229
 2026-09-04 10:42:16 +05:30
Mahavir Jain 32df74b8af Merge branch 'fix/crt_bundle_cert_header_oob' into 'master' 
Validate cert header extent before reading it in bundle check

See merge request espressif/esp-idf!51982
 2026-09-02 13:41:47 +05:30
Mahavir Jain 86b0b7b7e6 Merge branch 'feat/mbedtls_follow_app_perf_optimization' into 'master' 
feat(mbedtls): follow project performance optimization level by default

See merge request espressif/esp-idf!52120
 2026-09-02 13:41:37 +05:30
Mahavir Jain a1f17cebdc Merge branch 'fix/s3_memprot_panic_report' into 'master' 
Report ESP32-S3 PMS violations as memory protection faults

See merge request espressif/esp-idf!52109
 2026-09-02 13:41:24 +05:30
Mahavir Jain a3192567d5 Merge branch 'feat/cpu_region_protection_h4' into 'master' 
Memory region protection for ESP32-H4

Closes IDF-12588

See merge request espressif/esp-idf!47070
 2026-08-31 17:41:52 +05:30
Mahavir Jain 8224536f91 Merge branch 'fix/heap_align_hw_test' into 'master' 
test(heap): DMA alignment test silently passed on every target

See merge request espressif/esp-idf!52131
 2026-08-31 17:28:43 +05:30
Mahavir Jain d3fe62cee4 Merge branch 'feat/tee_sec_stg_non_det_sign' into 'master' 
change(esp_tee): Force non-deterministic ECDSA signing for TEE secure storage keys

Closes IDF-15937 and IDF-15939

See merge request espressif/esp-idf!50355
 2026-08-31 16:07:52 +05:30
Mahavir Jain 0a6f7d27af Merge branch 'contrib/github_pr_18983' into 'master' 
fix(http_client): default Content-Type for post field (GitHub PR)

Closes IDFGH-18153

See merge request espressif/esp-idf!51956
 2026-08-28 12:53:11 +05:30
Mahavir Jain 626d7e9bb3 Merge branch 'fix/aes_op_zero_buf_check' into 'master' 
fix(mbedtls/aes): reject an all-zero AES block output in the encrypt direction

Closes IDF-15997

See merge request espressif/esp-idf!51603
 2026-08-27 14:16:38 +05:30
Mahavir Jain a9de6a4f30 Merge branch 'fix/hmac-ds-reset-corrupts-concurrent-mpi' into 'master' 
fix(esp_security): don't reset DS peripheral in esp_hmac_calculate

Closes FCS-1918

See merge request espressif/esp-idf!51913
 2026-08-21 17:26:16 +05:30
Mahavir Jain 059f4ad22e Merge branch 'test/fix_inplace_ctr_psram_test_sw_aes' into 'master' 
test(mbedtls): fix in-place AES-CTR PSRAM test on targets without AES hardware

See merge request espressif/esp-idf!51921
 2026-08-21 10:07:32 +05:30
Mahavir Jain 6bf9b20dd9 Merge branch 'fix/tee_disallow_reentrant_sec_svc' into 'master' 
fix(esp_tee): Reject re-entrant secure service calls from the REE

See merge request espressif/esp-idf!51330
 2026-08-20 11:56:51 +05:30
Mahavir Jain dc73db9f18 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!51768
 2026-08-20 11:56:38 +05:30
Mahavir Jain b27a1cd318 Merge branch 'change/gen_crt_bundle_unify_output' into 'master' 
change(mbedtls/crt_bundle): Unify gen_crt_bundle output with esp-pylib

Closes IDF-15331

See merge request espressif/esp-idf!51556
 2026-08-19 19:38:29 +05:30
Mahavir Jain ad59a903b7 Merge branch 'fix/esp32s2_aes_dma_psram_partial_block_hang' into 'master' 
Avoid ESP32-S2 Crypto DMA stall on PSRAM output with partial blocks

See merge request espressif/esp-idf!51796
 2026-08-19 19:29:59 +05:30
Mahavir Jain 53076b8aad Merge branch 'feat/enable_dpu_region_protection_for_esp32s31' into 'master' 
feat: enable cpu region protection for esp32s31

Closes IDF-15238

See merge request espressif/esp-idf!49270
 2026-08-19 19:13:11 +05:30
Mahavir Jain 30e851857c Merge branch 'fix/mbedtls_gcm_multipart_and_ecp_pubkey' into 'master' 
Fix/mbedTLS port layer security fixes (394, 1214, 1206)

Closes SEC-1214, SEC-394, and SEC-1206

See merge request espressif/esp-idf!51096
 2026-08-19 16:21:43 +05:30
Mahavir Jain 200cae8317 Merge branch 'feat/ws-control-frame-handler' into 'master' 
feat(esp_http_server): separate control frame handler for WS server

Closes IDFGH-17509

See merge request espressif/esp-idf!50616
 2026-08-19 14:20:16 +05:30
Mahavir Jain d1fc1ed6b9 Merge branch 'contrib/github_pr_18922' into 'master' 
fix(esp_https_server): restore use_secure_element initializer in HTTPD_SSL_CONFIG_DEFAULT() (GitHub PR)

Closes IDFGH-18077

See merge request espressif/esp-idf!51540
 2026-08-19 13:45:15 +05:30
Mahavir Jain 50d1fb0773 fix(esp_hw_support): run ESP32-P4 PMA programming from IRAM 
The bootloader locks PMA entries on core 0 only (PMA is per-hart), so
core 1 applies its PMA configuration with effective writes. Executing
that from flash momentarily makes the flash aperture non-cacheable
while reprogramming its entry, which executes ciphertext with flash
encryption enabled (illegal instruction -> CPU lockup).
 2026-08-17 19:23:58 +05:30
Mahavir Jain dae3955279 fix(bootloader_support): do not gate application region protection on bootloader config 
CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE is bootloader-scoped;
disabling it must not strip the application's PMP/PMA configuration.
The application now always applies region protection.
 2026-08-17 19:23:58 +05:30
Mahavir Jain a03ec273f0 fix(esp_hw_support): fix ESP32-S31 CPU lockup with flash encryption during PMA setup 
Run esp_cpu_configure_invalid_regions() from IRAM: it reprograms the PMA
entry that keeps the flash aperture cacheable, so an instruction fetched
from flash inside the reprogramming window bypasses the cache and, with
flash encryption enabled, executes ciphertext (illegal instruction ->
CPU lockup).

Also move the PSRAM PMA entry to index 7 so that the application layout
matches the entry earlier bootloaders programmed and locked, keeping the
full layout effective under such bootloaders.
 2026-08-17 19:23:58 +05:30
Mahavir Jain 3ee34cdac5 change(esp_hw_support): drop the frozen PMP entry layout for ESP32-S31 
Freezing PMP entry indices as a bootloader<->application ABI (pmp_layout.h)
is only needed on targets where an already-shipped bootloader locks PMP
entries (C5, C6, C61, H2, P4). No such bootloader has ever shipped for
ESP32-S31 and, per the v6.2 PMP ownership policy, the bootloader never
configures or locks any PMP entry on this target - so there is no ABI to
freeze. Program all entries by plain index (as on ESP32-H4/H21) and state
that the application-owned layout is not an ABI.
 2026-08-17 19:23:58 +05:30
Mahavir Jain 8c007f0e03 Merge branch 'feat/bootloader-mbedtls-split-final' into 'master' 
feat(esp_image_verify): split image verification out of bootloader_support

Closes IDF-8577 and IDFGH-17033

See merge request espressif/esp-idf!48383
 2026-08-13 08:45:58 +05:30
Mahavir Jain 6e49bfec02 Merge branch 'fix/crt-bundle-unaligned-reads' into 'master' 
fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access

Closes IDF-16030

See merge request espressif/esp-idf!51600
 2026-08-12 14:13:45 +05:30
Mahavir Jain 167b6b19bd Merge branch 'fix/crt_bundle_unsupported_cert_extension' into 'master' 
fix(mbedtls):report an error for certificate files with unsupported extension

See merge request espressif/esp-idf!51518
 2026-08-12 13:54:53 +05:30
Mahavir Jain 9006fc70ac fix(build): word-align the length symbol of embedded data files 
The generated assembly emitted <name>_length immediately after the raw
payload bytes, so the 32-bit word landed misaligned whenever the data
size was not a multiple of 4. Consumers declare it as a 32-bit object
(e.g. `extern const size_t <name>_length` in the ULP firmware loaders),
so the compiler emits an alignment-assuming word load, which is a
misaligned flash read prone to spurious load faults on chips with
SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (ESP32-C6/H2/H21).
 2026-08-12 08:42:49 +05:30
Mahavir Jain 9c3a553115 fix(mbedtls): read crt bundle byte-wise to avoid misaligned flash access 
The offset table and the per-cert length fields of the certificate
bundle were read through uint16_t*/uint32_t* casts, which compile to
halfword/word loads at addresses with no alignment guarantee: bundles
supplied via esp_crt_bundle_set() can start anywhere, and cert entries
are byte-packed, so their 16-bit fields land at arbitrary offsets.

On chips with SOC_CPU_MISALIGNED_ACCESS_ON_PMP_MISMATCH_ISSUE (DIG-694:
ESP32-C6/H2/H21) a misaligned load from memory-mapped flash can take a
spurious "Load access fault" when it sits within two instructions of an
access to a differently-permissioned region, observed as a crash in
esp_crt_check_bundle()/CA callback during TLS handshakes with a bundle
that happened to be placed at an odd address.
 2026-08-12 08:42:49 +05:30
Mahavir Jain 846b17f1bd Merge branch 'fix/fix_esp_mbedtls_read_return_code' into 'master' 
fix(esp-tls): correct return codes and harden TLS 1.3 ticket handling

Closes SEC-237, SEC-359, and SEC-360

See merge request espressif/esp-idf!48720
 2026-08-06 16:10:05 +05:30
Mahavir Jain 2495e37a48 Merge branch 'feat/pma_pmp_lock_policy' into 'master' 
Stop locking PMP in the bootloader and freeze the entry layout

See merge request espressif/esp-idf!50326
 2026-08-06 11:31:39 +05:30
Mahavir Jain 6498d81eb4 Merge branch 'docs/vulnerabilities_guide_new_advisories' into 'master' 
docs(security): update vulnerabilities guide with recently published advisories

See merge request espressif/esp-idf!51456
 2026-08-05 18:27:43 +05:30
Mahavir Jain c9095b026f Merge branch 'feat/disable_constant_time_rsa_key_gen' into 'master' 
fix(mbedtls): revert to non constant time rsa key gen

See merge request espressif/esp-idf!51026
 2026-08-05 12:52:27 +05:30
Mahavir Jain d9f42b3fc6 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!50852
 2026-08-05 10:42:06 +05:30
Mahavir Jain 5e9ca673ac Merge branch 'contrib/github_pr_18880' into 'master' 
fix(esp_https_ota): Add missing requirement to `bootloader_support` component (GitHub PR)

Closes IDFGH-18024

See merge request espressif/esp-idf!51505
 2026-08-05 10:05:20 +05:30
Mahavir Jain 6d613d01ac docs(security): update vulnerabilities guide with recently published advisories 2026-08-03 18:04:17 +05:30
Mahavir Jain 628c1f8785 Merge branch 'fix/harden_esp_hw_support' into 'master' 
fix(esp_hw_support): harden memprot and fix bugs

Closes SEC-234, SEC-235, SEC-331, SEC-334, SEC-332, and SEC-333

See merge request espressif/esp-idf!49919
 2026-08-03 14:24:39 +05:30
Mahavir Jain fa44af6648 Merge branch 'contrib/github_pr_18872' into 'master' 
feat(esp-tls): add opt-in TCP_NODELAY Kconfig (GitHub PR)

Closes IDFGH-18014

See merge request espressif/esp-idf!51014
 2026-08-02 13:29:27 +05:30
Mahavir Jain 4090eeeea4 Merge branch 'fix/esp_http_server-ws-frame-header-strictness' into 'master' 
Fix(esp http server): ws frame header strictness

Closes SEC-036 and SEC-230

See merge request espressif/esp-idf!48905
 2026-07-31 11:56:15 +05:30
Mahavir Jain 7b45ac4309 Merge branch 'change/mmu_psram_anti_fi_bootloader_size' into 'master' 
change(hal): exclude PSRAM anti-FI check from bootloader build

See merge request espressif/esp-idf!51188
 2026-07-30 07:04:31 +05:30
Mahavir Jain 0996ffbb4e Merge branch 'fix/fix_esp32s31_xip_bss_psram_build_failure' into 'master' 
fix(esp_system): fix backwards location-counter move in `.ext_ram.dummy` on same-region targets

Closes IDFGH-17897

See merge request espressif/esp-idf!50366
 2026-07-26 17:24:08 +05:30
Mahavir Jain abc7489350 Merge branch 'fix/esp32s31_fpga_boot_fixes' into 'master' 
fix(regi2c): skip regi2c operations when running on FPGA

See merge request espressif/esp-idf!47154
 2026-07-26 17:06:46 +05:30
Mahavir Jain 08948ee390 Merge branch 'fix/esp_tee_stk_ptr_bug' into 'master' 
fix(esp_tee): Validate the stack pointer at the privilege switch boundary

Closes IDF-15974, IDF-15977, and IDF-15994

See merge request espressif/esp-idf!50647
 2026-07-23 19:44:47 +05:30
Mahavir Jain 14b8e87188 Merge branch 'fix/disable-key-mgr' into 'master' 
Disable Key Manager support

See merge request espressif/esp-idf!50311
 2026-07-22 20:48:35 +05:30
Mahavir Jain c566ace1f6 fix(esp_system): fixes build failure with XIP PSRAM + BSS/NoInit in external memory 
Declare ext_ram_xip_seg as a distinct region overlapping drom_seg at the
same origin (the esp32s3/c5/c61/h4 pattern) instead of aliasing drom_seg,
so .ext_ram.dummy has its own location counter and .ext_ram.bss reclaims
the VMA space of NOLOAD rodata (.rodata_wlog_*), saving up to one MMU
page of PSRAM on esp32s31. No layout change on esp32p4.

Closes https://github.com/espressif/esp-idf/issues/18791
Related https://github.com/espressif/esp-idf/issues/14992
 2026-07-22 16:39:25 +05:30
Mahavir Jain ef2d5c887d Merge branch 'feat/mbedtls_update_4.1.1' into 'master' 
Feat/mbedtls update 4.1.1

See merge request espressif/esp-idf!50602
 2026-07-20 09:34:19 +05:30
Mahavir Jain 2fd018b978 Merge branch 'docs/fix_ecdsa_p384_sb_doc_gating' into 'master' 
docs(security): show ECDSA-P384 Secure Boot notes only on targets supporting it

See merge request espressif/esp-idf!50751
 2026-07-16 17:51:36 +05:30
Mahavir Jain 1b7b298fcf Merge branch 'fix/fix_esp_tee_iv_length_check' into 'master' 
fix(esp_tee): extends IV length check and TEE address mapping check

Closes IDF-15940 and IDF-15941

See merge request espressif/esp-idf!50438
 2026-07-15 21:58:33 +05:30
Mahavir Jain 23d648df54 Merge branch 'contrib/github_pr_18813' into 'master' 
fix(protocomm): free response buffers on 2nd psa_cipher_update failure (GitHub PR)

Closes IDFGH-17940

See merge request espressif/esp-idf!50757
 2026-07-15 21:51:40 +05:30
Mahavir Jain 05250d7dd1 Merge branch 'feat/enable_cross_signed_cert_suppport_default' into 'master' 
feat(mbedtls): enable cross signed certificate verification support by default

See merge request espressif/esp-idf!49905
 2026-07-07 14:47:37 +05:30
Mahavir Jain cf322e283f Merge branch 'fix/bootloader_anti_rollback_konfig' into 'master' 
fix(bootloader): Hide bootloader anti-rollback Kconfig where not supported

See merge request espressif/esp-idf!50413
 2026-07-07 10:40:21 +05:30
Mahavir Jain 7eb664f61f Merge branch 'feat/update_documentation_and_cleanup_for_esp32h4' into 'master' 
Feat/update documentation and cleanup for esp32h4

See merge request espressif/esp-idf!49426
 2026-07-06 14:05:31 +05:30
Mahavir Jain 442cc028b5 Merge branch 'fix/fix_esp_http_client_cross_origin_credentials' into 'master' 
fix(esp_http_client): strip Authorization header on cross-origin redirect

Closes SEC-228 and SEC-049

See merge request espressif/esp-idf!48820
 2026-07-06 12:20:51 +05:30
Mahavir Jain 9456ac994e Merge branch 'feat/replace_mbedtls_sha_with_esp_sha_espcoredump' into 'master' 
feat(espcoredump): migrate to esp sha256 implementation from mbedtls sha256

See merge request espressif/esp-idf!46705
 2026-07-06 12:20:39 +05:30
Mahavir Jain 3706197f6c Merge branch 'fix/tls1_3_dynamic_buffer_server_crash' into 'master' 
fix(mbedtls): fixes TLS1.3 server failing with dynamic buffer

Closes SEC-1111

See merge request espressif/esp-idf!48777
 2026-07-06 11:04:50 +05:30
Mahavir Jain 1e2b539c1c Merge branch 'bugfix/memory-safety-and-validation' into 'master' 
fix(security): findings from project Vanessa

Closes SEC-1110, SEC-1115, SEC-1128, SEC-1144, SEC-763, SEC-1159, SEC-1058, SEC-609, SEC-1146, SEC-1163, SEC-1148, SEC-1176, SEC-1177, SEC-109, SEC-1156, SEC-1173, SEC-1174, SEC-1175, SEC-1117, SEC-1171, SEC-231, SEC-1182, SEC-1188, SEC-1157, SEC-328, and SEC-1131

See merge request espressif/esp-idf!50093
 2026-07-03 23:26:21 +05:30
Mahavir Jain 8d9fe4d5fe Merge branch 'fix/revert_redundant_rom_pmp_18769' into 'master' 
revert(esp_hw_support): Re-add separate D-ROM PMP entry on C6/H2

Closes IDFGH-17871

See merge request espressif/esp-idf!50161
 2026-07-03 17:53:58 +05:30
Mahavir Jain 6df37e9bec Merge branch 'fix/fix_psk_hint_key_null_dereference' into 'master' 
Fix/fix psk hint key null dereference

Closes IDF-15854 and TZ-2615

See merge request espressif/esp-idf!50179
 2026-07-03 09:39:31 +05:30
Mahavir Jain 625ee1abb7 Merge branch 'fix/harden_esp_security' into 'master' 
fix(esp_security): harden crypto peripheral error handling

Closes SEC-236, SEC-351, SEC-352, SEC-353, SEC-355, SEC-356, and SEC-357

See merge request espressif/esp-idf!49828
 2026-07-03 09:11:33 +05:30
Mahavir Jain 55c6099838 Merge branch 'refactor/normalize_tee_pycli_script_output' into 'master' 
refactor(esp_tee): Normalize the `esp_tee` python tools CLI output

Closes IDF-15329

See merge request espressif/esp-idf!49274
 2026-07-03 08:55:22 +05:30
Mahavir Jain 4799efa609 Merge branch 'fix/httpd-content-length-truncation' into 'master' 
fix(esp_http_server): reject Content-Length above UINT32_MAX

Closes SEC-102 and SEC-229

See merge request espressif/esp-idf!47554
 2026-07-02 21:07:27 +05:30
Mahavir Jain bd250902b8 Merge branch 'fix/fix_esp_tee_failing_deterministic_ecdsa_sign' into 'master' 
fix(esp_tee): release SHA held by HMAC after crypto peripheral reset

See merge request espressif/esp-idf!50286
 2026-07-02 13:46:59 +05:30
Mahavir Jain 98f7c78787 Merge branch 'fix/gcc16_unused_but_set_variable' into 'master' 
Fix unused-but-set-variable warnings with GCC 16

See merge request espressif/esp-idf!50282
 2026-07-02 13:40:46 +05:30
Mahavir Jain e16593ebc0 fix(esp_psram): fix unused-but-set-variable warning with GCC 16 
GCC 16 flags the volatile accumulator in the cache writeback loops even
though it is volatile, as it is only used to update itself. Drop the
accumulator and rely on the volatile-qualified psram pointer to keep
the cache-line reads from being optimized out.
 2026-07-02 07:55:14 +05:30
Mahavir Jain bd567cf046 fix(wpa_supplicant): fix unused-but-set-variable warnings with GCC 16 
GCC 16 raised the default level of -Wunused-but-set-variable and now
flags variables that are only used to update themselves. Remove the
'removed' counter in pmksa_cache_flush() (its only read was commented
out) and mark the EAP-FAST PAC entry counters as unused, since their
only read is inside wpa_printf(MSG_DEBUG, ...) which compiles to a
no-op when debug logging is disabled.
 2026-07-02 07:55:13 +05:30
Mahavir Jain 1c5aa1c5cb Merge branch 'fix/aes_dma_psram_encrypted_mem_s31' into 'master' 
fix(mbedtls/aes): Fix AES-DMA over encrypted PSRAM on ESP32-S31

See merge request espressif/esp-idf!49935
 2026-07-01 12:16:13 +05:30
Mahavir Jain 195a88db1a Merge branch 'fix/panic_spiram_xip_irom_drom_alignment_no_gap' into 'master' 
Handle absent IROM/DROM alignment gap in SPIRAM-XIP memprot tests

Closes IDFCI-5004, IDFCI-11739, and IDFCI-11738

See merge request espressif/esp-idf!50133
 2026-06-30 18:16:52 +05:30
Mahavir Jain cb33ab16b3 Merge branch 'contrib/github_pr_18684' into 'master' 
feat(httpd): avoid useless string copy by introducing httpd_req_get_url_query_str_ptr() (GitHub PR)

Closes IDFGH-17758

See merge request espressif/esp-idf!49682
 2026-06-30 18:15:48 +05:30
Mahavir Jain 1ec9740baf Merge branch 'fix/harden_mbedtls_port_layer' into 'master' 
fix(mbedtls): harden port layer to zeroize sensitive material

Closes SEC-395

See merge request espressif/esp-idf!49693
 2026-06-29 18:45:17 +05:30
Mahavir Jain 12496c87bf Merge branch 'fix/esp_http_client_header_buffer_too_small' into 'master' 
feat(esp_http_client): detect oversized headers in tx buffer at send site

Closes IDFGH-17696

See merge request espressif/esp-idf!49056
 2026-06-29 11:39:47 +05:30
Mahavir Jain cb56e6cbd9 Merge branch 'feat/esp_http_server-ws-strictness-foundation-and-handshake' into 'master' 
feat(esp_http_server): update websocket server to check RFC6455 headers

See merge request espressif/esp-idf!48903
 2026-06-23 11:10:58 +05:30
Mahavir Jain bae7a9ee3a Merge branch 'fix/esp_tee_heap_poison' into 'master' 
fix(esp_tee): Prevent TEE from dispatching the REE heap poisoning callback

See merge request espressif/esp-idf!49773
 2026-06-22 19:09:01 +05:30
Mahavir Jain 3c40268442 Merge branch 'feat/psa_its_custom_backend' into 'master' 
Support custom storage backend for persistent PSA keys

Closes IDF-15506

See merge request espressif/esp-idf!47106
 2026-06-18 18:13:09 +05:30
Mahavir Jain 2d95d621b7 Merge branch 'fix/fault-assert-volatile-survive' into 'master' 
Make ESP_FAULT_ASSERT survive optimization

Closes IDF-15794

See merge request espressif/esp-idf!49644
 2026-06-18 16:27:53 +05:30
Mahavir Jain bf51d194fe Merge branch 'update/update_cmn_crt_authorities_csv' into 'master' 
Update common cert authorities csv

See merge request espressif/esp-idf!49372
 2026-06-18 09:30:11 +05:30
Mahavir Jain 09d2eacbef Merge branch 'fix/align_sw_psa_drivers_and_hw_esp_psa_drivers' into 'master' 
Align s/w and h/w PSA drivers

See merge request espressif/esp-idf!48730
 2026-06-16 10:38:31 +05:30
Mahavir Jain ba94421767 Merge branch 'fix/bootloader_esp_crypto_clk_iram_placement' into 'master' 
fix(bootloader): place esp_crypto_clk in loader IRAM section

See merge request espressif/esp-idf!49650
 2026-06-15 12:49:03 +05:30
Mahavir Jain efb28b55ca fix(bootloader): place esp_crypto_clk in loader IRAM section 
Commit 69d548c8 ("feat(esp_security): suppoer s31 security clock
management") introduced a new esp_crypto_clk source file in esp_security
but did not add it to the bootloader loader IRAM input sections. As a
result the crypto clock code was not placed in the loader IRAM region,
causing a regression on targets that use it during bootloader load.

Add *libesp_security.a:esp_crypto_clk.* to the bootloader sections
linker fragments for all targets that carry the esp_security.a
dependency (esp32c5, esp32p4, esp32s31), placed alongside
esp_crypto_periph_clk.
 2026-06-15 11:36:30 +05:30
Mahavir Jain fa918d7261 Merge branch 'fix/secure_boot_bootloader_ecdsa_range_gate' into 'master' 
Add ECDSA signature bounds check in bootloader before Secure Boot verify

See merge request espressif/esp-idf!49555
 2026-06-12 19:05:48 +05:30
Mahavir Jain e1713f44fb Merge branch 'fix/sb_digest_revocation_workflow' into 'master' 
change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot

See merge request espressif/esp-idf!49553
 2026-06-11 13:34:01 +05:30
Mahavir Jain ca4906dd91 Merge branch 'bugfix/fix_protocomm_sec2_double_free_decrypt' into 'master' 
fix(protocomm): null output buffer pointer on crypto failure

See merge request espressif/esp-idf!49411
 2026-06-10 17:28:36 +05:30
Mahavir Jain 8da7627526 change(bootloader): honor SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS during first boot 
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.

Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
 2026-06-10 13:09:10 +05:30
Mahavir Jain fa28dd8c12 docs(security): fix typos in security guides 
- security.rst: remove duplicated word in OTA encryption note
- tee.rst: remove duplicated word in memory allocation note
- flash-encryption.rst: drop redundant phrase and fix subject-verb agreement
 2026-06-10 13:09:09 +05:30
Mahavir Jain b9c8a13326 Merge branch 'fix/esp_tee_bbp' into 'master' 
fix(esp_tee): Harden TEE secure services against REE manipulation

See merge request espressif/esp-idf!48710
 2026-06-10 12:35:47 +05:30
Mahavir Jain 05c70c1fd4 Merge branch 'fix/ecdsa_ecc_hw_input_validation' into 'master' 
Validate ECDSA signature range and harden ECC memory power-down

See merge request espressif/esp-idf!48958
 2026-06-09 14:40:24 +05:30
Mahavir Jain edae80c202 Merge branch 'contrib/github_pr_18700' into 'master' 
Fixed typos in flash_encrypt.c (GitHub PR)

Closes IDFGH-17779

See merge request espressif/esp-idf!49388
 2026-06-08 16:04:40 +05:30
Mahavir Jain da6dfc30e9 Merge branch 'feat/adds_ds_qemu_test' into 'master' 
feat: adds mutual auth example

Closes IDF-2681

See merge request espressif/esp-idf!45641
 2026-06-04 20:43:00 +05:30
Mahavir Jain e70b59bc10 Merge branch 'fix/httpd_clang_tidy_missing_close' into 'master' 
fix(network/http_server): fix clang-tidy warnings for missing close

See merge request espressif/esp-idf!49203
 2026-06-04 20:33:48 +05:30
Mahavir Jain c97a2c4148 Merge branch 'docs/add_ws_post_handshake_cb_doc' into 'master' 
docs(esp_http_server): adds doc and migration entry for ws server post handshake cb

Closes IDFGH-17615 and DOC-14699

See merge request espressif/esp-idf!48153
 2026-05-29 10:35:21 +05:30
Mahavir Jain d0fb1cdad8 Merge branch 'feat/enable_sb_and_fe_support_for_esp32s31' into 'master' 
feat: enable Secure Boot, Flash Encryption and Key Manager support in ESP32S31

Closes IDF-14629, IDF-14628, IDF-14626, and IDF-14622

See merge request espressif/esp-idf!48136
 2026-05-29 10:31:34 +05:30
Mahavir Jain 26e80b8f97 Merge branch 'fix/codeowners_doc_link' into 'master' 
fix(gitlab): correct link to codeowners syntax

See merge request espressif/esp-idf!48879
 2026-05-27 18:38:14 +05:30
Mahavir Jain a004840c04 Merge branch 'ci/esp_tee_fuzzing' into 'master' 
ci(esp_tee): Add fuzzing tests for verifying service call behaviour with random inputs

Closes IDF-12698

See merge request espressif/esp-idf!37851
 2026-05-27 18:35:45 +05:30
Mahavir Jain e601a60baa Merge branch 'bugfix/increase_partition_nan' into 'master' 
fix(esp_wifi): Increase partition size of app for NaN console

See merge request espressif/esp-idf!48973
 2026-05-27 18:30:14 +05:30
Mahavir Jain 1fc4f6653a Merge branch 'fix/https-redirect-downgrade' into 'master' 
fix(esp_http_client): block HTTPS-to-HTTP redirect downgrade

See merge request espressif/esp-idf!47553
 2026-05-27 17:30:36 +05:30