Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-01 18:50:34 +03:00
Code Issues Packages Projects Releases Wiki Activity
50,639 Commits 25 Branches 192 Tags
a7b604fd33e63ce793906f7e910935976d4905d6
Commit Graph
73 Commits
Author SHA1 Message Date
Laukik Hase 440a5d1906 change(esp_tee): Move the internal memory secure service call table to IRAM 
- Using PMA, the TEE IRAM is marked as R/X while TEE DRAM is marked as R/W.
  Moving the internal memory secure service call table from DRAM to IRAM
  makes it immutable.
 2026-04-17 17:33:11 +05:30
Laukik Hase 7867f4a575 fix(esp_tee): Add missing input validation checks for TEE service calls 
- MULTI_HEAP_ASSERT for TEE now aborts on failure, instead of ignoring the condition
- Prevent potential TEE OTA write bounds overflow
 2026-04-08 14:05:28 +05:30
Laukik Hase 83e2777a3b feat(esp_tee): Miscellaneous fixes and improvements 
- Fix intermittent TEE stack underflow test failures
- Fix out-of-bounds access Coverity report from the attestation
  component
- Add appropriate checks and asserts for TEE flash memory regions'
  sizes
 2026-03-20 10:54:14 +05:30
Fu Hanxi 84d80dd37d tests: change wifi tests expect timeout to 60 
- wifi_router
- wifi_ap
- wifi_high_traffic
 2026-03-12 15:59:26 +08:00
Mahavir Jain ad25b61af6 Merge branch 'fix/externsive_mbedtls_aes_sha_tests_v6.0' into 'release/v6.0' 
Re-introduce the extensive mbedtls AES and SHA tests (v6.0)

See merge request espressif/esp-idf!45591
 2026-02-12 09:49:09 +05:30
Laukik Hase 68d31180f0 fix(esp_tee): Prevent IV reuse in the TEE secure storage AES-GCM service 2026-02-11 12:29:52 +05:30
harshal.patil 91c3738e81 test(mbedtls): Re-introduce the extensive AES, AES-GCM and the SHA tests 
- Also extend the PSRAM encryption test to ESP32-S3
 2026-02-03 13:04:32 +05:30
harshal.patil a9598b3304 feat(esp_tee): Support deterministic ECDSA signatures for ESP-TEE based keys 2026-01-31 10:59:16 +05:30
harshal.patil 5c55790f54 feat(mbedtls/ecdsa): Introduce PSA ECDSA driver 2026-01-31 10:59:11 +05:30
Laukik Hase a6d39908f7 fix(esp_tee): Fix TEE attestation stack protection fault with secure boot enabled 
- Increased the TEE stack when secure boot is enabled
- Also, generate a build error when the generated TEE binary image size is
  greater than the TEE partition size
 2026-01-29 11:49:17 +05:30
Laukik Hase f18697b544 refactor(esp_tee): Remove support for ECDSA secp192r1 keys in TEE secure storage 2026-01-29 11:49:16 +05:30
Laukik Hase b470f08c94 refactor(esp_tee): Update TEE attestation tests and examples to use the PSA interface 2026-01-29 11:49:16 +05:30
Laukik Hase d826448fd0 ci(esp_tee): Optimize the TEE pytest script 2026-01-29 11:49:15 +05:30
Laukik Hase 304adb120b refactor(esp_tee): Adopt Picolibc as the default LibC for ESP-TEE build 
- Also fixed an issue where NewLib ROM APIs, when called from TEE, were
  using the syscall table located in the REE SRAM. This could be abused
  as an attack vector to invoke illegal functions from the TEE.
  To prevent this, the syscall table is now switched to the TEE-specific
  copy during every M-U mode transition.
 2026-01-29 11:49:15 +05:30
Laukik Hase 421246323a feat(esp_tee): Add support for the RISC-V H/W stack guard mechanism 2026-01-29 11:49:14 +05:30
Laukik Hase 39f392f943 feat(esp_tee): Support ECDSA secp384r1 keys in TEE secure storage 2026-01-29 11:49:13 +05:30
Ashish Sharma 5d5ba9d008 fix: migrate PSA SHA driver to be similar to parallel engine port 2025-12-19 11:06:41 +08:00
Ashish Sharma 76287081ea feat: code cleanup 2025-12-19 07:29:43 +08:00
Ashish Sharma aa88c81dfb fix(wpa_supplicant): revert changes to dpp_crypto 2025-12-19 07:29:08 +08:00
Ashish Sharma f306dbea84 feat(mbedtls): migrates ESP-TEE with PSA APIs 2025-12-19 07:28:33 +08:00
Jiang Jiang Jian ee4be1af57 Merge branch 'feat/flash_enc_using_key_manager_v6.0' into 'release/v6.0' 
Support Flash Encryption using Key Manager (v6.0)

See merge request espressif/esp-idf!43459
 2025-11-24 10:35:48 +08:00
harshal.patil 792c93c597 change(mbedtls): Generalize key source union for the hardware ECDSA context 2025-11-20 11:37:07 +05:30
Laukik Hase 01f5050f6f ci(esp_tee): Enable the TEE examples for ESP32-C61 2025-11-20 11:01:29 +05:30
Laukik Hase 46de215007 ci(esp_tee): Enable the TEE test-apps for ESP32-C61 2025-11-19 10:57:43 +05:30
Laukik Hase 2394e9451d feat(esp_tee): Support for ESP32-C61 - the esp_tee component 2025-11-19 10:57:42 +05:30
Laukik Hase f20351eb3b fix(esp_tee): Use HAL APIs instead of ROM APIs for SPI flash service calls 
Currently, REE SPI flash HAL operations are routed as service calls to TEE,
but the TEE implementation incorrectly uses ROM APIs instead of HAL APIs.
This leads to issues and is not the recommended approach.
 2025-11-13 15:38:12 +05:30
Laukik Hase 73b6e718f2 ci(esp_tee): Remove incorrect error checks for TEE flash protection tests 
- Also fixed coverity issue from TEE secure storage
 2025-11-06 17:19:56 +05:30
Laukik Hase 9de1d631b4 feat(esp_tee): Reclaim unused TEE IRAM memory as heap 
- Changed the default TEE code placement to use the flash
  text section instead of IRAM text, making it consistent
  with the default data placement.
 2025-10-15 18:22:44 +05:30
Laukik Hase 20344640e3 fix(esp_tee): Split TEE SRAM as I/DRAM for ESP32-C5 with PMA 2025-10-15 18:22:43 +05:30
Laukik Hase 6e51fac96e Merge branch 'fix/esp_tee_flash_op_bound_checks' into 'master' 
fix(esp_tee): Correct flash operation bound checks to handle all overlap cases

Closes IDF-14129

See merge request espressif/esp-idf!41946
 2025-10-13 13:31:03 +05:30
Mahavir Jain 439b1d6d08 cleanup: move cJSON to component manager 2025-10-06 14:08:06 +05:30
Peter Dragun e3198fff3c feat: Update esptool to v5 2025-09-30 15:28:55 +02:00
Laukik Hase 8b92f3603f fix(esp_tee): Correct flash operation bound checks to handle all overlap cases 
- Ensure bound checks correctly handle all scenarios, including
  when a requested operation's (SPI0/1) range fully contains the
  TEE-protected region.
- Disable delegation of INTWDT timeout and Cache error interrupts as they reset
  the device after the panic handler
 2025-09-30 12:22:25 +05:30
morris 71cb24caab feat(timg): graduate the hal driver into a single component 2025-09-27 17:33:10 +08:00
Laukik Hase 649741fa9d Merge branch 'feat/nvs_flash_deregister_sec_scheme' into 'master' 
feat(nvs_flash): Added an API to deregister the NVS security scheme context

Closes IDF-12456 and IDFGH-16210

See merge request espressif/esp-idf!41073
 2025-09-22 11:11:34 +05:30
Laukik Hase c152663408 feat(esp_tee): Added support for PBKDF2-based (HMAC) ECDSA signing 2025-09-19 12:06:02 +05:30
Laukik Hase 1ea0fc261d change(nvs_sec_provider): Make the HMAC-based NVS security scheme default for supported SoCs 
- When NVS encryption is enabled on SoCs with the HMAC peripheral that have flash encryption
  enabled, the HMAC-based NVS encryption scheme is now selected as default instead of the
  flash encryption-based scheme.
- If your application previously used the flash encryption-based scheme, you need to manually
  configure the NVS encryption scheme to flash encryption from HMAC through ``menuconfig``
  or your project's ``sdkconfig`` (i.e., setting ``CONFIG_NVS_SEC_KEY_PROTECT_USING_FLASH_ENC=y``).
 2025-09-19 10:38:38 +05:30
Laukik Hase 57432bb336 fix(esp_tee): Skip taking the service call mutex when in critical sections 
- Fixes INT_WDT timeouts with mmap operations
- Add test-case for verifying parallel service calls
 2025-09-16 14:57:27 +05:30
Laukik Hase 8b812d4192 feat(esp_tee): Miscellaneous fixes and updates 
- Rename `tee_test_fw` app configs for better CI tracking
- Decrease the lower bound of TEE I/DRAM config options
- Trim the TEE test-apps build
- Improve the TEE/REE OTA pytest script with additional checks
- Fix build issues when `tee_sec_storage`/`tee_ota_ops` are a
  a part of the project build but ESP-TEE is disabled
 2025-09-16 14:54:06 +05:30
Marek Fiala 9d35d63651 feat(cmake): Update minimum cmake version to 3.22 (whole repository) 2025-08-19 14:44:32 +02:00
Laukik Hase 9b807a253d ci(esp_tee): Disable the TEE test-apps for ESP32-C5 temporarily 2025-08-18 18:42:02 +05:30
Laukik Hase bb55b0cefc ci(esp_tee): Enable the TEE test-apps for ESP32-C5 2025-08-13 14:09:00 +05:30
Laukik Hase ab8400df4a ci(esp_tee): Refactor the ESP-TEE test-cases 
- Improve the interrupt-related test cases
- Fix potential issues in the task-switching test
  during secure service calls
 2025-08-13 14:09:00 +05:30
Marius Vikhammer bf84ab652a change(test_utils): moved test_utils component to tools/test_apps/components/ 2025-07-21 14:05:50 +08:00
Fu Hanxi f33469dd63 ci: apply idf-ci build run 
removed script:

- tools/ci/dynamic_pipelines/scripts/child_pipeline_build_apps.py -> idf-ci build run
- tools/ci/ci_build_apps.py -> idf-build-apps build

moved from remove from idf_pytest/constants.py to .idf_build_apps.toml

- DEFAULT_FULL_BUILD_TEST_COMPONENTS
- DEFAULT_FULL_BUILD_TEST_FILEPATTERNS
- DEFAULT_IGNORE_WARNING_FILEPATH
- DEFAULT_BUILD_LOG_FILENAME
- DEFAULT_SIZE_JSON_FILENAME
 2025-07-09 10:33:28 +02:00
Fu Hanxi 0d5b3e60ac ci: remove --enable-pytest from install.sh 2025-07-09 10:33:26 +02:00
Laukik Hase 9b1aaa2778 fix(esp_tee): Fix coverity issues from the attestation component 
- Also fix the incorrect marker set for TEE OTA tests
 2025-06-23 11:45:12 +05:30
Laukik Hase a1c6d2a458 fix(esp_tee): Fix failing SPI1 flash protection test-cases 2025-05-22 17:35:09 +08:00
Laukik Hase b8e48fbfc0 ci(esp_tee): Enable the tee_test_fw test app for ESP32-H2 2025-05-20 16:31:23 +05:30
Laukik Hase c16fc04c2d docs(esp_tee): Revise TEE secure storage and related documentation 2025-05-04 18:22:22 +05:30