Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
45,929 Commits 25 Branches 192 Tags
d2765dfcc36e60e58cd73eba6af4fbbf87cb4fca
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
harshal.patil 6618558e7b refactor(esp_system): deduplicate ROM fast wake RTC digest reservation 
The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
 2026-07-31 11:05:47 +08:00
harshal.patil 4e4cb4123f fix(esp_common/esp_fault): make ESP_FAULT_ASSERT survive optimization 
ESP_FAULT_ASSERT(C) was silently deleted by the optimizer when C is a cached
flag/status already proven by a preceding `if (!C) return/goto`: the compiler
folds C to a constant and drops all three checks, removing the fault-injection
protection with no warning.
 2026-06-22 11:17:50 +05:30
harshal.patil 8110949d88 fix(secure_boot): range-check ECDSA r,s in bootloader before ROM verify 2026-06-22 11:17:50 +05:30
harshal.patil ad8d86f725 fix(esp_common): Add esp_fault_internal.h for use by G0 components 
In release/v5.x, esp_fault.h resides in the esp_hw_support (G1)
component, so the G0 components (hal, esp_rom) must not depend on it.
Copy its contents to esp_common as esp_fault_internal.h, keep
esp_fault.h as a compatibility wrapper around it, and switch the hal
and esp_rom ECDSA/ECC code to the internal header.
 2026-06-22 11:17:50 +05:30
harshal.patil 551fad393d test(mbedtls): Add out-of-bounds test for the ECDSA hardware driver 2026-06-22 11:17:50 +05:30
harshal.patil d9a3c1f866 fix(esp_rom): Patch ets_ecdsa_verify() to include signature bounds check 2026-06-22 11:17:50 +05:30
harshal.patilandAshish Sharma abcbe87e2d fix(mbedtls): validate ECDSA signature range and harden ECC memory power-down 
Co-Authored-By: Ashish Sharma <ashish.sharma@espressif.com>
 2026-06-22 11:17:50 +05:30
harshal.patil dff987476b fix(mbedlts/aes): Ensure cache coherency when DMA writes to cacheable PSRAM buffers 2026-01-14 11:22:20 +05:30
harshal.patil 5fa0347a8b fix(bootloader_support): Allow pre-programmed XTS-AES psuedo round level efuses 
- The API esp_flash_encryption_set_release_mode() by defualt programs
the XTS-AES pseudo round level efuse to level low but did not considered
any existing value that would have been programmed in the efuse bit.
 2025-09-30 15:38:44 +05:30
harshal.patil dd3d58a315 fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-09-30 15:38:27 +05:30
harshal.patil b40f14cff6 fix(bootloader_support): Reorder write protection bits of some shared security efuses 2025-09-30 15:37:25 +05:30
harshal.patil 93473a0558 change(mbedtls/ecdsa): The ECDSA module of ESP32-H2 ECO5 does not use MPI module 2025-08-13 20:38:12 +05:30
harshal.patil e761d83cf8 fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-25 08:48:16 +05:30
harshal.patil 9d2cfcd094 fix(bootlaoder): Fix documentation as ESP32 does not support secure download mode 2025-06-30 10:27:04 +05:30
harshal.patilandMahavir Jain f81c69eabc fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-05-26 13:34:38 +05:30
harshal.patil 26586deb7d fix(esp_psram): Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled 2025-05-05 11:52:15 +05:30
harshal.patil 9406fde68d feat(cpu_region_protect): Enable basic memory protection for SPIRAM 2025-05-05 11:52:04 +05:30
harshal.patil f77e96e7c6 feat(esp_psram): Add the gap created due to alignment of XIP segments in heap 2025-05-05 11:09:52 +05:30
harshal.patil fac460f89e feat(esp_psram): Add some helper APIs to get usable PSRAM memory size 2025-05-05 11:09:52 +05:30
harshal.patil 9276f7b294 fix(docs): Fix unterminated quotes in secure-boot-v2.rst 2025-05-02 15:16:39 +05:30
harshal.patil 05353d8d8f fix(mbedtls): Fix config dependencies when ROM mbedtls is used 2025-04-29 10:53:06 +05:30
harshal.patil 1f0aa66f4e fix(wpa_supplicant): Disable fastpbkdf2 when s/w and h/w SHA1 is disabled 2025-04-29 10:53:06 +05:30
harshal.patil 37dba24869 fix(esp-tls): Fix build failure when CONFIG_MBEDTLS_SHA1_C is disabled 2025-04-29 10:53:06 +05:30
harshal.patil dcd80b2528 fix(examples): Example CA certs must contain the Key Usage parameter 
- Example CA certificates that are used for self-signed client certificates
need to include the Key Usage parameter.
- Python3.13 changed the default context of the SSL context that is
generated using ssl.create_default_context() by enabling the VERIFY_X509_STRICT
flag by default
 2025-04-03 10:51:09 +05:30
harshal.patil 96f48cd1cf feat(mbedtls): Make mbedtls SHA1 support configurable 2025-04-01 12:40:55 +05:30
harshal.patil 0076bb0289 fix(secure_boot): Fix SB verification failure when sig block and key digest mismatch 
- Secure boot V2 verification failed when multiple keys are used to sign the bootloader
  and the application is signed with a key other than the first key that is used to
  sign the bootloader.
- The issue was introduced as a regression from the commit `ff16ce43`.
 2025-03-05 11:26:33 +05:30
harshal.patil 0cdcd3a0fb fix(esp_psram): Fix incorrect calculation of used XIP PSRAM pages 
The functions mmu_config_psram_text_segment() and mmu_config_psram_rodata_segment()
used to return the value of next start page in *out_page instead of the number
of pages used as mentioned in the documentation
 2025-03-05 10:37:21 +05:30
harshal.patil 646492db0c fix(esptool_py): Fix NVS partition being incorrectly marked as encrypted 
- The CMake function esptool_py_partition_needs_encryption() in the esptool_py
component used to mark NVS partition as encrypted, instead it should have marked
the NVS keys partition as encrypted.
 2025-01-30 12:01:21 +05:30
harshal.patil b06a4c198a feat(bootloader_support): Permanently enable XTS-AES pseudo rounds when FE release mode is enabled 2025-01-21 12:28:23 +05:30
harshal.patil e3acb360e3 feat(hal/spi_flash_encrypted): Enable pseudo rounds function during XTS-AES operations 2025-01-21 12:28:23 +05:30
harshal.patil 7d803e661e feat(hal/aes): Enable pseudo rounds function during AES operations 2025-01-21 12:28:23 +05:30
harshal.patil e0312feddb fix(mbedtls/aes): Fix external memory corruption caused due to unaligned length cache sync 
Fixes the memory corruption issue that arises due to external memory cache sync of unaligned
length bytes when L2 cache line size is greater than the L1 cache line size
 2024-11-21 12:15:57 +05:30
harshal.patil 7c9bec2633 docs(mem_alloc): Fix typo to make a section visible for non-esp32 spiram targets 2024-11-05 16:13:08 +05:30
harshal.patil 8b8956f7ed ci(examples/protocols): Run the https x509 bundle default crt bundle stress test using QEMU 2024-11-05 13:31:48 +05:30
Harshal Patil 27f11f87f5 Merge branch 'feat/mbedtls_size_optimization' into 'master' 
Fix the increase in build size of mbedtls while upgrading to v3.x

See merge request espressif/esp-idf!34179
 2024-10-26 01:20:40 +08:00
harshal.patil 4cdfdac18c fix(mbedtls): Fix the increase in build size of mbedtls when upgrading to v3.x 2024-10-24 14:45:57 +05:30
harshal.patil c2b71a3855 ci(mbedtls): Fix component dependencies for security-related test apps 2024-10-24 14:45:56 +05:30
harshal.patilandHanno 3957e59f1a feat(mbedtls/esp_crt_bundle): Move dummy cert to .rodata to save 408B from dram 
Co-authored-by: Hanno <h.binder@web.de>
 2024-10-16 16:21:28 +05:30
harshal.patil 0702fb82b0 ci(examples/protocols): Add more testing connections in the x509 bundle example 
- This adds a test to try connecting to the domains that use the
most common certificate authorities with the default full cert bundle
 2024-10-09 16:08:35 +05:30
harshal.patil 20fff296e4 test(mbedtls): Update custom cert bundle init API - bound checking testcase 
- Support the newer cert bundle format in the test
 2024-10-09 16:08:35 +05:30
harshal.patil b097eb12b3 ci(mbedtls/esp_crt_bundle): Format esp_crt_bundle.c using astyle 2024-10-09 16:08:35 +05:30
harshal.patil e12c261b1b ci(esp_security): Add config to enable FPGA-related tests 2024-10-09 09:46:19 +05:30
harshal.patil 9e3a846356 ci(esp_security): Enable crypto drivers test app build only for supported targets 2024-10-09 09:46:18 +05:30
harshal.patil e1cd5b909e fix(esp_security): Fix build failure when dpa protection at startup is disabled 2024-09-20 18:46:55 +05:30
harshal.patil 39872a5575 feat(esp_security): Config to forcefully enable ECC constant-time operations during bootup 2024-09-20 18:46:55 +05:30
harshal.patilandaditya.patwardhan 46cbaa7d4d fix(mbedtls/ecc): Enable hardware ECC mult operations only for SOC_ECC_CONSTANT_TIME_MUL 
Co-authored-by: aditya.patwardhan <aditya.patwardhane@espressif.com>
 2024-09-20 18:46:55 +05:30
harshal.patil 2bf6a3cf8b feat(hal/ecc): Support ECC hardware constant-time point multiplication operations 2024-09-20 18:46:50 +05:30
harshal.patil 7667d9ebbe fix(cpu_region_protect): Reset PMA entries before using them 
- ROM uses some PMA entries so we clear such PMA entries before using them in ESP-IDF
 2024-09-18 10:25:18 +05:30
harshal.patil fcd751e79c ci(memprot): enable memory protection tests for ESP32-C61 2024-09-18 10:25:18 +05:30
harshal.patil c4f60d91f1 feat(mbedtls): Wrap mbedtls_ecdsa_read_signature to use ECDSA hardware when possible 2024-09-05 16:27:58 +05:30
harshal.patil 331fd7f79f fix(mbedtls/port): Check signature hash length before using ECDSA hardware 2024-09-05 16:27:58 +05:30
harshal.patil 945ad6ea5d ci(mbedtls): Enable PSRAM-related tests for ESP32-P4 and ESP32-C5 2024-08-30 17:19:12 +05:30
harshal.patil eec9197d47 feat(cpu_region_protect): Support memory protection in ESP32-C61 2024-08-28 11:16:28 +05:30
harshal.patil dc61456ad8 feat(cpu_region_protect): Protect I/D-ROM memory split 2024-08-28 11:16:27 +05:30
harshal.patil 95f286555a fix(esp_hw_support): Use _iram_text_end instead of _iram_end for I/D-RAM split 2024-08-28 11:16:27 +05:30
harshal.patil e5f22521da docs(secure_boot_v2): Mention idf.py and openssl commands to generate and verify signatures 
- Adds support for verify_signature command in idf.py

Closes https://github.com/espressif/esptool/issues/942
 2024-08-27 15:44:05 +05:30
harshal.patil ba49442683 Revert "ci(https_request): disable example for P4" 
This reverts commit 4b8a2b4a6e.
 2024-08-27 14:09:21 +05:30
harshal.patil c94986d793 fix(mbedtls): Fix https_request example build failure for mbedtls_config 
- This was caused due to some mbedtls confisg being defined but their all prerequisites were not
 2024-08-27 14:09:21 +05:30
harshal.patil 3b97011e39 fix(esp_security/ds): Clean up DS trying to re-acquire MPI lock post common crypto lock layer 2024-08-23 17:53:55 +05:30
Harshal Patil a00d22197c Merge branch 'change/secure_boot_config_description' into 'master' 
Improve description of the config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS

Closes IDF-9161

See merge request espressif/esp-idf!32651
 2024-08-21 22:08:23 +08:00
harshal.patilandZhang Shuxian 03a15664ee change(bootloader_support/secure_boot): Improve description of the config SECURE_BOOT_V2_ALLOW_EFUSE_RD_DIS 
Co-authored-by: Zhang Shuxian <zhangshuxian@espressif.com>
 2024-08-21 16:32:54 +05:30
harshal.patil 57db17bec2 feat(esp_security/crypto): Create a generic crypto locking layer across targets 2024-08-20 12:35:22 +08:00
harshal.patil 488b2a741d change(esp_security): Move the crypto locking layer into the security component 2024-08-20 12:35:22 +08:00
harshal.patil c125d21c71 change(esp_security): Move anti-DPA configuration into the security component 2024-08-20 12:35:22 +08:00
harshal.patil b729a0a732 change(esp_security): Move crypto clk configuration into the security component 2024-08-20 12:35:22 +08:00
harshal.patil 239734e3d5 feat(esp_security): Register a bare-metal security component 2024-08-20 12:35:22 +08:00
harshal.patil 14cbd837b3 ci(memprot): enable memory protection tests for ESP32-C5 2024-08-12 11:08:33 +05:30
harshal.patil b9dc847ee2 fix(mbedtls/aes): Avoid extra C2M sync of memory 2024-08-08 09:12:31 +05:30
harshal.patil 470ad32f2c fix(bootloader_support): Fix encrypt image instead of the partition feature not being enabled 2024-08-01 14:10:06 +05:30
Harshal Patil 2d9c7793b9 Merge branch 'update/update_certs_bundle' into 'master' 
Update esp_crt_bundle certificates

See merge request espressif/esp-idf!31875
 2024-07-09 14:14:59 +08:00
harshal.patil bd4e48d0d9 feat(cpu): Configure panic exception generation using asm illegal instruction 2024-06-25 11:55:24 +05:30
harshal.patil 84afc6a955 feat(esp_hw_support): Support memory protection using PMA and PMP for ESP32-C5 2024-06-25 11:55:15 +05:30
harshal.patil 980ac9bcf5 fix(soc): Fix ESP32-C5's rom mask high and subsystem high memory addresses 2024-06-25 11:39:22 +05:30
harshal.patil 4d6cb7bf23 docs(secure_boot): Add secure boot signature verification time for esp32p4 2024-06-21 21:59:55 +05:30
harshal.patil a31618b988 fix(tools/esp_prov): Fix incorrect input decoding when using console transport 
- Closes https://github.com/espressif/esp-idf/issues/14013
 2024-06-21 14:07:20 +05:30
harshal.patil a8f509f481 fix(esp_hw_support): Fix incorrect PMA configuration for ESP32-P4 
- As the PMA entry that made some memory regions cacheable was
assigned the highest priority, some intermediate inaccessible
memory regions bypassed protection.

- Added tests for the same

- Verified that even after changing the priority of the PMA entry,
a write operation at SOC_IRAM_LOW + 0x40 (a random RAM cached address)
still needs the same number (29) of CPU cycles.
 2024-06-10 11:55:58 +05:30
Harshal Patil 8657860580 Merge branch 'fix/mbedtls_port_coverity_fixes' into 'master' 
fix(mbedtls/port): Fix some divide-by-zero and deadcode coverity checks

Closes IDF-9851 and IDF-9846

See merge request espressif/esp-idf!30954
 2024-05-27 12:55:38 +08:00
harshal.patil 7c7c33ecbd fix(mbedtls/port): Fix some divide-by-zero and deadcode coverity checks 2024-05-23 09:45:44 +05:30
harshal.patil a15f19260b fix(soc): Cleanup inaccessible SHA registers from the header files 2024-05-20 15:34:42 +05:30
Harshal Patil bb34d78bce Merge branch 'fix/aes_ext_mem_case_for_older_targets' into 'master' 
fix(mbedtls/aes): Check location of the buffer only for SOC_AXI_DMA_EXT_MEM_ENC_ALIGNMENT

Closes IDFCI-2153

See merge request espressif/esp-idf!30850
 2024-05-16 15:10:28 +08:00
harshal.patil 141cdac87e fix(mbedtls/aes): Check location of the buffer only for SOC_AXI_DMA_EXT_MEM_ENC_ALIGNMENT 
When buffer_needs_realloc in the AES driver, check the location of the buffer only in case
of SOC_AXI_DMA_EXT_MEM_ENC_ALIGNMENT for allocating the newer buffer, otherwise use generic
DMA capable memory (as was done earlier)
 2024-05-16 13:36:30 +08:00
harshal.patil 1c21eb367e fix(hal/test_apps): Fix build failure of the crypto hal test app for ESP32-P4 
- Add bootloader_support component in its priv_requires as we use source files from mbedtls
 2024-05-14 11:53:44 +05:30
harshal.patil 3eb6487bb5 fix(bootloader_support): Make esp_flash_encrypt.h independent of spi_flash_mmap.h header 2024-05-13 16:54:45 +05:30
harshal.patil 5dfbc47192 fix(mbedtls/crypto_shared_gdma): Enable AXI-DMA enable external memory AES-ECC access 
- When external memory encryption is enabled, set the aes_ecc bit of AXI-DMA to enable memory access
 2024-05-13 16:54:45 +05:30
harshal.patil f07db4ef4d ci(otatool): fix test failure caused due to closing connection incorrectly 2024-04-15 17:09:39 +05:30
harshal.patil 6ec486e351 fix(esp_system): Enable crpyto peripherals related clocks for specific ESP32-P4 ECOs 2024-04-12 14:56:53 +05:30
harshal.patil 5ba9b53667 fix(hal): Clear reset on parent crpyto lock while resetting a crypto peripheral 2024-04-12 14:55:11 +05:30
harshal.patil e383616503 fix(mbedtls/aes): Fix incorrect dma alignment size 2024-04-02 14:30:14 +08:00
harshal.patil 1975c1c69e docs(security): Update security-related docs for ESP32-P4 2024-04-01 17:34:28 +05:30
harshal.patil 272633bde1 fix(mbedtls/ecdsa): Fix dependant peripheral's enable and reset 2024-03-29 12:40:13 +05:30
harshal.patil 84b6940ce4 feat(mbedtls/ecdsa): Wrapped ecdsa_write_signature to support deterministic ECDSA signatures 2024-03-29 12:14:11 +05:30
harshal.patil 70ef80d974 feat(mbedtls/ecdsa): Add support for deterministic ECDSA signature generation 2024-03-29 12:14:11 +05:30
harshal.patil cd98dfc3fd feat(hal): Add LL and HAL layer support for deterministic ECDSA 2024-03-29 12:14:11 +05:30
harshal.patil 95fac15698 feat(hal/ecdsa): Add HAL API for operation successful check 2024-03-29 12:14:11 +05:30
Harshal Patil 4ef1bf8031 Merge branch 'fix/esp32c5_sha_api_definitions' into 'master' 
fix(hal/sha): Add RCC enable and reset API definitions for ESP32-C5 SHA

Closes IDFCI-2111

See merge request espressif/esp-idf!29883
 2024-03-27 21:46:22 +08:00
harshal.patil e454fa4026 fix(hal/sha): Add RCC enable and reset API definitions for ESP32-C5 SHA 2024-03-27 18:09:33 +05:30
Harshal Patil 5274bf88e4 Merge branch 'esp32p4/add_sha_support' into 'master' 
feat: add SHA support for ESP32-P4

Closes IDF-7541 and IDF-7882

See merge request espressif/esp-idf!24865
 2024-03-27 20:08:28 +08:00
harshal.patil 22857529dd ci(hal/crypto): Update crypto test app to use SHA-DMA process API from mbedtls 2024-03-27 11:23:30 +05:30
harshal.patil 9cd10e196b feat(hal/sha): use RCC atomic block to enable/reset the SHA peripheral 2024-03-27 11:23:30 +05:30
harshal.patil 211a2a5477 feat(mbedtls/sha): Support SHA-DMA operations by satisfying L1 cache alignment requirements 
- Use block mode as default SHA operation mode instead of DMA
 2024-03-27 11:23:29 +05:30