Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity
46,398 Commits 25 Branches 192 Tags
ded4814c8d4e3a40a7caeec3617afefb7f2cbfc2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
harshal.patil cb9acbdd21 fix(secure_boot): Application's Secure Boot verify API support ECDSA-P384 2025-12-24 10:42:15 +05:30
harshal.patil 11c8f6aa94 fix(mbedtls/aes): Reallocate buffers only if in external RAM 2025-12-12 13:00:40 +05:30
harshal.patil 76436b3418 fix(mbedtls/port): Use internal buffers to perform chunkwise operations 
when the external input and output buffers are unaligned.
This also fixes as a recursion loop that occurs when the size of the input
buffer is not aligned to dcache_line_size but is aligned to AES_BLOCK_BYTES
 2025-12-01 18:15:25 +05:30
harshal.patil 6ea63548d4 fix(esp_security): Set WR_DIS_SECURE_BOOT_SHA384_EN by default when 
Flash Encryption Release mode is enabled and Secure Boot P384 scheme not is enabled.
 2025-11-11 17:53:04 +05:30
harshal.patil 7b57a1cd16 fix(esp_security): Fix undefined efuse build failure in case of ESP32-P4 
- The `wr_dis` efuse bit corresponding to `SECURE_BOOT_SHA384_EN` is absent in P4
 2025-11-11 17:53:04 +05:30
harshal.patil 317a6f074d fix(mbedtls/port): Align AES and SHA DMA buffers to 16 when SPIRAM encryption is enabled 
- Targets that support GDMA and MSPI encryption module need data and addresses aligned to 16
 2025-11-11 17:45:11 +05:30
harshal.patil 6ab5a2f883 fix(esp_security): Configure the Key Manager to use XTS-AES efuse key by-default 2025-10-13 10:40:50 +05:30
harshal.patil 175a6510f5 fix(bootloader_support): Allow pre-programmed XTS-AES psuedo round level efuses 
- The API esp_flash_encryption_set_release_mode() by defualt programs
the XTS-AES pseudo round level efuse to level low but did not considered
any existing value that would have been programmed in the efuse bit.
 2025-10-13 10:40:16 +05:30
harshal.patil 70a8b4d842 fix(bootloader_support): Reorder write disabling ECDSA_CURVE_MODE 2025-10-13 10:40:16 +05:30
harshal.patil d902072d80 fix(bootloader_support): Reorder write protection bits of some shared security efuses 2025-10-13 10:40:16 +05:30
harshal.patil ae7d7542e0 fix(esp_key_mgr): Fix incorrect key manager state management 2025-09-12 17:26:27 +05:30
harshal.patil 4213e41bbd fix(soc): Disable XTS-AES-256 using efuse key for ESP32-C5 2025-08-19 21:59:34 +05:30
harshal.patil f6f15bf91a change(mbedtls/ecdsa): The ECDSA module of ESP32-H2 ECO5 does not use MPI module 2025-08-13 18:53:19 +05:30
harshal.patil 12393745c2 fix(esp_system): Remove redundant crypto clock source selection 2025-07-25 14:43:56 +05:30
harshal.patil 6a03c8ffee ci(security): Security test app updated yml 
- Also fixes the errors generated by the check-test-scripts command
 2025-07-25 14:43:56 +05:30
harshal.patil 3d6423a251 docs(secure-boot-v2): Update the signature verification timings 
- THe timings are calculated for the ROM verifying the bootloader's signature
 2025-07-25 14:43:56 +05:30
harshal.patil c473b3deee docs(secure_boot_v2): Add documentation for Secure Boot V2 using ECDSA-P384 2025-07-25 14:43:56 +05:30
harshal.patil 9822c6f199 test(secure_boot): Add tests for ECDSA-based secure boot scheme 2025-07-25 14:43:46 +05:30
harshal.patil 96f11e01bf test(examples/efuse): Add test for secure boot v2 using ecdsa-p384 2025-07-25 14:25:33 +05:30
harshal.patil 476f8f6f51 feat(bootloader_support): Support Secure Boot using ECDSA-P384 curve 2025-07-25 14:25:31 +05:30
harshal.patil 55f693d4dd change(bootloader_support/secure_boot): Allow NULL as verified_digest for app build 
The esp_secure_boot_verify_sbv2_signature_block() and esp_secure_boot_verify_rsa_signature_block()
APIs need and use the verified_digest argument only for BOOTLOADER_BUILD, but the argument is
not used in the application code, and the value present in verified_digest is considered invalid.
Thus, allow passing NULL as the verified_digest parameter to help some save space.
 2025-07-25 14:23:02 +05:30
harshal.patil 1b3eb8f93e fix(bootloader_support/secure_boot): Fix incorrect usage of ESP_SECURE_BOOT_KEY_DIGEST_LEN 2025-07-25 14:23:02 +05:30
harshal.patil 61b0b072f9 fix(mbedtls/gcm): Allow enabling GCM fallback only if software GCM is available 2025-07-25 08:48:00 +05:30
harshal.patil 1c0b86e00c docs(bootloader): Change the default value of maximum supported bootloader size 2025-07-24 17:18:19 +05:30
harshal.patil 0644f453be fix(bootlaoder): Fix documentation as ESP32 does not support secure download mode 2025-06-30 10:26:36 +05:30
harshal.patil 5210e576d5 feat(mbedtls/sha): New API for setting SHA mode 2025-06-18 16:46:39 +05:30
harshal.patil e7a76ff71e feat(soc): Update ESP32-C5 ECO2 to support SHA512 2025-06-18 16:46:39 +05:30
harshal.patilandMahavir Jain 07ae83249a fix(mbedtls/esp_crt_bundle): Suppress non-negative serial number warning 
Co-authored-by: Mahavir Jain <mahavir.jain@espressif.com>
 2025-06-04 17:37:47 +05:30
harshal.patil 59496b4927 fix(system_internal): Avoid the sec clock reset caused due to resetting all crypto peripherals 2025-05-26 11:40:51 +05:30
harshal.patil 1ba8abd8b7 fix(mbedtls): Enable signature verification s/w fallback when ECDSA curve is disabled 2025-05-20 12:18:07 +05:30
Harshal Patil 51fef26287 Merge branch 'fix/configure_xip_psram_alignment_gaps_heap_by_default' into 'master' 
Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled

See merge request espressif/esp-idf!38888
 2025-05-12 15:07:07 +08:00
harshal.patil 3123fff18a fix(esp_psram): Add XIP PSRAM alignment gaps in heap only if PSRAM protection is enabled 2025-05-05 10:50:19 +05:30
Harshal Patil d898c2398b Merge branch 'feat/some_xip_psram_related_optimisations_and_fixes' into 'master' 
feat(esp_psram): Fix late PSRAM init and add some wasted XIP PSRAM memory in heap

Closes IDF-11463 and IDF-10555

See merge request espressif/esp-idf!37116
 2025-04-30 00:02:19 +08:00
harshal.patil 43a0026701 fix(hal/sha): Fix unaligned memory access in case of non-byte aligned regions 2025-04-29 14:08:42 +05:30
harshal.patil 003b54ebfe feat(esp_psram): XIP from PSRAM can be used only when SPIRAM_BOOT_INIT=y for ESP32P4 
In case of ESP32-P4, if SPIRAM memory initialisations are not performed during
boot-up, XIP PSRAM can be setup because of different virtual range of PSRAM and Flash
 2025-04-29 11:48:28 +05:30
harshal.patil c67901fc07 ci(esp_psram): Add a test to validate non-bootup PSRAM initialisation 
- Also adds a test for the newly added PSRAM helper APIs:
esp_psram_get_heap_pool_size() and esp_psram_get_effective_mapped_size()
 2025-04-29 11:48:28 +05:30
harshal.patil f58c78b644 fix(esp_psram): Fix loading PSRAM XIP segments after PMP split has been configured 2025-04-29 11:48:27 +05:30
harshal.patil ab229a34b3 feat(cpu_region_protect): Enable basic memory protection for SPIRAM 2025-04-29 11:48:27 +05:30
harshal.patil 49f253361e feat(esp_psram): Add the gap created due to alignment of XIP segments in heap 2025-04-29 11:48:27 +05:30
harshal.patil 0f628496c8 feat(esp_psram): Add some helper APIs to get usable PSRAM memory size 2025-04-29 11:48:27 +05:30
harshal.patil 46225a4026 feat(esp_psram): Add a new API to just detect and enable the PSRAM 
- esp_psram_chip_init() just detects and does basic initialisations of PSRAM
- esp_psram_init() initialises and maps/loads the PSRAM pages
 2025-04-29 11:48:27 +05:30
harshal.patil b0d9ccf6e3 fix(mbedtls): Fix config dependencies when ROM mbedtls is used 2025-04-21 13:38:29 +05:30
harshal.patil a42be5b1dd fix(wpa_supplicant): Disable fastpbkdf2 when s/w and h/w SHA1 is disabled 2025-04-21 13:38:29 +05:30
harshal.patil e738ec5ccd fix(esp-tls): Fix build failure when CONFIG_MBEDTLS_SHA1_C is disabled 2025-04-21 13:38:29 +05:30
harshal.patil 75fd14efbc fix(docs): Fix unterminated quotes in secure-boot-v2.rst 2025-04-21 11:18:22 +05:30
harshal.patil 9221c4eecd fix(examples): Example CA certs must contain the Key Usage parameter 
- Example CA certificates that are used for self-signed client certificates
need to include the Key Usage parameter.
- Python3.13 changed the default context of the SSL context that is
generated using ssl.create_default_context() by enabling the VERIFY_X509_STRICT
flag by default
 2025-04-03 09:20:35 +05:30
harshal.patil 4edd6c1f6d fix(bootloader_support): Fix sha handle memory leak when returning error 2025-03-27 09:18:30 +05:30
Harshal Patil a45d713b03 Merge branch 'refactor/unify_bootloader_sha' into 'master' 
Unify the bootloader_sha layer

Closes IDF-12704

See merge request espressif/esp-idf!37927
 2025-03-26 19:15:25 +08:00
harshal.patil a02dec09ca refactor(bootloader_support): Unify bootloader_sha layer 2025-03-21 16:37:20 +05:30
harshal.patil e442f11320 feat(mbedtls): Make mbedtls SHA1 support configurable 2025-03-19 14:28:40 +05:30
harshal.patil a6ea9bcd41 fix(secure_boot): Fix SB verification failure when sig block and key digest mismatch 
- Secure boot V2 verification failed when multiple keys are used to sign the bootloader
  and the application is signed with a key other than the first key that is used to
  sign the bootloader.
- The issue was introduced as a regression from the commit `ff16ce43`.
- Added a QEMU test for recreating the issue.
- Made SECURE_BOOT_FLASH_BOOTLOADER_DEFAULT independent of SECURE_BOOT_BUILD_SIGNED_BINARIES.
 2025-03-04 11:26:51 +05:30
harshal.patil 700f62e206 feat(wpa_supplicant): Support all targets generically in fastpsk 2025-03-03 14:04:45 +05:30
harshal.patil a1e6387c16 fix(esp_psram): Fix incorrect calculation of used XIP PSRAM pages 
The functions mmu_config_psram_text_segment() and mmu_config_psram_rodata_segment()
used to return the value of next start page in *out_page instead of the number
of pages used as mentioned in the documentation
 2025-02-21 11:07:39 +05:30
harshal.patil d403005afc change(mbedtls/sha): Change the legacy formatting in the SHA port layers 2025-02-11 11:04:57 +05:30
harshal.patil 2717e5b62e fix(mbedtls/sha): Fix some local variable's types to avoid any substraction overflow error 
- Though such a case would not occur given the way it is used the driver layer
 2025-02-11 10:58:16 +05:30
Harshal Patil 7c9c2537ed Merge branch 'feat/support_both_aes_and_sha_block_and_dma_modes_during_runtime' into 'master' 
feat(mbedtls): Support both SHA block and DMA modes during runtime

Closes IDF-11848

See merge request espressif/esp-idf!36589
 2025-02-06 11:19:51 +08:00
harshal.patil 7d8211bf87 feat(mbedtls): Support both SHA block and DMA modes during runtime 
Dynamically switch the SHA operation modes based on the buffer operating length
 2025-02-04 16:49:30 +05:30
harshal.patil 62df1017ad change(nvs_sec_provider): Change NVS encryption's default efuse HMAC key ID to -1 2025-01-29 18:51:29 +05:30
harshal.patil f205476ffe fix(nvs_flash): Add encrypted-flash as the dependency in nvs_create_partition_image() 2025-01-29 18:51:29 +05:30
harshal.patil c7f86301e6 change(bootloader): Increase the iram_seg size of bootloader to fit NVS encryption 2025-01-29 18:51:29 +05:30
harshal.patil 5b17375aca test(nvs_flash): Extend the nvs_flash test app to support encrypted NVS reads 2025-01-29 18:51:29 +05:30
harshal.patil 3b7d71eca2 feat(examples): Extend the bootloader_nvs example to support encrypted NVS reads 2025-01-29 18:51:29 +05:30
harshal.patil cadd6b8bcc feat(nvs_flash): Support reading encrypted NVS partitions in the bootloader 2025-01-29 18:51:29 +05:30
harshal.patil 37de702e97 feat(nvs_flash): Enable the usage of mbedtls from ROM for bootloader NVS decryption 
Bootloader NVS decryption uses hardware ROM APIs to decrypt the NVS contents,
but for targets that do not support AES hardware we could benefit by using the
software mbedtls library that is present in the ROM directly.
 2025-01-29 18:51:29 +05:30
harshal.patil 7c3832ff2a feat(nvs_flash): Add a minimal XTS-AES layer for the bootloader 2025-01-29 18:51:29 +05:30
harshal.patil 4c38499303 fix(esp_partition): Support reading unencrypted partitions by the bootloader 
- When flash encryption is enable to support reading a partition that is not
marked as "encrypted", the `esp_partition_read()` API of bootloader build
should be redirected to the `bootloader_flash_read()` API.
 2025-01-29 18:51:28 +05:30
harshal.patil eb05db30fc fix(esptool_py): Fix NVS partition being incorrectly marked as encrypted 
- The CMake function esptool_py_partition_needs_encryption() in the esptool_py
component used to mark NVS partition as encrypted, instead it should have marked
the NVS keys partition as encrypted.
 2025-01-29 18:51:28 +05:30
harshal.patil 2ee22f968a fix(nvs_flash): Allow matching with partition when label provided is NULL 
- When esp_parition_find_first() is called with the partition label provided
as NULL by the bootloader, allowing matching to the first partition that matches
partition_type and partition_subtype as done in the app variant.
 2025-01-29 18:51:28 +05:30
harshal.patil 21c11caf70 fix(soc): Add the unavailable TRM mentioned RNG_DATA_REG register for C2 and C3 2025-01-24 10:50:05 +05:30
Harshal Patil 9cabe79385 Merge branch 'fix/incorrect_reserved_bits_calculation_in_xts_pseudo_round_conf' into 'master' 
fix(soc): Fix incorrect reserved bits calculation in xts_pseudo_round_conf

See merge request espressif/esp-idf!36473
 2025-01-23 18:49:03 +08:00
harshal.patil f6be421a48 fix(bootloader_support): Enable pseudo round function in flash enc release mode for H2-ECO5 2025-01-21 12:21:42 +05:30
harshal.patil 5863b66ba5 fix(soc): Fix incorrect reserved bits calculation in xts_pseudo_round_conf 2025-01-20 13:30:03 +05:30
Harshal Patil a45b6e7b72 Merge branch 'feat/support_aes_pseudo_round_func_in_esp32h2_eco5' into 'master' 
Support AES and XTS-AES's pseudo round function in ESP32H2-ECO5

Closes IDF-11400 and IDF-11401

See merge request espressif/esp-idf!36041
 2025-01-15 23:22:18 +08:00
harshal.patil b26109cede feat(hal/spi_flash_encrypted): Support AES pseudo rounds function in ESP32-H2 ECO5 2025-01-15 16:00:44 +05:30
harshal.patil 1a7c52a230 feat(hal/aes): Support AES pseudo rounds function in ESP32-H2 ECO5 2025-01-15 16:00:44 +05:30
harshal.patil f02dc64ce6 feat(bootloader_support): Permanently enable pseudo rounds function for XTS-AES during start-up 2024-12-03 11:17:54 +05:30
harshal.patil fba8ab89da feat(hal/spi_flash_encrypted): Enable pseudo rounds function during XTS-AES operations 2024-12-03 11:17:54 +05:30
harshal.patil a2d6be9976 feat(hal/crypto): Add XTS-AES peripheral verification tests in the crypto test app 2024-12-03 11:17:54 +05:30
harshal.patil c6ea979efa feat(hal/aes): Enable pseudo rounds function during AES operations 2024-12-03 11:17:54 +05:30
harshal.patil 2560484e4a fix(mbedtls/port): Fixed overflowed constant in esp_mpi_exp_mpi_mod_hw_op() 2024-11-27 11:39:42 +05:30
harshal.patil f62bb46b48 fix(mbedtls/aes): Fix external memory corruption caused due to unaligned length cache sync 
Fixes the memory corruption issue that arises due to external memory cache sync of unaligned
length bytes when L2 cache line size is greater than the L1 cache line size
 2024-11-14 15:03:19 +05:30
Harshal Patil d46b23d44b Merge branch 'docs/fix_section_visibility_esp32p4' into 'master' 
Fix typo to make a section visible for non-esp32 SPIRAM supported targets

See merge request espressif/esp-idf!34482
 2024-11-05 18:37:35 +08:00
harshal.patil 7786cbe2c8 docs(mem_alloc): Fix typo to make a section visible for non-esp32 spiram targets 2024-11-05 10:56:20 +05:30
Harshal Patil ae51dcc227 Merge branch 'ci/nightly_run_crt_bundle_stress_test' into 'master' 
Run https x509 bundle default crt bundle stress test using QEMU

See merge request espressif/esp-idf!34508
 2024-11-05 13:19:51 +08:00
harshal.patil 5cc9931dc7 ci(examples/protocols): Run the https x509 bundle default crt bundle stress test using QEMU 2024-11-04 22:42:37 +05:30
Harshal Patil 27f11f87f5 Merge branch 'feat/mbedtls_size_optimization' into 'master' 
Fix the increase in build size of mbedtls while upgrading to v3.x

See merge request espressif/esp-idf!34179
 2024-10-26 01:20:40 +08:00
harshal.patil 4cdfdac18c fix(mbedtls): Fix the increase in build size of mbedtls when upgrading to v3.x 2024-10-24 14:45:57 +05:30
harshal.patil c2b71a3855 ci(mbedtls): Fix component dependencies for security-related test apps 2024-10-24 14:45:56 +05:30
harshal.patilandHanno 3957e59f1a feat(mbedtls/esp_crt_bundle): Move dummy cert to .rodata to save 408B from dram 
Co-authored-by: Hanno <h.binder@web.de>
 2024-10-16 16:21:28 +05:30
harshal.patil 0702fb82b0 ci(examples/protocols): Add more testing connections in the x509 bundle example 
- This adds a test to try connecting to the domains that use the
most common certificate authorities with the default full cert bundle
 2024-10-09 16:08:35 +05:30
harshal.patil 20fff296e4 test(mbedtls): Update custom cert bundle init API - bound checking testcase 
- Support the newer cert bundle format in the test
 2024-10-09 16:08:35 +05:30
harshal.patil b097eb12b3 ci(mbedtls/esp_crt_bundle): Format esp_crt_bundle.c using astyle 2024-10-09 16:08:35 +05:30
harshal.patil e12c261b1b ci(esp_security): Add config to enable FPGA-related tests 2024-10-09 09:46:19 +05:30
harshal.patil 9e3a846356 ci(esp_security): Enable crypto drivers test app build only for supported targets 2024-10-09 09:46:18 +05:30
harshal.patil e1cd5b909e fix(esp_security): Fix build failure when dpa protection at startup is disabled 2024-09-20 18:46:55 +05:30
harshal.patil 39872a5575 feat(esp_security): Config to forcefully enable ECC constant-time operations during bootup 2024-09-20 18:46:55 +05:30
harshal.patilandaditya.patwardhan 46cbaa7d4d fix(mbedtls/ecc): Enable hardware ECC mult operations only for SOC_ECC_CONSTANT_TIME_MUL 
Co-authored-by: aditya.patwardhan <aditya.patwardhane@espressif.com>
 2024-09-20 18:46:55 +05:30
harshal.patil 2bf6a3cf8b feat(hal/ecc): Support ECC hardware constant-time point multiplication operations 2024-09-20 18:46:50 +05:30
harshal.patil 7667d9ebbe fix(cpu_region_protect): Reset PMA entries before using them 
- ROM uses some PMA entries so we clear such PMA entries before using them in ESP-IDF
 2024-09-18 10:25:18 +05:30
harshal.patil fcd751e79c ci(memprot): enable memory protection tests for ESP32-C61 2024-09-18 10:25:18 +05:30