Merge branch 'fix/host_based_security_workflows_v5.2' into 'release/v5.2'

fix(security): Fix host based security workflow doc

See merge request espressif/esp-idf!33959

components/bt/controller/esp32/bt.c

@@ -1634,7 +1634,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
 
     btdm_cfg_mask = btdm_config_mask_load();
 
-    if (btdm_controller_init(btdm_cfg_mask, cfg) != 0) {
+    err = btdm_controller_init(btdm_cfg_mask, cfg);
+
+    if (err != 0) {
+        ESP_LOGE(BTDM_LOG_TAG, "%s %d\n",__func__,err);
         err = ESP_ERR_NO_MEM;
         goto error;
     }

components/bt/controller/esp32c3/bt.c

@@ -1433,7 +1433,10 @@ esp_err_t esp_bt_controller_init(esp_bt_controller_config_t *cfg)
     periph_module_enable(PERIPH_BT_MODULE);
     periph_module_reset(PERIPH_BT_MODULE);
 
-    if (btdm_controller_init(cfg) != 0) {
+    err = btdm_controller_init(cfg);
+
+    if (err != 0) {
+        ESP_LOGE(BT_LOG_TAG, "%s %d\n",__func__,err);
         err = ESP_ERR_NO_MEM;
         goto error;
     }

components/bt/host/bluedroid/Kconfig.in

@@ -66,7 +66,7 @@ config BT_A2DP_ENABLE
     depends on BT_CLASSIC_ENABLED
     default n
     help
-        Advanced Audio Distrubution Profile
+        Advanced Audio Distribution Profile
 
 config BT_SPP_ENABLED
     bool "SPP"
@@ -121,7 +121,7 @@ config BT_HFP_WBS_ENABLE
     default y
     help
         This enables Wide Band Speech. Should disable it when SCO data path is PCM.
-        Otherwise there will be no data transmited via GPIOs.
+        Otherwise there will be no data transmitted via GPIOs.
 
 
 menuconfig BT_HID_ENABLED
@@ -1064,7 +1064,7 @@ config BT_ACL_CONNECTIONS
         is used.
 
 config BT_MULTI_CONNECTION_ENBALE
-    bool "Enable BLE multi-conections"
+    bool "Enable BLE multi-connections"
     depends on BT_BLE_ENABLED
     default y
     help

components/bt/host/bluedroid/api/include/api/esp_gap_bt_api.h

@@ -435,8 +435,9 @@ typedef union {
      * @brief ESP_BT_GAP_MODE_CHG_EVT
      */
     struct mode_chg_param {
-        esp_bd_addr_t bda;                      /*!< remote bluetooth device address*/
-        esp_bt_pm_mode_t mode;                  /*!< PM mode*/
+        esp_bd_addr_t bda;                      /*!< remote bluetooth device address */
+        esp_bt_pm_mode_t mode;                  /*!< PM mode */
+        uint16_t interval;                      /*!< Number of baseband slots. unit is 0.625ms */
     } mode_chg;                                 /*!< mode change event parameter struct */
 
     /**

components/bt/host/bluedroid/bta/dm/bta_dm_pm.c

@@ -75,7 +75,7 @@ void bta_dm_init_pm(void)
 {
     memset(&bta_dm_conn_srvcs, 0x00, sizeof(bta_dm_conn_srvcs));
 
-    /* if there are no power manger entries, so not register */
+    /* if there are no power manager entries, so not register */
     if (p_bta_dm_pm_cfg[0].app_id != 0) {
         bta_sys_pm_register((tBTA_SYS_CONN_CBACK *)bta_dm_pm_cback);
 
@@ -694,9 +694,9 @@ static BOOLEAN bta_dm_pm_sniff(tBTA_DM_PEER_DEVICE *p_peer_dev, UINT8 index)
 #endif
     {
 #if (BTM_SSR_INCLUDED == TRUE)
-        /* Dont initiate Sniff if controller has alreay accepted
+        /* Dont initiate Sniff if controller has already accepted
          * remote sniff params. This avoid sniff loop issue with
-         * some agrresive headsets who use sniff latencies more than
+         * some aggressive headsets who use sniff latencies more than
          * DUT supported range of Sniff intervals.*/
         if ((mode == BTM_PM_MD_SNIFF) && (p_peer_dev->info & BTA_DM_DI_ACP_SNIFF)) {
             APPL_TRACE_DEBUG("%s: already in remote initiate sniff", __func__);
@@ -917,7 +917,7 @@ void bta_dm_pm_btm_status(tBTA_DM_MSG *p_data)
         } else {
 #if (BTM_SSR_INCLUDED == TRUE)
             if (p_dev->prev_low) {
-                /* need to send the SSR paramaters to controller again */
+                /* need to send the SSR parameters to controller again */
                 bta_dm_pm_ssr(p_dev->peer_bdaddr);
             }
             p_dev->prev_low = BTM_PM_STS_ACTIVE;
@@ -980,6 +980,7 @@ void bta_dm_pm_btm_status(tBTA_DM_MSG *p_data)
             ) {
             tBTA_DM_SEC conn;
             conn.mode_chg.mode = p_data->pm_status.status;
+            conn.mode_chg.interval = p_data->pm_status.value;
             bdcpy(conn.mode_chg.bd_addr, p_data->pm_status.bd_addr);
             bta_dm_cb.p_sec_cback(BTA_DM_PM_MODE_CHG_EVT, (tBTA_DM_SEC *)&conn);
         }

components/bt/host/bluedroid/bta/include/bta/bta_api.h

@@ -997,6 +997,7 @@ typedef struct {
 typedef struct {
     BD_ADDR         bd_addr;            /* BD address peer device. */
     tBTA_PM_MODE    mode;               /* the new connection role */
+    UINT16          interval;           /* Number of baseband slots */
 } tBTA_DM_MODE_CHG;
 
 typedef struct {

components/bt/host/bluedroid/btc/core/btc_dm.c

@@ -625,6 +625,7 @@ static void btc_dm_pm_mode_chg_evt(tBTA_DM_MODE_CHG *p_mode_chg)
     msg->act = BTC_GAP_BT_MODE_CHG_EVT;
     memcpy(param.mode_chg.bda, p_mode_chg->bd_addr, ESP_BD_ADDR_LEN);
     param.mode_chg.mode = p_mode_chg->mode;
+    param.mode_chg.interval= p_mode_chg->interval;
     memcpy(msg->arg, &param, sizeof(esp_bt_gap_cb_param_t));
 
     ret = btc_inter_profile_call(msg);

components/bt/host/bluedroid/btc/core/btc_main.c

@@ -141,6 +141,12 @@ uint32_t btc_get_ble_status(void)
         status |= BIT(BTC_BLE_STATUS_CONN);
     }
 
+    // Address resolve status
+    extern uint8_t btm_get_ble_addr_resolve_disable_status(void);
+    if (btm_get_ble_addr_resolve_disable_status()) {
+        status |= BIT(BTC_BLE_STATUS_ADDR_RESOLVE_DISABLE);
+    }
+
     #if (SMP_INCLUDED == TRUE)
     // Number of recorded devices
     extern uint8_t btm_ble_sec_dev_active_count(void);

components/bt/host/bluedroid/btc/include/btc/btc_main.h

@@ -40,6 +40,7 @@ typedef enum {
     BTC_BLE_STATUS_GATTC_APP,   // GATTC application exist
     BTC_BLE_STATUS_GATTS_SRVC,  // GATTS service exist
     BTC_BLE_STATUS_PRIVACY,     // Privacy enabled
+    BTC_BLE_STATUS_ADDR_RESOLVE_DISABLE,// Address resolution disable status
 } tBTC_BLE_STATUS;
 
 future_t **btc_main_get_future_p(btc_main_future_type_t type);

components/bt/host/bluedroid/hci/packet_fragmenter.c

@@ -171,6 +171,12 @@ static void reassemble_and_dispatch(BT_HDR *packet)
                 return;
             }
             partial_packet = (BT_HDR *)osi_calloc(full_length + sizeof(BT_HDR));
+
+            if (partial_packet == NULL) {
+               HCI_TRACE_WARNING("%s full_length %d no memory.\n", __func__, full_length);
+               assert(0);
+            }
+
             partial_packet->event = packet->event;
             partial_packet->len = full_length;
             partial_packet->offset = packet->len;

components/bt/host/bluedroid/stack/btm/btm_main.c

@@ -134,10 +134,16 @@ uint8_t btm_acl_active_count(void)
 
     return count;
 }
+#if (BLE_INCLUDED == TRUE)
+// Address resolution status
+uint8_t btm_get_ble_addr_resolve_disable_status(void)
+{
+    // Returns false if address resolution is enabled, true if disabled
+    return (btm_cb.addr_res_en) ? 0 : 1;
+}
 
 void btm_ble_addr_resolve_enable(bool enable)
 {
-#if (BLE_INCLUDED == TRUE)
     btm_cb.addr_res_en = enable;
-#endif
 }
+#endif /*BLE_INCLUDED*/

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.eco4.ld

@@ -48,6 +48,16 @@ mbedtls_mpi_gcd = 0x40002768;
 mbedtls_mpi_inv_mod = 0x4000276c;
 mbedtls_mpi_is_prime_ext = 0x40002770;
 
+/* Moved from mbedtls.ld to mbedtls.eco4 ld */
+mbedtls_cipher_init = 0x4000277c;
+mbedtls_cipher_set_padding_mode = 0x40002780;
+mbedtls_cipher_reset = 0x40002784;
+mbedtls_cipher_finish = 0x40002788;
+mbedtls_cipher_crypt = 0x4000278c;
+mbedtls_cipher_cmac_starts = 0x40002790;
+mbedtls_cipher_cmac_update = 0x40002794;
+mbedtls_cipher_cmac_finish = 0x40002798;
+
 /***************************************
  Group eco4_rom_mbedtls
  ***************************************/

components/esp_rom/esp32c2/ld/esp32c2.rom.mbedtls.ld

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -43,14 +43,6 @@ mbedtls_asn1_write_mpi = 0x400026d4;
 mbedtls_base64_decode = 0x400026d8;
 mbedtls_ccm_star_encrypt_and_tag = 0x40002774;
 mbedtls_ccm_star_auth_decrypt = 0x40002778;
-mbedtls_cipher_init = 0x4000277c;
-mbedtls_cipher_set_padding_mode = 0x40002780;
-mbedtls_cipher_reset = 0x40002784;
-mbedtls_cipher_finish = 0x40002788;
-mbedtls_cipher_crypt = 0x4000278c;
-mbedtls_cipher_cmac_starts = 0x40002790;
-mbedtls_cipher_cmac_update = 0x40002794;
-mbedtls_cipher_cmac_finish = 0x40002798;
 mbedtls_ctr_drbg_init = 0x4000279c;
 mbedtls_ctr_drbg_seed = 0x400027a0;
 mbedtls_ctr_drbg_free = 0x400027a4;

components/espcoredump/src/core_dump_sha.c

@@ -31,7 +31,9 @@ static void core_dump_sha256_start(core_dump_sha_ctx_t *sha_ctx)
 static void core_dump_sha256_update(core_dump_sha_ctx_t *sha_ctx, const void *data, size_t data_len)
 {
     // set software mode of SHA calculation
+#if CONFIG_MBEDTLS_HARDWARE_SHA
     sha_ctx->ctx.mode = ESP_MBEDTLS_SHA256_SOFTWARE;
+#endif
     mbedtls_sha256_update(&sha_ctx->ctx, data, data_len);
 }
 

components/esptool_py/project_include.cmake

@@ -11,7 +11,6 @@ set(ESPTOOLPY ${python} "$ENV{ESPTOOL_WRAPPER}" "${CMAKE_CURRENT_LIST_DIR}/espto
 set(ESPSECUREPY ${python} "${CMAKE_CURRENT_LIST_DIR}/esptool/espsecure.py")
 set(ESPEFUSEPY ${python} "${CMAKE_CURRENT_LIST_DIR}/esptool/espefuse.py")
 set(ESPMONITOR ${python} -m esp_idf_monitor)
-set(ESPMKUF2 ${python} "${idf_path}/tools/mkuf2.py" write --chip ${chip_model})
 set(ESPTOOLPY_CHIP "${chip_model}")
 
 if(NOT CONFIG_APP_BUILD_TYPE_RAM AND CONFIG_APP_BUILD_GENERATE_BINARIES)
@@ -208,30 +207,6 @@ add_custom_target(erase_flash
     VERBATIM
     )
 
-set(UF2_ARGS --json "${CMAKE_CURRENT_BINARY_DIR}/flasher_args.json")
-
-add_custom_target(uf2
-    COMMAND ${CMAKE_COMMAND}
-    -D "IDF_PATH=${idf_path}"
-    -D "SERIAL_TOOL=${ESPMKUF2}"
-    -D "SERIAL_TOOL_ARGS=${UF2_ARGS};-o;${CMAKE_CURRENT_BINARY_DIR}/uf2.bin"
-    -P run_serial_tool.cmake
-    WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}
-    USES_TERMINAL
-    VERBATIM
-    )
-
-add_custom_target(uf2-app
-    COMMAND ${CMAKE_COMMAND}
-    -D "IDF_PATH=${idf_path}"
-    -D "SERIAL_TOOL=${ESPMKUF2}"
-    -D "SERIAL_TOOL_ARGS=${UF2_ARGS};-o;${CMAKE_CURRENT_BINARY_DIR}/uf2-app.bin;--bin;app"
-    -P run_serial_tool.cmake
-    WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR}
-    USES_TERMINAL
-    VERBATIM
-    )
-
 add_custom_target(monitor
     COMMAND ${CMAKE_COMMAND}
     -D "IDF_PATH=${idf_path}"

components/mbedtls/mbedtls

@@ -1 +1 @@
-Subproject commit 72aa687352a469044cbb946f3fdb261430e41ce1
+Subproject commit f635fed59269b1ae14d1a1c50403cd63f78ac094

components/newlib/sbom.yml

@@ -4,3 +4,6 @@ cpe: cpe:2.3:a:newlib_project:newlib:{}:*:*:*:*:*:*:*
 supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
 originator: 'Organization: Red Hat Incorporated'
 description: An open-source C standard library implementation with additional features and patches from Espressif.
+cve-exclude-list:
+  - cve: CVE-2024-30949
+    reason: May affect RISCV binaries that are linked with libgloss. IDF does not link against this library.

docs/en/security/host-based-security-workflows.rst

@@ -428,13 +428,13 @@ In this workflow, we shall use ``espsecure`` tool to generate signing keys and u
 
      .. code:: bash
 
-          espefuse.py --port PORT --chip esp32c2 burn_key KEY_BLOCK0 SECURE_BOOT_DIGEST digest.bin
+          espefuse.py --port PORT --chip esp32c2 burn_key KEY_BLOCK0  digest.bin SECURE_BOOT_DIGEST
 
   .. only:: SOC_EFUSE_REVOKE_BOOT_KEY_DIGESTS
 
       .. code:: bash
 
-          espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_key BLOCK SECURE_BOOT_DIGEST0 digest.bin
+          espefuse.py --port PORT --chip {IDF_TARGET_PATH_NAME} burn_key digest.bin BLOCK SECURE_BOOT_DIGEST0 
 
       where ``BLOCK`` is a free keyblock between ``BLOCK_KEY0`` and ``BLOCK_KEY5``.
 

examples/bluetooth/bluedroid/classic_bt/a2dp_sink/main/main.c

@@ -99,7 +99,8 @@ static void bt_app_gap_cb(esp_bt_gap_cb_event_t event, esp_bt_gap_cb_param_t *pa
 
     /* when GAP mode changed, this event comes */
     case ESP_BT_GAP_MODE_CHG_EVT:
-        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_MODE_CHG_EVT mode: %d", param->mode_chg.mode);
+        ESP_LOGI(BT_AV_TAG, "ESP_BT_GAP_MODE_CHG_EVT mode: %d, interval: %.2f ms",
+                 param->mode_chg.mode, param->mode_chg.interval * 0.625);
         break;
     /* when ACL connection completed, this event comes */
     case ESP_BT_GAP_ACL_CONN_CMPL_STAT_EVT:

tools/cmake/project.cmake

@@ -779,6 +779,33 @@ macro(project project_name)
     # Add DFU build and flash targets
     __add_dfu_targets()
 
+    # Add uf2 related targets
+    idf_build_get_property(idf_path IDF_PATH)
+    idf_build_get_property(python PYTHON)
+
+    set(UF2_ARGS --json "${CMAKE_CURRENT_BINARY_DIR}/flasher_args.json")
+    set(UF2_CMD ${python} "${idf_path}/tools/mkuf2.py" write --chip ${chip_model})
+
+    add_custom_target(uf2
+        COMMAND ${CMAKE_COMMAND}
+        -D "IDF_PATH=${idf_path}"
+        -D "UF2_CMD=${UF2_CMD}"
+        -D "UF2_ARGS=${UF2_ARGS};-o;${CMAKE_CURRENT_BINARY_DIR}/uf2.bin"
+        -P "${idf_path}/tools/cmake/run_uf2_cmds.cmake"
+        USES_TERMINAL
+        VERBATIM
+        )
+
+    add_custom_target(uf2-app
+        COMMAND ${CMAKE_COMMAND}
+        -D "IDF_PATH=${idf_path}"
+        -D "UF2_CMD=${UF2_CMD}"
+        -D "UF2_ARGS=${UF2_ARGS};-o;${CMAKE_CURRENT_BINARY_DIR}/uf2-app.bin;--bin;app"
+        -P "${idf_path}/tools/cmake/run_uf2_cmds.cmake"
+        USES_TERMINAL
+        VERBATIM
+        )
+
     idf_build_executable(${project_elf})
 
     __project_info("${test_components}")

tools/cmake/run_uf2_cmds.cmake

@@ -0,0 +1,27 @@
+# A CMake script to run dfu-util from within ninja or make
+# or another cmake-based build runner
+#
+# It is recommended to NOT USE this CMake script directly
+
+cmake_minimum_required(VERSION 3.16)
+
+set(UF2_CMD "${UF2_CMD}")
+set(UF2_ARGS "${UF2_ARGS}")
+
+if(NOT UF2_CMD)
+    message(FATAL_ERROR "UF2_CMD must be specified on the CMake command line.")
+endif()
+
+if(NOT UF2_ARGS)
+    message(FATAL_ERROR "UF2_ARGS must be specified on the CMake command line.")
+endif()
+
+set(uf2_cmd_with_args ${UF2_CMD})
+list(APPEND uf2_cmd_with_args ${UF2_ARGS})
+
+execute_process(COMMAND ${uf2_cmd_with_args}
+    RESULT_VARIABLE result)
+
+if(${result})
+    message(FATAL_ERROR "${UF2_CMD} failed")
+endif()

tools/test_apps/system/panic/pytest_panic.py

@@ -47,6 +47,7 @@ TARGETS_DUAL_CORE = TARGETS_XTENSA_DUAL_CORE
 CONFIGS = [
     pytest.param('coredump_flash_bin_crc', marks=TARGETS_ALL),
     pytest.param('coredump_flash_elf_sha', marks=TARGETS_ALL),
+    pytest.param('coredump_flash_elf_soft_sha', marks=TARGETS_ALL),
     pytest.param('coredump_uart_bin_crc', marks=TARGETS_ALL),
     pytest.param('coredump_uart_elf_crc', marks=TARGETS_ALL),
     pytest.param('coredump_flash_custom_stack', marks=TARGETS_RISCV),

tools/test_apps/system/panic/sdkconfig.ci.coredump_flash_elf_soft_sha

@@ -0,0 +1,5 @@
+CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH=y
+CONFIG_ESP_COREDUMP_DATA_FORMAT_ELF=y
+CONFIG_ESP_COREDUMP_CHECKSUM_SHA256=y
+CONFIG_LOG_DEFAULT_LEVEL_INFO=y
+CONFIG_MBEDTLS_HARDWARE_SHA=n

tools/test_idf_py/test_idf_py.py

@@ -1,13 +1,15 @@
 #!/usr/bin/env python
 #
-# SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+# SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
 # SPDX-License-Identifier: Apache-2.0
-
 import json
 import os
 import subprocess
 import sys
-from unittest import TestCase, main, mock
+from typing import List
+from unittest import main
+from unittest import mock
+from unittest import TestCase
 
 import elftools.common.utils as ecu
 import jsonschema
@@ -344,5 +346,62 @@ class TestFileArgumentExpansion(TestCase):
         self.assertIn('(expansion of @args_non_existent) could not be opened', cm.exception.output.decode('utf-8', 'ignore'))
 
 
+class TestWrapperCommands(TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.sample_project_dir = os.path.join(current_dir, '..', 'test_build_system', 'build_test_app')
+        os.chdir(cls.sample_project_dir)
+        super().setUpClass()
+
+    def call_command(self, command: List[str]) -> str:
+        try:
+            output = subprocess.check_output(
+                command,
+                env=os.environ,
+                stderr=subprocess.STDOUT).decode('utf-8', 'ignore')
+            return output
+        except subprocess.CalledProcessError as e:
+            self.fail(f'Process should have exited normally, but it exited with a return code of {e.returncode}')
+
+    @classmethod
+    def tearDownClass(cls):
+        subprocess.run([sys.executable, idf_py_path, 'fullclean'], stdout=subprocess.DEVNULL)
+        os.chdir(current_dir)
+        super().tearDownClass()
+
+
+class TestUF2Commands(TestWrapperCommands):
+    """
+    Test if uf2 commands are invoked as expected.
+    This test is not testing the functionality of mkuf2.py/idf.py uf2, but the invocation of the command from idf.py.
+    """
+
+    def test_uf2(self):
+        uf2_command = [sys.executable, idf_py_path, 'uf2']
+        output = self.call_command(uf2_command)
+        self.assertIn('Executing:', output)
+
+    def test_uf2_with_envvars(self):
+        # Values do not really matter, they should not be used.
+        os.environ['ESPBAUD'] = '115200'
+        os.environ['ESPPORT'] = '/dev/ttyUSB0'
+        self.test_uf2()
+        os.environ.pop('ESPBAUD')
+        os.environ.pop('ESPPORT')
+
+    def test_uf2_app(self):
+        uf2_app_command = [sys.executable, idf_py_path, 'uf2-app']
+        output = self.call_command(uf2_app_command)
+        self.assertIn('Executing:', output)
+
+    def test_uf2_app_with_envvars(self):
+        # Values do not really matter, they should not be used.
+        os.environ['ESPBAUD'] = '115200'
+        os.environ['ESPPORT'] = '/dev/ttyUSB0'
+        self.test_uf2_app()
+        os.environ.pop('ESPBAUD')
+        os.environ.pop('ESPPORT')
+
+
 if __name__ == '__main__':
     main()