espressif · bonnefoi · Dec 10, 2019 · Dec 10, 2019 · Dec 10, 2019 · Dec 13, 2019
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -43,7 +43,7 @@ build_ssc:
     - git clone $GITLAB_SSH_SERVER/yinling/SSC.git
     - cd SSC
     # try checkout same branch
-    - git checkout "${CI_BUILD_REF_NAME}_8266" || echo "Using default branch..."
+    - git checkout "release/v3.3_8266" || echo "Using default branch..."
     - ./gen_misc_rtos.sh
 
 push_master_to_github:

diff --git a/SUPPORT_POLICY_CN.md b/SUPPORT_POLICY_CN.md
@@ -0,0 +1,54 @@
+有关 ESP8266 RTOS SDK 的最新支持政策，详见 [支持期限政策](./SUPPORT_POLICY_CN.md)。
+支持期限政策
+=================
+
+* [English Version](./SUPPORT_POLICY_EN.md)
+
+ESP8266 RTOS SDK 的每个主要版本和次要版本（如 V3.0、V3.1 等）自其首次稳定版本发布之日起将维护 18 个月。
+
+维护意味着 ESP8266 RTOS SDK 团队将会对 GitHub 上的发布分支继续进行 bug 修复、安全修补等，并根据需求定期发布新的 bugfix 版本。
+
+在某一版本支持期限结束，停止更新维护 (EOL) 前，建议用户升级到较新的 ESP8266 RTOS SDK 版本。根据《支持期限政策》，我们将停止对 EOL 版本进行 bug 修复。
+
+《支持期限政策》不适用于预发布版本（包括 beta、preview、`-rc` 和 `-dev` 版本等）。有时，在发布的版本中存在被标记为 "Preview" 的特定功能，则该功能也不在支持期限内。
+
+长期支持版本
+------------
+
+有些发布版本（例如 ESP8266 RTOS SDK V3.1）属于长期支持 (LTS) 版本。LTS 版本将自其首次稳定版本发布之日起维护 30 个月（2.5 年）。
+
+关于长期维护版本，在 github 上面正式的`第１次`发布该版本 release 的时候，会在标题上额外标注 `(LTS)`，例如：
+
+```
+ESP8266 RTOS SDK Release v3.4 (LTS)
+```
+
+后续的维护版本不会再额外标注 `(LTS)`，例如：
+
+```
+ESP8266 RTOS SDK Release v3.4.1
+```
+
+示例
+-----
+
+ESP8266 RTOS SDK V3.1 于 2019 年 01 月发布，属于 LTS 版本，自正式发布日开始将维护 30 个月至 2021 年 07 月停止。
+
+- V3.1 的首个发布版本为 2019 年 01 月发布的 `v3.1`。
+- ESP8266 RTOS SDK 团队将持续进行 bug 修复、安全修补等更新，并 backport 至分支 `release/v3.1`。
+- 定期从 release 分支创建稳定的 bugfix 版本，比如，`v3.1.1`、`v3.1.2` 等，并建议用户保持使用最新的 bugfix 版本。
+- V3.1 的 bugfix 版本发布将持续 30 个月至 2021 年 07 月，届时所有 V3.1.x 将停止更新维护。
+
+现有版本
+--------
+
+ESP8266 RTOS SDK V3.3 及所有后续更新版本都将遵守该《支持期限政策》。每一版本发布时将同时公布其支持期限。
+
+对于该政策公布之日前发布的其他版本，应适用下述支持期限：
+
+- ESP8266 RTOS SDK V3.3.x 将维护至 2021 年 12 月。
+- ESP8266 RTOS SDK V3.2.x 将维护至 2020 年 12 月。
+- ESP8266 RTOS SDK V3.1.x 作为长期维护版本，将维护至 2021 年 7 月。
+- ESP8266 RTOS SDK V3.0.x 将维护至 2020 年 10 月。
+- ESP8266 RTOS SDK V2.1.x 作为长期维护版本，将维护至 2021 年 4 月。
+- ESP8266 RTOS SDK V2.0.x 及之前的版本均已停止更新维护 (EOL)。
diff --git a/SUPPORT_POLICY_EN.md b/SUPPORT_POLICY_EN.md
@@ -0,0 +1,56 @@
+The latest support policy for ESP8266 RTOS SDK can be found at [Support Policy](./SUPPORT_POLICY_EN.md).
+
+Support Period Policy
+=================
+
+* [中文版](./SUPPORT_POLICY_CN.md)
+
+Each ESP8266 RTOS SDK major and minor release (V3.0, V3.1, etc) is supported for 18 months after the initial stable release date.
+
+Supported means that the ESP8266 RTOS SDK team will continue to apply bug fixes, security fixes, etc to the release branch on GitHub, and periodically make new bugfix releases as needed.
+
+Users are encouraged to upgrade to a newer ESP8266 RTOS SDK release before the support period finishes and the release becomes End of Life (EOL). It is our policy to not continue fixing bugs in End of Life releases.
+
+Pre-release versions (betas, previews, -rc and -dev versions, etc) are not covered by any support period. Sometimes a particular feature is marked as "Preview" in a release, which means it is also not covered by the support period.
+
+
+Long Term Support releases
+------------
+
+Some releases (for example, ESP8266 RTOS SDK V3.1) are designated Long Term Support (LTS). LTS releases are supported for 30 months (2.5 years) after the initial stable release date.
+
+We will add a `(LTS)` tag when we release a long term support version on GitHub at the first time. For example:
+
+```
+ESP8266 RTOS SDK Release v3.4 (LTS)
+```
+
+But we will not add `(LTS)` tag to the following bug fix versions. For example:
+
+```
+ESP8266 RTOS SDK Release v3.4.1
+```
+
+Example
+-----
+
+ESP8266 RTOS SDK V3.1 was released in January 2019 and is a Long Term Support (LTS) release, meaning it will be supported for 30 months until July 2021.
+
+- The first V3.1 release was `v3.1` in January 2019.
+- The ESP8266 RTOS SDK team continues to backport bug fixes, security fixes, etc to the release branch `release/v3.1`。
+- Periodically stable bugfix releases are created from the release branch. For example `v3.1.1`、`v3.1.2`, etc. Users are encouraged to always update to the latest bugfix release.
+- V3.1 bugfix releases continue until July 2021, when all V3.1.x releases become End of Life.
+
+Existing Releases
+--------
+
+ESP8266 RTOS SDK V3.3 and all newer releases will follow this support period policy. The support period for each release will be announced when the release is made.
+
+For releases made before the support period policy was announced, the following support periods apply:
+
+- ESP8266 RTOS SDK V3.2.x will be supported until December 2021.
+- ESP8266 RTOS SDK V3.2.x will be supported until December 2020.
+- ESP8266 RTOS SDK V3.1.x is Long Term Support (LTS) release, will be supported until July 2021.
+- ESP8266 RTOS SDK V3.0.x will be supported until October 2020.
+- ESP8266 RTOS SDK V2.1.x is Long Term Support (LTS) release, will be supported until April 2021.
+- ESP8266 RTOS SDK V2.0.x and earlier versions are already End of Life.
diff --git a/components/aws_iot/port/network_mbedtls_wrapper.c b/components/aws_iot/port/network_mbedtls_wrapper.c
@@ -107,7 +107,7 @@ IoT_Error_t iot_tls_connect(Network *pNetwork, TLSConnectParams *params) {
         ret = SSL_CONNECTION_ERROR;
     } else {
         int tls_ret = esp_tls_conn_new_sync(pNetwork->tlsConnectParams.pDestinationURL, strlen(pNetwork->tlsConnectParams.pDestinationURL), pNetwork->tlsConnectParams.DestinationPort, &cfg, tls);
-        if (tls_ret) {
+        if (tls_ret == -1) {
             ret = SSL_CONNECTION_ERROR;
             esp_tls_conn_delete(tls);
         }

diff --git a/components/bootloader/Kconfig.projbuild b/components/bootloader/Kconfig.projbuild
@@ -10,6 +10,15 @@ config BOOTLOADER_INIT_SPI_FLASH
         If your system bootloader is based on v3.0, the option must not be enable, because the v3.0 bootloader don't support
         this function.
 
+config BOOTLOADER_DISABLE_JTAG_IO
+    bool "Bootloader disable JTAG I/O"
+    default n 
+    help
+        Enable this option, when SoC brings up and bootloader initializes hardware, it will
+        disable JTAG's I/O and set these GPIOs to be normal I/O with inputting mode.
+
+        If users use JTAG to help develop, please disable this option.
+
 choice LOG_BOOTLOADER_LEVEL
    bool "Bootloader log verbosity"
    default LOG_BOOTLOADER_LEVEL_INFO

diff --git a/components/bootloader_support/src/bootloader_init.c b/components/bootloader_support/src/bootloader_init.c
@@ -613,6 +613,17 @@ esp_err_t bootloader_init()
 
 static esp_err_t bootloader_main()
 {
+#ifdef CONFIG_BOOTLOADER_DISABLE_JTAG_IO
+    /* Set GPIO 12-15 to be normal GPIO  */
+    PIN_FUNC_SELECT(PERIPHS_IO_MUX_MTDI_U, FUNC_GPIO12);
+    PIN_FUNC_SELECT(PERIPHS_IO_MUX_MTCK_U, FUNC_GPIO13);
+    PIN_FUNC_SELECT(PERIPHS_IO_MUX_MTMS_U, FUNC_GPIO14);
+    PIN_FUNC_SELECT(PERIPHS_IO_MUX_MTDO_U, FUNC_GPIO15);
+
+    /* Set GPIO 12-15 to be input mode  */
+    GPIO_REG_WRITE(GPIO_ENABLE_W1TC_ADDRESS, BIT12 | BIT13 | BIT14 | BIT15);
+#endif
+
     uart_console_configure();
 
     esp_image_header_t fhdr;

diff --git a/components/bootloader_support/src/bootloader_sha.c b/components/bootloader_support/src/bootloader_sha.c
@@ -222,11 +222,11 @@ void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest
 
 // typedef esp_sha_t* bootloader_sha256_handle_t;
 
-static esp_sha_t s_sha256_ctx;
+static esp_sha256_t s_sha256_ctx;
 
 bootloader_sha256_handle_t bootloader_sha256_start()
 {
-    esp_sha_t *ctx = &s_sha256_ctx;
+    esp_sha256_t *ctx = &s_sha256_ctx;
 
     esp_sha256_init(ctx);
 
@@ -235,12 +235,12 @@ bootloader_sha256_handle_t bootloader_sha256_start()
 
 void bootloader_sha256_data(bootloader_sha256_handle_t handle, const void *data, size_t data_len)
 {
-    esp_sha256_update((esp_sha_t *)handle, data, data_len);
+    esp_sha256_update((esp_sha256_t *)handle, data, data_len);
 }
 
 void bootloader_sha256_finish(bootloader_sha256_handle_t handle, uint8_t *digest)
 {
-    esp_sha256_finish((esp_sha_t *)handle, digest);
+    esp_sha256_finish((esp_sha256_t *)handle, digest);
 }
 
 #endif

diff --git a/components/esp-tls/Kconfig b/components/esp-tls/Kconfig
@@ -14,22 +14,22 @@ menu "ESP-TLS"
 
     config ESP_TLS_SERVER
         bool "Enable ESP-TLS Server"
-        depends on ESP_TLS_USING_MBEDTLS
         default n
         help
-            Enable support for creating server side SSL/TLS session, uses the mbedtls crypto library
+            Enable support for creating server side SSL/TLS session, available for mbedTLS
+            as well as wolfSSL TLS library.
 
     config ESP_TLS_PSK_VERIFICATION
         bool "Enable PSK verification"
-        depends on ESP_TLS_USING_MBEDTLS
-        select MBEDTLS_PSK_MODES
-        select MBEDTLS_KEY_EXCHANGE_PSK
-        select MBEDTLS_KEY_EXCHANGE_DHE_PSK
-        select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
-        select MBEDTLS_KEY_EXCHANGE_RSA_PSK
+        select MBEDTLS_PSK_MODES if ESP_TLS_USING_MBEDTLS
+        select MBEDTLS_KEY_EXCHANGE_PSK if ESP_TLS_USING_MBEDTLS
+        select MBEDTLS_KEY_EXCHANGE_DHE_PSK if ESP_TLS_USING_MBEDTLS
+        select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK if ESP_TLS_USING_MBEDTLS
+        select MBEDTLS_KEY_EXCHANGE_RSA_PSK if ESP_TLS_USING_MBEDTLS
         default n
         help
-            Enable support for pre shared key ciphers, uses the mbedtls crypto library
+            Enable support for pre shared key ciphers, supported for both mbedTLS as well as
+            wolfSSL TLS library.
 
     config ESP_WOLFSSL_SMALL_CERT_VERIFY
         bool "Enable SMALL_CERT_VERIFY"

diff --git a/components/esp-tls/esp_tls.c b/components/esp-tls/esp_tls.c
@@ -60,6 +60,10 @@ static const char *TAG = "esp-tls";
 #define _esp_tls_read                       esp_wolfssl_read
 #define _esp_tls_write                      esp_wolfssl_write
 #define _esp_tls_conn_delete                esp_wolfssl_conn_delete
+#ifdef CONFIG_ESP_TLS_SERVER
+#define _esp_tls_server_session_create      esp_wolfssl_server_session_create
+#define _esp_tls_server_session_delete      esp_wolfssl_server_session_delete
+#endif  /* CONFIG_ESP_TLS_SERVER */
 #define _esp_tls_get_bytes_avail            esp_wolfssl_get_bytes_avail
 #define _esp_tls_init_global_ca_store       esp_wolfssl_init_global_ca_store
 #define _esp_tls_set_global_ca_store        esp_wolfssl_set_global_ca_store                 /*!< Callback function for setting global CA store data for TLS/SSL */
@@ -115,8 +119,9 @@ esp_tls_t *esp_tls_init(void)
         return NULL;
     }
 #ifdef CONFIG_ESP_TLS_USING_MBEDTLS
-    tls->server_fd.fd = tls->sockfd = -1;
+    tls->server_fd.fd = -1;
 #endif
+    tls->sockfd = -1;
     return tls;
 }
 
@@ -193,7 +198,11 @@ static esp_err_t esp_tcp_connect(const char *host, int hostlen, int port, int *s
         }
         if (cfg->non_block) {
             int flags = fcntl(fd, F_GETFL, 0);
-            fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+            ret = fcntl(fd, F_SETFL, flags | O_NONBLOCK);
+            if (ret < 0) {
+                ESP_LOGE(TAG, "Failed to configure the socket as non-blocking (errno %d)", errno);
+                goto err_freesocket;
+            }
         }
     }
 
@@ -259,9 +268,9 @@ static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, c
             ms_to_timeval(cfg->timeout_ms, &tv);
 
             /* In case of non-blocking I/O, we use the select() API to check whether
-               connection has been estbalished or not*/
+               connection has been established or not*/
             if (select(tls->sockfd + 1, &tls->rset, &tls->wset, NULL,
-                       cfg->timeout_ms ? &tv : NULL) == 0) {
+                       cfg->timeout_ms>0 ? &tv : NULL) == 0) {
                 ESP_LOGD(TAG, "select() timed out");
                 return 0;
             }
@@ -309,12 +318,13 @@ static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, c
  */
 esp_tls_t *esp_tls_conn_new(const char *hostname, int hostlen, int port, const esp_tls_cfg_t *cfg)
 {
-    esp_tls_t *tls = (esp_tls_t *)calloc(1, sizeof(esp_tls_t));
+    esp_tls_t *tls = esp_tls_init();
     if (!tls) {
         return NULL;
     }
     /* esp_tls_conn_new() API establishes connection in a blocking manner thus this loop ensures that esp_tls_conn_new()
        API returns only after connection is established unless there is an error*/
+    size_t start = xTaskGetTickCount();
     while (1) {
         int ret = esp_tls_low_level_conn(hostname, hostlen, port, cfg, tls);
         if (ret == 1) {
@@ -323,22 +333,39 @@ esp_tls_t *esp_tls_conn_new(const char *hostname, int hostlen, int port, const e
             esp_tls_conn_delete(tls);
             ESP_LOGE(TAG, "Failed to open new connection");
             return NULL;
+        } else if (ret == 0 && cfg->timeout_ms >= 0) {
+            size_t timeout_ticks = pdMS_TO_TICKS(cfg->timeout_ms);
+            uint32_t expired = xTaskGetTickCount() - start;
+            if (expired >= timeout_ticks) {
+                esp_tls_conn_delete(tls);
+                ESP_LOGE(TAG, "Failed to open new connection in specified timeout");
+                return NULL;
+            }
         }
     }
     return NULL;
 }
 
 int esp_tls_conn_new_sync(const char *hostname, int hostlen, int port, const esp_tls_cfg_t *cfg, esp_tls_t *tls)
 {
-    /* esp_tls_conn_new_sync() is a sync alternative to esp_tls_conn_new_async() with symetric function prototype
+    /* esp_tls_conn_new_sync() is a sync alternative to esp_tls_conn_new_async() with symmetric function prototype
     it is an alternative to esp_tls_conn_new() which is left for compatibility reasons */
+    size_t start = xTaskGetTickCount();
     while (1) {
         int ret = esp_tls_low_level_conn(hostname, hostlen, port, cfg, tls);
         if (ret == 1) {
             return ret;
         } else if (ret == -1) {
             ESP_LOGE(TAG, "Failed to open new connection");
             return -1;
+        } else if (ret == 0 && cfg->timeout_ms >= 0) {
+            size_t timeout_ticks = pdMS_TO_TICKS(cfg->timeout_ms);
+            uint32_t expired = xTaskGetTickCount() - start;
+            if (expired >= timeout_ticks) {
+                ESP_LOGW(TAG, "Failed to open new connection in specified timeout");
+                ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ERR_TYPE_ESP, ESP_ERR_ESP_TLS_CONNECTION_TIMEOUT);
+                return 0;
+            }
         }
     }
     return 0;
@@ -384,6 +411,7 @@ esp_tls_t *esp_tls_conn_http_new(const char *url, const esp_tls_cfg_t *cfg)
                               get_port(url, &u), cfg, tls) == 1) {
         return tls;
     }
+    esp_tls_conn_delete(tls);
     return NULL;
 }
 
@@ -409,6 +437,7 @@ mbedtls_x509_crt *esp_tls_get_global_ca_store(void)
     return _esp_tls_get_global_ca_store();
 }
 
+#endif /* CONFIG_ESP_TLS_USING_MBEDTLS */
 #ifdef CONFIG_ESP_TLS_SERVER
 /**
  * @brief      Create a server side TLS/SSL connection
@@ -425,13 +454,22 @@ void esp_tls_server_session_delete(esp_tls_t *tls)
     return _esp_tls_server_session_delete(tls);
 }
 #endif /* CONFIG_ESP_TLS_SERVER */
-#endif /* CONFIG_ESP_TLS_USING_MBEDTLS */
 
 ssize_t esp_tls_get_bytes_avail(esp_tls_t *tls)
 {
     return _esp_tls_get_bytes_avail(tls);
 }
 
+esp_err_t esp_tls_get_conn_sockfd(esp_tls_t *tls, int *sockfd)
+{
+    if (!tls || !sockfd) {
+        ESP_LOGE(TAG, "Invalid arguments passed");
+        return ESP_ERR_INVALID_ARG;
+    }
+    *sockfd = tls->sockfd;
+    return ESP_OK;
+}
+
 esp_err_t esp_tls_get_and_clear_last_error(esp_tls_error_handle_t h, int *esp_tls_code, int *esp_tls_flags)
 {
     if (!h) {