Commander1024
cdc9c7335a
Generate exact-hash SDK source overrides without modifying dependencies. Harden SSH allocation and algorithm policy, tighten web authentication cleanup, and add focused host contract tests and documentation.
95 lines
4.0 KiB
Plaintext
95 lines
4.0 KiB
Plaintext
# ESP32-S3-WROOM-1-N16R8 hardware configuration
|
|
# Single-variable web throughput experiment; target validation pending.
|
|
CONFIG_ESP_DEFAULT_CPU_FREQ_MHZ_160=y
|
|
CONFIG_ESPTOOLPY_FLASHSIZE_16MB=y
|
|
CONFIG_SPIRAM=y
|
|
CONFIG_SPIRAM_MODE_OCT=y
|
|
CONFIG_SPIRAM_SPEED_80M=y
|
|
CONFIG_SPIRAM_BOOT_INIT=y
|
|
CONFIG_SPIRAM_USE_CAPS_ALLOC=y
|
|
# Preserve internal DMA/task memory by placing Wi-Fi and lwIP payload buffers in PSRAM first.
|
|
CONFIG_SPIRAM_TRY_ALLOCATE_WIFI_LWIP=y
|
|
# Retain the previously validated bounded Wi-Fi/lwIP capacities explicitly;
|
|
# ESP-IDF changes their defaults when PSRAM-first allocation is enabled.
|
|
CONFIG_ESP_WIFI_STATIC_RX_BUFFER_NUM=10
|
|
CONFIG_ESP_WIFI_RX_BA_WIN=6
|
|
CONFIG_LWIP_TCP_OOSEQ_MAX_PBUFS=4
|
|
|
|
# Keep concurrent HTTPS handshakes from exhausting scarce internal DRAM.
|
|
# Active TLS material remains unencrypted in PSRAM; physical extraction is outside
|
|
# the supported threat model (docs/security_hardening.md).
|
|
CONFIG_MBEDTLS_EXTERNAL_MEM_ALLOC=y
|
|
# CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
|
|
# Hardware AES can hang in the PSRAM DMA path and cannot be shared safely with
|
|
# wolfSSL's independently locked ESP32 acceleration. Software AES is fast enough
|
|
# at 240 MHz for bounded serial traffic and leaves ESP-IDF's SHA/MPI paths intact.
|
|
# CONFIG_MBEDTLS_HARDWARE_AES is not set
|
|
# CONFIG_MBEDTLS_AES_USE_INTERRUPT is not set
|
|
# HTTPS remains on ESP-IDF's mbedTLS backend; wolfSSL is linked only for wolfSSH.
|
|
CONFIG_ESP_TLS_USING_MBEDTLS=y
|
|
|
|
# Native USB OTG presents one CDC-ACM interface on the ESP32-S3 USB port.
|
|
CONFIG_TINYUSB_CDC_ENABLED=y
|
|
CONFIG_TINYUSB_CDC_COUNT=1
|
|
CONFIG_TINYUSB_CDC_RX_BUFSIZE=1024
|
|
CONFIG_TINYUSB_CDC_TX_BUFSIZE=1024
|
|
CONFIG_TINYUSB_CDC_EP_BUFSIZE=512
|
|
|
|
# Enable the TLS-only administration server; no plaintext HTTP listener is created.
|
|
CONFIG_ESP_HTTPS_SERVER_ENABLE=y
|
|
CONFIG_HTTPD_WS_SUPPORT=y
|
|
# Reserve capacity for HTTPS/WebSocket clients plus two bounded SSH sessions.
|
|
CONFIG_LWIP_MAX_SOCKETS=16
|
|
# Keep work submission bounded; one-second socket timeouts limit shared-task stalls.
|
|
# CONFIG_HTTPD_QUEUE_WORK_BLOCKING is not set
|
|
|
|
# Certificate generation and HTTPS startup use nested cryptographic buffers.
|
|
CONFIG_ESP_MAIN_TASK_STACK_SIZE=8192
|
|
|
|
# Build wolfSSH and wolfCrypt without replacing the HTTPS TLS implementation.
|
|
CONFIG_ESP_ENABLE_WOLFSSH=y
|
|
|
|
# The managed component emits a generic RSA stack warning although this target disables RSA.
|
|
CONFIG_ESP_WOLFSSL_NO_STACK_SIZE_BUILD_WARNING=y
|
|
|
|
# Keep configurable hostname discovery STA-only and bounded. The responder task
|
|
# remains internal; general mDNS metadata prefers PSRAM to protect internal heap.
|
|
CONFIG_MDNS_MAX_INTERFACES=1
|
|
CONFIG_MDNS_MAX_SERVICES=1
|
|
CONFIG_MDNS_PREDEF_NETIF_STA=y
|
|
# CONFIG_MDNS_PREDEF_NETIF_AP is not set
|
|
# CONFIG_MDNS_PREDEF_NETIF_ETH is not set
|
|
# CONFIG_MDNS_ENABLE_CONSOLE_CLI is not set
|
|
# CONFIG_MDNS_ENABLE_BROWSE is not set
|
|
# CONFIG_MDNS_MULTIPLE_INSTANCE is not set
|
|
CONFIG_MDNS_TASK_CREATE_FROM_INTERNAL=y
|
|
CONFIG_MDNS_MEMORY_ALLOC_SPIRAM=y
|
|
# CONFIG_MDNS_MEMORY_ALLOC_INTERNAL is not set
|
|
|
|
# Support WPA3-SAE for station profiles and the WPA2/WPA3 fallback AP.
|
|
CONFIG_ESP_WIFI_ENABLE_WPA3_SAE=y
|
|
CONFIG_ESP_WIFI_ENABLE_SAE_H2E=y
|
|
CONFIG_ESP_WIFI_SOFTAP_SAE_SUPPORT=y
|
|
|
|
# Keep diagnostic and interactive-console logging concise but useful.
|
|
CONFIG_LOG_DEFAULT_LEVEL_INFO=y
|
|
|
|
# Crash memory/registers can contain credentials and serial payloads. Keep the
|
|
# reserved coredump partition unused; enforce resolved settings at compile time.
|
|
CONFIG_ESP_COREDUMP_ENABLE_TO_NONE=y
|
|
# CONFIG_ESP_COREDUMP_ENABLE_TO_FLASH is not set
|
|
# CONFIG_ESP_COREDUMP_ENABLE_TO_UART is not set
|
|
CONFIG_ESP_SYSTEM_PANIC_SILENT_REBOOT=y
|
|
# CONFIG_ESP_SYSTEM_PANIC_PRINT_HALT is not set
|
|
# CONFIG_ESP_SYSTEM_PANIC_PRINT_REBOOT is not set
|
|
# CONFIG_ESP_SYSTEM_PANIC_GDBSTUB is not set
|
|
# CONFIG_ESP_SYSTEM_GDBSTUB_RUNTIME is not set
|
|
# CONFIG_ESP_DEBUG_OCDAWARE is not set
|
|
# CONFIG_FREERTOS_DEBUG_OCDAWARE is not set
|
|
|
|
# Audited allocation extents and TLS record retirement used by Phase 9C.
|
|
CONFIG_HEAP_POISONING_DISABLED=y
|
|
# CONFIG_HEAP_POISONING_LIGHT is not set
|
|
# CONFIG_HEAP_POISONING_COMPREHENSIVE is not set
|
|
# CONFIG_MBEDTLS_DYNAMIC_BUFFER is not set
|