fix(mbedtls): Fix the port for the mbedtls_internal_shaX_process API

- Also added the fix to update intermediate SHA state in the mbedtls_shaX_update API

components/mbedtls/port/sha/block/esp_sha1.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-1 standard was published by NIST in 1993.
@@ -90,6 +90,16 @@ int mbedtls_sha1_starts( mbedtls_sha1_context *ctx )
     return 0;
 }
 
+static void esp_internal_sha_update_state(mbedtls_sha1_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA1_STATE_INIT) {
+        ctx->first_block = true;
+        ctx->sha_state = ESP_SHA1_STATE_IN_PROCESS;
+    } else if (ctx->sha_state == ESP_SHA1_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+}
 
 static void esp_internal_sha1_block_process(mbedtls_sha1_context *ctx, const uint8_t *data)
 {
@@ -103,7 +113,9 @@ static void esp_internal_sha1_block_process(mbedtls_sha1_context *ctx, const uin
 int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] )
 {
     esp_sha_acquire_hardware();
+    esp_internal_sha_update_state(ctx);
     esp_sha_block(ctx->mode, data, ctx->first_block);
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
     return 0;
 }
@@ -138,12 +150,8 @@ int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input,
     if ( (ilen >= 64) || local_len) {
 
         esp_sha_acquire_hardware();
-        if (ctx->sha_state == ESP_SHA1_STATE_INIT) {
-            ctx->first_block = true;
-            ctx->sha_state = ESP_SHA1_STATE_IN_PROCESS;
-        } else if (ctx->sha_state == ESP_SHA1_STATE_IN_PROCESS) {
-           esp_sha_write_digest_state(SHA1, ctx->state);
-        }
+
+        esp_internal_sha_update_state(ctx);
 
         /* First process buffered block, if any */
         if ( local_len ) {
@@ -181,7 +189,7 @@ static const unsigned char sha1_padding[64] = {
  */
 int mbedtls_sha1_finish( mbedtls_sha1_context *ctx, unsigned char output[20] )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/block/esp_sha256.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
@@ -103,6 +103,17 @@ int mbedtls_sha256_starts( mbedtls_sha256_context *ctx, int is224 )
     return 0;
 }
 
+static void esp_internal_sha_update_state(mbedtls_sha256_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA256_STATE_INIT) {
+        ctx->first_block = true;
+        ctx->sha_state = ESP_SHA256_STATE_IN_PROCESS;
+    } else if (ctx->sha_state == ESP_SHA256_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+}
+
 static void esp_internal_sha256_block_process(mbedtls_sha256_context *ctx, const uint8_t *data)
 {
     esp_sha_block(ctx->mode, data, ctx->first_block);
@@ -115,7 +126,9 @@ static void esp_internal_sha256_block_process(mbedtls_sha256_context *ctx, const
 int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned char data[64] )
 {
     esp_sha_acquire_hardware();
+    esp_internal_sha_update_state(ctx);
     esp_sha_block(ctx->mode, data, ctx->first_block);
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
     return 0;
 }
@@ -156,13 +169,8 @@ int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *inp
     if ( (ilen >= 64) || local_len) {
 
         esp_sha_acquire_hardware();
-        if (ctx->sha_state == ESP_SHA256_STATE_INIT) {
-            ctx->first_block = true;
 
-            ctx->sha_state = ESP_SHA256_STATE_IN_PROCESS;
-        } else if (ctx->sha_state == ESP_SHA256_STATE_IN_PROCESS) {
-            esp_sha_write_digest_state(ctx->mode, ctx->state);
-        }
+        esp_internal_sha_update_state(ctx);
 
         /* First process buffered block, if any */
         if ( local_len ) {
@@ -200,7 +208,7 @@ static const unsigned char sha256_padding[64] = {
  */
 int mbedtls_sha256_finish( mbedtls_sha256_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/block/esp_sha512.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-512 Secure Hash Standard was published by NIST in 2002.
@@ -125,6 +125,27 @@ int mbedtls_sha512_starts( mbedtls_sha512_context *ctx, int is384 )
     return 0;
 }
 
+static int esp_internal_sha_update_state(mbedtls_sha512_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA512_STATE_INIT) {
+        if (ctx->mode == SHA2_512T) {
+            int ret = -1;
+            if ((ret = esp_sha_512_t_init_hash(ctx->t_val)) != 0) {
+                return ret;
+            }
+            ctx->first_block = false;
+        } else {
+            ctx->first_block = true;
+        }
+        ctx->sha_state = ESP_SHA512_STATE_IN_PROCESS;
+
+    } else if (ctx->sha_state == ESP_SHA512_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+    return 0;
+}
+
 static void esp_internal_sha512_block_process(mbedtls_sha512_context *ctx, const uint8_t *data)
 {
     esp_sha_block(ctx->mode, data, ctx->first_block);
@@ -136,10 +157,19 @@ static void esp_internal_sha512_block_process(mbedtls_sha512_context *ctx, const
 
 int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned char data[128] )
 {
+    int ret = -1;
     esp_sha_acquire_hardware();
+
+    ret = esp_internal_sha_update_state(ctx);
+    if (ret != 0) {
+        esp_sha_release_hardware();
+        return ret;
+    }
+
     esp_sha_block(ctx->mode, data, ctx->first_block);
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
-    return 0;
+    return ret;
 }
 
 /*
@@ -178,18 +208,11 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
 
         esp_sha_acquire_hardware();
 
-        if (ctx->sha_state == ESP_SHA512_STATE_INIT) {
-
-            if (ctx->mode == SHA2_512T) {
-                esp_sha_512_t_init_hash(ctx->t_val);
-                ctx->first_block = false;
-            } else {
-                ctx->first_block = true;
-            }
-            ctx->sha_state = ESP_SHA512_STATE_IN_PROCESS;
+        int ret = esp_internal_sha_update_state(ctx);
 
-        } else if (ctx->sha_state == ESP_SHA512_STATE_IN_PROCESS) {
-            esp_sha_write_digest_state(ctx->mode, ctx->state);
+        if (ret != 0) {
+            esp_sha_release_hardware();
+            return ret;
         }
 
         /* First process buffered block, if any */
@@ -206,7 +229,6 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
         esp_sha_read_digest_state(ctx->mode, ctx->state);
 
         esp_sha_release_hardware();
-
     }
 
     if ( ilen > 0 ) {
@@ -232,7 +254,7 @@ static const unsigned char sha512_padding[128] = {
  */
 int mbedtls_sha512_finish( mbedtls_sha512_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     size_t last, padn;
     uint64_t high, low;
     unsigned char msglen[16];

components/mbedtls/port/sha/dma/esp_sha1.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-1 standard was published by NIST in 1993.
@@ -88,6 +88,16 @@ int mbedtls_sha1_starts( mbedtls_sha1_context *ctx )
     return 0;
 }
 
+static void esp_internal_sha_update_state(mbedtls_sha1_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA1_STATE_INIT) {
+        ctx->first_block = true;
+        ctx->sha_state = ESP_SHA1_STATE_IN_PROCESS;
+    } else if (ctx->sha_state == ESP_SHA1_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+}
 
 static int esp_internal_sha1_dma_process(mbedtls_sha1_context *ctx,
         const uint8_t *data, size_t len,
@@ -98,16 +108,23 @@ static int esp_internal_sha1_dma_process(mbedtls_sha1_context *ctx,
 
 int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] )
 {
-    int ret;
+    int ret = -1;
     esp_sha_acquire_hardware();
+    esp_internal_sha_update_state(ctx);
+
     ret = esp_sha_dma(ctx->mode, data, 64, 0, 0, ctx->first_block);
+    if (ret != 0) {
+        esp_sha_release_hardware();
+        return ret;
+    }
+
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
     return ret;
 }
 
 int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input, size_t ilen )
 {
-    int ret;
     size_t fill;
     uint32_t left, len, local_len = 0;
 
@@ -138,25 +155,19 @@ int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input,
     if ( len || local_len) {
 
         esp_sha_acquire_hardware();
-        if (ctx->sha_state == ESP_SHA1_STATE_INIT) {
-            ctx->first_block = true;
 
-            ctx->sha_state = ESP_SHA1_STATE_IN_PROCESS;
-        } else if (ctx->sha_state == ESP_SHA1_STATE_IN_PROCESS) {
-            ctx->first_block = false;
-            esp_sha_write_digest_state(SHA1, ctx->state);
-        }
+        esp_internal_sha_update_state(ctx);
 
-        ret = esp_internal_sha1_dma_process(ctx, input, len, ctx->buffer, local_len);
+        int ret = esp_internal_sha1_dma_process(ctx, input, len, ctx->buffer, local_len);
+        if (ret != 0) {
+            esp_sha_release_hardware();
+            return ret;
+        }
 
         esp_sha_read_digest_state(SHA1, ctx->state);
 
         esp_sha_release_hardware();
 
-        if (ret != 0) {
-            return ret;
-        }
-
     }
 
     if ( ilen > 0 ) {
@@ -178,7 +189,7 @@ static const unsigned char sha1_padding[64] = {
  */
 int mbedtls_sha1_finish( mbedtls_sha1_context *ctx, unsigned char output[20] )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/dma/esp_sha256.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
@@ -100,11 +100,30 @@ int mbedtls_sha256_starts( mbedtls_sha256_context *ctx, int is224 )
     return 0;
 }
 
+static void esp_internal_sha_update_state(mbedtls_sha256_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA256_STATE_INIT) {
+        ctx->first_block = true;
+        ctx->sha_state = ESP_SHA256_STATE_IN_PROCESS;
+    } else if (ctx->sha_state == ESP_SHA256_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+}
+
 int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned char data[64] )
 {
-    int ret;
+    int ret = -1;
     esp_sha_acquire_hardware();
+    esp_internal_sha_update_state(ctx);
+
     ret = esp_sha_dma(ctx->mode, data, 64, 0, 0, ctx->first_block);
+    if (ret != 0) {
+        esp_sha_release_hardware();
+        return ret;
+    }
+
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
 
     return ret;
@@ -116,7 +135,6 @@ int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned
 int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *input,
                                size_t ilen )
 {
-    int ret = 0;
     size_t fill;
     uint32_t left, len, local_len = 0;
 
@@ -148,24 +166,18 @@ int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *inp
 
     if ( len || local_len) {
         esp_sha_acquire_hardware();
+        esp_internal_sha_update_state(ctx);
 
-        if (ctx->sha_state == ESP_SHA256_STATE_INIT) {
-            ctx->first_block = true;
-            ctx->sha_state = ESP_SHA256_STATE_IN_PROCESS;
-        } else if (ctx->sha_state == ESP_SHA256_STATE_IN_PROCESS) {
-            ctx->first_block = false;
-            esp_sha_write_digest_state(ctx->mode, ctx->state);
-        }
+        int ret = esp_sha_dma(ctx->mode, input, len,  ctx->buffer, local_len, ctx->first_block);
 
-        ret = esp_sha_dma(ctx->mode, input, len,  ctx->buffer, local_len, ctx->first_block);
+        if (ret != 0) {
+            esp_sha_release_hardware();
+            return ret;
+        }
 
         esp_sha_read_digest_state(ctx->mode, ctx->state);
 
         esp_sha_release_hardware();
-
-        if (ret != 0) {
-            return ret;
-        }
     }
 
     if ( ilen > 0 ) {
@@ -187,7 +199,7 @@ static const unsigned char sha256_padding[64] = {
  */
 int mbedtls_sha256_finish( mbedtls_sha256_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/dma/esp_sha512.c

@@ -5,7 +5,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-512 Secure Hash Standard was published by NIST in 2002.
@@ -122,6 +122,26 @@ int mbedtls_sha512_starts( mbedtls_sha512_context *ctx, int is384 )
     return 0;
 }
 
+static int esp_internal_sha_update_state(mbedtls_sha512_context *ctx)
+{
+    if (ctx->sha_state == ESP_SHA512_STATE_INIT) {
+        if (ctx->mode == SHA2_512T) {
+            int ret = -1;
+            if ((ret = esp_sha_512_t_init_hash(ctx->t_val)) != 0) {
+                return ret;
+            }
+            ctx->first_block = false;
+        } else {
+            ctx->first_block = true;
+        }
+        ctx->sha_state = ESP_SHA512_STATE_IN_PROCESS;
+    } else if (ctx->sha_state == ESP_SHA512_STATE_IN_PROCESS) {
+        ctx->first_block = false;
+        esp_sha_write_digest_state(ctx->mode, ctx->state);
+    }
+    return 0;
+}
+
 static int esp_internal_sha512_dma_process(mbedtls_sha512_context *ctx,
         const uint8_t *data, size_t len,
         uint8_t *buf, size_t buf_len)
@@ -135,9 +155,22 @@ static int esp_internal_sha512_dma_process(mbedtls_sha512_context *ctx,
 
 int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned char data[128] )
 {
-    int ret;
+    int ret = -1;
     esp_sha_acquire_hardware();
+
+    ret = esp_internal_sha_update_state(ctx);
+    if (ret != 0) {
+        esp_sha_release_hardware();
+        return ret;
+    }
+
     ret = esp_internal_sha512_dma_process(ctx, data, 128, 0, 0);
+    if (ret != 0) {
+        esp_sha_release_hardware();
+        return ret;
+    }
+
+    esp_sha_read_digest_state(ctx->mode, ctx->state);
     esp_sha_release_hardware();
 
     return ret;
@@ -150,7 +183,6 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned
 int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *input,
                                size_t ilen )
 {
-    int ret;
     size_t fill;
     unsigned int left, len, local_len = 0;
 
@@ -182,31 +214,24 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
 
         esp_sha_acquire_hardware();
 
-        if (ctx->sha_state == ESP_SHA512_STATE_INIT) {
-
-            if (ctx->mode == SHA2_512T) {
-                esp_sha_512_t_init_hash(ctx->t_val);
-                ctx->first_block = false;
-            } else {
-                ctx->first_block = true;
-            }
-            ctx->sha_state = ESP_SHA512_STATE_IN_PROCESS;
+        int ret = esp_internal_sha_update_state(ctx);
 
-        } else if (ctx->sha_state == ESP_SHA512_STATE_IN_PROCESS) {
-            ctx->first_block = false;
-            esp_sha_write_digest_state(ctx->mode, ctx->state);
+        if (ret != 0) {
+            esp_sha_release_hardware();
+            return ret;
         }
 
         ret = esp_internal_sha512_dma_process(ctx, input, len, ctx->buffer, local_len);
 
-        esp_sha_read_digest_state(ctx->mode, ctx->state);
-
-        esp_sha_release_hardware();
-
         if (ret != 0) {
+            esp_sha_release_hardware();
             return ret;
         }
 
+        esp_sha_read_digest_state(ctx->mode, ctx->state);
+
+        esp_sha_release_hardware();
+
     }
 
 
@@ -233,7 +258,7 @@ static const unsigned char sha512_padding[128] = {
  */
 int mbedtls_sha512_finish( mbedtls_sha512_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     size_t last, padn;
     uint64_t high, low;
     unsigned char msglen[16];

components/mbedtls/port/sha/parallel_engine/esp_sha1.c

@@ -7,7 +7,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-1 standard was published by NIST in 1993.
@@ -121,30 +121,6 @@ int mbedtls_sha1_starts( mbedtls_sha1_context *ctx )
 }
 
 
-static void mbedtls_sha1_software_process( mbedtls_sha1_context *ctx, const unsigned char data[64] );
-
-int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] )
-{
-    bool first_block = false;
-    if (ctx->mode == ESP_MBEDTLS_SHA1_UNUSED) {
-        /* try to use hardware for this digest */
-        if (esp_sha_try_lock_engine(SHA1)) {
-            ctx->mode = ESP_MBEDTLS_SHA1_HARDWARE;
-            first_block = true;
-        } else {
-            ctx->mode = ESP_MBEDTLS_SHA1_SOFTWARE;
-        }
-    }
-
-    if (ctx->mode == ESP_MBEDTLS_SHA1_HARDWARE) {
-        esp_sha_block(SHA1, data, first_block);
-    } else {
-        mbedtls_sha1_software_process(ctx, data);
-    }
-
-    return 0;
-}
-
 static void mbedtls_sha1_software_process( mbedtls_sha1_context *ctx, const unsigned char data[64] )
 {
     uint32_t temp, W[16], A, B, C, D, E;
@@ -301,12 +277,46 @@ static void mbedtls_sha1_software_process( mbedtls_sha1_context *ctx, const unsi
     ctx->state[4] += E;
 }
 
+
+static int esp_internal_sha1_parallel_engine_process( mbedtls_sha1_context *ctx, const unsigned char data[64], bool read_digest )
+{
+    bool first_block = false;
+
+    if (ctx->mode == ESP_MBEDTLS_SHA1_UNUSED) {
+        /* try to use hardware for this digest */
+        if (esp_sha_try_lock_engine(SHA1)) {
+            ctx->mode = ESP_MBEDTLS_SHA1_HARDWARE;
+            first_block = true;
+        } else {
+            ctx->mode = ESP_MBEDTLS_SHA1_SOFTWARE;
+        }
+    }
+
+    if (ctx->mode == ESP_MBEDTLS_SHA1_HARDWARE) {
+        esp_sha_block(SHA1, data, first_block);
+        if (read_digest) {
+            esp_sha_read_digest_state(SHA1, ctx->state);
+        }
+    } else {
+        mbedtls_sha1_software_process(ctx, data);
+    }
+
+    return 0;
+}
+
+
+int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] )
+{
+    return esp_internal_sha1_parallel_engine_process(ctx, data, true);
+}
+
+
 /*
  * SHA-1 process buffer
  */
 int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input, size_t ilen )
 {
-    int ret;
+    int ret = -1;
     size_t fill;
     uint32_t left;
 
@@ -327,7 +337,7 @@ int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input,
     if ( left && ilen >= fill ) {
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
-        if ( ( ret = mbedtls_internal_sha1_process( ctx, ctx->buffer ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha1_parallel_engine_process( ctx, ctx->buffer, false ) ) != 0 ) {
             return ret;
         }
 
@@ -337,7 +347,7 @@ int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input,
     }
 
     while ( ilen >= 64 ) {
-        if ( ( ret = mbedtls_internal_sha1_process( ctx, input ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha1_parallel_engine_process( ctx, input, false ) ) != 0 ) {
             return ret;
         }
 
@@ -345,6 +355,10 @@ int mbedtls_sha1_update( mbedtls_sha1_context *ctx, const unsigned char *input,
         ilen  -= 64;
     }
 
+    if (ctx->mode == ESP_MBEDTLS_SHA1_HARDWARE) {
+        esp_sha_read_digest_state(SHA1, ctx->state);
+    }
+
     if ( ilen > 0 ) {
         memcpy( (void *) (ctx->buffer + left), input, ilen );
     }
@@ -364,7 +378,7 @@ static const unsigned char sha1_padding[64] = {
  */
 int mbedtls_sha1_finish( mbedtls_sha1_context *ctx, unsigned char output[20] )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/parallel_engine/esp_sha256.c

@@ -7,7 +7,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
@@ -179,30 +179,6 @@ static const uint32_t K[] = {
     d += temp1; h = temp1 + temp2;              \
 }
 
-static void mbedtls_sha256_software_process( mbedtls_sha256_context *ctx, const unsigned char data[64] );
-
-int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned char data[64] )
-{
-    bool first_block = false;
-
-    if (ctx->mode == ESP_MBEDTLS_SHA256_UNUSED) {
-        /* try to use hardware for this digest */
-        if (!ctx->is224 && esp_sha_try_lock_engine(SHA2_256)) {
-            ctx->mode = ESP_MBEDTLS_SHA256_HARDWARE;
-            first_block = true;
-        } else {
-            ctx->mode = ESP_MBEDTLS_SHA256_SOFTWARE;
-        }
-    }
-
-    if (ctx->mode == ESP_MBEDTLS_SHA256_HARDWARE) {
-        esp_sha_block(SHA2_256, data, first_block);
-    } else {
-        mbedtls_sha256_software_process(ctx, data);
-    }
-
-    return 0;
-}
 
 static void mbedtls_sha256_software_process( mbedtls_sha256_context *ctx, const unsigned char data[64] )
 {
@@ -260,13 +236,47 @@ static void mbedtls_sha256_software_process( mbedtls_sha256_context *ctx, const
     }
 }
 
+
+static int esp_internal_sha256_parallel_engine_process( mbedtls_sha256_context *ctx, const unsigned char data[64], bool read_digest )
+{
+    bool first_block = false;
+
+    if (ctx->mode == ESP_MBEDTLS_SHA256_UNUSED) {
+        /* try to use hardware for this digest */
+        if (!ctx->is224 && esp_sha_try_lock_engine(SHA2_256)) {
+            ctx->mode = ESP_MBEDTLS_SHA256_HARDWARE;
+            first_block = true;
+        } else {
+            ctx->mode = ESP_MBEDTLS_SHA256_SOFTWARE;
+        }
+    }
+
+    if (ctx->mode == ESP_MBEDTLS_SHA256_HARDWARE) {
+        esp_sha_block(SHA2_256, data, first_block);
+        if (read_digest) {
+            esp_sha_read_digest_state(SHA2_256, ctx->state);
+        }
+    } else {
+        mbedtls_sha256_software_process(ctx, data);
+    }
+
+    return 0;
+}
+
+
+int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned char data[64] )
+{
+    return esp_internal_sha256_parallel_engine_process(ctx, data, true);
+}
+
+
 /*
  * SHA-256 process buffer
  */
 int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *input,
                                size_t ilen )
 {
-    int ret;
+    int ret = -1;
     size_t fill;
     uint32_t left;
 
@@ -287,7 +297,7 @@ int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *inp
     if ( left && ilen >= fill ) {
         memcpy( (void *) (ctx->buffer + left), input, fill );
 
-        if ( ( ret = mbedtls_internal_sha256_process( ctx, ctx->buffer ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha256_parallel_engine_process( ctx, ctx->buffer, false ) ) != 0 ) {
             return ret;
         }
 
@@ -297,7 +307,7 @@ int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *inp
     }
 
     while ( ilen >= 64 ) {
-        if ( ( ret = mbedtls_internal_sha256_process( ctx, input ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha256_parallel_engine_process( ctx, input, false ) ) != 0 ) {
             return ret;
         }
 
@@ -305,6 +315,10 @@ int mbedtls_sha256_update( mbedtls_sha256_context *ctx, const unsigned char *inp
         ilen  -= 64;
     }
 
+    if (ctx->mode == ESP_MBEDTLS_SHA256_HARDWARE) {
+        esp_sha_read_digest_state(SHA2_256, ctx->state);
+    }
+
     if ( ilen > 0 ) {
         memcpy( (void *) (ctx->buffer + left), input, ilen );
     }
@@ -324,7 +338,7 @@ static const unsigned char sha256_padding[64] = {
  */
 int mbedtls_sha256_finish( mbedtls_sha256_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     uint32_t last, padn;
     uint32_t high, low;
     unsigned char msglen[8];

components/mbedtls/port/sha/parallel_engine/esp_sha512.c

@@ -7,7 +7,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2023 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The SHA-512 Secure Hash Standard was published by NIST in 2002.
@@ -206,30 +206,6 @@ static const uint64_t K[80] = {
     UL64(0x5FCB6FAB3AD6FAEC),  UL64(0x6C44198C4A475817)
 };
 
-static void mbedtls_sha512_software_process( mbedtls_sha512_context *ctx, const unsigned char data[128] );
-
-int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned char data[128] )
-{
-    bool first_block = false;
-
-    if (ctx->mode == ESP_MBEDTLS_SHA512_UNUSED) {
-        /* try to use hardware for this digest */
-        if (esp_sha_try_lock_engine(sha_type(ctx))) {
-            ctx->mode = ESP_MBEDTLS_SHA512_HARDWARE;
-            first_block = true;
-        } else {
-            ctx->mode = ESP_MBEDTLS_SHA512_SOFTWARE;
-        }
-    }
-
-    if (ctx->mode == ESP_MBEDTLS_SHA512_HARDWARE) {
-        esp_sha_block(sha_type(ctx), data, first_block);
-    } else {
-        mbedtls_sha512_software_process(ctx, data);
-    }
-
-    return 0;
-}
 
 static void mbedtls_sha512_software_process( mbedtls_sha512_context *ctx, const unsigned char data[128] )
 {
@@ -296,13 +272,47 @@ static void mbedtls_sha512_software_process( mbedtls_sha512_context *ctx, const
     ctx->state[7] += H;
 }
 
+
+static int esp_internal_sha512_parallel_engine_process( mbedtls_sha512_context *ctx, const unsigned char data[128], bool read_digest )
+{
+    bool first_block = false;
+
+    if (ctx->mode == ESP_MBEDTLS_SHA512_UNUSED) {
+        /* try to use hardware for this digest */
+        if (esp_sha_try_lock_engine(sha_type(ctx))) {
+            ctx->mode = ESP_MBEDTLS_SHA512_HARDWARE;
+            first_block = true;
+        } else {
+            ctx->mode = ESP_MBEDTLS_SHA512_SOFTWARE;
+        }
+    }
+
+    if (ctx->mode == ESP_MBEDTLS_SHA512_HARDWARE) {
+        esp_sha_block(sha_type(ctx), data, first_block);
+        if (read_digest) {
+            esp_sha_read_digest_state(sha_type(ctx), ctx->state);
+        }
+    } else {
+        mbedtls_sha512_software_process(ctx, data);
+    }
+
+    return 0;
+}
+
+
+int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned char data[128] )
+{
+    return esp_internal_sha512_parallel_engine_process(ctx, data, true);
+}
+
+
 /*
  * SHA-512 process buffer
  */
 int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *input,
                                size_t ilen )
 {
-    int ret;
+    int ret = -1;
     size_t fill;
     unsigned int left;
 
@@ -321,7 +331,7 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
 
     if ( left && ilen >= fill ) {
         memcpy( (void *) (ctx->buffer + left), input, fill );
-        if ( ( ret = mbedtls_internal_sha512_process( ctx, ctx->buffer ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha512_parallel_engine_process( ctx, ctx->buffer, false ) ) != 0 ) {
             return ret;
         }
 
@@ -331,7 +341,7 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
     }
 
     while ( ilen >= 128 ) {
-        if ( ( ret = mbedtls_internal_sha512_process( ctx, input ) ) != 0 ) {
+        if ( ( ret = esp_internal_sha512_parallel_engine_process( ctx, input, false ) ) != 0 ) {
             return ret;
         }
 
@@ -339,6 +349,10 @@ int mbedtls_sha512_update( mbedtls_sha512_context *ctx, const unsigned char *inp
         ilen  -= 128;
     }
 
+    if (ctx->mode == ESP_MBEDTLS_SHA512_HARDWARE) {
+        esp_sha_read_digest_state(sha_type(ctx), ctx->state);
+    }
+
     if ( ilen > 0 ) {
         memcpy( (void *) (ctx->buffer + left), input, ilen );
     }
@@ -362,7 +376,7 @@ static const unsigned char sha512_padding[128] = {
  */
 int mbedtls_sha512_finish( mbedtls_sha512_context *ctx, unsigned char *output )
 {
-    int ret;
+    int ret = -1;
     size_t last, padn;
     uint64_t high, low;
     unsigned char msglen[16];

components/soc/esp32c2/include/soc/soc_caps.h

@@ -185,6 +185,9 @@
 
 /*--------------------------- SHA CAPS ---------------------------------------*/
 
+/* Due to very limited availability of the DMA channels, DMA support for the SHA peripheral is disabled */
+// #define SOC_SHA_SUPPORT_DMA             (1)
+
 /* The SHA engine is able to resume hashing from a user */
 #define SOC_SHA_SUPPORT_RESUME          (1)