Define per-target SDIO slave descriptor buffer limits in the LL layer and validate queued send buffers against the 4-byte aligned effective maximum. Update the public docs to describe the chip-dependent limit instead of hardcoding 4092 bytes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mirror the recent EN-side updates in the Chinese External RAM guide:
- Replace "PSRAM 顶部" with "PSRAM 上端（最高物理地址区）" to match the
clarified wording on the EN side.
- Add the verification-helper pointer next to the heap_caps_malloc
example so Chinese readers also learn about esp_psram_ptr_is_no_enc().
Also drop the :cpp:func: cross-reference for esp_psram_ptr_is_no_enc on
the EN side: esp_psram.h is not in any chip-specific Doxyfile, so
Sphinx/Breathe cannot resolve the reference. Use a plain inline code
literal instead, matching the existing reference style for
esp_psram_get_size and other esp_psram functions in the docs.
The previous wording "top of PSRAM" was ambiguous: the carve-out is
actually mapped at the highest physical addresses of PSRAM (after the
rodata, text, and main heap mappings). Update the Kconfig help text for
SPIRAM_ENC_EXEMPT and SPIRAM_ENC_EXEMPT_SIZE, the External RAM
documentation, and the internal layout comment to say "upper end of PSRAM
(highest physical addresses)" instead.
Drivers that allocate from the unencrypted PSRAM carve-out via
MALLOC_CAP_SPIRAM_NO_ENC currently have no way to verify after the fact
which pool a buffer came from. This is particularly relevant for callers
using heap_caps_malloc_prefer(MALLOC_CAP_SPIRAM_NO_ENC, MALLOC_CAP_SPIRAM),
where a silent fallback to encrypted PSRAM would still pass the typical
esp_ptr_external_ram() check.
Expose esp_psram_ptr_is_no_enc() in the public esp_psram.h header. It
performs a range check against the carve-out's virtual-address window and
returns false when PSRAM is not initialized or CONFIG_SPIRAM_ENC_EXEMPT is
disabled, so callers do not need to guard the call site with #if.
Also reference the helper from the External RAM documentation alongside
the heap_caps_malloc(MALLOC_CAP_SPIRAM_NO_ENC) usage example.
Extends the External RAM encryption section to describe
CONFIG_SPIRAM_ENC_EXEMPT and the MALLOC_CAP_SPIRAM_NO_ENC heap
capability, including a security warning and a typical DMA-alignment
use case. Mirrors the change in zh_CN.
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.
Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
- security.rst: remove duplicated word in OTA encryption note
- tee.rst: remove duplicated word in memory allocation note
- flash-encryption.rst: drop redundant phrase and fix subject-verb agreement
ECDSA based Secure Boot V2 is not functional for certain input vectors on
ESP32-C5/C61/H2/P4 and on the preview targets ESP32-H4/H21. RSA based Secure
Boot V2 is the recommended scheme where the SoC supports it. This issue will be
fixed in a future hardware ECO revision; more details will be shared through the
hardware errata document.
A new hidden Kconfig option SECURE_BOOT_V2_ECDSA_INSECURE marks the affected
mass-production SoCs (ESP32-C5/C61/H2/P4). On these SoCs, when hardware Secure
Boot V2 is enabled, the ECDSA (V2) signing scheme is no longer offered by
default; it must be turned on explicitly via SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
under "Allow potentially insecure options" (CONFIG_SECURE_BOOT_INSECURE). App
signing without hardware Secure Boot is not affected. Note that ESP32-C61 has no
RSA based Secure Boot V2, so it has no Secure Boot scheme enabled by default.
The preview targets ESP32-H4 and ESP32-H21 mark ECDSA Secure Boot V2 as not
supported in their SoC capabilities instead of using the option above. As
ESP32-H4 has no other Secure Boot V2 scheme, Secure Boot is disabled entirely on
it; ESP32-H21 retains RSA based Secure Boot V2.
The security documentation keeps the ECDSA Secure Boot V2 content visible and
adds a warning describing the limitation (including that ECDSA Secure Boot V2 on
ESP32-C61 is not recommended for production). CI apps that exercise ECDSA Secure
Boot V2 on the affected SoCs set CONFIG_SECURE_BOOT_V2_FORCE_ENABLE_ECDSA
accordingly.
morris
Chen Jichang
Zhang Shuxian
gaoxuandCursor
Hu Rui
Fu Hanxi
Island
Chen Chen
C.S.M
Jiang Jiang Jian
Zhi Wei Jian
Ashish Sharma
Konstantin Kondrashov
wanckl
wuzhenghui
Marius Vikhammer
Mahavir Jain
hebinglin
JiangGuangMingandCursor
Aditya Patwardhan