fix(esp_tee): Validate the stack pointer at the privilege switch boundary
Closes IDF-15974, IDF-15977, and IDF-15994
See merge request espressif/esp-idf!50647
Declare ext_ram_xip_seg as a distinct region overlapping drom_seg at the
same origin (the esp32s3/c5/c61/h4 pattern) instead of aliasing drom_seg,
so .ext_ram.dummy has its own location counter and .ext_ram.bss reclaims
the VMA space of NOLOAD rodata (.rodata_wlog_*), saving up to one MMU
page of PSRAM on esp32s31. No layout change on esp32p4.
Closes https://github.com/espressif/esp-idf/issues/18791
Related https://github.com/espressif/esp-idf/issues/14992
GCC 16 flags the volatile accumulator in the cache writeback loops even
though it is volatile, as it is only used to update itself. Drop the
accumulator and rely on the volatile-qualified psram pointer to keep
the cache-line reads from being optimized out.
GCC 16 raised the default level of -Wunused-but-set-variable and now
flags variables that are only used to update themselves. Remove the
'removed' counter in pmksa_cache_flush() (its only read was commented
out) and mark the EAP-FAST PAC entry counters as unused, since their
only read is inside wpa_printf(MSG_DEBUG, ...) which compiles to a
no-op when debug logging is disabled.
Handle absent IROM/DROM alignment gap in SPIRAM-XIP memprot tests
Closes IDFCI-5004, IDFCI-11739, and IDFCI-11738
See merge request espressif/esp-idf!50133
Commit 69d548c8 ("feat(esp_security): suppoer s31 security clock
management") introduced a new esp_crypto_clk source file in esp_security
but did not add it to the bootloader loader IRAM input sections. As a
result the crypto clock code was not placed in the loader IRAM region,
causing a regression on targets that use it during bootloader load.
Add *libesp_security.a:esp_crypto_clk.* to the bootloader sections
linker fragments for all targets that carry the esp_security.a
dependency (esp32c5, esp32p4, esp32s31), placed alongside
esp_crypto_periph_clk.
Previously the bootloader unconditionally revoked unused secure boot key
digest slots while permanently enabling secure boot on the first boot,
ignoring CONFIG_SECURE_BOOT_ALLOW_UNUSED_DIGEST_SLOTS. Now the config is
honored on this path too: when set, the unused digest slots are left
un-revoked. This is safe as long as the debug and download interfaces are
disabled.
Update the Kconfig help and the Secure Boot v2 guide (en and zh_CN)
accordingly.
- security.rst: remove duplicated word in OTA encryption note
- tee.rst: remove duplicated word in memory allocation note
- flash-encryption.rst: drop redundant phrase and fix subject-verb agreement
docs(esp_http_server): adds doc and migration entry for ws server post handshake cb
Closes IDFGH-17615 and DOC-14699
See merge request espressif/esp-idf!48153
feat: enable Secure Boot, Flash Encryption and Key Manager support in ESP32S31
Closes IDF-14629, IDF-14628, IDF-14626, and IDF-14622
See merge request espressif/esp-idf!48136
Mirror the recent EN-side updates in the Chinese External RAM guide:
- Replace "PSRAM 顶部" with "PSRAM 上端（最高物理地址区）" to match the
clarified wording on the EN side.
- Add the verification-helper pointer next to the heap_caps_malloc
example so Chinese readers also learn about esp_psram_ptr_is_no_enc().
Also drop the :cpp:func: cross-reference for esp_psram_ptr_is_no_enc on
the EN side: esp_psram.h is not in any chip-specific Doxyfile, so
Sphinx/Breathe cannot resolve the reference. Use a plain inline code
literal instead, matching the existing reference style for
esp_psram_get_size and other esp_psram functions in the docs.
The previous wording "top of PSRAM" was ambiguous: the carve-out is
actually mapped at the highest physical addresses of PSRAM (after the
rodata, text, and main heap mappings). Update the Kconfig help text for
SPIRAM_ENC_EXEMPT and SPIRAM_ENC_EXEMPT_SIZE, the External RAM
documentation, and the internal layout comment to say "upper end of PSRAM
(highest physical addresses)" instead.
Drivers that allocate from the unencrypted PSRAM carve-out via
MALLOC_CAP_SPIRAM_NO_ENC currently have no way to verify after the fact
which pool a buffer came from. This is particularly relevant for callers
using heap_caps_malloc_prefer(MALLOC_CAP_SPIRAM_NO_ENC, MALLOC_CAP_SPIRAM),
where a silent fallback to encrypted PSRAM would still pass the typical
esp_ptr_external_ram() check.
Expose esp_psram_ptr_is_no_enc() in the public esp_psram.h header. It
performs a range check against the carve-out's virtual-address window and
returns false when PSRAM is not initialized or CONFIG_SPIRAM_ENC_EXEMPT is
disabled, so callers do not need to guard the call site with #if.
Also reference the helper from the External RAM documentation alongside
the heap_caps_malloc(MALLOC_CAP_SPIRAM_NO_ENC) usage example.
If the virtual-address pool is exhausted when reserving the unencrypted
PSRAM carve-out (the warning at L388 may already have fired for the main
mapping), esp_mmu_map_reserve_block_with_caps() returns an error rather
than aborting. Convert the previous assert() into a logged fallback that
disables the carve-out for this boot, mirroring the SPIRAM_ENC_EXEMPT_SIZE
>= psram_available_size path.
Also extend esp_psram_extram_test() to run the standard memory test on
the carve-out region when CONFIG_SPIRAM_ENC_EXEMPT is enabled, so the
unencrypted mapping is exercised on startup like the other PSRAM regions.
Extends the External RAM encryption section to describe
CONFIG_SPIRAM_ENC_EXEMPT and the MALLOC_CAP_SPIRAM_NO_ENC heap
capability, including a security warning and a typical DMA-alignment
use case. Mirrors the change in zh_CN.
Adds CONFIG_SPIRAM_ENC_EXEMPT, available on chips that support per-page
PSRAM encryption configuration (esp32c5, esp32c61, esp32p4). When
enabled, esp_psram carves CONFIG_SPIRAM_ENC_EXEMPT_SIZE off the top of
PSRAM and maps it via the new mmu_hal_map_region_no_enc() helper, which
writes MMU entries without the SENSITIVE bit. The region is registered
as a separate heap pool reachable only through the new
MALLOC_CAP_SPIRAM_NO_ENC capability bit, so default SPIRAM allocations
cannot accidentally land there.
PSRAM encryption imposes alignment constraints that some DMA engines
(e.g. 2D-DMA) cannot satisfy. This option lets such workloads place
their buffers in unencrypted PSRAM while keeping the rest of PSRAM
(and flash) encrypted. Default disabled; security implications are
documented in the Kconfig help text.
fix(esp_crt_bundle): fixes verification failures with cross signed certificates
Closes IDFGH-17582 and IDFGH-17627
See merge request espressif/esp-idf!47966
fix(esp_http_server): Fix incorrect handling of websocket recv failures in web socket server
Closes IDFGH-17548
See merge request espressif/esp-idf!48190
Reset stale PMP gap entries on P4 v3 before app memprot setup
Closes IDFCI-10394, IDFCI-10397, IDFCI-10398, IDFCI-10399, IDFCI-10400, and IDFCI-10404
See merge request espressif/esp-idf!48048
handle_session_command0() freed cur_session->srp_hd on every error path
without clearing the pointer. A subsequent sec2_close_session() call
(e.g. on BLE disconnect, or via sec2_new_session evicting the old
session) checks `if (cur_session->srp_hd)` and frees it again,
double-freeing a dangling pointer.
fix(otatool): fix flaky serial port handoff in otatool CI test
Closes IDFCI-3263, IDFCI-3302, IDFCI-3402, IDFCI-3410, IDFCI-4548, IDFCI-5191, IDFCI-6937, and IDFCI-7329
See merge request espressif/esp-idf!47318
feat(security): add AES, SHA, ECC and RSA support for esp32s31
Closes IDF-14633, IDF-14630, IDF-14631, and IDF-14625
See merge request espressif/esp-idf!47286
fix(http_server/ws_echo_server): Fix ws_echo_server test URI registration race condition
Closes IDFCI-8585, IDFCI-6703, and IDFCI-3484
See merge request espressif/esp-idf!47368
fix(examples): replace unreliable external URL in https_x509_bundle example
Closes IDFCI-3853, IDFCI-7715, and IDFCI-6393
See merge request espressif/esp-idf!47328
Mahavir Jain