esp-idf-sbom reports five ESP-IDF CVEs against this branch because NVD
pins them to 5.5.4 -- the version release/v5.5 still reports until 5.5.5
is released -- even though the fixes are already merged here:
- CVE-2026-45160 DHCP server OOB read (d51b107609)
- CVE-2026-45328 ESP-TEE hardening against REE manipulation (b471faf803)
- CVE-2026-45329 ESP-TEE service-call input validation (eebabaff2f, dcb758a30b)
- CVE-2026-45541 esp_http_server WebSocket NULL dereference (00a2f7fbbb)
- CVE-2026-45542 protocomm SRP6a heap overflow (71eb2dbe6a)
esp-idf-sbom merges this repository-local excluded_cves.yaml into its
exclusion list when scanning the tree, so these CVEs are reported as
excluded for this branch while the released v5.5.4 tag, which predates
this file, is still reported. Once version.cmake is bumped to 5.5.5 the
entries become no-ops (NVD does not list 5.5.5) and can be removed.
Signed-off-by: Frantisek Hrbata <frantisek.hrbata@espressif.com>
The spiram-xip IROM/DROM alignment tests assumed the XIP region always
leaves an alignment gap before the next MMU page: they executed into the
gap and expected an instruction access fault followed by a register dump.
When the section ends exactly on an MMU page boundary there is no gap - the
device prints "<IROM/DROM> alignment gap not added into heap" and returns,
the framework restarts cleanly (esp_restart_noos, no panic), and the test
timed out waiting for a register dump.
Define per-target SDIO slave descriptor buffer limits in the LL layer and validate queued send buffers against the 4-byte aligned effective maximum. Update the public docs to describe the chip-dependent limit instead of hardcoding 4092 bytes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Mirror the recent EN-side updates in the Chinese External RAM guide:
- Replace "PSRAM 顶部" with "PSRAM 上端（最高物理地址区）" to match the
clarified wording on the EN side.
- Add the verification-helper pointer next to the heap_caps_malloc
example so Chinese readers also learn about esp_psram_ptr_is_no_enc().
Also drop the :cpp:func: cross-reference for esp_psram_ptr_is_no_enc on
the EN side: esp_psram.h is not in any chip-specific Doxyfile, so
Sphinx/Breathe cannot resolve the reference. Use a plain inline code
literal instead, matching the existing reference style for
esp_psram_get_size and other esp_psram functions in the docs.
The previous wording "top of PSRAM" was ambiguous: the carve-out is
actually mapped at the highest physical addresses of PSRAM (after the
rodata, text, and main heap mappings). Update the Kconfig help text for
SPIRAM_ENC_EXEMPT and SPIRAM_ENC_EXEMPT_SIZE, the External RAM
documentation, and the internal layout comment to say "upper end of PSRAM
(highest physical addresses)" instead.
Drivers that allocate from the unencrypted PSRAM carve-out via
MALLOC_CAP_SPIRAM_NO_ENC currently have no way to verify after the fact
which pool a buffer came from. This is particularly relevant for callers
using heap_caps_malloc_prefer(MALLOC_CAP_SPIRAM_NO_ENC, MALLOC_CAP_SPIRAM),
where a silent fallback to encrypted PSRAM would still pass the typical
esp_ptr_external_ram() check.
Expose esp_psram_ptr_is_no_enc() in the public esp_psram.h header. It
performs a range check against the carve-out's virtual-address window and
returns false when PSRAM is not initialized or CONFIG_SPIRAM_ENC_EXEMPT is
disabled, so callers do not need to guard the call site with #if.
Also reference the helper from the External RAM documentation alongside
the heap_caps_malloc(MALLOC_CAP_SPIRAM_NO_ENC) usage example.
If the virtual-address pool is exhausted when reserving the unencrypted
PSRAM carve-out (the warning at L388 may already have fired for the main
mapping), esp_mmu_map_reserve_block_with_caps() returns an error rather
than aborting. Convert the previous assert() into a logged fallback that
disables the carve-out for this boot, mirroring the SPIRAM_ENC_EXEMPT_SIZE
>= psram_available_size path.
Also extend esp_psram_extram_test() to run the standard memory test on
the carve-out region when CONFIG_SPIRAM_ENC_EXEMPT is enabled, so the
unencrypted mapping is exercised on startup like the other PSRAM regions.
Extends the External RAM encryption section to describe
CONFIG_SPIRAM_ENC_EXEMPT and the MALLOC_CAP_SPIRAM_NO_ENC heap
capability, including a security warning and a typical DMA-alignment
use case. Mirrors the change in zh_CN.
Adds CONFIG_SPIRAM_ENC_EXEMPT, available on chips that support per-page
PSRAM encryption configuration (esp32c5, esp32c61, esp32p4). When
enabled, esp_psram carves CONFIG_SPIRAM_ENC_EXEMPT_SIZE off the top of
PSRAM and maps it via the new mmu_hal_map_region_no_enc() helper, which
writes MMU entries without the SENSITIVE bit. The region is registered
as a separate heap pool reachable only through the new
MALLOC_CAP_SPIRAM_NO_ENC capability bit, so default SPIRAM allocations
cannot accidentally land there.
PSRAM encryption imposes alignment constraints that some DMA engines
(e.g. 2D-DMA) cannot satisfy. This option lets such workloads place
their buffers in unencrypted PSRAM while keeping the rest of PSRAM
(and flash) encrypted. Default disabled; security implications are
documented in the Kconfig help text.
morris
Jiang Jiang Jian
wuzhenghui
Mahavir Jain
Ashish Sharma
Laukik Hase
yanzihan@espressif.com
zhangyanjiao
Jack
Xu Si Yu
yinqingzhao
Frantisek Hrbata
harshal.patil
C.S.M
Rahul Tank