ESP32-S3 has granular/partial PSRAM encryption support ?

[Baldhead]

Hi everyone,

I am looking into the recent MMU driver updates (esp_mm) in the master branch of ESP-IDF.
I noticed the introduction of flags like MMU_MEM_CAP_ENCRYPT and updated APIs that seem to handle memory encryption capabilities at a page/block level.
Given that the ESP32-S3 shares the same MSPI bus lines (D0-D7, CLK) for both Flash and PSRAM within the SiP/module, I would like to get a definitive confirmation regarding hardware limitations:
Does the ESP32-S3 EXTMEM/MMU hardware actually support partial or page-level encryption toggling for the PSRAM ? Or is it strictly a global "all-or-nothing" configuration tied to EXTMEM_SHARE_ENC_EN ?
If a developer attempts to use the new unified esp_mm encryption flags targets on an ESP32-S3 target, will the HAL layer simply fall back or return an error due to the lack of hardware address-masking registers in the S3 silicons ?I

Suspect this granular capability is exclusive to newer chips like the ESP32-P4 (which has independent buses), and that on the S3, exposing decrypted PSRAM data on the shared SPI wires would leak the firmware anyway.
Could anyone from the Espressif team confirm if there will ever be stable support for partial PSRAM decryption on the ESP32-S3, or if it is physically impossible due to the EXTMEM hardware architecture ?

Note:
I would like to create 2 big frame buffers without encryption. Today, I use encryption for everything.

Thanks in advance.

[Baldhead]

Someone ?

[eriksl]

.

[eriksl]

I really don't think many people are into encryption of RAM. Out of curiosity, can I ask why you're doing it?

[MicroController]

The question does not seem to ask how to do PSRAM encryption, but rather how to use flash encryption while using parts of PSRAM still unencrypted.

The docs say

When [enryption] is enabled any data read and written through the cache will automatically be encrypted or decrypted

So it seems that CPU and DMA cannot share data in PSRAM.

[Baldhead]

The question does not seem to ask how to do PSRAM encryption, but rather how to use flash encryption while using parts of PSRAM still unencrypted.

The docs say

When [enryption] is enabled any data read and written through the cache will automatically be encrypted or decrypted

So it seems that CPU and DMA cannot share data in PSRAM.

I am using an ESP32-S3 module with embedded PSRAM and external Flash (S3-WROOM-2-N32R16V).

I already use external DMA, and it works with encryption enabled.

I have enabled both CONFIG_SPIRAM_FETCH_INSTRUCTIONS and CONFIG_SPIRAM_RODATA to copy all instructions and read-only data from Flash to PSRAM during boot.

My question is:
Is it possible to disable encryption only for the two frame buffers allocated in PSRAM, while keeping the rest of the PSRAM encrypted?

[Baldhead]

If ESP32-S3 support this:

Does support for this configuration depend on the ESP32-S3 silicon revision? If so, which revisions support it and which do not?

NOTES:
CONFIG_SPIRAM_ENC_EXEMPT
https://github.com/espressif/esp-idf/bl ... sp_psram.h

CONFIG_SPIRAM_ENC_EXEMPT is an ESP-IDF configuration option that carves out a designated unencrypted region of external PSRAM. This unmapped/unencrypted area avoids encryption-related alignment restrictions and is accessed using the MALLOC_CAP_SPIRAM_NO_ENC heap capability flag.

Key Features and Purpose:

Unencrypted Region:
Reserves a specific pool of external RAM that bypasses flash/PSRAM encryption routines.

Alignment Relief:
Eliminates strict encryption block-size alignment hurdles for specific high-speed or DMA-driven peripheral buffers (such as hardware JPEG decoder/encoder blocks).

Explicit Allocation:
Memory from this zone is requested explicitly via the heap allocator using MALLOC_CAP_SPIRAM_NO_ENC.