diff --git a/components/bootloader/Kconfig.projbuild b/components/bootloader/Kconfig.projbuild
index 18a3a7da8f..73a8bcb812 100644
--- a/components/bootloader/Kconfig.projbuild
+++ b/components/bootloader/Kconfig.projbuild
@@ -634,7 +634,7 @@ menu "Security features"
     choice SECURE_FLASH_ENCRYPTION_KEYSIZE
         bool "Size of generated AES-XTS key"
         default SECURE_FLASH_ENCRYPTION_AES128
-        depends on IDF_TARGET_ESP32S2 && SECURE_FLASH_ENC_ENABLED
+        depends on (IDF_TARGET_ESP32S2 || IDF_TARGET_ESP32S3) && SECURE_FLASH_ENC_ENABLED
         help
             Size of generated AES-XTS key.
 
diff --git a/components/esptool_py/CMakeLists.txt b/components/esptool_py/CMakeLists.txt
index c57f25c820..094da4d240 100644
--- a/components/esptool_py/CMakeLists.txt
+++ b/components/esptool_py/CMakeLists.txt
@@ -24,11 +24,10 @@ consist of two ota app without factory or test partitions.")
 
     # Generate flasher_args.json for tools that need it. The variables below are used
     # in configuring the template flasher_args.json.in.
-    # Some of the variables (flash mode, size, frequency) are already set in project_include.cmake.
+    # Some of the variables (flash mode, size, frequency, chip) are already set in project_include.cmake.
 
     set(ESPTOOLPY_BEFORE "${CONFIG_ESPTOOLPY_BEFORE}")
     set(ESPTOOLPY_AFTER  "${CONFIG_ESPTOOLPY_AFTER}")
-    set(ESPTOOLPY_CHIP "${target}")
     if(CONFIG_ESPTOOLPY_NO_STUB)
         set(ESPTOOLPY_WITH_STUB false)
     else()
diff --git a/components/esptool_py/project_include.cmake b/components/esptool_py/project_include.cmake
index 07e72667a1..5948fe40c2 100644
--- a/components/esptool_py/project_include.cmake
+++ b/components/esptool_py/project_include.cmake
@@ -21,6 +21,8 @@ set(ESPFLASHMODE ${CONFIG_ESPTOOLPY_FLASHMODE})
 set(ESPFLASHFREQ ${CONFIG_ESPTOOLPY_FLASHFREQ})
 set(ESPFLASHSIZE ${CONFIG_ESPTOOLPY_FLASHSIZE})
 
+set(ESPTOOLPY_CHIP "${chip_model}")
+
 set(ESPTOOLPY_FLASH_OPTIONS
     --flash_mode ${ESPFLASHMODE}
     --flash_freq ${ESPFLASHFREQ}
diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index bbe4009cee..9770497391 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -248,7 +248,7 @@ menu "mbedTLS"
 
     config MBEDTLS_AES_USE_INTERRUPT
         bool "Use interrupt for long AES operations"
-        depends on IDF_TARGET_ESP32S2 && MBEDTLS_HARDWARE_AES
+        depends on !IDF_TARGET_ESP32 && MBEDTLS_HARDWARE_AES
         default y
         help
             Use an interrupt to coordinate long AES operations.
diff --git a/components/mbedtls/port/aes/dma/esp_aes.c b/components/mbedtls/port/aes/dma/esp_aes.c
index a0b9af4ca5..1cd854000e 100644
--- a/components/mbedtls/port/aes/dma/esp_aes.c
+++ b/components/mbedtls/port/aes/dma/esp_aes.c
@@ -359,7 +359,8 @@ static int esp_aes_process_dma(esp_aes_context *ctx, const unsigned char *input,
         block_out_desc = block_desc + lldesc_num;
 
         lldesc_setup_link(block_in_desc, input, block_bytes, 0);
-        lldesc_setup_link(block_out_desc, output, block_bytes, 0);
+        //Limit max inlink descriptor length to be 16 byte aligned, require for EDMA
+        lldesc_setup_link_constrained(block_out_desc, output, block_bytes, LLDESC_MAX_NUM_PER_DESC_16B_ALIGNED, 0);
 
         out_desc_tail = &block_out_desc[lldesc_num - 1];
     }
diff --git a/components/mbedtls/test/test_mbedtls_sha.c b/components/mbedtls/test/test_mbedtls_sha.c
index 190769592a..88a9f364cf 100644
--- a/components/mbedtls/test/test_mbedtls_sha.c
+++ b/components/mbedtls/test/test_mbedtls_sha.c
@@ -475,11 +475,11 @@ TEST_CASE("mbedtls SHA512/t", "[mbedtls]")
         }
     }
 }
+#endif //CONFIG_MBEDTLS_HARDWARE_SHA
 
-#ifdef CONFIG_SPIRAM
+#ifdef CONFIG_SPIRAM_USE_MALLOC
 TEST_CASE("mbedtls SHA256 PSRAM DMA", "[mbedtls]")
 {
-
     const unsigned CALLS = 256;
     const unsigned CALL_SZ = 16 * 1024;
     mbedtls_sha256_context sha256_ctx;
@@ -510,6 +510,4 @@ TEST_CASE("mbedtls SHA256 PSRAM DMA", "[mbedtls]")
     TEST_ASSERT_EQUAL_STRING(expected_hash, hash_str);
 
 }
-#endif //CONFIG_SPIRAM
-
-#endif //CONFIG_MBEDTLS_HARDWARE_SHA
+#endif //CONFIG_SPIRAM_USE_MALLOC
diff --git a/components/soc/include/soc/lldesc.h b/components/soc/include/soc/lldesc.h
index 31e02125c4..ef74ce7aa4 100644
--- a/components/soc/include/soc/lldesc.h
+++ b/components/soc/include/soc/lldesc.h
@@ -31,6 +31,24 @@
 /** Maximum size of data in the buffer that a DMA descriptor can hold. */
 #define LLDESC_MAX_NUM_PER_DESC (4096-4)
 
+// Some DMA operations might impose certain alignment restrictions on the length
+#define LLDESC_MAX_NUM_PER_DESC_16B_ALIGNED (4096 - 16)
+#define LLDESC_MAX_NUM_PER_DESC_32B_ALIGNED (4096 - 32)
+
+/**
+ * Generate a linked list pointing to a (huge) buffer in an descriptor array.
+ *
+ * The caller should ensure there is enough size to hold the array, by calling
+ * ``lldesc_get_required_num_constrained`` with the same max_desc_size argument.
+ *
+ * @param[out] out_desc_array Output of a descriptor array, the head should be fed to the DMA.
+ * @param buffer Buffer for the descriptors to point to.
+ * @param size Size (or length for TX) of the buffer
+ * @param max_desc_size Maximum length of each descriptor
+ * @param isrx The RX DMA may require the buffer to be word-aligned, set to true for a RX link, otherwise false.
+ */
+void lldesc_setup_link_constrained(lldesc_t *out_desc_array, const void *buffer, int size, int max_desc_size, bool isrx);
+
 /**
  * Generate a linked list pointing to a (huge) buffer in an descriptor array.
  *
@@ -42,7 +60,7 @@
  * @param size Size (or length for TX) of the buffer
  * @param isrx The RX DMA may require the buffer to be word-aligned, set to true for a RX link, otherwise false.
  */
-void lldesc_setup_link(lldesc_t *out_desc_array, const void *buffer, int size, bool isrx);
+#define lldesc_setup_link(out_desc_array, buffer, size, isrx) lldesc_setup_link_constrained(out_desc_array, buffer, size, LLDESC_MAX_NUM_PER_DESC, isrx)
 
 /**
  * @brief Get the received length of a linked list, until end of the link or eof.
@@ -61,7 +79,16 @@ int lldesc_get_received_len(lldesc_t* head, lldesc_t** out_next);
  *
  * @return Numbers required.
  */
-static inline int lldesc_get_required_num(int data_size)
+static inline int lldesc_get_required_num_constrained(int data_size, int max_desc_size)
 {
-    return (data_size + LLDESC_MAX_NUM_PER_DESC - 1) / LLDESC_MAX_NUM_PER_DESC;
+    return (data_size + max_desc_size - 1) / max_desc_size;
 }
+
+/**
+ * Get the number of descriptors required for a given buffer size.
+ *
+ * @param data_size Size to check descriptor num.
+ * @param max_desc_size Maximum length of each descriptor
+ * @return Numbers required.
+ */
+#define lldesc_get_required_num(data_size) lldesc_get_required_num_constrained(data_size, LLDESC_MAX_NUM_PER_DESC)
diff --git a/components/soc/lldesc.c b/components/soc/lldesc.c
index c1bf6f022a..3e27537e05 100644
--- a/components/soc/lldesc.c
+++ b/components/soc/lldesc.c
@@ -1,12 +1,12 @@
 #include "soc/lldesc.h"
 
-void lldesc_setup_link(lldesc_t *dmadesc, const void *data, int len, bool isrx)
+void lldesc_setup_link_constrained(lldesc_t *dmadesc, const void *data, int len, int max_desc_size, bool isrx)
 {
     int n = 0;
     while (len) {
         int dmachunklen = len;
-        if (dmachunklen > LLDESC_MAX_NUM_PER_DESC) {
-            dmachunklen = LLDESC_MAX_NUM_PER_DESC;
+        if (dmachunklen > max_desc_size) {
+            dmachunklen = max_desc_size;
         }
         if (isrx) {
             //Receive needs DMA length rounded to next 32-bit boundary