fix(esp_rom): Set poison check hook for tlsf_walk_pool patch

components/esp_rom/esp32s31/Kconfig.soc_caps.in

@@ -47,6 +47,18 @@ config ESP_ROM_HAS_HAL_SYSTIMER
     bool
     default y
 
+config ESP_ROM_HAS_HEAP_TLSF
+    bool
+    default y
+
+config ESP_ROM_TLSF_CHECK_PATCH
+    bool
+    default y
+
+config ESP_ROM_MULTI_HEAP_WALK_PATCH
+    bool
+    default y
+
 config ESP_ROM_HAS_LAYOUT_TABLE
     bool
     default y
@@ -55,10 +67,6 @@ config ESP_ROM_WDT_INIT_PATCH
     bool
     default y
 
-config ESP_ROM_HAS_HEAP_TLSF
-    bool
-    default y
-
 config ESP_ROM_HAS_NEWLIB
     bool
     default y
@@ -75,10 +83,6 @@ config ESP_ROM_HAS_OUTPUT_PUTC_FUNC
     bool
     default y
 
-config ESP_ROM_MULTI_HEAP_WALK_PATCH
-    bool
-    default y
-
 config ESP_ROM_PRINTS_LOCKUP_STATUS
     bool
     default y

components/esp_rom/esp32s31/esp_rom_caps.h

@@ -17,6 +17,9 @@
 #define ESP_ROM_HAS_RVFPLIB                 (1) // ROM has the rvfplib
 #define ESP_ROM_HAS_HAL_WDT                 (1) // ROM has the implementation of Watchdog HAL driver
 #define ESP_ROM_HAS_HAL_SYSTIMER            (1) // ROM has the implementation of Systimer HAL driver
+#define ESP_ROM_HAS_HEAP_TLSF               (1) // ROM has the implementation of the tlsf and multi-heap library
+#define ESP_ROM_TLSF_CHECK_PATCH            (1) // ROM does not contain the patch of tlsf_check_pool()
+#define ESP_ROM_MULTI_HEAP_WALK_PATCH       (1) // ROM does not contain the patch of multi_heap_walk()
 #define ESP_ROM_HAS_LAYOUT_TABLE            (1) // ROM has the layout table
 #define ESP_ROM_WDT_INIT_PATCH              (1) // ROM version does not configure the clock
 #define ESP_ROM_HAS_HEAP_TLSF               (1) // ROM has the implementation of the tlsf and multi-heap library
@@ -24,5 +27,4 @@
 #define ESP_ROM_HAS_NEWLIB_NANO_FORMAT      (1) // ROM has the newlib nano version of formatting functions
 #define ESP_ROM_HAS_VERSION                 (1) // ROM has version/eco information
 #define ESP_ROM_HAS_OUTPUT_PUTC_FUNC        (1) // ROM has esp_rom_output_putc (or ets_write_char_uart)
-#define ESP_ROM_MULTI_HEAP_WALK_PATCH       (1) // ROM does not contain the patch of multi_heap_walk()
 #define ESP_ROM_PRINTS_LOCKUP_STATUS        (1) // ROM bootloader already prints CPU lockup diagnostic status

components/esp_rom/esp32s31/esp_rom_heap_tlsf_stub_table.h

@@ -0,0 +1,59 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+
+#pragma once
+
+#include <stddef.h>
+#include "esp_rom_tlsf.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief TLSF ROM vtable stub table for esp32s31.
+ *
+ * This struct mirrors the TLSF function-pointer vtable stored in ROM.
+ * Its layout MUST exactly match the ROM vtable for the target chip.
+ * It is used by tlsf_set_rom_patches() to intercept TLSF calls.
+ */
+struct heap_tlsf_stub_table_t {
+    tlsf_t (*tlsf_create)(void *mem, size_t max_bytes);
+    tlsf_t (*tlsf_create_with_pool)(void *mem, size_t pool_bytes, size_t max_bytes);
+    pool_t (*tlsf_get_pool)(tlsf_t tlsf);
+    pool_t (*tlsf_add_pool)(tlsf_t tlsf, void *mem, size_t bytes);
+    void (*tlsf_remove_pool)(tlsf_t tlsf, pool_t pool);
+
+    void *(*tlsf_malloc)(tlsf_t tlsf, size_t size);
+    void *(*tlsf_memalign)(tlsf_t tlsf, size_t align, size_t size);
+    void *(*tlsf_memalign_offs)(tlsf_t tlsf, size_t align, size_t size, size_t offset);
+    void *(*tlsf_realloc)(tlsf_t tlsf, void *ptr, size_t size);
+    void (*tlsf_free)(tlsf_t tlsf, void *ptr);
+
+    size_t (*tlsf_block_size)(void *ptr);
+    size_t (*tlsf_size)(tlsf_t tlsf);
+    size_t (*tlsf_align_size)(void);
+    size_t (*tlsf_block_size_min)(void);
+    /* NOTE: The ROM signature is tlsf_block_size_max(control_t *control), but
+     * control_t is an internal TLSF type not exposed in any public header.
+     * Since tlsf_t is typedef'd as void* (same as control_t), the ABI is
+     * identical and we use tlsf_t here to keep this header self-contained. */
+    size_t (*tlsf_block_size_max)(tlsf_t tlsf);
+    size_t (*tlsf_pool_overhead)(void);
+    size_t (*tlsf_alloc_overhead)(void);
+
+    void (*tlsf_walk_pool)(pool_t pool, tlsf_walker walker, void *user);
+
+    int (*tlsf_check)(tlsf_t tlsf);
+    int (*tlsf_check_pool)(pool_t pool);
+
+    void *(*tlsf_malloc_addr)(tlsf_t tlsf, size_t size, void *address);
+};
+
+#ifdef __cplusplus
+}
+#endif