A corrupted segment data_len was only caught by the image length check
after all segments had been checksummed/hashed. On chips with 32-bit cache
mapping (e.g. ESP32-P4 with CONFIG_BOOTLOADER_CACHE_32BIT_ADDR_QUAD_FLASH)
nothing bounds that walk, so a ~1.8 GB data_len trips the task WDT in the
app and the RTC WDT in the bootloader, which then reset-loops on the
corrupted partition.
Check that each segment header and its data lie inside the partition
before processing the segment data.
A reset does not stop a running trace encoder, which then writes into the next boot's RAM. Stop and
reset the encoders before a software reset and early in the bootloader.
SOC_EFUSE_DIS_DOWNLOAD_MSPI adds SPI_DOWNLOAD_MSPI_DIS to the release-mode criteria.
On ESP32-H2 its write-protection bit is shared with DIS_ICACHE, which first boot already
burns, so devices provisioned by earlier IDF versions can never set it and would report
DEVELOPMENT forever. Treat the field as satisfied when it is write-protected and warn
that MSPI access in download mode stays enabled; an unburned, unprotected field still fails.
Collapse the 12 non-ESP32 per-target secure_boot/flash_encryption secure-features files
into two shared SOC_EFUSE_*-gated files. ESP32 keeps its own (SBV1 + distinct eFuse family).
Adds SOC_EFUSE_DIS_DOWNLOAD_MSPI for C5/C61/H4 (they already burned the eFuse; the cap just
drives the unified cache-disable gating). eFuse-write behavior verified identical.
ESP32-H21 never disabled the UART download MMU cache during flash-encryption enable; the
SPI_DOWNLOAD_MSPI_DIS eFuse field exists but was never burned. Add the burn and the
SOC_EFUSE_DIS_DOWNLOAD_MSPI cap, matching peers (C5/C61/H4/P4/S31).
ESP32-H2 never disabled the UART download MMU cache during flash-encryption enable; the
SPI_DOWNLOAD_MSPI_DIS eFuse field exists but was never burned. Add the burn and the
SOC_EFUSE_DIS_DOWNLOAD_MSPI cap, matching peers (C5/C61/H4/P4/S31).
Secure Boot, flash encryption and image-integrity failures print an error and
stop, with no indication of the cause or the next step. Add hints.yml to the two
components that emit those messages so idf.py monitor annotates them inline.
The hints live with the components that own the messages rather than in the
global tools/idf_py_actions/hints.yml, matching the existing per-component
hints.yml convention.
CONFIG_BOOTLOADER_REGION_PROTECTION_ENABLE is bootloader-scoped;
disabling it must not strip the application's PMP/PMA configuration.
The application now always applies region protection.
Chips with RDID vendor 0x46 are not XMC and should not enter the XMC
startup flow via the RDID fast path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Trim bootloader size by moving some logs to DEBUG. Allows
compiling bootloader on P4 with CONFIG_ESPTOOLPY_FLASHMODE_QIO
without changing partition table offset
The digest length and the condition that reserves it at the end of RTC RAM were
duplicated in seven places. Hold the reservation in a hidden Kconfig value that
is zero when the feature does not apply, so every consumer subtracts it
unconditionally, and derive ESP_SECURE_BOOT_DIGEST_LEN from it.
Move the following modules from the hal component into a new dedicated
esp_hal_debug_assist component, following the esp_hal_timg pattern:
- assist_debug (hal + target-specific LL headers)
- debug_probe (types + target-specific LL headers)
- riscv_trace (hal + types + source + target-specific LL headers)
- trace_ll (esp32/esp32s2/esp32s3 target-specific LL headers)
Update the following components to depend on esp_hal_debug_assist:
esp_system, riscv, bootloader_support, esp_hw_support, esp_riscv_trace
Remove riscv_trace_hal.c from the hal component.
Set SECURE_BOOT_SHA384_EN when enabling ECDSA-P384 Secure Boot V2 on
ESP32-P4, as done on C5/H4/S31, so that ROM verifies the bootloader
using the SHA-384 scheme. The eFuse exists only on the rev >= v3.0
eFuse table, so the Kconfig option is gated on rev >= v3.0.
bootloader_support relies on linker-script placement that depends on object
file names, which LTO does not preserve. Set the NO_LTO component property so
it is excluded from compile-time LTO.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The removed function `esp_bootloader_get_description` never worked in the app build.
It can be used only in the bootloader build.
To read the bootloader description from app, there is another function
`esp_ota_get_bootloader_description`.
Remove ~50 duplicate local definitions of ALIGN_UP/ALIGN_DOWN/ALIGN_UP_BY/
ALIGN_DOWN_BY across the codebase and replace them with canonical
ESP_ALIGN_UP/ESP_ALIGN_DOWN from esp_macros.h.
Song Ruo Jing
Mahavir Jain
C.S.M
Erhan Kurubas
Laukik Hase
Harshal Patil
nilesh.kale
Aditya Patwardhan
morris
armando
Konstantin Kondrashov
Jiang Jiang Jian
wuzhenghui
Ashish Sharma
Marius Vikhammer
Gao Xu
Konstantin Kondrashov
Ivan Grokhotkov (bot)andClaude Opus 4.8