- remmediate deep-review memory-saftey and DoS defects
- fix duplicated report of HCI mode change event
- fix conflicts in handling sniff subrate request when ACL link enters active mode
The PSRAM encryption anti-FI check in mmu_ll_write_entry() pulls in
ESP_FAULT_ASSERT and efuse_hal_chip_revision(), which inflate the
bootloader image size. The check is not meaningful in the bootloader
or in the ESP-TEE build, so guard it out for both.
Applies to esp32c5, esp32c61 and esp32p4.
Commit ab229a34 added PSRAM memory protection for ESP32-P4 rev < 3.0. It
consumed all 16 PMP entries and shifted the fixed LP-RAM (9-12 -> 11-14) and
peripheral (13 -> 15) entries to make room. Older bootloaders lock the
peripheral entry at its original index 13, so on a v5.3/v5.4 bootloader running
a newer application the LP-RAM entry that landed on the locked index 13 was
silently ignored, weakening LP-RAM protection.
Select the rev < 3.0 layout at runtime by probing whether the bootloader locked
the peripheral at entry 13:
- locked (v5.3/v5.4) -> default layout (LP-RAM 9-12, peripheral 13), no PSRAM
protection; these devices never had it (it was introduced in v5.5).
- free (v5.5+) -> PSRAM layout (flash/ext-RAM 6-10, LP-RAM 11-14,
peripheral 15) with full external-RAM protection; the peripheral entry at 15
matches the bootloader's lock.
This restores forward compatibility across all shipped rev < 3.0 bootloaders
without regressing PSRAM protection on the v5.5+ devices that already have it.
Chip revision >= 3.0 (32 PMP entries) is unaffected.
A PMP entry the (non-OTA-updatable) bootloader locks cannot be reconfigured
by the application until CPU reset, so the layout of the entries a shipped
bootloader locks is a bootloader<->application ABI that renumbering would
silently break on deployed devices.
On C5, C6, C61, H2 and P4 the bootloader now configures only the PMA invalid regions
and leaves PMP to the application.
On C5 the application programs the two ROM entries without a cfg reset:
v6.0/v6.1 bootloaders lock the TOR base entry at SOC_IROM_MASK_LOW, so on
such devices the TOR region above it spans the ROM text and must keep the
X bit those bootloaders left in the following unlocked entry, which
OR-only writes can never clear. With newer bootloaders the application
receives clean entries and the ROM data region gets the intended strict R
permission.
Rename the internal ULP child-build marker to __ULP_BUILDV2 so component CMake files make the build-system scope explicit.
Document that the marker is currently set only by the IDF_BUILD_V2 ULP child path.
Route ulp_embed_binary() through a built-in CMake v2 default ULP project instead of generating a compatibility project with a synthetic main component.
Attach legacy ULP sources directly to the ULP executable, pass the parent component include view through the existing ULP_S_SOURCES/COMPONENT_* channel, and remove the generated legacy project templates plus the component path ownership validation bypass they required.
Update the build-system coverage to assert that the builtin child project builds and rebuilds when parent-owned ULP sources change.
Preserve all linker scripts passed to target_linker_script() so LP-core child builds keep the full esp32p4 LP ROM script set instead of only the first script.
Link the ULP runtime component as WHOLE_ARCHIVE for ULP child builds, matching the legacy helper behavior where runtime sources were added directly to the executable. This keeps strong runtime handlers such as ulp_lp_core_panic_handler from being skipped in favor of weak defaults from already-extracted archive objects.
Validated with the esp32p4 lp_core_hp_uart panic and LP-ROM pytest cases, plus the focused local/CI build_all shape for the app.
fix(bt): Fixed several issues on BR/EDR controller on ESP32-S31
Closes BTQABR2023-829, BTQABR2023-836, BTQABR2023-837, BTQABR2023-840, BTQABR2023-687, and BTQABR2023-697
See merge request espressif/esp-idf!51249
Fixed bug when BR/EDR ACL-U dynamic Tx buffer is enabled
Fixed infinite loop during connection set-up
Optimized the scheduling of SCO/eSCO and sniff events
Validate BitScrambler program headers against the supported format and
hardware limits before using header-derived instruction and LUT sizes.
Also add regression coverage for malformed headers and document that the
program blob must come from a trusted assembler output.
Reject LUT loads that exceed the hardware address space and assemble
each 32-bit LUT word via memcpy so unaligned and partial inputs do not
read past the caller buffer. Add regression tests for oversized and
partial unaligned LUT loads.
Clear the returned handle on loopback creation failure and route
initialized objects through bitscrambler_free so channel ownership and
extra cleanup state cannot leak after partial setup errors. Add a
regression test for the failed create path.
Both newlib and picolibc headers in toolchain 16.1 declare timespec_get()
but the archives do not define it. Provide the missing C11 implementation
through esp_libc, mapping TIME_UTC to clock_gettime(CLOCK_REALTIME).
Closes https://github.com/espressif/esp-idf/issues/18889
Add SOC_DEBUG_HAVE_OCD_STUB_BINS for esp32c5, esp32c61, esp32h4,
esp32h21, esp32p4, and esp32s31. Update TEE linker scripts with
correct esp_tee_app_config offsets for the 0x3000 stub reservation
