esp-idf: v5.2 bootloader crashes on startup (IDFGH-12141)

Answers checklist.

I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

v5.2 11eaf41b37267ad7709c0899c284e3683d2f0b5e

Espressif SoC revision.

ESP32-C3

Operating System used.

Linux

How did you build your project?

Command line with CMake

If you are using Windows, please specify command line type.

None

Development Kit.

Custom board

Power Supply used.

USB

What is the expected behavior?

The chip should boot up to the user application.

What is the actual behavior?

The bootloader crashes on startup.

Steps to reproduce.

Run IDF tag v5.2 on the C3.

Debug Logs.

ESP-ROM:esp32c3-api1-20210207
Build:Feb  7 2021
rst:0xc (RTC_SW_CPU_RST),boot:0xd (SPI_FAST_FLASH_BOOT)
Saved PC:0x403808ec
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fcd5820,len:0x23e0
load:0x403cc710,len:0xe4c
load:0x403ce710,len:0x354c
entry 0x403cc71a
I (24) boot: ESP-IDF v5.2 2nd stage bootloader
I (24) boot: compile time Feb 16 2024 10:12:36
D (24) bootloader_flash: non-XMC chip detected by SFDP Read (00), skip.
D (29) bootloader_flash: mmu set block paddr=0x00000000 (was 0xffffffff)
I (36) boot: chip revision: v0.4
D (40) qio_mode: Probing for QIO mode enable...
D (45) qio_mode: Raw SPI flash chip id 0x5e4016
D (49) qio_mode: Manufacturer ID 0x5e chip ID 0x4016
I (54) qio_mode: Enabling default flash chip QIO
D (60) qio_mode: Initial flash chip status 0x2
D (64) qio_mode: QIO mode already enabled in flash
D (69) qio_mode: Enabling QIO mode...
D (73) boot.esp32c3: magic e9
D (76) boot.esp32c3: segments 03
D (79) boot.esp32c3: spi_mode 02
D (82) boot.esp32c3: spi_speed 0f
D (86) boot.esp32c3: spi_size 02
I (89) boot.esp32c3: SPI Speed      : 80MHz
I (94) boot.esp32c3: SPI Mode       : QIO
I (99) boot.esp32c3: SPI Flash Size : 4MB
D (103) boot: Enabling RTCWDT(9000 ms)
I (107) boot: Enabling RNG early entropy source...
D (113) bootloader_flash: rodata starts from paddr=0x00008000, size=0xc00, will be mapped to vaddr=0x3c000000
V (122) bootloader_flash: after mapping, starting from paddr=0x00000000 and vaddr=0x3c000000, 0x10000 bytes are mapped
D (133) boot: mapped partition table 0x8000 at 0x3c008000
D (139) flash_parts: partition table verified, 7 entries
I (144) boot: Partition Table:
I (148) boot: ## Label            Usage          Type ST Offset   Length
D (155) boot: load partition table entry 0x3c008000
D (160) boot: type=1 subtype=4
I (163) boot:  0 nvs_key          NVS keys         01 04 00009000 00001000
D (171) boot: load partition table entry 0x3c008020
D (176) boot: type=1 subtype=0
I (179) boot:  1 otadata          OTA data         01 00 0000d000 00002000
D (186) boot: load partition table entry 0x3c008040
D (191) boot: type=1 subtype=1
I (195) boot:  2 phy_init         RF data          01 01 0000f000 00001000
D (202) boot: load partition table entry 0x3c008060
D (207) boot: type=0 subtype=10
I (210) boot:  3 ota_0            OTA app          00 10 00010000 00180000
D (218) boot: load partition table entry 0x3c008080
D (223) boot: type=0 subtype=11
I (226) boot:  4 ota_1            OTA app          00 11 00190000 00180000
D (233) boot: load partition table entry 0x3c0080a0
D (238) boot: type=1 subtype=2
I (242) boot:  5 nvs              WiFi data        01 02 00310000 00040000
I (249) boot: End of partition table
D (253) boot: OTA data offset 0xd000
D (257) bootloader_flash: rodata starts from paddr=0x0000d000, size=0x2000, will be mapped to vaddr=0x3c000000
V (267) bootloader_flash: after mapping, starting from paddr=0x00000000 and vaddr=0x3c000000, 0x10000 bytes are mapped
D (278) boot: otadata[0]: sequence values 0x00000001
D (283) boot: otadata[1]: sequence values 0xffffffff
D (288) boot_comm: Only otadata[0] is valid
D (292) boot: Active otadata[0]
D (295) boot: Mapping seq 0 -> OTA slot 0
D (299) boot: Trying partition index 0 offs 0x10000 size 0x180000
D (306) esp_image: reading image header @ 0x10000
D (310) bootloader_flash: mmu set block paddr=0x00010000 (was 0xffffffff)
D (317) esp_image: image header: 0xe9 0x05 0x02 0x02 4038054a
V (323) esp_image: loading segment header 0 at offset 0x10018
V (329) esp_image: segment data length 0x3b300 data starts 0x10020
V (335) esp_image: segment 0 map_segment 1 segment_data_offs 0x10020 load_addr 0x3c0b0020
I (343) esp_image: segment 0: paddr=00010020 vaddr=3c0b0020 size=3b300h (242432) map
D (352) esp_image: free data page_count 0x00000080
D (357) bootloader_flash: rodata starts from paddr=0x00010020, size=0x3b300, will be mapped to vaddr=0x3c000000
V (367) bootloader_flash: after mapping, starting from paddr=0x00010000 and vaddr=0x3c000000, 0x40000 bytes are mapped
V (412) esp_image: loading segment header 1 at offset 0x4b320
D (412) bootloader_flash: mmu set block paddr=0x00040000 (was 0xffffffff)
V (413) esp_image: segment data length 0x2af0 data starts 0x4b328
V (419) esp_image: segment 1 map_segment 0 segment_data_offs 0x4b328 load_addr 0x3fc92200
I (428) esp_image: segment 1: paddr=0004b328 vaddr=3fc92200 size=02af0h ( 10992) load
D (436) esp_image: free data page_count 0x00000080
D (441) bootloader_flash: rodata starts from paddr=0x0004b328, size=0x2af0, will be mapped to vaddr=0x3c000000
V (451) bootloader_flash: after mapping, starting from paddr=0x00040000 and vaddr=0x3c000000, 0x10000 bytes are mapped
V (464) esp_image: loading segment header 2 at offset 0x4de18
D (468) bootloader_flash: mmu set block paddr=0x00040000 (was 0xffffffff)
V (474) esp_image: segment data length 0x21f8 data starts 0x4de20
V (481) esp_image: segment 2 map_segment 0 segment_data_offs 0x4de20 load_addr 0x40380000
I (489) esp_image: segment 2: paddr=0004de20 vaddr=40380000 size=021f8h (  8696) load
D (497) esp_image: free data page_count 0x00000080
D (502) bootloader_flash: rodata starts from paddr=0x0004de20, size=0x21f8, will be mapped to vaddr=0x3c000000
V (512) bootloader_flash: after mapping, starting from paddr=0x00040000 and vaddr=0x3c000000, 0x20000 bytes are mapped
V (525) esp_image: loading segment header 3 at offset 0x50018
D (529) bootloader_flash: mmu set block paddr=0x00050000 (was 0xffffffff)
V (536) esp_image: segment data length 0xaf79c data starts 0x50020
V (542) esp_image: segment 3 map_segment 1 segment_data_offs 0x50020 load_addr 0x42000020
I (550) esp_image: segment 3: paddr=00050020 vaddr=42000020 size=af79ch (718748) map
D (559) esp_image: free data page_count 0x00000080
D (564) bootloader_flash: rodata starts from paddr=0x00050020, size=0xaf79c, will be mapped to vaddr=0x3c000000
V (574) bootloader_flash: after mapping, starting from paddr=0x00050000 and vaddr=0x3c000000, 0xb0000 bytes are mapped
V (685) esp_image: loading segment header 4 at offset 0xff7bc
D (686) bootloader_flash: mmu set block paddr=0x000f0000 (was 0xffffffff)
V (687) esp_image: segment data length 0xff00 data starts 0xff7c4
V (693) esp_image: segment 4 map_segment 0 segment_data_offs 0xff7c4 load_addr 0x403821f8
I (701) esp_image: segment 4: paddr=000ff7c4 vaddr=403821f8 size=0ff00h ( 65280) load
D (710) esp_image: free data page_count 0x00000080
D (715) bootloader_flash: rodata starts from paddr=0x000ff7c4, size=0xff00, will be mapped to vaddr=0x3c000000
V (725) bootloader_flash: after mapping, starting from paddr=0x000f0000 and vaddr=0x3c000000, 0x20000 bytes are mapped
V (747) esp_image: image start 0x00010000 end of last section 0x0010f6c4
D (747) bootloader_flash: mmu set block paddr=0x00100000 (was 0xffffffff)
D (749) boot: Calculated hash: 40bda191c549190fe5903884076fdfe8897b5ef4ec876d026d2ce6b52369a9ba
I (763) boot: Loaded app from partition at offset 0x10000
I (764) boot: Disabling RNG early entropy source...
D (770) boot: Mapping segment 0 as DROM
D (773) boot: Mapping segment 3 as IROM
D (777) boot: calling set_cache_and_start_app
D (782) boot: configure drom and irom and start
V (786) boot: rodata starts from paddr=0x00010020, vaddr=0x3c0b0020, size=0x3b300
V (794) boot: after mapping rodata, starting from paddr=0x00010000 and vaddr=0x3c0b0000, 0x40000 bytes are mapped
V (804) boot: text starts from paddr=0x00050020, vaddr=0x42000020, size=0xaf79c
V (812) boot: after mapping text, starting from paddr=0x00050000 and vaddr=0x42000000, 0xb0000 bytes are mapped
D (822) boot: start: 0x4038054a
I (825) cpu_start: Unicore app
Guru Meditation Error: Core  0 panic'ed (Load access fault). Exception was unhandled.

Core  0 register dump:
MEPC    : 0x4004c48c  RA      : 0x4004c4b0  SP      : 0x3fcde280  GP      : 0x3fc92a00  
TP      : 0x00000000  T0      : 0x00000000  T1      : 0x00000000  T2      : 0x00000009  
S0/FP   : 0x000000ff  S1      : 0x0000000c  A0      : 0x000000ff  A1      : 0x3fcde2b0  
A2      : 0x0012ad40  A3      : 0x03ff0000  A4      : 0x0000e000  A5      : 0x60ffe01c  
A6      : 0xfa000000  A7      : 0x00000003  S2      : 0x3c0eb31f  S3      : 0x00050000  
S4      : 0x4038054a  S5      : 0x00050020  S6      : 0x42000000  S7      : 0x3c0b0000  
S8      : 0x00010000  S9      : 0x3fcd6000  S10     : 0x3fcd6000  S11     : 0x3fcd6000  
T3      : 0x00710000  T4      : 0x000f0000  T5      : 0x00800000  T6      : 0x00800000  
MSTATUS : 0x00001881  MTVEC   : 0x40380001  MCAUSE  : 0x00000005  MTVAL   : 0x60ffe01c  
MHARTID : 0x00000000  

Stack memory:
3fcde280: 0x3c0eb31f 0x0000000c 0x00000050 0x42000e0e 0x0000001b 0x00000001 0x00000000 0x60008000
3fcde2a0: 0x00000001 0x000001e0 0x00000006 0x00000050 0x00000001 0x000001e0 0x00000003 0x000000a0
3fcde2c0: 0x3c0eb31f 0x0000000c 0x00000000 0x4038067e 0x00000000 0x80b67f00 0x000ff6d0 0x3fcde2f4
3fcde2e0: 0x00000000 0x3fcd6000 0x00000000 0x403cfa5e 0x00000000 0x00000336 0x3fcd58bc 0x00050000
3fcde300: 0x3c0eb31f 0x420af7bb 0x3fcd6000 0x403cfa64 0x91a1bd40 0x0f1949c5 0x0003b300 0x000af79c
3fcde320: 0xf45e7b89 0x026d87ec 0xb5e62c6d 0x000b0000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde340: 0x00000000 0x00000000 0x00000000 0x3fcdf000 0x000067a8 0x3fcd6000 0x3fcd6000 0xffffffff
3fcde360: 0x00000000 0x3fcde4b0 0x00000000 0x403d0034 0x3fcd7000 0x0000d000 0x00010000 0x00180000
3fcde380: 0x00010000 0x2f0205e9 0x4038054a 0x000000ee 0x03030005 0x0000c700 0x01000000 0x3c0b0020
3fcde3a0: 0x0003b300 0x3fc92200 0x00002af0 0x40380000 0x000021f8 0x42000020 0x000af79c 0x403821f8
3fcde3c0: 0x0000ff00 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde3e0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde400: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00010020
3fcde420: 0x0004b328 0x0004de20 0x00050020 0x000ff7c4 0x00000000 0x00000000 0x00000000 0x00000000
3fcde440: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x000ff6f0
3fcde460: 0x91a1bd40 0x0f1949c5 0x843890e5 0xe8df6f07 0xf45e7b89 0x026d87ec 0xb5e62c6d 0xbaa96923
3fcde480: 0x000067a8 0x3ff1c14c 0x0000ffff 0x3fce0000 0x00000000 0x00000036 0x000067b0 0x403cc79c
3fcde4a0: 0x10145677 0x78000ca0 0x00000000 0x00000000 0x0000d000 0x00002000 0x00000000 0x00000000
3fcde4c0: 0x00000000 0x00000000 0x00010000 0x00180000 0x00190000 0x00180000 0x00000000 0x00000000
3fcde4e0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde500: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde520: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde540: 0x00000000 0x00000000 0x00000002 0x00000000 0x600c5200 0x600c5200 0xdbb80087 0x4004a296
3fcde560: 0x00000000 0x00000000 0x3fcde668 0x00000000 0xffffffff 0x00000000 0x00010000 0x2f0203e9
3fcde580: 0x403cc71a 0x403ce710 0x0000354c 0x000000ee 0x03030005 0x0000c700 0x01000000 0x3c0067b0
3fcde5a0: 0x7533885e 0xe608c91c 0x1d5ebe25 0xfcb99d89 0x50412066 0x081ea972 0xbd990896 0xf99cb28f
3fcde5c0: 0xf9e235c5 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
3fcde5e0: 0x00000000 0x3fcde700 0x00000101 0x00000002 0xe608c91c 0x1d5ebe25 0xfcb99d89 0x50412066
3fcde600: 0x081ea972 0xbd990896 0xf99cb28f 0xf9e235c5 0x00000000 0x00000000 0x00000000 0x00000000
3fcde620: 0x00000000 0x00000000 0x00000000 0x00000000 0x600087b7 0x669d5bb8 0x9b5d0532 0x5bb8dbb8
3fcde640: 0x76e58d75 0x8f7516fd 0xdba88d59 0x67135bb8 0xdbb80087 0x00008082 0x00000000 0x36000000
3fcde660: 0x00000080 0x00000000 0x00000000 0x803d0300 0x00000000 0x00000000 0x00000000 0x00000000



ELF file SHA256: 

Rebooting...

More Information.

This is fatal for v5.2. This commit should not be tagged with a broken bootloader. Please delete the tag so no one else runs in to this.

What commit (I want the exact hash) on 5.2 actually works?

About this issue

Original URL
State: closed
Created 4 months ago
Comments: 18 (6 by maintainers)

Commits related to this issue

fix(usb_serial_jtag): Fix issue that boot failed on esp32c3, Closes https://github.com/espressif/esp-idf/issues/13197 — committed to espressif/esp-idf by mythbuster5 4 months ago

Most upvoted comments

FYI: esp32c3 issue is present too with CONFIG_ESP_CONSOLE_NONE=y.

RavenSystem on Feb 28, 2024

We’ve also confirmed that there is indeed an issue with using CONFIG_ESP_CONSOLE_USB_SERIAL_JTAG=y on v5.2 and are working on fixing it.

Thanks for the feedback here which helped us find the issue and sorry for all inconvenience this has caused you guys when trying to upgrade to v5.2!

ESP-Marius on Feb 23, 2024

Issue was fixed on master with 6768805d20cbd026b7fccf9d7adb49991d6b66a2, but unfortunately that introduced a regression with usb_otg console. My colleague is working on fixing that, and as soon as it is working properly we will merge both fixes to v5.2.

ESP-Marius on Feb 28, 2024

FWIW, y’all really do an amazing job of support here. No other chip vendor even bothers to try.

I’ll try and dig a bit more on 5.2 next week - I need to circle back to my MQTT stuff for now. I did get the mDNS sorted so that’s something.

readmodifywrite on Feb 16, 2024

Everything is built on 5.2. It never gets to the app binary.

The I (825) cpu_start: Unicore app line indicates that it does get to the app binary, although it crashes soon after, before it gets to your app_main function. (If it crashed in the bootloader, the panic output would also look differently.)

If you manage to share the sdkconfig file and provide the decoded backtrace in the future, it would be very helpful for diagnosing this issue.

igrr on Feb 16, 2024

Sorry for the bad experience with the version upgrade @readmodifywrite! There haven’t been many changes since v5.2-beta1 release, and so far we didn’t get feedback that it’s absolutely broken, so we went ahead with the final release. In our internal CI, all IDF examples we test on real hardware also worked fine. However sometimes there are cases which are not covered by our CI, usually related to a particular combination of sdkconfig settings. Hopefully we can figure out what is causing the issue in your case quickly.

According to the log, the crash happens during app startup (cpu_start line). Could you please clarify if you are

using IDF v5.2 bootloader with an IDF v5.1 app binary?
or building both the app and the bootloader with v5.2? If yes, please also attach you application’s sdkconfig file.

Additionally, could you please use idf.py monitor to get the decoded backtrace? This will help us identify the issue.

igrr on Feb 16, 2024