Issues updating the slave from HTTPS and query it's current firmware version (EHM-74)

[me-no-dev]

Checklist

• Checked the issue tracker for similar issues to ensure this is not a duplicate
• Read the documentation to confirm the issue is not addressed there and your configuration is set correctly
• Tested with the latest version to ensure the issue hasn't been fixed

How often does this bug occurs?

always

Expected behavior

• OTA should be able to update the slave firmware from HTTPS URL (and possibly from local file/byte array)
• esp_hosted_get_coprocessor_fwversion() should work after calling esp_hosted_init()
• esp_hosted_init() should return error if Slave was not found (wrong pins, missing, etc.)
• There should be a way to query the Host version and compare against the Slave version
• Possibly there should be a way to query the slave chip model

Actual behavior (suspected bug)

When attempting OTA over HTTPS the following logs are emitted and update fails:

E (8461) esp-tls-mbedtls: No server verification option set in esp_tls_cfg_t structure. Check esp_tls API reference
E (8461) esp-tls-mbedtls: Failed to set client configurations, returned [0x8017] (ESP_ERR_MBEDTLS_SSL_SETUP_FAILED)
E (8471) esp-tls: create_ssl_handle failed
E (8474) esp-tls: Failed to open new connection
E (8478) transport_base: Failed to open a new connection
E (8484) HTTP_CLIENT: Connection failed, sock < 0
E (8488) hosted_ota: Failed to open HTTP connection: ESP_ERR_HTTP_CONNECT
E (8494) hosted_ota: Check if URL is correct and connectable: https://github.com/.../network_adapter.bin

When calling esp_hosted_get_coprocessor_fwversion() right after esp_hosted_init() the following exception is raised:

E (3238) H_SDIO_DRV: tx fail: NULL buff, invalid len (20) or len > max len (1524), transport_up(0))
E (3238) serial: Failed to write data

E (3239) serial_if: Failed to write TX data

CORRUPT HEAP: Bad head at 0x4ff2997c. Expected 0xabba1234 got 0x4ff160d4

assert failed: multi_heap_free multi_heap_poisoning.c:279 (head != NULL)

When calling esp_hosted_init() on a Host that has no Slave or with wrong IO config, it will return ESP_OK, but following communication will cause exception:

sdio_mempool_create free:561412 min-free:561412 lfb-def:385012 lfb-8bit:385012

[   679][V][WiFiGeneric.cpp:324] wifiHostedInit(): ESP-HOSTED initialized!
E (2120) sdmmc_common: sdmmc_init_ocr: send_op_cond (1) returned 0x107
E (2120) sdio_wrapper: sdmmc_card_init failed
E (4690) H_SDIO_DRV: sdio card init failed

FreeRTOS: FreeRTOS Task "sdio_read" should not return, Aborting now!
Core  0 register dump:

There is no way to query the Host version or the Slave chip model at the moment

Error logs or terminal output

Steps to reproduce the behavior

1. Try OTA with HTTPS URL
2. Call esp_hosted_get_coprocessor_fwversion() right after esp_hosted_init()
3. Call esp_hosted_init() with wrong pins or no actual Slave and call any other hosted API after that

Project release version

2.0.13

System architecture

ARM 64-bit (Apple M1/M2, Raspberry Pi 4/5)

Operating system

MacOS

Operating system version

15.5

Shell

Bash

Additional context

No response

[mantriyogesh]

@SohKamYung-Espressif, once free, can you please pick it?

In addition, we need to add some api to get the host version.

in parallel to, esp_hosted_get_coprocessor_fwversion(), something like esp_hosted_get_host_fwversion()

[TD-er]

In addition, we need to add some api to get the host version.

in parallel to, esp_hosted_get_coprocessor_fwversion(), something like esp_hosted_get_host_fwversion()

And also the MCU type running as coprocessor, so you know which firmware to use for OTA.
There are now ESP32-P4 boards with a c5 on board for example.

[me-no-dev]

Possibly there should be a way to query the slave chip model

@TD-er already in the list

[SebastianOtt]

I have met this issue in a similar way. We are using an esp32 P4 with and esp32 C6 on a custom board with esp hosted.

First of all, trying to use the esp_hosted_slave_ota function will use a esp_http_client_handle_t client using a client configuration with HTTP, but not HTTPS. There is also no option to configure this client to use HTTPS. Thus, i had to modify esp-hosted functions to use a different client for HTTPS OTA update retrieval. A certificate is needed, if i am correct.

Current client configuration of hosted:

	/* Initialize HTTP client configuration */
	esp_http_client_config_t config = {
		.url = image_url,
		.timeout_ms = 5000,
		.event_handler = http_client_event_handler,
	};

        esp_http_client_handle_t client = esp_http_client_init(&config);

Adapted client configuration:

	/* Initialize HTTPS client configuration */
	esp_http_client_config_t config = {
		.url = image_url,
		.timeout_ms = 5000,
		.event_handler = http_client_event_handler,
		.transport_type = HTTP_TRANSPORT_OVER_SSL,
		.skip_cert_common_name_check = false,
		.cert_pem = cert_pem,
	};

	esp_http_client_handle_t client = esp_http_client_init(&config);

This worked in my case to retrieve a ESP32 C6 firmware per HTTPS from a server and should help regarding your first problem.
Nonetheless, chunked OTA failed AFTERWARDS in my case because of SDIO buffer problems if i am correct.

Here are some monitoring prints that indicate successful download, several OTA write responses and the occuring error:

I (23755) hosted_ota: Starting OTA attempt 1/3
I (23759) hosted_ota: http_open
W (23801) mbedtls: ssl_tls13_generic.c:1552 Perform PSA-based ECDH/FFDH computation.

W (24443) mbedtls: ssl_tls13_client.c:1950 Switch to handshake keys for inbound traffic

W (24571) mbedtls: ssl_tls13_generic.c:403 mbedtls_ssl_tls13_process_certificate_verify() returned 0 (-0x0000)

W (24579) mbedtls: ssl_tls13_client.c:2639 Switch to handshake traffic keys for outbound traffic

W (24582) mbedtls: ssl_tls13_generic.c:1235 Switch to application keys for inbound traffic

W (24587) mbedtls: ssl_tls13_generic.c:1238 Switch to application keys for outbound traffic

I (24595) hosted_ota: HTTP_EVENT_ON_CONNECTED
I (24600) hosted_ota: HTTP_EVENT_HEADER_SENT
I (24603) hosted_ota: http_fetch_headers
I (24983) hosted_ota: HTTP_EVENT_ON_HEADER, key=Server, value=nginx
I (24983) hosted_ota: HTTP_EVENT_ON_HEADER, key=Date, value=Mon, 14 Jul 2025 10:01:57 GMT
I (24985) hosted_ota: HTTP_EVENT_ON_HEADER, key=Content-Type, value=application/octet-stream
I (24994) hosted_ota: HTTP_EVENT_ON_HEADER, key=Content-Length, value=862992
I (25000) hosted_ota: HTTP_EVENT_ON_HEADER, key=Connection, value=keep-alive
I (25007) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-Powered-By, value=Express
I (25014) hosted_ota: HTTP_EVENT_ON_HEADER, key=Access-Control-Allow-Origin, value=*
I (25021) hosted_ota: HTTP_EVENT_ON_HEADER, key=Content-Disposition, value=attachment; filename="1.0.1-dev-all-C6-Code.bin"
I (25032) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-Checksum, value=ca62a1642f5159254eb04d03e4d20a6865e1c3570a40002c2000a1f90b4b4f6d
I (25044) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-Frame-Options, value=SAMEORIGIN
I (25051) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-Content-Type-Options, value=nosniff
I (25058) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-XSS-Protection, value=1; mode=block
I (25066) hosted_ota: HTTP_EVENT_ON_HEADER, key=X-Permitted-Cross-Domain-Policies, value=master-only
I (25075) hosted_ota: HTTP_EVENT_ON_HEADER, key=Referrer-Policy, value=same-origin
I (25082) hosted_ota: HTTP_EVENT_ON_HEADER, key=alt-svc, value=h3=":443"; ma=86400
I (25089) hosted_ota: HTTP GET Status = 200, content_length = 862992
W (25095) hosted_ota: ********* Started Slave OTA *******************
I (25102) hosted_ota: *** Please wait for 5 mins to let slave OTA complete ***
I (25108) hosted_ota: Preparing OTA
I (25112) rpc_wrap: Starting OTA
I (25399) rpc_wrap: OTA begin response: 0
I (25399) hosted_ota: Starting OTA transfer
I (25450) rpc_wrap: Writing OTA data
I (25488) rpc_wrap: OTA write response: 0
I (25938) rpc_wrap: Writing OTA data
I (25974) rpc_wrap: OTA write response: 0
....
< a lot of prints....>
...
I (89563) rpc_wrap: Writing OTA data
I (89599) rpc_wrap: OTA write response: 0
I (90049) rpc_wrap: Writing OTA data
I (90085) rpc_wrap: OTA write response: 0
I (90535) rpc_wrap: Writing OTA data
I (90571) rpc_wrap: OTA write response: 0
I (91026) rpc_wrap: Writing OTA data

assert failed: sdio_rx_get_buffer sdio_drv.c:674 (*buf)
Core  0 register dump:
MEPC    : 0x4ff00d36  RA      : 0x4ff0a220  SP      : 0x4ff28810  GP      : 0x4ff1d600  
TP      : 0x4ff289b0  T0      : 0x37363534  T1      : 0x7271706f  T2      : 0x33323130
S0/FP   : 0x00000090  S1      : 0x00000001  A0      : 0x4ff2884c  A1      : 0x4ff1f565  
A2      : 0x00000001  A3      : 0x00000029  A4      : 0x00000001  A5      : 0x4ff4c000  
A6      : 0x00000008  A7      : 0x76757473  S2      : 0x00000009  S3      : 0x4ff28957  
S4      : 0x4ff1f564  S5      : 0x00000000  S6      : 0x00000000  S7      : 0x00000000
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000  
T3      : 0x6e6d6c6b  T4      : 0x6a696867  T5      : 0x66656463  T6      : 0x62613938
MSTATUS : 0x00011880  MTVEC   : 0x4ff00003  MCAUSE  : 0x00000002  MTVAL   : 0x00000000  
MHARTID : 0x00000000

I was able to confirm, that the C6 receives the data chunks:

I (68081) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 103
I (68081) slave_ctrl: Received Req [0x111]
I (68568) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 104
I (68568) slave_ctrl: Received Req [0x111]
I (69054) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 105
I (69054) slave_ctrl: Received Req [0x111]
I (69540) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 106
I (69540) slave_ctrl: Received Req [0x111]
I (70526) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 107
I (70526) slave_ctrl: Received Req [0x111]
I (70914) stats: slave StaRxQLoad:        0 
H=>S: sta: in:      355 out:      355 fail:        0 
H<=S: sta: in:     1932 out:     1932
  serial : in:      107 rsp:      110  evt:        4
I (71012) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 108
I (71012) slave_ctrl: Received Req [0x111]
I (71498) slave_ctrl: Resp_MSGId for req[0x111] is [0x211], uid 109
I (71498) slave_ctrl: Received Req [0x111]
mem_dump free:54204 min-free:14924 lfb-dma:38912 lfb-def:38912 lfb-8bit:38912

I used the C6 firmware which is around 840Kb (network_adapter.bin) in size and i am curious if some else had this error trying to use OTA updates or if you will also meet it. The P4 crashes, the C6 does not.

[mantriyogesh]

Hello @SebastianOtt ,

Thanks for reporting your problem.

It looks that memory was exhaused for the mempool. If your code is open source, I would like to try and replicate, for understanding why the memory exhausted here

esp-hosted-mcu/host/drivers/transport/sdio/sdio_drv.c

Line 673 in 534c20f

*buf = (uint8_t *)MEM_ALLOC(len);

Please share your sdkconfig used.

If it is feasible and possible, Please share minimal code snippet along with sdkconfig pushed, to reproduce this issue reliably to fasten the things.

[TD-er]

I used the C6 firmware which is around 840Kb (network_adapter.bin) in size and i am curious if some else had this error trying to use OTA updates or if you will also meet it. The P4 crashes, the C6 does not.

Maybe also important to know what the version was that was running on the C6.
I've had a discussion with @me-no-dev about this and he also tried to query the firmware version on a 0.0.6 build of the C6 firmware.
Back then this function was not yet implemented and he noticed crashes (of the P4) also.
I already had updated my C6 to a self built 2.0.13 (N.B. there have been commits since and it is still version 2.0.13 ????)
A friend of mine tried my test build too on his node with 0.0.6 and got random data returned.
After initializing the struct before calling he got '0.0.0' :

        esp_hosted_coprocessor_fwver_t ver_info{};
        esp_hosted_get_coprocessor_fwversion(&ver_info);

As said, he got no crashes, but I was thinking maybe it is literally random as it might be related to uninitialized data being fed to (not yet supported) esp_hosted_xxx calls and then interpreted by the P4?

[SebastianOtt]

Thank you for your fast replies. I have created two truncated projects regarding this issue.

First of all @TD-er:
I was able to retrieve the C6 version using this code:

        // get the current firmware version
        esp_hosted_coprocessor_fwver_t ver_info{};
        esp_hosted_get_coprocessor_fwversion(&ver_info);
        ESP_LOGI(TAG, "Current C6 firmware version: %u.%u.%u", 
                 ver_info.major1, ver_info.minor1, ver_info.patch1);

which results in the output:
I (23805) FW_UPDATE: Current C6 firmware version: 2.0.1

I could not reproduce an error or crash regarding this query. Maybe it really depends on the version.
Also, i am using ESP-IDF 6.0.0 (master branch, maybe 2 months behind). Seems like my C6 firmware is a bit older.

@mantriyogesh:
I have created two truncated and public repos based on our project. Normally we are using MQTT, Websockets, an HTTP server while using esp_hosted. In this case, the repos focused on the OTA update, so i removed everything else except MQTT for testing (but i cannot share firmware links, mqtt channels, passwords etc with you). Thus, we can focus on the esp_hosted_ota.c files and the _hosted_ota function. In both cases, HTTPS is used to retrieve firmware.

I think in the future, a possibility is needed to choose between OTA updates per HTTP or HTTPS client, maybe by allowing a client configuration or whatever alternatives you can imagine.

esp_hosted_ota.c:

• "almsot original"
• custom

The "original" OTA update implementation works in some cases:

I (293693) rpc_wrap: Ending OTA
I (293935) rpc_wrap: OTA end response: 0
I (293935) hosted_ota: HTTP_EVENT_DISCONNECTED
W (293936) hosted_ota: ********* Slave OTA Complete *******************
I (293938) hosted_ota: OTA Successful, Slave will restart in while
E (293944) hosted_ota: Need to restart host after slave OTA is complete, to avoid sync issues
E (298952) hosted_ota: ********* Restarting Host **********************
E (298952) sdmmc_io: sdmmc_io_rw_extended: sdmmc_send_cmd returned 0x107
E (298953) H_SDIO_DRV: sdio_write_task: 0: Failed to send data: 263 30 30
E (298960) sdmmc_io: sdmmc_io_rw_extended: sdmmc_send_cmd returned 0x107
E (298966) H_SDIO_DRV: sdio_write_task: 1: Failed to send data: 263 30 30
E (298973) H_SDIO_DRV: Unrecoverable host sdio state, reset host mcu
I (298979) os_wrapper_esp: Restarting host

But not in every case:

I (28604) rpc_wrap: Writing OTA data
I (28653) rpc_wrap: OTA write response: 0
I (28655) rpc_wrap: Writing OTA data
I (28706) rpc_wrap: OTA write response: 0
I (28706) rpc_wrap: Writing OTA data
E (28759) H_SDIO_DRV: task still writing Rx data to queue!
W (44012) rpc_core: Timeout waiting for Resp for Req[0x111]
E (44012) rpc_core: Response not received for [0x111]
Guru Meditation Error: Core  0 panic'ed (Load access fault). Exception was unhandled.

Core  0 register dump:
MEPC    : 0x400158c2  RA      : 0x400158c0  SP      : 0x4ff610f0  GP      : 0x4ff1ad00
--- 0x400158c2: rpc_ota_write at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/drivers/rpc/wrap/rpc_wrap.c:587 (discriminator 1)
--- 0x400158c0: rpc_ota_write at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/drivers/rpc/wrap/rpc_wrap.c:587 (discriminator 10)

TP      : 0x4ff62ca0  T0      : 0x4fc0a9f8  T1      : 0x40000000  T2      : 0x842e84aa
S0/FP   : 0x00000000  S1      : 0x400ec000  A0      : 0x0000abec  A1      : 0x00000010
A2      : 0x4ff40038  A3      : 0x0000abec  A4      : 0x00000000  A5      : 0x00000699
A6      : 0x00000001  A7      : 0x0000000a  S2      : 0x00000578  S3      : 0x4ff71110
S4      : 0x00000003  S5      : 0x00000000  S6      : 0x00000000  S7      : 0x00000000
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000
T3      : 0x00000000  T4      : 0x95be00f0  T5      : 0x37b30034  T6      : 0x77938189
MSTATUS : 0x00011880  MTVEC   : 0x4ff00003  MCAUSE  : 0x00000005  MTVAL   : 0x00000008
--- 0x4ff00003: _vector_table at ??:?

MHARTID : 0x00000000

Stack memory:
4ff610f0: 0x400eb944 0x00000000 0x00000000 0x4ff71110 0x4ff2d01c 0x00000000 0x00000578 0x40019da0
--- 0x40019da0: _hosted_ota at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/port/esp/freertos/src/esp_hosted_ota.c:186

4ff61110: 0x00000000 0x4ff611f0 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff61130: 0x00000000 0x400f3ed4 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff61150: 0x00000000 0x00000000 0x00000000 0x00000000 0x00001388 0x00000000 0x00000000 0x00000000
4ff61170: 0x40019812 0x00000002 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
--- 0x40019812: http_client_event_handler at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/port/esp/freertos/src/esp_hosted_ota.c:65

4ff61190: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff611b0: 0x400097c4 0x0000000a 0x00000000 0x00000000 0x4ff611f0 0x400cea00 0x00000002 0x40019f78
--- 0x400097c4: uart_write at C:/Users/info/esp/master/esp-idf/components/esp_driver_uart/src/uart_vfs.c:227
--- 0x40019f78: esp_hosted_slave_ota_chunked at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/port/esp/freertos/src/esp_hosted_ota.c:234

4ff611d0: 0x4ff615f0 0x400cea00 0x4ff61734 0x40019fc8 0x400ce8b0 0x4ff611f0 0x400097c4 0x4001fc70
--- 0x40019fc8: esp_hosted_slave_ota at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/components/CustomEspHosted/host/port/esp/freertos/src/esp_hosted_ota.c:284
--- 0x400097c4: uart_write at C:/Users/info/esp/master/esp-idf/components/esp_driver_uart/src/uart_vfs.c:227
--- 0x4001fc70: download_and_install_binary(char const*, binary_info_t*) at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/main/firmware_update.cpp:225

4ff611f0: 0x70747468 0x2f2f3a73 0x6c2e7766 0x72657361 0x6b636174 0x6d6f632e 0x6970612f 0x776f642f
4ff61210: 0x616f6c6e 0x61372f64 0x64383439 0x412f6161 0x2f444342 0x432d3643 0x0065646f 0x4ff21770
4ff61230: 0x4ff5bb04 0x00000000 0x00000001 0x400a40e6 0x00000001 0x4ff215d8 0x4ff5e090 0x400cec64
--- 0x400a40e6: _vfprintf_r at /builds/idf/crosstool-NG/.build/riscv32-esp-elf/src/newlib/newlib/libc/stdio/vfprintf.c:1781

4ff61250: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000001 0x00000032 0x00000007
4ff61270: 0x00000000 0x400df9b8 0x00000000 0x00000000 0x4ff5bb04 0x00000000 0x4ff6ae04 0x4ff0dd42
--- 0x4ff0dd42: multi_heap_internal_unlock at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:177

4ff61290: 0x4ff5bb04 0x4ff5bc98 0x4ff40000 0x4ff0dcf0 0x4ff5bb04 0x00000000 0x4ff6ae04 0x4ff0dd42
--- 0x4ff0dcf0: multi_heap_free_impl at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:242
--- 0x4ff0dd42: multi_heap_internal_unlock at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:177

4ff612b0: 0x4ff5bb04 0x00000000 0x4ff6ae04 0x4ff0dd42 0x4ff307f0 0x00000000 0x4ff6ae04 0x4ff0dd42
--- 0x4ff0dd42: multi_heap_internal_unlock at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:177
--- 0x4ff0dd42: multi_heap_internal_unlock at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:177

4ff612d0: 0x4ff5bb04 0x00000000 0x4ff6ae04 0x4ff0dd42 0x4ff5bb04 0x4ff5bb04 0x4ff40000 0x4ff0dcf0
--- 0x4ff0dd42: multi_heap_internal_unlock at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:177
--- 0x4ff0dcf0: multi_heap_free_impl at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:242

4ff612f0: 0x00000000 0x4ff61700 0x00000000 0x4ff01052 0x4ff5bb04 0x4ff37644 0x4ff5bb04 0x4ff1825a
--- 0x4ff01052: heap_caps_free at C:/Users/info/esp/master/esp-idf/components/heap/heap_caps_base.c:89
--- 0x4ff1825a: free at C:/Users/info/esp/master/esp-idf/components/newlib/src/heap.c:35

4ff61310: 0x4ff5bb04 0x4ff61700 0x4ff5bb04 0x4ff616fc 0x400ce8b0 0x4ff61700 0x00f54504 0x4001f894
--- 0x4001f894: check_for_firmware_update(firmware_update_t*, update_buffer_t*) at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/main/firmware_update.cpp:191

4ff61330: 0x00000004 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff61350: 0x4ff6135c 0x00000000 0x00000000 0x400cec64 0x00000001 0x400cea00 0x00000007 0x00000000
4ff61370: 0x00000000 0x00000000 0x00000000 0x00000000 0x00002710 0x00000000 0x00000000 0x00000000
4ff61390: 0x4001f65e 0x00000002 0x00000000 0x00000000 0x4ff61c5c 0x00000000 0x00000000 0x00000000
--- 0x4001f65e: _http_event_handler(esp_http_client_event*) at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-example/main/firmware_update.cpp:29

4ff613b0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff613d0: 0x70747468 0x2f2f3a73 0x6c2e7766 0x72657361 0x6b636174 0x6d6f632e 0x6970612f 0x6568632f
4ff613f0: 0x70747468 0x2f2f3a73 0x6c2e7766 0x72657361 0x6b636174 0x6d6f632e 0x6970612f 0x776f642f
4ff61410: 0x616f6c6e 0x61372f64 0x64383439 0x412f6161 0x2f444342 0x432d3643 0x0065646f 0xa5a5a5a5
4ff61430: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff61450: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff61470: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0x00005f9e 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff61490: 0x400ce8b0 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0x00000001 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff614b0: 0x400cea00 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff614d0: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5

Using the "custom" esp_host_ota, or basically a delay between written chunks, i had no errors/crashes.
But this was in a truncated scenario. I think that the OTA update still fails inside our actual project because of other networking tasks for MQTT, websockets etc. while also using "custom" OTA implementation with delay between chunks. My guess is now, that stopping other networking tasks before the update could resolve the issue i have with SDIO traffic/buffers.

Additionally:

• There is a sdk config option for the C6 regarding an "OTA workaround" (ESP_OTA_WORKAROUND) option, which adds delay between write operation. While I did not notice a difference checking/unchecking this option, i think this could be moved to the P4 config to resolve crashing of the P4?

[me-no-dev]

I could not reproduce an error or crash regarding this query.

did you try right after esp_hosted_init as I have reported?

[SebastianOtt]

I could not reproduce an error or crash regarding this query.

did you try right after esp_hosted_init as I have reported?

No, i tried it far later, while already having an IP assigned. Sorry, i was more focused on the HTTPS and OTA topic. But i can test it tomorrow after esp_hosted_init if that helps.

[mantriyogesh]

@SohKamYung-Espressif

E (28759) H_SDIO_DRV: task still writing Rx data to queue!

Might need to look into double buffering..

[mantriyogesh]

There is a sdk config option for the C6 regarding an "OTA workaround" (ESP_OTA_WORKAROUND) option, which adds delay between write operation. While I did not notice a difference checking/unchecking this option, i think this could be moved to the P4 config to resolve crashing of the P4?

This was legacy code, most likely we will remove this in clean-up

[SohKamYung-Espressif]

@SebastianOtt

My guess is now, that stopping other networking tasks before the update could resolve the issue i have with SDIO traffic/buffers.

In general, stopping networking tasks is recommended before doing the OTA update, since the slave is busy updating its code and will reboot at the end, breaking the network link.

Will take a look to see why this is happening.

E (28759) H_SDIO_DRV: task still writing Rx data to queue!

[SebastianOtt]

@me-no-dev Here is the output i received, querying the firmware version right after esp_hosted_init(). Here, esp_hosted_get_coprocessor_fwversion() is basically the first line of code in app_main(), since esp_hosted_init() is automatically called before app_main().

OUTPUT

 I (1563) host_init: ESP Hosted : Host chip_ip[18]
I (1568) H_API: ESP-Hosted starting. Hosted_Tasks: prio:23, stack: 5120 RPC_task_stack: 5120
sdio_mempool_create free:33744632 min-free:33744632 lfb-def:33030144 lfb-8bit:33030144

I (1584) H_API: ** add_esp_wifi_remote_channels **
I (1588) transport: Add ESP-Hosted channel IF[1]: S[0] Tx[0x4000b928] Rx[0x4001abd2]
--- Error: ClearCommError failed (PermissionError(13, 'Zugriff verweigert', None, 5))
--- Waiting for the device to reconnect--- 0x4000b928: transport_drv_sta_tx at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/drivers/transport/transport_drv.c:216
--- 0x4001abd2: esp_wifi_remote_channel_rx at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomWifiRemote/esp_wifi_remote_net.c:19

I (1596) transport: Add ESP-Hosted channel IF[2]: S[0] Tx[0x4000b870] Rx[0x4001abd2]
--- 0x4000b870: transport_drv_ap_tx at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/drivers/transport/transport_drv.c:246
--- 0x4001abd2: esp_wifi_remote_channel_rx at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomWifiRemote/esp_wifi_remote_net.c:19

I (1604) main_task: Started on CPU0
I (1606) esp_psram: Reserving pool of 75K of internal memory for DMA/internal allocations
I (1614) main_task: Calling app_main()
E (1618) H_SDIO_DRV: tx fail: NULL buff, invalid len (20) or len > max len (1524), transport_up(0))
E (1627) serial: Failed to write data

E (1630) serial_if: Failed to write TX data


assert failed: tlsf_free tlsf.c:630 (!block_is_free(block) && "block already marked as free")
Core  0 register dump:
MEPC    : 0x4ff00d22  RA      : 0x4ff072a8  SP      : 0x4ff1e940  GP      : 0x4ff10b80
--- 0x4ff00d22: panic_abort at C:/Users/info/esp/master/esp-idf/components/esp_system/panic.c:483
--- 0x4ff072a8: __ubsan_include at C:/Users/info/esp/master/esp-idf/components/esp_system/ubsan.c:311

TP      : 0x4ff1eb80  T0      : 0x37363534  T1      : 0x7271706f  T2      : 0x33323130
S0/FP   : 0x0000006a  S1      : 0x00000001  A0      : 0x4ff1e97c  A1      : 0x4ff1220d
A2      : 0x00000001  A3      : 0x00000029  A4      : 0x00000001  A5      : 0x4ff14000
A6      : 0x0000000c  A7      : 0x76757473  S2      : 0x00000009  S3      : 0x4ff1eaad
S4      : 0x4ff1220c  S5      : 0x00000000  S6      : 0x00000000  S7      : 0x00000000
S8      : 0x00000000  S9      : 0x00000000  S10     : 0x00000000  S11     : 0x00000000
T3      : 0x6e6d6c6b  T4      : 0x6a696867  T5      : 0x66656463  T6      : 0x62613938  
MSTATUS : 0x00011880  MTVEC   : 0x4ff00003  MCAUSE  : 0x00000002  MTVAL   : 0x00000000
--- 0x4ff00003: _vector_table at ??:?

MHARTID : 0x00000000

Stack memory:
4ff1e940: 0xa5a5a5a5 0xa5a5a5a5 0x40052390 0x4ff0e80c 0x4ff11934 0x40052390 0x4ff11918 0x40040f9b
--- 0x4ff0e80c: esp_libc_include_assert_impl at C:/Users/info/esp/master/esp-idf/components/newlib/src/assert.c:96

4ff1e960: 0x4ff11944 0x4ff1e974 0x4ff11948 0x40041534 0x4ff1220c 0x00303336 0xa5a5a5a5 0x65737361
4ff1e980: 0x66207472 0x656c6961 0x74203a64 0x5f66736c 0x65657266 0x736c7420 0x3a632e66 0x20303336
4ff1e9a0: 0x6c622128 0x5f6b636f 0x665f7369 0x28656572 0x636f6c62 0x2620296b 0x62222026 0x6b636f6c
4ff1e9c0: 0x726c6120 0x79646165 0x72616d20 0x2064656b 0x66207361 0x22656572 0x4ff10029 0x4ff0733a
.--- 0x4ff10029: spi_flash_chip_winbond_erase_block at C:/Users/info/esp/master/esp-idf/components/spi_flash/spi_flash_chip_winbond.c:142 (discriminator 1)
--- 0x4ff0733a: prvCopyDataToQueue at C:/Users/info/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/queue.c:2470

4ff1e9e0: 0x00000000 0x00000000 0x4ff148ac 0x4ff0733a 0x00000000 0x00000000 0x4ff148ac 0x4ff0795c
--- 0x4ff0733a: prvCopyDataToQueue at C:/Users/info/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/queue.c:2470
--- 0x4ff0795c: xQueueGenericSend at C:/Users/info/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/queue.c:1057

4ff1ea00: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000003 0x00000000 0x0000000a
4ff1ea20: 0x4ff3b4d0 0x4ff1eaac 0x40053d54 0x00000000 0x4ff3b4d0 0x4ff1eabc 0x40053e90 0x4ff0e594
--- 0x4ff0e594: esp_log_impl_unlock at C:/Users/info/esp/master/esp-idf/components/log/src/os/log_lock.c:51

4ff1ea40: 0x4ff3b4d0 0x00000000 0x00000000 0x40000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ea60: 0x4ff3b4d8 0x4ff3afd4 0x4ff3b4e0 0x4ff0cc26 0x00000000 0x00000000 0x00000000 0x00000000
--- 0x4ff0cc26: block_next at C:/Users/info/esp/master/esp-idf/components/heap/tlsf/tlsf_block_functions.h:161 (discriminator 1)
---  (inlined by) block_link_next at C:/Users/info/esp/master/esp-idf/components/heap/tlsf/tlsf_block_functions.h:168 (discriminator 1)
---  (inlined by) block_mark_as_free at C:/Users/info/esp/master/esp-idf/components/heap/tlsf/tlsf_block_functions.h:176 (discriminator 1)
---  (inlined by) tlsf_free at C:/Users/info/esp/master/esp-idf/components/heap/tlsf/tlsf.c:631 (discriminator 1)

4ff1ea80: 0x4ff3b4d0 0x4ff3b4e0 0x4ff3afc0 0x4ff0c85a 0x00000000 0x00000008 0x4ff3b4e0 0x4ff00fe8
--- 0x4ff0c85a: multi_heap_free_impl at C:/Users/info/esp/master/esp-idf/components/heap/multi_heap.c:241
--- 0x4ff00fe8: heap_caps_free at C:/Users/info/esp/master/esp-idf/components/heap/heap_caps_base.c:89

4ff1eaa0: 0x4ff3b4d0 0x00000008 0x4ff3b4e0 0x4ff0e8c8 0x40053d54 0x00000644 0x00000001 0x40019306
--- 0x40019306: hosted_free at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/port/esp/freertos/src/os_wrapper.c:109

4ff1eac0: 0x40053e90 0x00000644 0x4000908a 0x400141b6 0x00000008 0x4ff3b314 0x4ff3b4d0 0x00000000
.--- 0x4000908a: uart_write at C:/Users/info/esp/master/esp-idf/components/esp_driver_uart/src/uart_vfs.c:227
--- 0x400141b6: transport_pserial_send at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/drivers/virtual_serial_if/serial_if.c:212

4ff1eae0: 0x00000008 0x4ff3b314 0x4ff3b4d0 0x4000d9a0 0x4ff1eb80 0x00000000 0x00000000 0x00000000
--- 0x4000d9a0: process_rpc_tx_msg at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/drivers/rpc/core/rpc_core.c:220

4ff1eb00: 0x40054f68 0x00000000 0x00000000 0x00000000 0x0000015e 0x00000001 0x0000015e 0x4ff3b4c0
4ff1eb20: 0x00000000 0x00000000 0x00000000 0x4000dd8e 0x00000000 0x00000000 0x00000000 0x4ff3b314
--- 0x4000dd8e: rpc_tx_thread at C:/Users/info/Desktop/ESP32-P4-Project/P4-C6-Hosted-minimized-custom-example/components/CustomEspHosted/host/drivers/rpc/core/rpc_core.c:526

4ff1eb40: 0x00000000 0x00000000 0x00000000 0x4ff082ae 0x00000000 0x00000000 0x00000000 0x00000000
--- 0x4ff082ae: vPortTaskWrapper at C:/Users/info/esp/master/esp-idf/components/freertos/FreeRTOS-Kernel/portable/riscv/port.c:258

4ff1eb60: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff1eb80: 0x00000000 0x4ff1d7b0 0x4ff1d7b0 0x00000000 0x00000000 0x00000000 0xa5a5a5a5 0xa5a5a5a5
4ff1eba0: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0x00000150 0x4ff1e480 0x00000000 0x4ff13088
4ff1ebc0: 0x4ff13088 0x4ff1ebb4 0x4ff13080 0x00000002 0x4ff1b66c 0x4ff1b66c 0x4ff1ebb4 0x00000000
4ff1ebe0: 0x00000017 0x4ff1d7b0 0x5f637072 0x00007874 0x00000000 0x00000000 0x4ff1eba0 0x00000017
4ff1ec00: 0x00000000 0x00000000 0x00000000 0x00000000 0x4ff14594 0x4ff145fc 0x4ff14664 0x00000000
4ff1ec20: 0x00000000 0x00000001 0x00000000 0x00000000 0x00000000 0x4fc0af14 0x00000000 0x00000000
4ff1ec40: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ec60: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ec80: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1eca0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ecc0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ece0: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
4ff1ed00: 0x00000000 0x00001000 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5
4ff1ed20: 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5 0xa5a5a5a5

Thus, i can confirm your issue. The only difference may be that i have heap assertions enabled, which is why i do not see this message:

CORRUPT HEAP: Bad head at 0x4ff2997c. Expected 0xabba1234 got 0x4ff160d4

assert failed: multi_heap_free multi_heap_poisoning.c:279 (head != NULL)

So, the P4 (Host) crashes after direct query of the C6 firmware version in app_main() and i can confirm your issue.