esp-emu 0.49.0

Added

• USB-Serial/JTAG console: firmware built with CONFIG_ESP_CONSOLE_USB_SERIAL_JTAG=y (USB-Serial/JTAG as the primary console, e.g. M5Stack ESP32-S3 boards) printed nothing after the ROM banner and looked hung. The emulator now follows the console the firmware selects, and IDF's default UART0 + USB-Serial/JTAG secondary configuration still prints once. --console <auto|uart0|usb-jtag> overrides the choice, for firmware that drives USB-Serial/JTAG outside the IDF console layer.
• Permission control on ESP32-C3: the SENSITIVE block's three PMS monitors, which predate APM, block a denied access on the instruction bus, the data bus and RTC_FAST and log it, as silicon does. ESP-IDF enables them by default, so C3 firmware now sees a denied read return 0, a denied write dropped and a denied fetch trap; its memprot app reads the log back.
• Permission control on ESP32-S3: the SENSITIVE block's PMS monitors block a denied access to SRAM, RTC FAST and RTC SLOW memory and log it, per core, as on C3. ESP-IDF enables them by default, so S3 firmware now sees a denied read return 0, a denied write dropped and a denied fetch trap, and its memprot app passes on both cores. Runs keep their speed: accesses the configuration cannot deny are not checked.
• The whole PIE instruction set on ESP32-P4 and S31: the 202 PIE and hardware-loop instructions that no supported kernel had needed are implemented — fused load/store arithmetic, unsigned and widening multiplies, complex multiply and multiply-accumulate, the remaining MAC, accumulator, permute and unaligned-access forms, esp.addx2/4, esp.subx2/4, esp.sat, and the esp.lp.setupi/counti/endi hardware-loop forms. All 361 instructions the two chips implement now run; firmware that used one of them (esp-nn's PIE multiply uses esp.vzip.16) previously stopped with Illegal instruction.
• PIE checked against silicon: every PIE instruction was run on random state on ESP32-P4 and ESP32-S31 boards and under the emulator (the smoke app built with sdkconfig.pie_full; the scripts are in tools/internal/pie/silicon). The two chips agree bit for bit, and the emulator now matches them on all 3022 cases. The smoke app's new pie case runs 615 of them against the recorded silicon results on every CI run; on ESP32-S31 the smoke app now uses a 3 MB factory partition on a 4 MB flash.
• MAC16 on ESP32-S3: the 16-bit multiply-accumulate instructions GCC emits at -O3 (CoreMark's matrix test, DSP loops) now execute; firmware that used one previously stopped with Illegal instruction.
• ESP-Hosted co-processor reset between two emulators: in the two-process P4 ↔ C6 ESP-Hosted setup, the host's reset of the co-processor now reaches the C6 and reboots it, so ESP-Hosted recovery completes instead of leaving the co-processor in its torn-down state. --hosted-reset-gpio names the pin when it is not ESP-Hosted's default.

Changed

• Faster emulation on every chip: the interpreter does less work around each instruction, so firmware runs about 2.5× faster on ESP32-C3 (CoreMark: 77 s → 29 s), about 2× on ESP32-P4 and ESP32-C6, and about 1.8× on ESP32-S3 (57 s → 31 s). In the browser the same C3 CoreMark drops from 99 s to 49 s. Emulated time is unchanged; only the wall clock moves.
• Single-precision floating point on ESP32-P4 and S31 runs about 2× faster: float arithmetic takes a direct host path and gives the same results, including rounding modes and exception flags.

Fixed

• ESP-Hosted streams between two emulators dropped packets (GH #18): in the two-process P4 ↔ C6 ESP-Hosted setup, a TCP stream from the C6 to the P4 logged aggr rx: invalid sub-frame and lost data, a burst from the P4 to the C6 stalled for good with no SDIO write buffers on slave device, and a packet-mode host (ESP-Hosted 2.x) read two packets as one. The C6's SDIO slave now streams and paces data as the silicon does, so both directions survive a flood.
• WebRTC and other ICE peers behind --net user: the NAT gave a guest UDP port a different public port per destination, so a peer's connectivity checks never reached the guest and ICE only succeeded by luck. One public port now serves every destination, as a home router does, and ICE connects.
• PIE arithmetic as silicon computes it: on ESP32-P4 and S31, multiplies, vector shifts and the FFT instructions now round per CFG.vxrm and saturate where silicon does, setting the saturation flag, instead of keeping the low bits as the TRM pseudo-code reads; esp.fft.cmul conjugates the second operand, not the first, and esp.fft.bitrev reverses over FFT_BIT_WIDTH bits. ESP-SR's audio front end and other FFT users now get the numbers the chip gives.
• PIE configuration and memory access: on ESP32-P4 and S31, firmware that reads or writes the PIE configuration register, moves the accumulator halves to and from general registers, or relies on unaligned PIE loads and stores now gets what the chip gives, and the fused store-and-compute instructions store the value the chip stores. Such code previously computed different results under the emulator than on hardware.
• PIE illegal operands: an instruction that writes two q registers and is given the same register for both now raises the PIE illegal-operand exception (mcause 0x1F) as silicon does, as do the esp.fft.cmul.s16 selectors the hardware rejects. Previously it ran and wrote one of them.
• PIE hardware loops of 256 bytes or more: esp.lp.setup and esp.lp.starti with a body that long did not decode and trapped as an illegal instruction.
• Endless illegal-instruction loop on PIE: a PIE-space instruction the emulator does not know, executed with the unit enabled, made ESP-IDF re-enable the unit and retry it forever, logging the same warning without end (about 18 GB in 20 minutes); it now panics with the instruction in mtval, as on silicon.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.48.0

This release also carries the changes from 0.47.0, which was tagged but never published.

Added

• Classic Bluetooth on ESP32-S31: Bluedroid firmware with Classic BT enabled no longer asserts right after esp_bt_controller_enable() (GH #17). A new Bumble peer, tools/bumble_classic_peer.py, connects to the firmware over BR/EDR and drives ESP-IDF's A2DP sink (stream start and suspend), SPP acceptor, L2CAP server, HID mouse device and HFP audio-gateway examples. Examples that find their peer by inquiry, SCO audio data and AVRCP are not covered.
• Reach a firmware's own soft AP from the host: firmware that runs its own access point (captive portal, softAP provisioning, APSTA) is now reachable from the host. The emulator joins the firmware's AP as a station and --net user forwards hostfwd ports to it, so a browser, curl or esp_prov talks to the firmware's server. Works on every WiFi chip, and APSTA firmware keeps its own station link to the built-in AP at the same time. --wifi-fw-ap-password sets the firmware AP's password when it differs from --wifi-password.
• Bluedroid on ESP32-S31: Bluedroid BLE firmware on ESP32-S31 now runs against the built-in controller, so advertising and GATT servers work as they do with NimBLE. Before, it stalled during controller start-up with BLE left unpatched.
• Browser UI redesign: the WebAssembly page has a dark theme and a live dashboard: instruction rate with a 30-second sparkline, emulated time and its speed against the wall clock, per-core program counters, a GPIO view that shows what the firmware drives and lets you click input pins, a register panel that follows the chip's ISA (RISC-V x registers, or the Xtensa register window on ESP32-S3), and a memory hex dump that can refresh while running. Firmware loads by drag and drop.
• Warning for memory past the fitted PSRAM: firmware that uses more PSRAM than the emulated chip has now gets a warning that points at --psram-size, instead of hanging silently. A Linux image whose device tree declares 32 MB hung right after the early console on ESP32-S31's default 16 MB.

Fixed

• Linux on ESP32-S31 (regression in 0.46.0): Linux reset at its first call into OpenSBI, because the new CPU lockup detection mistook the kernel's normal trap handling for an exception inside an exception handler. Linux boots again, and firmware that really faults inside its exception handler still gets the lockup report.
• ECDSA signing on ESP32-S31 with current ESP-IDF: firmware built with ESP-IDF master since early October failed every PSA ECDSA signature with psa_sign_hash failed: -132, because ESP-IDF now signs imported keys on the ECDSA peripheral. Signing and public-key export with imported keys now work, and eFuse and Key Manager keys work as before.
• ESP32-S3 idle speed: an idle ESP32-S3 ran at about a tenth of real time, both cores spinning in their idle tasks instead of sleeping, once firmware had disabled any interrupt source whose status stayed asserted. ESP-IDF v6.1's SPI driver does this after its first transaction, so SPI firmware on S3 ran several times slower than real time. Idle waits now fast-forward as on the other chips.
• GDB and the MMU on ESP32-S31: through --gdb, the address-translation register satp always read as 0 and writes to it were ignored, so a Linux guest's page tables could not be inspected or changed from GDB.
• Classic Bluetooth connections on ESP32-S31: Bluedroid faulted as soon as a Classic peer connected. Classic HFP audio over --ble-hci tcp: lost sync after the first audio packet, and large Classic data packets from a physical adapter (--ble-hci hciN) were truncated.
• I2S start on ESP32-S31: starting an I2S channel hung the calling task, so ESP-IDF's a2dp_sink_stream example stopped when a stream started.
• ESP-Hosted RPCs between two emulators: in the two-process P4 ↔ C6 ESP-Hosted setup, only the slave's start-up event arrived and every RPC request after it hung. RPCs now complete.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.46.0

Added

• ESP32-S31 WiFi station: firmware on ESP32-S31 now scans, connects to the built-in soft AP (WPA2-PSK and WPA3-SAE) and gets a DHCP lease, like the other WiFi chips. Previously the driver started, fell back to full PHY calibration and never saw an access point (GH #17).
• ESP32-S31 BLE: NimBLE firmware on ESP32-S31 now runs against the built-in controller instead of stopping at its first HCI command, so BLE advertising and GATT work there as on C3/C6; ESP-IDF's network_provisioning example provisions Wi-Fi over BLE end to end (GH #17).
• ESP32-S31 CPU lockup report: firmware that faults inside its own exception handler now resets with the CPU-lockup reset reason, and the boot ROM prints its CPU LockUp Exception Report with both exception addresses and the cause, as on silicon. Previously the chip came back from a plain software reset with nothing to report, so ESP-IDF's test_cpu_lockup_trap_chain case could not pass.
• IO_MUX on every chip: a pin that firmware wires straight to a peripheral through the IO_MUX, bypassing the GPIO matrix, is now resolved like any other pin. This is the path the ESP-IDF SPI driver takes on a chip's default SPI pinout, where the pins were previously invisible to the emulator; on C3, C6 and H2 the IO_MUX registers were not mapped at all, so configuring a pin logged Bus fault warnings.
• --no-panic-intercept: with --elf, the emulator stopped at the first panic even when the firmware meant to panic and reboot (a task-watchdog reset test, a deliberate abort()), so such runs never got past that point. The new flag lets the firmware's own panic handler run while keeping symbolicated output; the test harness already behaved this way.
• Cache-error panic on ESP32-C3, P4 and S31: reading flash-mapped memory with the cache disabled now panics with Cache error, as it has on C5, C6 and H2 since 0.44.0. Before, the read quietly returned zeros. ESP-IDF's invalid access to cache raises panic case passes on all six RISC-V chips.
• TEE interrupt delivery on ESP32-C5 and P4: an interrupt the firmware allocates for user mode is taken in user mode, and a user-mode interrupt that arrives while the TEE is running is handed to the TEE for delegation, as silicon does. ESP-IDF's TEE test app passes all four [CPU] interrupt cases on both chips, where C5 passed two and P4 one.

Fixed

• ESP-TEE on ESP32-C5 (regression in 0.45.0): every tee_test_fw case panicked with APM - Space exception naming GDMA_AES before it did any work. On C5 silicon a TEE-mode DMA master is not refused an address outside the configured regions; the emulator was applying the C6/H2 rule there. All basic cases pass again, and the APM violation cases now fault from the REE as the suite expects.
• ESP32-S3 boots without the ROM: with --skip-rom (and in the browser build, which takes that path) S3 firmware printed nothing at all, not even the bootloader banner, because the core started with the register window off and the bootloader's first retw trapped. It now starts as the ROM hands it over.
• ESP32-P4 built with IDF master boots without the ROM: --skip-rom (and the browser build, which takes that path) stopped every IDF-master P4 image in the 2nd-stage bootloader with boot_comm: mismatch chip ID, expected 18, found 65535. The bootloader asks the ROM where it was loaded from, and with the ROM skipped the answer was 0; the emulator now seeds it, as it already did on C5.
• Linux Ethernet on ESP32-S31: Linux's stmmac driver on the S31 Ethernet MAC never got a DHCP lease and reset the adapter in a loop (NETDEV WATCHDOG: transmit queue 0 timed out). Linux 6.18 now gets a lease, pings the gateway and downloads files over --net user. ESP-IDF's own Ethernet driver on S31 and P4 was unaffected.
• Supervisor-mode interrupts on ESP32-S31: returning from a supervisor-mode trap now restores the privilege mode and interrupt level the way the S31 CLIC does, and the second core's supervisor interrupt registers are mapped, for OpenSBI and Linux guests.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.45.0

Added

• WPA3 on the WiFi soft AP: WPA3-Personal firmware now connects, and the AP runs WPA2/WPA3 mixed mode by default so both kinds of station work unchanged. --wifi-auth pins the network type and --wifi-sae-pwe the WPA3 key-derivation method, to test what firmware should refuse (GH #15).
• WPA2/WPA3-Enterprise: --wifi-auth wpa3-enterprise --wifi-radius HOST:PORT,SECRET authenticates stations against a RADIUS server such as hostapd, so EAP-TLS, PEAP and TTLS firmware connects. ESP-IDF's wifi_enterprise example passes as shipped (GH #15).
• ESP-SR and esp-dl on ESP32-P4: voice and neural-network firmware (Audio Front End, WakeNet, VADNet, NSNet, esp-dl) no longer stops with Illegal instruction (GH #16).
• Access permission control: memory and peripheral permissions are enforced on ESP32-P4, and further on ESP32-C5 (per-peripheral table, internal RAM, flash and PSRAM) and ESP32-C6 (LP memory). The C5, C6 and H2 crypto engines' DMA is checked too. TEE and isolation firmware now sees the faults and violation reports silicon gives, including after a software reset.

Fixed

• WiFi reconnect: on ESP32-C5 and C6, a station that stopped and restarted WiFi could fail later with no AP found.
• BLE device name with Bumble 0.0.230+: the device appeared nameless, so esp_prov and esp-rainmaker-cli reported Device not found.
• System time between close reads: two quick reads could return the same time, failing code that expects it to advance.
• ESP32-P4 user mode: firmware that drops to user mode, as protected TEE builds do, trapped with Illegal instruction instead.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.44.0

Added

• TEE isolation on ESP32-C5, C6 and H2: memory and peripheral access permissions (APM) are enforced, the hardware stack guard reports Stack protection fault, reading through an unmapped cache page or with the cache disabled reports Cache error, and C5 reports illegal flash accesses. Firmware built with esp_tee now panics where silicon does, so an isolation test can tell a working boundary from a broken one. ESP-IDF's tee_default suite passes 8 of 8 on all three chips.
• ESP32-S31 APM and ESP32-P4 PMS: S31's four access-permission controllers are modelled and enforced like C6's. P4's permission-management (PMS) registers accept firmware's configuration, so that code runs, but P4 does not enforce the permissions yet.
• GDMA memory-to-memory transfers on C3, C5, C6 and H2: esp_async_memcpy and any driver that copies memory with GDMA now completes. It previously waited forever, so ESP-IDF's esp_driver_dma test app hung on its first case; it now passes 9 of 9 on C3 and 8 or more of 10 on the others.
• ECC accelerator work modes on C5, H2, P4 and S31: modular division, point addition, the Jacobian on-curve check and the modular add, subtract and multiply modes now compute results, where previously firmware read back its own operands. Jacobian point multiplication returns the same coordinates as real silicon, so tests that compare against recorded hardware vectors pass. ESP-IDF's esp_hal_security crypto suite reports no failures on C5 or P4.
• ECDSA P-192 and Key Manager keys on C5 and P4: the ECDSA peripheral signs on P-192, and signs with a key deployed through the Key Manager. ESP-IDF's key_manager cases, which hung forever on ecdsa_p192_key_aes_deployment, now all pass.
• SHA engine: SM3 (C5, S31), SHA-512/224, SHA-512/256 and SHA-512/t produce correct digests. All four previously returned a wrong digest from the first byte.
• AES CFB8 in DMA mode: a CFB8 transfer returned the plaintext unchanged; ESP-IDF's cfb8_aes_128_dma_test and cfb8_aes_256_dma_test pass.
• PIE vector arithmetic on ESP32-P4 and S31: the element-wise vector instructions (add, subtract, saturating variants, absolute value, bitwise, min/max, compare, shift) are implemented. Firmware doing any vector arithmetic previously panicked with Illegal instruction; FreeRTOS's PIE: Usage in task case passes. Instructions still missing (accumulator, FFT and unaligned-access groups) now report a coprocessor fault that names the unit.
• efuse-load PATH control command: over --control-tcp, load an eFuse image into the running machine and reset, so eFuses burned by a second emulator in download mode take effect without restarting the process. ESP-IDF's secure-boot test flow depends on this.
• SPI flash wrapped-burst reads: firmware that enables 32-byte wrap mode reads the wrapped data a real flash returns. ESP-IDF's SPI flash wrap test passes on C3.

Changed

• ESP32-C5 and ESP32-S3 PSRAM default: the emulated die is now 8 MB, the largest module shipped, instead of 32 MB. On both chips flash and PSRAM share one 32 MB address window, and a 32 MB die left esp_partition no page for the partition table, so C5 firmware with CONFIG_SPIRAM_XIP_FROM_PSRAM failed at boot with load_partitions returned 0x101 or 0x105. --psram-size 32M restores the old size.
• ESP32-C5 crystal is 48 MHz: the C5 was modelled with a 40 MHz crystal, matching no shipped part, so crystal-clocked timers and the task watchdog ran 20% slow. CPU and flash clocks at boot are unchanged.

Fixed

• Atomic operations lost updates on C5, C6, H2, P4 and S31: an atomic read-modify-write could overwrite a change another task made in between, so FreeRTOS spinlocks asserted in spinlock_release_impl and ESP-IDF's newlib_stdatomic group had 205 failing cases across the five chips. All 79 cases now pass on each.
• Task watchdog fired late or never: a task watchdog armed for 1000 ms expired after a 1000 ms busy wait instead of during it, so ESP-IDF's Task WDT task timeout case failed on every chip and broke the six cases after it. On S31 the watchdog interrupt never arrived at all, only the later reset. ESP-IDF's [task_wdt] group passes on C3, C5 and P4.
• Timekeeping across clock changes and reboots: esp_timer, uptime and the FreeRTOS tick ran fast or slow after firmware changed the CPU frequency, and the RTC wall clock stood still while nobody read it, jumped to zero on a software reboot, and drifted from the high-resolution timer by seconds. ESP-IDF's esp_libc timestamp cases, which reported a reboot latency of minus four years, pass.
• Browser build runs at real-time speed: the WebAssembly emulator no longer races ahead of the wall clock. Firmware that idles in vTaskDelay or waits on a timer now takes as long as it would on a board, and TCP over the WebSocket proxy no longer times out because emulated timers ran too fast.
• QIO/QOUT firmware aborted at boot: apps built for quad flash mode failed with assert failed: __esp_system_init_fn_init_flash esp_flash_spi_init.c:654 before reaching app_main. They now boot.
• Flash encryption read after write from PSRAM: with CONFIG_SPIRAM_XIP_FROM_PSRAM on C5, P4 and S31, esp_flash_read_encrypted() straight after an encrypted write returned the block's previous contents. test_flash_encryption_psram passes all cases.
• Reboot loop with CONFIG_SPI_FLASH_ROM_IMPL: on every chip, every boot after the first panicked at PC 0 inside the ROM's flash driver, so an OTA or esp_restart() test never came back up. Reboots now behave like a cold boot.
• ROM panic output was invisible on C5, C6, H2 and P4: a panic taken inside the ROM itself, such as the bootloader jumping to an invalid image, printed nothing and never reset. It now prints the Guru Meditation Error dump and the RTC watchdog recovers, matching a devkit line for line. ROM printf output also honours field width and zero padding (PCAddr: 0x%08x prints eight digits), and a firmware-installed putc receives the ROM's characters.
• espefuse refused to burn on ESP32-C5: every burn over socket:// failed with The eFuse supports only xtal=40M and 48M (xtal was 26). esptool now detects the right crystal on C3 and C5, so C5 firmware with pre-enabled flash encryption can be provisioned and boots.
• ECC P-384 point multiplication on C5, P4 and S31: multiplying a SECP384R1 point returned garbage, so mbedtls ECP point multiply with SECP384R1 failed with -109. Point validation on that curve had already worked.
• ESP32-H2 TEE interrupts: every secure interrupt on H2 went undispatched and the chip reset by watchdog, which made esp_tee crypto cases look like 600 s timeouts. tee_default on H2 goes from 2 passed to 8 of 8.
• Panic dumps on ESP32-C5, P4 and S31: the MCAUSE line showed only the exception code, so it differed from a devkit's for the same crash. It now matches.
• ESP32-P4 user mode: the P4 CPU has a user privilege mode, so firmware that drops to U-mode no longer faults.
• Flash encryption on P4 and S31: with encryption enabled, firmware reading back a flash mapping it had just created saw the page reported as unencrypted, which silicon does not do.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.43.0

Added

• ESP32-S3 support: --chip esp32s3 runs ESP32-S3 firmware, the first Xtensa target. Stock ESP-IDF images boot through the real ROM and bootloader to a dual-core app_main. Timers, interrupts, GPIO, PCNT, MCPWM, GDMA, eFuse and flash encryption are modelled; esptool and espefuse work over socket:// in UART and USB-Serial-JTAG download mode. USB-OTG is not modelled.
• ESP32-S3 Wi-Fi and BLE: a station connects to the built-in access point with WPA2 and DHCP, and BLE peripherals work with NimBLE against Bumble or a Linux hci0 adapter, including GATT discovery, reads, writes and notifications.
• ESP32-S3 PSRAM: firmware built with CONFIG_SPIRAM=y boots and uses external RAM in both quad and octal mode.
• ESP32-S3 debugging: --gdb works with xtensa-esp32s3-elf-gdb (breakpoints, stepping, register access, backtraces through FreeRTOS frames), and panic and abort output shows a full backtrace with source lines.
• Execution tracing: --trace FILE records which FreeRTOS task ran when. Open the file in Perfetto for a timeline, or run tools/trace-view.py for CPU time per task and the hottest functions. Requires --elf.
• Host control channel: --control-tcp HOST:PORT lets a test harness reset the chip, erase flash, or write a flash region while the emulator keeps running. This gives pytest-embedded's hard_reset(), erase_flash() and erase_partition() a way to work over a TCP serial connection, which cannot carry the DTR/RTS reset signal.
• Configurable PSRAM size: --psram-size 4M|8M|16M|32M|64M|0 sets how much external RAM the board has on ESP32-C5, P4, S3 and S31. Firmware detects the size at boot and cannot choose it, so a 32 MB board previously ran as 16 MB with no way to change that (GH #9).
• Chip revision tool: tools/make-efuse.py --chip CHIP --chip-rev MAJOR.MINOR builds an eFuse file that reports the requested silicon revision, so a production binary built with a minimum-revision requirement runs without changing its sdkconfig (GH #12). Covers C3, C5, C6, H2, P4 and S31.

Fixed

• eFuse revision: an --efuse file that stated a chip revision was partly ignored, so a C3 image asking for v1.0 booted as v1.3, and C3 v1.0, C3 v0.8 and C6 v1.0 could not be selected at all. The stated revision is now honoured exactly.
• UART loopback: firmware that enables UART loopback to read back its own output received nothing. On C5, C6, H2, P4 and S31 the same bug also sent normal console output into the receive buffer whenever an unrelated UART setting was changed. This fixed 82 to 190 failing cases per chip in ESP-IDF's unit-test suite.
• ECC P-384: public-key validation for SECP384R1 always failed on C5, P4 and S31, so mbedtls reported every P-384 key as invalid.
• PSRAM on P4 and S31: firmware running from PSRAM (xip_from_psram) rebooted in a loop as soon as it touched flash, and octal or hex PSRAM boards logged a bogus vendor id, "PSRAM ID read error" and "good-die: Fail". Both now boot and report the configured device.
• Flash encryption: a read straight after an encrypted write could return the old contents, and a later unrelated flash write could corrupt an earlier encrypted block.
• Runtime Quad-Enable: firmware that enables the flash's quad mode at runtime, such as ESP32-S3 with 80 MHz octal PSRAM, aborted during flash init because the status-register write was not honoured.
• ESP32-S3 flash erase: erasing a partition from application code erased the wrong sector (sector 0, the bootloader), which broke NVS and any code that writes to flash. Erases now land where the firmware asked.
• ESP32-S3 Wi-Fi: association with the built-in access point succeeded only about half the time. It now succeeds reliably.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.42.0

Added

• ESP32-C5 radios: C5 now runs 2.4 GHz Wi-Fi — STA association, DHCP and sustained TCP throughput — and BLE advertising via NimBLE. v0.41.0 shipped C5 with its radios unmodelled; this closes that. Stock firmware works unchanged: no band-mode pin is needed, the driver's default WIFI_BAND_MODE_AUTO scan finds the emulated 2.4 GHz AP. 5 GHz and 802.15.4 remain unmodelled.
• flash: support devices larger than 16 MiB, decoding the full esptool size range and the 4-byte-address opcodes ESP-IDF switches to past that line (CONFIG_BOOTLOADER_FLASH_32BIT_ADDR). C6 and H2 are excluded by ESP-IDF itself.
• i2c: model the HP I2C master on every chip, with a built-in 24Cxx-style EEPROM slave at address 0x50 (swappable via I2c::set_slave).
• mcpwm: model the Motor Control PWM block (C5/C6/H2/P4/S31) — timers, operators, comparators, brakes, sync and 32-bit capture, with generator levels pushed onto the GPIO matrix.
• periph: model the RTC watchdog (RWDT) on C3 and on the LP_WDT chips.

Fixed

• timg: deliver the watchdog stage-0 interrupt on C3, C6 and H2. The interrupt bit was hardcoded to bit 2, but those chips place TIMG_WDT_INT_* at bit 1, so the interrupt was undeliverable. ESP-IDF's task watchdog relies on it to print "Task watchdog got triggered" and feed the timer, so a timeout escalated silently to the stage-1 system reset instead — firmware that starves the idle task (a sustained download, say) rebooted with no diagnostic. Those workloads now run to completion.
• flash: keep flash size and contents across a reset. A device larger than the chip default lost everything above that default and read back 0xFF.
• ecdsa: read eFuse private-key scalars little-endian, stop gating EXPORT_PUBKEY on SOFTWARE_SET_Z, and wire the eFuse ECDSA key path on S31.
• machine: keep internal memory across every reset below a chip reset.
• periph: report the TRM reset cause for S31 MWDT and for P4/S31 CPU resets.
• periph/p4: report ADC conversions as done.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.41.0

esp-emu 0.41.0

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.40.1

esp-emu 0.40.1

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update

esp-emu 0.39.0

esp-emu 0.39.0

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update