esp-emu 0.49.0

Added

• USB-Serial/JTAG console: firmware built with CONFIG_ESP_CONSOLE_USB_SERIAL_JTAG=y (USB-Serial/JTAG as the primary console, e.g. M5Stack ESP32-S3 boards) printed nothing after the ROM banner and looked hung. The emulator now follows the console the firmware selects, and IDF's default UART0 + USB-Serial/JTAG secondary configuration still prints once. --console <auto|uart0|usb-jtag> overrides the choice, for firmware that drives USB-Serial/JTAG outside the IDF console layer.
• Permission control on ESP32-C3: the SENSITIVE block's three PMS monitors, which predate APM, block a denied access on the instruction bus, the data bus and RTC_FAST and log it, as silicon does. ESP-IDF enables them by default, so C3 firmware now sees a denied read return 0, a denied write dropped and a denied fetch trap; its memprot app reads the log back.
• Permission control on ESP32-S3: the SENSITIVE block's PMS monitors block a denied access to SRAM, RTC FAST and RTC SLOW memory and log it, per core, as on C3. ESP-IDF enables them by default, so S3 firmware now sees a denied read return 0, a denied write dropped and a denied fetch trap, and its memprot app passes on both cores. Runs keep their speed: accesses the configuration cannot deny are not checked.
• The whole PIE instruction set on ESP32-P4 and S31: the 202 PIE and hardware-loop instructions that no supported kernel had needed are implemented — fused load/store arithmetic, unsigned and widening multiplies, complex multiply and multiply-accumulate, the remaining MAC, accumulator, permute and unaligned-access forms, esp.addx2/4, esp.subx2/4, esp.sat, and the esp.lp.setupi/counti/endi hardware-loop forms. All 361 instructions the two chips implement now run; firmware that used one of them (esp-nn's PIE multiply uses esp.vzip.16) previously stopped with Illegal instruction.
• PIE checked against silicon: every PIE instruction was run on random state on ESP32-P4 and ESP32-S31 boards and under the emulator (the smoke app built with sdkconfig.pie_full; the scripts are in tools/internal/pie/silicon). The two chips agree bit for bit, and the emulator now matches them on all 3022 cases. The smoke app's new pie case runs 615 of them against the recorded silicon results on every CI run; on ESP32-S31 the smoke app now uses a 3 MB factory partition on a 4 MB flash.
• MAC16 on ESP32-S3: the 16-bit multiply-accumulate instructions GCC emits at -O3 (CoreMark's matrix test, DSP loops) now execute; firmware that used one previously stopped with Illegal instruction.
• ESP-Hosted co-processor reset between two emulators: in the two-process P4 ↔ C6 ESP-Hosted setup, the host's reset of the co-processor now reaches the C6 and reboots it, so ESP-Hosted recovery completes instead of leaving the co-processor in its torn-down state. --hosted-reset-gpio names the pin when it is not ESP-Hosted's default.

Changed

• Faster emulation on every chip: the interpreter does less work around each instruction, so firmware runs about 2.5× faster on ESP32-C3 (CoreMark: 77 s → 29 s), about 2× on ESP32-P4 and ESP32-C6, and about 1.8× on ESP32-S3 (57 s → 31 s). In the browser the same C3 CoreMark drops from 99 s to 49 s. Emulated time is unchanged; only the wall clock moves.
• Single-precision floating point on ESP32-P4 and S31 runs about 2× faster: float arithmetic takes a direct host path and gives the same results, including rounding modes and exception flags.

Fixed

• ESP-Hosted streams between two emulators dropped packets (GH #18): in the two-process P4 ↔ C6 ESP-Hosted setup, a TCP stream from the C6 to the P4 logged aggr rx: invalid sub-frame and lost data, a burst from the P4 to the C6 stalled for good with no SDIO write buffers on slave device, and a packet-mode host (ESP-Hosted 2.x) read two packets as one. The C6's SDIO slave now streams and paces data as the silicon does, so both directions survive a flood.
• WebRTC and other ICE peers behind --net user: the NAT gave a guest UDP port a different public port per destination, so a peer's connectivity checks never reached the guest and ICE only succeeded by luck. One public port now serves every destination, as a home router does, and ICE connects.
• PIE arithmetic as silicon computes it: on ESP32-P4 and S31, multiplies, vector shifts and the FFT instructions now round per CFG.vxrm and saturate where silicon does, setting the saturation flag, instead of keeping the low bits as the TRM pseudo-code reads; esp.fft.cmul conjugates the second operand, not the first, and esp.fft.bitrev reverses over FFT_BIT_WIDTH bits. ESP-SR's audio front end and other FFT users now get the numbers the chip gives.
• PIE configuration and memory access: on ESP32-P4 and S31, firmware that reads or writes the PIE configuration register, moves the accumulator halves to and from general registers, or relies on unaligned PIE loads and stores now gets what the chip gives, and the fused store-and-compute instructions store the value the chip stores. Such code previously computed different results under the emulator than on hardware.
• PIE illegal operands: an instruction that writes two q registers and is given the same register for both now raises the PIE illegal-operand exception (mcause 0x1F) as silicon does, as do the esp.fft.cmul.s16 selectors the hardware rejects. Previously it ran and wrote one of them.
• PIE hardware loops of 256 bytes or more: esp.lp.setup and esp.lp.starti with a body that long did not decode and trapped as an illegal instruction.
• Endless illegal-instruction loop on PIE: a PIE-space instruction the emulator does not know, executed with the unit enabled, made ESP-IDF re-enable the unit and retry it forever, logging the same warning without end (about 18 GB in 20 minutes); it now panics with the instruction in mtval, as on silicon.

---

Installable via:

curl -fsSL https://raw.githubusercontent.com/espressif/esp-emulator/main/install.sh | sh

Or from an existing install:

esp-emu update