ESP32-C6: crashes when using newlib #100077
Description
Describe the bug
ESP32-C6 blinky demo crashes when using newlib.
Regression
- This is a regression.
Steps to reproduce
Use zephyrproject\zephyr\samples\basic\blinky sample.
proj.conf:
CONFIG_GPIO=y
CONFIG_NEWLIB_LIBC=y
CONFIG_LOG=y
Build & flash:
west build --board xiao_esp32c6/esp32c6/hpcore -p
west flash
Relevant log output
ESP-ROM:esp32c6-20220919
Build:Sep 19 2022
rst:0x3 (LP_SW_HPSYS),boot:0x1e (SPI_FESP-ROM:esp32c6-20220919
Build:Sep 19 2022
rst:0x18 (JTAG_CPU),boot:0x1e (SPI_FAST_FLASH_BOOT)
Saved PC:0x2000084c
SPIWP:0xee
mode:DIO, clock div:2
load:0x40800000,len:0xaa14
load:0x4080aa30,len:0x2bf8
SHA-256 comparison failed:
Calculated: 6f5aed52a6d6a1968b90617e6604c78c58acfa79ad0934ec45f473716c46a472
Expected: 00000000b0290000000000000000000000000000000000000000000000000000
Attempting to boot anyway...
entry 0x40801cca
I (38) soc_init: ESP Simple boot
I (38) soc_init: compile time Nov 26 2025 16:00:36
I (39) soc_init: chip revision: v0.2
I (39) flash_init: SPI Speed : 80MHz
I (41) flash_init: SPI Mode : DIO
I (45) flash_init: SPI Flash Size : 4MB
I (49) boot: DRAM : lma=00000020h vma=40800000h size=0aa14h ( 43540)
I (55) boot: DRAM : lma=0000aa3ch vma=4080aa30h size=02bf8h ( 11256)
I (61) boot: IROM : lma=00010000h vma=42800000h size=01cc0h ( 7360)
I (67) boot: IROM : lma=00020000h vma=42000000h size=0a1a8h ( 41384)
I (73) boot: libc heap size 432 kB.
I (76) spi_flash: detected chip: generic
I (80) spi_flash: flash io: dio
[00:00:00.000,000] <err> os: mtval: 0
[00:00:00.000,000] <err> os: a0: 4080aac0 t0: 400283c2
--- 3 messages dropped ---
[00:00:00.000,000] <err> os: a1: 4080ac80 t1: 408029e2
[00:00:00.000,000] <err> os: a2: 00000001 t2: 00000020
[00:00:00.000,000] <err> os: a3: 00000000 t3: 00000004
[00:00:00.000,000] <err> os: a4: 00000009 t4: 0000004c
[00:00:00.000,000] <err> os: a5: 00000000 t5: aaaaaaaa
[00:00:00.000,000] <err> os: a6: 4080adac t6: aaaaaaaa
[00:00:00.000,000] <err> os: a7: 0000002e
[00:00:00.000,000] <err> os: sp: 4080e8e0
[00:00:00.000,000] <err> os: ra: 4003e52c
[00:00:00.000,000] <err> os: mepc: 400283ca
[00:00:00.000,000] <err> os: mstatus: 00001880
[00:00:00.000,000] <err> os:
[00:00:00.000,000] <err> os: s0: 4080ac80 s6: 428001f8
[00:00:00.000,000] <err> os: s1: 42802000 s7: 00000000
[00:00:00.000,000] <err> os: s2: 4080aac0 s8: 00000000
[00:00:00.000,000] <err> os: s3: 428001f4 s9: 00000000
[00:00:00.000,000] <err> os: s4: 42801c58 s10: 00000000
[00:00:00.000,000] <err> os: s5: 42800000 s11: 00000000
[00:00:00.000,000] <err> os:
[00:00:00.000,000] <err> os: call trace:
[00:00:00.000,000] <err> os: 0: sp: 4080e900 ra: 42006230
[00:00:00.000,000] <err> os: 1: sp: 4080ea90 ra: 42004c46
[00:00:00.000,000] <err> os: 2: sp: 4080eab0 ra: 42000088
[00:00:00.000,000] <err> os: 3: sp: 4080eb20 ra: 4200104c
[00:00:00.000,000] <err> os: 4: sp: 4080eb24 ra: 4200103e
[00:00:00.000,000] <err> os:
[00:00:00.000,000] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
[00:00:00.000,000] <err> os: Current thread: 0x40810130 (unknown)
[00:00:00.093,000] <err> os: Halting systemImpact
Showstopper – Prevents release or major functionality; system unusable.
Environment
- OS: Windows
- Zephyr version: 4.3.99
Additional Context
call sequence: printf -> vfprintf_r -> __swsetup_r(0x400005D0, internal rom)
The address, 0x400005d0, is introduced by esp32c6.rom.newlib.ld:
__swbuf = 0x400005cc;
__swsetup_r = 0x400005d0;
syscall_table_ptr = 0x4087ffd4;
_global_impure_ptr = 0x4087ffd0;
400005D0 jumps to 4003E51A:
4003E51A jumps to 400283BE:
And then, 400283BE tried to access *0x4087ffd4, which is 0:
(gdb) x/20wx 0x4087FFD4
0x4087ffd4: 0x00000000 0x4004d0d0 0x4004d980 0x4004d940
0x4087ffe4: 0x4004d8cc 0x00000000 0x4087fa08 0x4087fa24
0x4087fff4: 0x4080cebc 0x4004a680 0x20000830 0x00000000
0x40880004: 0x00000000 0x00000000 0x00000000 0x00000000
0x40880014: 0x00000000 0x00000000 0x00000000 0x00000000