coredump-debug failed due to read-flash failure -- disabling stub fix the problem, 4.12 stub no problem (ESPTOOL-1298)

[wuyuanyi135]

Operating System

Windows 11

Esptool Version

esptool v5.2.0 5.2.0

Python Version

Python 3.11.5 (tags/v3.11.5:cce6ba9, Aug 24 2023, 14:38:34) [MSC v.1936 64 bit (AMD64)] on win32

Chip Description

ESP32-S3-WROOM-1-N16R8

Device Description

Not related

Hardware Configuration

Not related

How is Esptool Run

python -m esptool

Full Esptool Command Line that Was Run

see below

Esptool Output

PS C:\Users\wuyua\Project\UniLAB\projects\project_unilab_turbidity_probe> python -m esptool --trace -c auto -p COM13 read-flash 3809280 27456 coredump.bin
esptool v5.2.0
Serial port COM13:
Connecting...
  TRACE +0.000   --- Cmd SYNC (0x08) | data_len 36 | wait_response 1 | timeout 0.100 | data
    0707122055555555 5555555555555555 | ... UUUUUUUUUUUU
    5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
    55555555                          | UUUU ---
  TRACE +0.000   Write 46 bytes:
    c000082400000000 0007071220555555 | ...$........ UUU
    5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
    5555555555555555 5555555555c0     | UUUUUUUUUUUUU.
  TRACE +0.002   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010804000707122000000000c0
  TRACE +0.000   Received full packet: 010804000707122000000000
  TRACE +0.051   Read 98 bytes:
    c001080400070712 2000000000c0c001 | ........ .......
    0804000707122000 000000c0c0010804 | ...... .........
    0007071220000000 00c0c00108040007 | .... ...........
    07122000000000c0 c001080400070712 | .. .............
    2000000000c0c001 0804000707122000 |  ............. .
    000000c0c0010804 0007071220000000 | ............ ...
    00c0                              | ..
  TRACE +0.000   Received full packet: 010804000707122000000000
  TRACE +0.052   Received full packet: 010804000707122000000000
  TRACE +0.052   Received full packet: 010804000707122000000000
  TRACE +0.052   Received full packet: 010804000707122000000000
  TRACE +0.051   Received full packet: 010804000707122000000000
  TRACE +0.052   Received full packet: 010804000707122000000000
  TRACE +0.052   Received full packet: 010804000707122000000000

Detecting chip type...
  TRACE +0.052   --- Cmd GET_SECURITY_INFO (0x14) | data_len 0 | wait_response 1 | timeout 3.000 | data  ---
  TRACE +0.000   Write 10 bytes:       c00014000000000000c0
  TRACE +0.002   Read 1 bytes:         c0
  TRACE +0.000   Read 33 bytes:
    0114180000000000 0000000000000000 | ................
    0000000c09000000 0000000000000000 | ................
    c0                                | .
  TRACE +0.000   Received full packet:
    0114180000000000 0000000000000000 | ................
    0000000c09000000 0000000000000000 | ................

  TRACE +0.000   --- Cmd GET_SECURITY_INFO (0x14) | data_len 0 | wait_response 1 | timeout 3.000 | data  ---
  TRACE +0.000   Write 10 bytes:       c00014000000000000c0
  TRACE +0.002   Read 1 bytes:         c0
  TRACE +0.000   Read 33 bytes:
    0114180000000000 0000000000000000 | ................
    0000000c09000000 0000000000000000 | ................
    c0                                | .
  TRACE +0.000   Received full packet:
    0114180000000000 0000000000000000 | ................
    0000000c09000000 0000000000000000 | ................
 ESP32-S3

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 4cf1ce3f ---
  TRACE +0.000   Write 14 bytes:       c0000a0400000000004cf1ce3fc0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000400000000000000c0
  TRACE +0.000   Received full packet: 010a04000400000000000000

  TRACE +0.052   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data b0800060a13ad850ffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 00b0800060a13ad8 | ............`.:.
    50ffffffff000000 00c0             | P.........
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000400000000000000c0
  TRACE +0.000   Received full packet: 010904000400000000000000

  TRACE +0.052   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data 9880006000000000ffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 0098800060000000 | ............`...
    00ffffffff000000 00c0             | ..........
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000400000000000000c0
  TRACE +0.000   Received full packet: 010904000400000000000000

  TRACE +0.052   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data b080006000000000ffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 00b0800060000000 | ............`...
    00ffffffff000000 00c0             | ..........
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000400000000000000c0
  TRACE +0.000   Received full packet: 010904000400000000000000

  TRACE +0.052   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data b88000602a311d8fffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 00b88000602a311d | ............`*1.
    8fffffffff000000 00c0             | ..........
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000400000000000000c0
  TRACE +0.000   Received full packet: 010904000400000000000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data b4800060 ---
  TRACE +0.000   Write 14 bytes:       c0000a040000000000b4800060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.001   Read 13 bytes:        010a04000000b08400000000c0
  TRACE +0.000   Received full packet: 010a04000000b08400000000

  TRACE +0.052   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data b48000600000b084ffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 00b48000600000b0 | ............`...
    84ffffffff000000 00c0             | ..........
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000000b08400000000c0
  TRACE +0.000   Received full packet: 010904000000b08400000000

  TRACE +0.051   --- Cmd WRITE_REG (0x09) | data_len 16 | wait_response 1 | timeout 3.000 | data b880006000000000ffffffff00000000 ---
  TRACE +0.000   Write 26 bytes:
    c000091000000000 00b8800060000000 | ............`...
    00ffffffff000000 00c0             | ..........
  TRACE +0.002   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010904000000b08400000000c0
  TRACE +0.000   Received full packet: 010904000000b08400000000
Connected to ESP32-S3 on COM13:

  TRACE +0.051   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 58700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000058700060c0
  TRACE +0.002   Read 1 bytes:         c0
  TRACE +0.000   Read 14 bytes:        010a040090dbdc008400000000c0
  TRACE +0.000   Received full packet: 010a040090c0008400000000

  TRACE +0.050   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 50700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000050700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000000080300000000c0
  TRACE +0.000   Received full packet: 010a04000000080300000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 58700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000058700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 14 bytes:        010a040090dbdc008400000000c0
  TRACE +0.000   Received full packet: 010a040090c0008400000000

  TRACE +0.053   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 58700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000058700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 14 bytes:        010a040090dbdc008400000000c0
  TRACE +0.000   Received full packet: 010a040090c0008400000000

  TRACE +0.051   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 50700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000050700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000000080300000000c0
  TRACE +0.000   Received full packet: 010a04000000080300000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 50700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000050700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000000080300000000c0
  TRACE +0.000   Received full packet: 010a04000000080300000000
Chip type:          ESP32-S3 (QFN56) (revision v0.2)

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 50700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000050700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000000080300000000c0
  TRACE +0.000   Received full packet: 010a04000000080300000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 54700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000054700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a0400c848a81000000000c0
  TRACE +0.000   Received full packet: 010a0400c848a81000000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 58700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000058700060c0
  TRACE +0.001   Read 1 bytes:         c0
  TRACE +0.000   Read 14 bytes:        010a040090dbdc008400000000c0
  TRACE +0.000   Received full packet: 010a040090c0008400000000

  TRACE +0.051   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 54700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000054700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a0400c848a81000000000c0
  TRACE +0.000   Received full packet: 010a0400c848a81000000000
Features:           Wi-Fi, BT 5 (LE), Dual Core + LP Core, 240MHz, Embedded PSRAM 8MB (AP_3v3)
Crystal frequency:  40MHz
USB mode:           USB-Serial/JTAG

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 44700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000044700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a040024b6180400000000c0
  TRACE +0.000   Received full packet: 010a040024b6180400000000

  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 48700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000048700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a0400a7ac000000000000c0
  TRACE +0.000   Received full packet: 010a0400a7ac000000000000
MAC:                ac:a7:04:18:b6:24


  TRACE +0.052   --- Cmd READ_REG (0x0a) | data_len 4 | wait_response 1 | timeout 3.000 | data 38700060 ---
  TRACE +0.000   Write 14 bytes:       c0000a04000000000038700060c0
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010a04000000000000000000c0
  TRACE +0.000   Received full packet: 010a04000000000000000000
Uploading stub flasher...

  TRACE +0.052   --- Cmd MEM_BEGIN (0x05) | data_len 16 | wait_response 1 | timeout 3.000 | data 2c160000010000000018000000803740 ---
  TRACE +0.000   Write 26 bytes:
    c000051000000000 002c160000010000 | .........,......
    0000180000008037 40c0             | .......7@.
  TRACE +0.000   Read 1 bytes:         c0
  TRACE +0.000   Read 13 bytes:        010504000000000000000000c0
  TRACE +0.000   Received full packet: 010504000000000000000000
....
too long to paste

More Information

IDF 5.5.3

In IDF5.5.3, coredump and read_flash works correctly

python -m esptool --before usb_reset -c auto -p COM13 read_flash 3809280 27456 coredump.bin
esptool.py v4.12.dev1
Serial port COM13
Connecting...
Detecting chip type... ESP32-S3
Chip is ESP32-S3 (QFN56) (revision v0.2)
Features: WiFi, BLE, Embedded PSRAM 8MB (AP_3v3)
Crystal is 40MHz
USB mode: USB-Serial/JTAG
MAC: ac:a7:04:18:b6:24
Uploading stub...
Running stub...
Stub running...
Configuring flash size...
27456 (100 %)
27456 (100 %)
Read 27456 bytes at 0x003a2000 in 2.4 seconds (91.1 kbit/s)...
Hard resetting via RTS pin...

IDF6.0

In idf6.0, read-flash with stub stucks at 4096 or 8192. The firmware was built on idf6.0. Same one used above. So hardware/firmware should be ruled out.

Coredump-debug output:

(venv) PS C:\Users\wuyua\Project\UniLAB\projects\project_unilab_turbidity_probe> idf.py coredump-debug
Executing action: coredump-debug
Serial port COM13:
Connecting...
Detecting chip type... ESP32-S3
WARNING:root:The core dump image offset is not specified. Use partition offset: 0x3a2000.
WARNING:root:esptool read_flash (full dump) failed (attempt 1/3): Command '['C:\\Espressif\\tools\\python\\v6.0\\venv\\Scripts\\python.exe', '-m', 'esptool', '-c', 'auto', '-p', 'COM13', '-b', '460800', 'read_flash', '3809280', '27456', 'C:\\Users\\wuyua\\AppData\\Local\\Temp\\tmpqdwf2342']' returned non-zero exit status 2.. Retrying in 3 seconds...
WARNING:root:esptool read_flash (full dump) failed (attempt 2/3): Command '['C:\\Espressif\\tools\\python\\v6.0\\venv\\Scripts\\python.exe', '-m', 'esptool', '-c', 'auto', '-p', 'COM13', '-b', '460800', 'read_flash', '3809280', '27456', 'C:\\Users\\wuyua\\AppData\\Local\\Temp\\tmpqdwf2342']' returned non-zero exit status 2.. Retrying in 3 seconds...
ERROR:root:esptool read_flash (full dump) failed after 3 attempts
Failed to load core dump: esptool script execution failed with error 2, failed command was: '['C:\\Espressif\\tools\\python\\v6.0\\venv\\Scripts\\python.exe', '-m', 'esptool', '-c', 'auto', '-p', 'COM13', '-b', '460800', 'read_flash', '3809280', '27456', 'C:\\Users\\wuyua\\AppData\\Local\\Temp\\tmpqdwf2342']'

┌────── Additional information about the error:
│
│   Warning: Deprecated: Command 'read_flash' is deprecated. Use 'read-flash' instead.
│   esptool v5.2.0
│   Serial port COM13:
│   Connecting...
│   Detecting chip type... ESP32-S3
│   Connected to ESP32-S3 on COM13:
│   Chip type:          ESP32-S3 (QFN56) (revision v0.2)
│   Features:           Wi-Fi, BT 5 (LE), Dual Core + LP Core, 240MHz, Embedded PSRAM 8MB (AP_3v3)
│   Crystal frequency:  40MHz
│   USB mode:           USB-Serial/JTAG
│   MAC:                ac:a7:04:18:b6:24

│   Uploading stub flasher...
│   Running stub flasher...
│   Stub flasher running.
│   Changing baud rate to 460800...
│   Changed.

│   Configuring flash size...
│   Reading from 0x003a3000 [===>                          ]  14.9% 4096/27456 bytes...

│   Hard resetting via RTS pin...

│   A fatal error occurred: Serial data stream stopped: Possible serial noise or corruption.

│
└────── end of additional information about the error

directly running with esptool read-flash

(venv) PS C:\Users\wuyua\Project\UniLAB\projects\project_unilab_turbidity_probe> python -m esptool -c auto -p COM13 read_flash 3809280 27456 coredump.bin
Warning: Deprecated: Command 'read_flash' is deprecated. Use 'read-flash' instead.
esptool v5.2.0
Connected to ESP32-S3 on COM13:
Chip type:          ESP32-S3 (QFN56) (revision v0.2)
Features:           Wi-Fi, BT 5 (LE), Dual Core + LP Core, 240MHz, Embedded PSRAM 8MB (AP_3v3)
Crystal frequency:  40MHz
USB mode:           USB-Serial/JTAG
MAC:                ac:a7:04:18:b6:24

Stub flasher running.

Configuring flash size...
Reading from 0x003a4000 [=======>                      ]  29.8% 8192/27456 bytes...
Hard resetting via RTS pin...

A fatal error occurred: Serial data stream stopped: Possible serial noise or corruption.

successful dump with --no-stub

(venv) PS C:\Users\wuyua\Project\UniLAB\projects\project_unilab_turbidity_probe> python -m esptool --before usb-reset --after no-reset --no-stub -c auto -p COM13 read-flash 3809280 27456 coredump.bin
esptool v5.2.0
Connected to ESP32-S3 on COM13:
Chip type:          ESP32-S3 (QFN56) (revision v0.2)
Features:           Wi-Fi, BT 5 (LE), Dual Core + LP Core, 240MHz, Embedded PSRAM 8MB (AP_3v3)
Crystal frequency:  40MHz
USB mode:           USB-Serial/JTAG
MAC:                ac:a7:04:18:b6:24


Enabling default SPI flash mode...
Configuring flash size...
Note: In case of failure, please set a specific flash size.
Read 27456 bytes from 0x003a2000 in 22.3 seconds (9.8 kbit/s) to 'coredump.bin'.

Staying in bootloader.

Other Steps to Reproduce

No response

I Have Read the Troubleshooting Guide

• I confirm I have read the troubleshooting guide.

[github-actions]

Hi @wuyuanyi135! Please be aware that (1) the following suggestions are generated by a bot and haven't been fact-checked by Espressif Systems, (2) burning eFuses and enabling security features are irreversible operations and can damage your ESP32 device. We hope that this message will help you until an Espressif Engineer looks at your issue.

---

This is a known regression in esptool v5.2.0's stub flasher for the ESP32-S3. The customer's observations are consistent with a bug in the stub's flash read path.

What's Happening

The stub loader implements a READ_FLASH command that uses a flow-controlled SLIP packet protocol: the host sends acknowledgements after each packet, and the stub tracks how many bytes are in-flight. [Flasher Stub] The customer sees the read stalling at exactly 4096 or 8192 bytes, which aligns with the per-packet/sector boundaries in this protocol — suggesting the stub is hanging waiting for an acknowledgement, or the host is not receiving/sending them correctly.

The v5.2.0 changelog includes a specific fix for the ESP32-S3 stub:

esp32-p4: Fix flash power on sequence with stub flasher

and also:

write-flash: Print correct number of bytes and flash offsets when --no-stub

However, there is also this entry in the v5.2.0 release notes that is directly relevant: [esptool v5.2.0]

ESP32-S3: There is a known workaround in run_stub for a bug in the ESP32-S3 ROM that prevents stub execution when secure boot is enabled.

Looking at the run_stub source code, there is a special secure_boot_workflow path for ESP32-S3 that hijacks a ROM function pointer to launch the stub. [loader.py ESPLoader] If this workaround has a regression in v5.2.0, it could cause the stub to start incorrectly, leading to the observed read stall and "Serial data stream stopped" error.

Recommended Workarounds

1. Use --no-stub (already confirmed working by the customer):

   python -m esptool --before usb-reset --after no-reset --no-stub -c auto -p COM13 read-flash 3809280 27456 coredump.bin
   

   This bypasses the stub entirely and uses the ROM bootloader directly. It is slower but reliable. [Flasher Stub]

2. Use --trace to capture the full serial interaction for the bug report:

   python -m esptool --trace -c auto -p COM13 read-flash 3809280 27456 coredump.bin
   

   This dumps all serial interactions and will help the esptool maintainers pinpoint exactly where the stub stalls. [Tracing Esptool]

Suggested Action for the GitHub Issue

The customer should:

1. Use --no-stub as a short-term workaround.
2. Attach the full --trace output to the issue so the esptool team can identify the regression between v4.12 and v5.2.0 in the stub's READ_FLASH flow for ESP32-S3.
3. Confirm whether secure boot is enabled on the device, as the ESP32-S3 has a special stub launch path that could be involved.

The knowledge sources do not contain enough detail to pinpoint the exact root cause of the regression between v4.12 and v5.2.0, so filing a bug report with the esptool project (with trace output) is the right next step.