For OTA_TYPE_UPDATE_PARTITION_TABLE the success path runs
nvs_flash_deinit() before the final write, which leaves every
preference handle held by other components invalid. App.safe_reboot()
calls on_safe_shutdown() which tries to flush preferences, and each
flush fails with ESP_ERR_NVS_INVALID_HANDLE -- noisy log spam during
the reboot window.
App.reboot() skips the safe-shutdown callbacks and goes straight to
esp_restart(). For partition-table OTAs there is nothing useful to
flush (NVS handles are already dead, the device is moments from a
reboot anyway), so reboot directly.
App-OTA path is unchanged: safe_reboot() still runs on_safe_shutdown
so preferences are saved on the way out.
When the running app does not fit any slot in the new partition table,
the user has almost certainly picked the wrong migration .bin for
their device. Replace the generic "No compatible app partition found"
error with one that prints the running app's offset, used size, and
the size limit a migration method must clear, plus an explicit
reassurance that no flash content has been modified yet.
Same treatment for the otadata-overlap case: include the running app
offset/size and tell the user to pick a different migration method.
Verification phase is non-destructive, so these errors are recoverable
by retrying with the correct .bin -- the new wording makes that
explicit so users don't lose time on a brick scare they aren't in.
No code-flow change; only log message wording.
The fixture shares the `host-climate-test` build dir with
host_mode_climate_control.yaml. When the control test runs first and
leaves the thermostat in HEAT mode, MEMORY restore on the next basic_state
boot picked up HEAT and the initial-state assertion failed
(`assert ClimateMode.HEAT == ClimateMode.OFF`).
`const Ts &...` is ill-formed when Ts is already a reference (e.g. a
trigger that passes `std::string &`). Forward Ts by-value so the
generated lambda matches ApplyFn for any valid trigger arg type.
`const Ts &...` is ill-formed when Ts is already a reference (e.g. a
trigger that passes `std::string &`). Forward Ts by-value so the
generated lambda matches ApplyFn for any valid trigger arg type.
`const Ts &...` is ill-formed when Ts is already a reference (e.g. a
trigger that passes `std::string &`). Forward Ts by-value so the
generated lambda matches ApplyFn for any valid trigger arg type.
`const Ts &...` is ill-formed when Ts is already a reference (e.g. a
trigger that passes `std::string &`). Forward Ts by-value so the
generated lambda matches ApplyFn for any valid trigger arg type.
Mat931 verified empirically that ``nvs_flash_init()`` after
``nvs_flash_deinit()`` does not revive NVS handles already held by
other components: writes still fail with ESP_ERR_NVS_INVALID_HANDLE.
The guard therefore only created the appearance of a recovery path.
Remove it and document the actual contract: from nvs_flash_deinit()
onward, components that hold open NVS handles will fail until the
device is rebooted. The success path reboots immediately, so it is
unaffected; the failure path now tells the user clearly to reboot
and retry, rather than implying retry-without-reboot will work.
Also soften the "permanently brick" wording in the pre-write log
warning -- a bad partition-table OTA leaves a device that needs a
serial flash to recover, not a permanently-dead one.
The PartitionTablePlan field that drives the optional app copy stores
the partition that will receive the running app (i.e. the destination
in the current table at the new slot's flash offset). The old name
``copy_source_part`` described the value backwards and risked future
callers swapping the esp_partition_copy() arguments; renamed to
``copy_dest_part`` along with the matching local
``app_copy_dest_part`` and the comments around them.
Also replace esp_ota_get_running_partition() in the copy path with
find_app_partition_at(running_app_offset, running_app_size). The IDF
call can return nullptr after a prior aborted partition-table OTA in
the same boot called esp_partition_unload_all() (the same condition
the cache in get_running_app_position() exists for); the previous code
would have dereferenced nullptr on the retry that the client error
message explicitly suggests.
No functional change on the success path; nullptr deref on the failed-
retry path is now reported as OTA_RESPONSE_ERROR_PARTITION_TABLE_UPDATE.
Every OTA backend's begin() now takes ``(size_t image_size, OTAType
ota_type = OTA_TYPE_UPDATE_APP)``. ESPHomeOTAComponent::handle_data_()
calls ``backend_->begin(ota_size, ota_type)`` unconditionally; the
USE_OTA_PARTITIONS ifdef around the call disappears. The four non-ESP32
backends (esp8266, rp2040, libretiny, host) accept the new parameter
and reject anything other than OTA_TYPE_UPDATE_APP up front, so the
client-visible behaviour is unchanged.
Same commit also trims the verbose block comments in the partition-
table TU and the IDF backend header, keeping the genuinely non-obvious
WHYs (slot-selection policy, NvsReinitGuard semantics, unload-then-null
ordering, cache-init flag, dump_config nullptr fallback) and dropping
the procedural narration.
No functional change.
Splits the partition-table OTA implementation out of the shared
ota_backend_esp_idf.cpp into a new translation unit gated by
USE_OTA_PARTITIONS. Builds without allow_partition_access compile
strictly less code and don't link esp_image_format / nvs_flash; the
common app-OTA backend is also easier to read without ~340 lines of
unrelated partition handling interleaved.
What moves: validate_new_partition_table_, update_partition_table,
get_running_app_position, the file-static running-app cache, the
NvsReinitGuard RAII helper, and the find_app_partition_at /
check_overlap helpers. What stays: begin/write/end/abort and the
factory.
Behaviour-preserving refactor.
Replace the four explicit nvs_flash_init() calls with a small RAII
guard (NvsReinitGuard) declared right after nvs_flash_deinit(). Each
failure path now just returns; the guard reinits NVS in its destructor.
The success path disarms it before the trailing return because the
device reboots immediately afterwards and reinit would only churn the
partition cache.
No behaviour change.
- upload_program: allow MQTT/MQTTIP devices for --partition-table.
MQTTIP gets resolved to a real IP by _resolve_network_devices(), so
rejecting any non-NETWORK port_type was incorrect; only SERIAL and
BOOTSEL are non-OTA upload paths.
- update_partition_table: re-initialize NVS on every failure path past
nvs_flash_deinit() so components that survive a failed OTA aren't
left with broken NVS handles. Success path stays as-is because the
device reboots immediately afterwards.
Adds an MQTTIP upload test and refreshes the gate's comment.
The running-app position cache lived as three function-local statics
inside get_running_app_position(). They cannot be IDFOTABackend members
(the backend is per-connection, the cache must outlive a backend that
called esp_partition_unload_all() in a prior aborted partition-table
OTA), but burying them inside the function made the lifetime and
shared-across-connections semantics implicit. Move them to file scope
with s_running_app_ prefix so the process-scoped lifetime is visible
at first read, and tighten the surrounding comments.
No behaviour change.
Splits the non-destructive validation phase out of update_partition_table()
into a dedicated method. update_partition_table() now reads top-down as
"check buffer state, find running app, validate the new table + plan the
target slot, then commit", with the destructive write isolated to the
final block.
The chosen slot and optional copy-source partition are returned via a
small PartitionTablePlan struct so the caller no longer juggles the two
candidate-index variables. Refactor only; behaviour and error semantics
are unchanged.
Split the combined "missing app, otadata, or nvs" verify failure into
three separate ESP_LOGE messages so users can see which check failed,
trim trailing spaces from the (err=0x%X) log strings, and document why
the partition-table espota2 test mocks SERVER_FEATURE_SUPPORTS_COMPRESSION
(intentional protocol-path coverage; the real IDFOTABackend never sets it).
Read the resolved partition-table file in upload_program before opening
a network connection. Reject anything that isn't 0xC00 bytes, doesn't
start with ESP_PARTITION_MAGIC, or is missing the MD5 checksum entry, so
mistakes (wrong file, swapped --file path) surface as a local error
instead of a post-handshake OTA_RESPONSE_ERROR_PARTITION_TABLE_VERIFY.
Includes unit tests covering size, magic, md5-presence, missing-file,
and end-to-end upload_program rejection, plus three real partition
tables checked in as fixtures (ESPHome build, ESP-IDF Hello-world,
esphome_dashboard prebuilt).
Restore tighter feed cadence on ESP8266 to match the smaller WDT
budgets on this platform. ESP8266 soft WDT is ~1.6 s and HW WDT is
~6 s; a single long iteration (mDNS reply, wifi scan, OTA verify,
lwIP TCP retransmit) can easily push the loop past a few hundred ms.
The 300 ms shared default left only ~1.3 s of soft-WDT headroom; 100 ms
restores ~16x margin to the soft WDT (matching pre-#15846 behavior in
spirit) without per-iteration arch_feed_wdt() cost.
Reports of Hardware WDT - Level1Int crashes on ESP8266 line up with
this margin being too tight under the new main-loop cadence.
J. Nick Koston