openeth MAC ISR panics "Cache disabled but cached memory region accessed" when flash is busy (EXCCAUSE 7) (IDFGH-17704)

### Answers checklist.

- [x] I have read the documentation [ESP-IDF Programming Guide](https://docs.espressif.com/projects/esp-idf/en/latest/) and the issue is not addressed there.
- [x] I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
- [x] I have searched the issue tracker for a similar issue and not found a similar issue.

### IDF version.

v6.1-dev-4996-gc1b7f38212

### Espressif SoC revision.

ESP32-U4WDH revision v3.1

### Operating System used.

macOS

### How did you build your project?

Command line with idf.py

### If you are using Windows, please specify command line type.

None

### Development Kit.

QEMU

### Power Supply used.

USB

### What is the expected behavior?

The openeth MAC ISR fires without panicking, even when another task is performing a flash read operation.

### What is the actual behavior?

Guru Meditation Error: Core 0 panic'ed (Cache disabled but cached memory region accessed).
EXCCAUSE: 0x00000007

The ISR (emac_opencores_isr_handler) is registered with ESP_INTR_FLAG_IRAM but calls
ESP_EARLY_LOGW(TAG, ...) where TAG and __func__ are flash-resident strings. When the ISR
fires during a cache-off window (SPI flash op in progress), dereferencing these flash
pointers causes the panic.


### Steps to reproduce.

The bug is reliably triggered in QEMU (qemu-system-xtensa). See attached openeth_repro.zip — a self-contained synthetic reproducer (no networking required):

Registers an ESP_INTR_FLAG_IRAM SW interrupt with the same ISR body as openeth (calls ESP_EARLY_LOGW(TAG, "%s: ...", __func__, ...))
Fires it at 4 kHz via ESP_TIMER_ISR dispatch (hardware timer, independent of FreeRTOS)
A separate task hammers esp_partition_read() in a tight loop — each call disables the cache for the duration of the SPI transfer
Build with CONFIG_REPRO_APPLY_FIX=n (default) → crashes within seconds in QEMU.

Build with CONFIG_REPRO_APPLY_FIX=y → runs indefinitely without crashing.

Tested on real hardware (ESP32-U4WDH v3.1): the crash does not reproduce reliably because the timing window is narrow on real silicon. The code is still incorrect — the %s dereference of flash pointers from an IRAM ISR is undefined behavior whenever the cache is disabled.

### Debug Logs.

```plain
Adding SPI flash device
ets Jul 29 2019 12:21:46

rst:0x1 (POWERON_RESET),boot:0x12 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0030,len:6276
load:0x40078000,len:15716
load:0x40080400,len:4
ho 8 tail 4 room 4
load:0x40080404,len:3860
entry 0x4008063c
I (897) boot: ESP-IDF v5.4 2nd stage bootloader
I (898) boot: compile time May 23 2026 21:31:32
I (898) boot: Multicore bootloader
I (1009) boot: chip revision: v3.0
I (1012) boot.esp32: SPI Speed      : 40MHz
I (1012) boot.esp32: SPI Mode       : DIO
I (1012) boot.esp32: SPI Flash Size : 4MB
I (1026) boot: Enabling RNG early entropy source...
I (1042) boot: Partition Table:
I (1042) boot: ## Label            Usage          Type ST Offset   Length
I (1042) boot:  0 nvs              WiFi data        01 02 00009000 00006000
I (1043) boot:  1 phy_init         RF data          01 01 0000f000 00001000
I (1043) boot:  2 factory          factory app      00 00 00010000 00100000
I (1051) boot: End of partition table
I (1062) esp_image: segment 0: paddr=00010020 vaddr=3f400020 size=09af4h ( 39668) map
I (1110) esp_image: segment 1: paddr=00019b1c vaddr=3ff80000 size=0001ch (    28) load
I (1154) esp_image: segment 2: paddr=00019b40 vaddr=3ffb0000 size=02400h (  9216) load
I (1180) esp_image: segment 3: paddr=0001bf48 vaddr=40080000 size=040d0h ( 16592) load
I (1209) esp_image: segment 4: paddr=00020020 vaddr=400d0020 size=15800h ( 88064) map
I (1251) esp_image: segment 5: paddr=00035828 vaddr=400840d0 size=098c0h ( 39104) load
I (1330) boot: Loaded app from partition at offset 0x10000
I (1330) boot: Disabling RNG early entropy source...
I (1353) cpu_start: Multicore app
I (2522) cpu_start: Pro cpu start user code
I (2523) cpu_start: cpu freq: 160000000 Hz
I (2526) app_init: Application information:
I (2526) app_init: Project name:     openeth_repro
I (2526) app_init: App version:      1
I (2526) app_init: Compile time:     May 23 2026 21:36:34
I (2526) app_init: ELF file SHA256:  bc60f9604...
I (2528) app_init: ESP-IDF:          v5.4
I (2528) efuse_init: Min chip rev:     v0.0
I (2528) efuse_init: Max chip rev:     v3.99 
I (2528) efuse_init: Chip rev:         v3.0
I (2532) heap_init: Initializing. RAM available for dynamic allocation:
I (2535) heap_init: At 3FFAE6E0 len 00001920 (6 KiB): DRAM
I (2535) heap_init: At 3FFB2E00 len 0002D200 (180 KiB): DRAM
I (2536) heap_init: At 3FFE0440 len 00003AE0 (14 KiB): D/IRAM
I (2536) heap_init: At 3FFE4350 len 0001BCB0 (111 KiB): D/IRAM
I (2536) heap_init: At 4008D990 len 00012670 (73 KiB): IRAM
I (2652) spi_flash: detected chip: gd
I (2681) spi_flash: flash io: dio
I (2746) main_task: Started on CPU0
I (2768) main_task: Calling app_main()
I (2768) openeth_repro: openeth IRAM-ISR cache-off bug — synthetic reproducer
I (4911) openeth_repro: buggy ISR registered (ESP_INTR_FLAG_IRAM, LEVEL1, src=SW0)
W (4916) openeth_repro: buggy_isr: RX frame dropped (0x1)
W (4917) openeth_repro: buggy_isr: RX frame dropped (0x2)
W (4918) openeth_repro: buggy_isr: RX frame dropped (0x3)
W (4918) openeth_repro: buggy_isr: RX frame dropped (0x4)
W (4919) openeth_repro: buggy_isr: RX frame dropped (0x5)
W (4919) openeth_repro: buggy_isr: RX frame dropped (0x6)
W (4919) openeth_repro: buggy_isr: RX frame dropped (0x7)
I (491W (4919) openeth_repro: buggy_isr: RX frame dropped (0x8)
W (4920) openeth_repro: buggy_isr: RX frame dropped (0x9)
8) openeth_repro: trW (4920) openeth_repro: buggy_isr: RX frame dropped (0xa)
igger timer started at 4 kHW (4920) openeth_repro: buggy_isr: RX frame dropped (0xb)
z
W (4921) openeth_repro: buggy_isr: RX frame dropped (0xc)
W (4921) openeth_repro: buggy_isr: RX frame dropped (0xd)

W (4921) openeth_repro: buggy_isr: RX frame dropped (0xe)
W (4922) openeth_repro: buggy_isr: RX frame dropped (0xf)
W (4922) openeth_repro: buggy_isr: RX frame dropped (0x10)
W (4922) openeth_repro: buggy_isr: RX frame dropped (0x11)
W (4923) openeth_repro: buggy_isr: RX frame dropped (0x12)
W (4923) openeth_repro: buggy_isr: RX frame dropped (0x13)
W (4923) openeth_repro: buggy_isr: RX frame dropped (0x14)
W (4923) openeth_repro: buggy_isr: RX frame dropped (0x15)
W (4924) openeth_repro: buggy_isr: RX frame dropped (0x16)
W (4924) openeth_repro: buggy_isr: RX frame dropped (0x17)
W (4924) openeth_repro: buggy_isr: RX frame dropped (0x18)
W (4924) openeth_repro: buggy_isr: RX frame dropped (0x19)
W (4925) openeth_repro: buggy_isr: RX frame dropped (0x1a)
W (4925) openeth_repro: buggy_isr: RX frame dropped (0x1b)
W (4925) openeth_repro: buggy_isr: RX frame dropped (0x1c)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x1d)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x1e)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x1f)
I (4926) openeth_repro: flash thrash on factory, size=0x100000
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x20)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x21)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x22)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x23)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x24)
W (4926) openeth_repro: buggy_isr: RX frame dropped (0x25)
Guru Meditation Error: Core  0 panic'ed (Cache disabled but cached memory region accessed). 

Core  0 register dump:
PC      : 0x40008150  PS      : 0x00060034  A0      : 0x80082d96  A1      : 0x3ffb0f90  
A2      : 0x3f403560  A3      : 0x00000000  A4      : 0x00000004  A5      : 0x00000000  
A6      : 0x00000000  A7      : 0x00000000  A8      : 0x00000aba  A9      : 0x3ffb0fe0  
A10     : 0x000000ad  A11     : 0x0024f636  A12     : 0x00000001  A13     : 0x00000000  
A14     : 0x00000000  A15     : 0x3ffb5ea4  SAR     : 0x00000008  EXCCAUSE: 0x00000007  
EXCVADDR: 0x00000000  LBEG    : 0x400014fd  LEND    : 0x4000150d  LCOUNT  : 0xfffffffe  


Backtrace: 0x4000814d:0x3ffb0f90 0x40082d93:0x3ffb1020 0x40083105:0x3ffb1040 0x40089548:0x3ffb7000 0x40083d55:0x3ffb7020 0x40083e2f:0x3ffb7040 0x40084cbb:0x3ffb7060 0x40084cc5:0x3ffb7080 0x4008519b:0x3ffb70a0 0x40084671:0x3ffb70c0 0x400d6c1b:0x3ffb7100 0x400d658a:0x3ffb7130 0x40086d31:0x3ffb7160




ELF file SHA256: bc60f9604

Rebooting...
```

### Diagnostic report archive.

_No response_

### More Information.

_No response_

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

openeth MAC ISR panics "Cache disabled but cached memory region accessed" when flash is busy (EXCCAUSE 7) (IDFGH-17704) #18644

Answers checklist.

IDF version.

Espressif SoC revision.

Operating System used.

How did you build your project?

If you are using Windows, please specify command line type.

Development Kit.

Power Supply used.

What is the expected behavior?

What is the actual behavior?

Steps to reproduce.

Debug Logs.

Diagnostic report archive.

More Information.

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

openeth MAC ISR panics "Cache disabled but cached memory region accessed" when flash is busy (EXCCAUSE 7) (IDFGH-17704) #18644

Description

Answers checklist.

IDF version.

Espressif SoC revision.

Operating System used.

How did you build your project?

If you are using Windows, please specify command line type.

Development Kit.

Power Supply used.

What is the expected behavior?

What is the actual behavior?

Steps to reproduce.

Debug Logs.

Diagnostic report archive.

More Information.

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions