OTA failure

[ndjurov]

I just tried my first OTA update using TCP sockets to transfer the new 1.7MB large binary.
Everything looks good until esp_ota_end() is called. This is where the application crashes.
Some relevant entries from the log are:

I (41) boot.esp32: SPI Speed : 40MHz
I (46) boot.esp32: SPI Mode : DIO
I (51) boot.esp32: SPI Flash Size : 16MB
I (877) cpu_start: Single core mode

I (853) cpu_start: App version: Version_1.0-22-g6df8174-dirty
I (860) cpu_start: Compile time: Nov 23 2021 16:33:04
I (866) cpu_start: ELF file SHA256: 7be1f490b84926a7...
I (872) cpu_start: ESP-IDF: v4.1-dirty

I (64) boot: ## Label Usage Type ST Offset Length
I (71) boot: 0 nvs WiFi data 01 02 00009000 00006000
I (79) boot: 1 phy_init RF data 01 01 0000f000 00001000
I (86) boot: 2 otadata OTA data 01 00 00010000 00002000
I (94) boot: 3 ota0 OTA app 00 10 00020000 00400000
I (101) boot: 4 ota1 OTA app 00 11 00420000 00400000
I (109) boot: 5 ffat Unknown data 01 81 00820000 00740000
I (116) boot: End of partition table

As you can see, app partitions are 4MB in size. After reading some online posts, I changed the size of the app partitions to 2MB, but the application keeps crashing. I also tried to limit Free-RTOS to only one core but it didn't help.

More relevant information from the log:

I (95507) esp_image: segment 0: paddr=0x00420020 vaddr=0x3f400020 size=0xa0ac4 (658116) map
E (95517) bootloader_mmap: spi_flash_mmap failed: 0x101
E (95527) esp_image: bootloader_mmap(0x420020, 0xa0ac4) failed
Guru Meditation Error: Core 0 panic'ed (LoadProhibited). Exception was unhandled.

These entries show the call stack just before the failure:

0x40081ecc: find_containing_heap at C:/ESP-IDF/IDF/components/heap/heap_caps.c:249
0x40081ec9: find_containing_heap at C:/ESP-IDF/IDF/components/heap/heap_caps.c:248
0x4008206f: heap_caps_free at C:/ESP-IDF/IDF/components/heap/heap_caps.c:270
0x40094eed: free at C:/ESP-IDF/IDF/components/newlib/heap.c:47
0x4014115a: bootloader_sha256_finish at C:/ESP-IDF/IDF/components/bootloader_support/src/idf/bootloader_sha.c:53
0x4014102d: image_load at C:/ESP-IDF/IDF/components/bootloader_support/src/esp_image_format.c:299
0x40141059: esp_image_verify at C:/ESP-IDF/IDF/components/bootloader_support/src/esp_image_format.c:326
0x401400d5: esp_ota_end at C:/ESP-IDF/IDF/components/app_update/esp_ota_ops.c:293
0x400d9b00: OC_EndOTA at c:\users\ndjuricic\desktop\esp\eimctrl\build/../main/OTA/OTACtrl.c:78
0x400edaf2: TS_TcpRxFile at c:\users\ndjuricic\desktop\esp\eimctrl\build/../main/TCP/EimTcpServer.c:576
0x400d936d: S_ProcessCmd at c:\users\ndjuricic\desktop\esp\eimctrl\build/../main/EIMctrl.c:1935


As you may expect, I really don't know what else to try so I would really appreciate any suggestions you may have.
Thank you.

[ndjurov]

Any ideas and/or suggestions?

[ESP_Mahavir]

E (95517) bootloader_mmap: spi_flash_mmap failed: 0x101

This error points to `ESP_ERR_NO_MEM`. In the context of `spi_flash_mmap` it can occur because of dynamic allocation failure or insufficient pages to map the address range.

Following items might help here:

1. Please check that there is sufficient dynamic memory available for application
2. Please dump spi flash mappings using `spi_flash_mmap_dump` API

Additional questions:
1. Please share debug/verbose enabled log and share details like IDF version etc.
2. Does this problem also occur with IDF provided OTA examples?

Hope this helps.

Mahavir

[ndjurov]

Thank you very much,

I enabled the verbose logging and run spi_flash_mmap_dump just before calling esp_ota_end().
This is what I got:

I (93291) Mmap dump:

page 0: refcnt=1 paddr=2
page 1: refcnt=1 paddr=3
page 2: refcnt=1 paddr=4
page 3: refcnt=1 paddr=5
page 4: refcnt=1 paddr=6
page 5: refcnt=1 paddr=7
page 6: refcnt=1 paddr=8
page 7: refcnt=1 paddr=9
page 8: refcnt=1 paddr=10
page 9: refcnt=1 paddr=11
page 10: refcnt=1 paddr=12
page 11: refcnt=1 paddr=13
page 77: refcnt=1 paddr=14
page 78: refcnt=1 paddr=15
page 79: refcnt=1 paddr=16
page 80: refcnt=1 paddr=17
page 81: refcnt=1 paddr=18
page 82: refcnt=1 paddr=19
page 83: refcnt=1 paddr=20
page 84: refcnt=1 paddr=21
page 85: refcnt=1 paddr=22
page 86: refcnt=1 paddr=23
page 87: refcnt=1 paddr=24
page 88: refcnt=1 paddr=25
page 89: refcnt=1 paddr=26
page 90: refcnt=1 paddr=27
page 91: refcnt=1 paddr=28
page 92: refcnt=1 paddr=29

I (93351) Mmap dump done.

and after that I got:

D (93361) esp_image: reading image header @ 0x220000
D (93371) esp_image: image header: 0xe9 0x06 0x02 0x04 400813b0
V (93381) esp_image: loading segme***ERROR*** A stack overflow in task EIM_server has been detected.
abort() was called at PC 0x4008d598 on core 0

ELF file SHA256: 716b2a587974000e

Backtrace: 0x4008d1e9:0x3ffdcdd0 0x4008d581:0x3ffdcdf0 0x4008d598:0x3ffdce10 0x4008fb6b:0x3ffdce30 0x4008ec68:0x3ffdce50 0x4008ec1e:0x00000000 |<-CORRUPTED

CPU halted.

ESP-IDF version is"

cpu_start: ESP-IDF: v4.1-dirty

I don't know how to check available dynamic memory to check if it's sufficient for the application.

I'm trying to configure ESP-Prog based debugging in VS Code that I'm using, and after that I will try the OTA example.
Maybe it is worth mentioning that the application initializes BLE but not using it for the communication. I will also try OTA without BLE being initialized.

I hope this log tells you more than it does to me.

Thanks a lot.

[ndjurov]

I'm not sure if it helps, but here is the power-up portion of the log:

rst:0x1 (POWERON_RESET),boot:0x12 (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff0030,len:4
load:0x3fff0034,len:6872
load:0x40078000,len:13072
ho 0 tail 12 room 4
load:0x40080400,len:3896
entry 0x40080688
I (31) boot: ESP-IDF v4.1-dirty 2nd stage bootloader
I (31) boot: compile time 09:29:39
I (31) boot: chip revision: 3
I (34) boot_comm: chip revision: 3, min. bootloader chip revision: 0
I (41) boot.esp32: SPI Speed : 40MHz
I (46) boot.esp32: SPI Mode : DIO
I (51) boot.esp32: SPI Flash Size : 16MB
I (55) boot: Enabling RNG early entropy source...
I (61) boot: Partition Table:
I (64) boot: ## Label Usage Type ST Offset Length
I (71) boot: 0 nvs WiFi data 01 02 00009000 00006000
I (79) boot: 1 phy_init RF data 01 01 0000f000 00001000
I (86) boot: 2 otadata OTA data 01 00 00010000 00002000
I (94) boot: 3 ota0 OTA app 00 10 00020000 00200000
I (101) boot: 4 ota1 OTA app 00 11 00220000 00200000
I (109) boot: 5 ffat Unknown data 01 81 00420000 00900000
I (116) boot: End of partition table
I (121) boot_comm: chip revision: 3, min. application chip revision: 0
I (128) esp_image: segment 0: paddr=0x00020020 vaddr=0x3f400020 size=0xb20b0 (729264) map
I (415) esp_image: segment 1: paddr=0x000d20d8 vaddr=0x3ffbdb60 size=0x04528 ( 17704) load
I (422) esp_image: segment 2: paddr=0x000d6608 vaddr=0x40080000 size=0x00404 ( 1028) load
I (423) esp_image: segment 3: paddr=0x000d6a14 vaddr=0x40080404 size=0x09604 ( 38404) load
I (447) esp_image: segment 4: paddr=0x000e0020 vaddr=0x400d0020 size=0xf9698 (1021592) map
I (836) esp_image: segment 5: paddr=0x001d96c0 vaddr=0x40089a08 size=0x131b4 ( 78260) load
I (886) boot: Loaded app from partition at offset 0x20000
I (886) boot: Disabling RNG early entropy source...
I (886) cpu_start: Pro cpu up.
I (890) cpu_start: Application information:
I (895) cpu_start: Project name: EIMctrl
I (899) cpu_start: App version: Version_1.0-22-g6df8174-dirty
I (906) cpu_start: Compile time: Nov 25 2021 09:57:25
I (912) cpu_start: ELF file SHA256: 716b2a587974000e...
I (918) cpu_start: ESP-IDF: v4.1-dirty
I (924) cpu_start: Single core mode
V (928) memory_layout: reserved range is 0x3f4b2098 - 0x3f4b20d0
D (934) memory_layout: Checking 9 reserved memory ranges:
D (939) memory_layout: Reserved memory range 0x3ffae000 - 0x3ffae6e0
D (946) memory_layout: Reserved memory range 0x3ffae6e0 - 0x3ffaff10
D (952) memory_layout: Reserved memory range 0x3ffb0000 - 0x3ffb6388
D (959) memory_layout: Reserved memory range 0x3ffb8000 - 0x3ffb9a20
D (965) memory_layout: Reserved memory range 0x3ffbdb28 - 0x3ffbdb5c
D (971) memory_layout: Reserved memory range 0x3ffbdb60 - 0x3ffd3ae8
D (978) memory_layout: Reserved memory range 0x3ffe0000 - 0x3ffe0440
D (984) memory_layout: Reserved memory range 0x40070000 - 0x40078000
D (991) memory_layout: Reserved memory range 0x40080000 - 0x4009cbbc
D (997) memory_layout: Building list of available memory regions:
V (1003) memory_layout: Examining memory region 0x3ffae000 - 0x3ffb0000
V (1010) memory_layout: Start of region 0x3ffae000 - 0x3ffb0000 overlaps reserved 0x3ffae000 - 0x3ffae6e0
V (1020) memory_layout: Start of region 0x3ffae6e0 - 0x3ffb0000 overlaps reserved 0x3ffae6e0 - 0x3ffaff10
D (1029) memory_layout: Available memory region 0x3ffaff10 - 0x3ffb0000
V (1036) memory_layout: Examining memory region 0x3ffb0000 - 0x3ffb8000
V (1043) memory_layout: Start of region 0x3ffb0000 - 0x3ffb8000 overlaps reserved 0x3ffb0000 - 0x3ffb6388
D (1052) memory_layout: Available memory region 0x3ffb6388 - 0x3ffb8000
V (1059) memory_layout: Examining memory region 0x3ffb8000 - 0x3ffc0000
V (1066) memory_layout: Start of region 0x3ffb8000 - 0x3ffc0000 overlaps reserved 0x3ffb8000 - 0x3ffb9a20
V (1075) memory_layout: Region 0x3ffb9a20 - 0x3ffc0000 contains reserved 0x3ffbdb28 - 0x3ffbdb5c
D (1084) memory_layout: Available memory region 0x3ffb9a20 - 0x3ffbdb28
V (1091) memory_layout: Examining memory region 0x3ffbdb5c - 0x3ffc0000
V (1097) memory_layout: End of region 0x3ffbdb5c - 0x3ffc0000 overlaps reserved 0x3ffbdb60 - 0x3ffd3ae8
D (1107) memory_layout: Available memory region 0x3ffbdb5c - 0x3ffbdb60
V (1114) memory_layout: Examining memory region 0x3ffc0000 - 0x3ffc2000
V (1120) memory_layout: Region 0x3ffc0000 - 0x3ffc2000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1129) memory_layout: Examining memory region 0x3ffc2000 - 0x3ffc4000
V (1136) memory_layout: Region 0x3ffc2000 - 0x3ffc4000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1145) memory_layout: Examining memory region 0x3ffc4000 - 0x3ffc6000
V (1152) memory_layout: Region 0x3ffc4000 - 0x3ffc6000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1160) memory_layout: Examining memory region 0x3ffc6000 - 0x3ffc8000
V (1167) memory_layout: Region 0x3ffc6000 - 0x3ffc8000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1176) memory_layout: Examining memory region 0x3ffc8000 - 0x3ffca000
V (1183) memory_layout: Region 0x3ffc8000 - 0x3ffca000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1192) memory_layout: Examining memory region 0x3ffca000 - 0x3ffcc000
V (1198) memory_layout: Region 0x3ffca000 - 0x3ffcc000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1207) memory_layout: Examining memory region 0x3ffcc000 - 0x3ffce000
V (1214) memory_layout: Region 0x3ffcc000 - 0x3ffce000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1223) memory_layout: Examining memory region 0x3ffce000 - 0x3ffd0000
V (1230) memory_layout: Region 0x3ffce000 - 0x3ffd0000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1239) memory_layout: Examining memory region 0x3ffd0000 - 0x3ffd2000
V (1245) memory_layout: Region 0x3ffd0000 - 0x3ffd2000 inside of reserved 0x3ffbdb60 - 0x3ffd3ae8
V (1254) memory_layout: Examining memory region 0x3ffd2000 - 0x3ffd4000
V (1261) memory_layout: Start of region 0x3ffd2000 - 0x3ffd4000 overlaps reserved 0x3ffbdb60 - 0x3ffd3ae8
D (1271) memory_layout: Available memory region 0x3ffd3ae8 - 0x3ffd4000
V (1277) memory_layout: Examining memory region 0x3ffd4000 - 0x3ffd6000
D (1284) memory_layout: Available memory region 0x3ffd4000 - 0x3ffd6000
V (1291) memory_layout: Examining memory region 0x3ffd6000 - 0x3ffd8000
D (1297) memory_layout: Available memory region 0x3ffd6000 - 0x3ffd8000
V (1304) memory_layout: Examining memory region 0x3ffd8000 - 0x3ffda000
D (1311) memory_layout: Available memory region 0x3ffd8000 - 0x3ffda000
V (1317) memory_layout: Examining memory region 0x3ffda000 - 0x3ffdc000
D (1324) memory_layout: Available memory region 0x3ffda000 - 0x3ffdc000
V (1331) memory_layout: Examining memory region 0x3ffdc000 - 0x3ffde000
D (1337) memory_layout: Available memory region 0x3ffdc000 - 0x3ffde000
V (1344) memory_layout: Examining memory region 0x3ffde000 - 0x3ffe0000
D (1351) memory_layout: Available memory region 0x3ffde000 - 0x3ffe0000
V (1357) memory_layout: Examining memory region 0x3ffe0000 - 0x3ffe4000
V (1364) memory_layout: Start of region 0x3ffe0000 - 0x3ffe4000 overlaps reserved 0x3ffe0000 - 0x3ffe0440
D (1374) memory_layout: Available memory region 0x3ffe0440 - 0x3ffe4000
V (1380) memory_layout: Examining memory region 0x3ffe4000 - 0x3ffe8000
D (1387) memory_layout: Available memory region 0x3ffe4000 - 0x3ffe8000
V (1394) memory_layout: Examining memory region 0x3ffe8000 - 0x3fff0000
D (1400) memory_layout: Available memory region 0x3ffe8000 - 0x3fff0000
V (1407) memory_layout: Examining memory region 0x3fff0000 - 0x3fff8000
D (1414) memory_layout: Available memory region 0x3fff0000 - 0x3fff8000
V (1421) memory_layout: Examining memory region 0x3fff8000 - 0x3fffc000
D (1427) memory_layout: Available memory region 0x3fff8000 - 0x3fffc000
V (1434) memory_layout: Examining memory region 0x3fffc000 - 0x40000000
D (1441) memory_layout: Available memory region 0x3fffc000 - 0x40000000
V (1447) memory_layout: Examining memory region 0x40070000 - 0x40078000
V (1454) memory_layout: Region 0x40070000 - 0x40078000 inside of reserved 0x40070000 - 0x40078000
V (1463) memory_layout: Examining memory region 0x40078000 - 0x40080000
D (1470) memory_layout: Available memory region 0x40078000 - 0x40080000
V (1476) memory_layout: Examining memory region 0x40080000 - 0x40082000
V (1483) memory_layout: Region 0x40080000 - 0x40082000 inside of reserved 0x40080000 - 0x4009cbbc
V (1492) memory_layout: Examining memory region 0x40082000 - 0x40084000
V (1499) memory_layout: Region 0x40082000 - 0x40084000 inside of reserved 0x40080000 - 0x4009cbbc
V (1508) memory_layout: Examining memory region 0x40084000 - 0x40086000
V (1514) memory_layout: Region 0x40084000 - 0x40086000 inside of reserved 0x40080000 - 0x4009cbbc
V (1523) memory_layout: Examining memory region 0x40086000 - 0x40088000
V (1530) memory_layout: Region 0x40086000 - 0x40088000 inside of reserved 0x40080000 - 0x4009cbbc
V (1539) memory_layout: Examining memory region 0x40088000 - 0x4008a000
V (1545) memory_layout: Region 0x40088000 - 0x4008a000 inside of reserved 0x40080000 - 0x4009cbbc
V (1554) memory_layout: Examining memory region 0x4008a000 - 0x4008c000
V (1561) memory_layout: Region 0x4008a000 - 0x4008c000 inside of reserved 0x40080000 - 0x4009cbbc
V (1570) memory_layout: Examining memory region 0x4008c000 - 0x4008e000
V (1577) memory_layout: Region 0x4008c000 - 0x4008e000 inside of reserved 0x40080000 - 0x4009cbbc
V (1586) memory_layout: Examining memory region 0x4008e000 - 0x40090000
V (1592) memory_layout: Region 0x4008e000 - 0x40090000 inside of reserved 0x40080000 - 0x4009cbbc
V (1601) memory_layout: Examining memory region 0x40090000 - 0x40092000
V (1608) memory_layout: Region 0x40090000 - 0x40092000 inside of reserved 0x40080000 - 0x4009cbbc
V (1617) memory_layout: Examining memory region 0x40092000 - 0x40094000
V (1624) memory_layout: Region 0x40092000 - 0x40094000 inside of reserved 0x40080000 - 0x4009cbbc
V (1633) memory_layout: Examining memory region 0x40094000 - 0x40096000
V (1639) memory_layout: Region 0x40094000 - 0x40096000 inside of reserved 0x40080000 - 0x4009cbbc
V (1648) memory_layout: Examining memory region 0x40096000 - 0x40098000
V (1655) memory_layout: Region 0x40096000 - 0x40098000 inside of reserved 0x40080000 - 0x4009cbbc
V (1664) memory_layout: Examining memory region 0x40098000 - 0x4009a000
V (1670) memory_layout: Region 0x40098000 - 0x4009a000 inside of reserved 0x40080000 - 0x4009cbbc
V (1679) memory_layout: Examining memory region 0x4009a000 - 0x4009c000
V (1686) memory_layout: Region 0x4009a000 - 0x4009c000 inside of reserved 0x40080000 - 0x4009cbbc
V (1695) memory_layout: Examining memory region 0x4009c000 - 0x4009e000
V (1702) memory_layout: Start of region 0x4009c000 - 0x4009e000 overlaps reserved 0x40080000 - 0x4009cbbc
D (1711) memory_layout: Available memory region 0x4009cbbc - 0x4009e000
V (1718) memory_layout: Examining memory region 0x4009e000 - 0x400a0000
D (1725) memory_layout: Available memory region 0x4009e000 - 0x400a0000
I (1731) heap_init: Initializing. RAM available for dynamic allocation:
D (1739) heap_init: New heap initialised at 0x3ffaff10
I (1744) heap_init: At 3FFAFF10 len 000000F0 (0 KiB): DRAM
D (1750) heap_init: New heap initialised at 0x3ffb6388
I (1755) heap_init: At 3FFB6388 len 00001C78 (7 KiB): DRAM
D (1761) heap_init: New heap initialised at 0x3ffb9a20
I (1767) heap_init: At 3FFB9A20 len 00004108 (16 KiB): DRAM
I (1773) heap_init: At 3FFBDB5C len 00000004 (0 KiB): DRAM
D (1779) heap_init: New heap initialised at 0x3ffd3ae8
I (1784) heap_init: At 3FFD3AE8 len 0000C518 (49 KiB): DRAM
I (1791) heap_init: At 3FFE0440 len 0001FBC0 (126 KiB): D/IRAM
D (1797) heap_init: New heap initialised at 0x40078000
I (1802) heap_init: At 40078000 len 00008000 (32 KiB): IRAM
D (1808) heap_init: New heap initialised at 0x4009cbbc
I (1814) heap_init: At 4009CBBC len 00003444 (13 KiB): IRAM
I (1820) cpu_start: Pro cpu start user code
D (1832) clk: RTC_SLOW_CLK calibration value: 3347827
V (1841) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): checking args
V (1842) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): Args okay. Resulting flags 0xE
D (1847) intr_alloc: Connected src 46 to int 2 (cpu 0)
V (1852) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): checking args
V (1858) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): Args okay. Resulting flags 0xC0E
D (1867) intr_alloc: Connected src 57 to int 3 (cpu 0)
V (1872) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): checking args
V (1878) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): Args okay. Resulting flags 0x40E
D (1886) intr_alloc: Connected src 24 to int 9 (cpu 0)
D (1892) FLASH_HAL: extra_dummy: 1
V (1895) memspi: raw_chip_id: 1840C8

V (1899) memspi: chip_id: C84018

V (1902) memspi: raw_chip_id: 1840C8

V (1906) memspi: chip_id: C84018

D (1910) spi_flash: trying chip: issi
D (1914) spi_flash: trying chip: gd
I (1917) spi_flash: detected chip: gd
I (1921) spi_flash: flash io: dio
D (1925) chip_generic: set_io_mode: status before 0x0
V (1930) chip_generic: set_io_mode: status update 0x0
I (1936) cpu_start: Starting scheduler on PRO CPU.
D (1941) heap_init: New heap initialised at 0x3ffe0440
V (1941) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): checking args
V (1941) intr_alloc: esp_intr_alloc_intrstatus (cpu 0): Args okay. Resulting flags 0xE
D (1941) intr_alloc: Connected src 16 to int 12 (cpu 0)
D (1961) partition: Loading the partition table

[ndjurov]

Just to report that disabling the BLE initialization in the application didn't help to complete the OTA.
Thanks.

[ESP_laukik-hase]

Hello,

Could you check out Heap Memory Debugging in IDF? (https://docs.espressif.com/projects/esp ... debug.html)

You can use the following functions for finding out the dynamic memory available:

Code: Select all

/* Set caps = MALLOC_CAP_8BIT for getting the free (data memory) heap */
size_t heap_caps_get_free_size(uint32_t caps) // returns the current free memory
size_t heap_caps_get_largest_free_block(uint32_t caps) // returns the largest block of free memory available
size_t heap_caps_get_minimum_free_size(uint32_t caps) // returns the lowest value of free memory available since boot

Also, could you please post the logs after running the ESP-IDF v4.1 provided OTA examples? This could help us understand the issue further.

Thanks,
Laukik

[ndjurov]

I added these three function calls and this is what they return:

Before OTA Starts:
Mem: Free = 94460, MinAvail = 84988, MaxBlock = 91508.

Just before esp_ota_end() is called and the application crashes.
Mem: Free = 101328, MinAvail = 84988, MaxBlock = 100008.

I was hoping to be able to use the JTAG debugger to help me find the issue so I didn't try the OTA example yet. However, I'm having some issues getting the debugger to work, so I'll try the example soon and let you know how it goes.

Thanks a lot.

[ndjurov]

Since I kept getting this OTA failure, I decided to try to debug it and get more information about the errors, although I probably wouldn't know what to do with it as the failure happens on system level. So I tried to configure a cppgdb debugger and I first got some extension configuration errors (https://www.esp32.com/viewtopic.php?f=40&t=24597) followed by some OpenOCD and gdb errors (https://github.com/espressif/openocd-esp32/issues/197). I then realized that there is another way to debug - using ESP Debug Adapter, but then I got ESP-IDF Debug Adapter configuration errors (https://www.esp32.com/viewtopic.php?f=40&t=24739).
Could you please give me some suggestion where to go from here?
The main problem is still OTA failure, although I would definitely love to have the debugger working correctly.

[ndjurov]

The problem is now fixed and this is just an update that may be useful to someone in the future.
Like I said earlier - our OTA is done via TCP sockets. In order to receive data we created a buffer on the stack. Now, when I know where to look, I know that at that point the remaining stack for this task was around 400 bytes. It looks like esp_ota_end() used them all so we ended up overflowing the task stack. Getting the buffer from the heap fixed the problem.