--no-stub
to esptool.py in order to disable the software stub loader.0xC0
. Within the packet, all occurrences of 0xC0
and 0xDB
are replaced with 0xDB 0xDC
and 0xDB 0xDD
, respectively.Byte | Name | Comment |
---|---|---|
0 | Direction | Always 0x00 for requests |
1 | Command | Command identifier (see Command Opcodes). |
2-3 | Size | Length of Data field, in bytes. |
4-7 | Checksum | Simple checksum of part of the data field (only used for some commands, see Checksum). |
8..n | Data | Variable length data payload (0-65535 bytes, as indicated by Size parameter). Usage depends on specific command. |
Byte | Name | Comment |
---|---|---|
0 | Direction | Always 0x01 for responses |
1 | Command | Same value as Command identifier in the request packet that trigged the response |
2-3 | Size | Size of data field. At least the length of the status bytes (2 or 4 bytes, see below). |
4-7 | Value | Response value used by READ_REG command (see below). Zero otherwise. |
8..n | Data | Variable length data payload. Length indicated by 'Size' field. |
Byte | Name | Comment |
---|---|---|
Size-2 | Status | Status flag, success (0 ) or failure (1 ) |
Size-1 | Error | If Status is 1, this indicates the type of error. |
Byte | Name | Comment |
---|---|---|
Size-4 | Status | Status flag, success (0 ) or failure (1 ) |
Size-3 | Error | If Status 1, this indicates the type of error. |
Size-2 | Reserved | |
Size-1 | Reserved |
0xC*
, or 0xFF
for 'unimplemented command'. (Full list here).Byte | Name | Description | Input Data | Output Data |
---|---|---|---|---|
0x02 | FLASH_BEGIN | Begin Flash Download | Four 32-bit words: size to erase, number of data packets, data size in one packet, flash offset. | |
0x03 | FLASH_DATA | Flash Download Data | Four 32-bit words: data size, sequence number, 0 , 0 , then data. Uses Checksum. | |
0x04 | FLASH_END | Finish Flash Download | One 32-bit word: 0 to reboot, 1 to stay in loader. | |
0x05 | MEM_BEGIN | Begin RAM Download Start | total size, number of data packets, data size in one packet, memory offset | |
0x06 | MEM_END | Finish RAM Download | Two 32-bit words: execute flag, entry point address | |
0x07 | MEM_DATA | RAM Download Data | Four 32-bit words: data size, sequence number, 0 , 0 , then data. Uses Checksum. | |
0x08 | SYNC | Sync Frame | 36 bytes: 0x07 0x07 0x12 0x20 , followed by 32 x 0x55 | |
0x09 | WRITE_REG | Write 32-bit memory address | Four 32-bit words: address, value, mask and delay (in microseconds) | |
0x0a | READ_REG | Read 32-bit memory address | Address as 32-bit word | Read data as 32-bit word in value field. |
Byte | Name | Description | Input Data | Output Data |
---|---|---|---|---|
0x0b | SPI_SET_PARAMS | Configure SPI flash | Six 32-bit words: id, total size in bytes, block size, sector size, page size, status mask. | |
0x0d | SPI_ATTACH | Attach SPI flash | 32-bit word: Zero for normal SPI flash. A second 32-bit word (should be 0 ) is passed to ESP32 ROM loader only. | |
0x0f | CHANGE_BAUDRATE | Change Baud rate | Two 32-bit words: new baud rate, 0 if we are talking to the ROM flasher or the current/old baud rate if we are talking to the software stub flasher. | |
0x10 | FLASH_DEFL_BEGIN | Begin compressed flash download | Four 32-bit words: uncompressed size, number of data packets, data packet size, flash offset. With stub loader the uncompressed size is exact byte count to be written, whereas on ROM bootloader it is rounded up to flash erase block size. | |
0x11 | FLASH_DEFL_DATA | Compressed flash download data | Four 32-bit words: data size, sequence number, 0 , 0 , then data. Uses Checksum. | Error code 0xC1 on checksum error. |
0x12 | FLASH_DEFL_END | End compressed flash download | One 32-bit word: 0 to reboot, 1 to stay in loader. | |
0x13 | SPI_FLASH_MD5 | Calculate MD5 of flash region | Four 32-bit words: address, size, 0 , 0 | Body contains 16 raw bytes (stub loader) or 32 hex-coded ASCII (ROM loader) of calculated MD5 |
Byte | Name | Descripton | Input | Output |
---|---|---|---|---|
0xd0 | ERASE_FLASH | Erase entire flash chip | ||
0xd1 | ERASE_REGION | Erase flash region | Two 32-bit words: flash offset to erase, erase size in bytes. Both must be multiples of flash sector size. | |
0xd2 | READ_FLASH | Read flash | Four 32-bit words: flash offset, read length, flash sector size, read packet size, maximum number of un-acked packets | |
0xd3 | RUN_USER_CODE | Exits loader and runs user code |
_DATA
command packets has the same 'data payload' format:Bytes | Name | Format |
---|---|---|
0-3 | 'Data to write' length | Little endian 32-bit word. |
4-7 | Sequence number | Little endian 32-bit word. The sequence numbers are 0 based. |
8-15 | 0 | Two words of all zeroes, unused. |
16- | 'Data to write' | Length given at beginning of payload. |
0xC0 0x4F 0x48 0x41 0x49 0xC0
), indicating that it is now running. This is the only unsolicited packet ever sent by the ESP. If the --no-stub
argument is supplied to esptool.py, this entire step is skipped.ESP8266ROM.get_erase_size()
function in esptool.py for the algorithm which works around this bug and provides the correct erase size parameter to send to the ESP8266.Value | Meaning |
---|---|
0 | Default SPI flash interface |
1 | HSPI interface |
(other values) | (ESP32 only) Pin numbers as 6-bit values, packed into a 30-bit value. Order (from MSB): HD pin, Q pin, D pin, CS pin, CLK pin. |
SPI_PAD_CONFIG_xxx
efuses (if unset, these efuses are all zero and the default SPI flash pins given in the datasheet are used.)SPI_PAD_CONFIG_xxx
efuses.--trace
option which can be supplied in the first group of arguments (before the command). This will dump all traffic sent and received via the serial port to the console.--no-stub --trace
to see interactions with the chip's built-in ROM loader only.