ESP8266 Community Forum

- Sun Jan 17, 2016 11:55 am #39058 I can see from esptool.py the function to read the flash ID:
def flash_id(self):
self.flash_begin(0, 0)
self.write_reg(0x60000240, 0x0, 0xffffffff)
self.write_reg(0x60000200, 0x10000000, 0xffffffff)
flash_id = self.read_reg(0x60000240)
self.flash_finish(False)
return flash_id

Does anyone know how they figured that out?
I can see its:
- Clearing 0x60000240 (W0), where the result of SPI commands is usually stored, I guess clearing it prior to the instruction?
- Writing 0x10000000 to 0x60000200 which I think is the SPI CMD register (rather than using USER/USER1 which I'd have expected). 0x10000000 must be the instruction but I don't know how it can be just one bit.
- Reading the result from 0x60000240 (W0). As expected.

My main question is what is the 0x10000000 and how do we know we can write it to CMD? Is there any documentation of these as I can't find any!

Cheers,
Liam.

- Sun Jan 17, 2016 6:16 pm #39089 I've try to figure things on that subject, but Google didn't help me much here.
Those 0x60000240 and 0x60000200 are a bit of mystery.
They are probably the SPI register, but not documented.
But also, the strange thing is that nowhere in esptool.py we can find this standard 0x9F opcode for reading the FlashID, which is pretty standard way on all those Flash chips.

- Mon Jan 18, 2016 5:27 am #39137 There seems to be some documentation about on how to use the USER/USER1 spi registers to use the SPI peripheral. But as you say this CMD register is completely unknown and esptool must've reverse engineered the routine from an official ESP tool.

I'm guessing the flash ID read command is in a hardware routine behind that 0x10000000 instruction!

- Mon Jan 18, 2016 8:51 am #39146 The 0x10000000 is probably a CMD send to the ROM Firmware, not to SPI directly, because if you look at any official specs of some Flash, like the Winbond W25Q32, you will see that actual CMD for the JedecID of the Flash itself is 0x9F, so writing directly to SPI should be done with 0x9F000000 to read back the 3 bytes of JedecID.