esp32 烧录协议

esp32的rom固化了出场固件。

进入烧录模式后，esp32串口输出：

给esp32烧录固件的时候，需要和rom的bootloder进行通讯。通讯时，使用 SLIP 数据包帧进行双向数据传输。

每个 SLIP 数据包都以 0xC0 开始和结束。 在数据包中，所有出现的 0xC0 和 0xDB 分别替换为 0xDB 0xDC 和 0xDB 0xDD。 替换是在计算校验和和长度后进行的，因此数据包长度可能比下面的大小字段长。

在SLIP通讯协议基础上，衍生出了以下协议：

Command Packet

每个命令都是一个由主机发起的 SLIP 数据包， 数据包由一个header和一个可变长度的主体组成。 小端模式传输。

Byte	Name	Comment
0	Direction	Always 0x00 for requests
1	Command	Command identifier (see Commands).
2-3	Size	Length of Data field, in bytes.
4-7	Checksum	Simple checksum of part of the data field (only used for some commands, see Checksum).
8..n	Data	Variable length data payload (0-65535 bytes, as indicated by Size parameter). Usage depends on specific command.

esp32 rom 支持的命令类型有如下：

Byte	Name	Description	Input Data	Output Data
0x02	FLASH_BEGIN	Begin Flash Download	Four 32-bit words: size to erase, number of data packets, data size in one packet, flash offset.
0x03	FLASH_DATA	Flash Download Data	Four 32-bit words: data size, sequence number, 0, 0, then data. Uses Checksum.
0x04	FLASH_END	Finish Flash Download	One 32-bit word: 0 to reboot, 1 to run user code. Not necessary to send this command if you wish to stay in the loader
0x05	MEM_BEGIN	Begin RAM Download Start	Total size, number of data packets, data size in one packet, memory offset
0x06	MEM_END	Finish RAM Download	Two 32-bit words: execute flag, entry point address
0x07	MEM_DATA	RAM Download Data	Four 32-bit words: data size, sequence number, 0, 0, then data. Uses Checksum.
0x08	SYNC	Sync Frame	36 bytes: 0x07 0x07 0x12 0x20, followed by 32 x 0x55
0x09	WRITE_REG	Write 32-bit memory address	Four 32-bit words: address, value, mask and delay (in microseconds)
0x0a	READ_REG	Read 32-bit memory address	Address as 32-bit word	Read data as 32-bit word in value field.
0x0b	SPI_SET_PARAMS	Configure SPI flash	Six 32-bit words: id, total size in bytes, block size, sector size, page size, status mask.
0x0d	SPI_ATTACH	Attach SPI flash	32-bit word: Zero for normal SPI flash. A second 32-bit word (should be 0) is passed to ROM loader only.
0x0f	CHANGE_BAUDRATE	Change Baud rate	Two 32-bit words: new baud rate, 0 if we are talking to the ROM loader or the current/old baud rate if we are talking to the stub loader.
0x10	FLASH_DEFL_BEGIN	Begin compressed flash download	Four 32-bit words: uncompressed size, number of data packets, data packet size, flash offset. With stub loader the uncompressed size is exact byte count to be written, whereas on ROM bootloader it is rounded up to flash erase block size.
0x11	FLASH_DEFL_DATA	Compressed flash download data	Four 32-bit words: data size, sequence number, 0, 0, then data. Uses Checksum.	Error code 0xC1 on checksum error.
0x12	FLASH_DEFL_END	End compressed flash download	One 32-bit word: 0 to reboot, 1 to run user code. Not necessary to send this command if you wish to stay in the loader.
0x13	SPI_FLASH_MD5	Calculate MD5 of flash region	Four 32-bit words: address, size, 0, 0	Body contains 16 raw bytes of MD5 followed by 2 status bytes (stub loader) or 32 hex-coded ASCII (ROM loader) of calculated MD5

Response Packet

Byte	Name	Comment
0	Direction	Always 0x01 for responses
1	Command	Same value as Command identifier in the request packet that trigged the response
2-3	Size	Size of data field. At least the length of the Status Bytes (2 or 4 bytes, see below).
4-7	Value	Response value used by READ_REG command (see below). Zero otherwise.
8..n	Data	Variable length data payload. Length indicated by “Size” field.

The final bytes of the Data payload indicate command status

对于 ESP32 ROM最后四个字节被使用，但只有前两个字节包含状态信息：

Byte	Name	Comment
Size-4	Status	Status flag, success (0) or failure (1)
Size-3	Error	If Status 1, this indicates the type of error.
Size-2	Reserved
Size-1	Reserved

ROM Loader Errors 枚举

Value	Meaning
0x05	“Received message is invalid” (parameters or length field is invalid)
0x06	“Failed to act on received message”
0x07	“Invalid CRC in message”
0x08	“Flash write error” - after writing a block of data to flash, the ROM loader reads the value back and the 8-bit CRC is compared to the data read from flash. If they don’t match, this error is returned.
0x09	“Flash read error” - SPI read failed
0x0a	“Flash read length error” - SPI read request length is too long
0x0b	“Deflate error” (compressed uploads only)

reff：

https://docs.espressif.com/projects/esptool/en/latest/esp32/advanced-topics/index.html

https://github.com/espressif/esp-serial-flasher

https://github.com/espressif/esptool