2015年12月5日 (六) 15:54的版本

1 ESP8266 启动

Reset 入口在： 0x40000080

ESP8266 启动时，将从 UART0 以波特率 74880 打印：

 ets Jan  8 2013,rst cause:2, boot mode:(3,6)

load 0x40100000, len 30372, room 16 
tail 4
chksum 0xe6
load 0x3ffe8000, len 900, room 4 
tail 0
chksum 0x0a
load 0x3ffe8388, len 392, room 8 
tail 0
chksum 0x14
csum 0x14

Reset Cause

1 ---> Power On
2 ---> External Reset
4 ---> Hardware Watchdog Reset

chksum 与 csum 值相等，表示启动过程中 Flash 读取正确

写入时：

localhost:hello comcat$ ls -l build/
total 1488
-rw-r--r--  1 comcat  staff   31712 12  5 11:09 0x00000.bin
-rw-r--r--  1 comcat  staff  190596 12  5 11:09 0x40000.bin
-rwxr-xr-x  1 comcat  staff  516521 12  5 11:09 app.out
-rw-r--r--  1 comcat  staff    4632 12  5 11:09 app_app.a
-rw-r--r--  1 comcat  staff    4480 12  5 11:09 main.o
localhost:hello comcat$ make flash
../../../toolchain/bin/esptool -cd nodemcu -cb 115200 -cp /dev/cu.SLAB_USBtoUART -ca 0x00000 -cf build/0x00000.bin
    -ca 0x40000 -cf build/0x40000.bin
Uploading 31712 bytes from build/0x00000.bin to flash at 0x00000000
...............................
Uploading 190596 bytes from build/0x40000.bin to flash at 0x00040000
.................................................................................................................

2 Boot Mode

ESP8266 Reset 后，通过判断如下管脚的状态来决定启动模式：

MTDO 	GPIO0 	GPIO2 	Mode 	Description
L 	L 	H 	UART 	串口刷机
L 	H 	H 	Flash 	SPI Flash 正常启动
H 	x 	x 	SDIO 	SD-card 启动

MTDO 为 GPIO15

启动时串口输出的 'boot mode:(x, y)' ， x 的低三位对应 {MTDO, GPIO0, GPIO2}

3 代码流程

ResetHandler (0x40000080)

    Set interrupt level 1
    Set processor modes (see separate section)
    Copy SROM data to SRAM
    Goto _start

_start

    Set Ring 0
    Clear callback vector
    Set up stack at 3FFFFFFFh
    Call main

main

    Initialize UART0
        115,200 bps, 8N1
        iomux.u0txd &= 0xE4F
        iomux.gpio2 = (iomux.gpio2 & 0xECF) | 0x100

Processor Modes

    Only Ring 0 used
    TLBs (D and I) are set to
        00000000h-1FFFFFFFh: Illegal
        20000000h-5FFFFFFFh: RWX, Cache Write-Through
        60000000h-FFFFFFFFh: RWX, Bypass Cache

4 详细分析

SPI Flash 非 OTA 系统，两部分：

 0x00000 --- 启动自动加载到 RAM 的部分
 0x40000 --- 运行需要后再加载的部分

OTA 系统：

 0x00000 --- 启动自动加载到 RAM 的部分，boot.bin （OTA 核心实现在这里）
 0x01000 --- 4KB 开始，为运行需要后再加载的部分，user1.bin

所有这两个部分，都是 ESP Firmware 格式 (Little Endian)：

File header

Byte	Description
0	Always 0xE9
1	Number of segments
2	SPI Flash Interface (0 = QIO, 1 = QOUT, 2 = DIO, 0x3 = DOUT)
3	High four bits: 0 = 512K, 1 = 256K, 2 = 1M, 3 = 2M, 4 = 4M, Low four bits: 0 = 40MHz, 1= 26MHz, 2 = 20MHz, 0xf = 80MHz
4-7	Entry point
8-n	Segments

Segment

Byte	Description
0-3	Memory offset
4-7	Segment size
8...n	Data

Footer

The file is padded with zeros until its size is one byte less than a multiple of 16 bytes. A last byte (thus making the file size a multiple of 16) is the checksum of the data of all segments. The checksum is defined as the xor-sum of all bytes and the byte 0xEF.

• https://github.com/tommie/esptool
• https://github.com/igrr/esptool-ck
• https://github.com/esp8266/Arduino/blob/master/bootloaders/eboot/rom.ld
• XTOS Reset Vector

• https://github.com/espressif/ESP8266_MP3_DECODER/blob/master/mp3/make.sh