ESP32-WROVER-IE-N8R8 programming errors

[jamesarm97]

We have received some of the ESP32-WROVER-IE-N8R8 (8MB Flash and 8MB PSRAM) modules on a new board design and are having issues flashing the modules. The flash_id is coming back as unknown and usually shows 00 or FF and flash size is not known. I have tried overriding them with the flash_mode QIO and flash_size 8M and does not have any effect (also tried all the other modes). The MAC address seems to be programmed. Here is a dump of getting the flash_id and chip_id and also the fuse dump. I have verified that the GPIO12 pin is floating (only goes to a debugger header for MTDI) and reads about 1.6V when floating. That is about the only setting that I could see would physically mess things up since the SPI flash pins are not brought out to the module pins. I have read that the fuses can only be written once so I don't want to write the VDD_SPIO to 3.3 yet. The chip doc looks like it says the internals use 3.3V and the MTDI pin left floating would be correct.

This is a note in the module doc:

Internal pull-up resistor (R9) for MTDI is not populated in the module, as the flash and SRAM in the module only support a power voltage of 3.3 V (output by VDD_SDIO).

esptool.py v4.4
Found 4 serial ports
Serial port /dev/cu.usbserial-FA13101
Connecting....
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting......
Detecting chip type... ESP32
Chip is ESP32-D0WD-V3 (revision v3.0)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: ec:62:60:c2:fe:e4
Uploading stub...
Running stub...
Stub running...
WARNING: Failed to communicate with the flash chip, read/write operations will fail. Try checking the chip connections or removing any other hardware connected to IOs.
Manufacturer: ff
Device: ffff
Detected flash size: Unknown
Hard resetting via RTS pin...

esptool.py v4.4
Found 4 serial ports
Serial port /dev/cu.usbserial-FA13101
Connecting.......
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting....
Detecting chip type... ESP32
Chip is ESP32-D0WD-V3 (revision v3.0)
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
Crystal is 40MHz
MAC: ec:62:60:c2:fe:e4
Uploading stub...
Running stub...
Stub running...
WARNING: Failed to communicate with the flash chip, read/write operations will fail. Try checking the chip connections or removing any other hardware connected to IOs.
Warning: ESP32 has no Chip ID. Reading MAC instead.
MAC: ec:62:60:c2:fe:e4
Hard resetting via RTS pin...

Fuse dump:

EFUSE_NAME (Block) Description = [Meaningful Value] [Readable/Writeable] (Hex Value)
----------------------------------------------------------------------------------------
Calibration fuses:
BLK3_PART_RESERVE (BLOCK0): BLOCK3 partially served for ADC calibration data = False R/W (0b0)
ADC_VREF (BLOCK0): Voltage reference calibration = 1121 R/W (0b00011)

Config fuses:
XPD_SDIO_FORCE (BLOCK0): Ignore MTDI pin (GPIO12) for VDD_SDIO on reset = False R/W (0b0)
XPD_SDIO_REG (BLOCK0): If XPD_SDIO_FORCE, enable VDD_SDIO reg on reset = False R/W (0b0)
XPD_SDIO_TIEH (BLOCK0): If XPD_SDIO_FORCE & XPD_SDIO_REG = 1.8V R/W (0b0)
CLK8M_FREQ (BLOCK0): 8MHz clock freq override = 54 R/W (0x36)
SPI_PAD_CONFIG_CLK (BLOCK0): Override SD_CLK pad (GPIO6/SPICLK) = 0 R/W (0b00000)
SPI_PAD_CONFIG_Q (BLOCK0): Override SD_DATA_0 pad (GPIO7/SPIQ) = 0 R/W (0b00000)
SPI_PAD_CONFIG_D (BLOCK0): Override SD_DATA_1 pad (GPIO8/SPID) = 0 R/W (0b00000)
SPI_PAD_CONFIG_HD (BLOCK0): Override SD_DATA_2 pad (GPIO9/SPIHD) = 0 R/W (0b00000)
SPI_PAD_CONFIG_CS0 (BLOCK0): Override SD_CMD pad (GPIO11/SPICS0) = 0 R/W (0b00000)
DISABLE_SDIO_HOST (BLOCK0): Disable SDIO host = False R/W (0b0)

Efuse fuses:
WR_DIS (BLOCK0): Efuse write disable mask = 0 R/W (0x0000)
RD_DIS (BLOCK0): Efuse read disable mask = 0 R/W (0x0)
CODING_SCHEME (BLOCK0): Efuse variable block length scheme
= NONE (BLK1-3 len=256 bits) R/W (0b00)
KEY_STATUS (BLOCK0): Usage of efuse block 3 (reserved) = False R/W (0b0)

Identity fuses:
MAC (BLOCK0): Factory MAC Address
= ec:62:60:c2:fe:e4 (CRC 0x87 OK) R/W
MAC_CRC (BLOCK0): CRC8 for factory MAC address = 135 R/W (0x87)
CHIP_VER_REV1 (BLOCK0): Silicon Revision 1 = True R/W (0b1)
CHIP_VER_REV2 (BLOCK0): Silicon Revision 2 = True R/W (0b1)
WAFER_VERSION_MINOR (BLOCK0): WAFER VERSION MINOR = 0 R/W (0b00)
CHIP_PACKAGE (BLOCK0): Chip package identifier = 1 R/W (0b001)
CHIP_PACKAGE_4BIT (BLOCK0): Chip package identifier #4bit = 0 R/W (0b0)
MAC_VERSION (BLOCK3): Version of the MAC field = 0 R/W (0x00)
WAFER_VERSION_MAJOR (BLOCK0): calc WAFER VERSION MAJOR from CHIP_VER_REV1 and CH = 3 R/W (0b011)
IP_VER_REV2 and apb_ctl_date (read only)
PKG_VERSION (BLOCK0): calc Chip package = CHIP_PACKAGE_4BIT << 3 + CHIP_ = 1 R/W (0x1)
PACKAGE (read only)

Security fuses:
FLASH_CRYPT_CNT (BLOCK0): Flash encryption mode counter = 0 R/W (0b0000000)
UART_DOWNLOAD_DIS (BLOCK0): Disable UART download mode (ESP32 rev3 only) = False R/W (0b0)
FLASH_CRYPT_CONFIG (BLOCK0): Flash encryption config (key tweak bits) = 0 R/W (0x0)
CONSOLE_DEBUG_DISABLE (BLOCK0): Disable ROM BASIC interpreter fallback = True R/W (0b1)
ABS_DONE_0 (BLOCK0): Secure boot V1 is enabled for bootloader image = False R/W (0b0)
ABS_DONE_1 (BLOCK0): Secure boot V2 is enabled for bootloader image = False R/W (0b0)
JTAG_DISABLE (BLOCK0): Disable JTAG = False R/W (0b0)
DISABLE_DL_ENCRYPT (BLOCK0): Disable flash encryption in UART bootloader = False R/W (0b0)
DISABLE_DL_DECRYPT (BLOCK0): Disable flash decryption in UART bootloader = False R/W (0b0)
DISABLE_DL_CACHE (BLOCK0): Disable flash cache in UART bootloader = False R/W (0b0)
BLOCK1 (BLOCK1): Flash encryption key
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK2 (BLOCK2): Secure boot key
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W
BLOCK3 (BLOCK3): Variable Block 3
= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 R/W

Flash voltage (VDD_SDIO) determined by GPIO12 on reset

[ESP_Sprite]

1.6V is a bit of an odd value... just to check, can you ground MTDI and see if it programs then?

[jamesarm97]

Yeah, I tried that. I measured the resistance on the MTDI pin and It is about 7.4Mohm to ground and to 3.3 so I guess 1.6 would be about right with it pulled half way. That pin goes nowhere else except to the ESPPROG debug header. Debugging doesn't work either. Gives a bunch of weird cpu errors. I may have to sacrifice one of these boards and take the module off. We made sure non of the pins used were for special functions and most critical internal GPIO isn't brought out to a pin on the module. I am pretty sure these were purchased from a reputable place like digikey and are brand new. The prototyping was done with the ESP32-ETH-KIT. I just have never had a ESP module act like this before and acts like the internals are bad. I read about that weird flash disabling bug, but these haven't even been programmed yet and the flash status registers will read all 0's or all FF's at different times.

I tried running debug and this is what it gets:

Warn : Unexpected idcode after end of chain: 559 0xfc07e03f
Warn : Unexpected idcode after end of chain: 591 0x07e03f01
Warn : Unexpected idcode after end of chain: 623 0xe03f01fc
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Error: esp32.cpu0: IR capture error; saw 0x03 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : esp32.cpu0: Debug controller was reset.
Info : esp32.cpu0: Core was reset.
Info : esp32.cpu0: Detected debug stubs @ 7f03f80f
Info : esp32.cpu1: Core was reset.
Error: esp32.cpu1: DSR (1FC07E03) indicates DIR instruction generated an exception!
Error: esp32.cpu1: DSR (E03F80FC) indicates target still busy!
Error: esp32.cpu1: DSR (E03F80FC) indicates DIR instruction generated an overrun!
Info : esp32.cpu1: Target halted, PC=0x80FE03F0, debug_reason=00000003
Error: Failed to read break instruction!
Error: esp32.cpu1: DSR (3F01FC07) indicates target still busy!
Error: esp32.cpu1: DSR (3F01FC07) indicates DIR instruction generated an exception!
Warn : esp32.cpu1: Failed writing 4 bytes at address 0x3ff5f064
Error: Failed to write ESP32_TIMG0WDT_PROTECT (-4)!
Polling target esp32.cpu1 failed, trying to reexamine
Info : esp32.cpu0: Debug controller was reset.
Info : esp32.cpu0: Core was reset.

[ESP_Sprite]

Hm, that's one unhappy puppy... Just to check, can you share the (relevant bits of) the schematic?

[jamesarm97]

Here is schematic, mostly bits taken from the ESP32-ETH-KIT with the phy replaced with a RMII compatible chip.

esp32.png (427.16 KiB) Viewed 3676 times

[ESP_Sprite]

Nothing odd there... Can you tell me a bit more about the power supply? How is the 3.3V generated; are you sure that has enough headroom to pull a good 500mA from that rail?

[jamesarm97]

I have tried powering from the ESPPROG and through a bench top adjustable / current regulated power supply and it didn't pull more than I had it set for. I have the ESP32-ETHERNET-KIT dev board and it is what this is based on and that board works fine powered from the built in ESPPROG circuit. A head scratcher for sure.

[jamesarm97]

Getting back to trying to figure this issue out. I wrote the fuse to force the VDD_SDIO to 1.8V and that did not fix anything. I finally got back from vacation and have the boot up messages. It tries to boot SPI Flash but I guess that fails and then falls back to UART_BOOT. If I press reset after that it mostly immediately boots in UART_BOOT mode until I press reset enough then tries the flash again. Another odd thing, the GPIO12 / MDTI only goes to a header but there is some sort of clock being generated on that pin after boot with nothing connected so it is coming from the ESP32 module. There is also a confusion on what the VDD_SDIO should be. In the ESP32-WROVER-IE-N8R8 docs it says

• Internal pull-up resistor (R9) for MTDI is not populated in the module, as the flash and SRAM in the module only support a power voltage of 3.3 V (output by VDD_SDIO).

https://www.espressif.com/sites/default ... eet_en.pdf

*But* from the espressif api documentation is states this:

All ESP32-WROVER modules, excluding ESP32-WROVER-B, use 1.8 V flash and have internal pull-ups on GPIO12. Other modules that use 3.3 V flash have no pull-ups on the GPIO12 pin, and this pin is slightly pulled down internally.

https://docs.espressif.com/projects/esp ... apping-pin

Terminal dump on power-up:

rst:0x1 (POWERON_RESET),boot:0x1f (SPI_FAST_FLASH_BOOT)
configsip: 0, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fffeba4,len:4
load:0x4009f000,len:3248
entry 0x4009f574
└OHAI└ets Jul 29 2019 12:21:46

rst:0x10 (RTCWDT_RTC_RESET),boot:0xf (UART_BOOT(UART0))

[jamesarm97]

esptool with trace and no-stub option:

/DownTemp/TEST32/test/.pio/build/esp_wrover_kit  esptool.py --chip auto -p /dev/cu.usbserial-00003314B -b 115200 --no-stub -t write_flash --flash_size detect 0 ./firmware.bin
esptool.py v3.1
Serial port /dev/cu.usbserial-00003314B
Connecting...TRACE +0.000 command op=0x08 data len=36 wait_response=1 timeout=0.100 data=
0707122055555555 5555555555555555 | ... UUUUUUUUUUUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
55555555 | UUUU
TRACE +0.000 Write 46 bytes:
c000082400000000 0007071220555555 | ...$........ UUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
5555555555555555 5555555555c0 | UUUUUUUUUUUUU.
TRACE +0.014 Read 1 bytes: c0
TRACE +0.000 Read 11 bytes: 0108020000000000ff00c0
TRACE +0.000 Received full packet: 0108020000000000ff00
TRACE +0.336 Read 1 bytes: 65
TRACE +0.000 Read invalid data: 65
TRACE +0.000 Remaining data in serial buffer:
7473204a756c2032 3920323031392031 | ts Jul 29 2019 1
323a32313a34360d 0a0d0a7273743a30 | 2:21:46....rst:0
7831302028525443 574454 | x10 (RTCWDT
.TRACE +0.053 command op=0x08 data len=36 wait_response=1 timeout=0.100 data=
0707122055555555 5555555555555555 | ... UUUUUUUUUUUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
55555555 | UUUU
TRACE +0.000 Write 46 bytes:
c000082400000000 0007071220555555 | ...$........ UUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
5555555555555555 5555555555c0 | UUUUUUUUUUUUU.
TRACE +0.011 Read 1 bytes: c0
TRACE +0.000 Read 11 bytes: 0108020000000000ff00c0
TRACE +0.000 Received full packet: 0108020000000000ff00
TRACE +0.336 Read 1 bytes: 65
TRACE +0.000 Read invalid data: 65
TRACE +0.000 Remaining data in serial buffer:
7473204a756c2032 3920323031392031 | ts Jul 29 2019 1
323a32313a34360d 0a0d0a7273743a30 | 2:21:46....rst:0
7831302028525443 5744545f5254435f | x10 (RTCWDT_RTC_
5245534554292c62 6f6f743a3078 | RESET),boot:0x
.TRACE +0.053 command op=0x08 data len=36 wait_response=1 timeout=0.100 data=
0707122055555555 5555555555555555 | ... UUUUUUUUUUUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
55555555 | UUUU
TRACE +0.000 Write 46 bytes:
c000082400000000 0007071220555555 | ...$........ UUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
5555555555555555 5555555555c0 | UUUUUUUUUUUUU.
TRACE +0.105 Timed out waiting for packet header
.TRACE +0.050 command op=0x08 data len=36 wait_response=1 timeout=0.100 data=
0707122055555555 5555555555555555 | ... UUUUUUUUUUUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
55555555 | UUUU
TRACE +0.000 Write 46 bytes:
c000082400000000 0007071220555555 | ...$........ UUU
5555555555555555 5555555555555555 | UUUUUUUUUUUUUUUU
5555555555555555 5555555555c0 | UUUUUUUUUUUUU.
TRACE +0.015 Read 1 bytes: c0
TRACE +0.000 Read 111 bytes:
0108040007071220 00000000c0c00108 | ....... ........
0400070712200000 0000c0c001080400 | ..... ..........
0707122000000000 c0c0010804000707 | ... ............
122000000000c0c0 0108040007071220 | . .............
00000000c0c00108 0400070712200000 | ............. ..
0000c0c001080400 0707122000000000 | ........... ....
c0c0010804000707 122000000000c0 | ......... .....
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000
TRACE +0.000 Received full packet: 010804000707122000000000

Detecting chip type...TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=00100040
TRACE +0.000 Write 14 bytes: c0000a04000000000000100040c0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a0400831df00000000000c0
TRACE +0.000 Received full packet: 010a0400831df00000000000
ESP32
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0ca0f53f
TRACE +0.000 Write 14 bytes: c0000a0400000000000ca0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040000a2000000000000c0
TRACE +0.000 Received full packet: 010a040000a2000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0ca0f53f
TRACE +0.000 Write 14 bytes: c0000a0400000000000ca0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040000a2000000000000c0
TRACE +0.000 Received full packet: 010a040000a2000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=14a0f53f
TRACE +0.000 Write 14 bytes: c0000a04000000000014a0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000000100000000000c0
TRACE +0.000 Received full packet: 010a04000000100000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=7c60f63f
TRACE +0.000 Write 14 bytes: c0000a0400000000007c60f63fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000020049600000000c0
TRACE +0.000 Received full packet: 010a04000020049600000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0ca0f53f
TRACE +0.000 Write 14 bytes: c0000a0400000000000ca0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040000a2000000000000c0
TRACE +0.000 Received full packet: 010a040000a2000000000000
Chip is ESP32-D0WD-V3 (revision 3)
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0ca0f53f
TRACE +0.000 Write 14 bytes: c0000a0400000000000ca0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040000a2000000000000c0
TRACE +0.000 Received full packet: 010a040000a2000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0ca0f53f
TRACE +0.000 Write 14 bytes: c0000a0400000000000ca0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040000a2000000000000c0
TRACE +0.000 Received full packet: 010a040000a2000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=10a0f53f
TRACE +0.000 Write 14 bytes: c0000a04000000000010a0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04003215000000000000c0
TRACE +0.000 Received full packet: 010a04003215000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=18a0f53f
TRACE +0.000 Write 14 bytes: c0000a04000000000018a0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000400000000000000c0
TRACE +0.000 Received full packet: 010a04000400000000000000
Features: WiFi, BT, Dual Core, 240MHz, VRef calibration in efuse, Coding Scheme None
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=1400f43f
TRACE +0.000 Write 14 bytes: c0000a0400000000001400f43fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04006001000000000000c0
TRACE +0.000 Received full packet: 010a04006001000000000000
Crystal is 40MHz
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=08a0f53f
TRACE +0.000 Write 14 bytes: c0000a04000000000008a0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a040062ecd80000000000c0
TRACE +0.000 Received full packet: 010a040062ecd80000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=04a0f53f
TRACE +0.000 Write 14 bytes: c0000a04000000000004a0f53fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a0400fcfec26000000000c0
TRACE +0.000 Received full packet: 010a0400fcfec26000000000
MAC: ec:62:60:c2:fe:fc
Enabling default SPI flash mode...
TRACE +0.000 command op=0x0d data len=8 wait_response=1 timeout=3.000 data=0000000000000000
TRACE +0.000 Write 18 bytes:
c0000d0800000000 0000000000000000 | ................
00c0 | ..
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010d0400fcfec26000000000c0
TRACE +0.000 Received full packet: 010d0400fcfec26000000000
Configuring flash size...
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=1c20f43f
TRACE +0.000 Write 14 bytes: c0000a0400000000001c20f43fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04004000008000000000c0
TRACE +0.000 Received full packet: 010a04004000008000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=2420f43f
TRACE +0.000 Write 14 bytes: c0000a0400000000002420f43fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000000007000000000c0
TRACE +0.000 Received full packet: 010a04000000007000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=2c20f43f17000000ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 002c20f43f170000 | ........., .?...
00ffffffff000000 00c0 | ..........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000007000000000c0
TRACE +0.000 Received full packet: 010904000000007000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=1c20f43f00000090ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 001c20f43f000000 | .......... .?...
90ffffffff000000 00c0 | ..........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000007000000000c0
TRACE +0.000 Received full packet: 010904000000007000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=2420f43f9f000070ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 002420f43f9f0000 | .........$ .?...
70ffffffff000000 00c0 | p.........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000007000000000c0
TRACE +0.000 Received full packet: 010904000000007000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=8020f43f00000000ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 008020f43f000000 | .......... .?...
00ffffffff000000 00c0 | ..........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000007000000000c0
TRACE +0.000 Received full packet: 010904000000007000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=0020f43f00000400ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 000020f43f000004 | .......... .?...
00ffffffff000000 00c0 | ..........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000007000000000c0
TRACE +0.000 Received full packet: 010904000000007000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=0020f43f
TRACE +0.000 Write 14 bytes: c0000a0400000000000020f43fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000000000000000000c0
TRACE +0.000 Received full packet: 010a04000000000000000000
TRACE +0.000 command op=0x0a data len=4 wait_response=1 timeout=3.000 data=8020f43f
TRACE +0.000 Write 14 bytes: c0000a0400000000008020f43fc0
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010a04000000000000000000c0
TRACE +0.000 Received full packet: 010a04000000000000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=1c20f43f40000080ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 001c20f43f400000 | .......... .?@..
80ffffffff000000 00c0 | ..........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000000000000000c0
TRACE +0.000 Received full packet: 010904000000000000000000
TRACE +0.000 command op=0x09 data len=16 wait_response=1 timeout=3.000 data=2420f43f00000070ffffffff00000000
TRACE +0.000 Write 26 bytes:
c000091000000000 002420f43f000000 | .........$ .?...
70ffffffff000000 00c0 | p.........
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010904000000000000000000c0
TRACE +0.000 Received full packet: 010904000000000000000000
Warning: Could not auto-detect Flash size (FlashID=0x0, SizeID=0x0), defaulting to 4MB
TRACE +0.000 command op=0x0b data len=24 wait_response=1 timeout=3.000 data=
0000000000004000 0000010000100000 | ......@.........
00010000ffff0000 | ........
TRACE +0.000 Write 34 bytes:
c0000b1800000000 0000000000000040 | ...............@
0000000100001000 0000010000ffff00 | ................
00c0 | ..
TRACE +0.016 Read 1 bytes: c0
TRACE +0.000 Read 13 bytes: 010b04000000000000000000c0
TRACE +0.000 Received full packet: 010b04000000000000000000
Flash will be erased from 0x00000000 to 0x0003efff...
Erasing flash...
TRACE +0.001 command op=0x02 data len=16 wait_response=1 timeout=7.683 data=60e80300fb0000000004000000000000
TRACE +0.000 Write 26 bytes:
c000021000000000 0060e80300fb0000 | .........`......
0000040000000000 00c0 | ..........
TRACE +7.683 Timed out waiting for packet header

A fatal error occurred: Timed out waiting for packet header

[jamesarm97]

So I unsoldered the ESP32 wrover module and put wires on every pin and put a socket on the board then proceeded to plug in every wire one at a time. With just power, EN, IO0 and RX/TX I was able to get the flash id and it shows 8MB. It appears that IO2 is the culprit. We have a pull-up on IO2 so we can use it for I2C SDA but I think we are seeing an undocumented mode if IO0 is low and IO2 is high. I don't see that in the boot table and don't see any mention of what it can cause, but IO2 connected is causing esptool to not detect the flash id or type.

Manufacturer: c8
Device: 4017
Detected flash size: 8MB