Skip to content

SPI Flash and Recovery

Roman Kuraev edited this page Jul 10, 2026 · 6 revisions

SPI Flash and Recovery

The EMW3165 board uses a Macronix MX25L1606E 2 MiB external SPI flash. Its physical connection is documented in Hardware Architecture.

Flash map

  • 0x0000000x100FFF: OTA staging, known-good backup, and state journal
  • 0x1010000x135FFF: WICED application lookup table and WLAN firmware
  • 0x1360000x1FFFFF: reserved/free

The web UI is linked into STM32 internal flash and does not occupy external SPI flash. The exact OTA layout and rollback rules are in the Firmware Updates.

Direct provisioning

The direct-write path uses OpenOCD with the WICED SRAM SPI-flash loader over SWD/CMSIS-DAP:

scripts/flash_sflash_openocd.zsh <image> <offset>

The script performs readback verification. The repository also includes scripts/flash_wifi_firmware_sflash.zsh for the WLAN assets and scripts/sflash_write_swd.tcl for the loader protocol.

Use OpenOCD 0.12 or newer. The old OpenOCD bundled with the WICED SDK is a JTAG-only build and does not support this CMSIS-DAP/SWD workflow.

Development firmware exposes raw readback at:

GET /api/debug/sflash?addr=<hex>&len=<n<=256>

This route is compiled only when REWAIR_API_CORS_DEV is enabled.

Recovery

Recovery requires both stock images created from your own device before its first experimental flash: F411 internal flash and the complete external SPI flash. The stock firmware will not operate with the internal image alone. Rewair does not distribute either image.

Use your dump with the scripts in tools/recovery. The recovery guide restores both memories and also documents lower-level helpers for targeted recovery.

Normal Rewair flashing preserves DCT. Only use the default DCT asset when you intend to erase the saved configuration, and never reuse its generated MAC address across multiple devices.

Clone this wiki locally