Failure to identify connected SPI Flash

[OhioDuckFarmer]

I have connected multiple SPI NOR-Flash chips (winbond W25Q16JV) to the greatfet and tried to use the spi-flash info command to read the ID code from the chips; however, 90%+ of the time I will receive a "spiflash: this target lacks a JEDEC ID or DO/MISO appears to be stuck" and the other 10% of the time I will get:

"
SPI flash detected:
Manufacturer: unknown (0xff)
Part number: unknown part (0xffff)
Capacity: 2.0 MiB (16.0 Mib)
Page size: 256 B
"
(this happens with a chip placed inside an external TSOP connection (used for other flash readers) or on the same chip soldered to a PCB test board.

If I remove the chip from the GreatFet and place it into my FlashcatUSB Mach reader the Flashcat software will identify it properly.

I have tried multiple chips and multiple wires (and tsop connectors) and all have the same result.

The environment I am running this in is:

A Windows 10 Host running a Ubuntu 20 Linux system within VMWare Workstation Pro. {the greatfet is plugged into a powered USB3 hub)

I have tried running the spi-flash both as normal user and as a super user.

Here is the results of uname -a:

Linux base 5.4.0-120-generic #136-Ubuntu SMP Fri Jun 10 13:40:48 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

and Here is the results of the gf info -a command (the greatfet software install installed using the instructions found on the docs page):

Host tools info:
host module version: 2019.5.1
pygreat module version: 2021.2.1
python version: 3.8.10 (default, Mar 15 2022, 12:22:08)

module path: /usr/local/lib/python3.8/dist-packages/GreatFET-2019.5.1-py3.8.egg/greatfet
command path: /usr/local/lib/python3.8/dist-packages/GreatFET-2019.5.1-py3.8.egg/greatfet/commands
gnuradio-companion block path: /usr/local/lib/python3.8/dist-packages/GreatFET-2019.5.1-py3.8.egg/greatfet/gnuradio

Found a GreatFET One!
Board ID: 0
Firmware version: git-v2021.2.1-50-g7cedf90
Part ID: a0000a306a476e
Serial number: 000057cc67e630a94c57
APIs supported:
core:
get_available_classes -- Fetches the available class numbers.
get_available_verbs -- Fetches the available verb numbers for a given class.
get_class_docs -- Fetches for documentation the given class.
get_class_name -- Fetches the string name for the given class.
get_verb_descriptor -- Fetches the information about the given verb.
get_verb_documentation -- Fetches the given verb's documentation.
get_verb_in_param_names -- Fetches the given verb's in-param names.
get_verb_in_signature -- Fetches the given verb's in-signature.
get_verb_name -- Fetches the string name for the given verb.
get_verb_out_param_names -- Fetches the given verb's out-param names.
get_verb_out_signature -- Fetches the given verb's out-signature.
read_board_id -- Fetches the board's type identifier.
read_part_id -- Fetches the part ID used on the board.
read_serial_number -- Fetches the board's serial number.
read_version_string -- Fetches the board's version.
request_reset -- Resets the relevant board.
firmware:
full_erase -- Erases the entire firmware flash chip.
initialize -- Sets up the board to have its firmware programmed.
page_erase -- Erases the page with the provided address on the fw flash.
read_page -- Returns the contents of the flash page at the given address.
write_page -- Writes the provided data to a single firmware flash page.
uart:
initialize -- Prepares a UART for use by the rest of this API.
read -- Reads from the UART buffer, capturing recently received data
synchronous_transmit -- Transmits the provided byte over the given UART.
swra124:
chip_erase -- erase the chip
debug_init -- reset target into debugging mode
debug_instr -- execute instruction on target
get_chip_id -- read chip ID from target
get_pc -- get program counter from target
halt -- halt target execution
read_status -- read status byte from target
resume -- resume target execution
setup -- initialize pin mapping for debugging
step_instr -- single-step target
spi_flash:
full_erase -- Erases the entire spi_flash flash chip.
initialize -- Sets up the board to program an external SPI flash.
query_device_id -- Reads the target SPI flash's JEDEC ID.
query_topology -- Attempts to read information about the device's 'shape' usin
read_page -- Returns the contents of the flash page at the given address.
write_page -- Writes the provided data to a single spi_flash flash page.
spi:
clock_data -- Clock data out and in; but don't change the chip select.
enable_drive -- If enable is false, the SPI pins will be tri-stated; if true
init -- Initialize a SPI device
set_clock_polarity_and_phase -- Applies a standard SPI mode to set the polarity and phase.
transmit -- Write to a SPI device and read response
selftest:
measure_clock_frequencies -- Returns the frequencies of the provided clocks, in MHz.
measure_raw_clock -- Returns the frequencies of the provided clocks, in MHz.
sdir:
dac_register_read -- debug: read a raw value from an AD904 register
dac_register_write -- debug: write a raw value from an AD904 register
start_receive -- Start receipt of SDIR data on the primary bulk comms pipe.
stop -- Halt SDIR communications; termianting any active communicati
pattern_generator:
dump_sgpio_configuration -- Requests that the system dumps its SGPIO configuration state
generate_pattern -- Sets the GreatFET to repeatedly emit a short pattern.
generate_simple_pattern -- Sets the GreatFET to emit a short pattern.
stop -- Stops all pattern generation functionality.
upload_samples -- Uploads a set of samples into the pattern generator's sample
logic_analyzer:
change_first_pin -- Changes the first SGPIO pin captured in future captures, but
configure -- Configures a logic analyzer capture; should be called before
configure_alt_mappings -- Swaps the locations of pins 8/9 for use with Rhodadendron's
dump_sgpio_configuration -- Requests that the system dumps its SGPIO configuration state
start -- Starts a logic analyzer capture, which will run until stop i
stop -- Terminates an active logic analyzer capture.
loadables:
halt_m0 -- Starts execution of a loaded program on the device's M0 core
load_m0_page -- Copies a page of data into the M0 address space.
start_m0 -- Starts execution of a loaded program on the device's M0 core
leds:
off -- Turn an LED off
on -- Turn an LED on
toggle -- Toggle an LED
jtag_msp430:
erase_flash -- Erase all flash (except info segment).
erase_info -- Erase info flash segment.
halt_cpu -- Halt program execution.
read_mem -- Read n words from memory.
release_cpu -- Release control of the CPU, continuing execution.
set_instruction_fetch -- Put CPU in to instruction fetch state (probably).
set_pc -- Set CPU program counter.
set_reg -- Set a register to the given value.
start -- Start JTAG process.
stop -- Stop JTAG process.
write_flash -- Write data to flash from a given address.
write_mem -- Write a 16 bit word to memory.
jtag:
configure -- Configures a JTAG scan chain; can be run multiple times, but
run_clock -- Pulses the clock for the chain; but neither scans in nor sca
scan -- Scans a set of data out to the chain, and returns a response
scan_in -- Scans a set of data in from the chain, scanning out all fill
scan_out -- Scans a set of data out to the chain, discarding any respons
i2c:
issue_bytes -- Issues a raw set of bytes on the I2C bus. Gives low-level co
issue_start -- Issues a raw start bit onto the I2C bus.
issue_stop -- Issues a raw stop bit on the I2C bus.
read -- Reads from the I2C bus and responds accordingly
read_bytes -- Reads a raw set of bytes on the I2C bus. Should follow an is
scan -- Scans all valid I2C addresses for attached devices
start -- Initialize and transmit a start bit to an I2C device
stop -- Transmit a stop bit to an I2C device
stop_periodic_read -- Stop any active periodic read.
stream_periodic_read -- Schedule a periodic I2C transaction, and stream its results
write -- Writes to the I2C bus and responds accordingly
heartbeat:
get_period -- Returns the base period for the hearbeat LED. Arbitary units
set_period -- Sets the base period for the hearbeat LED. Arbitary units.
start -- Enables heartbeat mode, e.g. after the heartbeat has been st
stop -- Disables heartbeat mode, free'ing the LED for user use.
greatdancer:
bus_reset -- Causes the target device to handle a bus reset.
clean_up_transfer -- Cleans up any complete transfers on the given endpoint.
connect -- Sets up the target port to connect to a host.
disconnect -- Disconnects the target port from the host.
finish_nonblocking_read -- Returns the data read after a given non-blocking read.
get_nonblocking_data_length -- Returns the amount of data read after a given non-blocking r
get_status -- Reads one of the device's USB status registers.
read_setup -- Reads any pending setup packets recieved on the given endpoi
send_on_endpoint -- Sends the provided data on the given IN endpoint.
set_address -- Sets the address of the target device.
set_up_endpoints -- Sets up all of the non-control endpoints for the device.
stall_endpoint -- Stalls the endpoint with the provided address.
start_nonblocking_read -- Begins listening for data on the given OUT endpoint.
gpio:
get_pin_directions -- Reads the direction of a GPIO pin or pins given tuples of (p
read_pins -- Reads the value of a GPIO pin or pins given tuples of (port,
release_pin -- Releases a GPIO pin for use by other peripherals.
set_up_pin -- Configures a single pin to be used for GPIO.
write_pins -- Sets the value of a GPIO pin or pins, given tuples of (port,
glitchkit_usb:
configure_requests -- Configures future requests. Optional; defaults are somewhat
control_in -- Issues a control IN request as GlitchKit stimuli and capture
glitchkit:
add_trigger_events -- Adds to the active collection of events to be used to trigge
provide_target_clock -- Sets up the board to provide a clock to a target device.
set_synchronization_events -- Sets a collection of events to be used to synchronize stimul
set_trigger_events -- Sets a collection of events to be used to trigger fault inje
example:
capitalize -- Capitalizes the first N characters of the provided string.
sum_and_difference -- Computes the sum and difference of two ints.
debug:
clear_dmesg -- Fetches and clears content of the device's debug ring (log).
peek -- Reads a raw LPC4330 memory address; for debug.
poke -- Writes a raw LPC4330 memory address; for debug.
read_dmesg -- Fetches the content of the device's debug ring (log).
dac:
initialize -- Initializes the DAC driver. Should be called before anything
set_value -- Sets the DAC value.
set_voltage -- Sets the DAC value by voltage in millivolts.
clock_gen:
output_clock -- Provide the target clock on a given CLKOUT pin,
adc:
read_samples -- Initialize the specified ADC for usage, with the given param
stop_periodic_read -- Stop any active periodic read.
stream_periodic_read -- Schedule a periodic ADC read, and stream its results to the

[straithe]

Thank you for opening this issue. I'm going to try to reproduce this issue and work to solve it for you!

[kalirenegade]

I’m also getting the same thing with the same chip

[antoinevg]

Similiar issue with W25Q32JVSS though I'm not seeing the SDO stuck errors.

[martinling]

I haven't been able to get this to work either.

I was trying to read a Winbond 25Q64FV in a SOIC adapter. I get seemingly random variations of manufacturer and part number, or sometimes the message about DO/MISO being stuck at 0.

Here's a PulseView capture of the SPI bus from a Rigol DS1102D, whilst running gf spi-flash info.

This same sequence above appears a second time, later in the capture.

Capture file: spi-flash-info.zip

The sample rate isn't correctly annotated, but looking at the scope, the clock frequency appears to be around 30MHz.

I connected the /WP and /HOLD signals to the GreatFET SCL/SDA pins in order to use the GreatFET's onboard pullups to hold those signals high.