June 2014DocID17066 Rev 61/37
AN3155
Application note
USART protocol used in the STM32 bootloader
Introduction
This application note describes the USART protocol used in the STM32 microcontroller bootloader. It details each supported command. For more information about the USART hardware resources and requirements for your device bootloader, please refer to the “STM32 system memory boot mode” application note (AN2606).Refer to Table 1 for the list of applicable microcontrollers.
Related documents
They are available from https://www.wendangku.net/doc/042204312.html,:?
Application note “STM32 system memory boot mode” (AN2606)
Table 1. Applicable products
Type
Part number or product series
Microcontrollers STM32L0 series STM32L1 series STM32F0 series
STM32F1 series
STM32F2 series STM32F3 series STM32F4 series
https://www.wendangku.net/doc/042204312.html,
Contents AN3155
Contents
1USART bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2Choosing the USARTx baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1Minimum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2Maximum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.1Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . . 10
3.3Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
3.4Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.5Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.7Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.8Extended Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.9Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.10Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.11Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.12Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 4Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 35 5Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
2/37DocID17066 Rev 6
AN3155List of tables List of tables
Table 1.Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Table https://www.wendangku.net/doc/042204312.html,ART bootloader commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Table 3.Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Table 4.Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
DocID17066 Rev 63/37
List of figures AN3155 List of figures
Figure 1.Bootloader for STM32 with USART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Figure 2.Get command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Figure 3.Get command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Figure 4.Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 10 Figure 5.Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 11 Figure 6.Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Figure 7.Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Figure 8.Read Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Figure 9.Read Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Figure 10.Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Figure 11.Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Figure 12.Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Figure 13.Write Memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Figure 14.Erase Memory command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Figure 15.Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Figure 16.Extended Erase Memory command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Figure 17.Extended Erase Memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Figure 18.Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Figure 19.Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Figure 20.Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Figure 21.Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Figure 22.Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Figure 23.Readout Protect command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Figure 24.Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Figure 25.Readout Unprotect command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 4/37DocID17066 Rev 6
DocID17066 Rev 65/37
AN3155
USART bootloader code sequence
1 USART bootloader code sequence
Once the system memory boot mode is entered and the STM32 microcontroller has been configured (for more details refer to application note AN2606 “STM32 system memory boot mode”) the bootloader code begins to scan the USARTx_RX line pin, waiting to receive the 0x7F data frame: one start bit, 0x7F data bits, even parity bit and one stop bit.
The duration of this data frame is measured using the Systick timer. The count value of the timer is then used to calculate the corresponding baud rate factor with respect to the current system clock.
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to receive commands.
Choosing the USARTx baud rate AN3155
6/37DocID17066 Rev 6
2 Choosing the USARTx baud rate
The calculation of the serial baud rate for USARTx, from the length of the first byte that is received, is used to operate the bootloader within a wide range of baud rates. However, the upper and lower limits have to be kept, in order to ensure proper data transfer.
For a correct data transfer from the host to the microcontroller, the maximum deviation between the internal initialized baud rate for USARTx and the real baud rate of the host should be below 2.5%. The deviation (f B , in percent) between the host baud rate and the microcontroller baud rate can be calculated using the formula below:
, where f B
≤ 2.5%.
This baud rate deviation is a nonlinear function depending on the CPU clock and the baud rate of the host. The maximum of the function (f B ) increases with the host baud rate. This is due to the smaller baud rate prescale factors, and the implied higher quantization error.
2.1 Minimum baud rate
The lowest tested baud rate (B Low ) is 1200. Baud rates below B Low would cause the SysTick timer to overflow. In this event, USARTx would not be correctly initialized.
2.2 Maximum baud rate
B High is the highest baud rate for which the deviation still does not exceed the limit. All baud rates between B Low and B High are below the deviation limit. The highest tested baud rate (B High ) is 115 200.
f B STM32 baud rate Host baud rate –STM32 baud rate
-------------------------------------------------------------------------------------------100%×=
DocID17066 Rev 67/37
AN3155
Bootloader command set
3 Bootloader command set
The supported commands are listed in Table 2 below. Each command is further described in
this section.
Communication safety
All communications from the programming tool (PC) to the device are verified by:1.
checksum: received blocks of data bytes are XORed. A byte containing the computed XOR of all previous bytes is added to the end of each communication (checksum byte). By XORing all received bytes, data + checksum, the result at the end of the packet must be 0x00
2. for each command the host sends a byte and its complement (XOR = 0x00)
3.
UART: parity check active (even parity)
1.If a denied command is received or an error occurs during the command execution, the bootloader sends
NACK byte and goes back to command checking.2.Read protection – When the RDP (read protection) option is active, only this limited subset of commands is
available. All other commands are NACKed and have no effect on the device. Once the RDP has been removed, the other commands become active.3.Refer to STM32 product datasheets and to the “STM32 microcontroller system memory boot mode”
application note (AN2606) to know which memory areas are valid for these commands.4.Erase (x043) and Extended Erase (0x44) are exclusive. A device may support either the Erase command
or the Extended Erase command but not both.
Bootloader command set AN3155
8/37
DocID17066 Rev 6
Each packet is either accepted (ACK answer) or discarded (NACK answer):?ACK = 0x79
?NACK = 0x1F
3.1 Get
command
The Get command allows you to get the version of the bootloader and the supported
commands. When the bootloader receives the Get command, it transmits the bootloader
version and the supported command codes to the host, as described in Figure 2.
AN3155
Bootloader command set
The STM32 sends the bytes as follows:
Byte 1:ACK
Byte 2:N = 11 = the number of bytes to follow – 1 except current and ACKs.
Byte 3:Bootloader version (0 < Version < 255), example: 0x10 = Version 1.0
Byte 4:0x00–Get command
Byte 5:0x01–Get Version and Read Protection Status
Byte 6:0x02–Get ID
Byte 7:0x11–Read Memory command
Byte 8:0x21–Go command
Byte 9:0x31–Write Memory command
Byte 10:0x43 or
0x44–Erase command or Extended Erase command (these commands are exlusive)
Byte 11:0x63–Write Protect command
Byte 12:0x73–Write Unprotect command
DocID17066 Rev 69/37
Bootloader command set AN3155
10/37
DocID17066 Rev 6
3.2 Get Version & Read Protection Status command
The Get Version & Read Protection Status command is used to get the bootloader version and the read protection status. When the bootloader receives the command, it transmits the information described below (version, read protection: number of times it was enabled and disabled) to the host.
1.GV = Get Version & Read Protection Status.
Byte 13:0x82–Readout Protect command Byte 14:
0x92
–Readout Unprotect command
Last byte (15):ACK
DocID17066 Rev 611/37
AN3155
Bootloader command set
1.GV = Get Version & Read Protection Status.
The STM32 sends the bytes as follows:3.3 Get ID command
The Get ID command is used to get the version of the chip ID (identification). When the bootloader receives the command, it transmits the product ID to the host.The STM32 device sends the bytes as follows:Byte 1:ACK
Byte 2:Bootloader version (0 < Version ≤ 255), example: 0x10 = Version 1.0Byte 3:Option byte 1: 0x00 to keep the compatibility with generic bootloader protocol Byte 4:Option byte 2: 0x00 to keep the compatibility with generic bootloader protocol Byte 5:
ACK
Byte 1:
ACK
Bootloader command set AN3155
12/37
DocID17066 Rev 6
1.GID = Get ID.
Byte 2:N = the number of bytes – 1 (N = 1 for STM32), except for current byte and ACKs.
Bytes 3-4:PID(1) byte 3 = 0x04, byte 4 = 0xXX
Byte 5:ACK
1.PID stands for product ID. Byte 1 is the MSB and byte 2, the LSB of the ID.
AN3155
Bootloader command set
1.GID = Get ID.
3.4 Read Memory command
The Read Memory command is used to read data from any valid memory address (see
note) in RAM, Flash memory and the information block (System memory or option byte
areas).
Note:Refer to STM32 product datasheets and to the “STM32 microcontroller system memory boot mode” application note (AN2606) for more details about the valid memory addresses
for the device you are using.
When the bootloader receives the Read Memory command, it transmits the ACK byte to the
application. After the transmission of the ACK byte, the bootloader waits for an address (4
bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, then it
checks the received address. If the address is valid and the checksum is correct, the
bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the
command.
When the address is valid and the checksum is correct, the bootloader waits for the number
of bytes to be transmitted – 1 (N bytes) and for its complemented byte (checksum). If the
checksum is correct it then transmits the needed data ((N + 1) bytes) to the application,
starting from the received address. If the checksum is not correct, it sends a NACK before
aborting the command.
The host sends bytes to the STM32 as follows:
Bytes 1-2:0x11+0xEE
Wait for ACK
Bytes 3 to 6:start address
DocID17066 Rev 613/37
Bootloader command set AN3155
14/37
DocID17066 Rev 6
1.RM = Read Memory.
Note:
Some products may return two NACKs instead of one single NACK when Read Protection (RDP) is active (or Read Potection level 1 is active). To know if a given product returns one
?byte 3: MSB ?
byte 6: LSB
Byte 7:Checksum: XOR (byte 3, byte 4, byte 5, byte 6)
Wait for ACK Byte 8:The number of bytes to be read – 1 (0 < N ≤ 255);Byte 9:
Checksum: XOR byte 8 (complement of byte 8)
DocID17066 Rev 615/37
AN3155
Bootloader command set
single NACK or two NACKs in this situation, please refer to the known limitations section relative to that product in AN2606.
1.RM = Read Memory.
Bootloader command set AN3155
16/37
DocID17066 Rev 6
3.5 Go
command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it transmits the ACK byte to the application. After the transmission of the ACK byte, the
bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is LSB) and
a checksum byte, then it checks the received address. If the address is valid and the
checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK
byte and aborts the command.
When the address is valid and the checksum is correct, the bootloader firmware performs
the following:
?it initializes the registers of the peripherals used by the bootloader to their default reset values
?it initializes the user application’s main stack pointer
?it jumps to the memory location programmed in the received ‘address + 4’ (which corresponds to the address of the application’s reset handler).
For example if the received address is 0x0800 0000, the bootloader will jump to the
memory location programmed at address 0x0800 0004.
In general, the host should send the base address where the application to jump to is
programmed
Note:Valid addresses for the Go command are in RAM or Flash memory (refer to STM32 product datasheets and to the “STM32 microcontroller system memory boot mode” application note
- AN2606 for more details about the valid memory addresses for the device you are using).
DocID17066 Rev 617/37
AN3155
Bootloader command set
All other addresses are considered not valid and are NACKed by the device.
When an application is loaded into RAM and then a jump is made to it, the program must be configured to run with an offset to avoid overlapping with the first RAM memory used by the bootloader firmware (refer to STM32 product datasheets and to the “STM32 microcontroller system memory boot mode” application note - AN2606 for more details about the RAM offset for the device you are using).
The Jump to the application works only if the user application sets the vector table correctly to point to the application address.
Some products may return two NACKs instead of one single NACK when Read Protection (RDP) is active (or Read Potection level 1 is active). To know if a given product returns one single NACK or two NACKs in this situation, please refer to the known limitations section relative to that product in AN2606.
Bootloader command set
AN3155
18/37DocID17066 Rev 6
The host sends bytes as follow to the STM32:3.6 Write Memory command
The Write Memory command is used to write data to any valid memory address (see note below) i.e. RAM, Flash memory, option byte area...
When the bootloader receives the Write Memory command, it transmits the ACK byte to the application. After the transmission of the ACK byte, the bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, it then
checks the received address. For the Option byte area, the start address must be the base address of the Option byte area (see note) to avoid writing inopportunely in this area.If the received address is valid and the checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address is valid and the checksum is correct, the bootloader:?gets a byte, N, which contains the number of data bytes to be received
?receives the user data ((N + 1) bytes) and the checksum (XOR of N and of all data bytes)
?programs the user data to memory starting from the received address
?
at the end of the command, if the write operation was successful, the bootloader transmits the ACK byte; otherwise it transmits a NACK byte to the application and aborts the command
The maximum length of the block to be written for the STM32 is 256 bytes.
If the Write Memory command is issued to the Option byte area, all options are erased before writing the new values, and at the end of the command the bootloader generates a system Reset to take into account the new configuration of the option byte.
Note:
When writing to the RAM, you should take care not to overlap the first RAM memory used by the bootloader firmware.
No error is returned when performing write operations on write-protected sectors.No error is returned when the start address is invalid.
Byte 1:0x21Byte 2:
0xDE
Wait for ACK
Byte 3 to byte 6:start address
byte 3: MSB byte 6: LSB
Byte 7:
checksum: XOR (byte 3, byte 4, byte 5, byte 6)
AN3155
Bootloader command set
1.WM = Write Memory.
2.N+1 should always be a multiple of 4.
Note:Some products may return two NACKs instead of one single NACK when Read Protection (RDP) is active (or Read Potection level 1 is active). To know if a given product returns one
single NACK or two NACKs in this situation, please refer to the known limitations section
relative to that product in AN2606.
DocID17066 Rev 619/37
Bootloader command set AN3155
20/37
DocID17066 Rev 6
1.WM = Write Memory.
2.N+1 should always be a multiple of 4.