Professional Documents
Culture Documents
Application note
USART protocol used in the STM32 bootloader
Introduction
This application note describes the USART protocol used in the STM32 microcontroller
bootloader, providing details on each supported command.
This document applies to STM32 products embedding any bootloader version, as specified
in the application note AN2606 “STM32 system memory boot mode”, available on
www.st.com. These products are listed in Table 1, and are referred to as STM32 throughout
the document.
For more information about the USART hardware resources and requirements for your
device bootloader, refer to the already mentioned AN2606.
STM32F0 Series
STM32F1 Series
STM32F2 Series
STM32F3 Series
STM32F4 Series
STM32F7 Series
STM32G0 Series
Microcontrollers STM32G4 Series
STM32H7 Series
STM32L0 Series
STM32L1 Series
STM32L4 Series
STM32L5 Series
STM32WB Series
STM32WL Series
Contents
5 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
List of tables
List of figures
USARTx selected
Wait for a
command
Command
GET cmd received GO cmd
JP to_Address
ai15702
Once the system memory boot mode is entered and the STM32 microcontroller (based on
Arm®(a) cores) has been configured (for more details refer to AN2606) the bootloader code
begins to scan the USARTx_RX line pin, waiting to receive the 0x7F data frame: a start bit,
0x7F data bits, even parity bit and a stop bit.
The duration of this data frame is measured using the Systick timer. The count value of the
timer is then used to calculate the corresponding baud rate factor with respect to the current
system clock.
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to
receive commands.
a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.
The calculation of the serial baud rate for USARTx, from the length of the first received byte,
is used to operate the bootloader within a wide range of baud rates. However, the upper and
lower limits have to be kept, to ensure proper data transfer.
For a correct data transfer from the host to the microcontroller, the maximum deviation
between the internal initialized baud rate for USARTx and the real baud rate of the host
must be below 2.5%. The deviation (fB, in percent) between the host baud rate and the
microcontroller baud rate can be calculated using the formula below:
f B = STM32 baud rate – Host baud rate
------------------------------------------------------------------------------------------- 100% , where fB 2.5%.
STM32 baud rate
This baud rate deviation is a nonlinear function, depending upon the CPU clock and the
baud rate of the host. The maximum of the function (fB) increases with the host baud rate.
This is due to the smaller baud rate prescale factors, and the implied higher quantization
error.
The supported commands are listed in Table 2. Each command is described in this section.
Communication safety
All communication from the programming tool (PC) to the device is verified by:
1. Checksum: received blocks of data bytes are XOR-ed. A byte containing the computed
XOR of all previous bytes is added to the end of each communication (checksum byte).
By XOR-ing all received bytes, data plus checksum, the result at the end of the packet
must be 0x00.
2. For each command the host sends a byte and its complement (XOR = 0x00).
3. UART: parity check active (even parity).
Start Get
ACK
ACK
End of Get
ai14631
Start Get
Received
No
byte = 0x00+0xFF? Send NACK byte
Yes
End of Get
ai14632
Figure 4. Get Version & Read Protection Status command: host side
Start GV(1)
Send 0x01+0xFE
NACK
Wait for
ACK or NACK
ACK
Option byte 1
Option byte 2
NACK
Wait for
ACK or NACK
ACK
End of GV(1)
MS45406V1
Figure 5. Get Version & Read Protection Status command: device side
Start GV(1)
Received
No
byte = 0x01+0xFE? Send NACK byte
Yes
Option byte 1
Option byte 2
End of GV(1)
MS35428V1
Start GID(1)
Send 0x02+0xFD
ACK
Receive PID
ACK
End of GID(1)
ai14633
Start GID(1)
Received No
byte = 0x02+0xFD? Send NACK byte
Yes
Send product ID
End of GID(1)
ai14636
Start RM(1)
Send 0x11+0xEE
ACK
ACK
ACK
End of RM(1)
ai14637
1. RM = Read Memory.
Note: Some products may return two NACKs instead of one when Read protection (RDP) is active
(or Read protection level 1 is active). To know if a given product returns one or two NACKs
in this situation, refer to the known limitations section relative to that product in AN2606.
Start RM(1)
Received byte = No
0x11+0xEE
Yes
Yes
RDP active
No
Yes
No
Checksum OK?
Yes
End of RM(1)
ai14638b
1. RM = Read Memory.
3.5 Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it transmits the ACK byte to the application. After the transmission of the ACK byte, the
bootloader waits for an address (four bytes, byte 1 is the address MSB and byte 4 is LSB)
and a checksum byte, then it checks the received address. If the address is valid and the
checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK
byte and aborts the command.
When the address is valid and the checksum is correct, the bootloader firmware
initializes the registers of the peripherals used by the bootloader to their default reset
values
initializes the main stack pointer of the user application
jumps to the memory location programmed in the received ‘address + 4’
(corresponding to the address of the application reset handler).
For example if the received address is 0x0800 0000, the bootloader jumps to the
memory location programmed at address 0x0800 0004.
In general, the host must send the base address where the application to jump to is
programmed.
Start Go
ACK
End of Go
ai14639d
Note: Valid addresses for the Go command are in RAM or Flash memory (refer to STM32 product
datasheets and to AN2606 for more details about the valid memory addresses for the used
device). All other addresses are considered not valid and are NACK-ed by the device.
When an application is loaded into RAM and then a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first area used by the
bootloader firmware (refer to STM32 product datasheets and to AN2606 for more details
about the RAM offset for the used device).
The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
Some products may return two NACKs instead of one when Read protection (RDP) is active
(or Read protection level 1 is active). To know if a given product returns one or two NACKs
in this situation, refer to the known limitations section relative to that product in AN2606.
Start Go
Received bytes = No
0x21+0xDE?
Yes
Yes
RDP active
No
ai14640d
Start WM(1)
Send 0x31+0xCE
ACK
ACK
Send the number of bytes to be written
(1 byte), the data (N + 1 bytes)(2) and checksum
ACK
End of WM(1)
ai14641b
1. WM = Write Memory.
2. N+1 must be a multiple of 4.
Note: Some products may return two NACKs instead of one when Read protection (RDP) is active
(or Read protection level 1 is active). To know if a given product returns one or two NACKs
in this situation, refer to the known limitations section relative to that product in AN2606.
Start WM(1)
Received byte = No
0x31+0xCE?
Yes
No
RDP inactive?
Yes
No
Checksum OK?
Yes
Send ACK byte
No
Checksum OK?
Yes
Supported Yes
memory & not Write to destination memory
Option bytes?
No
End of WM(1)
ai14642e
1. WM = Write Memory.
2. N+1 must be a multiple of 4.
Start ER(1)
Send 0x43+0xBC
ACK
Yes Global No
Erase?
Send 0x00
Send the page numbers
Send checksum
ACK
End of ER(1)
ai14643b
1. ER = Erase Memory.
Start ER(1)
Received bytes = No
0x43+0xBC?
Yes
Yes
RDP active
No
Yes
0xFF received?
No
Checksum No
OK?
Yes
Erase the corresponding pages
End of ER(1)
ai14644c
1. ER = Erase Memory.
Note: After sending the erase memory command and its checksum, if the host sends 0xFF
followed by data different from 0x00, the mass erase is not performed but an ACK is sent by
the device.
The host sends bytes to the STM32 as follows:
Byte 1: 0x43
Byte 2: 0xBC
Wait for ACK
Start EER
NACK
Wait for ACK or NACK
ACK
YES NO
Special Erase ?
NACK
Wait for ACK or NACK
ACK
End of EER
ai17460
Start EER
No
Received bytes = 0x44 + 0xBB ?
Yes
Yes
RDP Active ?
No
End of EER
ai17461c
Start WP(1)
Send 0x63+0x9C
ACK
Send checksum
ACK
End of WP(1)
ai14645b
1. WP = Write Protect.
Start WP(1)
Received bytes = No
0x63+0x9C?
Yes
Yes
RDP active
No
Checksum No
OK?
Yes
Write-protect the requested sectors
End of WP(1)
ai14646c
1. WP = Write Protect.
Start WPUN(1)
Send 0x73+0x8C
ACK
ACK
End of WPUN(1)
ai14647
Start WPUN(1)
Received bytes = No
0x73+0x8C?
Yes
Yes
RDP active
No
End of WPUN(1)
ai14648c
Start RDP_PRM(1)
Send 0x82+0x7D
ACK
ACK
End of RDP_PRM(1)
ai14649
Start RDP_PRM(1)
Received bytes = No
0x82+0x7D?
Yes
Yes
RDP active
No
End of RDP_PRM(1)
ai14650c
Start RDU_PRM(1)
Send 0x92+0x6D
ACK
ACK
End of RDU_PRM(1)
ai14651
Start RDU_PRM(1)
Received bytes No
0x92+0x6D
Yes
Disable RDP
ACK
ACK
ACK
ACK
ACK
MS54095V1
Yes
RDP active?
No
Yes
Number of No
received bytes OK?
Yes
Received CRC No
polynomial OK?
Yes
Received CRC No
initial value OK?
Yes
5 Revision history
STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgment.
Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of Purchasers’ products.
Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.
ST and the ST logo are trademarks of ST. For additional information about ST trademarks, please refer to www.st.com/trademarks. All other
product or service names are the property of their respective owners.
Information in this document supersedes and replaces information previously supplied in any prior versions of this document.