Application Notes |

STM32F101xx and STM32F103xx system memory boot mode

Application Note

Format: (285 kb)

Last Updated: 27/05/2008

Pages: 35

Related Datasheets

High-density access line, ARM-based 32-bit MCU with 256 to 512 KB Flash, 9 timers, 1 ADC and 10 communication interfaces

High-density performance line ARM-based 32bit MCU with 256 to 512 KB Flash, USB, CAN, 11 timers, 3 ADCs, 13 communication interfaces

Low-density access line, ARM-based 32-bit MCU with 16 or 32 KB Flash, 5 timers, ADC and 4 communication interfaces

Low-density performance line, ARM-based 32-bit MCU with 16 or 32 KB Flash, USB, CAN, 6 timers, 2 ADCs, 6 communication interfaces

Medium-density access line, ARM-based 32-bit MCU with 64 or 128 KB Flash, 6 timers, ADC and 7 communication interfaces

Medium-density performance line ARM-based 32-bit MCU with 64 or 128 KB Flash, USB, CAN, 7 timers, 2 ADCs, 9 communication interfaces

Raw Ascii Text- ( Hide )
(Unformatted textual content of the document used by search engines)

AN2606 Application note
STM32F101xx and STM32F103xx system memory boot mode
Introduction
This application note describes the bootloader stored in the system memory of the STM32F101xx and STM32F103xx Flash-memory-based microcontrollers. All STM32F10xxx in production include the bootloader detailed in this application note. The bootloader is used to program the application into the internal Flash memory. For more information about the Flash module organization, refer to the STM32F101xx and STM32F103xx Flash programming manual (PM0042). The specifications cover the architectural model of the bootloader for the STM32F10xxx family, but the low-level communication software supports all the microcontroller families that implement the bootloader.

May 2008

Rev 3

1/35
www.st.com

Contents

AN2606

Contents
1 Bootloader description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1 1.2 1.3 1.4 1.5 Bootloader introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Bootloader activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Hardware requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Choosing the USART baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.5.1 1.5.2 Minimum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Maximum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

1.6

Exiting System memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

2

Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . 12 Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

3

Bootloader version evolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

2/35

AN2606

List of tables

List of tables
Table 1. Table 2. Table 3. Table 4. Table 5. Boot pin configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 STM32F10xxx configuration in System memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 6 Bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

3/35

List of figures

AN2606

List of figures
Figure 1. Figure 2. Figure 3. Figure 4. Figure 5. Figure 6. Figure 7. Figure 8. Figure 9. Figure 10. Figure 11. Figure 12. Figure 13. Figure 14. Figure 15. Figure 16. Figure 17. Figure 18. Figure 19. Figure 20. Figure 21. Figure 22. Figure 23. Bootloader for STM32F10xxx with USART1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Get command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 12 Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 13 Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Read Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Read Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Write Memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4/35

AN2606

Bootloader description

1
1.1

Bootloader description
Bootloader introduction
The bootloader is stored in the internal boot ROM memory (system memory), and its main task is to download the application program to the internal Flash memory through a USART1 communication interface. The main features of the bootloader are the following:

it uses an embedded communication peripheral to download the code (peripherals are handled in polling mode) it transfers and updates the Flash memory code, the data, and the vector table sections

1.2

Bootloader activation
The bootloader is automatically activated by configuring the BOOT0 and BOOT1 pins in the specific "System memory" configuration (see Table 1) and then by applying a reset. Depending on the used pin configuration, the Flash memory, system memory or SRAM is selected as the boot space, as shown in Table 1 below. Table 1. Boot pin configuration
Boot mode BOOT1 X 0 1 0 1 1 BOOT0 User Flash memory User Flash memory is selected as the boot space System memory Embedded SRAM System memory is selected as the boot space Embedded SRAM is selected as the boot space Aliasing

Boot mode selection pins

Table 1 shows that the STM32F10xxx enters the System memory boot mode if the BOOT pins are configured as follows:

BOOT0 = 1 BOOT1 = 0

The values on the BOOT pins are latched on the fourth rising edge of SYSCLK after a reset.

5/35

Bootloader description Table 2. STM32F10xxx configuration in System memory boot mode
State Comment

AN2606

Feature/Peripheral Clock source USART1_RX pin USART1_TX pin SysTick timer USART1 RAM System memory

HSI enabled The system clock is equal to 24 MHz using the PLL Input Output Enabled Enabled PA10 pin: USART1 receives PA9 pin: USART1 transmits Used to automatically detect the serial baud rate from the host. Once initialized the USART1 configuration is: 8-bits, even parity and 1 Stop bit 512 bytes starting from address 0x2000 0000 are used by the booltloader firmware 2 Kbytes starting from address 0x1FFF F000, contain the bootloader firmware

Note:

The system clock is derived from the embedded internal high-speed RC, no external quartz is required for bootloader code.

1.3

Hardware requirements
The hardware required to put the STM32F10xxx into System memory boot mode consists of any circuitry, switch or jumper, capable of holding the BOOT0 pin high and the BOOT1 pin low during reset. To connect to the STM32F10xxx during System memory boot mode, an RS232 serial interface (example, ST3232 RS232 transceiver) has to be directly linked to the USART1_RX (PA10) and USART1_TX (PA9) pins.

Note:

USART1_CK, USART1_CTS and USART1_RTS pins are not used, therefore user can use these pins for other peripherals or GPIOs. For more details about hardware recommendations, refer to application note AN2586: "STM32F10xxx hardware development: getting started", available from the STMicroelectronics website: www.st.com.

6/35

AN2606

Bootloader description

1.4

Bootloader code sequence
Figure 1. Bootloader for STM32F10xxx with USART1

BL reset

Disable all interrupt sources

Configure internal RC mode

Wait for 7Fh from host

Auto-baud rate sequence send ACK byte & disable unused peripherals

Wait for a command Command received GET cmd GET cmd routine RD cmd routine (optional) load routines into RAM GO cmd routine GO cmd

JP to_Address
ai14630

Once the System memory boot mode is entered and the STM32F10xxx has been configured as described above, the bootloader code begins to scan the PA10 pin (USART1_RX line), waiting to receive 0x7F data: one start bit, 0x7F data bits, even parity bit and one stop bit. The duration of this data byte is measured using the Systick timer. The count value of the timer is then used to calculate the corresponding baud rate factor with respect to the current system clock. Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an acknowledge byte (0x79) is returned to the host, which signals that the STM32F10xxx is ready to receive user commands.

7/35

Bootloader description

AN2606

1.5

Choosing the USART baud rate
The calculation of the serial baud rate for USART1, from the length of the first byte that is received, is used to operate the bootloader within a wide range of baud rates. However, the upper and lower limits have to be kept, in order to ensure proper data transfer. For a correct data transfer from the host to the STM32F10xxx, the maximum deviation between the internal initialized baud rate for USART1 and the real baud rate of the host should be below 2.5%. The deviation (fB, in percent) between the host baud rate and the STM32F10xxx baud rate can be calculated using the formula below: TM32F xx baud rate Host baud rate f B = S--------------------x------------------------------------------------------------------------------ × 100 % , where fB 2.5%. ---STM32Fxxx baud rate This baud rate deviation is a nonlinear function depending on the CPU clock and the baud rate of the host. The maximum of the function (fB) increases with the host baud rate. This is due to the smaller baud rate prescale factors, and the implied higher quantization error.

1.5.1

Minimum baud rate
The lowest tested baud rate (BLow) is 1200. Baud rates below BLow would cause the SysTick timer to overflow. In this event, USART1 would not be correctly initialized.

1.5.2

Maximum baud rate
BHigh is the highest baud rate for which the deviation still does not exceed the limit. All baud rates between BLow and BHigh are below the deviation limit. The highest tested baud rate (BHigh) is 115 200.

1.6

Exiting System memory boot mode
System memory boot mode must be exited in order to execute a program in a normal User mode. The STM32F10xxx may exit this mode by applying a hardware reset. At the time of reset, the BOOT pins (BOOT0 and BOOT1) must be set at the proper levels to enter the desired user mode (see Table 1). Following the reset, the CPU starts code execution from the boot memory located at the bottom of the memory address space starting from 0x0000 0000.

8/35

AN2606

Bootloader command set

2

Bootloader command set
The supported commands are listed in Table 3 below. Each command is further described in this section. Table 3. Bootloader commands
Command(1) Get(2) Get Version & Read Protection Status(2) Get ID(2) Read Memory Go Write Memory Erase Write Protect(3) Command code 0x00 0x01 0x02 0x11 0x21 0x31 0x43 0x63 0x73 0x82 0x92 Command description Gets the version and the allowed commands supported by the current version of the bootloader Gets the bootloader version and the Read Protection status of the Flash memory Gets the chip ID Reads up to 256 bytes of memory starting from an address specified by the user Jumps to an address specified by the user to execute (a loaded) code Writes up to 256 bytes to the RAM or Flash memory starting from an address specified by the user Erases from one to all the Flash memory pages Enables the write protection for some sectors Disables the write protection for all Flash memory sectors Enables the read protection Disables the read protection

Write Unprotect(3) Readout Protect(2) Readout Unprotect(2)

1. If a denied command is received or an error occurs during the command execution, the bootloader sends NACK byte and goes back to command checking. 2. Read protection When the RDP (read protection) option is active, only this limited subset of commands is available. All other commands are NACKed and have no effect on the device. Once the RDP has been removed, the other commands become active. 3. On the STM32F10xxx, the sector size is 4 KBytes so, depending on the product, this could be 4 pages (when the page is 1 Kbyte) or 2 pages (when the page is 2 KBytes) for the Write Protect and Write Unprotect commands.

Communication safety
All communications from the programming tool (PC) to the device are verified by: 1. checksum: all received bytes are XORed. A byte containing the computed XOR of all previous bytes is added to the end of each communication (checksum byte). By XORing all received bytes, data + checksum, the result at the end of the packet must be 0x00. for each command the host sends a byte and its complement (XOR = 0x00) UART: parity check active (even parity) ACK = 0x79 NACK = 0x1F

2. 3.

Each packet is either accepted (ACK answer) or discarded (NACK answer):

9/35

Bootloader command set

AN2606

2.1

Get command
The Get command allows the user to get the version of the bootloader and the supported commands. When the bootloader receives the Get command, it transmits the bootloader version and the supported command codes to the host, as described in Figure 2. Figure 2. Get command: host side
Start Get

Send 0x00 + 0xFF

Wait for ACK or NACK ACK

NACK

Receive the number of bytes (version+commands)

Receive the bootloader version

Receive the supported commands

Wait for ACK or NACK

NACK

ACK End of Get
ai14631

10/35

AN2606 Figure 3. Get command: device side
Start Get

Bootloader command set

Received byte = 0x00+0xFF?

No

Send NACK byte

Yes Send ACK byte Send the number of bytes (version+commands)

Send the bootloader version

Send the supported commands

Send ACK byte

End of Get
ai14632

The STM32F10xxx sends the bytes as follows: Byte 1: Byte 2: Byte 3: Byte 4: Byte 5: Byte 6: Byte 7: Byte 8: Byte 9: Byte 10: Byte 11: Byte 12: Byte 13: Byte 14: ACK N = 11 = the number of bytes to follow 1 except current and ACKs. Bootloader version (0 < Version < 255): 0x21 = Version 2.1 0x00 0x01 0x02 0x11 0x21 0x31 0x43 0x63 0x73 0x82 0x92
Get command Get Version and Read Protection Status Get ID Read Memory command Go command Write Memory command Erase command Write Protect command Write Unprotect command Readout Protect command Readout Unprotect command

Last byte (15): ACK

11/35

Bootloader command set

AN2606

2.2

Get Version & Read Protection Status command
The Get Version & Read Protection Status command is used to get the bootloader version and the read protection status. When the bootloader receives the command, it transmits the information described below (version, read protection: number of times it was enabled and disabled) to the host. Figure 4. Get Version & Read Protection Status command: host side
Star t GV(1)

Send 0x01+0xFE

Wait for ACK or NACK ACK

NACK

Receive the bootloader version Receive the number of times the read protection was disabled Receive the number of times the read protection was enabled

Wait for ACK or NACK

NACK

ACK End of GV(1)
ai14633

1. GV = Get Version & Read Protection Status.

12/35

AN2606 Figure 5.

Bootloader command set Get Version & Read Protection Status command: device side
Start GV(1)

Received byte = 0x01+0xFE?

No

Send NACK byte

Yes Send ACK byte

Send the bootloader version

Option byte 1

Option byte 2

Send ACK byte End of GV(1)
ai14634

1. GV = Get Version & Read Protection Status.

The STM32F10xxx sends the bytes as follows: Byte 1: Byte 2: Byte 3: Byte 4: Byte 5: ACK The version of the bootloader (0 < Version 255)): 0x21 = Version 2.1 Option byte 1: 0x00 to keep the compatibility with generic bootloader protocol Option byte 2: 0x00 to keep the compatibility with generic bootloader protocol ACK

13/35

Bootloader command set

AN2606

2.3

Get ID command
The Get ID command is used to get the version of the chip ID (identification). When the bootloader receives the command, it transmits the product ID to the host. Figure 6. Get ID command: host side
Star t GID(1)

Send 0x02+0xFD

Wait for ACK or NACK ACK

NACK

Receive N = number of bytes 1 Receive PID

Wait for ACK or NACK ACK End of GID(1)

NACK

ai14633

1. GID = Get ID.

Figure 7.

Get ID command: device side
Start GID(1)

Received byte = 0x02+0xFD?

No

Send NACK byte

Yes Send ACK byte

Send N = number of bytes 1

Send product ID

Send ACK byte End of GID(1)
ai14636

1. GID = Get ID.

14/35

AN2606 The STM32F10xxx sends the bytes as follows: Byte 1: Byte 2: ACK

Bootloader command set

N = the number of bytes 1 (N = 1 for STM32F10xxx), except for current byte and ACKs.

Bytes 3-4: PID(1) byte 3 = 0x04, byte 4 = 0x1X Byte 5: ACK

1. PID: is the product ID, which may be 0x0410, 0x0412 or 0x0414 according to the STM32F10xxx product.

15/35

Bootloader command set

AN2606

2.4

Read Memory command
The Read Memory command is used to read data from any memory address in RAM, Flash memory and information block (System memory or option byte areas). When the bootloader receives the Read Memory command, it transmits the ACK byte to the user. After the transmission of the ACK byte, the bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, then it checks the received address. If the address is valid and the checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address is valid and the checksum is correct, the bootloader waits for the number of bytes to be transmitted (N bytes) and for its complemented byte (checksum). If the checksum is correct it then transmits the needed data ((N + 1) bytes) to the user, starting from the received address. If the checksum is not correct, it sends a NACK before aborting the command. Figure 8. Read Memory command: host side
Star t RM(1)

Send 0x11+0xEE

Wait for ACK or NACK ACK

NACK

Send the start address (4 bytes) with checksum

Wait for ACK or NACK ACK

NACK

Send the number of bytes to be read (1 byte) and a checksum (1 byte)

Wait for ACK or NACK

NACK

ACK
Receive data from the BL

End of RM(1)
ai14637

1. RM = Read Memory.

16/35

AN2606 Figure 9. Read Memory command: device side

Bootloader command set

Star t RM(1)

Received byte = 0x11+0xEE Yes

No

ROP active No Send ACK byte

Yes

Receive the start address (4 bytes) with checksum

Address valid & checksum OK? Yes Send ACK byte

No

Receive the number of bytes to be read (1 byte) and a checksum (1 byte)

Checksum OK? Yes Send ACK byte

No

Send NACK byte

Send data to the host

End of RM(1)
ai14638

1. RM = Read Memory.

17/35

Bootloader command set The host sends the bytes to the STM32F10xxx as follows: Bytes 1-2: 0x11+0xEE Wait for ACK Bytes 3 to 6: star t address

AN2606

byte 3: MSB byte 6: LSB

Byte 7:

Checksum: XOR (byte 3, byte 4, byte 5, byte 6) Wait for ACK The number of bytes to be read 1 (0 < N 255); Checksum: XOR byte 8 (complement of byte 8)

Byte 8: Byte 9:

2.5

Go command
The Go command is used to execute the downloaded code or any other code by branching to an address specified by the user. When the bootloader receives the Go command, it transmits the ACK byte to the user. After the transmission of the ACK byte, the bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is LSB) and a checksum byte, then it checks the received address. If the address is valid and the checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address is valid and the checksum is correct, the program counter of the CPU automatically jumps to the address. Figure 10. Go command: host side
Star t Go

Send 0x21+0xDE

Wait for ACK or NACK ACK

NACK

Send the start address (4 bytes) & checksum

Wait for ACK or NACK ACK End of Go

NACK

ai14639

18/35

AN2606 Note:

Bootloader command set Valid addresses are RAM (starting from 0x2000 0000 to the end of the RAM) or Flash memory (starting from 0x800 0000 to the end of the Flash memory ) addresses. All other addresses are considered not valid and will be NACKed by the device. When an application is loaded into RAM and then a jump is made to it, the program must be configured to run with an offset of at least 0x200 to avoid overlapping with the first 0x200 RAM memory used by the bootloader firmware. The Go command must be used after loading an application into RAM or user Flash memory. It will initialize the main stack pointer and jump to the loaded code. Figure 11. Go command: device side
Star t Go

Received bytes = 0x21+0xDE? Yes ROP active No Send ACK byte

No

Yes

Receive the start address (4 bytes) & checksum Send ACK byte

Address valid & checksum OK?

No

Send NACK byte

Send ACK byte End of Go Jump to address
ai14640b

The host sends the bytes as follow to the STM32F10xxx: Byte 1: Byte 2: 0x21 0xDE Wait for ACK Byte 3 to Byte 6: star t address byte3: MSB byte6: LSB Byte 7: checksum: XOR (byte 3, byte 4, byte 5, byte 6)

19/35

Bootloader command set

AN2606

2.6

Write Memory command
The Write Memory command is used to write data to any memory address of RAM, Flash memory, or Option byte area. Refer to the STM32F101xx and STM32F103xx Flash programming manual. When the bootloader receives the Write Memory command, it transmits the ACK byte to the user. After the transmission of the ACK byte, the bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, it then checks the received address. For the Option byte area, the start address must be 0x1FFFF800 to avoid writing inopportunely in this area. If the received address is valid and the checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address is valid and the checksum is correct, the bootloader:

gets a byte, N, which contains the number of data bytes to be received receives the user data ((N + 1) bytes) and the checksum (XOR of N and of all data bytes) programs the user data to memory starting from the received address at the end of the command, if the write operation was successful, the bootloader transmits the ACK byte; otherwise it transmits a NACK byte to the user and aborts the command

The maximum length of the block to be written for the STM32F10xxx is 256 bytes. If the Write Memory command is issued to the Option byte area, then at the end of the command the BL generates a system Reset to take into account the new configuration of the option byte. Note: When writting to the RAM, care must be taken to avoid overlapping with the first 512 bytes (0x200) in RAM because they are used by the bootloader firmware.

20/35

AN2606 Figure 12. Write Memory command: host side

Bootloader command set

Star t WM(1)

Send 0x31+0xCE

Wait for ACK or NACK ACK

NACK

Send the start address (4 bytes) & checksum

Wait for ACK or NACK ACK

NACK

Send the number of bytes to be written (1 byte), the data (N + 1) bytes) & checksum

Wait for ACK or NACK ACK End of WM(1)

NACK

ai14641

1. WM = Write Memory.

Note:

If the start address is invalid, the command is NACKed by the device.

21/35

Bootloader command set Figure 13. Write Memory command: device side
Star t WM(1)

AN2606

Received byte = 0x31+0xCE? Yes ROP active Yes Send ACK byte

No

No

Receive the start address (4 bytes) & checksum

Checksum OK? Yes Send ACK byte

No

Receive the number of bytes to be written (1 byte), the data (N + 1 bytes) & the checksum

Checksum OK? Yes Flash memory address? Yes

No

Yes

Write the received data to Flash memor y from the start address

Yes RAM address? Yes Option byte address? & address = 0x1FFF F800?

Write the received data to RAM from the start address

Yes

Write the Keys for Option byte area access Write the received data to Option byte area from start address

No Send ACK byte

Send ACK byte

Send NACK byte

Generate system reset

End of WM(1)

ai14642b

1. WM = Write Memory.

22/35

AN2606 The host sends the bytes to the STM32F10xxx as follows: Byte 1: Byte 2: 0x31 0xCE Wait for ACK Byte 3 to byte 6: star t address byte 3: MSB byte 6: LSB Byte 7: Checksum: XOR (Byte3, Byte4, Byte5, Byte6) Wait for ACK Byte 8: Number of bytes to be received (0 < N 255)

Bootloader command set

N +1 data bytes:(Max 256 bytes) Checksum byte: XOR (N, N+1 data bytes)

23/35

Bootloader command set

AN2606

2.7

Erase Memory command
The Erase Memory command allows the host to erase Flash memory pages. When the bootloader receives the Erase Memory command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the bootloader receives one byte (number of pages to be erased), the Flash memory page codes and a checksum byte; if the checksum is correct then bootloader erases the memory and sends an ACK byte to the host, otherwise it sends a NACK byte to the host and the command is aborted. Erase Memory command specifications: 1. the bootloader receives one byte that contains N, the number of pages to be erased 1. N = 255 is reserved for global erase requests. For 0 N 254, N + 1 pages are erased. the bootloader receives (N + 1) bytes, each byte containing a page number

2.

Figure 14. Erase Memory command: host side
Star t ER(1)

Send 0x43+0xBC

Wait for ACK or NACK ACK Yes Global Erase?

NACK

No

Send 0xFF

Send the number of pages to be erased (1 byte) Send the page numbers

Send 0x00

Send checksum

Wait for ACK or NACK ACK End of ER(1)

NACK

ai14643b

1. ER = Erase Memory.

24/35

AN2606 Figure 15. Erase Memory command: device side
Star t ER(1)

Bootloader command set

Received bytes = 0x43+0xBC? Yes ROP active No Send ACK byte

No

Yes

Receive the number of pages to be erased (1 byte)

Yes

0xFF received? No Receive the page codes No

Yes Star t Global Erase (Mass Erase) Receive the checksum

Checksum OK? Yes

No

Erase the corresponding pages

Send ACK byte

Send NACK byte

End of ER(1)
ai14642b

1. ER = Erase Memory.

The host sends the bytes to the STM32F10xxx as follows: Byte 1: 0x43 Byte 2: 0xBC Wait for ACK Byte 3: 0xFF or number of pages to be erased (0 N maximum number of pages) Byte 0x00 or (N + 1 bytes (page numbers) and then the checksum for byte 3 and the following bytes)

25/35

Bootloader command set

AN2606

2.8

Write Protect command
The Write Protect command is used to enable the write protection for some or all Flash memory sectors. When the bootloader receives the Write Protect command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the bootloader waits for the number of bytes to be received (sectors to be protected) and then receives the Flash memory sector codes from the user. If the write protection was enabled successfully, the bootloader transmits the ACK byte, otherwise it transmits a NACK byte to the user and the command is aborted. At the end of the Write Protect command, the BL generates a system Reset to take into account the new configuration of the option byte.

Note:

On the STM32F10xxx, the sector size is 4 Kbytes (4 pages when the page size is 1 Kbyte and 2 pages when the page is 2 Kbytes) for the Write Protect command. The Write Protect command sequence is as follows:

the bootloader receives one byte that contains N, the number of sectors to be writeprotected 1 (0 N 255) the bootloader receives (N + 1) bytes, each byte contains a sector code

Note:

If a second Write Protect command is executed, the Flash memory sectors that had been protected by the first command become unprotected and only the sectors passed within the second Write Protect command become protected. Figure 16. Write Protect command: host side
Star t WP(1)

Send 0x63+0x9C

Wait for ACK or NACK ACK

NACK

Send the number of sectors to be protected (1 byte) Send the sector codes

Send checksum

Wait for ACK or NACK ACK End of WP(1)

NACK

ai14645b

1. WP = Write Protect.

26/35

AN2606 Figure 17. Write Protect command: device side

Bootloader command set

Star t WP(1)

Received bytes = 0x63+0x9C? Yes ROP active No Send ACK byte

No

Yes

Receive the number of sectors to be protected (1 byte) Receive the sector codes

Receive the checksum

Checksum OK? Yes

No

Write-protect the requested sectors

Send ACK byte

Send NACK byte

Generate system reset

End of WP(1)
ai14646b

1. WP = Write Protect.

27/35

Bootloader command set

AN2606

2.9

Write Unprotect command
The Write Unprotect command is used to disable the write protection of all the Flash memory sectors. When the bootloader receives the Write Unprotect command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the bootloader disables the write protection of all the Flash memory sectors. If the unprotection operation was successful the bootloader transmits the ACK byte, otherwise it transmits a NACK byte to the user. At the end of the Write Unprotect command, the BL generate a system Reset to take into account the new configuration of the option byte. Figure 18. Write Unprotect command: host side

Star t WPUN(1)

Send 0x73+0x8C

Wait for ACK or NACK ACK Wait for ACK or NACK ACK End of WPUN(1)

NACK

NACK

ai14647

1. WPUN = Write Unprotect.

28/35

AN2606 Figure 19. Write Unprotect command: device side
Star t WPUN(1)

Bootloader command set

Received bytes = 0x73+0x8C? Yes ROP active No Send ACK byte

No

Yes

Remove the protection for the entire Flash memory

Send ACK byte

Send NACK byte

Generate system reset

End of WPUN(1)
ai14648b

1. WPUN = Write Unprotect.

29/35

Bootloader command set

AN2606

2.10

Readout Protect command
The Readout Protect command is used to enable the Flash memory read protection. When the bootloader receives the Readout Protect command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the bootloader enables the read protection for the Flash memory. If the protection operation was successful the bootloader transmits the ACK byte, otherwise it transmits a NACK byte to the user. At the end of the Readout Protect command, the BL generates a system Reset to take into account the new configuration of the option byte. Figure 20. Readout Protect command: host side
Star t RDP_PRM(1)

Send 0x82+0x7D

Wait for ACK or NACK ACK Wait for ACK or NACK ACK End of RDP_PRM(1)

NACK

NACK

ai14649

1. RDP_PRM = Readout Protect.

30/35

AN2606 Figure 21. Readout Protect command: device side
Star t RDP_PRM(1)

Bootloader command set

Received bytes = 0x82+0x7D? Yes ROP active No Send ACK byte

No

Yes

Activate Read protection for Flash memor y

Send ACK byte

Send NACK byte

Generate system reset

End of RDP_PRM(1)
ai14650b

1. RDP_PRM = Readout Protect.

31/35

Bootloader command set

AN2606

2.11

Readout Unprotect command
The Readout Unprotect command is used to disable the Flash memory read protection. When the bootloader receives the Readout Unprotect command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the bootloader erases all the Flash memory sectors and it disables the read protection for the entire Flash memory. If the erase operation is successful, the bootloader deactivates the RDP. If the RDP deactivation is successful, the bootloader transmits an ACK, otherwise, it transmits a NACK. If the erase operation is unsuccessful, the bootloader transmits a NACK and the read protection remains active. At the end of the Readout Unprotect command, the BL generates a system Reset to take into account the new configuration of the option byte. Figure 22. Readout Unprotect command: host side
Star t RDU_PRM(1)

Send 0x92+0x6D

Wait for ACK or NACK ACK Wait for ACK or NACK ACK End of RDU_PRM(1)

NACK

NACK

ai14651

1. RDU_PRM = Readout Unprotect.

Figure 23. Readout Unprotect command: device side
Star t RDU_PRM(1)

Received bytes = 0x92+0x6D? Yes Send ACK byte

No

Disable ROP Send ACK byte Generate system reset Send NACK byte

End of RDU_PRM(1)
ai14652c

1. RDU_PRM = Readout Unprotect.

32/35

AN2606

Bootloader version evolution

3

Bootloader version evolution
Table 4 lists the bootloader versions. Table 4. Bootloader versions
Description Initial bootloader version. Update Go Command to initialize the main stack pointer Update Go command to return NACK when jump address is in the Option byte area or System memory area Update Get ID command to return the device ID on two bytes Update the bootloader version to V2.1

Bootloader version number V2.0

V2.1

33/35

Revision history

AN2606

Revision history
Table 5.
Date 22-Oct-2007

Document revision history
Revision 1 Initial release. All STM32F10xxx in production (rev. B and rev. Z) include the bootloader described in this application note. Modified: Section 1.2: Bootloader activation and Section 1.4: Bootloader code sequence. Added: Section 1.3: Hardware requirements, Section 1.5: Choosing the USART baud rate, Section 1.6: Using the bootloader and Section 1.6: Exiting System memory boot mode. Note 2 linked to Get, Get Version & Read Protection Status and Get ID commands in Table 3: Bootloader commands, Note 3 added. Notion of "permanent" (Permanent Write Unprotect/Readout Protect/Unprotect) removed from document. Small text changes. Bootloader version upgraded to 2.0. Small text changes. RAM and System memory added to Table 2: STM32F10xxx configuration in System memory boot mode. Section 1.6: Using the bootloader on page 8 removed. Erase modified, Note 3 modified and Note 1 added in Table 3: Bootloader commands on page 9. Byte 3: on page 11 modified. Byte 2: on page 13 modified. Byte 2:, Bytes 3-4: and Byte 5: on page 15 modified, Note 3 modified. Byte 8: on page 18 modified. Notes added to Section 2.5: Go command on page 18. Figure 11: Go command: device side on page 19 modified. Note added in Section 2.6: Write Memory command on page 20. Byte 8: on page 23 modified. Figure 14: Erase Memory command: host side and Figure 15: Erase Memory command: device side modified. Byte 3: on page 25 modified. Table 3: Bootloader commands on page 9. Note modified and note added in Section 2.8: Write Protect command on page 26. Figure 16: Write Protect command: host side, Figure 17: Write Protect command: device side, Figure 19: Write Unprotect command: device side, Figure 21: Readout Protect command: device side and Figure 23: Readout Unprotect command: device side modified. Changes

22-Jan-2008

2

26-May-2008

3

34/35

AN2606

Please Read Carefully:

Information in this document is provided solely in connection with ST products. STMicroelectronics NV and its subsidiaries ("ST") reserve the right to make changes, corrections, modifications or improvements, to this document, and the products and services described herein at any time, without notice. All ST products are sold pursuant to ST's terms and conditions of sale. Purchasers are solely responsible for the choice, selection and use of the ST products and services described herein, and ST assumes no liability whatsoever relating to the choice, selection or use of the ST products and services described herein. No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted under this document. If any part of this document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products or services, or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such third party products or services or any intellectual property contained therein.

UNLESS OTHERWISE SET FORTH IN ST'S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY WITH RESPECT TO THE USE AND/OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (AND THEIR EQUIVALENTS UNDER THE LAWS OF ANY JURISDICTION), OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS EXPRESSLY APPROVED IN WRITING BY AN AUTHORIZED ST REPRESENTATIVE, ST PRODUCTS ARE NOT RECOMMENDED, AUTHORIZED OR WARRANTED FOR USE IN MILITARY, AIR CRAFT, SPACE, LIFE SAVING, OR LIFE SUSTAINING APPLICATIONS, NOR IN PRODUCTS OR SYSTEMS WHERE FAILURE OR MALFUNCTION MAY RESULT IN PERSONAL INJURY, DEATH, OR SEVERE PROPERTY OR ENVIRONMENTAL DAMAGE. ST PRODUCTS WHICH ARE NOT SPECIFIED AS "AUTOMOTIVE GRADE" MAY ONLY BE USED IN AUTOMOTIVE APPLICATIONS AT USER'S OWN RISK.

Resale of ST products with provisions different from the statements and/or technical features set forth in this document shall immediately void any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever, any liability of ST.

ST and the ST logo are trademarks or registered trademarks of ST in various countries. Information in this document supersedes and replaces all information previously supplied. The ST logo is a registered trademark of STMicroelectronics. All other names are the property of their respective owners.

2008 STMicroelectronics - All rights reserved STMicroelectronics group of companies Australia - Belgium - Brazil - Canada - China - Czech Republic - Finland - France - Germany - Hong Kong - India - Israel - Italy - Japan Malaysia - Malta - Morocco - Singapore - Spain - Sweden - Switzerland - United Kingdom - United States of America www.st.com

35/35

Document Number: 13801



All rights reserved © 2009 STMicroelectronics :: Terms Of Use :: Privacy Policy