cd00264321

AN3154
Application note
CAN protocol used in the STM32 bootloader
Introduction
This application note describes the CAN protocol used in the STM32 microcontroller
bootloader. It details each supported command. For more information about the CAN
hardware resources and requirements for your device bootloader, please refer to the
application note AN2606 “STM32 system memory boot mode”.
Table 1. Applicable products
Type
Microcontrollers
May 2014
Part number or product series
STM32F1 series:
– STM32F105xx, STM32F107xx,
STM32F2 series
STM32F4 series:
– STM32F405xx, STM32F407xx
– STM32F415xx, STM32F417xx
– STM32F427xx, STM32F429xx
– STM32F437xx, STM32F439xx
DocID017063 Rev 5
1/34
www.st.com
Contents
AN3154
Contents
1
Bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2
CAN settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3
Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1
Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2
Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . . .11
3.3
Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.4
Speed command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.5
Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.6
Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.7
Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.8
Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.9
Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.10
Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.11
Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.12
Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4
Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 32
5
Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
2/34
DocID017063 Rev 5
AN3154
List of tables
List of tables
Table 1.
Table 2.
Table 3.
Table 4.
Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
CAN bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
DocID017063 Rev 5
3/34
3
List of figures
AN3154
List of figures
Figure 1.
Figure 2.
Figure 3.
Figure 4.
Figure 5.
Figure 6.
Figure 7.
Figure 8.
Figure 9.
Figure 10.
Figure 11.
Figure 12.
Figure 13.
Figure 14.
Figure 15.
Figure 16.
Figure 17.
Figure 18.
Figure 19.
Figure 20.
Figure 21.
Figure 22.
Figure 23.
Figure 24.
Figure 25.
Figure 26.
Figure 27.
4/34
Bootloader for STM32 with CAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Check HSE frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
CAN frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Get command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 11
Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 12
Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Speed command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Speed command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Read memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Read memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Write memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
DocID017063 Rev 5
AN3154
1
Bootloader code sequence
Bootloader code sequence
Figure 1. Bootloader for STM32 with CAN
&RAMEDETECTED ON#!.X?2XPIN
#HECK(3%FREQUENCY
7AITFORA
COMMAND
#OMMAND
RECEIVED
'%4CMD
'%4CMD
ROUTINE
2$CMD
ROUTINE
OPTIONAL
2OUTINESFOR
LOADING
INTO2!-
'/CMD
'/CMD
ROUTINE
*0TO?!DDRESS
AIB
1. it is recommended to send a frame with a Standard ID = 0x79.
Once the system memory boot mode is entered and the STM32 device has been configured
(for more details refer to application note AN2606 “STM32 system memory boot mode”), the
bootloader code waits for a frame on the CANx_Rx pin. When a detection occurs the CAN
bootloader firmware starts to check the external clock frequency.
Figure 2 shows the flowchart of the frequency check.
DocID017063 Rev 5
5/34
33
Bootloader code sequence
AN3154
Figure 2. Check HSE frequency
Start check HSE frequency
HSE measured with HSI
and Timer (1)
No HSE measurement (1)
Configure CAN baudrate at 125 Kbps
Assuming that HSE = 8 MHz
Initialize timeout at ~1.5 ms
Message
received with stdID=0x79
and without frame error?
Configure external Oscillator mode
(System Clock = 60 MHz)
Initialize timeout at ~3 ms
Yes
Yes
No
Message
received with stdID=0x79
and without frame error
?
No
No
No
Decrement timeout
Timeout=0x0?
Decrement timeout
Timeout = 0x0 ?
Yes
Yes
Configure CAN baudrate at 125Kbps
Assuming that HSE = 25MHz
Initialize timeout at ~1.5 ms
Message
received with stdID=0x79
and without frame error
?
Generate System Reset
Yes
No
No
Decrement timeout
Timeout = 0x0 ?
Yes
Configure CAN baudrate at 125Kbps
Assuming that HSE = 14.7456MHz
Initialize timeout at ~1.5 ms
Message
received with stdID=0x79
and without frame error
?
Yes
No
No
Decrement timeout
Timeout = 0x0 ?
Yes
Enter an infinite loop, waiting for any
CAN bootloader command.
Generate System Reset
ai15704c
1. For some devices, the HSE frequency is calculated using HSI oscillator connected to a timer. For other
devices, this measurement is not implemented. For the devices without HSE frequency measurement, only
the flow represented on the left is executed, while for the devices with HSE frequency measurement, only
the flow on the right is executed. To know which flow is relative to your device, please refer to AN2606.
6/34
DocID017063 Rev 5
AN3154
CAN settings
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to
receive commands.
2
CAN settings
The STM32 CAN is compliant with the 2.0A and B (active) specifications with a bitrate up to
1 Mbit/s. It can receive and transmit standard frames with 11-bit identifiers as well as
extended frames with 29-bit identifiers.
Figure 3 shows a CAN frame that uses the standard identifier only.
Figure 3. CAN frame
#ONTROLFIELD
$,#
#2#FIELD
!#+FIELD
#2#
242
)$%
R
)$
$ATAFIELD
.
%/&
!#+
!RBITRATIONFIELD
3/&
)NTERFRAMESPACE
OROVERLOADFRAME
$ATAFRAMESTANDARDIDENTIFIER
.
)NTERFRAMESPACE
AI
In this application, the CAN settings are:
•
Standard identifier (not extended)
•
Bitrate: at the beginning it is 125 kbps; during runtime it can be changed via the speed
command to achieve a maximum bit rate of 1 Mbps.
The transmit settings (from the STM32 to the host) are:
•
Tx mailbox0: On
•
Tx mailbox1 and Tx mailbox2: Off
•
Tx identifier: (0x00, 0x01, 0x02, v03, 0x11, 0x21, 0x31, 0x43, 0x63, 0x73, 0x82, 0x92)
The receive settings (from the host to the STM32) are:
Note:
•
Synchronization byte, 0x79, is in the RX identifier and not in the data field.
•
RX identifier depends on the command (0x00, 0x01, 0x02, 0x03, 0x11, 0x21, 0x31,
0x43, 0x63, 0x73, 0x82, 0x92).
•
Error checking: If the error field (bit [6:4] in the CAN_ESR register) is different from
000b, the message is discarded and a NACK is sent to the host.
•
In FIFO overrun condition, the message is discarded and a NACK is sent to the host.
•
Incoming messages can contain from 1 to 8 data bytes.
The CAN bootloader firmware supports only one node at a time. This means that CAN
Network Management is not supported by the firmware.
DocID017063 Rev 5
7/34
33
Bootloader command set
3
AN3154
Bootloader command set
The supported commands are listed in Table 2. Each command is further described in this
section.
Table 2. CAN bootloader commands
Command
Command code
Command description
Get(1)
0x00
Gets the version and the allowed commands
supported by the current version of the bootloader
Get Version &
Read Protection Status(1)
0x01
Gets the bootloader version and the Read Protection
status of the Flash memory
Get ID(1)
0x02
Gets the chip ID
Speed
0x03
The speed command allows the baud rate for CAN
run-time to be changed.
Read Memory(2)
0x11
Reads up to 256 bytes of memory starting from an
address specified by the application
Go(2)
0x21
Jumps to user application code located in the internal
Flash memory or in SRAM
Write Memory(2)
0x31
Writes up to 256 bytes to the RAM or Flash memory
starting from an address specified by the application
Erase(2)
0x43
Erases from one to all the Flash memory sectors
Write Protect
0x63
Enables the write protection for some sectors
Write Unprotect
0x73
Disables the write protection for all Flash memory
sectors
Readout Protect(1)
0x82
Enables the read protection
Readout Unprotect(1)
0x92
Disables the read protection
1. Read protection – When the RDP (read protection) option is active, only this limited subset of commands is
available. All other commands are NACKed and have no effect on the device. Once the RDP has been
removed, the other commands become active.
2. Please refer to STM32 product datasheet and AN2606 “STM32 microcontroller system memory boot
mode” to know which memory spaces are valid for these commands.
Communication safety
Each packet is either accepted (ACK answer) or discarded (NACK answer):
3.1
•
ACK message = 0x79
•
NACK message = 0x1F
Get command
The Get command allows the host to get the version of the bootloader and the supported
commands. When the bootloader receives the get command, it transmits the bootloader
version and the supported command codes to the host.
8/34
DocID017063 Rev 5
AN3154
Bootloader command set
Figure 4. Get command: host side
3TARTGETCOMMAND
3ENDMESSAGEWITHSTD)$H
7AITFOR!#+
OR.!#+
.!#+
!#+
2ECEIVEMESSAGENUMBEROFBYTES
VERSIONCOMMANDS
2ECEIVEMESSAGE"OOTLOADERVERSION
2ECEIVEMESSAGE'ETCOMMAND
2ECEIVEMESSAGE'ET6ERSION
2EAD0ROTECTIONSTATUSCOMMAND
2ECEIVEMESSAGE'ET)$COMMAND
2ECEIVEMESSAGE3PEEDCOMMAND
2ECEIVEMESSAGE2EADCOMMAND
2ECEIVEMESSAGE'OCOMMAND
2ECEIVEMESSAGE7RITEMEMORYCOMMAND
2ECEIVEMESSAGE%RASEMEMORYCOMMAND
2ECEIVEMESSAGE7RITE0ROTECTCOMMAND
2ECEIVEMESSAGE7RITE5NPROTECTCOMMAND
2ECEIVEMESSAGE2EADOUT0ROTECTCOMMAND
2ECEIVEMESSAGE2EADOUT5NPROTECTCOMMAND
7AITFOR!#+
OR.!#+
%NDOFGETCOMMAND
DocID017063 Rev 5
AI
9/34
33
Bootloader command set
AN3154
The host sends messages as follows:
Command message: Std ID = 0x00, data length code (DLC) = ‘not important’.
Figure 5. Get command: device side
3TARTGETCOMMAND
2ECEIVEDMESSAGE
WITH)$X
.O
9ES
3END!#+MESSAGE
3END.!#+MESSAGE
3ENDMESSAGE.UMBEROFBYTES
VERSIONCOMMANDS
3ENDMESSAGE"OOTLOADERVERSION
3ENDMESSAGES3UPPORTEDCOMMANDS
3END!#+MESSAGE
%NDOFGETCOMMAND
AI
The STM32 sends messages as follows:
Message 1: Std ID = 0x00, DLC = 1, data = 0x79 - ACK
Message 2: Std ID = 0x00, DLC = 1 data = N = 12 = the number of bytes to be sent -1
(1 ≤N +1 ≤256)
Message 3: Std ID = 0x00, DLC = 1, data = bootloader version (0 < version ≤255)
Message 4: Std ID = 0x00, DLC = 1, data = 0x00 - Get command
Message 5: Std ID = 0x00, DLC = 1, data = 0x01 - Get Version & Read Protection
Status command
Message 6: Std ID = 0x00, DLC = 1, data = 0x02 - Get ID command
Message 7: Std ID = 0x00, DLC = 1, data = 0x03 - Speed command
Message 8: Std ID = 0x00, DLC = 1, data = 0x11 - Read memory command
Message 9: Std ID = 0x00, DLC = 1, data = 0x21 - Go command
Message 10: Std ID = 0x00, DLC = 1, data = 0x31 - Write memory command
Message 11: Std ID = 0x00, DLC = 1, data = 0x43 - Erase memory command
10/34
DocID017063 Rev 5
AN3154
Bootloader command set
Message 12: Std ID = 0x00, DLC = 1, data = 0x63 - Write Protect command
Message 13: Std ID = 0x00, DLC = 1, data = 0x73 - Write Unprotect command
Message 14: Std ID = 0x00, DLC = 1, data = 82h - Readout Protect command
Message 15: Std ID = 0x00, DLC = 1, data = 92h - Readout Unprotect command
Message 1: Std ID = 0x00, DLC = 1, data = 0x79- ACK
3.2
Get Version & Read Protection Status command
The Get Version & Read Protection Status command is used to get the bootloader version
and the read protection status. When the bootloader receives the command, it transmits the
information described below (version and 2 dummy bytes having value 0x00) to the host.
Figure 6. Get Version & Read Protection Status command: host side
6WDUW*9
6HQGPHVVDJHZLWKVWG,' [
:DLWIRU$&.
RU1$&.
1$&.
$&.
5HFHLYHPHVVDJH%RRWORDGHUYHUVLRQ
5HFHLYHPHVVDJH
GXPP\E\WHVKDYLQJYDOXH[
:DLWIRU$&.
RU1$&.
1$&.
$&.
(QGRI*9
DL9
1. GV = Get Version & Read Protection Status.
The host sends messages as follows:
Command message: Std ID = 0x01, data length code (DLC) = ‘not important’.
ACK Message contain: Std ID = 0x01, DLC = 1, data = 0x79 - ACK
DocID017063 Rev 5
11/34
33
Bootloader command set
AN3154
Figure 7. Get Version & Read Protection Status command: device side
3TART'6
2ECEIVEDMESSAGE .O
WITHSTD)$
X
3END.!#+MESSAGE
9ES
3END!#+BYTE
3ENDMESSAGEBOOTLOADERVERSION
/PTIONMESSAGE
3END!#+MESSAGE
%NDOF'6
AI
1. GV = Get Version & Read Protection Status.
The STM32 sends messages as follows:
Message 1: Std ID = 0x01, DLC = 1, data = ACK
Message 2: Std ID = 0x01, DLC = 1, data[0] = bootloader version (0 < version ≤255),
example: 0x10 = Version 1.0
Message 3: Option message 1: Std ID = 0x01, DLC = 2, data = 0x00(byte1 and byte2)
Message 4: Std ID = 0x01, DLC = 1, data = ACK
12/34
DocID017063 Rev 5
AN3154
3.3
Bootloader command set
Get ID command
The Get ID command is used to get the version of the chip ID (identification). When the
bootloader receives the command, it transmits the product ID to the host.
Figure 8. Get ID command: host side
3TART')$
3ENDMESSAGEWITHSTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
2ECEIVEMESSAGE
DATAFIELDCONTAINSTHE0)$
7AITFOR!#+
OR.!#+
.!#+
!#+
%NDOF')$
AI
1. GID = Get ID.
2. PID stands for product ID. Byte 1 is the MSB and byte 2, the LSB of the address. Refer to Section 3.1: Get
command for more details about the PID of the device you are using.
The host sends messages as follows:
Command message: Std ID = 0x02, data length code (DLC) = ‘not important’.
ACK Message contain: Std ID = 0x02, DLC = 1, data = 0x79 - ACK
DocID017063 Rev 5
13/34
33
Bootloader command set
AN3154
Figure 9. Get ID command: device side
3TART')$
2ECEIVEDMESSAGE
WITHSTD)$
X
.O
3END.!#+MESSAGE
9ES
3END!#+MESSAGE
3ENDMESSAGE0)$
3END!#+BYTE
%NDOF')$
AI
1. GID = Get ID.
2. PID stands for product ID. Byte 1 is the MSB and byte 2 is LSB of the address.
The STM32 sends the bytes as follows:
14/34
Message 1:
Std ID = 0x02, DLC = 1, data = ACK with DLC except for current message
and ACKs.
Message 2:
Std ID = 0x02, DLC = N (the number of bytes – 1. For STM32, N = 1), data =
PID with byte 0 is MSB and byte N is the LSB of the product ID
Message 3:
Std ID = 0x02, DLC = 1, data = ACK = 0x79
DocID017063 Rev 5
AN3154
3.4
Bootloader command set
Speed command
The speed command allows the baud rate for CAN run-time to be changed. It can be used
only if CAN is the peripheral being used.
A system reset is generated if the CAN receives the correct message but the operation to
set the new baudrate fails, which prevents it from entering or leaving initialization mode.
Figure 10. Speed command: host side
3TARTSPEEDCOMMAND
3ENDSPEEDMESSAGESTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
#HANGESTHE#!.BAUDRATE
ACCORDINGTOCOMMANDSENT
7AITFOR!#+
%NDOFSPEED
AI
1. After setting the new baud rate, the bootloader sends the ACK message. Therefore, the host sets its baud
rate while waiting for the ACK.
The host sends the message as follows:
Command message: Std ID = 0x03, DLC = 0x01, data[0] = XXh where XXh takes the
following values depending on the baud rate to be set:
•
0x01 -> baud rate = 125 kbps
•
0x02 -> baud rate = 250 kbps
•
0x03 -> baud rate = 500 kbps
•
0x04 -> baud rate = 1 Mbps
DocID017063 Rev 5
15/34
33
Bootloader command set
AN3154
Figure 11. Speed command: device side
3TARTSPEEDCOMMAND
2ECEIVEDAMESSAGE
WITHSTD)$X
ANDWITHVALID
DATA
.O
3END.!#+MESSAGE
OLDBAUDRATE
9ES
3END!#+MESSAGE
OLDBAUDRATE
%NDOFSPEEDCOMMAND
#HANGESTHE#!.BAUDRATEACCORDING
TORECEIVEDDATANEWBAUDRATE
"AUDRATESETCORRECTLY
.O
9ES
'ENERATESYSTEMRESET
3END!#+MESSAGE
NEWBAUDRATE
%NDOFSPEEDCOMMAND
AI
The STM32 sends the bytes as follows:
16/34
Message 1:
Std ID = 0x03, DLC = 1, data[0] = ACK= 0x79: with old baudrate if the receive
message is correct else data[0] = NACK= 0x1F
Message 2:
Std ID = 0x03, DLC = 1, data[0] = ACK = 0x79 with new baudrate
DocID017063 Rev 5
AN3154
3.5
Bootloader command set
Read Memory command
The Read Memory command is used to read data from any valid memory address (see
note) in RAM, Flash memory and in the information block (System memory or option byte
areas).
When the bootloader receives the Read Memory command, it starts to verify the contents of
the message:
•
ID of the command is correct or not
•
ReadOutProtection is disabled or enabled
•
Address to be read is valid or not
If the message content is correct it transmits an ACK message otherwise it transmits a
NACK message.
After sending an ACK message, then it transmits the required data to the application ((N +
1) bytes) via (N+1) messages /8 (since each message contains 8 bytes), starting from the
received address.
Figure 12. Read memory command: host side
3TART2EADMEMORY
3ENDREADMESSAGESTD)$X
7AITFOR!#+OR.!#+
.!#+
!#+
2ECEIVE.MESSAGESFROMBOOTLOADER
%NDOF2EADMEMORY
3END.!#+MESSAGE
AI
The host sends messages as follows:
Command message:
Std ID = 0x11, DLC = 0x05, data[0] = 0xXX: MSB of the address... data[3] = 0xYY: LSB of
the address, data[4] = N: number of bytes to be read (where 0 < N ≤255).
DocID017063 Rev 5
17/34
33
Bootloader command set
AN3154
Figure 13. Read memory command: device side
3TART2EADMEMORY
2ECEIVEDMESSAGE
WITHSTD)$X
.O
9ES
2/0INACTIVE
!DDRESSVALID
.O
9ES
3END!#+MESSAGE
3END.MESSAGESTOTHEHOST
%NDOF2EADMEMORY
3END.!#+MESSAGE
AI
The STM32 sends messages as follows:
ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK if content of the command is correct
else data[0] = NACK
Data message (N+1) / 8: Std ID = 0x11, DLC = Number of Byte, data[0] = 0xXX...
data[Number of Byte - 1] = 0xYY
ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK
3.6
Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it starts if the message contains the following valid information:
•
ID of the command is correct or not
•
ReadOutProtection is disabled or enabled
•
Branch destination address is valid or not(data[0] is the address MSB and data[3] 4 is
LSB
If the message content is correct it transmits an ACK message otherwise it transmits a
NACK message.
18/34
DocID017063 Rev 5
AN3154
Bootloader command set
After sending an ACK message to the application, the bootloader firmware performs the
following:
Note:
•
it initializes the registers of the peripherals used by the bootloader to their default reset
values
•
it initializes the user application’s main stack pointer
•
it jumps to the memory location programmed in the received ‘address + 4’ (which
corresponds to the address of the application’s reset handler).
For example if the received address is 0x0800 0000, the bootloader will jump to the
memory location programmed at address 0x0800 0004.
In general, the host should send the base address where the application to jump to is
programmed
1
The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
2
The valid addresses for the Go command are in RAM or Flash memory (refer to Section 3.1:
Get command for more details about the valid memory addresses for the device you are
using). All other addresses are considered not valid and are NACKed by the device.
3
When an application is loaded into RAM and then a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first RAM memory used by the
bootloader firmware (refer to Section 3.1: Get command for more details about the RAM
offset for the device you are using).
Figure 14. Go command: host side
3TART'OCOMMAND
3END'OMESSAGESTD)$X
7AITFOR!#+
OR.!#+
%NDOF'O
AI
1. See product datasheet for valid addresses.
The host sends the bytes as follows
Go command message: Std ID = 0x21, DLC = 0x04, data[0] = 0xXX: MSB address,...data[3]
= 0xYY LSB address.
DocID017063 Rev 5
19/34
33
Bootloader command set
AN3154
Figure 15. Go command: device side
3TART'OCOMMAND
2ECEIVEDMESSAGE
WITHSTD)$X
.O
9ES
2/0INACTIVE
!DDRESSVALID
.O
9ES
3END!#+MESSAGE
3END.!#+MESSAGE
*UMPTOUSERAPPLICATION
%NDOFGO
AIB
The STM32 send the messages as follows:
ACK message: Std ID = 0x21, DLC = 1, data[0] = ACK if content of the command is correct
else data[0] = NACK
3.7
Write Memory command
The Write Memory command is used to write data to any valid memory address (see note)
of RAM, Flash memory, or Option byte area. When the bootloader receives the Write
Memory command, (message with 5 bytes data length, data[0] is the address MSB, data[3]
is the LSB and data[4] is the number of data bytes to be received), it then checks the
received address. For the Option byte area, the start address must be the base address of
the Option byte area (see note) to avoid writing inopportunely in this area.
Note:
Refer to Section 3.1: Get command for more details about the valid memory addresses for
the device you are using.
If the received address is valid, the bootloader transmits an ACK message, otherwise it
transmits a NACK message and aborts the command. When the address is valid, the
bootloader:
•
Receives the user data (N bytes) so the device receives N/8 messages (each message
contains 8 data bytes)
•
Programs the user data into memory starting from the received address
•
At the end of the command, if the write operation was successful, the bootloader
transmits the ACK message; otherwise it transmits a NACK message to the application
and aborts the command
The maximum length of the block to be written for the STM32 is 256 bytes.
If the Write Memory command is issued to the Option byte area, all options are erased
before writing the new values, and at the end of the command the bootloader generates a
system Reset to take into account the new configuration of the option byte.
20/34
DocID017063 Rev 5
AN3154
Note:
Bootloader command set
1
When writing to the RAM, you should take care not to overlap the first RAM memory used by
the bootloader firmware.
2
No error is returned when performing write operations on write protected sectors.
Figure 16. Write Memory command: host side
3TART7RITEMEMORY
3END7RITEMESSAGESTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
3ENDTHEDATAMESSAGES!TSAME
TIMETHEHOSTCHECKSWHETHERIT
RECEIVEDA.!#+MESSAGE
7AITFOR!#+
OR.!#+
)F.!#+MESSAGERECEIVED
%NDOF7RITEMEMORY
Note:
AI
If the start address is invalid, the command is NACKed by the device.
The host sends the messages as follows:
Command message: Std ID = 0x31, DLC = 0x05, data[0] = 0xXX: MSB address,..., data[3] =
0xYY: LSB address, data[4] = N-1 (number of bytes to be written - 1), 0 < N ≤255).
then the host send N/8 message
Data message: Std ID = 0x31, DLC_1 = to 8, data = byte_11, … byte_18…
Data message_M: Std ID = 0x04, DLC_M = 1 to 8, data = byte_m1, …, byte_M8
Note:
1
DLC_1 + DLC_2 + ... DLC_M = 256 maximum
2
After each message the host receives the ACK or NACK message from the device
3
The bootloader does not check the standard ID of the data, so any ID from 0h to 0xFF can
be used. It is recommended to use 0x04.
DocID017063 Rev 5
21/34
33
Bootloader command set
AN3154
Figure 17. Write memory command: device side
Start write memory
No
Received message
with stdID
= 0x31?
Yes
No
ROP inactive?
Address valid?
Yes
Send ACK message
Receive the ’data messages’ and
temporarily write the data to RAM
Address in Flash ?
Yes
Write the received data to the
memory from the start address
No
Address in RAM ?
Yes
Write the received data to RAM
from the start address
No
Address= 0x1FFF F800 ?
No
If a message is corrupted
Yes
Write the Keys for Option byte
area access
Write the received data to Option
area access from start address
Send ACK message
Generated system reset
Send ACK message
Send NACK message
End of write memory
ai15719b
The STM32 sends messages as follows:
ACK message: Std ID = 0x31, DLC = 1, data[0] = ACK if the content of the command is
correct else data[0] = NACK
22/34
DocID017063 Rev 5
AN3154
Bootloader command set
After each received message, the device will send an ACK if the content of the command is
correct else a NACK. However, as described in Figure 17, after receiving all the 'data
messages' (N/8 messages) and temporarily write the data to RAM, if none of the messages
content is corrupted, the bootloader will write the N bytes at the requested address (Flash
memory, RAM or option byte), then if the write operation is successfully completed, device
will send an ACK message to the host.
In other terms, after sending the N/8 messages, host will receive two successive ACK; the
first will be sent by the device if the last message of the N/8 is correctly received, and the
second ACK will be sent after writing correctly the N/8 message at the requested address
3.8
Erase Memory command
The Erase Memory command allows the host to erase Flash memory pages. When the
bootloader receives the Erase Memory command and ROP is disabled, it transmits the ACK
message to the host. After the transmission of the ACK message, the bootloader checks if
data[0] is equal to 0xFF, if it is the case a global memory erase operation will be started and
when finished it sends ACK message. Otherwise (data[0] is different from 0xFF), the
bootloader will start the memory page(s) erase as defined by the host, and after each page
erase it sends ACK or NACK message.
Erase Memory command specifications:
Note:
1.
The bootloader receives one message that contains N, the number of pages to be
erased – 1.
N = 255 is reserved for global erase requests. For 0 ≤N ≤254, N + 1 pages are erased.
2.
The bootloader receives (N + 1) bytes, each byte containing a page number
No error is returned when performing erase operations on write protected sectors.
DocID017063 Rev 5
23/34
33
Bootloader command set
AN3154
Figure 18. Erase Memory command: host side
3TARTERASEMEMORY
9ES
'LOBAL
%RASE
3ENDAMESSAGEWITHSTD
)$XANDDATABYTE
X&&4HEBOOTLOADER
TAKESNOACCOUNTOFOTHER
DATAINTHEMESSAGE
.O
7AITFOR!#+
OR.!#+
3ENDAMESSAGEWITHSTD
)$XANDDATAFIELD
CONTAININGSECTORCODES
.!#+
!#+
%NDOFERASEMEMORY
AI
The host sends the message as follows:
The ID contains the command type (0x43):
•
Total erase message: Std ID = 0x43, DLC = 0x01, data = 0xFF.
•
Erase sector by sector message: Std ID = 0x43, DLC = 0x01 to 0x08, data = see
product datasheet.
In case of page by page erase, after each message the host receives the ACK or NACK
message from the device.
24/34
DocID017063 Rev 5
AN3154
Bootloader command set
Figure 19. Erase Memory command: device side
6WDUW(UDVH0HPRU\
5HFHLYHGPHVVDJH
ZLWKVWG,' [
DQG523"
1R
<HV
6HQG$&.PHVVDJH
<HV
6WDUWJOREDOHUDVH
6HQG$&.PHVVDJH
,VE\WHRIWKH
'DWDILHOG [))"
1R
(UDVHPHPRU\SDJHE\SDJH
DFFRUGLQJWRGDWDFRQWDLQHGLQ
WKHPHVVDJHVGDWDILHOG
6HQG$&.PHVVDJHDIWHUHDFK
SDJHHUDVH
6HQG1$&.PHVVDJH
(QGRIHUDVHPHPRU\
DL9
The STM32 sends messages as follows:
ACK message: Std ID = 0x43, DLC = 1, data[0] = ACK if content of the command is correct
and ROP is not active else data[0] = NACK
DocID017063 Rev 5
25/34
33
Bootloader command set
3.9
AN3154
Write Protect command
The Write Protect command is used to enable the write protection for some or all Flash
memory sectors. When the bootloader receives the Write Protect command, it transmits the
ACK message to the host if ROP is disabled else it transmits NACK.
After the transmission of the ACK byte, the bootloader waits to receive the Flash memory
sector codes from the application.
At the end of the Write Protect command, the bootloader transmits the ACK message and
generates a system Reset to take into account the new configuration of the option byte.
Note:
1
Refer to Section 3.1: Get command for more details about the sector size for the device you
are using.
2
The total number of sectors and the sector number to be protected are not checked, this
means that no error is returned when a command is passed with a wrong number of sectors
to be protected or a wrong sector number.
If a second Write Protect command is executed, the Flash memory sectors that were
protected by the first command become unprotected and only the sectors passed within the
second Write Protect command become protected.
Figure 20. Write Protect command: host side
3TART70
3ENDWRITEPROTECTMESSAGESTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
3ENDMESSAGEWITHTHESECTORCODESAND
THENUMBEROFSECTORSTOBEPROTECTED
7AITFOR!#+
OR.!#+
.!#+
!#+
%NDOF70
AI
1. WP = Write Protect.
The host sends messages as follows:
Command message: Std ID = 0x63, DLC = 0x01, data[0] = N (where 0 < N ≤255).
Command message: Std ID = 0x63, DLC = 0x01..08, data[0] = N (where 0 < N ≤255).
After each message the host receives the ACK or NACK message from the device.
26/34
DocID017063 Rev 5
AN3154
Bootloader command set
Figure 21. Write Protect command: device side
3TART70
2ECEIVEDMESSAGE
WITHSTD)$X
2/0INACTTIVE
.O
9ES
3END!#+MESSAGE
2ECEIVETHESECTORCODESANDTHE
NUMBEROFSECTORSTOBEPROTECTED
9ES
7RITEPROTECTTHEREQUESTEDSECTORS
3END!#+MESSAGE
3END.!#+MESSAGE
'ENERATESYSTEMRESET
%NDOF70
AI
1. WP = Write Protect
The STM32 sends messages as follows:
ACK message: Std ID = 0x63, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.
3.10
Write Unprotect command
The Write Unprotect command is used to disable the write protection of all the Flash
memory sectors. When the bootloader receives the Write Unprotect command, it transmits
the ACK message to the host if ROP is disabled else it transmits NACK. After the
transmission of the ACK message, the bootloader disables the write protection of all the
Flash memory sectors.
At the end of the Write Unprotect command, the bootloader transmits the ACK message and
generates a system Reset to take into account the new configuration of the option byte.
DocID017063 Rev 5
27/34
33
Bootloader command set
AN3154
Figure 22. Write Unprotect command: host side
3TART705.
3END7RITEUNPROTECTMESSAGESTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
7AITFOR!#+
OR.!#+
.!#+
!#+
%NDOF705.
AI
1. WPUN = Write Unprotect.
The host sends messages as follows:
Command message: Std ID = 0x73, DLC = 0x01, data = 00.
Figure 23. Write Unprotect command: device side
3TART705.
2ECEIVED
MESSAGEWITH
)$H
2/0INACTIVE
.O
.O
3END!#+BYTE
2EMOVETHEPROTECTIONFORTHE
ENTIRE&LASHMEMORY
3END!#+BYTE
3END.!#+BYTE
'ENERATESYSTEMRESET
%NDOF705.
AI
1. WPUN = Write Unprotect.
28/34
DocID017063 Rev 5
AN3154
Bootloader command set
The STM32 sends messages as follows:
ACK message: Std ID = 0x73, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.
3.11
Readout Protect command
The Readout Protect command is used to enable the Flash memory read protection. When
the bootloader receives the Readout Protect command, it transmits the ACK message to the
host if ROP is disabled else it transmits NACK. After the transmission of the ACK message,
the bootloader enables the read protection for the Flash memory.
At the end of the Readout Protect command, the bootloader transmits the ACK message
and generates a system Reset to take into account the new configuration of the option byte.
Figure 24. Readout Protect command: host side
3TART2$0?02-
3END2EADOUT0ROTECTMESSAGESTD)$X
.!#+
7AITFOR!#+
OR.!#+
!#+
7AITFOR!#+
OR.!#+
.!#+
!#+
%NDOF2$0?02-
AI
1. RDP_PRM = Readout Protect.
The host sends the messages as follows
Command message: Std ID = 0x82, DLC = 0x01, data[0] = 00.
DocID017063 Rev 5
29/34
33
Bootloader command set
AN3154
Figure 25. Readout Protect command: device side
6WDUW5'3B350
5HFHLYHG
PHVVDJHZLWK
,' ["
1R
<HV
523LQDFWLYH"
1R
<HV
6HQG$&.PHVVDJH
$FWLYDWH5HDGSURWHFWLRQIRU
)ODVKPHPRU\
6HQG$&.PHVVDJH
6HQG1$&.PHVVDJH
*HQHUDWHV\VWHPUHVHW
(QGRI5'3B350
DL9
1. RDP_PRM = Readout Protect
The STM32 sends messages as follows:
ACK message: Std ID = 0x82, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.
3.12
Readout Unprotect command
The Readout Unprotect command is used to disable the Flash memory read protection.
When the bootloader receives the Readout Unprotect command, it transmits the ACK
message to the host. After the transmission of the ACK message, the bootloader erases all
the Flash memory sectors and it disables the read protection for the entire Flash memory. If
the erase operation is successful, the bootloader deactivates the RDP.
At the end of the Readout Unprotect command, the bootloader transmits an ACK message
and generates a system Reset to take into account the new configuration of the option
bytes.
30/34
DocID017063 Rev 5
AN3154
Bootloader command set
Figure 26. Readout Unprotect command: host side
3TART2$5?02-
3END2EADOUT5NPROTECTMESSAGESTD)$X
7AITFOR!#+
OR.!#+
.!#+
!#+
7AITFOR!#+
OR.!#+
.!#+
!#+
%NDOF2$5?02-
AI
1. RDU_PRM = Readout Unprotect.
The host sends messages as follows
Command message: Std ID = 0x92, DLC = 0x01, data = 00.
Figure 27. Readout Unprotect command: device side
Start RDU_PRM(1)
Received
message with
ID = 0x92?
No
Yes
Send ACK message
Disable ROP
Send ACK message
Send NACK message
Clear all RAM
Generate system reset
End of RDU_PRM (1)
ai15729b
1. RDU_PRM = Readout Unprotect.
The STM32 sends messages as follows:
ACK message: Std ID = 0x92, DLC = 1, data[0] = ACK if the content of the command is
correct and ROP is not active else data[0] = NACK.
DocID017063 Rev 5
31/34
33
Bootloader protocol version evolution
4
AN3154
Bootloader protocol version evolution
Table 3 lists the bootloader versions.
Table 3. Bootloader protocol versions
Version
V2.0
32/34
Description
Initial bootloader version.
DocID017063 Rev 5
AN3154
5
Revision history
Revision history
Table 4. Document revision history
Date
Revision
09-Mar-2010
1
Initial release.
15-Apr-2011
2
Updated Figure 2: Check HSE frequency and added Note 1.
22-Apr-2011
3
Update Std ID for message 2 in Section 3.4: Speed command.
4
Updated
Chapter 3.2: Get Version & Read Protection Status command
Figure 6: Get Version & Read Protection Status command: host side
Chapter 3.7: Write Memory command
Chapter 3.8: Erase Memory command
Figure 19: Erase Memory command: device side
Chapter 3.9: Write Protect command
Figure 25: Readout Protect command: device side
5
Updated Table 1: Applicable products and Table 2: CAN bootloader
commands.
Removed Section dedicated to Device-dependent bootloader
parameters.
Updated Section 3.5: Read Memory command and Section 3.7:
Write Memory command.
24-Oct-2012
02-May-2014
Changes
DocID017063 Rev 5
33/34
33
AN3154
Please Read Carefully:
Information in this document is provided solely in connection with ST products. STMicroelectronics NV and its subsidiaries (“ST”) reserve the
right to make changes, corrections, modifications or improvements, to this document, and the products and services described herein at any
time, without notice.
All ST products are sold pursuant to ST’s terms and conditions of sale.
Purchasers are solely responsible for the choice, selection and use of the ST products and services described herein, and ST assumes no
liability whatsoever relating to the choice, selection or use of the ST products and services described herein.
No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted under this document. If any part of this
document refers to any third party products or services it shall not be deemed a license grant by ST for the use of such third party products
or services, or any intellectual property contained therein or considered as a warranty covering the use in any manner whatsoever of such
third party products or services or any intellectual property contained therein.
UNLESS OTHERWISE SET FORTH IN ST’S TERMS AND CONDITIONS OF SALE ST DISCLAIMS ANY EXPRESS OR IMPLIED
WARRANTY WITH RESPECT TO THE USE AND/OR SALE OF ST PRODUCTS INCLUDING WITHOUT LIMITATION IMPLIED
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE (AND THEIR EQUIVALENTS UNDER THE LAWS
OF ANY JURISDICTION), OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT.
ST PRODUCTS ARE NOT DESIGNED OR AUTHORIZED FOR USE IN: (A) SAFETY CRITICAL APPLICATIONS SUCH AS LIFE
SUPPORTING, ACTIVE IMPLANTED DEVICES OR SYSTEMS WITH PRODUCT FUNCTIONAL SAFETY REQUIREMENTS; (B)
AERONAUTIC APPLICATIONS; (C) AUTOMOTIVE APPLICATIONS OR ENVIRONMENTS, AND/OR (D) AEROSPACE APPLICATIONS
OR ENVIRONMENTS. WHERE ST PRODUCTS ARE NOT DESIGNED FOR SUCH USE, THE PURCHASER SHALL USE PRODUCTS AT
PURCHASER’S SOLE RISK, EVEN IF ST HAS BEEN INFORMED IN WRITING OF SUCH USAGE, UNLESS A PRODUCT IS
EXPRESSLY DESIGNATED BY ST AS BEING INTENDED FOR “AUTOMOTIVE, AUTOMOTIVE SAFETY OR MEDICAL” INDUSTRY
DOMAINS ACCORDING TO ST PRODUCT DESIGN SPECIFICATIONS. PRODUCTS FORMALLY ESCC, QML OR JAN QUALIFIED ARE
DEEMED SUITABLE FOR USE IN AEROSPACE BY THE CORRESPONDING GOVERNMENTAL AGENCY.
Resale of ST products with provisions different from the statements and/or technical features set forth in this document shall immediately void
any warranty granted by ST for the ST product or service described herein and shall not create or extend in any manner whatsoever, any
liability of ST.
ST and the ST logo are trademarks or registered trademarks of ST in various countries.
Information in this document supersedes and replaces all information previously supplied.
The ST logo is a registered trademark of STMicroelectronics. All other names are the property of their respective owners.
© 2014 STMicroelectronics - All rights reserved
STMicroelectronics group of companies
Australia - Belgium - Brazil - Canada - China - Czech Republic - Finland - France - Germany - Hong Kong - India - Israel - Italy - Japan Malaysia - Malta - Morocco - Philippines - Singapore - Spain - Sweden - Switzerland - United Kingdom - United States of America
www.st.com
34/34
DocID017063 Rev 5