ST AN3154 Installation and operating instructions

March 2010 Doc ID 17063 Rev 1 1/34
AN3154
Application note
CAN protocol used
in the STM32™ bootloader
Introduction
This application note describes the CAN protocol used in the STM32 microcontroller
bootloader. It details each supported command. For more information about the CAN
hardware resources and requirements for your device bootloader, please refer to the
“STM32 system memory boot mode” application note (AN2606).
Related documents
Available from www.st.com:
AN2606 “STM32 system memory boot mode”
www.st.com

Contents AN3154
2/34 Doc ID 17063 Rev 1
Contents
1 Bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 CAN settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3 Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.1 Device-dependent bootloader parameters . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2 Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.3 Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . 12
3.4 Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.5 Speed command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6 Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.7 Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.8 Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.9 Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.10 Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
3.11 Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.12 Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.13 Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4 Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 32
5 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

AN3154 List of tables
Doc ID 17063 Rev 1 3/34
List of tables
Table 1. CAN bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Table 2. Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 3. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

List of figures AN3154
4/34 Doc ID 17063 Rev 1
List of figures
Figure 1. Bootloader for STM32 with CAN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Figure 2. Check HSE frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Figure 3. CAN frame . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Figure 4. Get command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Figure 5. Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Figure 6. Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 12
Figure 7. Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 13
Figure 8. Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Figure 9. Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Figure 10. Speed command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Figure 11. Speed command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Figure 12. Read memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Figure 13. Read memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Figure 14. Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Figure 15. Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Figure 16. Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Figure 17. Write memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 18. Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Figure 19. Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 20. Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 21. Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Figure 22. Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 23. Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 24. Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 25. Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 26. Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 27. Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

AN3154 Bootloader code sequence
Doc ID 17063 Rev 1 5/34
1 Bootloader code sequence
Figure 1. Bootloader for STM32 with CAN
Once the system memory boot mode is entered and the STM32 device has been configured
(for more details refer to application note AN2606 “STM32 system memory boot mode”), the
bootloader code waits for a frame on the CANx_Rx pin. When a detection occurs the CAN
bootloader firmware starts to check the external clock frequency, Figure 2 shows the
flowchart of the frequency check.
&RAMEDETECTED
ON#!.X?2XPIN
7AITFORA
COMMAND
'%4CMD
ROUTINE
AI
#HECK(3%FREQUENCY
2$CMD
ROUTINE
OPTIONAL
2OUTINESFOR
LOADING
INTO2!-
'/CMD
ROUTINE
*0TO?!DDRESS
'/CMD
#OMMAND
RECEIVED
'%4CMD

Bootloader code sequence AN3154
6/34 Doc ID 17063 Rev 1
Figure 2. Check HSE frequency
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to
receive commands.
3TARTCHECK(3%FREQUENCY
-ESSAGERECEIVED
WITHSTD)$X
ANDWITHOUTFRAME
ERROR
AIB
#ONFIGURE#!.BAUDRATEATKBPS
ASSUMINGTHAT(3%-(Z
)NITIALIZETIMEOUTAT^MS
$ECREMENTTIMEOUT
4IMEOUTX
#ONFIGURE#!.BAUDRATEATKBPS
ASSUMINGTHAT(3%-(Z
)NITIALIZETIMEOUTAT^MS
.O
9E S
-ESSAGERECEIVED
WITHSTD)$X
ANDWITHOUTFRAME
ERROR
.O
9E S
#ONFIGURE#!.BAUDRATEATKBPS
ASSUMINGTHAT(3%-(Z
)NITIALIZETIMEOUTAT^MS
-ESSAGERECEIVED
WITHSTD)$X
ANDWITHOUTFRAME
ERROR
$ECREMENTTIMEOUT
4IMEOUTX
.O
9E S
%NTERANINFINITELOOPWAITING
FORANY#!.BOOTLOADERCOMMAND
'ENERATESYSTEMRESET
$ECREMENTTIMEOUT
4IMEOUTX
9E S
9E S
.O
.O
.O
9E S

AN3154 CAN settings
Doc ID 17063 Rev 1 7/34
2 CAN settings
The STM32 CAN is compliant with the 2.0A and B (active) specifications with a bitrate up to
1 Mbit/s. It can receive and transmit standard frames with 11-bit identifiers as well as
extended frames with 29-bit identifiers.
Figure 3 shows a CAN frame that uses the standard identifier only.
Figure 3. CAN frame
In this application, the CAN settings are:
●Standard identifier (not extended)
●Bitrate: at the beginning it is 125 kbps; during runtime it can be changed via the speed
command to achieve a maximum bit rate of 1 Mbps.
The transmit settings (from the STM32 to the host) are:
●Tx mailbox0: On
●Tx mailbox1 and Tx mailbox2: Off
●Tx identifier: (0x00, 0x01, 0x02, v03, 0x11, 0x21, 0x31, 0x43, 0x63, 0x73, 0x82, 0x92)
The receive settings (from the host to the STM32) are:
●Synchronization byte, 0x79, is in the RX identifier and not in the data field.
●RX identifier depends on the command (0x00, 0x01, 0x02, 0x03, 0x11, 0x21, 0x31,
0x43, 0x63, 0x73, 0x82, 0x92).
●Error checking: If the error field (bit [6:4] in the CAN_ESR register) is different from
000b, the message is discarded and a NACK is sent to the host.
●In FIFO overrun condition, the message is discarded and a NACK is sent to the host.
●Incoming messages can contain from 1 to 8 data bytes.
Note: The CAN bootloader firmware supports only one node at a time. This means that CAN
Network Management is not supported by the firmware.
)$

$,#
.
#2#
 
%/&
!#+
3/&
242
)$%
R
!RBITRATIONFIELD #ONTROLFIELD $ATAFIELD #2#FIELD
!#+FIELD
)NTERFRAMESPACE
)NTERFRAMESPACE
OROVERLOADFRAME
$ATAFRAMESTANDARDIDENTIFIER
.
AI

Bootloader command set AN3154
8/34 Doc ID 17063 Rev 1
3 Bootloader command set
The supported commands are listed in Ta bl e 1 below. Each command is further described in
this section.
Communication safety
Each packet is either accepted (ACK answer) or discarded (NACK answer):
●ACK message = 0x79
●NACK message = 0x1F
Table 1. CAN bootloader commands
Command Command
code Command description
Get(1)
1. Read protection – When the RDP (read protection) option is active, only this limited subset of commands is
available. All other commands are NACKed and have no effect on the device. Once the RDP has been
removed, the other commands become active.
0x00 Gets the version and the allowed commands
supported by the current version of the bootloader
Get Version & Read Protection
Status(1) 0x01 Gets the bootloader version and the Read
Protection status of the Flash memory
Get ID(1) 0x02 Gets the chip ID
Speed 0x03 The speed command allows the baud rate for CAN
run-time to be changed.
Read Memory 0x11 Reads up to 256 bytes of memory starting from an
address specified by the application
Go 0x21 Jumps to user application code located in the
internal Flash memory or in SRAM
Write Memory 0x31 Writes up to 256 bytes to the RAM or Flash memory
starting from an address specified by the application
Erase 0x43 Erases from one to all the Flash memory sectors
Write Protect(2)
2. See Section 3.1 below
0x63 Enables the write protection for some sectors
Write Unprotect(2) 0x73 Disables the write protection for all Flash memory
sectors
Readout Protect(1) 0x82 Enables the read protection
Readout Unprotect(1) 0x92 Disables the read protection

AN3154 Bootloader command set
Doc ID 17063 Rev 1 9/34
3.1 Device-dependent bootloader parameters
While the CAN bootloader protocol’s command set and sequences are the same for all
STM32 devices, some parameters are device-dependent. For a few commands, the value of
some parameters may depend on the device used. The concerned parameters are listed
below:
●PID (product ID), which changes with the device
●Valid memory addresses (RAM, Flash memory, system memory, option byte areas)
accepted by the bootloader when the Read Memory, Go and Write Memory commands
are executed
●Size of the Flash memory sector used when executing the Write Protect command
For more details about the value of these parameters for the device you are using please
refer to the “Device-dependent boot loader parameters” section in the “STM32 system
memory boot mode” application note (AN2606).
3.2 Get command
The Get command allows the host to get the version of the bootloader and the supported
commands. When the bootloader receives the get command, it transmits the bootloader
version and the supported command codes to the host.

Bootloader command set AN3154
10/34 Doc ID 17063 Rev 1
Figure 4. Get command: host side

7AITFOR!#+
OR.!#+
2ECEIVEMESSAGENUMBEROFBYTES
VERSIONCOMMANDS
%NDOFGETCOMMAND
.!#+
!#+
3ENDMESSAGEWITHSTD)$H
3TARTGETCOMMAND
AI
2ECEIVEMESSAGE"OOTLOADERVERSION
7AITFOR!#+
OR.!#+
2ECEIVEMESSAGE'ETCOMMAND
2ECEIVEMESSAGE3PEEDCOMMAND
2ECEIVEMESSAGE2EADCOMMAND
2ECEIVEMESSAGE'OCOMMAND
2ECEIVEMESSAGE7RITEMEMORYCOMMAND
2ECEIVEMESSAGE%RASEMEMORYCOMMAND
2ECEIVEMESSAGE'ET6ERSION
2EAD0ROTECTIONSTATUSCOMMAND
2ECEIVEMESSAGE'ET)$COMMAND
2ECEIVEMESSAGE7RITE0ROTECTCOMMAND
2ECEIVEMESSAGE7RITE5NPROTECTCOMMAND
2ECEIVEMESSAGE2EADOUT0ROTECTCOMMAND
2ECEIVEMESSAGE2EADOUT5NPROTECTCOMMAND

AN3154 Bootloader command set
Doc ID 17063 Rev 1 11/34
The host sends messages as follows:
Command message: Std ID = 0x00, data length code (DLC) = ‘not important’.
Figure 5. Get command: device side
The STM32 sends messages as follows:
Message 1: Std ID = 0x00, DLC = 1, data = 0x79 - ACK
Message 2: Std ID = 0x00, DLC = 1 data = N = 12 = the number of bytes to be sent -1
(1 N +1 256)
Message 3: Std ID = 0x00, DLC = 1, data = bootloader version (0 < version 255)
Message 4: Std ID = 0x00, DLC = 1, data = 0x00 - Get command
Message 5: Std ID = 0x00, DLC = 1, data = 0x01 - Get Version & Read Protection
Status command
Message 6: Std ID = 0x00, DLC = 1, data = 0x02 - Get ID command
Message 7: Std ID = 0x00, DLC = 1, data = 0x03 - Speed command
Message 8: Std ID = 0x00, DLC = 1, data = 0x11 - Read memory command
Message 9: Std ID = 0x00, DLC = 1, data = 0x21 - Go command
Message 10: Std ID = 0x00, DLC = 1, data = 0x31 - Write memory command
Message 11: Std ID = 0x00, DLC = 1, data = 0x43 - Erase memory command

3ENDMESSAGE.UMBEROFBYTES
VERSIONCOMMANDS
%NDOFGETCOMMAND
.O
9E S
3TARTGETCOMMAND
AI
3ENDMESSAGE"OOTLOADERVERSION
3ENDMESSAGES3UPPORTEDCOMMANDS
2ECEIVEDMESSAGE
WITH)$X
3END!#+MESSAGE
3END!#+MESSAGE
3END.!#+MESSAGE

Bootloader command set AN3154
12/34 Doc ID 17063 Rev 1
Message 12: Std ID = 0x00, DLC = 1, data = 0x63 - Write Protect command
Message 13: Std ID = 0x00, DLC = 1, data = 0x73 - Write Unprotect command
Message 14: Std ID = 0x00, DLC = 1, data = 82h - Readout Protect command
Message 15: Std ID = 0x00, DLC = 1, data = 92h - Readout Unprotect command
Message 1: Std ID = 0x00, DLC = 1, data = 0x79 - ACK
3.3 Get Version & Read Protection Status command
The Get Version & Read Protection Status command is used to get the bootloader version
and the read protection status. When the bootloader receives the command, it transmits the
information described below (version, read protection: number of times it was enabled and
disabled) to the host.
Figure 6. Get Version & Read Protection Status command: host side
1. GV = Get Version & Read Protection Status.
The host sends messages as follows:
Command message: Std ID = 0x01, data length code (DLC) = ‘not important’.
ACK Message contain: Std ID = 0x01, DLC = 1, data = 0x79 - ACK

7AITFOR!#+
OR.!#+
2ECEIVEMESSAGE
2ECEIVEMESSAGE"OOTLOADERVERSION
7AITFOR!#+
OR.!#+
%NDOF'6

.!#+
!#+
AI
3ENDMESSAGEWITHSTD)$X
3TART'6

.!#+
!#+
BYTEOFTHEDATAFIELDCONTAINSTHENUMBER
OFTIMESTHEREADPROTECTIONWASDISABLED
BYTEOFTHEDATAFIELDCONTAINSTHENUMBER
OFTIMESTHEREADPROTECTIONWASENABLED

AN3154 Bootloader command set
Doc ID 17063 Rev 1 13/34
Figure 7. Get Version & Read Protection Status command: device side
1. GV = Get Version & Read Protection Status.
The STM32 sends messages as follows:
Message 1: Std ID = 0x01, DLC = 1, data = ACK
Message 2: Std ID = 0x01, DLC = 1, data[0] = bootloader version (0 < version 255),
example: 0x10 = Version 1.0
Message 3: Option message 1: Std ID = 0x01, DLC = 2, data = 0x00(byte1 and byte2)
Message 4: Std ID = 0x01, DLC = 1, data = ACK
3END!#+BYTE

3TART'6

2ECEIVEDMESSAGE
3ENDMESSAGEBOOTLOADERVERSION
%NDOF'6
.O
9E S
AI
3END.!#+MESSAGE
3END!#+MESSAGE
/PTIONMESSAGE
X
WITHSTD)$

Bootloader command set AN3154
14/34 Doc ID 17063 Rev 1
3.4 Get ID command
The Get ID command is used to get the version of the chip ID (identification). When the
bootloader receives the command, it transmits the product ID to the host.
Figure 8. Get ID command: host side
1. GID = Get ID.
2. PID stands for product ID. Byte 1 is the MSB and byte 2, the LSB of the address. Refer to Section 3.1:
Device-dependent bootloader parameters for more details about the PID of the device you are using.
The host sends messages as follows:
Command message: Std ID = 0x02, data length code (DLC) = ‘not important’.
ACK Message contain: Std ID = 0x02, DLC = 1, data = 0x79 - ACK

7AITFOR!#+
OR.!#+
7AITFOR!#+
OR.!#+
%NDOF')$

.!#+
!#+
AI
3ENDMESSAGEWITHSTD)$X
3TART')$

.!#+
!#+
2ECEIVEMESSAGE
DATAFIELDCONTAINSTHE0)$

AN3154 Bootloader command set
Doc ID 17063 Rev 1 15/34
Figure 9. Get ID command: device side
1. GID = Get ID.
2. PID stands for product ID. Byte 1 is the MSB and byte 2 is LSB of the address.
The STM32 sends the bytes as follows:
Message 1: Std ID = 0x02, DLC = 1, data = ACK with DLC except for current message
and ACKs.
Message 2: Std ID = 0x02, DLC = N (the number of bytes – 1. For STM32, N = 1), data =
PID with byte 0 is MSB and byte N is the LSB of the product ID
Message 3: Std ID = 0x02, DLC = 1, data = ACK = 0x79
3END!#+MESSAGE

3TART')$

X
3ENDMESSAGE0)$
%NDOF')$

.O
9E S
AI
3END.!#+MESSAGE
3END!#+BYTE
2ECEIVEDMESSAGE
WITHSTD)$

Bootloader command set AN3154
16/34 Doc ID 17063 Rev 1
3.5 Speed command
The speed command allows the baud rate for CAN run-time to be changed. It can be used
only if CAN is the peripheral being used.
A system reset is generated if the CAN receives the correct message but the operation to
set the new baudrate fails, which prevents it from entering or leaving initialization mode.
Figure 10. Speed command: host side
1. After setting the new baud rate, the bootloader sends the ACK message. Therefore, the host sets its baud
rate while waiting for the ACK.
The host sends the message as follows:
Command message: Std ID = 0x03, DLC = 0x01, data[0] = XXh where XXh takes the
following values depending on the baud rate to be set:
●0x01 -> baud rate = 125 kbps
●0x02 -> baud rate = 250 kbps
●0x03 -> baud rate = 500 kbps
●0x04 -> baud rate = 1 Mbps

%NDOFSPEED
3ENDSPEEDMESSAGESTD)$X
3TARTSPEEDCOMMAND
AI
7AITFOR!#+
OR.!#+
#HANGESTHE#!.BAUDRATE
ACCORDINGTOCOMMANDSENT
7AITFOR!#+
.!#+
!#+

AN3154 Bootloader command set
Doc ID 17063 Rev 1 17/34
Figure 11. Speed command: device side
The STM32 sends the bytes as follows:
Message 1: Std ID = 0x03, DLC = 1, data[0] = ACK= 0x79: with old baudrate if the receive
message is correct else data[0] = NACK= 0x1F
Message 2: Std ID = 0x02, DLC = 1, data[0] = ACK = 0x79 with new baudrate
2ECEIVEDAMESSAGE
WITHSTD)$X
ANDWITHVALID
DATA
3TARTSPEEDCOMMAND
.O
9E S
%NDOFSPEEDCOMMAND
AI
#HANGESTHE#!.BAUDRATEACCORDING
TORECEIVEDDATANEWBAUDRATE
3END!#+MESSAGE
NEWBAUDRATE
3END.!#+MESSAGE
OLDBAUDRATE
3END!#+MESSAGE
OLDBAUDRATE
"AUDRATESETCORRECTLY
%NDOFSPEEDCOMMAND
9E S
.O
'ENERATESYSTEMRESET

Bootloader command set AN3154
18/34 Doc ID 17063 Rev 1
3.6 Read Memory command
The Read Memory command is used to read data from any valid memory address (see
note) in RAM, Flash memory and in the information block (System memory or option byte
areas).
Note: Refer to Section 3.1: Device-dependent bootloader parameters for more details about the
valid memory addresses for the device you are using.
When the bootloader receives the Read Memory command, it starts to verify the contents of
the message:
●ID of the command is correct or not
●ReadOutProtection is disabled or enabled
●Address to be read is valid or not
If the message content is correct it transmits an ACK message otherwise it transmits a
NACK message.
After sending an ACK message, then it transmits the required data to the application ((N +
1) bytes) via (N+1) messages /8 (since each message contains 8 bytes), starting from the
received address.
Figure 12. Read memory command: host side
The host sends messages as follows:
Command message:
Std ID = 0x11, DLC = 0x05, data[0] = 0xXX: MSB of the address... data[3] = 0xYY: LSB of
the address, data[4] = N: number of bytes to be read (where 0 < N 255).
3TART2EADMEMORY

%NDOF2EADMEMORY
3ENDREADMESSAGESTD)$X
2ECEIVE.MESSAGESFROMBOOTLOADER
7AITFOR!#+OR.!#+
3END.!#+MESSAGE
AI
!#+
.!#+

AN3154 Bootloader command set
Doc ID 17063 Rev 1 19/34
Figure 13. Read memory command: device side
The STM32 sends messages as follows:
ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK if content of the command is correct
else data[0] = NACK
Data message (N+1) / 8: Std ID = 0x11, DLC = Number of Byte, data[0] = 0xXX...
data[Number of Byte - 1] = 0xYY
ACK message: Std ID = 0x11, DLC = 1, data[0] = ACK
3.7 Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it starts if the message contains the following valid information:
●ID of the command is correct or not
●ReadOutProtection is disabled or enabled
●Branch destination address is valid or not(data[0] is the address MSB and data[3] 4 is
LSB
If the message content is correct it transmits an ACK message otherwise it transmits a
NACK message.
3TART2EADMEMORY

%NDOF2EADMEMORY
2ECEIVEDMESSAGE
WITHSTD)$X
3END.MESSAGESTOTHEHOST
3END!#+MESSAGE
3END.!#+MESSAGE
.O
9E S
AI
2/0INACTIVE
!DDRESSVALID
.O
9E S

Bootloader command set AN3154
20/34 Doc ID 17063 Rev 1
After sending an ACK message to the application, the bootloader firmware performs the
following:
●it initializes the registers of the peripherals used by the bootloader to their default reset
values
●it initializes the user application’s main stack pointer
●it jumps to the memory location programmed in the received ‘address + 4’ (which
corresponds to the address of the application’s reset handler).
For example if the received address is 0x0800 0000, the bootloader will jump to the
memory location programmed at address 0x0800 0004.
In general, the host should send the base address where the application to jump to is
programmed
Note: 1 The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
2 The valid addresses for the Go command are in RAM or Flash memory (refer to Section 3.1:
Device-dependent bootloader parameters for more details about the valid memory
addresses for the device you are using). All other addresses are considered not valid and
are NACKed by the device.
3 When an application is loaded into RAM and then a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first RAM memory used by the
bootloader firmware (refer to Section 3.1: Device-dependent bootloader parameters for
more details about the RAM offset for the device you are using).
Figure 14. Go command: host side
1. See product datasheet for valid addresses.
The host sends the bytes as follows
Go command message: Std ID = 0x21, DLC = 0x04, data[0] = 0xXX: MSB address,...data[3]
= 0xYY LSB address.

7AITFOR!#+
OR.!#+
%NDOF'O
3END'OMESSAGESTD)$X
3TART'OCOMMAND
AI