ST AN3155 Installation and operating instructions

April 2010 Doc ID 17066 Rev 2 1/37
AN3155
Application note
USART protocol used
in the STM32™ bootloader
Introduction
This application note describes the USART protocol used in the STM32 microcontroller
bootloader. It details each supported command. For more information about the USART
hardware resources and requirements for your device bootloader, please refer to the
“STM32 system memory boot mode” application note (AN2606).
Related documents
Available from www.st.com:
AN2606 “STM32 system memory boot mode”
www.st.com

Contents AN3155
2/37 Doc ID 17066 Rev 2
Contents
1 USART bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Choosing the USARTx baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.1 Minimum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Maximum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3 Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.1 Device-dependent bootloader parameters . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.3 Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . 10
3.4 Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.5 Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.6 Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.7 Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.8 Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.9 Extended Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.10 Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.11 Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.12 Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.13 Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4 Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 35
5 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

AN3155 List of tables
Doc ID 17066 Rev 2 3/37
List of tables
Table 1. USART bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Table 2. Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 3. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

List of figures AN3155
4/37 Doc ID 17066 Rev 2
List of figures
Figure 1. Bootloader for STM32 with USART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Figure 2. Get command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 3. Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 4. Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 11
Figure 5. Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 11
Figure 6. Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Figure 7. Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Figure 8. Read Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Figure 9. Read Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Figure 10. Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Figure 11. Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Figure 12. Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Figure 13. Write Memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Figure 14. Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Figure 15. Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 16. Extended Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 17. Extended Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 18. Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 19. Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 20. Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 21. Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 22. Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 23. Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 24. Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Figure 25. Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

AN3155 USART bootloader code sequence
Doc ID 17066 Rev 2 5/37
1 USART bootloader code sequence
Figure 1. Bootloader for STM32 with USART
Once the system memory boot mode is entered and the STM32 microcontroller has been
configured (for more details refer to application note AN2606 “STM32 system memory boot
mode”) the bootloader code begins to scan the USARTx_RX line pin, waiting to receive the
0x7F data frame: one start bit, 0x7F data bits, even parity bit and one stop bit.
The duration of this data frame is measured using the Systick timer. The count value of the
timer is then used to calculate the corresponding baud rate factor with respect to the current
system clock.
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to
receive commands.
X&RECEIVEDON
53!24X2XPIN
7AITFORA
COMMAND
'%4CMD
ROUTINE
AI
53!24XSELECTED
!UTOBAUDRATESEQUENCE
SEND!#+BYTEDISABLE
UNUSEDPERIPHERALS
2$CMD
ROUTINE
OPTIONAL
2OUTINESFOR
LOADING
INTO2!-
'/CMD
ROUTINE
*0TO?!DDRESS
'/CMD
#OMMAND
RECEIVED
'%4CMD

Choosing the USARTx baud rate AN3155
6/37 Doc ID 17066 Rev 2
2 Choosing the USARTx baud rate
The calculation of the serial baud rate for USARTx, from the length of the first byte that is
received, is used to operate the bootloader within a wide range of baud rates. However, the
upper and lower limits have to be kept, in order to ensure proper data transfer.
For a correct data transfer from the host to the microcontroller, the maximum deviation
between the internal initialized baud rate for USARTx and the real baud rate of the host
should be below 2.5%. The deviation (fB, in percent) between the host baud rate and the
microcontroller baud rate can be calculated using the formula below:
, where fB≤2.5%.
This baud rate deviation is a nonlinear function depending on the CPU clock and the baud
rate of the host. The maximum of the function (fB) increases with the host baud rate. This is
due to the smaller baud rate prescale factors, and the implied higher quantization error.
2.1 Minimum baud rate
The lowest tested baud rate (BLow) is 1200. Baud rates below BLow would cause the SysTick
timer to overflow. In this event, USARTx would not be correctly initialized.
2.2 Maximum baud rate
BHigh is the highest baud rate for which the deviation still does not exceed the limit. All baud
rates between BLow and BHigh are below the deviation limit.
The highest tested baud rate (BHigh) is 115 200.
fBSTM32 baud rate Host baud rate–
STM32 baud rate
------------------------------------------------------------------------------------------- 100%×=

AN3155 Bootloader command set
Doc ID 17066 Rev 2 7/37
3 Bootloader command set
The supported commands are listed in Ta bl e 1 below. Each command is further described in
this section.
Communication safety
All communications from the programming tool (PC) to the device are verified by:
1. checksum: received blocks of data bytes are XORed. A byte containing the computed
XOR of all previous bytes is added to the end of each communication (checksum byte).
By XORing all received bytes, data + checksum, the result at the end of the packet
must be 0x00
2. for each command the host sends a byte and its complement (XOR = 0x00)
3. UART: parity check active (even parity)
Table 1. USART bootloader commands
Command(1)
1. If a denied command is received or an error occurs during the command execution, the bootloader sends
NACK byte and goes back to command checking.
Command code Command description
Get(2)
2. Read protection – When the RDP (read protection) option is active, only this limited subset of commands is
available. All other commands are NACKed and have no effect on the device. Once the RDP has been
removed, the other commands become active.
0x00 Gets the version and the allowed commands supported
by the current version of the bootloader
Get Version & Read
Protection Status(2) 0x01 Gets the bootloader version and the Read Protection
status of the Flash memory
Get ID(2) 0x02 Gets the chip ID
Read Memory 0x11 Reads up to 256 bytes of memory starting from an
address specified by the application
Go 0x21 Jumps to user application code located in the internal
Flash memory or in SRAM
Write Memory 0x31 Writes up to 256 bytes to the RAM or Flash memory
starting from an address specified by the application
Erase(3)
3. Erase (x043) and Extended Erase (0x44) are exclusive. A device may support either the Erase command
or the Extended Erase command but not both.
0x43 Erases from one to all the Flash memory pages
Extended Erase(3) 0x44
Erases from one to all the Flash memory pages using
two byte addressing mode (available only for v3.0 usart
bootloader versions and above).
Write Protect(4)
4. See Section 3.1: Device-dependent bootloader parameters.
0x63 Enables the write protection for some sectors
Write Unprotect(4) 0x73 Disables the write protection for all Flash memory sectors
Readout Protect 0x82 Enables the read protection
Readout Unprotect(2) 0x92 Disables the read protection

Bootloader command set AN3155
8/37 Doc ID 17066 Rev 2
Each packet is either accepted (ACK answer) or discarded (NACK answer):
●ACK = 0x79
●NACK = 0x1F
3.1 Device-dependent bootloader parameters
While the USART bootloader protocol’s command set and sequences are the same for all
the STM32 devices, some parameters are device-dependent. For a few commands, the
value of some parameters may depend on the device used. The concerned parameters are
listed below:
●PID (product ID), which changes with the device
●Valid memory addresses (RAM, Flash memory, system memory, option byte areas)
accepted by the bootloader when the Read Memory, Go and Write Memory commands
are executed.
●Size of the Flash memory sector used when executing the Write Protect command.
For more details about the value of these parameters for the device you are using, please
refer to the “Device-dependent bootloader parameters” section in the “STM32 system
memory boot mode” application note (AN2606).

AN3155 Bootloader command set
Doc ID 17066 Rev 2 9/37
3.2 Get command
The Get command allows you to get the version of the bootloader and the supported
commands. When the bootloader receives the Get command, it transmits the bootloader
version and the supported command codes to the host, as described in Figure 2.
Figure 2. Get command: host side
Figure 3. Get command: device side
Send 0x00 + 0xFF
Start Get
Wait for ACK
or NACK
Receive the number of bytes
(version+commands)
Receive the bootloader version
Receive the supported commands
Wait for ACK
or NACK
End of Get
NACK
ACK
ai14631
NACK
ACK
Send ACK byte
Start Get
Received
byte = 0x00+0xFF?
Send the number of bytes
(version+commands)
Send the bootloader version
Send the supported commands
End of Get
No
Ye s
ai14632
Send NACK byte
Send ACK byte

Bootloader command set AN3155
10/37 Doc ID 17066 Rev 2
The STM32 sends the bytes as follows:
3.3 Get Version & Read Protection Status command
The Get Version & Read Protection Status command is used to get the bootloader version
and the read protection status. When the bootloader receives the command, it transmits the
information described below (version, read protection: number of times it was enabled and
disabled) to the host.
Byte 1: ACK
Byte 2: N = 11 = the number of bytes to follow – 1 except current and ACKs.
Byte 3: Bootloader version (0 < Version < 255), example: 0x10 = Version 1.0
Byte 4: 0x00 – Get command
Byte 5: 0x01 – Get Version and Read Protection Status
Byte 6: 0x02 –GetID
Byte 7: 0x11 – Read Memory command
Byte 8: 0x21 – Go command
Byte 9: 0x31 – Write Memory command
Byte 10: 0x43 or
0x44
– Erase command or Extended Erase command (these commands are
exlusive)
Byte 11: 0x63 – Write Protect command
Byte 12: 0x73 – Write Unprotect command
Byte 13: 0x82 – Readout Protect command
Byte 14: 0x92 – Readout Unprotect command
Last byte (15): ACK

AN3155 Bootloader command set
Doc ID 17066 Rev 2 11/37
Figure 4. Get Version & Read Protection Status command: host side
1. GV = Get Version & Read Protection Status.
Figure 5. Get Version & Read Protection Status command: device side
1. GV = Get Version & Read Protection Status.
Wait for ACK
or NACK
Receive the number of times the
read protection was disabled
Receive the bootloader version
Wait for ACK
or NACK
End of GV
(1)
NACK
ACK
ai14633
Send 0x01+0xFE
Start GV
(1)
Receive the number of times the
read protection was enabled
NACK
ACK
Send ACK byte
Start GV
(1)
Received
byte = 0x01+0xFE?
Send the bootloader version
Option byte 2
End of GV
(1)
No
Ye s
ai14634
Send NACK byte
Send ACK byte
Option byte 1

Bootloader command set AN3155
12/37 Doc ID 17066 Rev 2
The STM32 sends the bytes as follows:
3.4 Get ID command
The Get ID command is used to get the version of the chip ID (identification). When the
bootloader receives the command, it transmits the product ID to the host.
The STM32 device sends the bytes as follows:
Figure 6. Get ID command: host side
1. GID = Get ID.
Byte 1: ACK
Byte 2: Bootloader version (0 < Version ≤255), example: 0x10 = Version 1.0
Byte 3: Option byte 1: 0x00 to keep the compatibility with generic bootloader protocol
Byte 4: Option byte 2: 0x00 to keep the compatibility with generic bootloader protocol
Byte 5: ACK
Byte 1: ACK
Byte 2: N = the number of bytes – 1 (N = 1 for STM32), except for current byte and
ACKs.
Bytes 3-4: PID(1) byte 3 = 0x04, byte 4 = 0x1X
1. PID stands for product ID. Byte 1 is the MSB and byte 2, the LSB of the address. Refer to Section 3.1:
Device-dependent bootloader parameters for more details about the PID of the device you are using.
Byte 5: ACK
Wait for ACK
or NACK
Receive N = number of bytes – 1
Wait for ACK
or NACK
End of GID(1)
NACK
ACK
ai14633
Send 0x02+0xFD
Start GID(1)
Receive PID
NACK
ACK

AN3155 Bootloader command set
Doc ID 17066 Rev 2 13/37
Figure 7. Get ID command: device side
1. GID = Get ID.
3.5 Read Memory command
The Read Memory command is used to read data from any valid memory address (see
note) in RAM, Flash memory and the information block (System memory or option byte
areas).
Note: Refer to Section 3.1: Device-dependent bootloader parameters for more details about the
valid memory addresses for the device you are using.
When the bootloader receives the Read Memory command, it transmits the ACK byte to the
application. After the transmission of the ACK byte, the bootloader waits for an address (4
bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, then it
checks the received address. If the address is valid and the checksum is correct, the
bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the
command.
When the address is valid and the checksum is correct, the bootloader waits for the number
of bytes to be transmitted – 1 (N bytes) and for its complemented byte (checksum). If the
checksum is correct it then transmits the needed data ((N + 1) bytes) to the application,
starting from the received address. If the checksum is not correct, it sends a NACK before
aborting the command.
Send ACK byte
Start GID
(1)
Received
byte = 0x02+0xFD?
Send N = number of bytes – 1
End of GID
(1)
No
Ye s
ai14636
Send NACK byte
Send ACK byte
Send product ID

Bootloader command set AN3155
14/37 Doc ID 17066 Rev 2
The host sends bytes to the STM32 as follows:
Figure 8. Read Memory command: host side
1. RM = Read Memory.
Bytes 1-2: 0x11+0xEE
Wait for ACK
Bytes 3 to 6: start address
●byte 3: MSB
●byte 6: LSB
Byte 7: Checksum: XOR (byte 3, byte 4, byte 5, byte 6)
Wait for ACK
Byte 8: The number of bytes to be read – 1 (0 < N ≤255);
Byte 9: Checksum: XOR byte 8 (complement of byte 8)
Wait for ACK
or NACK
Send the start address (4 bytes) with
checksum
Wait for ACK
or NACK
End of RM(1)
NACK
ACK
ai14637
Send 0x11+0xEE
Start RM(1)
Send the number of bytes to be read (1 byte)
and a checksum (1 byte)
Wait for ACK
or NACK
Receive data from the BL
NACK
ACK
NACK
ACK

AN3155 Bootloader command set
Doc ID 17066 Rev 2 15/37
Figure 9. Read Memory command: device side
1. RM = Read Memory.
ROP active
Receive the start address (4 bytes)
with checksum
Checksum OK?
End of RM
(1)
ai14638
Start RM
(1)
Receive the number of bytes to be read (1 byte)
and a checksum (1 byte)
Address valid &
checksum OK?
Send data to the host
Received byte =
0x11+0xEE
Send ACK byte
Send ACK byte
Send ACK byte Send NACK byte
No
Ye s
No
Ye s
No
Ye s
No
Ye s

Bootloader command set AN3155
16/37 Doc ID 17066 Rev 2
3.6 Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it transmits the ACK byte to the application. After the transmission of the ACK byte, the
bootloader waits for an address (4 bytes, byte 1 is the address MSB and byte 4 is LSB) and
a checksum byte, then it checks the received address. If the address is valid and the
checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK
byte and aborts the command.
When the address is valid and the checksum is correct, the bootloader firmware performs
the following:
●it initializes the registers of the peripherals used by the bootloader to their default reset
values
●it initializes the user application’s main stack pointer
●it jumps to the memory location programmed in the received ‘address + 4’ (which
corresponds to the address of the application’s reset handler).
For example if the received address is 0x0800 0000, the bootloader will jump to the
memory location programmed at address 0x0800 0004.
In general, the host should send the base address where the application to jump to is
programmed
Figure 10. Go command: host side
Wait for ACK
or NACK
Send 0x21 + 0xDE
Send the Start Address (4
bytes) & checksum
NACK
ACK
NACK
ACK
Start Go
End of EER
NACK
ACK
Wait for ACK
or NACK
Wait for ACK
or NACK
AIB

AN3155 Bootloader command set
Doc ID 17066 Rev 2 17/37
Note: 1 Valid addresses for the Go command are in RAM or Flash memory (refer to Section 3.1:
Device-dependent bootloader parameters for more details about the valid memory
addresses for the device you are using). All other addresses are considered not valid and
are NACKed by the device.
2 When an application is loaded into RAM and then a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first RAM memory used by the
bootloader firmware (refer to Section 3.1: Device-dependent bootloader parameters for
more details about the RAM offset for the device you are using).
3 The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
Figure 11. Go command: device side
ai14640b
Received bytes =
0x21+0xDE?
Start Go
ROP active
Send ACK byte
Send ACK byte
Receive the start address (4 bytes) &
checksum
Address valid &
checksum OK?
Send ACK byte
Jump to user application
Send NACK byte
No
Ye s
No
Ye s
No
End of Go

Bootloader command set AN3155
18/37 Doc ID 17066 Rev 2
The host sends bytes as follow to the STM32:
3.7 Write Memory command
The Write Memory command is used to write data to any valid memory address (see note
below) of RAM, Flash memory, or Option byte area.
When the bootloader receives the Write Memory command, it transmits the ACK byte to the
application. After the transmission of the ACK byte, the bootloader waits for an address (4
bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, it then
checks the received address. For the Option byte area, the start address must be the base
address of the Option byte area (see note) to avoid writing inopportunely in this area.
Note: 1 Write operations to Flash memory/SRAM must be word (32-bit) aligned and data should be
in multiples of four bytes. If less data are written the remaining bytes should be filled by
0xFF.
2 Refer to Section 3.1: Device-dependent bootloader parameters for more details about the
valid memory addresses for the device you are using.
If the received address is valid and the checksum is correct, the bootloader transmits an
ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address
is valid and the checksum is correct, the bootloader:
●gets a byte, N, which contains the number of data bytes to be received
●receives the user data ((N + 1) bytes) and the checksum (XOR of N and of all data
bytes)
●programs the user data to memory starting from the received address
●at the end of the command, if the write operation was successful, the bootloader
transmits the ACK byte; otherwise it transmits a NACK byte to the application and
aborts the command
The maximum length of the block to be written for the STM32 is 256 bytes.
If the Write Memory command is issued to the Option byte area, all options are erased
before writing the new values, and at the end of the command the bootloader generates a
system Reset to take into account the new configuration of the option byte.
Note: 1 When writing to the RAM, you should take care not to overlap the first RAM memory used by
the bootloader firmware.
2 No error is returned when performing write operations on write-protected sectors.
3 No error is returned when the start address is invalid.
Byte 1: 0x21
Byte 2: 0xDE
Wait for ACK
Byte 3 to byte 6: start address
byte 3: MSB
byte 6: LSB
Byte 7: checksum: XOR (byte 3, byte 4, byte 5, byte 6)

AN3155 Bootloader command set
Doc ID 17066 Rev 2 19/37
Figure 12. Write Memory command: host side
1. WM = Write Memory.
2. N+1 should always be a multiple of 4.

7AITFOR!#+
OR.!#+
7AITFOR!#+
OR.!#+
%NDOF7-

.!#+
!#+
AIB
3ENDXX#%
3TART7-

7AITFOR!#+
OR.!#+
3ENDTHESTARTADDRESSBYTES
CHECKSUM
3ENDTHENUMBEROFBYTESTOBEWRITTEN
BYTETHEDATA.BYTES

ANDCHECKSUM
.!#+
!#+
.!#+
!#+

Bootloader command set AN3155
20/37 Doc ID 17066 Rev 2
Figure 13. Write Memory command: device side
1. WM = Write Memory.
2. N+1 should always be a multiple of 4.
ROP inactive?
Receive the start address (4 bytes) &
checksum
Flash memory
address?
No
Ye s
ai14642c
Start WM
(1)
Receive the number of bytes to be written
(1 byte), the data (N + 1 bytes)
(2)
and checksum
Checksum OK? No
Ye s
Received byte =
0x31+0xCE?
Send ACK byte
Send ACK byte
Write the received data to Flash
memory from the start address
Send
ACK
byte
End of WM
(1)
No
Ye s
No
Ye s
Checksum OK? No
Ye s
RAM address?
Write the received data to RAM
from the start address
Ye s
Ye s
Option
byte address?
& address =
0x1FFF F800?
Write the received data to
Option byte area from start address
Ye s
Ye s
Write the Keys for Option byte
area access
Generate system reset
Send
NACK
byte
Send ACK byte