AN3155

Application note
USART protocol used in the STM32 bootloader

Introduction
This application note describes the USART protocol used in the STM32 microcontroller
bootloader, providing details on each supported command.
This document applies to STM32 products embedding any bootloader version, as specified
in the application note AN2606 “STM32 system memory boot mode”, available on
www.st.com. These products are listed in Table 1, and are referred to as STM32 throughout
the document.
For more information about the USART hardware resources and requirements for your
device bootloader, refer to the already mentioned AN2606.

Table 1. Applicable products

Type Product series

STM32L0 Series
STM32L1 Series
STM32L4 Series
STM32F0 Series
STM32F1 Series
Microcontrollers STM32F2 Series
STM32F3 Series
STM32F4 Series
STM32F7 Series
STM32H7 Series
STM32WB Series

February 2019 AN3155 Rev 9 1/38

www.st.com 1
Contents AN3155

Contents

1 USART bootloader code sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

2 Choosing the USARTx baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.1 Minimum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Maximum baud rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

3 Bootloader command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3.1 Get command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3.2 Get Version & Read Protection Status command . . . . . . . . . . . . . . . . . . . 10
3.3 Get ID command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.4 Read Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.5 Go command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.6 Write Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.7 Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.8 Extended Erase Memory command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.9 Write Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
3.10 Write Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.11 Readout Protect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.12 Readout Unprotect command . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4 Bootloader protocol version evolution . . . . . . . . . . . . . . . . . . . . . . . . . 35

5 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

2/38 AN3155 Rev 9

AN3155 List of tables

List of tables

Table 1. Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Table 2. USART bootloader commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Table 3. Bootloader protocol versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Table 4. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

AN3155 Rev 9 3/38

3
List of figures AN3155

List of figures

Figure 1. Bootloader for STM32 with USART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Figure 2. Get command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Figure 3. Get command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Figure 4. Get Version & Read Protection Status command: host side . . . . . . . . . . . . . . . . . . . . . . . 10
Figure 5. Get Version & Read Protection Status command: device side. . . . . . . . . . . . . . . . . . . . . . 11
Figure 6. Get ID command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Figure 7. Get ID command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Figure 8. Read Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Figure 9. Read Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Figure 10. Go command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Figure 11. Go command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Figure 12. Write Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Figure 13. Write Memory command: device side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Figure 14. Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Figure 15. Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Figure 16. Extended Erase Memory command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Figure 17. Extended Erase Memory command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Figure 18. Write Protect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Figure 19. Write Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Figure 20. Write Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Figure 21. Write Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Figure 22. Readout Protect command: host side. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 23. Readout Protect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Figure 24. Readout Unprotect command: host side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Figure 25. Readout Unprotect command: device side . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

4/38 AN3155 Rev 9

AN3155 USART bootloader code sequence

1 USART bootloader code sequence

Figure 1. Bootloader for STM32 with USART

X& RECEIVED ON
53!24X 2X PIN

53!24X SELECTED

!UTO BAUD RATE SEQUENCE

SEND !#+ BYTE  DISABLE
UNUSED PERIPHERALS

7AIT FOR A
COMMAND
#OMMAND
'%4 CMD RECEIVED '/ CMD

'%4 CMD 2$ CMD OPTIONAL '/ CMD

ROUTINE ROUTINE 2OUTINES FOR ROUTINE
LOADING
INTO 2!-

*0 TO?!DDRESS

AI

Once the system memory boot mode is entered and the STM32 microcontroller (based on
on Arm®(a) cores) has been configured (for more details refer to AN2606) the bootloader
code begins to scan the USARTx_RX line pin, waiting to receive the 0x7F data frame: a
start bit, 0x7F data bits, even parity bit and a stop bit.
The duration of this data frame is measured using the Systick timer. The count value of the
timer is then used to calculate the corresponding baud rate factor with respect to the current
system clock.
Next, the code initializes the serial interface accordingly. Using this calculated baud rate, an
acknowledge byte (0x79) is returned to the host, which signals that the STM32 is ready to
receive commands.

a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

AN3155 Rev 9 5/38

37
Choosing the USARTx baud rate AN3155

2 Choosing the USARTx baud rate

The calculation of the serial baud rate for USARTx, from the length of the first received byte,
is used to operate the bootloader within a wide range of baud rates. However, the upper and
lower limits have to be kept, to ensure proper data transfer.
For a correct data transfer from the host to the microcontroller, the maximum deviation
between the internal initialized baud rate for USARTx and the real baud rate of the host
must be below 2.5%. The deviation (fB, in percent) between the host baud rate and the
microcontroller baud rate can be calculated using the formula below:

f B = STM32 baud rate – Host baud rate

------------------------------------------------------------------------------------------- × 100% , where fB ≤2.5%.
STM32 baud rate

This baud rate deviation is a nonlinear function, depending upon the CPU clock and the
baud rate of the host. The maximum of the function (fB) increases with the host baud rate.
This is due to the smaller baud rate prescale factors, and the implied higher quantization
error.

2.1 Minimum baud rate

The lowest tested baud rate (BLow) is 1200. Baud rates below BLow cause SysTick timer
overflows. In this event, USARTx will not be correctly initialized.

2.2 Maximum baud rate

BHigh is the highest baud rate for which the deviation does not exceed the limit. All baud
rates between BLow and BHigh are below the deviation limit.
The highest tested baud rate (BHigh) is 115200.

6/38 AN3155 Rev 9

AN3155 Bootloader command set

3 Bootloader command set

The supported commands are listed in Table 2. Each command is described in this section.

Table 2. USART bootloader commands

Command(1) Command code Command description

Gets the version and the allowed commands supported by

Get(2) 0x00
the current version of the bootloader.
Get Version & Read Gets the bootloader version and the Read Protection
0x01
Protection Status(2) status of the Flash memory.
Get ID(2) 0x02 Gets the chip ID.
Reads up to 256 bytes of memory starting from an
Read Memory(3) 0x11
address specified by the application.
Jumps to user application code located in the internal
Go(3) 0x21
Flash memory or in the SRAM.
Writes up to 256 bytes to the RAM or Flash memory
Write Memory(3) 0x31
starting from an address specified by the application.
Erase(3)(4) 0x43 Erases from one to all the Flash memory pages.
Erases from one to all the Flash memory pages using two
Extended Erase(3)(4) 0x44 byte addressing mode (available only for v3.0 usart
bootloader versions and above).
Write Protect 0x63 Enables the write protection for some sectors.
Write Unprotect 0x73 Disables the write protection for all Flash memory sectors.
Readout Protect 0x82 Enables the read protection.
Readout Unprotect(2) 0x92 Disables the read protection.
1. If a denied command is received or an error occurs during the command execution, the bootloader sends
NACK byte and goes back to command checking.
2. Read protection. When the RDP (Read protection) option is active, only this limited subset of commands is
available. All other commands are NACK-ed and have no effect on the device. Once the RDP has been
removed, the other commands become active.
3. Refer to STM32 product datasheets and to AN2606 to know the valid memory areas for these commands.
4. Erase (x043) and Extended Erase (0x44) are exclusive. A device can support either the Erase command or
the Extended Erase command, but not both.

Communication safety
All communication from the programming tool (PC) to the device is verified by:
1. checksum: received blocks of data bytes are XOR-ed. A byte containing the computed
XOR of all previous bytes is added to the end of each communication (checksum byte).
By XOR-ing all received bytes, data plus checksum, the result at the end of the packet
must be 0x00.
2. For each command the host sends a byte and its complement (XOR = 0x00).
3. UART: parity check active (even parity).

AN3155 Rev 9 7/38

37
Bootloader command set AN3155

Each packet is either accepted (ACK answer) or discarded (NACK answer):

• ACK = 0x79
• NACK = 0x1F

3.1 Get command

The Get command allows the user to get the version of the bootloader and the supported
commands. When the bootloader receives the Get command, it transmits the bootloader
version and the supported command codes to the host, as described in Figure 2.

Figure 2. Get command: host side

6WDUW*HW

6HQG[[))

:DLWIRU$&. 1$&.
RU1$&.

$&.


5HFHLYHWKHQXPEHURIE\WHV
YHUVLRQFRPPDQGV

5HFHLYHWKHERRWORDGHUYHUVLRQ

5HFHLYHWKHVXSSRUWHGFRPPDQGV

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI*HW
DL

8/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 3. Get command: device side

6WDUW*HW

5HFHLYHG
1R
E\WH [[))" 6HQG1$&.E\WH

<HV

6HQG$&.E\WH


6HQGWKHQXPEHURIE\WHV
YHUVLRQFRPPDQGV

6HQGWKHERRWORDGHUYHUVLRQ

6HQGWKHVXSSRUWHGFRPPDQGV

6HQG$&.E\WH

(QGRI*HW
DL

The STM32 sends the bytes as follows:

Byte 1: ACK
Byte 2: N = 11 = the number of bytes to follow – 1 except current and ACKs.
Byte 3: Bootloader version (0 < Version < 255), example: 0x10 = Version 1.0
Byte 4: 0x00 – Get command
Byte 5: 0x01 – Get Version and Read Protection Status
Byte 6: 0x02 – Get ID
Byte 7: 0x11 – Read Memory command
Byte 8: 0x21 – Go command
Byte 9: 0x31 – Write Memory command
Byte 10: 0x43 or 0x44 – Erase command or Extended Erase command
(exclusive commands)
Byte 11: 0x63 – Write Protect command
Byte 12: 0x73 – Write Unprotect command

AN3155 Rev 9 9/38

37
Bootloader command set AN3155

Byte 13: 0x82 – Readout Protect command

Byte 14: 0x92 – Readout Unprotect command
Last byte (15): ACK

3.2 Get Version & Read Protection Status command

The Get Version & Read Protection Status command is used to get the bootloader version
and the read protection status. After receiving the command the bootloader transmits the
version, the read protection and number of times it was enabled and disabled to the host.

Figure 4. Get Version & Read Protection Status command: host side

6WDUW*9;ϭͿ

6HQG[[)(

1$&.
:DLWIRU
$&.RU1$&.

$&.

5HFHLYHWKHERRWORDGHUYHUVLRQ

2SWLRQE\WH

2SWLRQE\WH

1$&.
:DLWIRU
$&.RU1$&.

$&.

(QGRI*9;ϭͿ

069

1. GV = Get Version & Read Protection Status.

10/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 5. Get Version & Read Protection Status command: device side

6WDUW*9 

5HFHLYHG
1R
E\WH [[)(" 6HQG1$&.E\WH

<HV

6HQG$&.E\WH


6HQGWKHERRWORDGHUYHUVLRQ

2SWLRQE\WH

2SWLRQE\WH

6HQG$&.E\WH

(QGRI*9 
069

1. GV = Get Version & Read Protection Status.

The STM32 sends the bytes as follows:

Byte 1: ACK
Byte 2: Bootloader version (0 < Version ≤ 255), example: 0x10 = Version 1.0
Byte 3: Option byte 1: 0x00 to keep the compatibility with generic bootloader protocol
Byte 4: Option byte 2: 0x00 to keep the compatibility with generic bootloader protocol
Byte 5: ACK

AN3155 Rev 9 11/38

37
Bootloader command set AN3155

3.3 Get ID command

The Get ID command is used to get the version of the chip ID (identification). When the
bootloader receives the command, it transmits the product ID to the host.
The STM32 device sends the bytes as follows:
Byte 1: ACK
Byte 2: N = the number of bytes – 1 (N = 1 for STM32), except for current byte and
ACKs.
Bytes 3-4: PID(1) byte 3 = 0x04, byte 4 = 0xXX
Byte 5: ACK
1. PID stands for product ID. Byte 1 is the MSB and byte 2 the LSB of the ID.

Figure 6. Get ID command: host side

6WDUW*,' 

6HQG[[)'

:DLWIRU$&. 1$&.
RU1$&.

$&.


5HFHLYH1 QXPEHURIE\WHV±

5HFHLYH3,'

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI*,' 
DL

1. GID = Get ID.

12/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 7. Get ID command: device side

3TART ')$

2ECEIVED .O
BYTE  X X&$ 3END .!#+ BYTE

9ES

3END !#+ BYTE

3END .  NUMBER OF BYTES n 

3END PRODUCT )$

3END !#+ BYTE

%ND OF ')$
AI

1. GID = Get ID.

3.4 Read Memory command

The Read Memory command is used to read data from any valid memory address (refer to
the product datasheets and to AN2606 for more details) in RAM, Flash memory and the
information block (system memory or option byte areas).
When the bootloader receives the Read Memory command, it transmits the ACK byte to the
application. After the transmission of the ACK byte, the bootloader waits for an address (four
bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, then it
checks the received address. If the address is valid and the checksum is correct, the
bootloader transmits an ACK byte, otherwise it transmits a NACK byte and aborts the
command.
When the address is valid and the checksum is correct, the bootloader waits for the number
of bytes to be transmitted – 1 (N bytes) and for its complemented byte (checksum). If the
checksum is correct it then transmits the needed data ((N + 1) bytes) to the application,
starting from the received address. If the checksum is not correct, it sends a NACK before
aborting the command.
The host sends bytes to the STM32 as follows:
Bytes 1-2: 0x11 + 0xEE
Wait for ACK
Bytes 3 to 6 Start address byte 3: MSB, byte 6: LSB
Byte 7: Checksum: XOR (byte 3, byte 4, byte 5, byte 6)
Wait for ACK
Byte 8: The number of bytes to be read – 1 (0 < N ≤255);
Byte 9: Checksum: XOR byte 8 (complement of byte 8)

AN3155 Rev 9 13/38

37
Bootloader command set AN3155

Figure 8. Read Memory command: host side

6WDUW50 

6HQG[[((

:DLWIRU$&. 1$&.
RU1$&.

$&.


6HQGWKHVWDUWDGGUHVV E\WHV ZLWK
FKHFNVXP

:DLWIRU$&. 1$&.
RU1$&.

$&.

6HQGWKHQXPEHURIE\WHVWREHUHDG E\WH
DQGDFKHFNVXP E\WH

:DLWIRU$&. 1$&.
RU1$&.

$&.

5HFHLYHGDWDIURPWKH%/

(QGRI50 
DL

1. RM = Read Memory.

14/38 AN3155 Rev 9

AN3155 Bootloader command set

Note: Some products may return two NACKs instead of a single NACK when Read protection
(RDP) is active (or Read protection level 1 is active). To know if a given product returns one
or two NACKs in this situation, refer to the known limitations section relative to that product
in AN2606.

Figure 9. Read Memory command: device side

3TART 2-

2ECEIVED BYTE  .O
X X%%

9ES

9ES
2$0 ACTIVE

.O

3END !#+ BYTE

2ECEIVE THE START ADDRESS  BYTES

WITH CHECKSUM

!DDRESS VALID  .O
CHECKSUM /+

9ES

3END !#+ BYTE

2ECEIVE THE NUMBER OF BYTES TO BE READ  BYTE

AND A CHECKSUM  BYTE

.O
#HECKSUM /+

9ES

3END !#+ BYTE 3END .!#+ BYTE

3END DATA TO THE HOST

%ND OF 2-
AIB

1. RM = Read Memory.

AN3155 Rev 9 15/38

37
Bootloader command set AN3155

3.5 Go command
The Go command is used to execute the downloaded code or any other code by branching
to an address specified by the application. When the bootloader receives the Go command,
it transmits the ACK byte to the application. After the transmission of the ACK byte, the
bootloader waits for an address (four bytes, byte 1 is the address MSB and byte 4 is LSB)
and a checksum byte, then it checks the received address. If the address is valid and the
checksum is correct, the bootloader transmits an ACK byte, otherwise it transmits a NACK
byte and aborts the command.
When the address is valid and the checksum is correct, the bootloader firmware performs
the following:
• initializes the registers of the peripherals used by the bootloader to their default reset
values
• initializes the user application’s main stack pointer
• jumps to the memory location programmed in the received ‘address + 4’
(corresponding to the address of the application reset handler).
For example if the received address is 0x0800 0000, the bootloader will jump to the
memory location programmed at address 0x0800 0004.
In general, the host must send the base address where the application to jump to is
programmed

Figure 10. Go command: host side

6WDUW*R

6HQG[['(

:DLWIRU$&. 1$&.
RU1$&.
$&.

6HQGWKH6WDUW$GGUHVV
E\WHVFKHFNVXP 

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI*R

DLG

16/38 AN3155 Rev 9

AN3155 Bootloader command set

Note: Valid addresses for the Go command are in RAM or Flash memory (refer to STM32 product
datasheets and to AN2606 for more details about the valid memory addresses for the used
device). All other addresses are considered not valid and are NACK-ed by the device.
When an application is loaded into RAM and then a jump is made to it, the program must be
configured to run with an offset to avoid overlapping with the first RAM used by the
bootloader firmware (refer to STM32 product datasheets and to AN2606 for more details
about the RAM offset for the used device).
The Jump to the application works only if the user application sets the vector table correctly
to point to the application address.
Some products may return two NACKs instead of a single NACK when Read protection
(RDP) is active (or Read protection level 1 is active). To know if a given product returns one
or two NACKs in this situation, refer to the known limitations section relative to that product
in AN2606.

Figure 11. Go command: device side

6WDUW*R

5HFHLYHGE\WHV 1R
[['("

<HV

<HV
5'3DFWLYH

1R

6HQG$&.E\WH

5HFHLYHWKHVWDUWDGGUHVV E\WHV 
FKHFNVXP

$GGUHVVYDOLG 1R
6HQG1$&.E\WH
FKHFNVXP2."

6HQG$&.E\WH
(QGRI*R

-XPSWRXVHUDSSOLFDWLRQ

DLG

AN3155 Rev 9 17/38

37
Bootloader command set AN3155

The host sends bytes to the STM32 as follows:

Byte 1: 0x21
Byte 2: 0xDE
Wait for ACK
Byte 3 to byte 6: Start address (byte 3: MSB, byte 6: LSB)
Byte 7: Checksum: XOR (byte 3, byte 4, byte 5, byte 6)

3.6 Write Memory command

The Write Memory command is used to write data to any valid memory address (see note
below) i.e. RAM, Flash memory, option byte area...
When the bootloader receives the Write Memory command, it transmits the ACK byte to the
application. After the transmission of the ACK byte, the bootloader waits for an address (four
bytes, byte 1 is the address MSB and byte 4 is the LSB) and a checksum byte, it then
checks the received address. For the option byte area, the start address must be the base
address of the option byte area (see note) to avoid writing inopportunely in this area.
If the received address is valid and the checksum is correct, the bootloader transmits an
ACK byte, otherwise it transmits a NACK byte and aborts the command. When the address
is valid and the checksum is correct, the bootloader:
• gets a byte, N, which contains the number of data bytes to be received
• receives the user data ((N + 1) bytes) and the checksum (XOR of N and of all data
bytes)
• programs the user data to memory starting from the received address
• at the end of the command, if the write operation was successful, the bootloader
transmits the ACK byte; otherwise it transmits a NACK byte to the application and
aborts the command
The maximum length of the block to be written for the STM32 is 256 bytes.
If the Write Memory command is issued to the option byte area, all bytes are erased before
writing the new values, and at the end of the command the bootloader generates a system
reset to take into account the new configuration of the option bytes.
Note: When writing to the RAM, user must not overlap the first RAM used by the bootloader
firmware.
No error is returned when performing write operations on write-protected sectors.No error is
returned when the start address is invalid.

18/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 12. Write Memory command: host side

3TART 7-

3END X X#%

7AIT FOR !#+ .!#+

OR .!#+

!#+

3END THE START ADDRESS  BYTES

 CHECKSUM

7AIT FOR !#+ .!#+

OR .!#+

!#+
3END THE NUMBER OF BYTES TO BE WRITTEN
 BYTE THE DATA .  BYTES  AND CHECKSUM

7AIT FOR !#+ .!#+

OR .!#+

!#+
%ND OF 7- 

AIB

1. WM = Write Memory.
2. N+1 must be a multiple of 4.

Note: Some products may return two NACKs instead of one when Read protection (RDP) is active
(or Read protection level 1 is active). To know if a given product returns a single or two
NACKs in this situation, refer to the known limitations section relative to that product in
AN2606.

AN3155 Rev 9 19/38

37
Bootloader command set AN3155

Figure 13. Write Memory command: device side

^ƚĂƌƚtD;ϭͿ

ZĞĐĞŝǀĞĚďLJƚĞс EŽ
ϬdžϯϭнϬdž͍

zĞƐ
EŽ
ZWŝŶĂĐƚŝǀĞ͍

zĞƐ

^ĞŶĚ<ďLJƚĞ

ZĞĐĞŝǀĞƚŚĞƐƚĂƌƚĂĚĚƌĞƐƐ;ϰďLJƚĞƐͿΘ
ĐŚĞĐŬƐƵŵ

EŽ
ŚĞĐŬƐƵŵK<͍

zĞƐ
^ĞŶĚ<ďLJƚĞ

ZĞĐĞŝǀĞƚŚĞŶƵŵďĞƌŽĨďLJƚĞƐƚŽďĞǁƌŝƚƚĞŶ
;ϭďLJƚĞͿ͕ƚŚĞĚĂƚĂ;EнϭďLJƚĞƐͿ;ϮͿĂŶĚĐŚĞĐŬƐƵŵ

EŽ
ŚĞĐŬƐƵŵK<͍

zĞƐ

^ƵƉƉŽƌƚĞĚ zĞƐ
ŵĞŵŽƌLJΘŶŽƚ tƌŝƚĞƚŽĚĞƐƚŝŶĂƚŝŽŶŵĞŵŽƌLJ
KƉƚŝŽŶďLJƚĞƐ͍

EŽ

KƉƚŝŽŶ zĞƐ tƌŝƚĞƚŚĞ<ĞLJƐĨŽƌKƉƚŝŽŶďLJƚĞĂƌĞĂ

ďLJƚĞĂĚĚƌĞƐƐ͍ ĂĐĐĞƐƐ

tƌŝƚĞƚŚĞƌĞĐĞŝǀĞĚĚĂƚĂƚŽ
KƉƚŝŽŶďLJƚĞĂƌĞĂĨƌŽŵƐƚĂƌƚĂĚĚƌĞƐƐ
EŽ ^ĞŶĚ ^ĞŶĚ
< E<
^ĞŶĚ<ďLJƚĞ ďLJƚĞ ďLJƚĞ

'ĞŶĞƌĂƚĞƐLJƐƚĞŵƌĞƐĞƚ

ŶĚŽĨtD;ϭͿ
ĂŝϭϰϲϰϮĞ

1. WM = Write Memory.
2. N+1 must be a multiple of 4.

20/38 AN3155 Rev 9

AN3155 Bootloader command set

The host sends the bytes to the STM32 as follows:

Byte 1: 0x31
Byte 2: 0xCE
Wait for ACK
Byte 3 to byte 6: Start address (byte 3: MSB, byte 6: LSB)
Byte 7: Checksum: XOR (byte3, byte4, byte5, byte6)
Wait for ACK
Byte 8: Number of bytes to be received (0 < N ≤255)
N +1 data bytes:(Max 256 bytes)
Checksum byte: XOR (N, N+1 data bytes)

3.7 Erase Memory command

The Erase Memory command allows the host to erase Flash memory pages. When the
bootloader receives the Erase Memory command, it transmits the ACK byte to the host.
After the transmission of the ACK byte, the bootloader receives one byte (number of pages
to be erased), the Flash memory page codes and a checksum byte; if the checksum is
correct then bootloader erases the memory and sends an ACK byte to the host, otherwise it
sends a NACK byte to the host and the command is aborted.
Erase Memory command specifications:
1. the bootloader receives a byte that contains N, the number of pages to be erased – 1.
N = 255 is reserved for global erase requests. For 0 ≤N ≤254, N + 1 pages are erased.
2. the bootloader receives (N + 1) bytes, each byte containing a page number.
Note: No error is returned when performing erase operations on write protected sectors.

AN3155 Rev 9 21/38

37
Bootloader command set AN3155

Figure 14. Erase Memory command: host side

6WDUW(5 

6HQG[[%&

:DLWIRU$&. 1$&.
RU1$&.

$&.


<HV *OREDO 1R
(UDVH"

6HQG[)) 6HQGWKHQXPEHURISDJHV
WREHHUDVHG E\WH

6HQG[
6HQGWKHSDJHQXPEHUV

6HQGFKHFNVXP

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI(5 
DLE

1. ER = Erase Memory.

22/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 15. Erase Memory command: device side

3TART %2

2ECEIVED BYTES  .O
X X"#

9ES

9ES
2$0 ACTIVE

.O

3END !#+ BYTE

2ECEIVE THE NUMBER OF PAGES

TO BE ERASED  BYTE

9ES
X&& RECEIVED

.O

2ECEIVE THE PAGE CODES

.O
9ES
3TART 'LOBAL %RASE 2ECEIVE THE CHECKSUM
-ASS %RASE

#HECKSUM .O
/+

9ES
%RASE THE CORRESPONDING PAGES

3END !#+ BYTE 3END .!#+ BYTE

%ND OF %2
AIC

1. ER = Erase Memory.

Note: After sending the erase memory command and its checksum, if the host sends 0xFF
followed by data different from 0x00, the mass erase is not performed but an ACK is sent by
the device.
The host sends bytes to the STM32 as follows:
Byte 1: 0x43
Byte 2: 0xBC
Wait for ACK

AN3155 Rev 9 23/38

37
Bootloader command set AN3155

Byte 3: 0xFF or number of pages to be erased – 1 (0 ≤N ≤maximum number of pages)

Byte 4: 0x00 (in case of global erase) or ((N + 1 bytes (page numbers) and then checksum
XOR (N, N+1 bytes))

3.8 Extended Erase Memory command

The Extended Erase Memory command allows the host to erase Flash memory pages using
two bytes addressing mode. When the bootloader receives the Extended Erase Memory
command, it transmits the ACK byte to the host. After the transmission of the ACK byte, the
bootloader receives two bytes (number of pages to be erased), the Flash memory page
codes (each one coded on two bytes, MSB first) and a checksum byte (XOR of the sent
bytes); if the checksum is correct, the bootloader erases the memory and sends an ACK
byte to the host. Otherwise it sends a NACK byte to the host and the command is aborted.
Extended Erase Memory command specifications:
1. The bootloader receives one half-word (two bytes) that contains N, the number of
pages to be erased:
a) For N = 0xFFFY (where Y is from 0 to F) special erase is performed:
- 0xFFFF for global mass erase
- 0xFFFE for bank 1 mass erase
- 0xFFFD for bank 2 mass erase
- Codes from 0xFFFC to 0xFFF0 are reserved
b) For other values where 0 ≤ N < maximum number of pages: N + 1 pages are
erased.
2. The bootloader receives:
a) In the case of a special erase, one byte: checksum of the previous bytes:
- 0x00 for 0xFFFF
- 0x01 for 0xFFFE
- 0x02 for 0xFFFD
a) In the case of N+1 page erase, the bootloader receives (2 x (N + 1)) bytes, each
half-word containing a page number (coded on two bytes, MSB first). Then all
previous byte checksums (in one byte).
Note: No error is returned when performing erase operations on write-protected sectors.
The maximum number of pages is relative to the product and must be respected.

24/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 16. Extended Erase Memory command: host side

6WDUW((5

6HQG[[%%

1$&.
:DLWIRU$&.RU1$&.

$&.

<(6 12
6SHFLDO(UDVH"

6HQGWKHQXPEHURISDJHV
WREHHUDVHG1 RQWZR
6HQG6SHFLDO(UDVHFPG E\WHV 06%ILUVW
[)))) 0DVVHUDVH
[)))( %DQNHUDVH
6HQGWKHSDJHQXPEHUV
[)))' %DQNHUDVH
[)))WR[)))&DUHUHVHUYHG
HDFKRQWZRE\WHV06%
ILUVW

6HQGWKHFKHFNVXPRIWKHWZR 6HQGE\WHFKHFNVXPRIDOO
E\WHV VHQWE\WHV 1 E\WHV 
[ 1 E\WHV

1$&.
:DLWIRU$&.RU1$&.

$&.

(QGRI((5

AI

1. EER = Extended Erase Memory

AN3155 Rev 9 25/38

37
Bootloader command set AN3155

Figure 17. Extended Erase Memory command: device side

^ƚĂƌƚZ

EŽ
ZĞĐĞŝǀĞĚďLJƚĞƐсϬdžϰϰнϬdž͍

zĞƐ

zĞƐ
ZWĐƚŝǀĞ͍

EŽ

^ĞŶĚ<LJƚĞ

ZĞĐĞŝǀĞEƵŵďĞƌŽĨWĂŐĞƐƚŽďĞ
ĞƌĂƐĞĚE;ϮďLJƚĞƐͿD^ĨŝƌƐƚ

zĞƐ Ϭdž&&&zƌĞĐĞŝǀĞĚ͍
tŚĞƌĞzĐĂŶďĞ
&͕Žƌ
^ƚĂƌƚ^ƉĞĐŝĂůƌĂƐĞ͗ EŽ
Ϭdž&&&&сDĂƐƐĞƌĂƐĞ
Ϭdž&&&сĂŶŬϭĞƌĂƐĞ ZĞĐĞŝǀĞƚŚĞƉĂŐĞĐŽĚĞƐ;ŽŶϮ
Ϭdž&&&сĂŶŬϮĞƌĂƐĞ ďLJƚĞƐĞĂĐŚ͕D^ĨŝƌƐƚͿ
;Ϭdž&&&ϬƚŽϬdž&&&ĂƌĞƌĞƐĞƌǀĞĚͿ
ZĞĐĞŝǀĞƚŚĞĐŚĞĐŬƐƵŵŽĨĂůů
ZĞĐĞŝǀĞŚĞĐŬƐƵŵŽĨƚŚĞϮďLJƚĞƐ ƌĞĐĞŝǀĞĚďLJƚĞƐ;E;ŽŶϮ
;ϬdžϬϬ͕ϬdžϬϭŽƌϬdžϬϮͿ Ϯ
ďLJƚĞƐͿ͕dž;EнϭͿďLJƚĞƐͿ

ŚĞĐŬƐƵŵŽĨϮ ŚĞĐŬƐƵŵŽĨĂůů EŽ
EŽ ƌĞĐĞŝǀĞĚďLJƚĞƐK<
͍
ďLJƚĞƐK<ĂŶĚĐŽŵŵĂŶĚ
^ƵƉƉŽƌƚĞĚ͍
zĞƐ
zĞƐ
WĞƌĨŽƌŵƚŚĞ ƌĂƐĞƚŚĞĐŽƌƌĞƐƉŽŶĚŝŶŐƉĂŐĞƐ
ƌĞƋƵĞƐƚĞĚĞƌĂƐĞ

^ĞŶĚE<ďLJƚĞ ^ĞŶĚ<ďLJƚĞ ^ĞŶĚE<ďLJƚĞ

ŶĚŽĨZ
ĂŝϭϳϰϲϭĐ

1. EER = Extended Erase Memory.

26/38 AN3155 Rev 9

AN3155 Bootloader command set

The host sends the bytes to the STM32F1xxx as follows:

Byte 1: 0x44
Byte 2: 0xBB
Wait for ACK
Bytes 3-4: – Special erase (0xFFFF, 0xFFFE or 0xFFFD)
OR
– Number of pages to be erased (N+1 where: 0 ≤N < Maximum number of
pages).
Remaining – Checksum of Bytes 3-4 in case of special erase (0x00 if 0xFFFFor 0x01
bytes if 0xFFFE or 0x02 if 0xFFFD)
OR
– (2 x (N + 1)) bytes (page numbers coded on two bytes MSB first) and
then the checksum for bytes 3-4 and all the following bytes)

3.9 Write Protect command

The Write Protect command is used to enable the write protection for some or all Flash
memory sectors. When the bootloader receives the Write Protect command, it transmits the
ACK byte to the host. After the transmission of the ACK byte, the bootloader waits for the
number of bytes to be received (sectors to be protected) and then receives the Flash
memory sector codes from the application.
At the end of the Write Protect command, the bootloader transmits the ACK byte and
generates a system reset to take into account the new configuration of the option byte.
Note: Refer to STM32 product datasheets and to AN2606 for more details about the sector size
for the used device.
The Write Protect command sequence is as follows:
• the bootloader receives one byte that contains N, the number of sectors to be write-
protected – 1 (0 ≤ N ≤ 255)
• the bootloader receives (N + 1) bytes, each byte contains a sector code
Note: The total number of sectors and the sector number to be protected are not checked, this
means that no error is returned when a command is passed with a wrong number of sectors
to be protected or a wrong sector number.
If a second Write Protect command is executed, the Flash memory sectors been protected
by the first command become unprotected, and only the sectors passed within the second
Write Protect command become protected.

AN3155 Rev 9 27/38

37
Bootloader command set AN3155

Figure 18. Write Protect command: host side

6WDUW:3 

6HQG[[&

:DLWIRU$&. 1$&.
RU1$&.

$&.

6HQGWKHQXPEHURIVHFWRUV
WREHSURWHFWHG E\WH

6HQGWKHVHFWRUFRGHV

6HQGFKHFNVXP

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI:3 
DLE

1. WP = Write Protect.

28/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 19. Write Protect command: device side

3TART 70

2ECEIVED BYTES  .O
X X#

9ES

9ES
2$0 ACTIVE

.O

3END !#+ BYTE

2ECEIVE THE NUMBER OF SECTORS

TO BE PROTECTED  BYTE

2ECEIVE THE SECTOR CODES

2ECEIVE THE CHECKSUM

#HECKSUM .O
/+

9ES
7RITE PROTECT THE REQUESTED SECTORS

3END !#+ BYTE 3END .!#+ BYTE

'ENERATE SYSTEM RESET

%ND OF 70
AIC

1. WP = Write Protect.

AN3155 Rev 9 29/38

37
Bootloader command set AN3155

3.10 Write Unprotect command

The Write Unprotect command is used to disable the write protection of all the Flash
memory sectors. When the bootloader receives the Write Unprotect command, it transmits
the ACK byte to the host. After the transmission of the ACK byte, the bootloader disables
the write protection of all the Flash memory sectors. After the unprotection operation the
bootloader transmits the ACK byte.
At the end of the Write Unprotect command, the bootloader transmits the ACK byte and
generates a system reset to take into account the new configuration of the option byte.

Figure 20. Write Unprotect command: host side

6WDUW:381 

6HQG[[&

:DLWIRU$&. 1$&.
RU1$&.

$&.

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI:381 
DL

1. WPUN = Write Unprotect.

30/38 AN3155 Rev 9

AN3155 Bootloader command set

Figure 21. Write Unprotect command: device side

3TART 705.

2ECEIVED BYTES  .O
X X#

9ES

9ES
2$0 ACTIVE

.O

3END !#+ BYTE

2EMOVE THE PROTECTION FOR THE

ENTIRE &LASH MEMORY

3END !#+ BYTE 3END .!#+ BYTE

'ENERATE SYSTEM RESET

%ND OF 705.
AIC

1. WPUN = Write Unprotect.

3.11 Readout Protect command

The Readout Protect command is used to enable the Flash memory read protection. When
the bootloader receives the Readout Protect command, it transmits the ACK byte to the
host. After the transmission of the ACK byte, the bootloader enables the read protection for
the Flash memory.
At the end of the Readout Protect command, the bootloader transmits the ACK byte and
generates a system reset to take into account the new configuration of the option byte.

AN3155 Rev 9 31/38

37
Bootloader command set AN3155

Figure 22. Readout Protect command: host side

6WDUW5'3B350 

6HQG[['

:DLWIRU$&. 1$&.
RU1$&.

$&.

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI5'3B350 

DL

1. RDP_PRM = Readout Protect.

Figure 23. Readout Protect command: device side

3TART 2$0?02-

2ECEIVED BYTES  .O
X X$

9ES

9ES
2$0 ACTIVE

.O

3END !#+ BYTE

!CTIVATE 2EAD PROTECTION FOR &LASH

MEMORY

3END !#+ BYTE 3END .!#+ BYTE

'ENERATE SYSTEM RESET

%ND OF 2$0?02-
AIC

1. RDP_PRM = Readout Protect.

32/38 AN3155 Rev 9

AN3155 Bootloader command set

3.12 Readout Unprotect command

The Readout Unprotect command is used to disable the Flash memory read protection.
When the bootloader receives the Readout Unprotect command, it transmits the ACK byte
to the host. After the transmission of the ACK byte, the bootloader erases all the Flash
memory sectors and it disables the read protection for the entire Flash memory. If the erase
operation is successful, the bootloader deactivates the RDP.
If the erase operation is unsuccessful, the bootloader transmits a NACK and the read
protection remains active.
At the end of the Readout Unprotect command, the bootloader transmits an ACK and
generates a system reset to take into account the new configuration of the option byte.
Note: For most STM32 products, the readout unprotect operation induces a mass erase of the
Flash memory, so the Host has to wait sufficient time after the second ACK and before
restarting connection. To know how much time this operation takes, refer to the mass erase
time (when specified) in the product datasheet.

Figure 24. Readout Unprotect command: host side

6WDUW5'8B350 

6HQG[['

:DLWIRU$&. 1$&.
RU1$&.

$&.

:DLWIRU$&. 1$&.
RU1$&.

$&.

(QGRI5'8B350 
AI

1. RDU_PRM = Readout Unprotect.

AN3155 Rev 9 33/38

37
Bootloader command set AN3155

Figure 25. Readout Unprotect command: device side

3TART 2$5?02-

2ECEIVED BYTES .O
X X$

9ES

3END !#+ BYTE

$ISABLE 2$0

3END !#+ BYTE

#LEAR ALL 2!- MEMORY

'ENERATE SYSTEM RESET 3END .!#+ BYTE

%ND OF 2$5?02- AIB

2. RDU_PRM = Readout Unprotect.

34/38 AN3155 Rev 9

AN3155 Bootloader protocol version evolution

4 Bootloader protocol version evolution

Table 3 lists the bootloader versions.

Table 3. Bootloader protocol versions

Version Description

V2.0 Initial bootloader version.

– Update Go command to initialize the main stack pointer
– Update Go command to return NACK when jump address is in the option byte
V2.1 area or system memory area
– Update Get ID command to return the device ID on two bytes
– Update the bootloader version to V2.1
– Update Read Memory, Write Memory and Go commands to deny access, with a
NACK response, to the first bytes of RAM used by the bootloader
V2.2
– Update Readout Unprotect command to initialize the whole RAM content to 0x0
before RDP disable operation
– Extended Erase command added to support number of pages larger than 256 and
separate bank mass erase.
V3.0 – Erase command has not been modified in this version but, due to addition of the
Extended Erase command it is no longer supported (Erase and Extended Erase
commands are exclusive).
– Limitation fix of:
“When a Read Memory command or Write Memory command is issued with an
unsupported memory address and a correct address checksum (i.e. address
0x6000 0000), the command is aborted by the bootloader device, but the NACK
V3.1
(0x1F) is not sent to the host. As a result, the next two bytes (that is, the number of
bytes to be read/written and its checksum) are considered as a new command and
its checksum” (1).
– No changes in specification, the product implementation has been corrected.
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), then the limitation is not perceived from the host
since the command is NACK-ed anyway (as an unsupported new command).

AN3155 Rev 9 35/38

37
Revision history AN3155

5 Revision history

Table 4. Document revision history

Date Revision Changes

09-Mar-2010 1 Initial release.

Table 2: USART bootloader commands: added Extended Erase
command; removed footnote 2 concerning read protection from the
Readout Protect command.
Communication safety: amended Note 1.
Section 3.1: Get command: updated byte 10.
20-Apr-2010 2
Updated Figure 10: Go command: host side for missing ACK state.
Section 3.7: Write Memory command: added Note 1 and Note 2.
Figure 12, and Figure 13: added notes regarding N+1.
Added Section 3.8: Extended Erase Memory command.
Table 3: Bootloader protocol versions: added v3.0.
Added Note:, Note and Note:.
Changed all occurrences of “ROP” by “RDP” including in figures: Figure
12-Feb-2013 3 9., Figure 11., Figure 13., Figure 15., Figure 17., Figure 19., Figure 21.,
Figure 23., Figure 25..
Added Table 1: Applicable products.
Added Version 3.1 in Table 3: Bootloader protocol versions.
Updated “byte 4” value in Section 3.3: Get ID command.
Replaced “address” by “ID” in this Note 1.
Replaced “End of EER” by “End of Go” in Figure 10: Go command: host
side.
Updated first sentence in Section 3.7: Write Memory command.
26-Mar-2013 4 Removed “& address=0x1FFF F800” and replaced the two tests “Flash
memory address?” and “RAM address?” by a single test in Figure 13:
Write Memory command: device side.
Precised missing “Y” values in the third test of Figure 17: Extended Erase
Memory command: device side.
Added this Note: above Figure 24: Readout Unprotect command: host
side.
Replaced “STM32L151xx, STM32L152xx and STM32L162xx” by
22-May-2013 5
“STM32L1 Series” in Table 1: Applicable products.
Updated Table 1: Applicable products.
Removed footnote 4 and added footnote 3.in Table 2: USART bootloader
commands.
20-Jun-2014 6 Removed section 3.1 Device-dependent bootloader parameters.
Updated Figure 10: Go command: host side and Figure 11: Go command:
device side.
Updated Section 3.6: Write Memory command.
Introduced STM32L4 and STM32F7 Series, hence updated Introduction
21-Oct-2016 7
and Table 1: Applicable products.

36/38 AN3155 Rev 9

AN3155 Revision history

Table 4. Document revision history (continued)

Date Revision Changes

Added STM32H7 Series, hence updated Table 1: Applicable products.

Updated Section 1: USART bootloader code sequence.
14-Feb-2019 8 Updated Figure 4: Get Version & Read Protection Status command: host
side.
Minor text edits across the whole document.
21-Feb-2019 9 Added STM32WB Series, hence updated Table 1: Applicable products.

AN3155 Rev 9 37/38

37
 AN3155

IMPORTANT NOTICE – PLEASE READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgement.

Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of Purchasers’ products.

No license, express or implied, to any intellectual property right is granted by ST herein.

Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.

ST and the ST logo are trademarks of ST. All other product or service names are the property of their respective owners.

Information in this document supersedes and replaces information previously supplied in any prior versions of this document.

© 2019 STMicroelectronics – All rights reserved

38/38 AN3155 Rev 9