AN2606

Application note
STM32 microcontroller system memory boot mode

Introduction
The bootloader is stored in the internal boot ROM (system memory) of STM32 devices, and is
programmed by ST during production. Its main task is to download the application program to the
internal flash memory through one of the available serial peripherals (such as USART, CAN,
USB, I2C, SPI). A communication protocol is defined for each serial interface, with a compatible
command set and sequence.
This application note applies to the products listed in Table 1, referred to as STM32 throughout
the document. It describes the supported peripherals and hardware requirements to consider
when using the bootloader.

January 2024 AN2606 Rev 61 1/436

www.st.com 2
 AN2606

Table 1. Applicable products

Type Part number or product series
STM32C0 series: STM32C011xx, STM32C031xx
STM32F0 series: STM32F03xxx, STM32F04xxx, STM32F05xxx, STM32F07xxx, STM32F09xxx
STM32F1 series
STM32F2 series
STM32F3 series: STM32F301xx, STM32F302xx, STM32F303xx, STM32F318xx, STM32F328xx,
STM32F334xx, STM32F358xx, STM32F373xx, STM32F378xx, STM32F398xx
STM32F4 series: STM32F401xx, STM32F405xx, STM32F407xx, STM32F410xx, STM32F411xx,
STM32F412xx, STM32F413xx, STM32F415xx, STM32F417xx, STM32F423xx,
STM32F427xx, STM32F429xx, STM32F437xx, STM32F439xx, STM32F446xx,
STM32F469xx, STM32F479xx
STM32F7 series: STM32F722xx, STM32F723xx, STM32F732xx, STM32F733xx, STM32F745xx,
STM32F746xx, STM32F756xx, STM32F765xx, STM32F767xx, STM32F769xx,
STM32F777xx, STM32F779xx
STM32G0 series: STM32G030xx, STM32G031xx, STM32G041xx, STM32G07xxx, STM32G08xxx,
STM32G0B0xx, STM32G0B1xx, STM32G0C1xx, STM32G050xx, STM32G051xx,
STM32G061xx
STM32G4 series: STM32G431xx, STM32G441xx, STM32G47xxx, STM32G48xxx, STM32G491xx,
STM32G4A1xx
STM32H5 series: STM32H503xx, STM32H563xx, STM32H573xx
STM32H7 series: STM32H72xxx, STM32H73xxx, STM32H74xxx, STM32H75xxx, STM32H7A3xx,
Microcontrollers STM32H7B3xx
STM32L0 series
STM32L1 series: STM32L100xx, STM32L151xx, STM32L152xx, STM32L162xx
STM32L4 series: STM32L431xx, STM32L432xx, STM32L433xx, STM32L442xx, STM32L443xx,
STM32L451xx, STM32L452xx, STM32L462xx, STM32L471xx, STM32L475xx,
STM32L476xx, STM32L486xx, STM32L496xx, STM32L4A6xx, STM32L4R5xx,
STM32L4R7xx, STM32L4R9xx, STM32L4S5xx, STM32L4S7xx, STM32L4S9xx,
STM32L412xx, STM32L422xx, STM32L4P5xx, STM32L4Q5xx, STM32L431xx,
STM32L432xx, STM32L433xx, STM32L442xx, STM32L443xx, STM32L451xx,
STM32L452xx, STM32L462xx, STM32L471xx, STM32L475xx, STM32L476xx,
STM32L486xx, STM32L496xx, STM32L4A6xx, STM32L4R5xx, STM32L4R7xx,
STM32L4R9xx, STM32L4S5xx, STM32L4S7xx, STM32L4S9xx, STM32L412xx,
STM32L422xx, STM32L4P5xx, STM32L4Q5xx
STM32L5 series: STM32L552xx, STM32L562xx
STM32WBA series: STM32WBA52xx
STM32WB series: STM32WB10xx, STM32WB15xx, STM32WB30xx, STM32WB35xx, STM32WB50xx,
STM32WB55xx
STM32WL series: STM32WLE5xx STM32WL55xx
STM32U5 series: STM32U535xx, STM32U545xx, STM32U575xx, STM32U585xx,
STM32U595xx, STM32U599xx, STM32U5A5xx,STM32U5A9xx,
STM32U5F7xx, STM32U5F9xx, STM32U5G7xx, STM32U5G9xx

2/436 AN2606 Rev 61

AN2606 Contents

Contents

1 General information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

2 Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

3 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4 General bootloader description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

4.1 Bootloader activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
4.2 Bootloader identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.3 Hardware connection requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
4.4 Bootloader memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.5 Bootloader UART baudrate detection . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.6 Programming constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
4.7 ExitSecureMemory feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.8 IWDG usage in Bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

5 STM32C011xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

5.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
5.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
5.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

6 STM32C031xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

6.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
6.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

7 STM32F03xx4/6 devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

7.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
7.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
7.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

8 STM32F030xC devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

8.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

AN2606 Rev 61 3/436

15
Contents AN2606

8.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

8.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

9 STM32F05xxx and STM32F030x8 devices bootloader . . . . . . . . . . . . . 57

9.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
9.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
9.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

10 STM32F04xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

10.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
10.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
10.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

11 STM32F070x6 devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

11.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
11.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
11.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

12 STM32F070xB devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

12.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
12.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
12.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

13 STM32F071xx/072xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . 70

13.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
13.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
13.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

14 STM32F09xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

14.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
14.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
14.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

15 STM32F10xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

15.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

4/436 AN2606 Rev 61

AN2606 Contents

15.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

15.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

16 STM32F105xx/107xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . 78

16.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
16.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
16.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
16.3.1 How to identify STM32F105xx/107xx bootloader versions . . . . . . . . . . 81
16.3.2 Bootloader unavailability on STM32F105xx/STM32F107xx devices
with date code lower than 937 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
16.3.3 USART bootloader Get-Version command returns 0x20
instead of 0x22 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
16.3.4 PA9 excessive power consumption when USB cable is plugged
in bootloader V2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

17 STM32F10xxx XL-density devices bootloader . . . . . . . . . . . . . . . . . . . 84

17.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
17.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
17.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

18 STM32F2xxxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

18.1 Bootloader V2.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
18.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
18.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
18.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
18.2 Bootloader V3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
18.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
18.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
18.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

19 STM32F301xx/302x4(6/8) devices bootloader . . . . . . . . . . . . . . . . . . . 93

19.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
19.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
19.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

20 STM32F302xB(C)/303xB(C) devices bootloader . . . . . . . . . . . . . . . . . . 96

20.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

AN2606 Rev 61 5/436

15
Contents AN2606

20.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

20.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

21 STM32F302xD(E)/303xD(E) devices bootloader . . . . . . . . . . . . . . . . . . 99

21.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
21.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
21.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

22 STM32F303x4(6/8)/334xx/328xx devices bootloader . . . . . . . . . . . . . 102

22.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
22.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
22.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

23 STM32F318xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

23.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
23.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
23.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

24 STM32F358xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

24.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
24.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
24.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

25 STM32F373xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

25.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
25.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
25.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110

26 STM32F378xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

26.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
26.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112
26.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112

27 STM32F398xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

27.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113

6/436 AN2606 Rev 61

AN2606 Contents

27.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114

27.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114

28 STM32F40xxx/41xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 115

28.1 Bootloader V3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115
28.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
28.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
28.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
28.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
28.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
28.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
28.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

29 STM32F401xB(C) devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . 124

29.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
29.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
29.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

30 STM32F401xD(E) devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . 130

30.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
30.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
30.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

31 STM32F410xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

31.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
31.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
31.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

32 STM32F411xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

32.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
32.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
32.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

33 STM32F412xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

33.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
33.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

AN2606 Rev 61 7/436

15
Contents AN2606

33.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

34 STM32F413xx/423xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 151

34.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
34.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
34.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

35 STM32F42xxx/43xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 158

35.1 Bootloader V7.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
35.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
35.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
35.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
35.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
35.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
35.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
35.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

36 STM32F446xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

36.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
36.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
36.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

37 STM32F469xx/479xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 177

37.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
37.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
37.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

38 STM32F72xxx/73xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 184

38.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
38.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
38.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

39 STM32F74xxx/75xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 190

39.1 Bootloader V7.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
39.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
39.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

8/436 AN2606 Rev 61

AN2606 Contents

39.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

39.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
39.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
39.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
39.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

40 STM32F76xxx/77xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 200

40.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
40.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
40.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

41 STM32G03xxx/STM32G04xxx devices bootloader . . . . . . . . . . . . . . . 207

41.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
41.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
41.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

42 STM32G07xxx/08xxx device bootloader . . . . . . . . . . . . . . . . . . . . . . . 210

42.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
42.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
42.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

43 STM32G0B0xx device bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

43.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
43.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
43.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

44 STM32G0B1xx/0C1xx device bootloader . . . . . . . . . . . . . . . . . . . . . . 220

44.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
44.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
44.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

45 STM32G05xxx/061xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 225

45.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
45.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
45.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

AN2606 Rev 61 9/436

15
Contents AN2606

46 STM32G431xx/441xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 228

46.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
46.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
46.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

47 STM32G47xxx/48xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 233

47.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
47.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
47.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237

48 STM32G491xx/4A1xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 239

48.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
48.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
48.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

49 STM32H503xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 244

49.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
49.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
49.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

50 STM32H563xx/573xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 249

50.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
50.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
50.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

51 STM32H72xxx/73xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 255

51.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
51.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
51.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

52 STM32H74xxx/75xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 262

52.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
52.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
52.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

10/436 AN2606 Rev 61

AN2606 Contents

53 STM32H7A3xx/B3xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 269

53.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
53.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
53.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

54 STM32L01xxx/02xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 276

54.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
54.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
54.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

55 STM32L031xx/041xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 280

55.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280
55.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
55.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

56 STM32L05xxx/06xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 283

56.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
56.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
56.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

57 STM32L07xxx/08xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 286

57.1 Bootloader V4.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
57.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
57.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
57.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
57.2 Bootloader V11.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
57.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
57.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
57.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

58 STM32L1xxx6(8/B)A devices bootloader . . . . . . . . . . . . . . . . . . . . . . 294

58.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294
58.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
58.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295

59 STM32L1xxx6(8/B) devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . 296

AN2606 Rev 61 11/436

15
Contents AN2606

59.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

59.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
59.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297

60 STM32L1xxxC devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

60.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
60.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
60.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301

61 STM32L1xxxD devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 302

61.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
61.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
61.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

62 STM32L1xxxE devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

62.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
62.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
62.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

63 STM32L412xx/422xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 310

63.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
63.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
63.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

64 STM32L43xxx/44xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 316

64.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
64.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
64.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

65 STM32L45xxx/46xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 324

65.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
65.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
65.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330

66 STM32L47xxx/48xxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 331

12/436 AN2606 Rev 61

AN2606 Contents

66.1 Bootloader V10.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

66.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
66.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
66.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
66.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
66.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
66.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
66.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

67 STM32L496xx/4A6xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 343

67.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
67.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347
67.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

68 STM32L4P5xx/4Q5xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 350

68.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
68.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354
68.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356

69 STM32L4Rxxx/4Sxxx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 357

69.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
69.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
69.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

70 STM32L552xx/STM32L562xx devices bootloader . . . . . . . . . . . . . . . 364

70.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
70.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
70.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370

71 STM32WBA52xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . . . 371

71.1 Bootloader Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
71.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
71.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373

72 STM32WB10xx/15xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 374

72.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

AN2606 Rev 61 13/436

15
Contents AN2606

72.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376

72.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377

73 STM32WB30xx/35xx/50xx/55xx devices bootloader . . . . . . . . . . . . . 378

73.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
73.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
73.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382

74 STM32WLE5xx/55xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 383

74.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
74.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
74.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385

75 STM32U535xx/545xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . 386

75.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
75.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
75.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391

76 STM32U575xx/85xx devices bootloader . . . . . . . . . . . . . . . . . . . . . . . 392

76.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392
76.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
76.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

77 STM32U595xx/599xx/5A5xx/5A9xx devices bootloader . . . . . . . . . . 397

77.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 397
77.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
77.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

78 STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader . . . . . . . . . . 402

78.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
78.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
78.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406

79 Device-dependent bootloader parameters . . . . . . . . . . . . . . . . . . . . . 407

80 Bootloader timings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

14/436 AN2606 Rev 61

AN2606 Contents

80.1 Bootloader startup timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

80.2 USART connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
80.3 USB connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
80.4 I2C connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
80.5 SPI connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425

Appendix A Example of function to use the “ExitSecureMemory” function . 426

81 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

AN2606 Rev 61 15/436

15
List of tables AN2606

List of tables

Table 1. Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Table 2. Bootloader activation patterns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Table 3. Embedded bootloaders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Table 4. STM32 F2, F4, and F7 voltage range configuration using bootloader . . . . . . . . . . . . . . . . 43
Table 5. Supported memory area by Write, Read, Erase, and Go commands. . . . . . . . . . . . . . . . . 43
Table 6. Jitter software calculation on bootloader USART detection . . . . . . . . . . . . . . . . . . . . . . . . 44
Table 7. Flash memory alignment constraints on STM32 products . . . . . . . . . . . . . . . . . . . . . . . . . 44
Table 8. ExitSecureMemory entry address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Table 9. STM32C011xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 49
Table 10. STM32C011xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 11. STM32C031xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 51
Table 12. STM32C031xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Table 13. STM32F03xx4/6 configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 53
Table 14. STM32F03xx4/6 bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 15. STM32F030xC configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 55
Table 16. STM32F030xC bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Table 17. STM32F05xxx and STM32F030x8 devices configuration in system memory boot mode . 57
Table 18. STM32F05xxx and STM32F030x8 devices bootloader versions . . . . . . . . . . . . . . . . . . . . 58
Table 19. STM32F04xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 20. STM32F04xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 21. STM32F070x6 configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . . 62
Table 22. STM32F070x6 bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Table 23. STM32F070xB configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 66
Table 24. STM32F070xB bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Table 25. STM32F071xx/072xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 70
Table 26. STM32F071xx/072xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Table 27. STM32F09xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 73
Table 28. STM32F09xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Table 29. STM32F10xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 75
Table 30. STM32F10xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Table 31. STM32F105xx/107xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 78
Table 32. STM32F105xx/107xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Table 33. STM32F10xxx XL-density configuration in system memory boot mode . . . . . . . . . . . . . . . 84
Table 34. STM32F10xxx XL-density bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Table 35. STM32F2xxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 86
Table 36. STM32F2xxxx bootloader V2.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Table 37. STM32F2xxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 89
Table 38. STM32F2xxxx bootloader V3.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Table 39. STM32F301xx/302x4(6/8) configuration in system memory boot mode. . . . . . . . . . . . . . . 93
Table 40. STM32F301xx/302x4(6/8) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Table 41. STM32F302xB(C)/303xB(C) configuration in system memory boot mode . . . . . . . . . . . . . 96
Table 42. STM32F302xB(C)/303xB(C) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Table 43. STM32F302xD(E)/303xD(E) configuration in system memory boot mode . . . . . . . . . . . . . 99
Table 44. STM32F302xD(E)/303xD(E) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Table 45. STM32F303x4(6/8)/334xx/328xx configuration in system memory boot mode . . . . . . . . 102
Table 46. STM32F303x4(6/8)/334xx/328xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Table 47. STM32F318xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 104
Table 48. STM32F318xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

16/436 AN2606 Rev 61

AN2606 List of tables

Table 49. STM32F358xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 106

Table 50. STM32F358xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Table 51. STM32F373xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 108
Table 52. STM32F373xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Table 53. STM32F378xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 111
Table 54. STM32F378xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Table 55. STM32F398xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 113
Table 56. STM32F398xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Table 57. STM32F40xxx/41xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 115
Table 58. STM32F40xxx/41xxx bootloader V3.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Table 59. STM32F40xxx/41xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 119
Table 60. STM32F40xxx/41xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Table 61. STM32F401xB(C) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . 124
Table 62. STM32F401xB(C) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Table 63. STM32F401xD(E) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . 130
Table 64. STM32F401xD(E) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Table 65. STM32F410xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 135
Table 66. STM32F410xx bootloader V11.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Table 67. STM32F411xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 140
Table 68. STM32F411xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
Table 69. STM32F412xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 145
Table 70. STM32F412xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Table 71. STM32F413xx/423xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 151
Table 72. STM32F413xx/423xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Table 73. STM32F42xxx/43xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 158
Table 74. STM32F42xxx/43xxx bootloader V7.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Table 75. STM32F42xxx/43xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 164
Table 76. STM32F42xxx/43xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
Table 77. STM32F446xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 171
Table 78. STM32F446xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
Table 79. STM32F469xx/479xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 177
Table 80. STM32F469xx/479xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Table 81. STM32F72xxx/73xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 184
Table 82. STM32F72xxx/73xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
Table 83. STM32F74xxx/75xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 190
Table 84. STM32F74xxx/75xxx bootloader V7.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
Table 85. STM32F74xxx/75xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 194
Table 86. STM32F74xxx/75xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Table 87. STM32F76xxx/77xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 200
Table 88. STM32F76xxx/77xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Table 89. STM32G03xxx/G04xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . 207
Table 90. STM32G03xx/04xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Table 91. STM32G07xxx/8xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 210
Table 92. STM32G07xx/08xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Table 93. STM32G0B0xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 215
Table 94. STM32G0B0xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Table 95. STM32G0B1xx/0C1xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . 220
Table 96. STM32G0B1xx/0C1xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
Table 97. STM32G05xxx/061xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 225
Table 98. STM32G05xxx/061xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Table 99. STM32G431xx/441xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 228
Table 100. STM32G431xx/441xx bootloader version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

AN2606 Rev 61 17/436

19
List of tables AN2606

Table 101. STM32G47xxx/48xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 233

Table 102. STM32G47xxx/48xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
Table 103. STM32G491xx/4A1xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 239
Table 104. STM32G491xx/4A1xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Table 105. STM32H503xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 244
Table 106. STM32H503xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
Table 107. STM32H503xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Table 108. STM32H563xx/573xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 249
Table 109. STM32H563xx/573xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
Table 110. STM32H563xx/573xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Table 111. STM32H72xxx/73xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 255
Table 112. STM32H72xxx/73xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
Table 113. STM32H74xxx/75xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 262
Table 114. STM32H74xxx/75xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 269
Table 116. STM32H7A3xx/7B3xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
Table 117. STM32L01xxx/02xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 276
Table 118. STM32L01xxx/02xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
Table 119. STM32L031xx/041xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 280
Table 120. STM32L031xx/041xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Table 121. STM32L05xxx/06xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 283
Table 122. STM32L05xxx/06xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Table 123. STM32L07xxx/08xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 286
Table 124. STM32L07xxx/08xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Table 125. STM32L07xxx/08xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 290
Table 126. STM32L07xxx/08xxx bootloader V11.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Table 127. STM32L1xxx6(8/B)A configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 294
Table 128. STM32L1xxx6(8/B)A bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Table 129. STM32L1xxx6(8/B) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . 296
Table 130. STM32L1xxx6(8/B) bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Table 131. STM32L1xxxC configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 298
Table 132. STM32L1xxxC bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Table 133. STM32L1xxxD configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 302
Table 134. STM32L1xxxD bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Table 135. STM32L1xxxE configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 306
Table 136. STM32L1xxxE bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
Table 137. STM32L412xx/422xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 310
Table 138. STM32L412xx/422xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
Table 139. STM32L43xxx/44xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 316
Table 140. STM32L43xxx/44xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
Table 141. STM32L45xxx/46xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 324
Table 142. STM32L45xxx/46xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
Table 143. STM32L47xxx/48xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 331
Table 144. STM32L47xxx/48xxx bootloader V10.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336
Table 145. STM32L47xxx/48xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 337
Table 146. STM32L47xxx/48xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Table 147. STM32L496xx/4A6xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 343
Table 148. STM32L496xx/4A6xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Table 149. STM32L4P5xx/4Q5xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 350
Table 150. STM32L4P5xx/4Q5xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356
Table 151. STM32L4Rxxx/4Sxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 357
Table 152. STM32L4Rxx/4Sxx bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

18/436 AN2606 Rev 61

AN2606 List of tables

Table 153. STM32L552xx/562xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 364

Table 154. STM32L552cc/562xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Table 155. STM32L552xx/562xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Table 156. STM32WBA52xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . 371
Table 157. STM32WBA52xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372
Table 158. STM32WBA52xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Table 159. STM32WB10xx/15xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 374
Table 160. STM32WB10xx/15xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
Table 161. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode . . . . . . . . . 378
Table 162. STM32WB30xx/35xx/50xx/55xx bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Table 163. STM32WLE5xx/55xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 383
Table 164. STM32WLE5xx/55xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Table 165. STM32U535xx/545xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 386
Table 166. STM32U535xx/545xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 389
Table 167. STM32U535xx/545xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Table 168. STM32U575xx/85xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 392
Table 169. STM32U575xx/585xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
Table 170. STM32U575xx/85xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396
Table 171. STM32U595xx/599xx/5A5xx/5A9xx configuration in system memory boot mode . . . . . . 397
Table 172. STM32U595xx/599xx/5A5xx/5A9xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . 399
Table 173. STM32U595xx/599xx/5A5xx/5A9xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . 401
Table 174. STM32U5F7xx/5F9xx/5G7xx/5G9xx configuration in system memory boot mode. . . . . . 402
Table 175. STM32U5F7xx/5F9xx/5G7xx/5G9xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . 404
Table 176. STM32U5F7xx/5F9xx/5G7xx/5G9xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . 406
Table 177. Bootloader device-dependent parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
Table 178. Bootloader startup timings (ms) for STM32 devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
Table 179. USART bootloader minimum timings (ms) for STM32 devices. . . . . . . . . . . . . . . . . . . . . 417
Table 180. USB bootloader minimum timings (ms) for STM32 devices . . . . . . . . . . . . . . . . . . . . . . . 420
Table 181. I2C bootloader minimum timings (ms) for STM32 devices . . . . . . . . . . . . . . . . . . . . . . . . 422
Table 182. SPI bootloader minimum timings (ms) for STM32 devices . . . . . . . . . . . . . . . . . . . . . . . . 425
Table 183. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

AN2606 Rev 61 19/436

19
List of figures AN2606

List of figures

Figure 1. USART connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Figure 2. USB connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Figure 3. I2C connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Figure 4. SPI connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Figure 5. CAN connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Figure 6. ExitSecureMemory function usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 7. Access to securable memory area from the bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Figure 8. Bootloader V5.x selection for STM32C011xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Figure 9. Bootloader V5.x selection for STM32C031xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Figure 10. Bootloader selection for STM32F03xx4/6 devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Figure 11. Bootloader selection for STM32F030xC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Figure 12. Bootloader selection for STM32F05xxx and STM32F030x8 devices . . . . . . . . . . . . . . . . . 58
Figure 13. Bootloader selection for STM32F04xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Figure 14. Bootloader selection for STM32F070x6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Figure 15. Bootloader selection for STM32F070xB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 16. Bootloader selection for STM32F071xx/072xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Figure 17. Bootloader selection for STM32F09xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Figure 18. Bootloader selection for STM32F10xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Figure 19. Bootloader selection for STM32F105xx/107xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Figure 20. Bootloader selection for STM32F10xxx XL-density devices. . . . . . . . . . . . . . . . . . . . . . . . 85
Figure 21. Bootloader V2.x selection for STM32F2xxxx devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Figure 22. Bootloader V3.x selection for STM32F2xxxx devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Figure 23. Bootloader selection for STM32F301xx/302x4(6/8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Figure 24. Bootloader selection for STM32F302xB(C)/303xB(C) devices. . . . . . . . . . . . . . . . . . . . . . 98
Figure 25. Bootloader selection for STM32F302xD(E)/303xD(E) . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Figure 26. Bootloader selection for STM32F303x4(6/8)/334xx/328xx . . . . . . . . . . . . . . . . . . . . . . . . 103
Figure 27. Bootloader selection for STM32F318xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Figure 28. Bootloader selection for STM32F358xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Figure 29. Bootloader selection for STM32F373xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Figure 30. Bootloader selection for STM32F378xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Figure 31. Bootloader selection for STM32F398xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Figure 32. Bootloader V3.x selection for STM32F40xxx/41xxx devices . . . . . . . . . . . . . . . . . . . . . . 117
Figure 33. Bootloader V9.x selection for STM32F40xxx/41xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Figure 34. Bootloader selection for STM32F401xB(C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Figure 35. Bootloader selection for STM32F401xD(E) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
Figure 36. Bootloader V11.x selection for STM32F410xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Figure 37. Bootloader selection for STM32F411xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Figure 38. Bootloader V9.x selection for STM32F412xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Figure 39. Bootloader V9.x selection for STM32F413xx/423xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Figure 40. Dual bank boot implementation for STM32F42xxx/43xxx Bootloader V7.x . . . . . . . . . . . 161
Figure 41. Bootloader V7.x selection for STM32F42xxx/43xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
Figure 42. Dual bank boot implementation for STM32F42xxx/43xxx bootloader V9.x . . . . . . . . . . . 168
Figure 43. Bootloader V9.x selection for STM32F42xxx/43xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Figure 44. Bootloader V9.x selection for STM32F446xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Figure 45. Dual bank boot implementation for STM32F469xx/479xx Bootloader V9.x . . . . . . . . . . . 181
Figure 46. Bootloader V9.x selection for STM32F469xx/479xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Figure 47. Bootloader V9.x selection for STM32F72xxx/73xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188
Figure 48. Bootloader V7.x selection for STM32F74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

20/436 AN2606 Rev 61

AN2606 List of figures

Figure 49. Bootloader V9.x selection for STM32F74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

Figure 50. Dual bank boot implementation for STM32F76xxx/77xxx Bootloader V9.x . . . . . . . . . . . 204
Figure 51. Bootloader V9.x selection for STM32F76xxx/77xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Figure 52. Bootloader V5.x selection for STM32G03xxx/G04xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
Figure 53. Bootloader V11.0 selection for STM32G07xxx/G08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Figure 54. Bootloader selection for STM32G0B0xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
Figure 55. Bootloader selection for STM32G0B1xx/0C1xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223
Figure 56. Bootloader selection for STM32G05xxx/061xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Figure 57. Bootloader selection for STM32G431xx/441xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
Figure 58. Bootloader selection for STM32G47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Figure 59. Dual bank boot implementation for STM32G47xxx/48xxx bootloader V13.x . . . . . . . . . . 237
Figure 60. Bootloader selection for STM32G491xx/4A1xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
Figure 61. Bootloader V14 selection for STM32H503xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Figure 62. Bootloader V14 selection for STM32H563xx/573xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Figure 63. Bootloader V9.0 selection for STM32H72xxx/73xxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260
Figure 64. Bootloader V9.x selection for STM32H74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267
Figure 65. Bootloader V9.x selection for STM32H7A3xx/7B3xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
Figure 66. Bootloader selection for STM32L01xxx/02xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Figure 67. Bootloader selection for STM32L031xx/041xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Figure 68. Bootloader selection for STM32L05xxx/06xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
Figure 69. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V4.x. . . . . . . . . . . . 288
Figure 70. Bootloader V4.x selection for STM32L07xxx/08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Figure 71. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V11.x. . . . . . . . . . . 292
Figure 72. Bootloader V11.x selection for STM32L07xxx/08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
Figure 73. Bootloader selection for STM32L1xxx6(8/B)A devices. . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Figure 74. Bootloader selection for STM32L1xxx6(8/B) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
Figure 75. Bootloader selection for STM32L1xxxC devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
Figure 76. Bootloader selection for STM32L1xxxD devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Figure 77. Bootloader selection for STM32L1xxxE devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308
Figure 78. Dual bank boot Implementation for STM32L412xx/422xx bootloader V9.x . . . . . . . . . . . 313
Figure 79. Bootloader V13.x selection for STM32L412xx/422xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Figure 80. Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x . . . . . . . . . . . 320
Figure 81. Bootloader V9.x selection for STM32L43xxx/44xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Figure 82. Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x. . . . . . . . . . . . 328
Figure 83. Bootloader V9.x selection for STM32L45xxx/46xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
Figure 84. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V10.x. . . . . . . . . . . 334
Figure 85. Bootloader V10.x selection for STM32L47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335
Figure 86. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V9.x. . . . . . . . . . . . 340
Figure 87. Bootloader V9.x selection for STM32L47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Figure 88. Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x . . . . . . . . . . . 347
Figure 89. Bootloader V9.x selection for STM32L496xx/4A6xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Figure 90. Dual bank boot implementation for STM32L4P5xx/4Q5xx bootloader V9.x . . . . . . . . . . . 354
Figure 91. Bootloader V9.x selection for STM32L4P5xx/4Q5xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
Figure 92. Dual bank boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x . . . . 361
Figure 93. Bootloader V9.x selection for STM32L4Rxx/4Sxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
Figure 94. Bootloader V9.x selection for STM32L552xx/562xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 369
Figure 95. Bootloader V11.x selection for STM32WBA52xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Figure 96. Bootloader V11.x selection for STM32WB10xx/15xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
Figure 97. Bootloader V13.0 selection for STM32WB30xx/35xx/50xx/55xx . . . . . . . . . . . . . . . . . . . 381
Figure 98. Bootloader V12.x selection for STM32WLE5xx/55xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Figure 99. Bootloader V9.x selection for STM32U535xx/545xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Figure 100. Bootloader V9.x selection for STM32U575xx/85xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

AN2606 Rev 61 21/436

22
List of figures AN2606

Figure 101. Bootloader V9.x selection for STM32U595xx/599xx/5A5xx/5A9xx. . . . . . . . . . . . . . . . . . 401

Figure 102. Bootloader V9.x selection for STM32U5F7xx/5F9xx/5G7xx/5G9xx . . . . . . . . . . . . . . . . . 406
Figure 103. Bootloader startup timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413
Figure 104. USART connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416
Figure 105. USB connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
Figure 106. I2C connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
Figure 107. SPI connection timing description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425

22/436 AN2606 Rev 61

AN2606 General information

1 General information

This document applies to Arm®(a)-based devices.

2 Related documents

For each supported product (listed in Table 1) refer to the following documents available on
www.st.com:
• Datasheet or databrief
• Reference manual
• Application notes
– AN3154: CAN protocol used in the STM32 bootloader
– AN3155: USART protocol used in the STM32 bootloader
– AN3156: USB DFU protocol used in the STM32 bootloader
– AN4221: I2C protocol used in the STM32 bootloader
– AN4286: SPI protocol used in the STM32 bootloader
– AN5405: FDCAN protocol used in the STM32 bootloader
– AN5927: I3C protocol used in the STM32 bootloader

a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

AN2606 Rev 61 23/436

435
Glossary AN2606

3 Glossary

C0 series:
STM32C011xx indicates STM32C011xx devices.
STM32C031xx indicates STM32C031xx devices.
F0 series:
STM32F03xxx indicates STM32F030x4, STM32F030x6, STM32F038x6,
STM32F030xC, STM32F031x4, and STM32F031x6 devices.
STM32F04xxx indicates STM32F042x4 and STM32F042x6 devices.
STM32F05xxx and STM32F030x8 devices indicates STM32F051x4, STM32F051x6,
STM32F051x8, STM32F058x8, and STM32F030x8 devices.
STM32F07xxx indicates STM32F070x6, STM32F070xB, STM32F071xB,
STM32F072x8, and STM32F072xB devices.
STM32F09xxx indicates STM32F091xx and STM32F098xx devices.
F1 series:
STM32F10xxx indicates Low-density, Medium-density, High-density, Low-density
value line, Medium-density value line, and High-density value line devices:
Low-density devices are STM32F101xx, STM32F102xx, and STM32F103xx
microcontrollers, where the flash memory density ranges between 16 and
32 Kbytes.
Medium-density devices are STM32F101xx, STM32F102xx, and STM32F103xx
microcontrollers, where the flash memory density ranges between 64 and
128 Kbytes.
High-density devices are STM32F101xx and STM32F103xx microcontrollers,
where the flash memory density ranges between 256 and 512 Kbytes.
Low-density value line devices are STM32F100xx microcontrollers, where the
flash memory density ranges between 16 and 32 Kbytes.
Medium-density value line devices are STM32F100xx microcontrollers, where
the flash memory density ranges between 64 and 128 Kbytes.
High-density value line devices are STM32F100xx microcontrollers, where the
flash memory density ranges between 256 and 512 Kbytes.
STM32F105xx/107xx indicates STM32F105xx and STM32F107xx devices.
STM32F10xxx XL-density indicates STM32F101xx and STM32F103xx devices,
where the flash memory density ranges between 768 Kbytes and 1 Mbyte.
F2 series:
STM32F2xxxx indicates STM32F215xx, STM32F205xx, STM32F207xx, and
SMT32F217xx devices.

24/436 AN2606 Rev 61

AN2606 Glossary

F3 series:
STM32F301xx/302x4(6/8) indicates STM32F301x4, STM32F301x6, STM32F301x8,
STM32F302x4, STM32F302x6, and STM32F302x8 devices.
STM32F302xB(C)/303xB(C) indicates STM32F302xB, STM32F302xC,
STM32F303xB and STM32F303xC devices.
STM32F302xD(E)/303xD(E) indicates STM32F302xD, STM32F302xE,
STM32F303xD, and STM32F303xE devices.
STM32F303x4(6/8)/334xx/328xx indicates STM32F303x4, STM32F303x6,
STM32F303x8, STM32F334x4, STM32F334x6, STM32F334x8, and STM32F328x8
devices.
STM32F318xx indicates STM32F318x8 devices.
STM32F358xx indicates STM32F358xC devices.
STM32F373xx indicates STM32F373x8, STM32F373xB and STM32F373xC devices.
STM32F378xx indicates STM32F378xC devices.
STM32F398xx indicates STM32F398xE devices.
F4 series:
STM32F40xxx/41xxx indicates STM32F405xx, STM32F407xx, STM32F415xx, and
SMT32F417xx devices.
STM32F401xB(C) indicates STM32F401xB and STM32F401xC devices.
STM32F401xD(E) indicates STM32F401xD and STM32F401xE devices.
STM32F410xx indicates STM32F410x8 and STM32F410xB devices.
STM32F411xx indicates STM32F411xD and STM32F411xE devices.
STM32F412xx indicates STM32F412Cx, STM32F412Rx, STM32F412Vx and
STM32F412Zx devices.
STM32F413xx/423xx indicates STM32F413xG, STM32F413xH and STM32F423xH
devices.
STM32F42xxx/43xxx indicates STM32F427xx, STM32F429xx, STM32F437xx, and
STM32F439xx devices.
STM32F446xx indicates STM32F446xE and STM32F446xC devices.
STM32F469xx/479xx indicates STM32F469xE, STM32F469xG, STM32F469xI,
STM32F479xG, and STM32F479xI devices.
F7 series:
STM32F72xxx/73xxx indicates STM32F722xx, STM32F723xx, STM32F732xx, and
STM32F733xx devices.
STM32F74xxx/75xxx indicates STM32F745xx, STM32F746xx, and STM32F756xx
devices.
STM32F76xxx/77xxx indicates STM32F765xx, STM32F767xx, STM32F769xx,
STM32F777xx, and STM32F779xx devices.
G0 series:
STM32G03xxx/04xxx indicates STM32G03xxx and STM32G04xxx devices.
STM32G07xxx/08xxx indicates STM32G07xxx and STM32G08xxx devices.
STM32G0B1xx/C1xx indicates STM32GB1xx and STM32G0C1xxx devices.
STM32G0B0xx indicates STM32G0B0xx devices.

AN2606 Rev 61 25/436

435
Glossary AN2606

STM32G05xxx/61xx indicates STM32G050xx, STM32G051xx, STM32G061xx

devices.
G4 series:
STM32G431xx indicates STM32G431xx devices.
STM32G441xx indicates STM32G441xx devices.
STM32G47xxx indicates STM32G471xx, STM32G473xx, and STM32G474xx devices.
STM32G48xxx indicates STM32G483xx and STM32G484xx devices.
STM32G491xx indicates STM32G491xx devices.
STM32G4A1xx indicates STM32G4A1xx devices.
H5 series:
STM32H503xx indicates STM32H503xx devices.
STM32H563xx/73xx indicates STM32H563xx and STM32H573xx devices.
H7 series:
STM32H72xxx/73xxx indicates STM32H72xxx and STM32H73xxx devices.
STM32H74xxx/75xxx indicates STM32H74xxx and STM32H75xxx devices.
STM32H7A3xx/7B3xx indicates STM32H7A3xx/STM32H7B3xx devices.
L0 series:
STM32L01xxx/02xxx indicates STM32L011xx and STM32L021xx devices.
STM32L031xx/041xx indicates STM32L031xx and STM32L041xx devices.
STM32L05xxx/06xxx indicates STM32L051xx, STM32L052xx, STM32L053xx,
STM32L062xx, and STM32L063xx ultra-low power devices.
STM32L07xxx/08xxx indicates STM32L071xx, STM32L072xx, STM32L073xx,
STM32L081xx, STM32L082xx, and STM32L083xx devices.
L1 series:
STM32L1xxx6(8/B) indicates STM32L1xxV6T6, STM32L1xxV6H6, STM32L1xxR6T6,
STM32L1xxR6H6, STM32L1xxC6T6, STM32L1xxC6H6, STM32L1xxV8T6,
STM32L1xxV8H6, STM32L1xxR8T6, STM32L1xxR8H6, STM32L1xxC8T6,
STM32L1xxC8H6, STM32L1xxVBT6, STM32L1xxVBH6, STM32L1xxRBT6,
STM32L1xxRBH6, STM32L1xxCBT6, and STM32L1xxCBH6 ultra-low power devices.
STM32L1xxx6(8/B)A indicates STM32L1xxV6T6-A, STM32L1xxV6H6-A,
STM32L1xxR6T6-A, STM32L1xxR6H6-A, STM32L1xxC6T6-A, STM32L1xxC6H6-A,
STM32L1xxV8T6-A, STM32L1xxV8H6-A, STM32L1xxR8T6-A, STM32L1xxR8H6-A,
STM32L1xxC8T6-A, STM32L1xxC8H6-A, STM32L1xxVBT6-A, STM32L1xxVBH6-A,
STM32L1xxRBT6-A, STM32L1xxRBH6-A, STM32L1xxCBT6-A, and
STM32L1xxCBH6-A ultra-low power devices.
STM32L1xxxC indicates STM32L1xxVCT6, STM32L1xxVCH6, STM32L1xxRCT6,
STM32L1xxUCY6, STM32L1xxCCT6, and STM32L1xxCCU6 ultra-low power devices.

26/436 AN2606 Rev 61

AN2606 Glossary

STM32L1xxxD indicates STM32L1xxZDT6, STM32L1xxQDH6, STM32L1xxVDT6,

STM32L1xxRDY6, STM32L1xxRDT6, STM32L1xxZCT6, STM32L1xxQCH6,
STM32L1xxRCY6, STM32L1xxVCT6-A, and STM32L1xxRCT6-A ultra-low power
devices.
STM32L1xxxE indicates STM32L1xxZET6, STM32L1xxQEH6, STM32L1xxVET6,
STM32L1xxVEY6, and STM32L1xxRET6 ultra-low power devices.
L4 series:
STM32L412xx/422xx indicates STM32L412xB, STM32L412x8, and STM32L422xB
devices.
STM32L43xxx/44xxx indicates STM32L431xx, STM32L432xx, STM32L433xx and
STM32L442xx, and STM32L443xx devices.
STM32L45xxx/46xxx indicates STM32L451xx, STM32L452xx, and STM32L462xx
devices.
STM32L47xxx/48xxx indicates STM32L471xx, STM32L475xx, STM32L476xx, and
STM32L486xx devices.
STM32L496xx/4A6xx indicates STM32L496xE, STM32L496xG, and STM32L4A6xG
devices.
STM32L4Rxxx/4Sxxx indicates STM32L4R5xx, STM32L4R7xx, STM32L4R9xx,
STM32L4S5xx, STM32L4S7xx, and STM32L4S9xx devices.
STM32L4P5xx/4Q5xx indicates STM32L4P5xx/STM32L4Q5xx devices.
L5 series:
STM32L552xx indicates STM32L552xx devices.
STM32L562xx indicates STM32L562xx devices.
WBA series:
STM32WBA52xx indicates STM32WBA52xx devices.
WB series:
STM32WB10xx indicates STM32WB10xx devices.
STM32WB15xx indicates STM32WB15xx devices.
STM32WB30xx indicates STM32WB30xx devices.
STM32WB35xx indicates STM32WB35xx devices.
STM32WB50xx indicates STM32WB50xx devices.
STM32WB55xx indicates STM32WB55Cx, STM32WB55Rx, and STM32WB55Vx
devices.
WL series:
STM32WLE5xx indicates STM32WLE5xx devices.
STM32WL55xx indicates STM32WL55xx devices.
U5 series:
STM32U535xx indicates STM32U535xx devices.
STM32U545xx indicates STM32U545xx devices.
STM32U575xx indicates STM32U575xx devices.
STM32U585xx indicates STM32U585xx devices.
STM32U595xx indicates STM32U595xx devices.
STM32U599xx indicates STM32U599xx devices.

AN2606 Rev 61 27/436

435
Glossary AN2606

STM32U5A5xx indicates STM32U5A5xx devices.

STM32U5A9xx indicates STM32U5A9xx devices.
STM32U5F7xx indicates STM32U5F7xx devices.
STM32U5F9xx indicates STM32U5F9xx devices.
STM32U5G7xx indicates STM32U5G7xx devices.
STM32U5G9xx indicates STM32U5G9xx devices.

Note: BL_USART_Loop refers to the USART bootloader execution loop.

BL_CAN_Loop refers to the CAN bootloader execution loop.
BL_I2C_Loop refers to the I2C bootloader execution loop.
BL_SPI_Loop refers to the SPI bootloader execution loop.

28/436 AN2606 Rev 61

AN2606 General bootloader description

4 General bootloader description

4.1 Bootloader activation

The bootloader is activated by applying one of the patterns described in Table 2.
If boot from Bank2 option is activated (for products supporting this feature), the bootloader
executes Dual Boot mechanism as described in figures “Dual bank boot implementation for
STM32xxxx” (example: Figure 40), otherwise bootloader selection protocol is executed as
described in figures “Bootloader VY.x selection for STM32xxxx” (example: Figure 21), where
STM32xxxx is the relative STM32 product.
When readout protection Level2 is activated, the MCU does not boot on system memory,
and bootloader cannot be executed (unless jumping to it from flash user code, all
commands are not accessible except Get, GetID, and GetVersion).

Table 2. Bootloader activation patterns

Pattern Condition

Pattern 1 Boot0(pin) = 1 and Boot1(pin) = 0

Pattern 2 Boot0(pin) = 1 and nBoot1(bit) = 1
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 1
Pattern 3 Boot0(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 1
Pattern 4 Boot0(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 0
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 0
Pattern 5 Boot0(pin) = 0, BFB2(bit) = 1 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2 (bit) = 1
Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1
nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Pattern 6
Boot0(pin) = 0, nBoot0_SW(bit) = 1 and main flash memory empty
nBoot0(bit) = 1, nBoot0_SW(bit)=0 and main flash memory empty
Boot0(pin) = 1, nBoot1(bit) = 1 and BFB2(bit) = 0
Pattern 7 Boot0(pin) = 0, BFB2(bit) = 1 and both banks do not contain valid code
Boot0(pin) = 1, nBoot1(bit) = 1 and BFB2(bit) = 1
Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x0040
Pattern 8
Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x0040

AN2606 Rev 61 29/436

435
General bootloader description AN2606

Table 2. Bootloader activation patterns (continued)

Pattern Condition

nDBANK(bit) = 1, Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x0040

nDBANK(bit) = 1, Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x0040
nDBANK(bit) = 0, nDBOOT(bit) = 1, Boot(pin) = 0 and BOOT_ADD0(optionbyte) =
0x0040

Pattern 9 nDBANK(bit) = 0, nDBOOT(bit) = 1, Boot(pin) = 1 and BOOT_ADD1(optionbyte) =

0x0040
nDBANK(bit) = 0, nDBOOT(bit) = 0, BOOT_ADDx(optionbyte) out of memory range or in
ICP memory range
nDBANK(bit) = 0, nDBOOT(bit) = 0, BOOT_ADDx(optionbyte) in flash memory range
and both banks do not contain valid code
Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x1FF0
Pattern 10
Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x1FF0
nBoot0(bit) = 0, nBoot1(bit) = 1, nBOOT0_SEL(bit) = 1 and BOOT_LOCK(bit) = 0
Boot0(pin) = 1, nBoot1(bit) = 1, BOOT_LOCK(bit) = 0 and nBOOT0_SEL (bit) = 0

Pattern 11 nBoot0(bit) = 1, nBOOT0_SEL(bit) = 1, BOOT_LOCK(bit) = 0 and main flash memory

empty
Boot0(pin) = 0, nBOOT0_SEL(bit) = 0, BOOT_LOCK(bit) = 0 and main flash memory
empty
TZen = 0, Boot0(pin) = 0, nSWBoot0(bit) = 1 and NSBOOTADD0 [24:0] = 0x017F200
TZen = 0, Boot0(pin) = 1, nSWBoot0(bit) = 1 and NSBOOTADD1 [24:0] = 0x017F200
TZen = 0, nBoot0(bit) = 0, nSWBoot0(bit) = 0 and NSBOOTADD1 [24:0] = 0x017F200
TZen = 0, nBoot0(bit) = 1, nSWBoot0(bit) = 0 and NSBOOTADD0 [24:0] = 0x017F200
TZen = 1, Boot0(pin) = 0, nSWBoot0(bit) = 1 and SECBOOTADD0 [24:0] = 0x01FF000 &
RSSCMD = 0
TZen = 1, Boot0(pin) = 1, nSWBoot0(bit) = 1 & RSSCMD = 0, BOOT_LOCK=0 or
Pattern 12
(BOOT_LOCK = 1 and SECBOOTADD0 [24:0] = 0x01FF000)
TZen = 1, nBoot0(bit) = 1, nSWBoot0(bit) = 0 and SECBOOTADD0 [24:0] = 0x01FF000
& RSSCMD = 0, BOOT_LOCK=0 or (BOOT_LOCK = 1 and SECBOOTADD0 [24:0] =
0x01FF000)
TZen = 1, nBoot0(bit) = 0, nSWBoot0(bit) = 0 & RSSCMD = 0, BOOT_LOCK=0 or
BOOT_LOCK = 1 and SECBOOTADD1 [24:0] = 0x01FF000
TZen = 1, RSSCMD = 0x1C0, BOOT_LOCK=0 or (BOOT_LOCK = 1 and
SECBOOTADD0 [24:0] = 0x01FF000)
nBoot0(bit) = 0, nBoot1(bit) = 1 and nSWBoot0(bit) = 0
nBoot0(bit) = 1, nBoot1(bit) = 1, nSWBoot0(bit) = 0 and user flash empty
Pattern 13
nBoot1(bit) = 1, nSWBoot0(bit) = 1 and Boot0(pin) = 1
nBoot1(bit) = 1, nSWBoot0(bit) = 1, Boot0(pin) = 0 and user flash empty

30/436 AN2606 Rev 61

AN2606 General bootloader description

Table 2. Bootloader activation patterns (continued)

Pattern Condition

BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, Boot0(pin) = 1 and nSWBoot0(bit) = 1

BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, nBoot0(bit) = 0 and nSWBoot0(bit) = 0

Pattern 14 BOOT_LOCK(bit) = 0, Boot0(pin) = 0, nSWBoot0(bit) = 1, BFB2(bit)=1 and both banks

do not contain valid code
BOOT_LOCK(bit) = 0, nBoot0(bit) = 1, nSWBoot0(bit) = 0, BFB2(bit)=1 and both banks
do not contain valid code
BOOT_LOCK(bit)=0, Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1
Pattern 15
BOOT_LOCK(bit)=0, nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1
Pattern 16 nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Boot0(pin) = 0, nBoot0_SW(bit) = 1 and main flash memory empty
PRODUCT_STATE = Open and Boot0(pin) = 1
Pattern 17
PRODUCT_STATE = Provisioning

Note: nBoot0_SW means either nSWBoot0 or nBOOT0_SEL, depending upon the product.
Note: BOOT_LOCK implementation is product dependent. See the reference manual for more
details.
In addition to the patterns described above, the user can execute bootloader by performing
a jump to system memory from user code. Before jumping to bootloader:
• Disable all peripheral clocks
• Disable used PLL
• Disable interrupts
• Clear pending interrupts
System memory boot mode can be exited by getting out from bootloader activation
condition and generating hardware reset or using Go command to execute user code.
Note: When executing the Go command, the peripheral registers used by the bootloader are not
initialized to their default reset values before jumping to the user application. They must be
reconfigured in the user application if they are used. So, if the application uses the IWDG,
the IWDG prescaler value must be adapted to meet requirements (since the prescaler was
set to its maximum value). For some products, not all reset values are set. For more
information, refer to the known limitations detailed for each product bootloader version.
Note: On devices with dual bank boot, to jump to system memory from user code the user must
first remap the system memory bootloader at address 0x00000000 using SYSCFG register
(except for STM32F7 series), then jump to bootloader. For the STM32F7 series, the user
must disable nDBOOT and/or nDBANK features (in option bytes), then jump to bootloader.
For STM32L0 series, the jump to system memory from user code is not possible.
Note: For STM32 devices embedding bootloader using the DFU/CAN interface in which the
external clock source (HSE) is required for DFU/CAN operations, the detection of the HSE
value is done dynamically by the bootloader firmware and is based on the internal oscillator
clock (HSI, MSI). When (because of temperature variations or other conditions) the internal

AN2606 Rev 61 31/436

435
General bootloader description AN2606

oscillator precision is altered above the tolerance band (1% around the theoretical value),
the bootloader can calculate a wrong HSE frequency value. In this case, the bootloader
DFU/CAN interfaces can malfunction, or not work at all.

4.2 Bootloader identification

Depending on the device, the bootloader can support one or more embedded serial
peripherals used to download the code to the internal flash memory. The bootloader
identifier (ID) provides information about the supported serial peripherals.
For a given STM32 device, the bootloader is identified by means of the:
1. Bootloader (protocol) version: version of the serial peripheral (e.g. USART, CAN,
USB) communication protocol used in the bootloader. This version can be retrieved
using the bootloader Get Version command.
2. Bootloader identifier (ID): version of the STM32 device bootloader, coded on one
byte in the 0xXY format, where:
– X specifies the embedded serial peripheral(s) used by the device bootloader:
X = 1: one USART is used
X = 2: two USARTs are used
X = 3: USART, CAN, and DFU are used
X = 4: USART and DFU are used
X = 5: USART and I2C are used
X = 6: I2C is used
X = 7: USART, CAN, DFU, and I2C are used
X = 8: I2C and SPI are used
X = 9: USART, CAN (or FDCAN), DFU, I2C, and SPI are used
X = 10: USART, DFU, FDCAN, and SPI are used
X = 11: USART, I2C, and SPI are used
X = 12: USART and SPI are used
X = 13: USART, DFU, I2C, and SPI are used
X = 14: USART, DFU, I2C, I3C, FDCAN, and SPI are used
– Y specifies the device bootloader version
For example, if the bootloader ID is 0x10, this is the first version of the device
bootloader that uses only one USART.
The bootloader ID is programmed in the last byte address - 1 of the device system
memory and can be read by using the bootloader “Read memory” command or by
direct access to the system memory via JTAG/SWD.
Note: The bootloader ID format is applied to all STM32 products, except the STM32F1xx devices.
The bootloader version for the STM32F1xx applies only to the embedded device bootloader
version and not to its supported protocols.

32/436 AN2606 Rev 61

AN2606 General bootloader description

Table 3 provides identification information of the bootloaders embedded in STM32 devices.

Table 3. Embedded bootloaders

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1 USART (V3.1)
STM32C011xx 0x51 0x1FFF17FE
I2C1 I2C1(V1.1)
C0
USART1 USART (V3.1)
STM32C031xx 0x52 0x1FFF17FE
I2C1 I2C1(V1.1)
STM32F05xxx/STM32F030x8 USART1/USART2 0x21 0x1FFFF7A6 USART (V3.1)
STM32F03xx4/6 USART1 0x10 0x1FFFF7A6 USART (V3.1)
USART1 USART (V3.1)
STM32F030xC 0x52 0x1FFFF796
I2C1 I2C1(V1.0)
F0 USART1/USART2 USART (V3.1)
STM32F04xxx DFU (USB device FS) 0xA1 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F071xx/072xx DFU (USB device FS) 0xA1 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F070x6 DFU (USB device FS) 0xA2 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
F0
STM32F070xB DFU (USB device FS) 0xA3 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F09xxx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
Low-density USART1 NA NA USART (V2.2)
Medium-
USART1 NA NA USART (V2.2)
density
High-density USART1 NA NA USART (V2.2)
STM32F10xxx
Medium-
density value USART1 0x10 0x1FFFF7D6 USART (V2.2)
F1 line
High-density
USART1 0x10 0x1FFFF7D6 USART (V2.2)
value line
USART1/USART2 (remapped) USART (V2.2(1))
STM32F105xx/107xx CAN2 (remapped) NA NA CAN (V2.0)
DFU (USB device) DFU(V2.2)
STM32F10xxx XL-density USART1/USART2 (remapped) 0x21 0x1FFFF7D6 USART (V3.0)
USART1/USART3 0x20 0x1FFF77DE USART (V3.0)
F2 STM32F2xxxx USART1/USART3 USART (V3.1)
CAN2 0x33 0x1FFF77DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)

AN2606 Rev 61 33/436

435
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2/ USART (V3.1)
STM32F373xx 0x41 0x1FFFF7A6
DFU (USB device FS) DFU (V2.2)
USART (V3.1)
STM32F378xx USART1/USART2/ I2C1 0x50 0x1FFFF7A6
I2C (V1.0)
USART1/USART2/ USART (V3.1)
STM32F302xB(C)/303xB(C) 0x41 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2/ USART (V3.1)
STM32F358xx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
USART1/USART2/ USART (V3.1)
F3 STM32F301xx/302x4(6/8) 0x40 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2/ USART (V3.1)
STM32F318xx 0x50 0x1FFFF796
I2C1/ I2C3 I2C (V1.0)
USART1/USART2/ USART (V3.1)
STM32F302xD(E)/303xD(E) 0x40 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2/ USART (V3.1)
STM32F303x4(6/8)/334xx/328xx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
USART1/USART2/ USART (V3.1)
STM32F398xx 0x50 0x1FFFF796
I2C1/I2C3 I2C (V1.0)

34/436 AN2606 Rev 61

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3/ USART (V3.1)
CAN2 0x31 0x1FFF77DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
STM32F40xxx/41xxx USART1/USART3/ USART (V3.1)
CAN2 CAN (V2.0)
DFU (USB device FS) 0x91 0x1FFF77DE DFU (V2.2)
/I2C1/I2C2/I2C3/ SPI(V1.1)
SPI1/SPI2 I2C (V1.0)
USART1/USART3/ USART (V3.1)
CAN2 CAN (V2.0)
0x70 0x1FFF76DE
DFU (USB device FS) / DFU (V2.2)
I2C1 I2C (V1.0)
STM32F42xxx/43xxx USART1/USART3/ USART (V3.1)
CAN2 CAN (V2.0)
DFU (USB device FS) 0x91 0x1FFF76DE DFU (V2.2)
SPI1/ SPI2/ SPI4 SPI(V1.1)
I2C1/I2C2/I2C3/ I2C (V1.0)
USART1/USART2 USART (V3.1)
DFU (USB device FS) / DFU (V2.2)
STM32F401xB(C) 0xD1 0x1FFF76DE
SPI1/SPI2/ SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.0)
USART1/USART2 USART (V3.1)
DFU (USB device FS) DFU (V2.2)
STM32F401xD(E) 0xD1 0x1FFF76DE
SPI1/SPI2/ SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.1)
USART1/USART2/ USART (V3.1)
F4
STM32F410xx I2C1/I2C2/I2C4 0xB1 0x1FFF76DE I2C (V1.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/ USART (V3.1)
DFU (USB device FS)/ DFU (V2.2)
STM32F411xx 0xD0 0x1FFF76DE
SPI1/SPI2/ SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.1)
USART1/USART2/ USART (V3.1)
USART3/CAN2 CAN (V2.0)
STM32F412xx DFU (USB device FS)/ 0x91 0x1FFF76DE DFU (V2.2)
I2C1/I2C2/I2C3/I2C4/ SPI (V1.1)
SPI1/SPI3/SPI4 I2C (V1.2)
USART1/USART2/ USART (V3.1)
USART3/CAN2 CAN (V2.0)
STM32F413xx/423xx DFU (USB device FS)/ 0x90 0x1FFF76DE DFU (V2.2)
I2C1/I2C2/I2C3/I2C4/ I2C (V1.2)
SPI1/SPI3/SPI4 SPI (V1.1)
USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
STM32F446xx DFU (USB device FS) 0x90 0x1FFF76DE DFU (V2.2)
I2C1/I2C2/I2C3 SPI(V1.1)
SPI1/ SPI2/ SPI4 I2C (V1.2)
USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32F469xx/479xx CAN2 0x90 0x1FFF76DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/ SPI2/ SPI4 SPI (V1.1)

AN2606 Rev 61 35/436

435
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3/ USART (V3.1)
CAN1 CAN (V2.0)
STM32F72xxx/73xxx DFU (USB device FS)/ 0x90 0x1FF0EDBE DFU (V2.2)
I2C1/I2C2/I2C3/ I2C (V1.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART3/ USART (V3.1)
I2C1/I2C2/I2C3/ I2C (V1.2)
0x70 0x1FF0EDBE
CAN2 CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
F7 STM32F74xxx/75xxx USART1/USART3/ USART (V3.1)
I2C1/I2C2/I2C3/ I2C (V1.2)
CAN2 0x90 0x1FF0EDBE CAN (V2.0)
DFU (USB device FS)/ DFU (V2.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART3/ USART (V3.1)
CAN2 CAN (V2.0)
STM32F76xxx/77xxx DFU (USB device FS)/ 0x93 0x1FF0EDBE DFU (V2.2)
I2C1/I2C2/I2C3/ I2C (V1.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART2/ USART (V3.1)
STM32G07xxx/08xxx USART3/I2C1/I2C2/ 0xB3 0x1FFF6FFE I2C (V1.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/ USART (V3.1)
STM32G03xxx/04xxx 0x53 0x1FFF1FFE
I2C1\I2C2 I2C (V1.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2 I2C (V1.2)
STM32G0B0xx 0xD0 0x1FFF9FFE
SPI1/SPI2 SPI (V1.1)
G0 DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2 I2C (V1.2)
STM32G0B1xx/0C1xx SPI1/SPI2 0x92 0x1FFF9FFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN FDCAN (V1.0)
USART1/USART2 USART (V3.1)
STM32G05xxx/061xx 0x51 0x1FFF1FFE
I2C1/I2C2 I2C (V1.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3 I2C (V1.2)
STM32G431xx/441xx 0xD4 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3/I2C4 I2C (V1.2)
G4 STM32G47xxx/48xxx 0xD5 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3 I2C (V1.2)
STM32G491xx/4A1xx 0xD2 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)

36/436 AN2606 Rev 61

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2/USART3 USART (V4.0)
I2C2 I2C (V2.0)
I3C1 I3C (V1.0)
STM32H503xx 0xE1 0x0BF8FFFE
SPI1/SPI2/SPI3 SPI (V2.0)
USB DFU USB (V3.0)
H5 FDCAN1 FDCAN (V2.0)
USART1/USART2/USART3 USART (V4.0)
I2C3/I2C4 I2C (V2.0)
I3C1 I3C (V1.0)
STM32H563xx/73xx 0xE4 0x0BF9FAFE
SPI1/SPI2/SPI3 SPI (V2.0)
USB DFU USB (V3.0)
FDCAN2 FDCAN (V2.0)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32H72xxx/73xxx DFU (USB device FS) 0x93 0x1FF1E7FE DFU (V2.2)
SPI1/SPI2/SPI3/SPI4 SPI (V1.1)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.1)
H7 STM32H74xxx/75xxx DFU (USB device FS) 0x91 0x1FF1E7FE DFU (V2.2)
SPI1/SPI2/SPI3/SPI4 SPI (V1.1)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32H7A3xx/B3xx DFU (USB device FS) 0x92 0x1FF13FFE DFU (V2.2)
SPI1/SPI2/SPI3/SPI4 SPI (V1.2)
FDCAN1 FDCAN (V1.1)
USART2 USART (V3.1)
STM32L01xxx/02xxx 0xC3 0x1FF00FFE
SPI1 SPI (V1.1)
USART2 USART (V3.1)
STM32L031xx/041xx 0xC0 0x1FF00FFE
SPI1 SPI (V1.1)
USART1/USART2/ USART (V3.1)
STM32L05xxx/06xxx 0xC0 0x1FF00FFE
L0 SPI1/ SPI2 SPI (V1.1)
USART1/USART2/ USART (V3.1)
0x41 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
STM32L07xxx/08xxx USART1/USART2 USART (V3.1)
SPI1/SPI2/ 0xB2 0x1FF01FFE SPI (V1.1)
I2C1/I2C2 I2C (V1.2)
STM32L1xxx6(8/B) USART1/USART2 0x20 0x1FF00FFE USART (V3.0)
STM32L1xxx6(8/B)A USART1/USART2 0x20 0x1FF00FFE USART (V3.1)
USART1/USART2 USART (V3.1)
STM32L1xxxC 0x40 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
L1
USART1/USART2 USART (V3.1)
STM32L1xxxD 0x45 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32L1xxxE 0x40 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)

AN2606 Rev 61 37/436

435
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L412xx/422xx 0xD1 0x1FFF6FFE
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L43xxx/44xxx CAN1 0x91 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L45xxx/46xxx CAN1 0x92 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/ USART3 USART (V3.1)
I2C1/I2C2/I2C3 0xA3 0x1FFF6FFE I2C (V1.2)
DFU (USB device FS) DFU (V2.2)
STM32L47xxx/48xxx USART1/USART2/ USART3 USART (V3.1)
L4 I2C/I2C2/I2C3 I2C (V1.2)
SPI1/SPI2 0x92 0x1FFF6FFE SPI (V1.1)
CAN1 CAN(V2.0)
DFU (USB device FS) DFU(V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L496xx/4A6xx CAN1 0x93 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS)/ DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L4Rxxx/STM32L4Sxxx CAN1 0x95 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS)/ DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3/ I2C (V1.2)
STM32L4P5xx /Q5xx CAN1 0x90 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS)/ DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
L5 STM32L552xx/562xx SPI1/SPI2/SPI3 0x92 0x0BF97FFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.0)

38/436 AN2606 Rev 61

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2 USART (V3.1)
WBA STM32WBA52xx I2C1/I2C3 0XB0 0x0BF8FEFE I2C (V1.2)
SPI3 SPI (V1.1)
USART1 USART (V3.1)
STM32WB10xx/15xx I2C1/ 0xB1 0x1FFF6FFE I2C (V1.2)
SPI1 SPI (V1.1)
WB USART1 USART (V3.2)
I2C1/I2C3 I2C (V1.2)
STM32WB30xx/35xx/50xx/55xx 0xD5 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
WL STM32WLE5xx/55xx 0xC4 0x1FFF3EFE
SPI1/SPI2 SPI (V1.1)
USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U535xx/545xx SPI1/SPI2/SPI3 0x91 0x0BF99EFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U575xx/STM32U585xx SPI1/SPI2/SPI3 0x92 0x0BF99EFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
U5
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U595xx/599xx/
SPI1/SPI2/SPI3 0x92 0x0BF99EFE SPI (V1.1)
STM32U5A5xx/5A9xx
DFU (USB device HS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U5F7xx/5F9xx/
SPI1/SPI2/SPI3 0x90 0x0BF99EFE SPI (V1.1)
STM32U5G7xx/5G9xx
DFU (USB device HS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
1. For connectivity line devices, the USART bootloader returns V2.0 instead of V2.2 for the protocol version. For more details
refer to the “STM32F105xx and STM32F107xx revision Z” errata sheet available from www.st.com.

AN2606 Rev 61 39/436

435
General bootloader description AN2606

4.3 Hardware connection requirements

To use the USART bootloader, the host must be connected to the RX and TX pins of the
desired USARTx interface via a serial cable.

Figure 1. USART connection

+V 1

R
RX 2 TX
RS232
Transceiver
STM32
UART Host TX RX Microcontroller
GND GND

MSv35098V1

1. A pull-up resistor must be added, if they are not connected in host side.
2. An RS232 transceiver must be connected to adapt the voltage level (3.3 to 12 V) between the STM32
device and the host.
Note: Typically V is 3.3 V, and R is 100 KΩ.These values depend upon the application and the
used hardware.
To use the DFU, connect the microcontroller USB interface to a USB host (such as a PC).

Figure 2. USB connection

1
+V
10K
36K

1.5K

VBus
DP DP
STM32
USB Host
DM DM Microcontroller
GND GND

MS35037V1

1. This additional circuit permits to connect a pull-up resistor to DP pin using VBus when needed. Refer to
product section (table describing STM32 configuration in system memory boot mode) to know if an external
pull-up resistor must be connected to DP pin.
Note: V typically is 3.3 V. This value depends upon the application and the used hardware.
To use the I2C bootloader, connect the host (master) and the desired I2Cx interface (slave)
together via the data (SDA) and clock (SCL) pins. A 1.8 KΩ pull-up resistor must be
connected to both SDA and SCL lines.

40/436 AN2606 Rev 61

AN2606 General bootloader description

Figure 3. I2C connection

+V

1.8K

1.8K
SCL SCL
STM32
I2C Host
SDA SDA Microcontroller
GND GND

MS35038V1

Note: V is typically 3.3 V. This value depends upon the application and the used hardware.
To use the SPI bootloader, connect the host (master) and the desired SPIx interface (slave)
together via the MOSI, MISO, and SCK pins. The NSS pin must be connected to GND. A
pull-down resistor must be connected to the SCK line.

Figure 4. SPI connection

NSS
MOSI MOSI
STM32
MISO MISO
SPI Host Microcontroller
SCK SCK
R

GND GND

MS35039V1

Note: R is typically 10 KΩ. This value depends upon the application and the used hardware.
To use the CAN interface, the host must be connected to the RX and TX pins of the desired
CANx interface via CAN transceiver and a serial cable. A 120 Ω resistor must be added as
terminating resistor.

Figure 5. CAN connection

RX CAN_H TX
CAN CAN STM32
CAN Host
120

120

Transceiv Transceiv
TX er er RX Microcontroller
CAN_L
GND GND

MS35040V1

AN2606 Rev 61 41/436

435
General bootloader description AN2606

Note: When a bootloader firmware supports DFU, it is mandatory that no USB Host is connected
to the USB peripheral during the selection phase of the other interfaces. After selection
phase, the user can plug a USB cable without impacting the selected bootloader execution
except for commands generating a system reset.
It is recommended to keep the RX pins of unused bootloader interfaces (USART_RX,
SPI_MOSI, CAN_RX and USB D+/D- lines if present) at a known (low or high) level at the
startup of the bootloader (detection phase). Leaving these pins floating during the detection
phase might lead to activating unused interfaces.

4.4 Bootloader memory management

All write operations using bootloader commands must only be Word-aligned (the address
must be a multiple of 4). The number of data to be written must also be a multiple of 4
(non-aligned half page write addresses are accepted).
Some Products embed bootloader that has some specific features:
• Some products do not support Mass erase operation. To perform a mass erase
operation using bootloader, two options are available:
– Erase all sectors one by one using the Erase command
– Set protection level to Level 1. Then, set it to Level 0 (using the Read protect and
then the Read Unprotect command). This operation results in a mass erase of the
internal flash memory.
• Bootloader firmware of STM32 L1 and L0 series supports Data memory in addition to
standard memories (internal flash, internal SRAM, option bytes and System memory).
The start address and the size of this area depends on product, refer to the product
reference manual for more information. Data memory can be read and written but
cannot be erased using the Erase Command. When writing in a Data memory location,
the bootloader firmware manages the erase operation of this location before any write.
A write to Data memory must be Word-aligned (address to be written must be a
multiple of 4) and the number of data must also be a multiple of 4. To erase a Data
memory location, write zeros at this location.
• Bootloader firmware of the F2, F4, F7, and L4 series supports OTP memory in addition
to standard memories (internal flash, internal SRAM, option bytes and System
memory). The start address and the size of this area depends on product, refer to
product reference manual for more information. OTP memory can be read and written
but cannot be erased using Erase command. When writing in an OTP memory location,
make sure that the relative protection bit is not reset.
• For STM32 F2, F4 and F7 series the internal flash memory write operation format
depends on voltage Range. By default write operations are allowed by one byte format
(Half-Word, Word and Double-Word operations are not allowed). to increase the speed
of write operation, the user must apply the adequate voltage range that allows write
operation by Half-Word, Word or Double-Word and update this configuration on the fly
by the bootloader software through a virtual memory location. This memory location is
not physical but can be read and written using usual bootloader read/write operations
according to the protocol in use. This memory location contains 4 bytes described in
Table 4. It can be accessed by 1, 2, 3, or 4 bytes. However, reserved bytes must
remain at their default values (0xFF), otherwise the request is NACKed.

42/436 AN2606 Rev 61

AN2606 General bootloader description

Table 4. STM32 F2, F4, and F7 voltage range configuration using bootloader
Address Size Description

This byte controls the current value of the voltage range.

0x00: voltage range [1.8 V, 2.1 V]
0x01: voltage range [2.1 V, 2.4 V]
0x02: voltage range [2.4 V, 2.7 V]
0xFFFF0000 1 byte 0x03: voltage range [2.7 V, 3.6 V]
0x04: voltage range [2.7 V, 3.6 V] and double word write/erase
operation is used. In this case it is mandatory to supply 9 V
through the VPP pin (refer to the product reference manual for
more details about the double-word write procedure).
Other: all other values are not supported and are NACKed.
Reserved.
0xFFFF0001 1 byte 0xFF: default value.
Other: all other values are not supported and are NACKed.
Reserved.
0xFFFF0002 1 byte 0xFF: default value.
Other: all other values are not supported and is NACKed.
Reserved.
0xFFFF0003 1 byte 0xFF: default value.
Other: all other values are not supported and are NACKed.

The table below lists the valid memory areas, depending upon the bootloader commands.

Table 5. Supported memory area by Write, Read, Erase, and Go commands

Memory area Write command Read command Erase command Go command

Flash Supported Supported Supported Supported

RAM Supported Supported Not supported Supported
System memory Not supported Supported Not supported Not supported
Data memory Supported Supported Not supported Not supported
OTP memory Supported Supported Not supported Not supported

4.5 Bootloader UART baudrate detection

For the UART interface baudrate detection, there are two types of mechanisms
implemented on different STM32 devices:
• Software baudrate detection using internal HSI and timer (use GPIO as input, detect
falling edge and rising edge as explained in AN3155).
The devices using this mechanism are subject to software jitter (variable error of
baudrate calculation) that can reach up to ±5%. In this case, the host connecting to the
STM32 bootloader UART interface must support a ±5% deviation in baudrate.
The software jitter value is variable and different at each retry, so it is possible to use
multiple retry connections to overcome it (connect and check for correct bootloader
answer, if answer is not correct, reset the device and retry connection until the correct
answer is received. Once correct answer is received the rest of the communication is

AN2606 Rev 61 43/436

435
General bootloader description AN2606

not impacted by software jitter).

It is also possible to reduce software jitter by reducing baudrate value (i.e. use
56000 bps instead of 115200).
Table 6 provides the maximum software jitter value for the baudrate 115200 bps.
The lower the baudrate the lower the software jitter.
• Baudrate detection using UART auto-baudrate feature. Devices using this mechanism
do not present any software jitter.

Table 6. Jitter software calculation on bootloader USART detection

Maximum software jitter
Series Baudrate detection method
for 115200 bps

STM32F0 Software baudrate detection -1%

STM32F1 Software baudrate detection -3%
STM32F2 Software baudrate detection -5%
STM32F3 Software baudrate detection -2%
STM32F4 Software baudrate detection -6%
STM32F7 Software baudrate detection -6%
STM32L0 Software baudrate detection -2%
STM32L1 Software baudrate detection -3%
STM32L4 Software baudrate detection -5%
STM32G07x/8x UART3
Software baudrate detection -4%
STM32G03x/4x UART2
STM32G07x/8x UART1/UART2
Auto-baudrate N/A
STM32G03x/4x UART1
STM32G4 Auto-baudrate N/A
STM32H7 Auto-baudrate N/A
STM32WB Auto-baudrate N/A
STM32WL Auto-baudrate N/A

4.6 Programming constraints

When using bootloader interface to write in the flash memory, alignment on the programmed
address must be respected according to Table 7.
If the address to which the write operation is not aligned, it fails and all following program
operations fail as well.

Table 7. Flash memory alignment constraints on STM32 products

Series Alignment

STM32F0 4 bytes
STM32F1 4 bytes
STM32F2 4 bytes

44/436 AN2606 Rev 61

AN2606 General bootloader description

Table 7. Flash memory alignment constraints on STM32 products (continued)

Series Alignment

STM32F3 4 bytes
STM32F4 4 bytes
STM32F7 8 bytes
STM32G0 4 bytes
STM32G4 4 bytes
STM32H5 16 bytes
STM32H7 8 bytes
STM32L0 8 bytes
STM32L1 8 bytes
STM32L4 8 bytes
STM32L5 16 bytes
STM32WBA 16 bytes
STM32WB 8 bytes
STM32WL 8 bytes
STM32U5 16 bytes

Examples of alignment:
• 4 bytes: 0x08000014 is aligned and passes, 0x08000012 is not aligned and fails
• 8 bytes: 0x08000010 is aligned and passes, 0x08000014 is not aligned and fails
Note: On some products (STM32F4 and STM32F7) it is possible to change the alignment
constraint by writing in the device feature space.

4.7 ExitSecureMemory feature

The securable memory area is used to isolate secure boot code/data, which handle
sensitive information (secrets), from application code:
• Access is controlled by a securable memory bit SEC_PROT (write once), in the
FLASH_CR register
• Executed once at boot, then locked by writing the securable memory bit
– The code protected: in the securable memory area is hidden until the next reset
that unlocks the SEC_PROT bit
• Width (number of flash memory pages) is defined through an option byte, SEC_SIZE,
in the flash memory FLASH_SEC_R register
The ExitSecureMemory is a software developed and hosted on the system memory. When
the user boot code jump to it, the software allows setting the SEC_PROT bit to 1 and then
jumping to the application code. The SEC_SIZE must be set to the needed value before
jumping to the ExitSecureMemory function.
As shown in Figure 6, two jump methods can be used by the customer:

AN2606 Rev 61 45/436

435
General bootloader description AN2606

Jump to the secure memory function without parameter

In this case the application must be loaded just after the secure memory defined.

Jump to the secure memory function using two parameters

1. Magic number
• 0x08192A3C
– Used to secure boot code/data in flash and jump in case of a single bank product
– Used to secure boot code/data in Bank1 and jump in case of a dual bank product
• 0x08192A3D
– Used to secure boot code/data and jump to application in Bank2 in case of a dual
bank product
2. User address = Application address
• In this case the application can be loaded to any desired address (as per user address
defined)

Figure 6. ExitSecureMemory function usage

System memory User Flash memory

Boot code/data SEC_SIZE Boot code/data

1
Bootloader (to protect) (hidden)

Application Application
ExitSecureMemory
3
2

Jump to the secure memory area without parameter

System memory User Flash memory

1 Boot code/data SEC_SIZE Boot code/data

Bootloader (to protect) (hidden)

ExitSecureMemory 3
2
Application Application

Jump to the secure memory area with parameter

(Magic number + Application address)
MS53655V1

Note: For more information regarding the option bytes configuration refer to the reference manual.
Note: An example of a function that can be used to call the “ExitSecureMemory” is in Appendix A.

46/436 AN2606 Rev 61

AN2606 General bootloader description

Table 8. ExitSecureMemory entry address

MCU ExitSecureMemory address

STM32G07xxx/08xxx 0x1FFF6800
STM32G03xxx/04xxx 0x1FFF1E00
STM32G0
STM32G0Bxxx/0Cxxx 0x1FFF6800
STM32G05xxx/061xx 0x1FFF6800
STM32G47xxx/48xxx 0x1FFF6800
STM32G4 STM32G431xx/441xx 0x1FFF6800
STM32G491xx/4A1xx 0x1FFF6800

For more details refer to Figure 7.

Figure 7. Access to securable memory area from the bootloader

Jump to secure
memory address

R1=Magic number
No and
R2=User address

Yes
Flash dual bank

Check link register to know from Jump to ExitSecArea() Single bank Dual bank
which bank happening the jump function

Valid magic bank1 Valid magic

Set bank’s securable number for which bank2
number
memory bit bank

Set securable Set securable

memory bit for memory bit for
Jump just after securable Set securable bank1 bank2
memory area memory bit

Jump to user Jump to user

address address
Jump to user
address

MS51971V1

1. The Bootloader does not check the integrity of the user address, it is up to the user to ensure the validity of the address to
jump to.

AN2606 Rev 61 47/436

435
General bootloader description AN2606

4.8 IWDG usage in Bootloader

The Bootloader does not enable IWDG, it only tries to update the pre-scaler value if the
IWDG was enabled by HW (through option bytes) or by SW in case of an application that
jumps to Bootloader.
If the IWDG was not enabled prior boot on Bootloader (using HW boot or by a jump from an
application), the Watchdog pre-scaler value update bit (PVU) is set to 0x1 when the
Bootloader tries to change the pre-scaler value.
This value does not change, it remains at 0x1 as the pre-scaler update never happens
(IWDG is not enabled), and this even after the jump from Bootloader.
So, when using the Bootloader to jump to the application, and when there is the need to
enable the IWDG, consider that the PVU bit in IWDG_SR register is set to 0x1.

48/436 AN2606 Rev 61

AN2606 STM32C011xx devices bootloader

5 STM32C011xx devices bootloader

5.1 Bootloader configuration

The STM32C011xx bootloader is activated by applying Pattern 11(see Table 2: Bootloader
activation patterns). Table 13 shows the hardware resources used by this bootloader.

Table 9. STM32C011xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz (no PLL)
3.5 Kbytes, starting from address 0x20000000
RAM -
are used by the bootloader firmware.

Common to all 6 Kbytes, starting from address 0x1FFF0000

System memory -
bootloaders contain the bootloader firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset if the hardware IWDG
option was previously enabled by the user.
Securable memory The address to jump to for the securable
- -
area memory area is 0x1FFF1600
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
input pull-up mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1100100x
(where x = 0 for write and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

Note: On WLCSP12, SO8N, TSSOP20, and UFQFN20 packages USART1 PA9/PA10 IOs are
remapped on PA11/PA12.

AN2606 Rev 61 49/436

435
STM32C011xx devices bootloader AN2606

5.2 Bootloader selection

Figure 10 shows the bootloader selection mechanism.

Figure 8. Bootloader V5.x selection for STM32C011xx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
no I2Cx Address
Detected interfaces clock’s interfaces clock’s

Execute Configure
BL_I2C_Loop for USARTx
I2Cx

Execute
BL_USART_Loop
for USARTx

MS52813V1

5.3 Bootloader version

Table 10 lists the STM32C011xx devices bootloader versions.

Table 10. STM32C011xx bootloader versions

Version
Description Known limitations
number

V5.1 Initial bootloader version None

50/436 AN2606 Rev 61

AN2606 STM32C031xx devices bootloader

6 STM32C031xx devices bootloader

6.1 Bootloader configuration

The STM32C031xx bootloader is activated by applying Pattern 11(see Table 2). Table 13
shows the hardware resources used by this bootloader.

Table 11. STM32C031xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (no

RCC HSI enabled
PLL)
3.5 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.

Common to all 6 Kbytes, starting from address

bootloaders System memory - 0x1FFF0000 contain the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset if the hardware
IWDG option was previously enabled by the
user.
Securable memory The address to jump to for the securable
- -
area memory area is 0x1FFF1600
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1100011x
(where x = 0 for write and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB7 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.

Note: On TSSOP20 and UFQFN28 packages USART1 PA9/PA10 IOs are remapped on
PA11/PA12.

AN2606 Rev 61 51/436

435
STM32C031xx devices bootloader AN2606

6.2 Bootloader selection

Figure 10 shows the bootloader selection mechanism.

Figure 9. Bootloader V5.x selection for STM32C031xx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
no I2Cx Address
Detected interfaces clock’s interfaces clock’s

Execute Configure
BL_I2C_Loop for USARTx
I2Cx

Execute
BL_USART_Loop
for USARTx

MS52813V1

6.3 Bootloader version

Table 12 lists the STM32C031xx devices bootloader versions.

Table 12. STM32C031xx bootloader versions

Version number Description Known limitations

V5.2 Initial bootloader version None

52/436 AN2606 Rev 61

AN2606 STM32F03xx4/6 devices bootloader

7 STM32F03xx4/6 devices bootloader

7.1 Bootloader configuration

The STM32F03xx4/6 bootloader is activated by applying Pattern 2 (see Table 2). Table 13
shows the hardware resources used by this bootloader.

Table 13. STM32F03xx4/6 configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using

RCC HSI enabled PLL clocked by HSI).
1 flash Wait State.
2 Kbytes, starting from address 0x20000000
RAM -
are used by the bootloader firmware.
Common to all
bootloaders 3 Kbytes, starting from address 0x1FFFEC00
System memory -
contain the bootloader firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset if the hardware IWDG
option was previously enabled by the user.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
USART1 bootloader PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
(on PA10/PA9) input pull-up mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in alternate push-pull, pull-up mode.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
USART1 bootloader PA15 pin: USART1 in reception mode. Used in
USART1_RX pin Input
(on PA14/PA15) input pull-up mode.
PA14 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USART1 bootloaders SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: After the STM32F03xx4/6 device has booted in bootloader mode, serial wire debug (SWD)
communication is no longer possible until the system is reset. This is because the SWD
uses the PA14 pin (SWCLK), already used by the bootloader (USART1_TX).

AN2606 Rev 61 53/436

435
STM32F03xx4/6 devices bootloader AN2606

7.2 Bootloader selection

Figure 10 shows the bootloader selection mechanism.

Figure 10. Bootloader selection for STM32F03xx4/6 devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35015V1

7.3 Bootloader version

Table 14 lists the STM32F03xx4/6 devices bootloader versions.

Table 14. STM32F03xx4/6 bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

instead of 1 NACK are sent when a Read Memory
V1.0 Initial bootloader version
or Write Memory command is sent and the RDP
level is active.

54/436 AN2606 Rev 61

AN2606 STM32F030xC devices bootloader

8 STM32F030xC devices bootloader

8.1 Bootloader configuration

The STM32F030xC bootloader is activated by applying Pattern 2 (see Table 2). Table 15
shows the hardware resources used by this bootloader.

Table 15. STM32F030xC configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with

RCC HSI enabled
HSI 8 MHz as clock source.
Common to all 6 Kbytes, starting from address 0x20000000
RAM -
bootloaders are used by the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800,
System memory -
contain the bootloader firmware.
Once initialized the USART1 configuration is
USART1 Enabled
8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
input pull-up mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is
USART2 Enabled
8-bit, even parity, and one stop bit
USART2 bootloader PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input
(on PA2/PA3) input pull-up mode.
PA2 pin: USART2 in transmission mode. Used
USART2_TX pin Output
in input pull-up mode.
Once initialized the USART2 configuration is
USART2 Enabled
8-bit, even parity, and one stop bit
USART2 bootloader PA15 pin: USART2 in reception mode. Used in
USART2_RX pin Input
(on PA14/PA15) input pull-up mode.
PA14 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1000001x
(where x = 0 for write and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

AN2606 Rev 61 55/436

435
STM32F030xC devices bootloader AN2606

Note: After the STM32F030xC devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no more possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

8.2 Bootloader selection

Figure 11 shows the bootloader selection mechanism.

Figure 11.Bootloader selection for STM32F030xC

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

0x7F received on Disable all interrupt

USARTx sources and other
yes interfaces clock’s
no
Disable all interrupt
Configure
sources and other
USARTx
I2Cx Address interfaces clock’s
Detected
no Execute
Execute
BL_I2C_Loop for BL_USART_Loop
I2Cx for USARTx

MSv36789V1

8.3 Bootloader version

Table 16 lists the STM32F030xC devices bootloader versions.

Table 16. STM32F030xC bootloader versions

Version number Description Known limitations

PA13 is set in input pull-up mode even if not used

V5.2 Initial bootloader version
by the bootloader

56/436 AN2606 Rev 61

AN2606 STM32F05xxx and STM32F030x8 devices bootloader

9 STM32F05xxx and STM32F030x8 devices bootloader

9.1 Bootloader configuration

The STM32F05xxx and STM32F030x8 devices bootloader is activated by applying
Pattern 2 (described in Table 2). Table 17 shows the hardware resources used by this
bootloader.

Table 17. STM32F05xxx and STM32F030x8 devices configuration in system memory boot mode
Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using

RCC HSI enabled PLL clocked by HSI).
1 flash Wait State.
2 Kbytes, starting from address 0x20000000
RAM -
are used by the bootloader firmware.
Common to all
bootloaders 3 Kbytes, starting from address 0x1FFFEC00,
System memory -
contain the bootloader firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset if the hardware IWDG
option was previously enabled by the user.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8
USART2 Enabled
bits, even parity, and one stop bit.
PA15 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA14 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: After the STM32F05xxx and STM32F030x8 devices have booted in bootloader mode, the
serial wire debug (SWD) communication is no more possible until the system is reset,
because SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_TX).

AN2606 Rev 61 57/436

435
STM32F05xxx and STM32F030x8 devices bootloader AN2606

9.2 Bootloader selection

Figure 12 shows the bootloader selection mechanism.

Figure 12. Bootloader selection for STM32F05xxx and STM32F030x8 devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35014V1

9.3 Bootloader version

Table 18 lists the STM32F05xxx and STM32F030x8 devices bootloader versions.

Table 18. STM32F05xxx and STM32F030x8 devices bootloader versions

Version
Description Known limitations
number

– At bootloader startup, the HSITRIM value is set

to 0 (in HSITRIM bits on RCC_CR register)
instead of default value (16), as a consequence
a deviation is generated in crystal
measurement. For better results, use the
smallest supported crystal value (i.e. 4 MHz).
V2.1 Initial bootloader version
– For the USART interface, two consecutive
NACKs instead of 1 NACK are sent when a
Read Memory or Write Memory command is
sent and the RDP level is active.
– PA13 is set in input pull-up mode even if not
used by the Bootloader.

58/436 AN2606 Rev 61

AN2606 STM32F04xxx devices bootloader

10 STM32F04xxx devices bootloader

10.1 Bootloader configuration

The STM32F04xxx bootloader is activated by applying Pattern 6 (described in Table 2).
Table 19 shows the hardware resources used by this bootloader.

Table 19. STM32F04xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48

HSI enabled
MHz as clock source.
RCC The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by HSI48
48 MHz.
6 Kbytes, starting from address 0x20000000 are used
Common to all RAM -
by the bootloader firmware
bootloaders
13 Kbytes, starting from address 0x1FFFC400, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Use in input
USART1_RX pin Input
bootloader pull-up mode
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 PA15 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
bootloader pull-up mode.
PA14 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
analog filter ON. Slave 7-bit address: 0b0111110x
I2C1 bootloader (where x = 0 for write and x = 1 for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

AN2606 Rev 61 59/436

435
STM32F04xxx devices bootloader AN2606

Table 19. STM32F04xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU bootloader
Input/output PA12: USB DP line
USB_DP pin No external pull-up resistor is required. Used in
alternate push-pull, no pull mode.

Note: After the STM32F04xxx devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no more possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: Due to empty check mechanism present on this product, it is not possible to jump from user
code to system bootloader. Such jump results in a jump back to user flash memory space.
But if the first 4 bytes of User flash (at 0x0800 0000) are empty at the moment of jump (i.e.
erase first sector before jump or execute code from SRAM while flash is empty), then
system bootloader is executed when jumped to.

60/436 AN2606 Rev 61

AN2606 STM32F04xxx devices bootloader

10.2 Bootloader selection

Figure 13 shows the bootloader selection mechanism.

Figure 13. Bootloader selection for STM32F04xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure USB FS device

0x7F received
yes
on USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
I2Cx Address
Detected yes interfaces clock’s interfaces clock’s

Disable other
no interfaces clock’s Execute Configure
no BL_I2C_Loop for USARTx
I2Cx
USB
Detected Execute DFU
bootloader using USB Execute
interrupts BL_USART_Loop
for USARTx

MS35025V1

10.3 Bootloader version

Table 20. STM32F04xxx bootloader versions
Version
Description Known limitations
number

V10.0 Initial bootloader version At bootloader startup, the HSITRIM value is set to 0 (in
HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated
Add dynamic support of in crystal measurement.
USART/USB interfaces on For better results, use the smallest supported crystal
V10.1
PA11/12 IOs for small value (i.e. 4 MHz).
packages.
PA13 is set in input pull-up mode even if not used by
the bootloader.

AN2606 Rev 61 61/436

435
STM32F070x6 devices bootloader AN2606

11 STM32F070x6 devices bootloader

11.1 Bootloader configuration

The STM32F070x6 bootloader is activated by applying Pattern 6 (described in Table 2).
Table 21 shows the hardware resources used by this bootloader.

Table 21. STM32F070x6 configuration in system memory boot mode

Feature/Periphe
Bootloader State Comment
ral
At startup, the system clock frequency is configured
HSI enabled to 48 MHz using the HSI. If an external clock (HSE) is
not present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader
interfaces and must have one of the following values:
RCC HSE enabled
24, 18, 16, 12, 8, 6, 4 MHz. The PLL is used to
Common to all generate 48 MHz for USB and system clock.
bootloaders The CSS interrupt is enabled for HSE. Any failure (or
- removal) of the external clock generates system
reset.
6 Kbytes, starting from address 0x20000000 are used
RAM -
by the bootloader firmware
13 Kbytes, starting from address 0x1FFFC400,
System memory -
contain the bootloader firmware.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 bootloader PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
alternate push-pull, pull-up mode.
USART1_TX pin Output PA9 pin: USART1 in transmission mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 bootloader
USART2_RX pin Input PA15 pin: USART2 in reception mode
USART2_TX pin Output PA14 pin: USART2 in transmission mode
Used to automatically detect the serial baud rate from
USARTx bootloaders SysTick timer Enabled
the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 bootloader Slave 7-bit address: 0b0111110x where x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain mode.

62/436 AN2606 Rev 61

AN2606 STM32F070x6 devices bootloader

Table 21. STM32F070x6 configuration in system memory boot mode (continued)

Feature/Periphe
Bootloader State Comment
ral
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
DFU bootloader
USB_DM pin PA11 pin: USB FS DM line
Input/output PA12 pin: USB FS DP line.
USB_DP pin
No external pull-up resistor is required.

Note: If HSI deviation exceeds 1% the bootloader might not function correctly.
Note: After the STM32F070x6 devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no more possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 8, 6, 4 MHz, the system clock is
configured to 48 MHz with HSE as clock source. The DFU interface, USART1,
USART2, and I2C1 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source and only USART1,
USART2, and I2C1 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.
Note: Due to empty check mechanism present on this product, it is not possible to jump from user
code to system bootloader. Such jump results in a jump back to user flash space, but if the
first four bytes of user flash (at 0x0800 0000) are empty at the moment of jump (i.e. erase
first sector before jump or execute code from SRAM while flash is empty), then system
bootloader is executed when jumped to.

AN2606 Rev 61 63/436

435
STM32F070x6 devices bootloader AN2606

11.2 Bootloader selection

Figure 14 shows the bootloader selection mechanism.

Figure 14. Bootloader selection for STM32F070x6

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24, 18, 16, no

12, 8, 6, 4 MHz ?

yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

Configure I2Cx

0x7F received
yes
on USARTx

yes
no
Disable all interrupt
sources and other
interfaces clock’s
I2Cx Address
Detected yes
Disable all interrupt
Disable other sources and other Configure
interfaces clock’s interfaces clock’s USARTx
no
no

Execute DFU Execute Execute

USB cable
bootloader using USB BL_I2C_Loop for BL_USART_Loop
Detected & USB
interrupts I2Cx for USARTx
configured

MSv36794V1

64/436 AN2606 Rev 61

AN2606 STM32F070x6 devices bootloader

11.3 Bootloader version

Table 22 lists the STM32F070x6 devices bootloader versions.

Table 22. STM32F070x6 bootloader versions

Version
Description Known limitations
number

V10.2 Initial bootloader version At bootloader startup, the HSITRIM value is set to
0 (in HSITRIM bits on RCC_CR register) instead
of default value (16), as a consequence a
Clock configuration fixed deviation is generated in crystal measurement.
V10.3
to HSI 8 MHz For better results, use the smallest supported
crystal value (i.e. 4 MHz).

AN2606 Rev 61 65/436

435
STM32F070xB devices bootloader AN2606

12 STM32F070xB devices bootloader

12.1 Bootloader configuration

The STM32F070xB bootloader is activated by applying Pattern 2 (described in Table 2).
Table 23 shows the hardware resources used by this bootloader.

Table 23. STM32F070xB configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
At startup, the system clock frequency is configured to
HSI enabled 48 MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader
interfaces and must have one of the following values:
RCC HSE enabled
24, 18, 16, 12, 8, 6, 4 MHz. The PLL is used to
Common to all generate 48 MHz for USB and system clock.
bootloaders The clock security system (CSS) interrupt is enabled
- for HSE. Any failure (or removal) of the external clock
generates system reset.
6 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
12 Kbytes, starting from address 0x1FFFC800, contain
System memory -
the bootloader firmware.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
bootloader alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
pull-up mode
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 PA15 pin: USART2 in reception mode. Used in
USART2_RX pin Input
bootloader alternate push-pull, pull-up mode.
PA14 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 bootloader – Slave 7-bit address: 0b0111011x
– (where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

66/436 AN2606 Rev 61

AN2606 STM32F070xB devices bootloader

Table 23. STM32F070xB configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
PA11 pin: USB FS DM line used in alternate push-pull,
DFU bootloader USB_DM pin
no pull mode.
Input/output PA12 pin: USB FS DP line used in alternate push-pull,
USB_DP pin no pull mode.
No external pull-up resistor is required.

Note: If HSI deviation exceeds 1% the bootloader might not function correctly.
Note: After the STM32F070xB devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no more possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 8, 6, 4 MHz, the system clock is
configured to 48 MHz with HSE as clock source. The DFU interface, USART1,
USART2, and I2C1 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source and only USART1,
USART2, and I2C1 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 61 67/436

435
STM32F070xB devices bootloader AN2606

12.2 Bootloader selection

Figure 15 shows the bootloader selection mechanism.

Figure 15.Bootloader selection for STM32F070xB

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24, 18, 16, 12, 8, no

6, 4 MHz ?

yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

Configure I2Cx

0x7F received
yes
on USARTx

yes
no
Disable all interrupt
sources and other
interfaces clock’s
I2Cx Address
Detected yes
Disable all interrupt
Disable other sources and other Configure
interfaces clock’s interfaces clock’s USARTx
no
no

Execute DFU Execute Execute

USB cable
bootloader using USB BL_I2C_Loop for BL_USART_Loop
Detected & USB
interrupts I2Cx for USARTx
configured

MSv36795V1

68/436 AN2606 Rev 61

AN2606 STM32F070xB devices bootloader

12.3 Bootloader version

Table 24 lists the STM32F070xB devices bootloader versions.

Table 24. STM32F070xB bootloader versions

Version
Description Known limitations
number

V10.2 Initial bootloader version At bootloader startup, the HSITRIM value is set to
(0) (in HSITRIM bits on RCC_CR register) instead
of default value (16), as a consequence a
deviation is generated in crystal measurement.
Clock configuration fixed For better results, use the smallest supported
V10.3
to HSI 8 MHz crystal value (i.e. 4 MHz).
PA13 is set in alternate push-pull mode even if not
used by the bootloader.

AN2606 Rev 61 69/436

435
STM32F071xx/072xx devices bootloader AN2606

13 STM32F071xx/072xx devices bootloader

13.1 Bootloader configuration

The STM32F071xx/072xx bootloader is activated by applying Pattern 2 (described in
Table 2). Table 25 shows the hardware resources used by this bootloader.

Table 25. STM32F071xx/072xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with

HSI enabled
HSI48 48 MHz as clock source.
RCC The clock recovery system (CRS) is
- enabled for the DFU bootloader to allow
USB to be clocked by HSI48 48 MHz.
6 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
Common to all firmware
bootloaders
12 Kbytes, starting from address
System memory - 0x1FFFC800, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration
USART1 Enabled
is 8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized the USART2 configuration
USART2 Enabled
is 8-bit, even parity, and one stop bit
PA15 pin: USART2 in reception mode.
USART2 bootloader USART2_RX pin Input
Used in input pull-up mode
PA14 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.

70/436 AN2606 Rev 61

AN2606 STM32F071xx/072xx devices bootloader

Table 25. STM32F071xx/072xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b0111011x (where x = 0 for write
and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
pull-up mode.
PB7 pin: data line is used in open-drain
I2C1_SDA pin Input/output
pull-up mode.
USB Enabled USB used in FS mode
PA11: USB DM line. Used in alternate push-
USB_DM pin
pull, no pull mode.
DFU bootloader
Input/output PA12: USB DP line
USB_DP pin No external pull-up resistor is required.
Used in alternate push-pull, no pull mode.

Note: After the STM32F071xx/072xx devices have booted in bootloader mode using USART2, the
serial wire debug (SWD) communication is no more possible until the system is reset,
because SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

AN2606 Rev 61 71/436

435
STM32F071xx/072xx devices bootloader AN2606

13.2 Bootloader selection

Figure 16 shows the bootloader selection mechanism.

Figure 16. Bootloader selection for STM32F071xx/072xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure USB FS device

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
I2Cx Address
Detected yes interfaces clock’s interfaces clock’s

Disable other
no interfaces clock’s Execute Configure
no BL_I2C_Loop for USARTx
I2Cx
USB
Detected Execute DFU
bootloader using USB Execute
interrupts BL_USART_Loop
for USARTx

MS35026V1

13.3 Bootloader version

Table 26 lists the STM32F071xx/072xx devices bootloader versions.

Table 26. STM32F071xx/072xx bootloader versions

Version
Description Known limitations
number

At bootloader startup, the HSITRIM value is set to (0) (in

HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated in
V10.1 Initial bootloader version crystal measurement. For better results, use the smallest
supported crystal value (i.e. 4 MHz).
PA13 set in alternate push-pull, pull-up mode even if not
used by bootloader.

72/436 AN2606 Rev 61

AN2606 STM32F09xxx devices bootloader

14 STM32F09xxx devices bootloader

14.1 Bootloader configuration

The STM32F09xxx bootloader is activated by applying Pattern 6 (described in
Table 2).Table 27 shows the hardware resources used by this bootloader.

Table 27. STM32F09xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48

RCC HSI enabled
MHz as clock source.
Common to all 6 Kbytes, starting from address 0x20000000 are used
RAM -
bootloaders by the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain
System memor -
the bootloader firmware.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input
USART1_RX pin Input
bootloader pull-up mode
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-
up mode.
USART2_RX pin Input
USART2 PA15 pin: USART2 in reception mode. Used in input
bootloader pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
alternate push-pull, pull-up mode.
USART2_TX pin Output
PA14 pin: USART2 in transmission mode. Used in
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1000001x
I2C1 bootloader
(where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

Note: After the STM32F09xxx devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no longer possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).

AN2606 Rev 61 73/436

435
STM32F09xxx devices bootloader AN2606

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

14.2 Bootloader selection

Figure 17. Bootloader selection for STM32F09xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

0x7F received on Disable all interrupt

USARTx sources and other
yes interfaces clock’s
no
Disable all interrupt
Configure
sources and other
USARTx
I2Cx Address interfaces clock’s
Detected
no Execute
Execute
BL_I2C_Loop for BL_USART_Loop
I2Cx for USARTx

MSv36789V1

14.3 Bootloader version

Table 28 lists the STM32F09xxx devices bootloader versions.

Table 28. STM32F09xxx bootloader versions

Version
Description Known limitations
number

At bootloader startup, the HSITRIM value is set to (0) (in

HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated in
V5.0 Initial bootloader version crystal measurement. For better results, use the
smallest supported crystal value (i.e. 4 MHz).
PA13 set in input pull-up mode even if not used by the
bootloader.

74/436 AN2606 Rev 61

AN2606 STM32F10xxx devices bootloader

15 STM32F10xxx devices bootloader

15.1 Bootloader configuration

The STM32F10xxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 29 shows the hardware resources used by this bootloader.

Table 29. STM32F10xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz using the PLL.
512 byte starting from address 0x20000000 are used
RAM -
by the bootloader firmware.
2 Kbytes, starting from address 0x1FFFF000 contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum
value and is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
USART1 enabled by the user).
bootloader
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output push-pull
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from
SysTick timer Enabled
the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

AN2606 Rev 61 75/436

435
STM32F10xxx devices bootloader AN2606

15.2 Bootloader selection

Figure 18 shows the bootloader selection mechanism.

Figure 18. Bootloader selection for STM32F10xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

No
Yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35004V1

15.3 Bootloader version

Table 30 lists the STM32F10xxx devices bootloader versions:

Table 30. STM32F10xxx bootloader versions

Version number Description

V2.0 Initial bootloader version

– Updated Go Command to initialize the main stack pointer
– Updated Go command to return NACK when jump address is in the Option byte
V2.1 area or System memory area
– Updated Get ID command to return the device ID on two bytes
– Update the bootloader version to V2.1
– Updated Read Memory, Write Memory and Go commands to deny access with
a NACK response to the first 0x200 bytes of RAM used by the bootloader
V2.2
– Updated Readout Unprotect command to initialize the whole RAM content to
0x0 before ROP disable operation

76/436 AN2606 Rev 61

AN2606 STM32F10xxx devices bootloader

Note: The bootloader ID format is applied to all STM32 devices families except the STM32F1xx
family. The bootloader version for the STM32F1xx applies only to the embedded device’s
bootloader version and not to its supported protocols.

AN2606 Rev 61 77/436

435
STM32F105xx/107xx devices bootloader AN2606

16 STM32F105xx/107xx devices bootloader

16.1 Bootloader configuration

The STM32F105xx/107xx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 31 shows the hardware resources used by this bootloader.

Table 31. STM32F105xx/107xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using the PLL.

This is used only for USARTx bootloaders and during
HSI enabled CAN2, USB detection for CAN and DFU bootloaders
(once CAN or DFU bootloader is selected, the clock
source is derived from the external crystal).
The external clock is mandatory only for DFU and CAN
bootloaders and it must provide one of the following
frequencies: 8 MHz, 14.7456 MHz or 25 MHz.
RCC
For CAN bootloader, the PLL is used only to generate
HSE enabled
48 MHz when 14.7456 MHz is used as HSE.
For DFU bootloader, the PLL is used to generate a
48 MHz system clock from all supported external clock
Common to all frequencies.
bootloaders
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external
clock will generate system reset.
4 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware.
18 Kbytes, starting from address 0x1FFFB000 contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset
IWDG -
(if the hardware IWDG option was previously enabled by
the user).
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
Output push- PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin
pull no pull mode.
Once initialized, the USART2 configuration is 8 bits,
USART2 Enabled even parity, and one stop bit. The USART2 uses its
remapped pins.
USART2
bootloader USART2_RX pin Input PD6 pin: USART2 receive (remapped pin)
Output push-
USART2_TX pin PD5 pin: USART2 transmit (remapped pin)
pull

78/436 AN2606 Rev 61

AN2606 STM32F105xx/107xx devices bootloader

Table 31. STM32F105xx/107xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USARTx Used to automatically detect the serial baud rate from

SysTick timer Enabled
bootloaders the host for USARTx bootloader.
Once initialized, the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during the CAN bootloader
execution because CAN1 manages the communication
CAN2 between CAN2 and SRAM.
bootloader
PB5 pin: CAN2 receives (remapped pin). Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
Output push- PB6 pin: CAN2 transmits (remapped pin). Used in input
CAN2_TX pin
pull no pull mode.
USB Enabled USB OTG FS configured in forced device mode
USB_VBUS pin Input PA9: Power supply voltage line
DFU
bootloader USB_DM pin PA11 pin: USB_DM line
Input/output PA12 pin: USB_DP line.
USB_DP pin
No external pull-up resistor is required

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU and CAN bootloaders, but only for the
selection phase. An external clock (8, 14.7456, or 25 MHz) is required for DFU and CAN
bootloader execution after the selection phase.

AN2606 Rev 61 79/436

435
STM32F105xx/107xx devices bootloader AN2606

16.2 Bootloader selection

Figure 19 shows the bootloader selection mechanism.

Figure 19. Bootloader selection for STM32F105xx/107xx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

USB cable
yes
Detected

no yes
Disable all
interrupt sources HSE= 8MHz,
no 0x7F received on
USARTx 14.7456MHz or
Configure 25 MHz
USARTx
no
yes
Frame detected on Execute
CANx BL_USART_Loop
Reconfigure System
for USARTx
clock to 48MHz and
yes USB clock to 48 MHz

HSE= 8MHz, Execute DFU

no bootloader using USB
14.7456MHz or no
25 MHz interrupts

Generate System
yes
reset
Reconfigure System
clock to 48MHz

Disable all
interrupt sources

Configure CAN

Execute
BL_CAN_Loop for
CANx
MS35005V1

80/436 AN2606 Rev 61

AN2606 STM32F105xx/107xx devices bootloader

16.3 Bootloader version

Table 32 lists the STM32F105xx/107xx devices bootloader versions:

Table 32. STM32F105xx/107xx bootloader versions

Version number Description

V1.0 Initial bootloader version

– Bootloader detection mechanism updated to fix the issue when GPIOs of
unused peripherals in this bootloader are connected to low level or left floating
during the detection phase.
For more details refer to Section 16.3.2.
– Vector table set to 0x1FFFB000 instead of 0x00000000
– Go command updated (for all bootloaders): USART1, USART2, CAN2,
V2.0
GPIOA, GPIOB, GPIOD and SysTick peripheral registers are set to their
default reset values
– DFU bootloader: USB pending interrupt cleared before executing the Leave
DFU command
– DFU subprotocol version changed from V1.0 to V1.2
– Bootloader version updated to V2.0
– Fixed PA9 excessive consumption described in Section 16.3.4.
– Get-Version command (defined in AN3155) corrected. It returns 0x22 instead
V2.1
of 0x20 in bootloader V2.0. Refer to Section 16.3.3 for more details.
– Bootloader version updated to V2.1
– Fixed DFU option bytes descriptor (set to ‘e’ instead of ‘g’ because it is
read/write and not erasable).
V2.2 – Fixed DFU polling timings for flash Read/Write/Erase operations.
– Robustness enhancements for DFU bootloader interface.
– Updated bootloader version to V2.2.

Note: The bootloader ID format is applied to all STM32 devices families except the STM32F1xx
family. The bootloader version for the STM32F1xx applies only to the embedded device’s
bootloader version and not to its supported protocols.

16.3.1 How to identify STM32F105xx/107xx bootloader versions

Bootloader V1.0 is implemented on devices whose date code is lower than 937 (refer to
STM32F105xx and STM32F107xx datasheet to find the date code on the device marking).
Bootloader V2.0 and V2.1 are implemented on devices with a date code higher than or
equal to 937.
Bootloader V2.2 is implemented on devices with a date code higher than or equal to 227.
There are two ways to distinguish between bootloader versions:
• When using the USART bootloader, the Get-Version command defined in AN2606 and
AN3155 has been corrected in V2.1 version. It returns 0x22 instead of 0x20 as in
bootloader V2.0.

AN2606 Rev 61 81/436

435
STM32F105xx/107xx devices bootloader AN2606

• The values of the vector table at the beginning of the bootloader code are different. The
user software (or via JTAG/SWD) reads 0x1FFFE945 at address 0x1FFFB004 for
bootloader V2.0 0x1FFFE9A1 for bootloader V2.1, and 0x1FFFE9C1 for bootloader
V2.2.
• The DFU version is the following:
– V2.1 in bootloader V2.1
– V2.2 in bootloader V2.2.
It can be read through the bcdDevice field of the DFU Device Descriptor.

16.3.2 Bootloader unavailability on STM32F105xx/STM32F107xx devices

with date code lower than 937
Description
The bootloader cannot be used if the USART1_RX (PA10), USART2_RX (PD6, remapped),
CAN2_Rx (PB5, remapped), OTG_FS_DM (PA11), and/or OTG_FS_DP (PA12) pin(s) are
held low or left floating during the bootloader activation phase.
The bootloader cannot be connected through CAN2 (remapped), DFU (OTG FS in Device
mode), USART1 or USART2 (remapped).
On 64-pin packages, the USART2_RX signal remapped PD6 pin is not available and it is
internally grounded. In this case, the bootloader cannot be used at all.

Workaround
• For 64-pin packages
None. The bootloader cannot be used.
• For 100-pin packages
Depending on the used peripheral, the pins for the unused peripherals must be kept at
a high level during the bootloader activation phase as described below:
– If USART1 is used to connect to the bootloader, PD6 and PB5 must be kept at a
high level.
– If USART2 is used to connect to the bootloader, PA10, PB5, PA11, and PA12 must
be kept at a high level.
– If CAN2 is used to connect to the bootloader, PA10, PD6, PA11, and PA12 must be
kept at a high level.
– If DFU is used to connect to the bootloader, PA10, PB5, and PD6 must be kept at
a high level.
Note: This limitation applies only to STM32F105xx and STM32F107xx devices with a date code
lower than 937. STM32F105xx and STM32F107xx devices with a date code higher or equal
to 937 are not impacted. See STM32F105xx and STM32F107xx datasheets for where to
find the date code on the device marking.

82/436 AN2606 Rev 61

AN2606 STM32F105xx/107xx devices bootloader

16.3.3 USART bootloader Get-Version command returns 0x20

instead of 0x22
Description
In USART mode, the Get-Version command (defined in AN3155) returns 0x20 instead of
0x22. This limitation is present on bootloader versions V1.0 and V2.0, while it is fixed in
bootloader version 2.1.

Workaround
None.

16.3.4 PA9 excessive power consumption when USB cable is plugged

in bootloader V2.0
Description
When connecting a USB cable after booting from System-Memory mode, PA9 pin
(connected to VBUS = 5 V) is also shared with USART TX pin, configured as alternate
push-pull and forced to 0 since the USART peripheral is not yet clocked. As a consequence,
a current higher than 25 mA is drained by PA9 I/O and may affect the I/O pad reliability.
This limitation is fixed in bootloader version 2.1 by configuring PA9 as alternate function
push-pull when a correct 0x7F is received on RX pin and the USART is clocked. Otherwise,
PA9 is configured as alternate input floating.

Workaround
None.

AN2606 Rev 61 83/436

435
STM32F10xxx XL-density devices bootloader AN2606

17 STM32F10xxx XL-density devices bootloader

17.1 Bootloader configuration

The STM32F10xxx XL-density bootloader is activated by applying Pattern 3 (described in
Table 2). Table 33 shows the hardware resources used by this bootloader.

Table 33. STM32F10xxx XL-density configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz

RCC HSI enabled
using the PLL.
2 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.

Common to all 6 Kbytes, starting from address

bootloaders System memory - 0x1FFFE000 contain the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output push-pull
Used in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration
USART2 Enabled
is 8 bits, even parity, and one stop bit.
PD6 pin: USART2 receives (remapped
USART2_RX pin Input
USART2 bootloader pins). Used in input pull-up mode.
PD5 pin: USART2 transmits (remapped
USART2_TX pin Output push-pull pins). Used in alternate push-pull, pull-up
mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

84/436 AN2606 Rev 61

AN2606 STM32F10xxx XL-density devices bootloader

17.2 Bootloader selection

Figure 20. Bootloader selection for STM32F10xxx XL-density devices

System Reset

BFB2 bit reset

(BFB2 = 0)

yes

If Value
@0x08080000 is
yes
within int. SRAM
address Jump to user code
in Bank2
no no

If Value
@0x08000000 is
yes
within int. SRAM
address Jump to user code
in Bank1
no

Continue Bootloader execution

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)
yes Configure
USARTx

0x7F received on Execute

USARTx BL_USART_Loop
for USARTx

no
MS35006V1

17.3 Bootloader version

Table 34. STM32F10xxx XL-density bootloader versions
Version number Description

V2.1 Initial bootloader version

Note: The bootloader ID format is applied to all STM32 devices families except the STM32F1xx
family. The bootloader version for the STM32F1xx applies only to the embedded device
bootloader version and not to its supported protocols.

AN2606 Rev 61 85/436

435
STM32F2xxxx devices bootloader AN2606

18 STM32F2xxxx devices bootloader

Two bootloader versions are available on STM32F2xxxx devices:

• V2.x supporting USART1 and USART3
This version is embedded in revisions A, Z, and B
• V3.x supporting USART1, USART3, CAN2, and DFU (USB FS device)
This version is embedded in all other revisions (Y, X, W, 1, V, 2, 3, and 4)

18.1 Bootloader V2.x

18.1.1 Bootloader configuration

The STM32F2xxxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 35 shows the hardware resources used by this bootloader.

Table 35. STM32F2xxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz.

RAM - 8 Kbytes, starting from address 0x20000000.
29 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum
Common to all value and is periodically refreshed to prevent
IWDG -
bootloaders watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in byte
Power - format (Half-Word, Word and Double-Word operations
are not allowed). The voltage range can be configured
in run time using bootloader commands.
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
USART1 bootloader
USART1_RX pin Input PA10 pin: USART1 in reception mode
USART1_TX pin Output PA9 pin: USART1 in transmission mode
Once initialized, the USART3 configuration is 8 bits,
USART3 Enabled
even parity, and one stop bit.
USART3 bootloader
(on PC10/PC11) USART3_RX pin Input PC11 pin: USART3 in reception mode
USART3_TX pin Output PC10 pin: USART3 in transmission mode

86/436 AN2606 Rev 61

AN2606 STM32F2xxxx devices bootloader

Table 35. STM32F2xxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART3 configuration is 8 bits,

USART3 Enabled
even parity, and one stop bit
USART3 bootloader
(on PB10/PB11) USART3_RX pin Input PB11 pin: USART3 in reception mode
USART3_TX pin Output PB10 pin: USART3 in transmission mode
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader code.

18.1.2 Bootloader selection

Figure 21 shows the bootloader selection mechanism.

Figure 21. Bootloader V2.x selection for STM32F2xxxx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35010V1

AN2606 Rev 61 87/436

435
STM32F2xxxx devices bootloader AN2606

18.1.3 Bootloader version

Table 36 lists the STM32F2xxxx devices V2.x bootloader versions:

Table 36. STM32F2xxxx bootloader V2.x versions

Version
Description Known limitations
number

When a Read Memory command or Write Memory command is

issued with an unsupported memory address and a correct address
checksum (i.e. address 0x6000 0000), the command is aborted by
the bootloader device, but the NACK (0x1F) is not sent to the host.
Initial bootloader As a result, the next 2 bytes (which are the number of bytes to be
V2.0
version read/written and its checksum) are considered as a new command
and its checksum.
For the CAN interface, the Write Unprotect command is not
functional. Use Write Memory command and write directly to the
option bytes in order to disable the write protection.(1)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as
the command is NACKed anyway (as an unsupported new command).

88/436 AN2606 Rev 61

AN2606 STM32F2xxxx devices bootloader

18.2 Bootloader V3.x

18.2.1 Bootloader configuration

The STM32F2xxxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 37 shows the hardware resources used by this bootloader.

Table 37. STM32F2xxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using the PLL.

The HSI clock source is used at startup (interface
HSI enabled detection phase) and when USARTx interfaces are
selected (once CAN or DFU bootloader is selected, the
clock source is derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the CAN or the
HSE enabled DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple of
1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external
Common to all clock generates system reset.
bootloaders 8 Kbytes, starting from address 0x20000000 are used
RAM -
by the bootloader firmware.
29 Kbytes, starting from address 0x1FF00000 contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Voltage range is set to 1.62 V, 2.1 V. In this range
internal flash write operations are allowed only in byte
Power - format (half-word, word and double-word operations are
not allowed). The voltage range can be configured in run
time using bootloader commands.
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in no pull
USART1_TX pin Output
mode.
Once initialized, the USART3 configuration is 8 bits,
USART3 Enabled
even parity, and one stop bit.
USART3
PB11 pin: USART3 in reception mode. Used in pull-up
bootloader (on USART3_RX pin Input
mode
PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in pull-
USART3_TX pin Output
up mode

AN2606 Rev 61 89/436

435
STM32F2xxxx devices bootloader AN2606

Table 37. STM32F2xxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART3 configuration is 8 bits,

USART3 Enabled
even parity, and one stop bit.
USART3
PC11 pin: USART3 in reception mode. Used in pull-up
bootloader (on USART3_RX pin Input
mode.
PC10/PC11)
PC10 pin: USART3 in transmission mode. Used in pull-
USART3_TX pin Output
up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
Once initialized, the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the communication
CAN2 between CAN2 and SRAM.
bootloader
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in
CAN2_TX pin Output
alternate push-pull, pull-up mode.
USB Enabled USB OTG FS configured in forced device mode
USB_DM pin PA11: USB DM line. Used in input no pull mode.
DFU bootloader
Input/output PA12: USB DP line. Used in inpt no pull mode.
USB_DP pin
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once the HSE frequency is determined, the system
bootloaders
clock is configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but only for
the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.

90/436 AN2606 Rev 61

AN2606 STM32F2xxxx devices bootloader

18.2.2 Bootloader selection

Figure 22 shows the bootloader selection mechanism.

Figure 22. Bootloader V3.x selection for STM32F2xxxx devices

System Reset

yes Disable all

System Init (Clock, GPIOs,
interrupt sources
IWDG, SysTick)

Configure
Configure USB OTG FS
USARTx
device

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx

yes
no

Frame detected HSE detected

no
on CANx pin yes

yes

no no HSE detected no Disable all

interrupt sources
Generate System
USB cable
Yes reset Reconfigure System
Detected
clock to 60MHz
Reconfigure System
clock to 60MHz and
Configure CAN
USB clock to 48 MHz

Execute
Execute DFU BL_CAN_Loop for
bootloader using USB CANx
interrupts

MS35011V1

AN2606 Rev 61 91/436

435
STM32F2xxxx devices bootloader AN2606

18.2.3 Bootloader version

Table 38 lists the STM32F2xxxx devices V3.x bootloader versions:

Table 38. STM32F2xxxx bootloader V3.x versions

Version
Description Known limitations
number

– When a Read Memory command or Write Memory

command is issued with an unsupported memory
address and a correct address checksum (i.e. address
0x6000 0000), the command is aborted by the bootloader
device, but the NACK (0x1F) is not sent to the host. As a
V3.2 Initial bootloader version result, the next 2 bytes (which are the number of bytes to
be read/written and its checksum) are considered as a
new command and its checksum(1).
– Option bytes, OTP and Device Feature descriptors (in
DFU interface) are set to “g” instead of “e” (not erasable
memory areas).
– For the USART interface, two consecutive NACKs
(instead of 1 NACK) are sent when a Read Memory or
Write Memory command is sent and the RDP level is
Fix V3.2 limitations. DFU
active.
V3.3 interface robustness
enhancement – For the CAN interface, the Write Unprotect command is
not functional. Use Write Memory command and write
directly to the option bytes in order to disable the write
protection.
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as
the command is NACKed anyway (as an unsupported new command).

92/436 AN2606 Rev 61

AN2606 STM32F301xx/302x4(6/8) devices bootloader

19 STM32F301xx/302x4(6/8) devices bootloader

19.1 Bootloader configuration

The STM32F301xx/302x4(6/8) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 39 shows the hardware resources used by this bootloader.
Table 39. STM32F301xx/302x4(6/8) configuration in system memory boot mode
Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with

HSI enabled
HSI48 48 MHz as clock source.
The external clock can be used for all
bootloader interfaces and must have one
the following values:
HSE enabled 24,18,16,12,9,8,6,4,3 MHz.
RCC
The PLL is used to generate the USB48
MHz clock and the 48 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU
- bootloader. Any failure (or removal) of the
Common to all external clock generates system reset.
bootloaders
6 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware
8 Kbytes, starting from address
System memory - 0x1FFFD800, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration
USART1 Enabled
is 8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized the USART2 configuration
USART2 Enabled
is 8-bit, even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used
USART2 bootloader USART2_RX pin Input
in alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.

AN2606 Rev 61 93/436

435
STM32F301xx/302x4(6/8) devices bootloader AN2606

Table 39. STM32F301xx/302x4(6/8) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-
USB_DM pin
pull, no pull mode.
DFU bootloader
Input/output PA12: USB DP line. Used in alternate push-
pull, no pull mode.
USB_DP pin
An external pull-up resistor 1.5 KΩ must be
connected to USB_DP pin.

The bootloader has two casess of operation, depending upon the presence of the external
clock (HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4, or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

94/436 AN2606 Rev 61

AN2606 STM32F301xx/302x4(6/8) devices bootloader

19.2 Bootloader selection

Figure 23 shows the bootloader selection mechanism.

Figure 23. Bootloader selection for STM32F301xx/302x4(6/8)

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24,
18, 16, 12, 9, 8, 6, 4, no
3 MHz ?

Yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

IWDG, SysTick) System Init (Clock, GPIOs,
IWDG, SysTick)

Configure USB FS device

yes
USB cable
Detected & USB
configured Disable all interrupt
yes
sources and other
interfaces clock’s Disable other
no interfaces clock’s
Configure
USARTx
0x7F received on
Execute DFU
USARTx
no Execute bootloader using USB
BL_USART_Loop interrupts
for USARTx
MS35027V1

19.3 Bootloader version

Table 40 lists the STM32F301xx/302x4(6/8) devices bootloader versions:

Table 40. STM32F301xx/302x4(6/8) bootloader versions

Version number Description Known limitations

V4.0 Initial bootloader version None

AN2606 Rev 61 95/436

435
STM32F302xB(C)/303xB(C) devices bootloader AN2606

20 STM32F302xB(C)/303xB(C) devices bootloader

20.1 Bootloader configuration

The STM32F302xB(C)/303xB(C) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 41 shows the hardware resources used by this bootloader.

Table 41. STM32F302xB(C)/303xB(C) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

At startup, the system clock frequency is configured to 48

HSI enabled MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader
interfaces and must have one the following values: 24,
RCC HSE enabled 18,16, 12, 9, 8, 6, 4, 3 MHz.
The PLL is used to generate the USB 48 MHz clock and
the 48 MHz clock for the system clock.
The CSS interrupt is enabled for the DFU bootloader.
Common to all - Any failure (or removal) of the external clock generates
bootloaders system reset.
5 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled parity, and one stop bit. The USART2 uses its remapped
pins.
USART2
PD6 pin: USART2 in reception mode. Used in alternate
bootloader USART2_RX pin Input
push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloader.

96/436 AN2606 Rev 61

AN2606 STM32F302xB(C)/303xB(C) devices bootloader

Table 41. STM32F302xB(C)/303xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
bootloader Input/output PA12: USB DP line. Used in alternate push-pull, no pull
mode.
USB_DP pin
An external pull-up resistor 1.5 KΩ must be connected to
USB_DP pin.

The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4 or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 61 97/436

435
STM32F302xB(C)/303xB(C) devices bootloader AN2606

20.2 Bootloader selection

Figure 24 shows the bootloader selection mechanism.

Figure 24. Bootloader selection for STM32F302xB(C)/303xB(C) devices

System Reset

Configure System clock to

48MHz using HSI

HSE = 24, 18, 16, 12, 9,

8, 6, 4, 3 MHz
no

yes

Reconfigure System clock

to 48MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

yes

USB configured
and cable Detected yes Execute DFU
Disable all bootloader using USB
interrupt sources interrupts
no
Configure
0x7F received USARTx
no on USARTx

Execute
BL_USART_Loop
for USARTx

MS350

20.3 Bootloader version

Table 42 lists the STM32F302xB(C)/303xB(C) devices bootloader versions.

Table 42. STM32F302xB(C)/303xB(C) bootloader versions

Version number Description Known limitations

V4.1 Initial bootloader version None

98/436 AN2606 Rev 61

AN2606 STM32F302xD(E)/303xD(E) devices bootloader

21 STM32F302xD(E)/303xD(E) devices bootloader

21.1 Bootloader configuration

The STM32F302xD(E)/303xD(E) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 43 shows the hardware resources used by this bootloader.

Table 43.STM32F302xD(E)/303xD(E) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 48 MHz with HSI48 48 MHz
HSI enabled
as clock source.
The external clock can be used for all bootloader
interfaces and must have one the following values: 24, 18,
HSE enabled 16, 12, 9, 8, 6, 4, 3 MHz.
RCC
The PLL is used to generate the USB 48 MHz clock and
the 48 MHz clock for the system clock.
The CSS interrupt is enabled for the DFU bootloader. Any
Common to all - failure (or removal) of the external clock generates system
bootloaders reset.
6 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.

AN2606 Rev 61 99/436

435
STM32F302xD(E)/303xD(E) devices bootloader AN2606

Table 43.STM32F302xD(E)/303xD(E) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
PA11 pin: USB FS DM line. Used in alternate push-pull, no
USB_DM pin
DFU bootloader pull mode.

Input/output PA12 pin: USB FS DP line. Used in alternate push-pull, no

pull mode.
USB_DP pin
An external pull-up resistor 1.5 KΩ must be connected to
USB_DP pin.

The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4 or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

100/436 AN2606 Rev 61

AN2606 STM32F302xD(E)/303xD(E) devices bootloader

21.2 Bootloader selection

Figure 25. Bootloader selection for STM32F302xD(E)/303xD(E)

System Reset

Configure System clock to

48 MHz using HSI

HSE = 24, 18, 16,

12, 9, 8, 6, 4, 3 no
MHz?

yes
Reconfigure System clock to
48 MHz using HSE
System Init (Clock, GPIOs,
IWDG, SysTick)

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB FS device

USB cable
detected & USB yes
configured yes

Disable all interrupt

no sources and other
interfaces clock’s

Disable other
Configure USARTx interfaces clock’s
0x7F received on
no USARTx
Execute Execute DFU
BL_USART_Loop for bootloader using USB
USARTx interrupts

MSv36790V1

21.3 Bootloader version

Table 44. STM32F302xD(E)/303xD(E) bootloader versions
Version number Description Known limitations

V4.0 Initial bootloader version None

AN2606 Rev 61 101/436

435
STM32F303x4(6/8)/334xx/328xx devices bootloader AN2606

22 STM32F303x4(6/8)/334xx/328xx devices bootloader

22.1 Bootloader configuration

The STM32F303x4(6/8)/334xx/328xx bootloader is activated by applying Pattern 2
(described in Table 2). Table 45 shows the hardware resources used by this bootloader.

Table 45. STM32F303x4(6/8)/334xx/328xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz with HSI 8 MHz

RCC HSI enabled
as clock source.
6 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all 8 Kbytes, starting from address 0x1FFFD800, contain
bootloaders System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
analog filter ON. Slave 7-bit address: 0b0111111x (where
I2C1
x = 0 for write and x = 1 for read)
bootloader
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

102/436 AN2606 Rev 61

AN2606 STM32F303x4(6/8)/334xx/328xx devices bootloader

22.2 Bootloader selection

Figure 26 shows the bootloader selection mechanism.

Figure 26. Bootloader selection for STM32F303x4(6/8)/334xx/328xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx
no

MS35029V2

22.3 Bootloader version

Table 46 lists the STM32F303x4(6/8)/334xx/328xx devices bootloader versions:

Table 46. STM32F303x4(6/8)/334xx/328xx bootloader versions

Version number Description Known limitations

V5.0 Initial bootloader version None

AN2606 Rev 61 103/436

435
STM32F318xx devices bootloader AN2606

23 STM32F318xx devices bootloader

23.1 Bootloader configuration

The STM32F318xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 47 shows the hardware resources used by this bootloader.

Table 47. STM32F318xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz with HSI 8 MHz as

RCC HSI enabled
clock source.
6 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all 8 Kbytes, starting from address 0x1FFFD800, contain the
bootloaders System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value,
and periodically refreshed to prevent a reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
analog filter ON. Slave 7-bit address: 0b0111101x (where
I2C1 bootloader x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

104/436 AN2606 Rev 61

AN2606 STM32F318xx devices bootloader

Table 47. STM32F318xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled
analog filter ON. Slave 7-bit address: 0b0111101x (where
I2C3 bootloader x = 0 for write and x = 1 for read) and digital filter disabled.
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PB5 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

23.2 Bootloader selection

Figure 27. Bootloader selection for STM32F318xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx
no

MS35028V2

23.3 Bootloader version

Table 48. STM32F318xx bootloader versions
Version number Description Known limitations

V5.0 Initial bootloader version None

AN2606 Rev 61 105/436

435
STM32F358xx devices bootloader AN2606

24 STM32F358xx devices bootloader

24.1 Bootloader configuration

The STM32F358xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 49 shows the hardware resources used by this bootloader.

Table 49. STM32F358xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 8 MHz using the

RCC HSI enabled
HSI.
5 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware.

Common to all 8 Kbytes, starting from address 0x1FFFD800,

System memory -
bootloaders contains the bootloader firmware.
The IWDG prescaler is configured to its maximum
value and is periodically refreshed to prevent
IWDG - watchdog reset (if the hardware IWDG option was
previously enabled by the user). Window feature is
disabled.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8
USART2 Enabled bits, even parity, and one stop bit. The USART2
uses its remapped pins.
USART2 bootloader PD6 pin: USART2 in reception mode. Used in
USART2_RX pin Input
alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloaders SysTick timer Enabled
from the host for USARTx bootloader.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON. Slave 7-bit address:
0b0110111x (where x = 0 for write and x = 1 for
read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

106/436 AN2606 Rev 61

AN2606 STM32F358xx devices bootloader

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

24.2 Bootloader selection

Figure 28 shows the bootloader selection mechanism.

Figure 28. Bootloader selection for STM32F358xx devices

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx
no

MS35019V2

24.3 Bootloader version

Table 50 lists the STM32F358xx devices bootloader versions.
Table 50. STM32F358xx bootloader versions
Version number Description Known limitations

For USART1 and USART2 interfaces, the maximum

V5.0 Initial bootloader version
baudrate supported by the bootloader is 57600 baud.

AN2606 Rev 61 107/436

435
STM32F373xx devices bootloader AN2606

25 STM32F373xx devices bootloader

25.1 Bootloader configuration

The STM32F373xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 51 shows the hardware resources used by this bootloader.

Table 51. STM32F373xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

At startup, the system clock frequency is configured to

HSI enabled 48 MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader interfaces
and must have one the following values: 24, 18, 16, 12, 9, 8,
RCC HSE enabled 6, 4, 3 MHz.
The PLL is used to generate the USB 48 MHz clock and the
48 MHz clock for the system clock.
Common to The CSS interrupt is enabled for the DFU bootloader. Any
all - failure (or removal) of the external clock generates system
bootloaders reset.
5 Kbytes, starting from address 0x20000000 are used by the
RAM -
bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value and
IWDG - is periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled
parity, and one stop bit. The USART2 uses its remapped pins.
USART2 PD6 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the host
SysTick timer Enabled
bootloaders for USARTx bootloader.

108/436 AN2606 Rev 61

AN2606 STM32F373xx devices bootloader

Table 51. STM32F373xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
DFU mode.
bootloader Input/output PA12: USB DP line. Used in alternate push-pull, no pull mode.
USB_DP pin An external pull-up resistor 1.5 KΩ must be connected to
USB_DP pin.

There are two operation modes, depending upon the presence of the external clock (HSE)
at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4, or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
Note: The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 61 109/436

435
STM32F373xx devices bootloader AN2606

25.2 Bootloader selection

Figure 29 shows the bootloader selection mechanism.

Figure 29. Bootloader selection for STM32F373xx devices

System Reset

Configure System clock to

48MHz using HSI

HSE = 24,
18, 16, 12, 9, 8, 6, 4,
3 MHz
no

yes

Reconfigure System clock

to 48MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

yes

USB configured
and cable Detected Execute DFU
yes Disable all bootloader using USB
interrupt sources interrupts
no
Configure
0x7F received USARTx
no on USARTx

Execute
BL_USART_Loop
for USARTx

MS35016V4

25.3 Bootloader version

Table 52 lists the STM32F373xx devices bootloader versions.

Table 52. STM32F373xx bootloader versions

Version number Description Known limitations

V4.1 Initial bootloader version None

110/436 AN2606 Rev 61

AN2606 STM32F378xx devices bootloader

26 STM32F378xx devices bootloader

26.1 Bootloader configuration

The STM32F378xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 53 shows the hardware resources used by this bootloader.

Table 53. STM32F378xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 8 MHz using the

RCC HSI enabled
HSI.
4 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware.

Common to all 8 Kbytes, starting from address 0x1FFFD800,

System memory -
bootloaders contains the bootloader firmware
The IWDG prescaler is configured to its maximum
value and is periodically refreshed to prevent
IWDG - watchdog reset (if the hardware IWDG option was
previously enabled by the user). Window feature is
disabled.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8
USART2 Enabled bits, even parity, and one stop bit. The USART2
uses its remapped pins.
USART2 bootloader PD6 pin: USART2 in reception mode. Used in
USART2_RX pin Input
alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate
SysTick timer Enabled
bootloaders from the host for USARTx bootloader.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON. Slave 7-bit address:
0b0110111x (where x = 0 for write and x = 1 for
read).
I2C1 bootloader
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

AN2606 Rev 61 111/436

435
STM32F378xx devices bootloader AN2606

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

26.2 Bootloader selection

Figure 30 shows the bootloader selection mechanism.

Figure 30. Bootloader selection for STM32F378xx devices

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx
no

MS35018V2

26.3 Bootloader version

Table 54 lists the STM32F378xx devices bootloader versions.
Table 54. STM32F378xx bootloader versions
Version number Description Known limitations

For USART1 and USART2 interfaces, the maximum

V5.0 Initial bootloader version
baudrate supported by the bootloader is 57600 baud.

112/436 AN2606 Rev 61

AN2606 STM32F398xx devices bootloader

27 STM32F398xx devices bootloader

27.1 Bootloader configuration

The STM32F398xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 55 shows the hardware resources used by this bootloader.

Table 55.STM32F398xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz with HSI 8 MHz as
RCC HSI enabled
clock source.
6 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all 7 Kbytes, starting from address 0x1FFFD800, contain the
bootloaders System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
I2C1 analog filter ON. Slave 7-bit address: 0b1000000x
bootloader (where x = 0 for write and x = 1 for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled
I2C3 analog filter ON. Slave 7-bit address: 0b1000000x
bootloader (where x = 0 for write and x = 1 for read).
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PB5 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 61 113/436

435
STM32F398xx devices bootloader AN2606

27.2 Bootloader selection

Figure 31 shows the bootloader selection mechanism.

Figure 31.Bootloader selection for STM32F398xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received yes

on USARTx

Disable all interrupt

sources and other
yes
no interfaces clock’s
Disable other
interfaces clock’s Configure USARTx
I2Cx Address
no Detected
Execute
Execute BL_I2C_Loop
BL_USART_Loop
for I2Cx
for USARTx

MSv36791V1

27.3 Bootloader version

Table 56 lists the STM32F398xx devices bootloader versions.

Table 56. STM32F398xx bootloader versions

Version number Description Known limitations

V5.0 Initial bootloader version None

114/436 AN2606 Rev 61

AN2606 STM32F40xxx/41xxx devices bootloader

28 STM32F40xxx/41xxx devices bootloader

28.1 Bootloader V3.x

28.1.1 Bootloader configuration

The STM32F40xxx/41xxx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 57 shows the hardware resources used by this bootloader.

Table 57. STM32F40xxx/41xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz

using the PLL.
The HSI clock source is used at startup
HSI enabled (interface detection phase) and when
USARTx interfaces are selected (once CAN
or DFU bootloader is selected, the clock
source is derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when
the CAN or the DFU (USB FS device)
HSE enabled interfaces are selected.
The external clock must provide a
frequency multiple of 1 MHz and ranging
from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN
and DFU bootloaders. Any failure (or
-
removal) of the external clock generates
Common to all system reset.
bootloaders
8 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
29 Kbytes, starting from address 0x1FFF
System memory -
0000 contain the bootloader firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the
user).
Voltage range is set to [1.62 V, 2.1 V]. In
this range internal flash write operations are
allowed only in byte format (Half-Word,
Power - Word and Double-Word operations are not
allowed). The voltage range can be
configured in run time using bootloader
commands.

AN2606 Rev 61 115/436

435
STM32F40xxx/41xxx devices bootloader AN2606

Table 57. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART1 configuration

USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode
Once initialized, the USART3 configuration
USART3 Enabled
is 8 bits, even parity, and one stop bit.
USART3 bootloader PB11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PB10/PB11) Used in input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized, the USART3 configuration
USART3 Enabled
is 8 bits, even parity, and one stop bit.
USART3 bootloader PC11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PC10/PC11) used in input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
used in input pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.
Once initialized, the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because CAN1
manages the communication between
CAN2 bootloader CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode.
CAN2_TX pin Output
Used in alternate push-pull, pull-up mode.
USB OTG FS configured in forced device
USB Enabled
mode
PA11: USB DM line. Used in alternate
USB_DM pin
DFU bootloader push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate push-
USB_DP pin pull, no pull mode.
No external pull-up resistor is required
This timer is used to determine the value of
CAN2 and DFU the HSE. Once the HSE frequency is
TIM11 Enabled
bootloaders determined, the system clock is configured
to 60 MHz using PLL and HSE.

116/436 AN2606 Rev 61

AN2606 STM32F40xxx/41xxx devices bootloader

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but only for
the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystals (low frequency values are better detected due to
larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

28.1.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 32. Bootloader V3.x selection for STM32F40xxx/41xxx devices

System Reset

yes Disable all

System Init (Clock, GPIOs,
interrupt sources
IWDG, SysTick)

Configure
Configure USB OTG FS
USARTx
device

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx

yes
no

Frame detected HSE detected

no
on CANx pin yes

yes

no no HSE detected no Disable all

interrupt sources
Generate System
USB cable
yes reset Reconfigure System
Detected
clock to 60MHz
Reconfigure System
clock to 60MHz and
Configure CAN
USB clock to 48 MHz

Execute
Execute DFU BL_CAN_Loop for
bootloader using USB CANx
interrupts

MS35012V3

AN2606 Rev 61 117/436

435
STM32F40xxx/41xxx devices bootloader AN2606

28.1.3 Bootloader version

Table 58 lists the STM32F40xxx/41xxx devices V3.x bootloader versions:

Table 58. STM32F40xxx/41xxx bootloader V3.x versions

Version
Description Known limitations
number

– When a Read Memory command or Write Memory

command is issued with an unsupported memory
address and a correct address checksum (i.e. address
0x6000 0000), the command is aborted by the
bootloader device, but the NACK (0x1F) is not sent to
the host. As a result, the next 2 bytes (which are the
number of bytes to be read/written and its checksum)
are considered as a new command and its
V3.0 Initial bootloader version checksum(1).
– Option bytes, OTP and Device Feature descriptors (in
DFU interface) are set to “g” instead of “e” (not
erasable memory areas).
After executing Go command (jump to user code) the
bootloader resets AHB1ENR value to 0x0000 0000 and
thus CCM RAM, when present, is not active (must be re-
enabled by user code at startup)
– For the USART interface, two consecutive NACKs
(instead of 1 NACK) are sent when a Read Memory or
Write Memory command is sent and the RDP level is
active.
– For the CAN interface, the Write Unprotect command
Fix V3.0 limitations.
is not functional. Use Write Memory command and
V3.1 DFU interface robustness
write directly to the option bytes in order to disable the
enhancement.
write protection.
After executing Go command (jump to user code) the
bootloader resets AHB1ENR value to 0x0000 0000 and
thus CCM RAM, when present, is not active (must be re-
enabled by user code at startup)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as
the command is NACKed anyway (as an unsupported new command).

118/436 AN2606 Rev 61

AN2606 STM32F40xxx/41xxx devices bootloader

28.2 Bootloader V9.x

28.2.1 Bootloader configuration

The STM32F40xxx/41xxx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 59 shows the hardware resources used by this bootloader.
Note: The bootloader version V9.0 is embedded only in STM32F405xx/415xx devices in
WLCSP90 package.
Version V9.1 is populated in all packages of the product.

Table 59. STM32F40xxx/41xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz using the PLL.
The HSI clock source is used at startup (interface
detection phase) and when USART or SPI or I2C
HSI enabled
interfaces are selected (once CAN or DFU bootloader
is selected, the clock source is derived from the
external crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when the CAN or
HSE enabled the DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple
of 1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external
Common to all
clock generates system reset.
bootloaders
12 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in byte
Power - format (Half-Word, Word and Double-Word operations
are not allowed). The voltage range can be configured
in run time using bootloader commands.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input
USART1_RX pin Input
bootloader no pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode.

AN2606 Rev 61 119/436

435
STM32F40xxx/41xxx devices bootloader AN2606

Table 59. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
USART3 even parity, and one stop bit
bootloader (on PB11 pin: USART3 in reception mode. Used in input
USART3_RX pin Input
PB10/PB11) pull-up mode.
USART3_TX pin Output PB10 pin: USART3 in transmission mode
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3
PC11 pin: USART3 in reception mode. Used in input
bootloader (on USART3_RX pin Input
pull-up mode.
PC10/PC11)
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
input pull-up mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
Once initialized the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the
CAN2 bootloader communication between CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in
CAN2_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
analog filter ON. Slave 7-bit address: 0b0111010x
I2C1 bootloader (where x = 0 for write and x = 1 for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C2 Enabled I2C speed: up to 400 kHz, 7-bit address, slave mode,
analog filter ON. Slave 7-bit address: 0b0111010x
I2C2 bootloader (where x = 0 for write and x = 1 for read).
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled
analog filter ON. Slave 7-bit address: 0b0111010x
I2C3 bootloader (where x = 0 for write and x = 1 for read).
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.

120/436 AN2606 Rev 61

AN2606 STM32F40xxx/41xxx devices bootloader

Table 59. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI1 configuration is:
SPI1 Enabled slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.
The SPI2 configuration is:
SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2 bootloader PI2 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PI1 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PI0 pin: slave chip select pin used in push-pull, pull-
SPI2_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
DFU bootloader
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once the HSE frequency is determined, the system
bootloaders
clock is configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS device),
but only for the selection phase. An external clock multiple of 1 MHz (between 4 and
26 MHz) is required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 121/436

435
STM32F40xxx/41xxx devices bootloader AN2606

28.2.2 Bootloader selection

Figure 33. Bootloader V9.x selection for STM32F40xxx/41xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device

Configure I2Cx Disable all

interrupt sources

Configure SPIx yes Configure

USARTx

Execute
0x7F received on
USARTx BL_USART_Loo
p for USARTx

no yes

Frame detected
on CANx no HSE detected

yes
no HSE detected no

Generate System
yes
Yes reset
USB cable
Detected
Reconfigure System
clock to 60MHz and Disable all
Disable all interrupt USB clock to 48 MHz interrupt sources
no sources
no
yes
Reconfigure System
Execute DFU clock to 60MHz
Execute
I2Cx Address BL_I2C_Loop for bootloader using
Detected I2Cx USB interrupts
Configure CAN

yes
no Execute
Disable all BL_CAN_Loop for
interrupt sources CANx
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35012V2

122/436 AN2606 Rev 61

AN2606 STM32F40xxx/41xxx devices bootloader

28.2.3 Bootloader version

Table 60 lists the STM32F40xxx/41xxx devices V9.x bootloader versions.

Table 60. STM32F40xxx/41xxx bootloader V9.x versions

Version
Description Known limitations
number

– For the USART interface, two consecutive

NACKs (instead of 1 NACK) are sent when a
This bootloader is an updated Read Memory or Write Memory command is
version of bootloader v3.1. sent and the RDP level is active.
This new version of bootloader – For the CAN interface, the Write Unprotect
supports I2C1, I2C2, I2C3, SPI1 command is not functional. Use Write Memory
V9.0 and SPI2 interfaces. command and write directly to the option bytes
The RAM used by this bootloader in order to disable the write protection.
is increased from 8Kb to 12Kb. After executing Go command (jump to user code)
The ID of this bootloader is 0x90. the bootloader resets AHB1ENR value to 0x0000
The connection time is increased. 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)
This bootloader is an updated
version of bootloader v9.0 that
will be populated in all packages
V9.1 even the one embedding the None
V3.1 bootloader version.
It contains fixes of the known
limitations of the V9.0

AN2606 Rev 61 123/436

435
STM32F401xB(C) devices bootloader AN2606

29 STM32F401xB(C) devices bootloader

29.1 Bootloader configuration

The STM32F401xB(C) bootloader is activated by applying Pattern 1 (described in Table 2).
Table 61 shows the hardware resources used by this bootloader.

Table 61. STM32F401xB(C) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the

PLL.
The HSI clock source is used at startup (interface
HSI enabled detection phase) and when USART or SPI or I2C
interface is selected (once DFU bootloader is
selected, the clock source is derived from the
external crystal).
RCC The system clock frequency is 60 MHz.
The HSE clock source is used only when the DFU
HSE enabled (USB FS device) interface is selected.
The external clock must provide a frequency
multiple of 1 MHz and ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external
Common to all clock generates system reset.
bootloaders
12 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in
byte format (Half-Word, Word and Double-Word
Power -
operations are not allowed). The voltage range can
be configured in run time using bootloader
commands.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
input no pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
input no pull mode.

124/436 AN2606 Rev 61

AN2606 STM32F401xB(C) devices bootloader

Table 61. STM32F401xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART2 configuration is 8-bit,

USART2 Enabled
even parity, and one stop bit
PD6 pin: USART2 in reception mode. Used in input
USART2 bootloader USART2_RX pin Input
pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloaders SysTick timer Enabled
from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for
read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for
read)
I2C2 bootloader
PB10 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PB3 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for
read)
I2C3 bootloader
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PB4 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.

AN2606 Rev 61 125/436

435
STM32F401xB(C) devices bootloader AN2606

Table 61. STM32F401xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
SPI1 Enabled
MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull,
SPI1_NSS pin Input
pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
SPI2 Enabled
MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
SPI2_NSS pin Input
pull-down mode.
The SPI3 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
SPI3 Enabled
MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PC12 pin: slave data Input line, used in push-pull,
SPI3_MOSI pin Input
pull-down mode
SPI3 bootloader
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
pull-down mode
PC10 pin: slave clock line, used in push-pull, pull-
SPI3_SCK pin Input
down mode
PA15 pin: slave chip select pin used in push-pull,
SPI3_NSS pin Input
pull-down mode.

126/436 AN2606 Rev 61

AN2606 STM32F401xB(C) devices bootloader

Table 61. STM32F401xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB OTG FS configured in forced device mode

PA11: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
DFU bootloader USB_DP pin pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the
HSE. Once the HSE frequency is determined, the
TIM11 Enabled
system clock is configured to 60 MHz using PLL
and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS device),
but only for the selection phase. An external clock, multiple of 1 MHz (between 4 and
26 MHz), is required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 127/436

435
STM32F401xB(C) devices bootloader AN2606

29.2 Bootloader selection

Figure 34. Bootloader selection for STM32F401xB(C)

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received on
USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35030V1

128/436 AN2606 Rev 61

AN2606 STM32F401xB(C) devices bootloader

29.3 Bootloader version

Table 62. STM32F401xB(C) bootloader versions
Version number Description Known limitations

– After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
0000 and thus CCM RAM, when present, is not
V13.0 Initial bootloader version active (must be re-enabled by user code at startup)
– The bootloader does not support the reset of
SPRMOD bit during RDP regression

AN2606 Rev 61 129/436

435
STM32F401xD(E) devices bootloader AN2606

30 STM32F401xD(E) devices bootloader

30.1 Bootloader configuration

The STM32F401xD(E) bootloader is activated by applying Pattern 1 (described in Table 2).
Table 63 shows the hardware resources used by this bootloader.

Table 63. STM32F401xD(E) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz using the PLL.
The HSI clock source is used at startup (interface
HSI enabled detection phase) and when USART or SPI or I2C
interface is selected (once DFU bootloader is selected,
the clock source is derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the DFU
HSE enabled (USB FS device) interface is selected.
The external clock must provide a frequency multiple of
1 MHz, ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the DFU bootloader.
- Any failure (or removal) of the external clock generates
Common to all system reset.
bootloaders 12 Kbytes, starting from address 0x20000000 are used
RAM -
by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage range is set to 1.62 V, 2.1 V. In this range
internal flash write operations are allowed only in byte
Power - format (Half-Word, Word and Double-Word operations
are not allowed). The voltage range can be configured
in run time using bootloader commands.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in no pull
USART1_RX pin Input
bootloader mode.
PA9 pin: USART1 in transmission mode. Used in no
USART1_TX pin Output
pull mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PD6 pin: USART2 in reception mode. Used in pull-up
USART2_RX pin Input
bootloader mode.
PD5 pin: USART2 in transmission mode. Used in pull-
USART2_TX pin Output
up mode.

130/436 AN2606 Rev 61

AN2606 STM32F401xD(E) devices bootloader

Table 63. STM32F401xD(E) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – slave mode
I2C1 bootloader – analog filter ON
– Slave 7-bit address: 0b0111001x (where x = 0 for
write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – slave mode
I2C2 bootloader – analog filter ON
– . Slave 7-bit address: 0b0111001x (where x = 0 for
write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB3 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – slave mode
I2C3 bootloader – analog filter ON
– Slave 7-bit address: 0b0111001x (where x = 0 for
write and x = 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PB4 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI1 bootloader PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

AN2606 Rev 61 131/436

435
STM32F401xD(E) devices bootloader AN2606

Table 63. STM32F401xD(E) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI2 bootloader PB15 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
SPI2_NSS pin Input
down mode.
The SPI3 configuration is:
SPI3 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data Input line, used in push-pull, pull-
SPI3_MOSI pin Input
down mode
SPI3 bootloader PC11 pin: slave data output line, used in push-pull, pull-
SPI3_MISO pin Output
down mode
PC10 pin: slave clock line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PA15 pin: slave chip select pin used in push-pull, pull-
SPI3_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
DFU bootloader USB_DP pin mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
TIM11 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for DFU (USB FS device), but only for
the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

132/436 AN2606 Rev 61

AN2606 STM32F401xD(E) devices bootloader

30.2 Bootloader selection

Figure 35 shows the bootloader selection mechanism.

Figure 35. Bootloader selection for STM32F401xD(E)

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received
on USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35031V1

AN2606 Rev 61 133/436

435
STM32F401xD(E) devices bootloader AN2606

30.3 Bootloader version

The following table lists the STM32F401xD(E) devices bootloader version.

Table 64. STM32F401xD(E) bootloader versions

Version
Description Known limitations
number

After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
V13.1 Initial bootloader version
0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup)

134/436 AN2606 Rev 61

AN2606 STM32F410xx devices bootloader

31 STM32F410xx devices bootloader

31.1 Bootloader configuration

The STM32F410xx bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 65. STM32F410xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source

RCC HSI enabled for system clock configured to 60 MHz and
for USART and I2C bootloader operation.
5 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware
29 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
Common to all maximum value. It is periodically
bootloaders IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
The voltage range is [1.8V, 3.6V]
In this range:
- flash wait states: 3.
Power - - System clock frequency 60 MHz.
- ART Accelerator enabled.
- flash write operation by byte (refer to
bootloader memory management section
for more information).
Once initialized the USART1 configuration
USART1 Enabled
is 8-bit, even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode.
USART1_RX pin Input
bootloader Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized the USART2 configuration
USART2 Enabled
is 8-bit, even parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode.
USART2_RX pin Input
bootloader Used in alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial
USARTx
SysTick timer Enabled baud rate from the host for USARTx
bootloaders
bootloaders.

AN2606 Rev 61 135/436

435
STM32F410xx devices bootloader AN2606

Table 65. STM32F410xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000111x (where x = 0 for
write and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB7 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C2 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000111x (where x = 0 for
write and x = 1 for read)
I2C2 bootloader
PB10 pin: clock line is used in open-drain
I2C2_SCL pin Input/output
no pull mode.
PB11 pin: data line is used in open-drain
I2C2_SDA pin Input/output
no pull mode.
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C4 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000111x (where x = 0 for
write and x = 1 for read)
PB15 pin: clock line is used in open-drain
no pull mode for STM32F410Cx/Rx
I2C4 bootloader I2C4_SCL pin Input/output devices.
PB10 pin: clock line is used in open-drain
no pull mode for STM32F410Tx devices.
PB14 pin: data line is used in open-drain
no pull mode for STM32F410Cx/Rx
I2C4_SDA pin Input/output devices.
PB3 pin: data line is used in open-drain no
pull mode for STM32F410Tx devices.

136/436 AN2606 Rev 61

AN2606 STM32F410xx devices bootloader

Table 65. STM32F410xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

SPI1 Enabled Slave mode, Full Duplex, 8-bit MSB,
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in
push-pull, pull-down mode for
STM32F410Cx/Rx devices.
SPI1_MOSI pin Input
PB5 pin: slave data Input line, used in
push-pull, pull-down mode for
STM32F410Tx devices.
PA6 pin: slave data output line, used in
push-pull, pull-down mode for
SPI1 bootloader
STM32F410Cx/Rx devices.
SPI1_MISO pin Output
PB4 pin: slave data output line, used in
push-pull, pull-down mode for
STM32F410Tx devices.
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode.
PA4 pin: slave chip select pin used in
push-pull, pull-up mode for
STM32F410Cx/Rx devices.
SPI1_NSS pin Input
PA15 pin: slave chip select pin used in
push-pull, pull-down mode for
STM32F410Tx devices.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI2 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PC3 pin: slave data Input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2 bootloader
PC2 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PB13 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PB12 pin: slave chip select pin used in
SPI2_NSS pin Input
push-pull, pull-down mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 61 137/436

435
STM32F410xx devices bootloader AN2606

31.2 Bootloader selection

Figure 36 shows the bootloader selection mechanism.

Figure 36.Bootloader V11.x selection for STM32F410xx

System Reset

Disable all interrupt

sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
Detected

no Disable all other

Disable all other Disable all other interfaces clocks
interfaces clocks interfaces clocks

Configure USARTx
SPIx detects Synchro yes
mechanism

Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx
no

MSv38431V2

138/436 AN2606 Rev 61

AN2606 STM32F410xx devices bootloader

31.3 Bootloader version

The following table lists the STM32F410xx devices bootloader V11.x versions.

Table 66. STM32F410xx bootloader V11.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
V11.0 Initial bootloader version 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)
After executing Go command (jump to user code)
the bootloader resets AHB1ENR value to 0x0000
Support I2C4 and SPI1 for
V11.1 0000 and thus CCM RAM, when present, is not
STM32F410Tx devices.
active (must be re-enabled by user code at
startup)

AN2606 Rev 61 139/436

435
STM32F411xx devices bootloader AN2606

32 STM32F411xx devices bootloader

32.1 Bootloader configuration

The STM32F411xx bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 67. STM32F411xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the

PLL.
The HSI clock source is used at startup (interface
HSI enabled detection phase) and when USART or SPI or I2C
interface is selected (once DFU bootloader is
selected, the clock source is derived from the exter-
nal crystal).
RCC The system clock frequency is 60 MHz.
The HSE clock source is used only when the DFU
HSE enabled (USB FS device) interface is selected.
The external clock must provide a frequency multiple
of 1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the DFU boot-
- loader. Any failure (or removal) of the external clock
Common to all generates system reset.
bootoaders
12 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, con-
System memory -
tain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watch-
IWDG -
dog reset (if the hardware IWDG option was previ-
ously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in
byte format (Half-Word, Word and Double-Word
Power -
operations are not allowed). The voltage range can
be configured in run time using bootloader com-
mands.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in input
USART1 bootloader USART1_RX pin Input
no pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
input no pull mode.

140/436 AN2606 Rev 61

AN2606 STM32F411xx devices bootloader

Table 67. STM32F411xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART2 configuration is 8-bit,

USART2 Enabled
even parity, and one stop bit
PD6 pin: USART2 in reception mode. Used in input
USART2 bootloader USART2_RX pin Input
pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloaders SysTick timer Enabled
from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled
mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for read)
I2C1 bootloader
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled
mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for read)
I2C2 bootloader
PB10 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PB3 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled
mode, analog filter ON. Slave 7-bit address:
0b0111001x (where x = 0 for write and x = 1 for read)
I2C3 bootloader
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PB4 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
SPI1 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

AN2606 Rev 61 141/436

435
STM32F411xx devices bootloader AN2606

Table 67. STM32F411xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2 bootloader PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
SPI2_NSS pin Input
pull-down mode.
The SPI3 configuration is:
SPI3 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data Input line, used in push-pull,
SPI3_MOSI pin Input
pull-down mode
SPI3 bootloader PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
pull-down mode
PC10 pin: slave clock line, used in push-pull, pull-
SPI3_SCK pin Input
down mode
PA15 pin: slave chip select pin used in push-pull,
SPI3_NSS pin Input
pull-down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
DFU bootloader USB_DP pin pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
TIM11 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

142/436 AN2606 Rev 61

AN2606 STM32F411xx devices bootloader

32.2 Bootloader selection

Figure 37 shows the bootloader selection mechanism.

Figure 37. Bootloader selection for STM32F411xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received on
USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
Yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx MS35032V1

AN2606 Rev 61 143/436

435
STM32F411xx devices bootloader AN2606

32.3 Bootloader version

The following table lists the STM32F411xx devices bootloader version.

Table 68. STM32F411xx bootloader versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V13.0 Initial bootloader version
and thus CCM RAM, when present, is not active
(must be re-enabled by user code at startup)

144/436 AN2606 Rev 61

AN2606 STM32F412xx devices bootloader

33 STM32F412xx devices bootloader

33.1 Bootloader configuration

The STM32F412xx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 69 shows the hardware resources used by this bootloader.

Table 69.STM32F412xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN or the DFU (USB
FS device) interfaces are selected. In this case the
system clock configured to 60 MHz with HSE as clock
RCC HSE enabled source.
The HSE frequency must be multiple of 1 MHz, ranging
from 4 to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external clock
generates system reset.

Common to all 16 Kbytes, starting from address 0x20000000 are used

RAM -
bootloaders by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
The voltage range is [1.8V, 3.6V]. In this range:
- Flash wait states: 3.
- System clock frequency 60 MHz.
Power -
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader
memory management section for more information).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.

AN2606 Rev 61 145/436

435
STM32F412xx devices bootloader AN2606

Table 69.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART2 configuration is 8-bit, even

USART2 Enabled
parity, and one stop bit
USART2 PD6 pin: USART2 in reception mode. Used in input pull-
USART2_RX pin Input
bootloader up mode.
PD5 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3 PB11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
bootloader up mode.
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the communication
CAN2 between CAN2 and SRAM.
bootloader
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 bootloader – Slave 7-bit address: 0b1000110x (where x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
I2C2 bootloader – Slave 7-bit address: 0b1000110x (where x = 0 for write
and x = 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.

146/436 AN2606 Rev 61

AN2606 STM32F412xx devices bootloader

Table 69.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
I2C3 bootloader – Slave 7-bit address: 0b1000110x (where x = 0 for write
and x = 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PB4 pin: data line is used in open-drain no pull mode.
The I2C4 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C4 Enabled analog filter ON.
I2C4 bootloader – Slave 7-bit address: 0b1000110x (where x = 0 for write
and x = 1 for read)
I2C4_SCL pin Input/output PB15 pin: clock line is used in open-drain no pull mode.
I2C4_SDA pin Input/output PB14 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1 bootloader SPI1_MOSI pin Input
down mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-up
SPI1_NSS pin Input
mode.
The SPI3 configuration is:
SPI3 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8 MHz,
Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data Input line, used in push-pull, pull-
SPI3_MOSI pin Input
down mode
SPI3 bootloader PC11 pin: slave data output line, used in push-pull, pull-
SPI3_MISO pin Output
down mode
PC10 pin: slave clock line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PA15 pin: slave chip select pin used in push-pull, pull-up
SPI3_NSS pin Input
mode.

AN2606 Rev 61 147/436

435
STM32F412xx devices bootloader AN2606

Table 69.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

SPI4 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8 MHz,
Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in push-pull, pull-
SPI4_MOSI pin Input
down mode
SPI4 bootloader PE13 pin: slave data output line, used in push-pull, pull-
SPI4_MISO pin Output
down mode
PE12 pin: slave clock line, used in push-pull, pull-down
SP4_SCK pin Input
mode
PE11 pin: slave chip select pin used in push-pull, pull-up
SPI4_NSS pin Input
mode.
USB Enabled USB OTG FS configured in forced device mode
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
DFU bootloader
Input/output PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once HSE frequency is determined, the system clock is
bootloaders
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

148/436 AN2606 Rev 61

AN2606 STM32F412xx devices bootloader

33.2 Bootloader selection

Figure 38 shows the bootloader selection mechanism.

Figure 38.Bootloader V9.x selection for STM32F412xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx

no
yes

I2Cx Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CANx
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CANx

MSv38454V2

AN2606 Rev 61 149/436

435
STM32F412xx devices bootloader AN2606

33.3 Bootloader version

The following table lists the STM32F412xx devices bootloader V9.x versions.

Table 70. STM32F412xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
V9.0 Initial bootloader version 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)
After executing Go command (jump to user code)
the bootloader resets AHB1ENR value to 0x0000
V9.1 Fix USART3 interface pinout 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)

150/436 AN2606 Rev 61

AN2606 STM32F413xx/423xx devices bootloader

34 STM32F413xx/423xx devices bootloader

34.1 Bootloader configuration

The STM32F413xx/423xx bootloader is activated by applying Pattern 1 (described in
Table 2h). The following table shows the hardware resources used by this bootloader.

Table 71. STM32F413xx/423xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock

source for system clock configured to
HSI enabled
60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN
or the DFU (USB FS device) interfaces
are selected. In this case the system
clock configured to 60 MHz with HSE
RCC HSE enabled as clock source.
The HSE frequency must be multiple
of 1 MHz and ranging from 4 MHz to
26 MHz.
The CSS interrupt is enabled for the
CAN and DFU bootloaders. Any failure
-
(or removal) of the external clock
generates system reset.
16 Kbytes, starting from address
Common to all bootloaders RAM - 0x20000000 are used by the
bootloader firmware
60 Kbytes, starting from address
System memory - 0x1FF00000, contain the bootloader
firmware
The IWDG prescaler is configured to
its maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
The voltage range is [1.8V, 3.6V]
In this range:
– Flash wait states 4.
Power - – System clock frequency 60 MHz.
– ART Accelerator enabled.
– Flash write operation by byte (refer
to Bootloader memory management
for more information).

AN2606 Rev 61 151/436

435
STM32F413xx/423xx devices bootloader AN2606

Table 71. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the USART1
USART1 Enabled configuration is 8-bit, even parity, and
one stop bit
USART1 bootloader PA10 pin: USART1 in reception mode.
USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission
USART1_TX pin Output
mode. Used in input no pull mode.
Once initialized the USART2
USART2 Enabled configuration is 8-bit, even parity, and
one stop bit
USART2 bootloader PD6 pin: USART2 in reception mode.
USART2_RX pin Input
Used in input pull-up mode.
PD5 pin: USART2 in transmission
USART2_TX pin Output
mode. Used in input pull-up mode.
Once initialized the USART3
USART3 Enabled configuration is 8-bit, even parity, and
one stop bit
USART3 bootloader PB11 pin: USART3 in reception mode.
USART3_RX pin Input
Used in input pull-up mode.
PB10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
Used to automatically detect the serial
USARTx bootloaders SysTick timer Enabled baud rate from the host for USARTx
bootloaders.
Once initialized the CAN2
configuration is: Baudrate 125 kbps,
11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2
bootloader execution because CAN1
manages the communication between
CAN2 bootloader CAN2 and SRAM.
PB5 pin: CAN2 in reception mode.
CAN2_RX pin Input Used in alternate push-pull, pull-up
mode.
PB13 pin: CAN2 in transmission
CAN2_TX pin Output mode. Used in alternate push-pull,
pull-up mode.

152/436 AN2606 Rev 61

AN2606 STM32F413xx/423xx devices bootloader

Table 71. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C1 Enabled
Slave 7-bit address: 0b1001011x
(where x = 0 for write and x = 1 for
I2C1 bootloader read)
PB6 pin: clock line is used in open-
I2C1_SCL pin Input/output
drain no pull mode.
PB7 pin: data line is used in open-
I2C1_SDA pin Input/output
drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C2 Enabled
Slave 7-bit address: 0b1001011x
(where x = 0 for write and x = 1 for
I2C2 bootloader read)
PF1 pin: clock line is used in open-
I2C2_SCL pin Input/output
drain no pull mode.
PF0 pin: data line is used in open-
I2C2_SDA pin Input/output
drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C3 Enabled
Slave 7-bit address: 0b1001011x
(where x = 0 for write and x = 1 for
I2C3 bootloader read)
PA8 pin: clock line is used in open-
I2C3_SCL pin Input/output
drain no pull mode.
PB4 pin: data line is used in open-
I2C3_SDA pin Input/output
drain no pull mode.
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
slave mode, analog filter ON.
I2C4 Enabled
Slave 7-bit address: 0b1001011x
(where x = 0 for write and x = 1 for
I2C4 bootloader read)
PB15 pin: clock line is used in open-
I2C4_SCL pin Input/output
drain no pull mode.
PB14 pin: data line is used in open-
I2C4_SDA pin Input/output
drain no pull mode.

AN2606 Rev 61 153/436

435
STM32F413xx/423xx devices bootloader AN2606

Table 71. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in
SPI1 bootloader SPI1_MOSI pin Input
push-pull, pull-down mode
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
SPI1_NSS pin Input
push-pull, pull-down mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PC12 pin: slave data Input line, used
SPI3 bootloader SPI3_MOSI pin Input
in push-pull, pull-down mode
PC11 pin: slave data output line, used
SPI3_MISO pin Output
in push-pull, pull-down mode
PC10 pin: slave clock line, used in
SPI3_SCK pin Input
push-pull, pull-down mode
PA15 pin: slave chip select pin used in
SPI3_NSS pin Input
push-pull, pull-down mode.
The SPI4 configuration is:
– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PE14 pin: slave data Input line, used in
SPI4 bootloader SPI4_MOSI pin Input
push-pull, pull-down mode
PE13 pin: slave data output line, used
SPI4_MISO pin Output
in push-pull, pull-down mode
PE12 pin: slave clock line, used in
SP4_SCK pin Input
push-pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.

154/436 AN2606 Rev 61

AN2606 STM32F413xx/423xx devices bootloader

Table 71. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB OTG FS configured in forced

USB Enabled
device mode
PA11 pin: USB DM line. Used in
USB_DM pin
DFU bootloader alternate push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in
USB_DP pin alternate push-pull, no pull mode.
No external pull-up resistor is required.
This timer is used to determine the
value of the HSE. Once HSE
CAN2 and DFU
TIM11 Enabled frequency is determined, the system
bootloaders
clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 155/436

435
STM32F413xx/423xx devices bootloader AN2606

34.2 Bootloader selection

Figure 39 shows the bootloader selection mechanism.

Figure 39.Bootloader V9.x selection for STM32F413xx/423xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx

no
yes

I2C Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CAN
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CAN2

MSv42229V1

156/436 AN2606 Rev 61

AN2606 STM32F413xx/423xx devices bootloader

34.3 Bootloader version

The following table lists the STM32F413xx/423xx devices bootloader V9.x versions.

Table 72. STM32F413xx/423xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)

AN2606 Rev 61 157/436

435
STM32F42xxx/43xxx devices bootloader AN2606

35 STM32F42xxx/43xxx devices bootloader

35.1 Bootloader V7.x

35.1.1 Bootloader configuration

The STM32F42xxx/43xxx bootloader is activated by applying Pattern 5 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 73. STM32F42xxx/43xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using

the PLL.
The HSI clock source is used at startup
HSI enabled (interface detection phase) and when USART
or I2C interfaces are selected (once CAN or
DFU bootloader is selected, the clock source
is derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the
CAN or the DFU (USB FS device) interfaces
HSE enabled are selected.
The external clock must provide a frequency
multiple of 1 MHz and ranging from 4 MHz to
26 MHz.
The CSS interrupt is enabled for the CAN and
Common to all - DFU bootloaders. Any failure (or removal) of
bootloaders the external clock /generates system reset.
8 Kbytes, starting from address 0x20000000
RAM -
are used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset (if the hardware IWDG
option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this
range internal flash write operations are
allowed only in byte format (Half-Word, Word
Power -
and Double-Word operations are not allowed).
The voltage range can be configured in run
time using bootloader commands.

158/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

Table 73. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART1 configuration is 8

USART1 Enabled
bits, even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
input no pull mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in input no pull mode.
Once initialized the USART3 configuration is 8
USART3 Enabled
bits, even parity, and one stop bit
USART3 bootloader PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PB10/PB11) input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized the USART3 configuration is 8
USART3 Enabled
bits, even parity, and one stop bit
USART3 bootloader PC11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PC10/PC11) input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because CAN1 manages
the communication between CAN2 and
CAN2 bootloader SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used
CAN2_TX pin Output
in alternate push pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON. Slave 7-bit address:
0b0111000x (where x = 0 for write and x = 1 for
read).
I2C1 bootloader
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

AN2606 Rev 61 159/436

435
STM32F42xxx/43xxx devices bootloader AN2606

Table 73. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB OTG FS configured in forced device

USB Enabled
mode
PA11: USB DM line. Used in alternate push
USB_DM pin
DFU bootloader pull no pull mode.
Input/output PA12: USB DP line. Used in alternate push
USB_DP pin pull no pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the
CAN2 and DFU HSE. Once the HSE frequency is determined,
TIM11 Enabled
bootloaders the system clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

160/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

35.1.2 Bootloader selection

Figure 40 and Figure 41 show the bootloader selection mechanism.

Figure 40. Dual bank boot implementation for STM32F42xxx/43xxx Bootloader V7.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

1. CCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

AN2606 Rev 61 161/436

435
STM32F42xxx/43xxx devices bootloader AN2606

Figure 41. Bootloader V7.x selection for STM32F42xxx/43xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS Disable all

yes
device interrupt sources

Configure
Configure I2Cx USARTx

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx

yes
no
Execute
BL_I2C_Loop for
I2Cx
I2C Address
Detected yes

HSE detected
no no

yes yes
Frame detected
no on CANx HSE detected no Disable all
interrupt sources
Generate System
no yes reset
Reconfigure System
clock to 60MHz
Reconfigure System
USB cable clock to 60MHz and
Detected USB clock to 48 MHz Configure CAN

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MS35022V1

162/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

35.1.3 Bootloader version

The following table lists the STM32F42xxx/43xxx devices bootloader V7.x versions.
.

Table 74. STM32F42xxx/43xxx bootloader V7.x versions

Version
Description Known limitations
number

For the CAN interface, the Write Unprotect

command is not functional. Use Write Memory
command and write directly to the option bytes to
disable the write protection.
For the USB DFU interface, in Dual Bank mode, the
Erase operation is not functional for the second
V7.0 Initial bootloader version
bank. Return to Single Bank mode, erase desired
sector(s) and then reactivate the Dual Bank mode.
After executing Go command (jump to user code)
the bootloader resets AHB1ENR value to 0x0000
0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup).

AN2606 Rev 61 163/436

435
STM32F42xxx/43xxx devices bootloader AN2606

35.2 Bootloader V9.x

35.2.1 Bootloader configuration

The STM32F42xxx/43xxx bootloader is activated by applying Pattern 5 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 75. STM32F42xxx/43xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the PLL.

The HSI clock source is used at startup (interface
detection phase) and when USART or SPI or I2C
HSI enabled
interfaces are selected (once CAN or DFU bootloader
is selected, the clock source is derived from the
external crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when the CAN or
HSE enabled the DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple
of 1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external
Common to all clock generates system reset.
bootloaders 12 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in byte
format (Half-Word, Word and Double-Word
Power -
operations are not allowed). The voltage range can
be configured in run time using bootloader
commands.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input
USART1_RX pin Input
bootloader no pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
input no pull mode.

164/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

Table 75. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit,

USART3 Enabled
even parity, and one stop bit
USART3
PB11 pin: USART3 in reception mode. Used in input
bootloader USART3_RX pin Input
pull-up mode.
(on PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
input pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
USART3 even parity, and one stop bit.
bootloader
USART3_RX pin Input PC11 pin: USART3 in reception mode.
(on PC10/PC11)
USART3_TX pin Output PC10 pin: USART3 in transmission mode.
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
Once initialized the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the
communication between CAN2 and SRAM.
CAN2 bootloader
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in
CAN2_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled
analog filter ON. Slave 7-bit address: 0b0111000x
I2C1 bootloader (where x = 0 for write and x = 1 for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C2 Enabled
analog filter ON. Slave 7-bit address: 0b0111000x
I2C2 bootloader (where x = 0 for write and x = 1 for read).
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled
analog filter ON. Slave 7-bit address: 0b0111000x
I2C3 bootloader (where x = 0 for write and x = 1 for read).
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain mode.

AN2606 Rev 61 165/436

435
STM32F42xxx/43xxx devices bootloader AN2606

Table 75. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

SPI1 Enabled Slave mode, Full Duplex, -bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.
The SPI2 configuration is:
SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2 bootloader PI2 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PI1 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PI0 pin: slave chip select pin used in push-pull, pull-
SPI2_NSS pin Input
down mode.
The SPI4 configuration is:
SPI4 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in push-pull,
SPI4_MOSI pin Input
pull-down mode
SPI4 bootloader PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
pull-down mode
PE12 pin: slave clock line, used in push-pull, pull-
SP4_SCK pin Input
down mode
PE11 pin: slave chip select pin used in push-pull, pull-
SPI4_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull no
USB_DM pin
pull mode.
DFU bootloader
Input/output PA12: USB DP line. Used in alternate push-pull no
USB_DP pin pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once the HSE frequency is determined, the system
bootloaders
clock is configured to 60 MHz using PLL and HSE.

166/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS
device), but only for the selection phase. An external clock multiple of 1 MHz (between 4
and 26 MHz) is required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 167/436

435
STM32F42xxx/43xxx devices bootloader AN2606

35.2.2 Bootloader selection

Figure 42 and Figure 43 show the bootloader selection mechanism.

Figure 42. Dual bank boot implementation for STM32F42xxx/43xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1) Protection level2
no
Set Bank Swap to enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35023V1

1. CCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

168/436 AN2606 Rev 61

AN2606 STM32F42xxx/43xxx devices bootloader

Figure 43. Bootloader V9.x selection for STM32F42xxx/43xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device

Disable all interrupt

sources
Configure I2Cx
yes
Configure USARTx
Configure SPIx

Execute
BL_USART_Loop for
0x7F received USARTx
on USARTx

no Execute
BL_I2C_Loop for
yes
I2Cx
I2C Address
Detected

Execute
no
yes BL_SPI_Loop for
SPIx
Synchro
mechanism detected
on SPIx yes

no HSE detected
no
HSE detected
Frame detected yes
no yes no
on CANx
Disable all interrupt
sources
yes
no Generate System
reset
Reconfigure System clock
Reconfigure System to 60MHz
USB cable clock to 60MHz and
Detected USB clock to 48 MHz
Configure CAN

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MS35024V1

AN2606 Rev 61 169/436

435
STM32F42xxx/43xxx devices bootloader AN2606

35.2.3 Bootloader version

Table 76 lists the STM32F42xxx/43xxx devices bootloader V9.x versions.

Table 76. STM32F42xxx/43xxx bootloader V9.x versions

Version
Description Known limitations
number

This bootloader is an updated

For the USB DFU interface, in Dual Bank mode, the
version of bootloader v7.0.
Erase operation is not functional for the second
This new version of bootloader
bank. Return to Single Bank mode, erase desired
supports I2C2, I2C3, SPI1, SPI2,
sector(s) and then reactivate the Dual Bank mode.
V9.0 and SPI4 interfaces.
The RAM used by this bootloader After executing Go command (jump to user code)
is increased from 8 Kb to 12 Kb. the bootloader resets AHB1ENR value to 0x0000
The ID of this bootloader is 0x90 0000 and thus CCM RAM, when present, is not
The connection time is increased. active (must be re-enabled by user code at startup)

For the CAN interface, the Write Unprotect

This bootloader is an updated command is not functional. Use Write Memory
version of bootloader v9.0. This command and write directly to the option bytes in
new version implements the new order to disable the write protection.
I2C No-stretch commands (I2C For the USB DFU interface, in Dual Bank mode, the
protocol v1.1) and the capability of Erase operation is not functional for the second
V9.1
disabling PcROP when RDP1 is bank. Return to Single Bank mode, erase desired
enabled with ReadOutUnprotect sector(s) and then reactivate the Dual Bank mode.
command for all protocols(USB, After executing Go command (jump to user code)
USART, CAN, I2C and SPI). The the bootloader resets AHB1ENR value to 0x0000
ID of this bootloader is 0x91 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup)

170/436 AN2606 Rev 61

AN2606 STM32F446xx devices bootloader

36 STM32F446xx devices bootloader

36.1 Bootloader configuration

The STM32F446xx bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 77.STM32F446xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source

for system clock configured to 60 MHz and
HSI enabled
for USART, I2C and SPI bootloader
operation.
The HSE is used only when the CAN or the
DFU (USB FS device) interfaces are
selected. In this case the system clock
RCC HSE enabled configured to 60 MHz with HSE as clock
source.
The HSE frequency must be multiple of
1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN
and DFU bootloaders. Any failure (or
-
removal) of the external clock generates
system reset.
12 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
Common to all
firmware
bootloaders
29 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the
user).
The voltage range is [1.71 V, 3.6 V].
In this range:
- Flash wait states: 3.
- System Clock 60 MHz.
Power -
- Prefetch disabled.
- Flash write operation by byte (refer to
section bootloader memory management
for more information).

AN2606 Rev 61 171/436

435
STM32F446xx devices bootloader AN2606

Table 77.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART1 configuration

USART1 Enabled
is 8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode.
Once initialized the USART3 configuration
USART3 Enabled
is 8-bit, even parity, and one stop bit
USART3 bootloader PB11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PB10/PB11) Used in input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized the USART3 configuration
USART3 Enabled
is 8-bit, even parity, and one stop bit
USART3 bootloader PC11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PC10/PC11) Used in input pull-up mode
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because in CAN1
manages the communication between
CAN2 bootloader CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode.
CAN2_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b0111100x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB9 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.

172/436 AN2606 Rev 61

AN2606 STM32F446xx devices bootloader

Table 77.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C2 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b0111100x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no
I2C2_SCL pin Input/output
pull mode.
PF0 pin: data line is used in open-drain no
I2C2_SDA pin Input/output
pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C3 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b0111100x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no
I2C3_SCL pin Input/output
pull mode.
PC9 pin: data line is used in open-drain no
I2C3_SDA pin Input/output
pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed
SPI1 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PA7 pin: slave data Input line, used in push-
SPI1_MOSI pin Input
pull, pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-pull,
SPI1_SCK pin Input
pull-down mode
PA4 pin: slave chip select pin used in push-
SPI1_NSS pin Input
pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed
SPI2 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PB15 pin: slave data Input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PC7 pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PB12 pin: slave chip select pin used in
SPI2_NSS pin Input
push-pull, pull-down mode.

AN2606 Rev 61 173/436

435
STM32F446xx devices bootloader AN2606

Table 77.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed
SPI4 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PE14 pin: slave data Input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4 bootloader
PE13 pin: slave data output line, used in
SPI4_MISO pin Output
push-pull, pull-down mode
PE12 pin: slave clock line, used in push-
SPI4_SCK pin Input
pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced device
USB Enabled
mode
PA11: USB DM line. Used in alternate
USB_DM pin
DFU bootloader push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate push-
USB_DP pin pull, no pull mode.
No external pull-up resistor is required
This timer is used to determine the value of
CAN2 and DFU the HSE. Once the HSE frequency is
TIM17 Enabled
bootloaders determinated, the system clock is
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

174/436 AN2606 Rev 61

AN2606 STM32F446xx devices bootloader

36.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 44.Bootloader V9.x selection for STM32F446xx

System Reset

Disable all
System Init (Clock, GPIOs,
interrupt sources
IWDG, SysTick)
yes
Configure
Configure USB OTG FS
USARTx
device

Execute
Configure I2Cx BL_USART_Loop
for USARTx

0x7F received
on USARTx
Disable all
yes interrupt sources
no

Execute
I2C Address BL_I2C_Loop for
Detected I2Cx

yes Disable all

no interrupt sources

Execute
Synchro mechanism BL_SPI_Loop for
detected on SPIx SPIx
yes

no HSE detected
no
no

yes yes
Frame detected
on CANx HSE detected no Disable all
interrupt sources
Generate System
yes reset
no Reconfigure System
clock to 60MHz
Reconfigure System
clock to 60MHz and
USB cable USB clock to 48 MHz Configure CAN
Detected

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MSv36763V1

AN2606 Rev 61 175/436

435
STM32F446xx devices bootloader AN2606

36.3 Bootloader version

The following table lists the STM32F446xx devices bootloader V9.x versions:

Table 78. STM32F446xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)

176/436 AN2606 Rev 61

AN2606 STM32F469xx/479xx devices bootloader

37 STM32F469xx/479xx devices bootloader

37.1 Bootloader configuration

The STM32F469xx/479xx bootloader is activated by applying Pattern 5 (described in
Table 2). Table 79 shows the hardware resources used by this bootloader.

Table 79. STM32F469xx/479xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz

using the PLL.
The HSI clock source is used at startup
HSI enabled (interface detection phase) and when
USART or SPI or I2C interfaces are
selected (once CAN or DFU bootloader is
selected, the clock source is derived from
external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when
the CAN or the DFU (USB FS device)
HSE enabled interfaces are selected.
The external clock must provide a
frequency multiple of 1 MHz and ranging
from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN
and DFU bootloaders. Any failure (or
-
removal) of the external clock generates
Common to all system reset.
bootloaders
12 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware
29 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In
this range internal flash write operations
are allowed only in byte format (Half-
Power - Word, Word and Double-Word operations
are not allowed). The voltage range can
be configured in run time using bootloader
commands.

AN2606 Rev 61 177/436

435
STM32F469xx/479xx devices bootloader AN2606

Table 79. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART1 configuration

USART1 Enabled
is 8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode.
Once initialized the USART3 configuration
USART3 Enabled
is 8-bit, even parity, and one stop bit
USART3 bootloader
USART3_RX pin Input PB11 pin: USART3 in reception mode.
(on PB10/PB11)
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized the USART3 configuration
USART3 Enabled
is 8-bit, even parity, and one stop bit
USART3 bootloader PC11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PC10/PC11) Used in input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial
USARTx bootloaders SysTick timer Enabled baud rate from the host for USARTx
bootloaders.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2
bootloader execution because CAN1
manages the communication between
CAN2 bootloader CAN2 and SRAM.
PB05 pin: CAN2 in reception mode. Used
CAN2_RX pin Input
in alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode.
CAN2_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000100x (where x = 0 for
write and x = 1 for read).
I2C1 bootloader
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB9 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.

178/436 AN2606 Rev 61

AN2606 STM32F469xx/479xx devices bootloader

Table 79. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C2 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000100x (where x = 0 for
write and x = 1 for read).
I2C2 bootloader
PF0 pin: clock line is used in open-drain
I2C2_SCL pin Input/output
no pull mode.
PF1 pin: data line is used in open-drain no
I2C2_SDA pin Input/output
pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C3 Enabled slave mode, analog filter ON. Slave 7-bit
address: 0b1000100x (where x = 0 for
write and x = 1 for read).
I2C3 bootloader
PA8 pin: clock line is used in open-drain
I2C3_SCL pin Input/output
no pull mode.
PC9 pin: data line is used in open-drain no
I2C3_SDA pin Input/output
pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI1 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in
SPI1_MOSI pin Input
push-pull, pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
SPI1_NSS pin Input
push-pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI2 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2 bootloader
PI2 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PI1pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PI0 pin: slave chip select pin used in push-
SPI2_NSS pin Input
pull, pull-down mode.

AN2606 Rev 61 179/436

435
STM32F469xx/479xx devices bootloader AN2606

Table 79. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB,
SPI4 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4 bootloader
PE13 pin: slave data output line, used in
SPI4_MISO pin Output
push-pull, pull-down mode
PE12 pin: slave clock line, used in push-
SP4_SCK pin Input
pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced device
mode. USB_OTG_FS interrupt vector is
USB Enabled
enabled and used for USB DFU
communications.
DFU bootloader PA11 pin: USB DM line. Used in alternate
USB_DM pin
push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in alternate
USB_DP pin push-pull, no pull mode.
No external pull-up resistor is required.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 48 MHz) is
required for CAN and DFU bootloaders execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

180/436 AN2606 Rev 61

AN2606 STM32F469xx/479xx devices bootloader

37.2 Bootloader selection

Figure 45 and Figure 46 show the bootloader selection mechanism.

Figure 45. Dual bank boot implementation for STM32F469xx/479xx Bootloader V9.x

System Reset

If Boot = 0 no

yes

If value of
first address of Bank2
yes
is within int. SRAM
address
Set Bank Swap to
Bank2

no
Jump to user code Protection
no
in Bank2 level2 enabled

Continue Bootloader
If value of
execution
first address of Bank1
yes
is within int. SRAM yes
address

no If value of
first address of Bank2
yes
is within int. SRAM
Protection address
yes
level2 enabled

no

no Set Bank Swap to Set Bank Swap to Set Bank Swap to

Bank1 Bank1 Bank2

Continue Bootloader Jump to user code Jump to user code Jump to user code
execution in Bank1 in Bank1 in Bank2

MSv38429V1

AN2606 Rev 61 181/436

435
STM32F469xx/479xx devices bootloader AN2606

Figure 46.Bootloader V9.x selection for STM32F469xx/479xx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Disable all interrupt

Configure USB OTG FS
Disable all interrupt Disable all interrupt sources and other
device
sources and other sources and other interfaces clocks
interfaces clocks interfaces clocks
Configure I2Cx Configure USARTx

Configure SPIx Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx

0x7F received
yes
on USARTx

no

I2C Address
yes
Detected

no

no HSE detected

Synchro mechanism HSE detected no

yes
detected on SPIx
Generate System yes
reset
yes
Disable all interrupt
no Disable other sources and other
interfaces clocks interfaces clocks

Frame detected
yes
on CANx Reconfigure
Reconfigure System System clock to
clock to 60MHz and 60MHz
USB clock to 48 MHz
no

Configure CAN
Execute DFU
USB cable bootloader using USB
yes
Detected interrupts
Execute
BL_CAN_Loop for
CAN2
no
MSv38430V2

182/436 AN2606 Rev 61

AN2606 STM32F469xx/479xx devices bootloader

37.3 Bootloader version

Table 80 lists the STM32F469xx/479xx devices V9.x bootloader versions:

Table 80. STM32F469xx/479xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active
(must be re-enabled by user code at startup).

AN2606 Rev 61 183/436

435
STM32F72xxx/73xxx devices bootloader AN2606

38 STM32F72xxx/73xxx devices bootloader

38.1 Bootloader configuration

The STM32F72xxx/73xxx bootloader is activated by applying Pattern 8 (described in
Table 2). Table 81 shows the hardware resources used by this bootloader.

Table 81. STM32F72xxx/73xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock

source for system clock configured to
HSI enabled
60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN
or the DFU (USB FS device) interfaces
are selected. In this case the system
clock configured to 60 MHz with HSE
RCC HSE enabled as clock source.
The HSE frequency must be multiple
of 1 MHz and ranging from 4 MHz to
26 MHz.
The CSS interrupt is enabled for the
CAN and DFU bootloaders. Any failure
-
(or removal) of the external clock
generates system reset.
16 Kbytes, starting from address
Common to all RAM - 0x20000000 are used by the
bootloaders bootloader firmware
59 Kbytes, starting from address
System memory - 0x1FF00000, contain the bootloader
firmware
The IWDG prescaler is configured to
its maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
The voltage range is [1.8V, 3.6V]
In this range:
- Flash wait states: 3.
Power - - System clock frequency 60 MHz.
- ART Accelerator enabled.
- Flash write operation by byte (refer to
bootloader memory management
section for more information).

184/436 AN2606 Rev 61

AN2606 STM32F72xxx/73xxx devices bootloader

Table 81. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART1

USART1 Enabled configuration is 8-bit, even parity, and
one stop bit
USART1
PA10 pin: USART1 in reception mode.
bootloader USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission
USART1_TX pin Output
mode. Used in input no pull mode.
Once initialized the USART3
USART3 Enabled configuration is 8-bit, even parity, and
one stop bit
USART3
bootloader PB11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PB11/PB10) Used in input pull-up mode.
PB10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
Once initialized the USART3
USART3 Enabled configuration is 8-bit, even parity, and
one stop bit
USART3
bootloader PC11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PC11/PC10) Used in input pull-up mode.
PC10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
Used to automatically detect the serial
USARTx
SysTick timer Enabled baud rate from the host for USARTx
bootloaders
bootloaders.
Once initialized the CAN1
CAN1 Enabled configuration is: Baudrate 125 kbps,
11-bit identifier.
PD0 pin: CAN1 in reception mode.
CAN1 bootloader CAN1_RX pin Input Used in alternate push-pull, pull-up
mode.
PD1 pin: CAN1 in transmission mode.
CAN1_TX pin Output Used in alternate push-pull, pull-up
mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C1 Enabled
Slave 7-bit address: 0b1001001x
(where x = 0 for write and x = 1 for
I2C1 bootloader read)
PB6 pin: clock line is used in open-
I2C1_SCL pin Input/output
drain no pull mode.
PB9 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.

AN2606 Rev 61 185/436

435
STM32F72xxx/73xxx devices bootloader AN2606

Table 81. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C2 Enabled
Slave 7-bit address: 0b1001101x
(where x = 0 for write and x = 1 for
I2C2 bootloader read)
PF1 pin: clock line is used in open-
I2C2_SCL pin Input/output
drain no pull mode.
PF0 pin: data line is used in open-drain
I2C2_SDA pin Input/output
no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit
address, slave mode, analog filter ON.
I2C3 Enabled
Slave 7-bit address: 0b1001001x
(where x = 0 for write and x = 1 for
I2C3 bootloader read)
PA8 pin: clock line is used in open-
I2C3_SCL pin Input/output
drain no pull mode.
PC9 pin: data line is used in open-
I2C3_SDA pin Input/output
drain no pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI1 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in
SPI1_MOSI pin Input
push-pull, pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
SPI1_NSS pin Input
push-pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI2 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2 bootloader
PI2 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PI1 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PI0 pin: slave chip select pin used in
SPI2_NSS pin Input
push-pull, pull-down mode.

186/436 AN2606 Rev 61

AN2606 STM32F72xxx/73xxx devices bootloader

Table 81. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB,
SPI4 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4 bootloader
PE13 pin: slave data output line, used
SPI4_MISO pin Output
in push-pull, pull-down mode
PE12 pin: slave clock line, used in
SP4_SCK pin Input
push-pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced
USB Enabled
device mode
PA11 pin: USB DM line. Used in
USB_DM pin
DFU bootloader alternate push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in
USB_DP pin alternate push-pull, no pull mode.
No external pull-up resistor is required.
This timer is used to determine the
value of the HSE. Once HSE
CAN1 and DFU
TIM11 Enabled frequency is determined, the system
bootloaders
clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 187/436

435
STM32F72xxx/73xxx devices bootloader AN2606

38.2 Bootloader selection

Figure 47 shows the bootloader selection mechanism.

Figure 47. Bootloader V9.x selection for STM32F72xxx/73xxx

6\VWHP5HVHW

6\VWHP,QLW &ORFN*3,2V
,:'*6\V7LFN \HV

&RQILJXUH86%27*)6
GHYLFH \HV
'LVDEOHDOOLQWHUUXSW
\HV VRXUFHVDQGRWKHU
LQWHUIDFHVFORFNV
&RQILJXUH,&[
'LVDEOHDOOLQWHUUXSW 'LVDEOHDOOLQWHUUXSW
VRXUFHVDQGRWKHU VRXUFHVDQGRWKHU &RQILJXUH
LQWHUIDFHVFORFNV LQWHUIDFHVFORFNV 86$57[
&RQILJXUH63,[

([HFXWH ([HFXWH ([HFXWH

%/B63,B/RRS %/B,&B/RRS %/B86$57B/RRS
IRU63,[ IRU,&[ IRU86$57[
[)UHFHLYHGRQ
86$57[

QR
\HV

,&$GGUHVV
'HWHFWHG

QR
+6(GHWHFWHG QR QR +6(GHWHFWHG

6\QFKURPHFKDQLVP *HQHUDWH6\VWHP
GHWHFWHGRQ63,[ \HV UHVHW \HV

'LVDEOHDOOLQWHUUXSW
'LVDEOHRWKHU
VRXUFHVDQGRWKHU
QR LQWHUIDFHVFORFNV
LQWHUIDFHVFORFNV
QR

)UDPHGHWHFWHG 5HFRQILJXUH6\VWHP 5HFRQILJXUH6\VWHP

RQ&$1[ FORFNWR 0+]DQG FORFNWR 0+]
86%FORFNWR0+]

QR &RQILJXUH&$1
([HFXWH')8
ERRWORDGHUXVLQJ86%
86%FDEOH LQWHUUXSWV ([HFXWH
\HV
'HWHFWHG %/B&$1B/RRSIRU
&$1[

06Y9

188/436 AN2606 Rev 61

AN2606 STM32F72xxx/73xxx devices bootloader

38.3 Bootloader version

Table 82 lists the STM32F72xxx/73xxx devices bootloader V9.x versions.

Table 82. STM32F72xxx/73xxx bootloader V9.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps) connection

may fail due to software jitter leading to wrong
baudrate calculation.
V9.0 Initial bootloader version In that case bootloader may respond with a baudrate
up to ± 5% different from host baudrate.
Workaround: use baudrates lower than 57600 bps if
host tolerance to baudrate error is lower than ± 5%

AN2606 Rev 61 189/436

435
STM32F74xxx/75xxx devices bootloader AN2606

39 STM32F74xxx/75xxx devices bootloader

Two bootloader versions are available on STM32F74xxx/75xxx:

• V7.x supporting USART1, USART3, CAN2, I2C1, I2C2, I2C3, and DFU (USB FS
device). This version is embedded in STM32F74xxx/75xxx rev. A devices.
• V9.x supporting USART1, USART3, CAN2, I2C1, I2C2, I2C3, SPI1, SPI2, SPI4, and
DFU (USB FS device). This version is embedded in STM32F74xxx/75xxx rev. Z and
rev. 1 devices.
Note: When readout protection Level2 is activated, STM32F74xxx/75xxx devices can boot also on
system memory and all commands are not accessible except Get, GetID, and GetVersion.

39.1 Bootloader V7.x

39.1.1 Bootloader configuration

The STM32F74xxx/75xxx bootloader is activated by applying Pattern 8 (described in
Table 2). Table 83 shows the hardware resources used by this bootloader.

Table 83. STM32F74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for system
HSI enabled clock configured to 60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system
RCC HSE enabled clock configured to 60 MHz with HSE as clock source.
The HSE frequency must be multiple of 1 MHz and
ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFU
- bootloaders. Any failure (or removal) of the external clock
generates system reset.
16 Kbytes, starting from address 0x20000000 are used by
Common to all RAM -
the bootloader firmware
bootloaders
60 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The voltage range is [1.8V, 3.6V]. In this range:
- Flash wait states: 3.
- System clock frequency 60 MHz.
Power -
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader
memory management section for more information).

190/436 AN2606 Rev 61

AN2606 STM32F74xxx/75xxx devices bootloader

Table 83. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3
PB11 pin: USART3 in reception mode. Used in input pull-
bootloader (on USART3_RX pin Input
up mode.
PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
USART3 parity, and one stop bit
bootloader PC11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
(on up mode.
PC10/PC11) PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 CAN2 and SRAM.
bootloader
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, slave mode
I2C1 Enabled
– analog filter ON.
I2C1 bootloader
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, slave mode
I2C2 Enabled
– analog filter ON.
I2C2 bootloader
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.

AN2606 Rev 61 191/436

435
STM32F74xxx/75xxx devices bootloader AN2606

Table 83. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled
– slave mode, analog filter ON.
I2C3 bootloader
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.
USB Enabled USB OTG FS configured in forced device mode.
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
DFU bootloader
Input/output PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once HSE frequency is determined, the system clock is
bootloaders
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

192/436 AN2606 Rev 61

AN2606 STM32F74xxx/75xxx devices bootloader

39.1.2 Bootloader selection

Figure 48.Bootloader V7.x selection for STM32F74xxx/75xxx

System Reset
yes

System Init (Clock, GPIOs,

IWDG, SysTick) yes
Disable all interrupt
sources and other
Configure USB OTG FS interfaces clocks
device
Disable all interrupt
sources and other Configure
interfaces clocks USARTx
Configure I2Cx

Execute Execute
BL_I2C_Loop BL_USART_Loop
0x7F received on for I2Cx for USARTx
USARTx
yes

no

I2C Address
Detected HSE detected no no HSE detected

no Generate System
yes reset yes

Disable all interrupt

Frame detected Disable other
sources and other
on CANx interfaces clocks
interfaces clocks
no

no Reconfigure System Reconfigure System

clock to 60MHz and clock to 60MHz
USB clock to 48 MHz
USB cable
yes
Detected
Configure CAN
Execute DFU
bootloader using USB
interrupts Execute
BL_CAN_Loop for
CAN2

MSv37792V1

39.1.3 Bootloader version

Table 84. STM32F74xxx/75xxx bootloader V7.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps) connection may fail due to

software jitter leading to wrong baudrate calculation. In that case
bootloader may respond with a baudrate up to ± 5% different from host
V7.0 Initial bootloader version baudrate.
Workaround: use baudrates lower than 57600 bps if host tolerance to
baudrate error is lower than ± 5%

AN2606 Rev 61 193/436

435
STM32F74xxx/75xxx devices bootloader AN2606

39.2 Bootloader V9.x

39.2.1 Bootloader configuration

The STM32F74xxx/75xxx bootloader is activated by applying Pattern 8 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 85. STM32F74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 60 MHz and for USART, I2C and SPI
bootloader operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system
HSE enabled clock configured to 60 MHz with HSE as clock source.
RCC The HSE frequency must be multiple of 1 MHz and
ranging from 4 MHz to 26 MHz.
The CSS interrupt
is enabled for the CAN and DFU
-
bootloaders. Any failure (or removal) of the
external clock generates system reset.
Common to all 16 Kbytes, starting from address 0x20000000 are used by
RAM -
bootloaders the bootloader firmware
60 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The voltage range is 1.8 V, 3.6V. In this range:
- Flash wait states: 3.
- System clock frequency 60 MHz.
Power -
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader
memory management section for more information).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.

194/436 AN2606 Rev 61

AN2606 STM32F74xxx/75xxx devices bootloader

Table 85. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit, even

USART3 Enabled
parity, and one stop bit
USART3
PB11 pin: USART3 in reception mode. Used in input pull-
bootloader (on USART3_RX pin Input
up mode.
PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3
PC11 pin: USART3 in reception mode. Used in input pull-
bootloader (on USART3_RX pin Input
up mode.
PC10/PC11)
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 CAN2 and SRAM.
bootloader
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – slave mode
I2C1 bootloader – analog filter ON.
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – slave mode
I2C2 bootloader – analog filter ON.
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.

AN2606 Rev 61 195/436

435
STM32F74xxx/75xxx devices bootloader AN2606

Table 85. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – slave mode
I2C3 bootloader – analog filter ON.
– Slave 7-bit address: 0b1000101x (where x = 0 for write
and x = 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data Input line, used in push-pull, pull-down
SPI1_MOSI pin Input
bootloader mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8 MHz,
Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
SPI2
bootloader PI2 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PI1 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PI0 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

196/436 AN2606 Rev 61

AN2606 STM32F74xxx/75xxx devices bootloader

Table 85. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI4 PE14 pin: slave data Input line, used in push-pull, pull-
SPI4_MOSI pin Input
bootloader down mode
PE13 pin: slave data output line, used in push-pull, pull-
SPI4_MISO pin Output
down mode
PE12 pin: slave clock line, used in push-pull, pull-down
SP4_SCK pin Input
mode
PE11 pin: slave chip select pin used in push-pull, pull-
SPI4_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode.
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
DFU bootloader pull mode.
Input/output
PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and DFU
TIM11 Enabled Once HSE frequency is determined, the system clock is
bootloaders
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS
device), but only for the selection phase. An external clock multiple of 1 MHz (between 4
and 26 MHz) is required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 197/436

435
STM32F74xxx/75xxx devices bootloader AN2606

39.2.2 Bootloader selection

Figure 49 shows the bootloader selection mechanism.

Figure 49.Bootloader V9.x selection for STM32F74xxx/75xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx

no
yes

I2C Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CAN
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CAN2

MSv36793V1

198/436 AN2606 Rev 61

AN2606 STM32F74xxx/75xxx devices bootloader

39.2.3 Bootloader version

The following table lists the STM32F74xxx/75xxx bootloader V9.x versions:

Table 86. STM32F74xxx/75xxx bootloader V9.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps)

connection may fail due to software jitter
leading to wrong baudrate calculation.
In that case bootloader may respond with a
V9.0 Initial bootloader version baudrate up to ± 5% different from host
baudrate.
Workaround: use baudrates lower than
57600 bps if host tolerance to baudrate
error is lower than ± 5%

AN2606 Rev 61 199/436

435
STM32F76xxx/77xxx devices bootloader AN2606

40 STM32F76xxx/77xxx devices bootloader

40.1 Bootloader configuration

The STM32F76xxx/77xxx bootloader is activated by applying Pattern 9 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 87. STM32F76xxx/77xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for

HSI enabled system clock configured to 60 MHz and for
USART and I2C bootloader operation.
The HSE is used only when the CAN or the
DFU (USB FS device) interfaces are selected.
In this case the system clock configured to 60
RCC HSE enabled MHz with HSE as clock source.
The HSE frequency must be multiple of 1 MHz
and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and
- DFU bootloaders. Any failure (or removal) of
the external clock generates system reset.
16 Kbytes, starting from address 0x20000000
RAM -
Common to all are used by the bootloader firmware
bootloaders 59 Kbytes, starting from address 0x1FF00000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset (if the hardware IWDG
option was previously enabled by the user).
The voltage range is [1.8V, 3.6V]
In this range:
- Flash wait states: 3.
Power - - System clock frequency 60 MHz.
- ART Accelerator enabled.
- Flash write operation by byte (refer to
bootloader memory management section for
more information).
Once initialized the USART1 configuration is
USART1 Enabled
8-bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
input no pull mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in input no pull mode.

200/436 AN2606 Rev 61

AN2606 STM32F76xxx/77xxx devices bootloader

Table 87. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is

USART3 Enabled
8-bit, even parity, and one stop bit
USART3 bootloader PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PB11/PB10) input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized the USART3 configuration is
USART3 Enabled
8-bit, even parity, and one stop bit
USART3 bootloader PC11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PC11/PC10) input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloaders.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2
bootloader execution because CAN1 manages
the communication between CAN2 and
CAN2 bootloader SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used
CAN2_TX pin Output
in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001001x (where x = 0
I2C1 bootloader for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001001x (where x = 0
I2C2 bootloader for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no
I2C2_SCL pin Input/output
pull mode.
PF0 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.

AN2606 Rev 61 201/436

435
STM32F76xxx/77xxx devices bootloader AN2606

Table 87. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001001x (where x = 0
I2C3 bootloader for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no
I2C3_SCL pin Input/output
pull mode.
PC9 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up
SPI1 Enabled
to 8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-
SPI1_MOSI pin Input
pull, pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-
SPI1_MISO pin Output
pull, pull-down mode
PA5 pin: slave clock line, used in push-pull,
SPI1_SCK pin Input
pull-down mode
PA4 pin: slave chip select pin used in push-
SPI1_NSS pin Input
pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up
SPI2 Enabled
to 8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PI3 pin: slave data Input line, used in push-
SPI2_MOSI pin Input
pull, pull-down mode
SPI2 bootloader
PI2 pin: slave data output line, used in push-
SPI2_MISO pin Output
pull, pull-down mode
PI1 pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PI0 pin: slave chip select pin used in push-pull,
SPI2_NSS pin Input
pull-down mode.

202/436 AN2606 Rev 61

AN2606 STM32F76xxx/77xxx devices bootloader

Table 87. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up
SPI4 Enabled
to 8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PE14 pin: slave data Input line, used in push-
SPI4_MOSI pin Input
pull, pull-down mode
SPI4 bootloader
PE13 pin: slave data output line, used in push-
SPI4_MISO pin Output
pull, pull-down mode
PE12 pin: slave clock line, used in push-pull,
SP4_SCK pin Input
pull-down mode
PE11 pin: slave chip select pin used in push-
SPI4_NSS pin Input
pull, pull-down mode.
USB OTG FS configured in forced device
USB Enabled
mode
PA11 pin: USB DM line. Used in alternate
USB_DM pin
DFU bootloader push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in alternate
USB_DP pin push-pull, no pull mode.
No external pull-up resistor is required.
This timer is used to determine the value of the
CAN2 and DFU HSE. Once HSE frequency is determined, the
TIM11 Enabled
bootloaders system clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU bootloader execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, the user must use low
rather than high frequency HSE crystal values (low frequency values are better detected
due to larger error margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 61 203/436

435
STM32F76xxx/77xxx devices bootloader AN2606

40.2 Bootloader selection

Figure 50 and Figure 51 show the bootloader selection mechanism.

Figure 50. Dual bank boot implementation for STM32F76xxx/77xxx Bootloader V9.x

System Reset

nDBANK = 0 &
yes
nDBOOT = 0

Select BOOT_ADDx by BOOT0

no Pin(1)

Compute entire boot address from

BOOT_ADDx
Protection level2
enabled yes

no If boot address is out of Protection level2

yes yes
memory range or in ICP enabled
Jump to AXIM-Flash
Continue Bootloader
base address 0x0800
execution
0000 no
no
Continue Bootloader
execution
If boot address is in
RAM memory (SRAM1, yes
SRAM2, DTCM RAM)

no

If the code in boot

address is valid(2)
yes

If boot address is in
yes
Bank2

Set Bank Swap to

Bank2

no
Jump to address
defined by
BOOT_ADDx
If boot address is in
no yes
Bank1
Set Bank Swap to
Bank1

no
Jump to address
defined by
BOOT_ADDx

Protection level2
yes
enabled

no

Jump to AXIM-Flash
Continue Bootloader
base address 0x0800
execution
0000

MSv38482V2

1. Only BOOT_ADD0 value is considered whatever the BOOT0 pin state, as described in Table 88.
2. ITCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

204/436 AN2606 Rev 61

AN2606 STM32F76xxx/77xxx devices bootloader

Figure 51. Bootloader V9.x selection for STM32F76xxx/77xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx
yes
no

I2C Address
Detected HSE detected no no HSE detected

Generate System
no reset
yes yes

Disable all interrupt

Disable other
Synchro mechanism sources and other
interfaces clocks
detected on SPIx interfaces clocks

no Reconfigure System Reconfigure System

no clock to 60 MHz and clock to 60 MHz
USB clock to 48 MHz
Frame detected
on CANx Configure CAN
Execute DFU
bootloader using USB
no interrupts Execute
BL_CAN_Loop for
CANx
USB cable
yes
Detected

MSv38483V2

AN2606 Rev 61 205/436

435
STM32F76xxx/77xxx devices bootloader AN2606

40.3 Bootloader version

The following table lists the STM32F76xxx/77xxx devices bootloader V9.x versions.

Table 88. STM32F76xxx/77xxx bootloader V9.x versions

Version
Description Known limitations
number

When the flash memory is configured to the dual

bank boot mode (nDBANK=nDBOOT=0),
whatever the BOOT0 Pin state only
BOOT_ADD0 value is considered (when BOOT0
Pin=1, BOOT_ADD0 value is considered not the
BOOT_ADD1).
Workaround: to manage dual bank boot with
BOOT_ADD0 only, refer to AN4826 "STM32F7
series flash memory dual bank mode”
At high UART baudrates (115200 bps)
V9.3 Initial bootloader version
connection may fail due to software jitter leading
to wrong baudrate calculation.
In that case bootloader may respond with a
baudrate up to ± 5% different from host baudrate.
Workaround: use baudrates lower than
57600 bps if host tolerance to baudrate error is
lower than ± 5%.
Bank2 sector erase issue when using USB
interface. Erasing a sector from bank2 with index
(i) leads to erase sector (i+4)

206/436 AN2606 Rev 61

AN2606 STM32G03xxx/STM32G04xxx devices bootloader

41 STM32G03xxx/STM32G04xxx devices bootloader

41.1 Bootloader configuration

The STM32G03xxx/G04xxx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader. Note
that STM32G030x do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 89. STM32G03xxx/G04xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
4 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
Common to all
bootloaders System memory - 8 Kbytes, starting from address 0x1FFF0000
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF1D00
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloader SysTick timer Enabled
from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1010110x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.

AN2606 Rev 61 207/436

435
STM32G03xxx/STM32G04xxx devices bootloader AN2606

Table 89. STM32G03xxx/G04xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010110x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.

Note: On SO8, WLCSP18, TSSOP20, and UFQFN28 packages USART1 PA9/PA10 IOs are
remapped on PA11/PA12.

41.2 Bootloader selection

Figure 52 shows the bootloader selection mechanism.

Figure 52. Bootloader V5.x selection for STM32G03xxx/G04xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
no I2Cx Address
Detected interfaces clock’s interfaces clock’s

Execute Configure
BL_I2C_Loop for USARTx
I2Cx

Execute
BL_USART_Loop
for USARTx

MS52813V1

208/436 AN2606 Rev 61

AN2606 STM32G03xxx/STM32G04xxx devices bootloader

41.3 Bootloader version

Table 90 lists the STM32G03xxx/G04xxx devices bootloader versions.

Table 90. STM32G03xx/04xxx bootloader versions

Version number Description Known limitations

– Supports only 48- and 32-pin packages

– Issue is seen for both packages, if PA3
V5.1 Initial bootloader version stays to low level, system is stuck in the
USART2 detection sequence and no
other interface is detected.
Issue is seen for all packages (except SO8,
no PA3 pin), if PA3 stays to low level,
Add support to small packages
V5.2 system is stuck in the USART2 detection
8/20 and 28 pins
sequence and no other interface is
detected.
V5.3 Fix V5.2 limitations None

AN2606 Rev 61 209/436

435
STM32G07xxx/08xxx device bootloader AN2606

42 STM32G07xxx/08xxx device bootloader

42.1 Bootloader configuration

The STM32G07xxx/G08xxx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader.
STM32G070x devices do not have BOOT_LOCK(bit), consider that when using Pattern 11.

Table 91. STM32G07xxx/8xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
12 Kbytes starting from address 0x20000000 are
RAM -
used by the bootloader firmware
Common to all 28 Kbytes starting from address 0x1FFF0000,
bootloaders System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

210/436 AN2606 Rev 61

AN2606 STM32G07xxx/08xxx device bootloader

Table 91. STM32G07xxx/8xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1010001x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010001x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode.
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

AN2606 Rev 61 211/436

435
STM32G07xxx/08xxx device bootloader AN2606

Table 91. STM32G07xxx/8xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

212/436 AN2606 Rev 61

AN2606 STM32G07xxx/08xxx device bootloader

42.2 Bootloader selection

Figure 53 shows the bootloader selection mechanism.

Figure 53. Bootloader V11.0 selection for STM32G07xxx/G08xxx

Bootloader

Disable all interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx
yes

Configure SPIx
yes

0x7F received
on USARTx yes
Disable all other
no interfaces clocks

I2C Address Disable all other Disable all other

Detected Configure
interfaces clocks interfaces clocks USARTx

no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
no for SPIx for I2Cx for USARTx
Synchro mechanism
detected on SPIx

MS51450V1

42.3 Bootloader version

Table 92 lists the STM32G07xxx/8xxx devices bootloader versions.

Table 92. STM32G07xx/08xxx bootloader versions

Version number Description Known limitations

V11.0 Initial bootloader version Not supporting packages smaller than LQFP64
V11.1 Supporting all packages None

AN2606 Rev 61 213/436

435
STM32G07xxx/08xxx device bootloader AN2606

Table 92. STM32G07xx/08xxx bootloader versions (continued)

Version number Description Known limitations

– Option byte launch missing when using

USART protocol
– RCC register RCC_ICSCR is not set to its
default value when Go command is used.
HSITRIM value is set to a value different
Add securable memory from default.
V11.2
area feature – RCC registers are not set to their default
value when “Go” command is used
(HSITRIM is not correctly reset).
– Enabling SRAM parity check option byte
causes bootloader crash if the SRAM is not
initialized before enabling this feature.
V11.3 Fix all V11.2 limitations None

214/436 AN2606 Rev 61

AN2606 STM32G0B0xx device bootloader

43 STM32G0B0xx device bootloader

43.1 Bootloader configuration

The STM32G0B0xx bootloader is activated by applying Pattern 11 (described in Table 2).
The following table shows the hardware resources used by this bootloader. Note that
STM32G0B0x do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 93. STM32G0B0xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL

HSI enabled clocked by HSI). If an external clock (HSE) is not
present, the system is kept clocked from the HSI
RCC The external clock can be used for all bootloader
interfaces and must have one of the following values
HSE enabled
[48, 32, 16, 12, 8] MHz. The PLL is used to generate
48 MHz for USB and system clock.
16 Kbytes starting from address 0x20000000 are
Common to all RAM -
used by the bootloader firmware
bootloaders
The bootloader firmware is shared on two banks:
- 28 Kbytes, starting from address 0x1FFF0000 until
System memory -
0x1FFF6FFF
- Part of the 28 KB (0x1FFF8000 – 0x1FFFEFFF)
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the exit securable
- -
area memory area is 0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 61 215/436

435
STM32G0B0xx device bootloader AN2606

Table 93. STM32G0B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit,

USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1011101x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1011101x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode.
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

216/436 AN2606 Rev 61

AN2606 STM32G0B0xx device bootloader

Table 93. STM32G0B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in Forced Device mode. USB
FS interrupt vector is enabled and used for USB
USB Enabled DFU communications. Note: VDDUSB IO must be
connected to 3.3 V as USB peripheral is used by the
DFU bootloader bootloader.‘
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 61 217/436

435
STM32G0B0xx device bootloader AN2606

43.2 Bootloader selection

Figure 54 shows the bootloader selection mechanism.

Figure 54. Bootloader selection for STM32G0B0xx

System Reset

Configure System clock to

60 MHz using HSI

HSE= 48, 32, 16, no

12, 8 MHz ?

yes
Reconfigure System clock to
60 MHz using HSE System Init (Clock, GPIOs,
IWDG, SysTick)

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

Configure I2Cx
yes

Configure SPIx
Disable all interrupt
sources and other
interfaces clock’s

0x7F received
Disable all interrupt
on USARTx
sources and other Configure
interfaces clock’s USARTx
no
Disable all interrupt
sources and other Execute Execute
interfaces clocks BL_I2C_Loop for
I2Cx Address BL_USART_Loop
I2Cx for USARTx
Detected
Execute
BL_SPI_Loop
for SPIx
no

Synchro mechanism yes

detected on SPIx
no Disable other
interfaces clock’s

USB cable
Detected & USB Execute DFU
configured bootloader using USB
interrupts
MS54534V2

218/436 AN2606 Rev 61

AN2606 STM32G0B0xx device bootloader

43.3 Bootloader version

Table 94 lists the STM32G0B0xx devices bootloader versions.

Table 94. STM32G0B0xx bootloader versions

Version number Description known limitations

V13.0 Initial bootloader version None

AN2606 Rev 61 219/436

435
STM32G0B1xx/0C1xx device bootloader AN2606

44 STM32G0B1xx/0C1xx device bootloader

44.1 Bootloader configuration

The STM32G0B1xx/0C1xx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 95. STM32G0B1xx/0C1xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL

HSI enabled
clocked by HSI).
The clock recovery system (CRS) is enabled for the
RCC
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x20000000 are
Common to all RAM -
used by the bootloader firmware
bootloaders
The bootloader firmware is shared on two banks:
- 28 Kbytes, starting from address 0x1FFF0000 until
System memory -
0x1FFF6FFF
- Part of the 28 KB (0x1FFF8000 – 0x1FFFEFFF)
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

220/436 AN2606 Rev 61

AN2606 STM32G0B1xx/0C1xx device bootloader

Table 95. STM32G0B1xx/0C1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1011101x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1011101x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode.
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

AN2606 Rev 61 221/436

435
STM32G0B1xx/0C1xx device bootloader AN2606

Table 95. STM32G0B1xx/0C1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in Forced device mode. USB FS
interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.‘
USB_DM pin PA11: USB DM line. Used in no pull mode.
Input/output PA12: USB DP line. Used in no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-up mode.
PD1 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-up mode.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

222/436 AN2606 Rev 61

AN2606 STM32G0B1xx/0C1xx device bootloader

44.2 Bootloader selection

Figure 55 shows the bootloader selection mechanism.

Figure 55. Bootloader selection for STM32G0B1xx/0C1xx

System Reset

Configure System clock to

60 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

Device
Execute
BL_FDCAN loop

Configure I2Cx

Configure SPIx Disable all interrupt

sources and other
interfaces clocks
FDCAN frame Disable all interrupt Disable all interrupt
detected yes sources and other Configure
sources and other
interfaces clocks interfaces clocks USARTx
no
Execute Execute Execute
0x7F received BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
on USARTx yes for SPIx for I2Cx for USARTx

no

I2C Address
yes
Detected

no

no
Execute DFU
Synchro mechanism yes bootloader using USB
detected on SPIx
interrupts

no

USB cable yes

Detected

MS52834V1

AN2606 Rev 61 223/436

435
STM32G0B1xx/0C1xx device bootloader AN2606

44.3 Bootloader version

Table 96 lists the STM32G0B1xx/0C1xx devices bootloader versions.

Table 96. STM32G0B1xx/0C1xx bootloader versions

Version number Description known limitations

V9.2 Initial bootloader version None

224/436 AN2606 Rev 61

AN2606 STM32G05xxx/061xx devices bootloader

45 STM32G05xxx/061xx devices bootloader

45.1 Bootloader configuration

The STM32G05xxx/061xx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader. Note
that STM32G050x do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 97. STM32G05xxx/061xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
4 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
Common to all 8 Kbytes, starting from address 0x1FFF0000,
bootloaders System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloader SysTick timer Enabled
from the host for USART2 bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1100010x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.

AN2606 Rev 61 225/436

435
STM32G05xxx/061xx devices bootloader AN2606

Table 97. STM32G05xxx/061xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1100010x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.

226/436 AN2606 Rev 61

AN2606 STM32G05xxx/061xx devices bootloader

45.2 Bootloader selection

Figure 56 shows the bootloader selection mechanism.

Figure 56. Bootloader selection for STM32G05xxx/061xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
no I2Cx Address
Detected interfaces clock’s interfaces clock’s

Execute Configure
BL_I2C_Loop for USARTx
I2Cx

Execute
BL_USART_Loop
for USARTx

MS52813V1

45.3 Bootloader version

Table 98 lists the STM32G05xxx/061xx devices bootloader versions.

Table 98. STM32G05xxx/061xx bootloader versions

Version number Description Known limitations

V5.0 Initial bootloader version USART2 SW jitter issue on detection phase

V5.1 Fix V5.0 limitation None

AN2606 Rev 61 227/436

435
STM32G431xx/441xx devices bootloader AN2606

46 STM32G431xx/441xx devices bootloader

46.1 Bootloader configuration

The STM32G431xx/441xx bootloader is activated by applying Pattern 15 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 99. STM32G431xx/441xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the

HSI enabled
PLL clocked by HSI)
RCC The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
16 Kbytes, starting from address 0x20000000 are
Common to all RAM -
used by the bootloader firmware
bootloaders
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to the exit securable memory
- -
area area @0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

228/436 AN2606 Rev 61

AN2606 STM32G431xx/441xx devices bootloader

Table 99. STM32G431xx/441xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010100x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PC4 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PA8 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1010100x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PC8 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1 bootloader SPI1_MOSI pin Input
pull-down mode.
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

AN2606 Rev 61 229/436

435
STM32G431xx/441xx devices bootloader AN2606

Table 99. STM32G431xx/441xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
DFU bootloader
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

230/436 AN2606 Rev 61

AN2606 STM32G431xx/441xx devices bootloader

46.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 57. Bootloader selection for STM32G431xx/441xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes
Detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
Execute DFU
bootloader using USB
no
interrupts
no

USB cable yes

Detected

MS51432V1

AN2606 Rev 61 231/436

435
STM32G431xx/441xx devices bootloader AN2606

46.3 Bootloader version

Table 100. STM32G431xx/441xx bootloader version
Version
Description Known limitations
number

V13.3 (0xD3) Initial bootloader version CCSRAM not supported

V13.4 (0xD4) Fix V13.3 limitations Add CCSRAM support

232/436 AN2606 Rev 61

AN2606 STM32G47xxx/48xxx devices bootloader

47 STM32G47xxx/48xxx devices bootloader

47.1 Bootloader configuration

The STM32G47xxx/48xxx bootloader is activated by applying Pattern 14 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 101. STM32G47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the

HSI enabled
PLL clocked by HSI)
RCC The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
16 Kbytes, starting from address 0x20000000 are
Common to all RAM -
used by the bootloader firmware
bootloaders
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
- The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG
- watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to the exit securable memory
- -
area area @0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 61 233/436

435
STM32G47xxx/48xxx devices bootloader AN2606

Table 101. STM32G47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010011x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PC4 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PA8 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1010011x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PC8 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C4 Enabled analog filter ON.
Slave 7-bit address: 0b1010011x
I2C4 bootloader (where x = 0 for write and x = 1 for read)
PC6 pin: clock line is used in open-drain pull-up
I2C4_SCL pin Input/output
mode.
PC7 pin: data line is used in open-drain pull-up
I2C4_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1 bootloader SPI1_MOSI pin Input
pull-down mode.
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull no pull-
SPI1_SCK pin Input
up, pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

234/436 AN2606 Rev 61

AN2606 STM32G47xxx/48xxx devices bootloader

Table 101. STM32G47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
npull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, n pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 61 235/436

435
STM32G47xxx/48xxx devices bootloader AN2606

47.2 Bootloader selection

The figures below show the bootloader selection mechanism.

Figure 58. Bootloader selection for STM32G47xxx/48xxx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes
Detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
Execute DFU
bootloader using USB
no
interrupts
no

USB cable yes

Detected

MS51432V1

236/436 AN2606 Rev 61

AN2606 STM32G47xxx/48xxx devices bootloader

Figure 59. Dual bank boot implementation for STM32G47xxx/48xxx bootloader V13.x

System Reset

If Boot from
FLASH
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader executio
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MS52833V1

47.3 Bootloader version

Table 102. STM32G47xxx/48xxx bootloader version
Version number Description Known limitations

V13.3 (0xD3) Initial bootloader version Boot from bank2 is not working

AN2606 Rev 61 237/436

435
STM32G47xxx/48xxx devices bootloader AN2606

Table 102. STM32G47xxx/48xxx bootloader version (continued)

Version number Description Known limitations

V13.4 (0xD4) Fix V13.3 limitations CCSRAM/ENGI not supported

– Fix V13.4 limitations
V13.5 (0xD5) None
– Add CCSRAM/ENGI support

238/436 AN2606 Rev 61

AN2606 STM32G491xx/4A1xx devices bootloader

48 STM32G491xx/4A1xx devices bootloader

48.1 Bootloader configuration

The STM32G491xx/4A1xx bootloader is activated by applying Pattern 15 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 103. STM32G491xx/4A1xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the

HSI enabled
PLL clocked by HSI)
RCC The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
16 Kbytes, starting from address 0x20000000 are
Common to all RAM -
used by the bootloader firmware
bootloaders
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to the exit securable memory
- -
area area @0x1FFF6800
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 61 239/436

435
STM32G491xx/4A1xx devices bootloader AN2606

Table 103. STM32G491xx/4A1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1011111x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PC4 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PA8 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1011111x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PC8 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1 bootloader SPI1_MOSI pin Input
pull-down mode.
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull no pull-
SPI1_SCK pin Input
up, pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

240/436 AN2606 Rev 61

AN2606 STM32G491xx/4A1xx devices bootloader

Table 103. STM32G491xx/4A1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
npull-down mode.
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, n pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as bit DMATx enable on SPI
CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 61 241/436

435
STM32G491xx/4A1xx devices bootloader AN2606

48.2 Bootloader selection

Figure 60. Bootloader selection for STM32G491xx/4A1xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes
Detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
Execute DFU
bootloader using USB
no
interrupts
no

USB cable yes

Detected

MS51432V1

242/436 AN2606 Rev 61

AN2606 STM32G491xx/4A1xx devices bootloader

48.3 Bootloader version

Table 104. STM32G491xx/4A1xx bootloader version
Version number Description Known limitations

V13.2 Initial bootloader version None

AN2606 Rev 61 243/436

435
STM32H503xx devices bootloader AN2606

49 STM32H503xx devices bootloader

49.1 Bootloader configuration

The STM32H503xx bootloader is activated by applying Pattern 17 (described in Table 2).
Table 105 shows the hardware resources used by this bootloader.

Table 105. STM32H503xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 160 MHz (using PLL

HSI enabled
clocked by the HSI)
The clock recovery system (CRS) is enabled for the
RCC
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
Common to all 16 Kbytes starting from address 0x24000000 are
bootloaders RAM -
used by the bootloader firmware
35 Kbytes starting from address 0x0BF87000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as
USART1_TX pin Output
Input until USART1 is detected.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA15 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA5 pin: USART2 in transmission mode. Set as
USART2_TX pin Output
Input until USART2 is detected.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PA3 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-down mode.
PA4 pin: USART3 in transmission mode. Set as
USART3_TX pin Output
Input until USART3 is detected.

244/436 AN2606 Rev 61

AN2606 STM32H503xx devices bootloader

Table 105. STM32H503xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1100111x, where x = 0 for
I2C2 bootloader write and x = 1 for read
PB3 pin: clock line is used in open-drain. pull up
I2C2_SCL pin Input/output
mode.
PB4 pin: data line is used in open-drain, pull up
I2C2_SDA pin Input/output
mode.
PA7 pin: slave data Input line, used in push-pull, no
SPI1_MOSI pin Input
pull mode.
PA0 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
SPI1 bootloader
PA8 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PB8 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
PB1 pin: slave data input line, used in push-pull no
SPI2_MOSI pin Input
pull mode
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
no pull mode.
SPI2 bootloader
PB10 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PB12 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.
PC12 pin: slave data input line, used in push-pull no
SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
SPI3 bootloader
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PD2 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU bootloader USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required

AN2606 Rev 61 245/436

435
STM32H503xx devices bootloader AN2606

Table 105. STM32H503xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode. No
USB_DP pin
external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN bootloader – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB5 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, no pull mode.
PB15 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, no pull mode.
– mode: target mode
– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: Disabled
– Status FIFO: Disabled
– DMA Req status: Disabled
I3C Enabled – DMA Req control: Disabled
– IBI: Enabled
– Additional data after IBI Acked: 1 byte
I3C bootloader
– IBI configuration: Mandatory Data Byte (MDB)
– All IT disabled except RXFNE (Receive FIFO
Interrupt)
o The RXFNE interruption is disabled after SYNC
byte detection by the bootloader.
PB6 pin: I3C1 in transmission mode. Used in
I3C1_SCL pin
alternate push-pull, no pull mode.
Input/output
PB7 pin: I3C1 in transmission mode. Used in
I3C1_SDA pin
alternate push-pull, no pull mode.

246/436 AN2606 Rev 61

AN2606 STM32H503xx devices bootloader

Table 106. STM32H503xx special commands

Special commands supported (USART/I2C/SPI/FDCAN/I3C)
Opcode - 0x50

Sub- Number of Number Number of status

Data sent Data Status data
Function Opcode data sent of data data received
(MSB first) received received
(2 bytes) (2 bytes) received (2 bytes)

Change Product state

Product 0x01 0x4 targeted Ex: 0x0 NA 0x1 0x0
state 0x00000017
Reset 0x02 0x4 0x0 0x0 NA 0x1 0x0

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte (LSB first). No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 61 247/436

435
STM32H503xx devices bootloader AN2606

49.2 Bootloader selection

Figure 61. Bootloader V14 selection for STM32H503xx

System Reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USART Tx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 160 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
braodcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx

MS57511V2

49.3 Bootloader version

Table 107. STM32H503xx bootloader version
Version number Description Known limitations

Bootloader crash when jumping to it with (HiDe Protection Level = 3

V14.1 Initial bootloader version
+ product state ≥ Provisioned)

248/436 AN2606 Rev 61

AN2606 STM32H563xx/573xx devices bootloader

50 STM32H563xx/573xx devices bootloader

50.1 Bootloader configuration

The STM32H563xx/573xx bootloader is activated by applying Pattern 17 (described in
Table 2). Table 108 shows the hardware resources used by this bootloader.

Table 108. STM32H563xx/573xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 160 MHz (using PLL

HSI enabled
clocked by the HSI)
The clock recovery system (CRS) is enabled for the
RCC
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
Common to all 16 Kbytes starting from address 0x20000000 are
bootloaders RAM -
used by the bootloader firmware
35 Kbytes starting from address 0x0BF97000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as
USART1_TX pin Output
Input until USART1 is detected.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as
USART2_TX pin Output
Input until USART2 is detected.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PD9 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-down mode.
PD8 pin: USART3 in transmission mode. Set as
USART3_TX pin Output
Input until USART3 is detected.

AN2606 Rev 61 249/436

435
STM32H563xx/573xx devices bootloader AN2606

Table 108. STM32H563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1100101x, where x = 0 for
I2C3 bootloader write and x = 1 for read
PA8 pin: clock line is used in open-drain. pull up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain, pull up
I2C3_SDA pin Input/output
mode.
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C4 Enabled analog filter ON.
Slave 7-bit address: 0b1100101x, where x = 0 for
I2C4 bootloader write and x = 1 for read
PD12 pin: clock line is used in open-drain. pull up
I2C4_SCL pin Input/output
mode.
PD13 pin: data line is used in open-drain, pull up
I2C4_SDA pin Input/output
mode.
PA7 pin: slave data Input line, used in push-pull, no
SPI1_MOSI pin Input
pull mode.
PA6pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
SPI1 bootloader
PA5 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PA4 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
PC1 pin: slave data input line, used in push, pull no
SPI2_MOSI pin Input
pull mode
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
no pull mode.
SPI2 bootloader
PB10 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PB12 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.
PC12 pin: slave data input line, used in push-pull no
SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
SPI3 bootloader
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.

250/436 AN2606 Rev 61

AN2606 STM32H563xx/573xx devices bootloader

Table 108. STM32H563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU bootloader USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the FDCAN2 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN2 Enabled
Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN bootloader TransmitPause = DISABLE
ProtocolException = ENABLE
PB5 pin: FDCAN2 in reception mode. Used in
FDCAN2_Rx pin Input
alternate push-pull, no pull mode.
PB13 pin: FDCAN2 in transmission mode. Used in
FDCAN2_Tx pin Output
alternate push-pull, no pull mode.

AN2606 Rev 61 251/436

435
STM32H563xx/573xx devices bootloader AN2606

Table 108. STM32H563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

– mode: target mode

– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: Disabled
– Status FIFO: Disabled
– DMA Req status: Disabled
I3C Enabled – DMA Req control: Disabled
– IBI: Enabled
– Additional data after IBI Acked: 1 byte
I3C bootloader
– IBI configuration: Mandatory Data Byte (MDB)
– All IT disabled except RXFNE (Receive FIFO
Interrupt)
o The RXFNE interruption is disabled after SYNC
byte detection by the bootloader.
PB6 pin: I3C1 in transmission mode. Used in
I3C1_SCL pin
alternate push-pull, no pull mode.
Input/output
PB7 pin: I3C1 in transmission mode. Used in
I3C1_SDA pin
alternate push-pull, no pull mode.

Table 109. STM32H563xx/573xx special commands

Special commands supported (USART/I2C/SPI/FDCAN/I3C)
Opcode - 0x50

Number of
Sub- Number of Number of
Data sent Data status data Status data
Function Opcode data sent data
(MSB first) received received received
(2 bytes) (2 bytes) received
(2 bytes)

Product state
Change
0x01 0x4 targeted Ex: 0x0 NA 0x1 0x0
Product state
0x00000017
Reset 0x02 0x4 0x0 0x0 NA 0x1 0x0
Data RAM address NA - if
0x0 - if
Provisioning where Data to success
0x83 0x4 success 0x1 0x0
Only when BL is provision is Error code
0x1 - if fail
on HDPL = 1 written - if fail

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte (LSB first). No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

252/436 AN2606 Rev 61

AN2606 STM32H563xx/573xx devices bootloader

50.2 Bootloader selection

Figure 62 shows the bootloader selection mechanism.

Figure 62. Bootloader V14 selection for STM32H563xx/573xx

System Reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USART Tx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 160 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
braodcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx

MS57511V2

AN2606 Rev 61 253/436

435
STM32H563xx/573xx devices bootloader AN2606

50.3 Bootloader version

Table 110. STM32H563xx/573xx bootloader version
Version
Description Known limitations
number

V14.5 Fix known limitations (1) None

– Fix known limitations
V14.4 – Change BL system clock EEPROM sector erase not working on 1 Mbyte devices.
from 160 to 200 MHz
Bootloader crash when jumping to it with the following condition
V14.3 Initial bootloader version
(TrustZone® enabled + HiDe Protection = 3 + Product state ≥ Provisioned)
1. Only on 1 Mbytes devices.

A standalone EraseEEPROM function is added on the system memory at address

0x0BF9 F500. When an erase sector is needed:
1. Write at RAM address 0x2000 4000 (LSB to MSB)
a) Byte0: number of sectors to erase (N)
b) Byte1 to N (every byte contains the sector number, that is, 0 to 7 for Bank1, 8 to 15
for Bank2)
c) Example: to erase sector 3, 4, and 13, write 0x0303 040D at address 0x20004000.
2. After the erase, go back to the bootloader.
3. To continue using the bootloader, a reconnect is needed.

254/436 AN2606 Rev 61

AN2606 STM32H72xxx/73xxx devices bootloader

51 STM32H72xxx/73xxx devices bootloader

51.1 Bootloader configuration

The STM32H72xxx/73xxx bootloader is activated by applying Pattern 10 (described in
Table 2). Table 111 shows the hardware resources used by this bootloader.

Table 111. STM32H72xxx/73xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 66 MHz (using PLL

HSI enabled
clocked by the HSI)
The clock recovery system (CRS) is enabled for the
RCC
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x24000000 are
RAM -
used by the bootloader firmware
128 Kbytes starting from address 0x1FFF0000,
Common to all
System memory - contain the bootloader firmware. The bootloader
bootloaders
start address is 0x1FF09800
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Voltage range is set to Voltage Range 3.
Bootloader SW is writing to the PWR_CR3 register
Power - using 4 bytes, which is locking this register. Only
Power off/on will unlock it. This is fixed on the BL
with 0x93 version.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
USART1 bootloader alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output alternate push-pull, pull-up mode. Set as Input until
USART1 is detected on the BL version 0x93.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input
USART2 bootloader alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output alternate push-pull, pull-up mode. Set as Input until
USART2 is detected on the BL version 0x93.

AN2606 Rev 61 255/436

435
STM32H72xxx/73xxx devices bootloader AN2606

Table 111. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit,

USART3 Enabled
even parity, and one stop bit
PB11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-down mode.
(on PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output alternate push-pull, pull-down mode. Set as Input
until USART3 is detected on the BL version 0x93.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PD9 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-down mode.
(on PD8/PD9)
PD8 pin: USART3 in transmission mode. Used in
USART3_TX pin Output alternate push-pull, pull-down mode. Set as Input
until USART3 is detected on the BL version 0x93.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1010111x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010111x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PF0 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1010111x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.

256/436 AN2606 Rev 61

AN2606 STM32H72xxx/73xxx devices bootloader

Table 111. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, no
SPI1 bootloader SPI1_MOSI pin Input
pull mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
PA5 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PA4 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull no
SPI3 bootloader SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.

AN2606 Rev 61 257/436

435
STM32H72xxx/73xxx devices bootloader AN2606

Table 111. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull,
SPI4_MOSI pin Input
pull-down mode
SPI4 bootloader
PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
pull-down mode.
PE12 pin: slave clock line, used in push-pull, pull-
SPI4_SCK pin Input
dpwn mode.
PE11 pin: slave chip select pin used in push-pull,
pull-up mode.
SPI4_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU bootloader USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN bootloader AutoRetransmission = ENABLE
(on PH13/PH14) TransmitPause = DISABLE
ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-down mode.
PH13 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

258/436 AN2606 Rev 61

AN2606 STM32H72xxx/73xxx devices bootloader

Table 111. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN1 configuration is:

Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN bootloader AutoRetransmission = ENABLE
(on PD1/PD0) TransmitPause = DISABLE
ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-down mode.
PD1 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

AN2606 Rev 61 259/436

435
STM32H72xxx/73xxx devices bootloader AN2606

51.2 Bootloader selection

Figure 63 shows the bootloader selection mechanism.

Figure 63. Bootloader V9.0 selection for STM32H72xxx/73xxx

System Reset

Configure System clock to

66 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS Device

Configure I2Cx

Configure SPIx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MS54027V2

260/436 AN2606 Rev 61

AN2606 STM32H72xxx/73xxx devices bootloader

51.3 Bootloader version

Table 114 lists the STM32H72xxx/73xxx devices bootloader versions.

Table 112. STM32H72xxx/73xxx bootloader version

Version
Description Known limitations
number

– TCM_AXI OB cannot be modified using all BL interfaces

V9.1 Initial bootloader version – String returned describing the memory size when using
USB is wrong
– Crash loop when booting on the BL, setting RDP to
Level1, doing a reset or power on/off and the USB cable
is plugged.
– BL is not working in RDP Level1 when
Fix all issues of previous
V9.2 TCM_AXI_SHARED option byte is not “0”. Value of this
release
OB must be set to “0” before going to RDP L1.
– Bootloader SW is writing to the PWR_CR3 register using
4 bytes, which is locking this register. Only Power off/on
will unlock it.
– Fix all issues of
previous release.
V9.3 – Modify USART TX None
from push pull mode in
the previous versions
to input.

AN2606 Rev 61 261/436

435
STM32H74xxx/75xxx devices bootloader AN2606

52 STM32H74xxx/75xxx devices bootloader

52.1 Bootloader configuration

The STM32H74xxx/75xxx bootloader is activated by applying Pattern 10 (described in
Table 2). Table 113 shows the hardware resources used by this bootloader.

Table 113. STM32H74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz using the

HSI. The HSI clock source is used at startup
HSI enabled
(interface detection phase) and when USART or SPI
or I2C interface is selected.
RCC The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
Clock used for the FDCAN is fixed to 20 MHz and is
-
derived from PLLQ
16 Kbytes, starting from address 0x20000000, and
208 Kbytes (reduced to 20 Kbytes in V9.1 version)
RAM -
Common to all starting from address 0x24000000 are used by the
bootloaders bootloader firmware
122 Kbytes, starting from address 0x1FFF0000,
System memory - contain the bootloader firmware. The bootloader
start address is 0x1FF09800
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Voltage is set to Range 3. Bootloader software
writes to the PWR_CR3 register using 4 bytes,
Power -
which locks this register. Only Power off/on unlocks
it. This is fixed on the bootloader with 0x91 version.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
USART1 bootloader alternate push-pull, pull-up mode.
(on PA9/PA10)
PA9 pin: USART1 in transmission mode. Used in
alternate push-pull, pull-up mode. Set as input until
USART1_TX pin Output
USART1 is detected on the bootloader version
0x91.

262/436 AN2606 Rev 61

AN2606 STM32H74xxx/75xxx devices bootloader

Table 113. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART1 configuration is 8-bit,

USART1 Enabled
even parity, and one stop bit
PB15 pin: USART1 in reception mode.Used in input
USART1 bootloader USART1_RX pin Input
pull-up mode.
(on PB14/PB15)
PB14 pin: USART1 in transmission mode. Used in
USART1_TX pin Output input pull-up mode. Set as input until USART2 is
detected on the bootloader version 0x91.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input alternate push-pull, no pull mode. Used in alternate
USART2 bootloader push-pull, no pull mode.
PA2 pin: USART2 in transmission mode. Used in
alternate push-pull, no pull mode. Set as input until
USART2_TX pin Output
USART3 is detected on the bootloader version
0x91.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
alternate push-pull, no pull mode.
USART3 bootloader
PB10 pin: USART3 in transmission mode. Used in
alternate push-pull, no pull mode. Set as input until
USART3_TX pin Output
USART3 is detected on the bootloader version
0x91.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001110x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001110x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PF0 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.

AN2606 Rev 61 263/436

435
STM32H74xxx/75xxx devices bootloader AN2606

Table 113. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled mode, analog filter ON.
Slave 7-bit address: 0b1001110x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, no
SPI1 bootloader SPI1_MOSI pin Input
pull mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
PA5 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PA4 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in push-pull, no
SPI2 bootloader SPI2_MOSI pin Input
pull mode.
PI2 pin: slave data output line, used in push-pull, no
SPI2_MISO pin Output
pull mode.
PI1 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PI0 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.

264/436 AN2606 Rev 61

AN2606 STM32H74xxx/75xxx devices bootloader

Table 113. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data Input line, used in push-pull,
SPI3 bootloader SPI3_MOSI pin Input
no pull mode.
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.
The SPI4 configuration is:
– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in push-pull,
SPI4 bootloader SPI4_MOSI pin Input
no pull mode.
PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
no pull mode.
PE12 pin: slave clock line, used in push-pull, no pull
SPI4_SCK pin Input
mode.
PE11 pin: slave chip select pin used in push-pull, no
SPI4_NSS pin Input
pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU bootloader USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required

AN2606 Rev 61 265/436

435
STM32H74xxx/75xxx devices bootloader AN2606

Table 113. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN1 configuration is:

Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN bootloader TransmitPause = DISABLE
ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-up mode.
PH13 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-up mode.

Note: To connect to the bootloader USART1 using PB14/PB15 pins, user must send two
synchronization bytes. Baudrate is limited to 115200.
DFU mode does not support USBREGEN mode. If STM32 is powered by 1.8 V source, it is
not possible to use the BL DFU unless 3.3 V is provided

266/436 AN2606 Rev 61

AN2606 STM32H74xxx/75xxx devices bootloader

52.2 Bootloader selection

Figure 64 shows the bootloader selection mechanism.

Figure 64. Bootloader V9.x selection for STM32H74xxx/75xxx

System Reset

Configure System clock to

64 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS Device

Configure I2Cx

Configure SPIx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MSv45966V4

AN2606 Rev 61 267/436

435
STM32H74xxx/75xxx devices bootloader AN2606

52.3 Bootloader version

Table 114 lists the STM32H74xxx/75xxx devices bootloader versions.

Table 114. STM32H74xxx/75xxx bootloader version

Version
Description Known limitations
number
– “Go” Command is not working
– USART2 connection is not working
V13.2
Initial bootloader version – SPI1 connection is not working
(0xD2)
– Mass erase is not working well on I2C (only Bank2
is erased in this command)
– Switch USB clock input from HSE to HSI48
V13.3 – Bank erase is not working on USART/SPI and I2C
with CRS
(0xD3) – DFU bootloader mass-erase not working
– Fix known limitations on the V13.2
– First ACK not received on “Go” Command when
using USART or SPI
– On the FDCAN write memory, write of data with
length > 63 bytes fails
– If PB15 is set to GND, user cannot connect to BL
interfaces. Only the USB is able to connect as it
uses interrupt for detection. PB15 must not be
pulled down if USART1 on PB14/PB15 is not used
– Jump issue on some application.Application stack
pointer must be lower than (RAM end @ - 16 bytes)
– Add support of FDCAN interface to guarantee it is working
V9.0 – Fix V13.3 limitations – Additional reset needed after power off/on to
(0x90) – V9.0 is the latest version in production and enable connection to the BL interfaces. As a
replaces V13.2 and V13.3 workaround user can add a pull up on PA11 pin.’
– Cannot program the "CM4_BOOT_ADDx" option
byte using BL in dual core case
– FDCAN Get version command is giving a bad
FDCAN protocol version (0x11). It must be 0 x10
(V1.0)
– SRAM1/SRAM2/SRAM3 (0x30000000-
0x30047FFF) and ITCM memories not accessible
by the BL
– Number of supported commands is wrong (13
instead of 11)
Fix V9.0 limitations
– Fix the configuration of PWR control register
CR3. Bootloader is no more blocking the
change of PWR source
– If PB15 is set to GND, user will not be able to
– Adjust USB, I2C erase and program timings
and fix them connect to BL interfaces
V9.1
– SRAM1/SRAM2/SRAM3 (0x30000000-
(0x91) – Fix FDCAN version from V1.0 to V1.1
0x30047FFF) and ITCM memories not accessible
– Fix write issue when using FDCAN
by the BL
– Fix missing PCROP disable in RDP level1
regression
– Update option byte support to handle all
possible use cases

268/436 AN2606 Rev 61

AN2606 STM32H7A3xx/B3xx devices bootloader

53 STM32H7A3xx/B3xx devices bootloader

53.1 Bootloader configuration

The STM32H7A3xx/7B3xx bootloader is activated by applying Pattern 10 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz using the

HSI enabled
HSI.
The clock recovery system (CRS) is enabled for the
RCC - DFU bootloader to allow USB to be clocked by
HSI48 48 MHz
Clock used for the FDCAN is fixed to 20 MHz and is
-
derived from PLLQ
16 Kbytes, starting from address 0x24000000 are
RAM -
used by the bootloader firmware
Common to all
128 Kbytes, starting from address 0x1FFF0000,
bootloaders
System memory - contain the bootloader firmware. The bootloader
start address is 0x1FF0A000
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Bootloader software is writing to the PWR_CR3
register using four bytes, which is locking this
Power -
register. Only Power off/on unlocks it. This is fixed
on the bootloader with 0x92 versions.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
alternate push-pull, pull-up mode.
USART1 bootloader
PA9 pin: USART1 in transmission mode. Used in
alternate push-pull, pull-up mode. Set as Input until
USART1_TX pin Output
USART1 is detected on the bootloader version
0x92.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input
alternate push-pull, pull-up mode.
USART2 bootloader
PA2 pin: USART2 in transmission mode. Used in
alternate push-pull, pull-up mode. Set as Input until
USART2_TX pin Output
USART2 is detected on the bootloader version
0x92.

AN2606 Rev 61 269/436

435
STM32H7A3xx/B3xx devices bootloader AN2606

Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit,

USART3 Enabled
even parity, and one stop bit
PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
USART3 bootloader alternate push-pull, pull-down mode.
on (PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in
alternate push-pull, pull-down mode. Set as Input
USART3_TX pin Output
until USART3 is detected on the bootloader version
0x92.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PD9 pin: USART3 in reception mode. Used in
USART3_RX pin Input
USART3 bootloader alternate push-pull, pull-down mode.
on (PD8/PD9)
PD8 pin: USART3 in transmission mode. Used in
alternate push-pull, pull-down mode. Set as Input
USART3_TX pin Output
until USART3 is detected on the bootloader version
0x92.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON.
Slave 7-bit address: 0b10101111x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled mode, analog filter ON.
Slave 7-bit address: 0b10101111x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PF0 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled mode, analog filter ON.
Slave 7-bit address: 0b10101111x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.

270/436 AN2606 Rev 61

AN2606 STM32H7A3xx/B3xx devices bootloader

Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, no
SPI1 bootloader SPI1_MOSI pin Input
pull-up no pull-down mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull-up no pull-down mode.
PA5 pin: slave clock line, used in push-pull no pull-
SPI1_SCK pin Input
up, no pull-up no pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data Input line, used in push-pull, no
SPI2 bootloader SPI2_MOSI pin Input
pull mode.
PI2 pin: slave data output line, used in push-pull, no
SPI2_MISO pin Output
pull mode.
PI1 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PI0 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data Input line, used in push-pull,
SPI3 bootloader SPI3_MOSI pin Input
no pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.

AN2606 Rev 61 271/436

435
STM32H7A3xx/B3xx devices bootloader AN2606

Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data Input line, used in push-pull,
SPI4 bootloader SPI4_MOSI pin Input
no pull up, no pull down mode
PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
no pull up, no pull down mode.
PE12 pin: slave clock line, used in push-pull, no pull
SPI4_SCK pin Input
up, no pull down mode.
PE11 pin: slave chip select pin used in push-pull, no
SPI4_NSS pin Input
pull up, no pull down mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU bootloader USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN bootloader AutoRetransmission = ENABLE
on (PH13/PH14) TransmitPause = DISABLE
ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-down mode.
PH13 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

272/436 AN2606 Rev 61

AN2606 STM32H7A3xx/B3xx devices bootloader

Table 115. STM32H7A3xx/7B3xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN1 configuration is:

Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN bootloader AutoRetransmission = ENABLE
on (PD1/PD0) TransmitPause = DISABLE
ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-down mode.
PD1 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

AN2606 Rev 61 273/436

435
STM32H7A3xx/B3xx devices bootloader AN2606

53.2 Bootloader selection

Figure 64 shows the bootloader selection mechanism.

Figure 65. Bootloader V9.x selection for STM32H7A3xx/7B3xx

System Reset

Configure System clock to

64 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS Device

Configure I2Cx

Configure SPIx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MSv45966V4

274/436 AN2606 Rev 61

AN2606 STM32H7A3xx/B3xx devices bootloader

53.3 Bootloader version

Table 114 lists the STM32H7A3xx/7B3xx devices bootloader versions.

Table 116. STM32H7A3xx/7B3xx bootloader version

Version
Description Known limitations
number

– String returned describing the flash memory size

when using USB is wrong (expected value 256 x 8 KB,
V9.0 Initial bootloader version
but returns 256 x 2 KB)
– OTP memory is not supported by the bootloader
– Crash loop when booting on the bootloader, setting
RDP to Level1, doing a reset or power on/off and the
Fixes all issues of previous USB cable is plugged.
V9.1
release. – Bootloader software is writing to the PWR_CR3
register using four bytes, which is locking this register.
Only Power off/on unlocks it
– Fix all issues of previous
release
– Modify USART TX from None
V9.2
push pull mode in the
previous versions to
input.

AN2606 Rev 61 275/436

435
STM32L01xxx/02xxx devices bootloader AN2606

54 STM32L01xxx/02xxx devices bootloader

54.1 Bootloader configuration

The STM32L01xxx/02xxx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 117 shows the hardware resources used by this bootloader.

Table 117. STM32L01xxx/02xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16

RCC HSI enabled
MHz as clock source.
2 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
Common to all 4 Kbytes, starting from address 0x1FF00000,
bootloaders System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 bootloader PA10 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
(on PA9/PA10) pull-up mode.
PA9 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 bootloader PA3 pin: USART2 in reception mode.Used in input
USART2_RX pin Input
(on PA2/PA3) pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USART2 bootloader SysTick timer Enabled
from the host for USARTx bootloaders.

276/436 AN2606 Rev 61

AN2606 STM32L01xxx/02xxx devices bootloader

Table 117. STM32L01xxx/02xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
SPI1 Enabled
MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1 bootloader (for
PA6 pin: slave data output line, used in push-pull,
all device packages SPI1_MISO pin Output
pull-down mode
except TSSOP14)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up to
SPI1 Enabled
8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
PA14 pin: slave data output line, used in push-pull,
pull-down mode.
SPI1 bootloader Note: This IO is also used as SWCLK for debug
SPI1_MISO pin Output
(only for devices on interface, as a consequence debugger cannot
TSSOP14 package) connect to the device in "on-the-fly" mode when the
bootloader is running.
PA13 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input Note: NSS pin synchronization is required on
bootloader with SPI1 interface for devices on
TSSOP14 package.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.
Note: Due to empty check mechanism present on this product, it is not possible to jump from user
code to system bootloader. Such jump results in a jump back to user flash memory space.
But if the first 4 bytes of user flash memory (at 0x0800 0000) are empty at the moment of
the jump (i.e. erase first sector before jump or execute code from SRAM while flash is
empty), then system bootloader is executed when jumped to.

AN2606 Rev 61 277/436

435
STM32L01xxx/02xxx devices bootloader AN2606

54.2 Bootloader selection

The Table 66 shows the bootloader selection mechanism.

Figure 66. Bootloader selection for STM32L01xxx/02xxx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received
yes
on USARTx

Disable all other

yes interfaces clocks
no

Disable all other Configure

interfaces clocks USARTx
SPIx detects
no Synchro
mechanism Execute Execute
BL_SPI_Loop BL_USART_Loop
for SPIx for USARTx

MSv38476V1

278/436 AN2606 Rev 61

AN2606 STM32L01xxx/02xxx devices bootloader

54.3 Bootloader version

The following table lists the STM32L01xxx/02xxx devices bootloader versions.

Table 118. STM32L01xxx/02xxx bootloader versions

Version
Description Known limitations
number

Bootloader not functional with SPI1 interface for devices

V12.2 Initial bootloader version
on TSSOP14 package.
For the SPI1 interface for devices in TSSOP14, a falling
edge on NSS pin is required before staring
Adds support of SPI interface
communication, to properly synchronize the SPI interface.
V12.3 for devices in TSSOP14
If the NSS pin is grounded (all time from device reset) the
package.
SPI communication is not synchronized and bootloader
does not work properly with the SPI interface.

AN2606 Rev 61 279/436

435
STM32L031xx/041xx devices bootloader AN2606

55 STM32L031xx/041xx devices bootloader

55.1 Bootloader configuration

The STM32L031xx/041xx bootloader is activated by applying Pattern 2 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 119. STM32L031xx/041xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16

RCC HSI enabled
MHz as clock source.
4 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
Common to all 4 Kbytes, starting from address 0x1FF00000,
bootloaders System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 bootloader PA10 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
(on PA9/PA10) pull-up mode.
PA9 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 bootloader PA3 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
(on PA2/PA3) pull-up mode.
PA2 pin: USART2 in transmission mode.Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USART2 bootloader SysTick timer Enabled
from the host for USARTx bootloaders.

280/436 AN2606 Rev 61

AN2606 STM32L031xx/041xx devices bootloader

Table 119. STM32L031xx/041xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up to
SPI1 Enabled
8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
PA6 pin: slave data output line, used in push-pull,
SPI1 bootloader SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.
The bootloader Read/Write commands do not support SRAM space for this product.

AN2606 Rev 61 281/436

435
STM32L031xx/041xx devices bootloader AN2606

55.2 Bootloader selection

Figure 67 shows the bootloader selection mechanism.

Figure 67. Bootloader selection for STM32L031xx/041xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received on
yes
USARTx
Disable all other
interfaces clocks

no
yes Configure
Disable all other USARTx
interfaces clocks
SPIx detects
no Execute
Synchro
BL_USART_Loop
mechanism Execute for USARTx
BL_SPI_Loop for
SPIx
MS35035V1

55.3 Bootloader version

Table 120 lists the STM32L031xx/041xx devices bootloader versions.

Table 120. STM32L031xx/041xx bootloader versions

Version number Description Known limitations

V12.0 Initial bootloader version None

282/436 AN2606 Rev 61

AN2606 STM32L05xxx/06xxx devices bootloader

56 STM32L05xxx/06xxx devices bootloader

56.1 Bootloader configuration

The STM32L05xxx/06xxx bootloader is activated by applying Pattern 1 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 121. STM32L05xxx/06xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
Power - Voltage range is set to Voltage Range 1.
4 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all
bootloaders 4 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.

AN2606 Rev 61 283/436

435
STM32L05xxx/06xxx devices bootloader AN2606

Table 121. STM32L05xxx/06xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data Input line, used in push-pull, pull-down
bootloader SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data Input line, used in push-pull, pull-down
SPI2_MOSI pin Input
bootloader mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

284/436 AN2606 Rev 61

AN2606 STM32L05xxx/06xxx devices bootloader

56.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 68. Bootloader selection for STM32L05xxx/06xxx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received on
yes
USARTx
Disable all other
interfaces clocks

no
yes Configure
Disable all other USARTx
interfaces clocks
SPIx detects
no Execute
Synchro
BL_USART_Loop
mechanism Execute for USARTx
BL_SPI_Loop for
SPIx
MS35035V1

56.3 Bootloader version

The following table lists the STM32L05xxx/06xxx devices bootloader versions:

Table 122. STM32L05xxx/06xxx bootloader versions

Version
Description Known limitations
number

PA13 set in alternate push-pull, pull-up mode

V12.0 Initial bootloader version and PA14 set in alternate pull-up pull-down
mode even if not used

AN2606 Rev 61 285/436

435
STM32L07xxx/08xxx devices bootloader AN2606

57 STM32L07xxx/08xxx devices bootloader

Two bootloader versions are available on STM32L07xxx/08xxx devices:

• V4.x supporting USART1, USART2 USART2, and DFU (USB FS device).
This version is embedded in STM32L072xx/73xx and STM32L082xx/83xx devices.
• V11.x supporting USART1, USART2, I2C1, I2C2, SPI1 and SPI2.
This version is embedded in other STM32L071xx/081xx devices.

57.1 Bootloader V4.x

57.1.1 Bootloader configuration

The STM32L07xxx/08xxx bootloader is activated by applying Pattern 2 or Pattern 7 when
dual bank boot feature is available (described in Table 2). Table 123 shows the hardware
resources used by this bootloader.

Table 123. STM32L07xxx/08xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
4 Kbytes, starting from address 0x20000000 are used by the
RAM -
bootloader firmware.
Common to all
bootloaders 8 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART2 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART2 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.

286/436 AN2606 Rev 61

AN2606 STM32L07xxx/08xxx devices bootloader

Table 123. STM32L07xxx/08xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode. USB FS interrupt

USB Enabled
vector is enabled and used for USB DFU communications.
DFU PA11 pin: USB FS DM line. Used in alternate push-pull, no
USB_DM pin
bootloader pull mode.
Input/output
PA12 pin: USB FS DP line. Used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 61 287/436

435
STM32L07xxx/08xxx devices bootloader AN2606

57.1.2 Bootloader selection

Figure 69 and Figure 70 show the bootloader selection mechanism.

Figure 69. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V4.x

System Reset

If Boot0 = 0 no

yes

If Value of first
address of Bank2 is Protection
within int. SRAM
yes no
level2 enabled
address
Set Bank Swap to
Bank2
Continue Bootloader
no Jump to user yes
execution
code in Bank2

If Value of first If Value of first

address of Bank1 is address of Bank2 is
within int. SRAM within int. SRAM
address address
yes yes

no

no
Protection
level2 enabled
yes

Set Bank Swap to Set Bank Swap to Set Bank Swap to

no Bank1 Bank1 Bank2

Continue Bootloader
Jump to user Jump to user Jump to user
execution
code in Bank1 code in Bank1 code in Bank2

MSv38477V1

288/436 AN2606 Rev 61

AN2606 STM32L07xxx/08xxx devices bootloader

Figure 70. Bootloader V4.x selection for STM32L07xxx/08xxx

Bootloader

Configure System clock

to 32 MHz with HSI

Configure USB clock to 48

MHz with HSI as clock source

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB FS device

0x7F received on
yes
USARTx
Disable all
interrupt sources
no
Configure
USARTx
USB cable
yes
Detected
no Execute
Execute DFU bootloader BL_USART_Loop
using USB interrupts for USARTx

MSv38442V1

57.1.3 Bootloader version

Table 124 lists the STM32L07xxx/08xxx devices bootloader versions.

Table 124. STM32L07xxx/08xxx bootloader versions

Version number Description Known limitations

PA4, PA5, PA6 and PA7 IOs are configured in

V4.0 Initial bootloader version
pull-down mode despite not used by bootloader
This new version implements PA4, PA5, PA6 and PA7 IOs are configured in
V4.1
the Dual Bank Boot feature. pull-down mode despite not used by bootloader

AN2606 Rev 61 289/436

435
STM32L07xxx/08xxx devices bootloader AN2606

57.2 Bootloader V11.x

57.2.1 Bootloader configuration

The STM32L07xxx/08xxx bootloader is activated by applying Pattern 2 or Pattern 7 when
dual bank boot feature is available (see in Table 2). Table 125 shows the hardware
resources used by this bootloader.

Table 125. STM32L07xxx/08xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
5 Kbytes, starting from address 0x20000000 are used by the
RAM -
bootloader firmware
Common to all
bootloaders 8 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART2 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART2 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 – Slave 7-bit address: 0b1000010x
bootloader – (where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: I2C1 clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: I2C1 data line is used in open-drain no pull mode.

290/436 AN2606 Rev 61

AN2606 STM32L07xxx/08xxx devices bootloader

Table 125. STM32L07xxx/08xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
I2C2 – Slave 7-bit address: 0b1000010x
bootloader – (where x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: I2C2 clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: I2C2 data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-down
SPI1 SPI1_MOSI pin Input
mode
bootloader
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull, pull-down
SPI2 SPI2_MOSI pin Input
mode
bootloader
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 61 291/436

435
STM32L07xxx/08xxx devices bootloader AN2606

57.2.2 Bootloader selection

Figure 71 and Figure 72 show the bootloader selection mechanism.

Figure 71. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V11.x

System Reset

If Boot0 = 0 no

yes

If Value of first
address of Bank2 is Protection
within int. SRAM
yes no
level2 enabled
address
Set Bank Swap to
Bank2
Continue Bootloader
no Jump to user yes
execution
code in Bank2

If Value of first If Value of first

address of Bank1 is address of Bank2 is
within int. SRAM within int. SRAM
address address
yes yes

no

no
Protection
level2 enabled
yes

Set Bank Swap to Set Bank Swap to Set Bank Swap to

no Bank1 Bank1 Bank2

Continue Bootloader
Jump to user Jump to user Jump to user
execution
code in Bank1 code in Bank1 code in Bank2

MSv38477V1

292/436 AN2606 Rev 61

AN2606 STM32L07xxx/08xxx devices bootloader

Figure 72. Bootloader V11.x selection for STM32L07xxx/08xxx

Bootloader

Disable all
interrupt sources

System Init ( Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
detected

no
yes Disable all other
no interfaces clocks

Disable all other Disable all other Configure

interfaces clocks interfaces clocks USARTx
SPIx detects
Synchro
mechanism
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

MSv38443V2

57.2.3 Bootloader version

The following table lists the STM32L07xxx/08xxx devices bootloader versions:

Table 126. STM32L07xxx/08xxx bootloader V11.x versions

Version number Description Known limitations

V11.1 Initial bootloader version None

V11.2 This new version implements the Dual Bank Boot feature. None

AN2606 Rev 61 293/436

435
STM32L1xxx6(8/B)A devices bootloader AN2606

58 STM32L1xxx6(8/B)A devices bootloader

58.1 Bootloader configuration

The STM32L1xxx6(8/B)A bootloader is activated by applying Pattern 1 (described in Table 2).
The following table shows the hardware resources used by this bootloader.

Table 127. STM32L1xxx6(8/B)A configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz.

2 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
4 Kbytes, starting from address
System memory - 0x1FF00000 contain the bootloader
Common to all
firmware.
bootloaders
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage range is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration
USART2 Enabled
is 8 bits, even parity, and one stop bit.
PD6 pin: USART2 in reception mode. Used
USART2 bootloader USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC, no external . No
external quartz is required for the bootloader execution.

294/436 AN2606 Rev 61

AN2606 STM32L1xxx6(8/B)A devices bootloader

58.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 73. Bootloader selection for STM32L1xxx6(8/B)A devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35033V1

58.3 Bootloader version

The following table lists the STM32L1xxx6(8/B)A devices bootloader versions:

Table 128. STM32L1xxx6(8/B)A bootloader versions

Version
Description Known limitations
number

When a Read Memory or Write Memory command is

issued with an unsupported memory address and a
correct address checksum (i.e. address 0x6000 0000),
the command is aborted by the bootloader device, but the
V2.0 Initial bootloader version
NACK (0x1F) is not sent to the host. As a result, the next
2 bytes ( the number of bytes to be read/written and its
checksum) are considered as a new command and its
checksum.(1)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code, the limitation is not
perceived from the host, as the command is NACKed anyway (as an unsupported new command).

AN2606 Rev 61 295/436

435
STM32L1xxx6(8/B) devices bootloader AN2606

59 STM32L1xxx6(8/B) devices bootloader

59.1 Bootloader configuration

The STM32L1xxx6(8/B) bootloader is activated by applying Pattern 1 (described in Table 2).
The following table shows the hardware resources used by this bootloader.

Table 129. STM32L1xxx6(8/B) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz.

2 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
4 Kbytes, starting from address
System memory - 0x1FF00000 contain the bootloader
Common to all
firmware.
bootloaders
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage range is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration
USART2 Enabled
is 8 bits, even parity, and one stop bit.
PD6 pin: USART2 in reception mode. Used
USART2 bootloader USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC, no external . No
external quartz is required for the bootloader execution.

296/436 AN2606 Rev 61

AN2606 STM32L1xxx6(8/B) devices bootloader

59.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 74. Bootloader selection for STM32L1xxx6(8/B) devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35007V1

59.3 Bootloader version

The following table lists the STM32L1xxx6(8/B) devices bootloader versions:

Table 130. STM32L1xxx6(8/B) bootloader versions

Version
Description Known limitations
number

– When a Read Memory or Write Memory command is

issued with an unsupported memory address and a
correct address checksum (i.e. address 0x6000 0000),
the command is aborted by the bootloader device, but
the NACK (0x1F) is not sent to the host. As a result, the
V2.0 Initial bootloader version
next 2 bytes (the number of bytes to be read/written
and its checksum) are considered as a new command
and its checksum.(1)
– PA13/14/15 is configured in alternate push-pull (PA14
in pull-down) even if not used.
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code, the limitation is not
perceived from the host, as the command is NACKed anyway (as an unsupported new command).

AN2606 Rev 61 297/436

435
STM32L1xxxC devices bootloader AN2606

60 STM32L1xxxC devices bootloader

60.1 Bootloader configuration

The STM32L1xxxC bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 131. STM32L1xxxC configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
USARTx bootloaders and during USB
HSI enabled
detection for DFU bootloader (once the
DFU bootloader is selected, the clock
source is derived from the external crystal).
The external clock is mandatory only for the
DFU bootloader and must be in the
RCC
following range:
HSE enabled [24, 16, 12, 8, 6, 4, 3, 2] MHz.
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU
Common to all
- bootloader. Any failure (or removal) of the
bootloaders
external clock generates a system reset.
4 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog resets (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage range is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity and 1 stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

298/436 AN2606 Rev 61

AN2606 STM32L1xxxC devices bootloader

Table 131. STM32L1xxxC configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity and 1 stop bit. The
USART2 uses its remapped pins.
USART2 bootloader PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled rate from the host for the USARTx
bootloader.
USB Enabled USB used in FS mode
PA11: USB DM line. Used in input no pull
USB_DM pin
DFU bootloader mode.
Input/output
PA12: USB DP line. Used in input no pull
USB_DP pin
mode.

The system clock is derived from the embedded internal high-speed RC for the USARTx
bootloader. This internal clock is also used the for DFU bootloader, but only for the selection
phase. An external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for the
execution of the DFU bootloader after the selection phase.

AN2606 Rev 61 299/436

435
STM32L1xxxC devices bootloader AN2606

60.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 75. Bootloader selection for STM32L1xxxC devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

USB cable
yes
Detected

no

HSE = 24, 16, 12, 8,

no
0x7F received on 6, 4, 3, 2 MHz
no USARTx

Generate System
yes yes reset

Reconfigure System
Disable all clock to 32MHz and
interrupt sources USB clock to 48 MHz

Configure
Execute DFU
USARTx
bootloader using USB
interrupts
Execute
BL_USART_Loop
for USARTx

MS35008V1

300/436 AN2606 Rev 61

AN2606 STM32L1xxxC devices bootloader

60.3 Bootloader version

The following table lists the STM32L1xxxC devices bootloader versions.

Table 132. STM32L1xxxC bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

instead of 1 NACK are sent when a Read Memory
Initial bootloader or Write Memory command is sent and the RDP
V4.0
version level is active.
PA13/14/15 configured in alternate push-pull, pull
(PA14 in pull-down) even if not used

AN2606 Rev 61 301/436

435
STM32L1xxxD devices bootloader AN2606

61 STM32L1xxxD devices bootloader

61.1 Bootloader configuration

The STM32L1xxxD bootloader is activated by applying Pattern 4 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 133. STM32L1xxxD configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
USARTx bootloaders and during USB
HSI enabled
detection for DFU bootloader (once the
DFU bootloader is selected, the clock
source is derived from the external crystal).
The external clock is mandatory only for
DFU bootloader and it must be in the
RCC
following range: [24, 16, 12, 8, 6, 4, 3, 2]
HSE enabled MHz.
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU
Common to all
- bootloader. Any failure (or removal) of the
bootloaders
external clock generates system reset.
4 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage range is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

302/436 AN2606 Rev 61

AN2606 STM32L1xxxD devices bootloader

Table 133. STM32L1xxxD configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity, and one stop bit. The
USART2 uses its remapped pins.
USART2 bootloader PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloader.
USB Enabled USB used in FS mode
PA11: USB DM line. Used in alternate
USB_DM pin
DFU bootloader push-pull, no pull mode.
Input/output
PA12: USB DP line. Used in alternate push-
USB_DP pin
pull, no pull mode.

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU bootloader, but only for the selection
phase. An external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for DFU
bootloader execution after the selection phase.

AN2606 Rev 61 303/436

435
STM32L1xxxD devices bootloader AN2606

61.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 76. Bootloader selection for STM32L1xxxD devices

System Reset

BFB2 bit reset

(BFB2 = 0)

Protection
no yes
level2 enabled
If Value
@0x08030000 is
yes yes
within int. SRAM
address Jump to user code
in Bank2 If Value
no no @0x08030000 is
yes
within int. SRAM
If Value address
@0x08000000 is Jump to user code
yes in Bank2
within int. SRAM
address Jump to user code no
in Bank1
no If Value
@0x08000000 is
Continue Bootloader execution yes
within int. SRAM
address
Jump to user code
Disable all in Bank1
interrupt sources no

CPU blocked
System Init (Clock, GPIOs, (halted)
IWDG, SysTick)

Configure USB
yes

USB cable Generate System

Detected HSE detected no
reset

yes
no yes

Configure Reconfigure System

0x7F received on USARTx clock to 32MHz and
USARTx USB clock to 48 MHz
no
Execute
BL_USART_Loop
for USARTx
Execute DFU
bootloader using USB
interrupts MS35009V2

304/436 AN2606 Rev 61

AN2606 STM32L1xxxD devices bootloader

61.3 Bootloader version

The following table lists the STM32L1xxxD devices bootloader versions:

Table 134. STM32L1xxxD bootloader versions

Version
Description Known limitations
number

– In the bootloader code the PA13

(JTMS/SWDIO) I/O output speed is
configured to 400 kHz, as a
consequence some debugger cannot
connect to the device in Serial Wire
mode when the bootloader is running.
V4.1 Initial bootloader version – When the DFU bootloader is selected,
the RTC is reset and thus all RTC
information (such as calendar, alarm)
are lost including backup registers.
Note: When the USART bootloader is
selected there is no change on the RTC
configuration (including backup
registers).
– Stack overflow by 8 bytes when jumping
to Bank1/Bank2 if BFB2=0 or when
Read Protection level is set to 2.
Workaround: the user code must force in
the startup file the top of stack address
before to jump to the main program. This
can be done in the “Reset_Handler”
routine.
Fix V4.1 limitations (available on Rev.Z – When the Stack of the user code is
V4.2
devices only) placed outside the SRAM (i.e. @
0x2000C000) the bootloader cannot
jump to that user code which is
considered invalid. This might happen
when using compilers which place the
stack at a non-physical address at the
top of the SRAM (i,e. @ 0x2000C000).
Workaround: place manually the stack at
a physical address.
– For the USART interface, two
Fix V4.2 limitations. consecutive NACKs (instead of 1 NACK)
V4.5 DFU interface robustness enhancements are sent when a Read Memory or Write
(available on Rev.Y devices only). Memory command is sent and the RDP
level is active.

AN2606 Rev 61 305/436

435
STM32L1xxxE devices bootloader AN2606

62 STM32L1xxxE devices bootloader

62.1 Bootloader configuration

The STM32L1xxxE bootloader is activated by applying Pattern 4 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 135. STM32L1xxxE configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
USARTx bootloaders and during USB
HSI enabled
detection for DFU bootloader (once the
DFU bootloader is selected, the clock
source is derived from the external crystal).
The external clock is mandatory only for
DFU bootloader and it must be in the
RCC
following range: [24, 16, 12, 8, 6, 4, 3, 2]
HSE enabled MHz.
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU
Common to all
- bootloader. Any failure (or removal) of the
bootloaders
external clock generates system reset.
4 Kbytes, starting from address
RAM - 0x20000000 are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage range is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 bootloader USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

306/436 AN2606 Rev 61

AN2606 STM32L1xxxE devices bootloader

Table 135. STM32L1xxxE configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity, and one stop bit. The
USART2 uses its remapped pins.
USART2 bootloader PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx bootloaders SysTick timer Enabled
rate from the host for USARTx bootloader.
USB Enabled USB used in FS mode
DFU bootloader USB_DM pin PA11: USB DM line.
Input/output
USB_DP pin PA12: USB DP line.

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU bootloader, but only for the selection
phase. An external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for DFU
bootloader execution after the selection phase.

AN2606 Rev 61 307/436

435
STM32L1xxxE devices bootloader AN2606

62.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 77. Bootloader selection for STM32L1xxxE devices

System Reset
no

BFB2 bit reset Protection level2

(BFB2 = 0) enabled

yes yes

If Value
no If Value @0x08040000 is @0x08040000 is within yes
yes
within int. SRAM address int. SRAM address

Jump to user code Jump to user code

no in Bank2 no in Bank2

If Value @0x08000000 is If Value @0x08000000 is

yes yes
within int. SRAM address within int. SRAM address

Jump to user code

in Bank1
no Jump to user code
no
in Bank1
Continue Bootloader execution
CPU blocked
(halted)

Disable all interrupt sources

System Init (Clock, GPIOs, HSE Generate

no
IWDG, SysTick) detected System Reset

Configure USB
Reconfigure System
clock to 32MHz and
USB cable USB clock to 48 MHz
detected
yes

no yes
Execute DFU
bootloader using USB
0x7F received interrupts
Configure USARTx
on USARTx

Execute BL_USART_Loop
no for USARTx

MS35034V3

308/436 AN2606 Rev 61

AN2606 STM32L1xxxE devices bootloader

62.3 Bootloader version

Table 136 lists the STM32L1xxxE devices bootloader versions:

Table 136. STM32L1xxxE bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

(instead of 1 NACK) are sent when a Read
Memory or Write Memory command is sent and
V4.0 Initial bootloader version the RDP level is active.
PA13/14/15 configured in alternate push-pull, pull
(PA14 in pull-down) even if not used.

AN2606 Rev 61 309/436

435
STM32L412xx/422xx devices bootloader AN2606

63 STM32L412xx/422xx devices bootloader

63.1 Bootloader configuration

The STM32L412xx/422xx bootloader is activated by applying Pattern 16 (described in
Table 2). Table 137 shows the hardware resources used by this bootloader.

Table 137. STM32L412xx/422xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 72 MHz and for USART, I2C, SPI and
RCC USB bootloader operation.
The clock recovery system (CRS) is enabled for the DFU
-
bootloader to allow USB to be clocked by HSI48 48 MHz.
12 Kbytes, starting from address 0x20000000 are used
RAM -
by the bootloader firmware

Common to all 28 Kbytes, starting from address 0x1FFF0000, contain

System memory -
bootloaders the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is selected.
Power -
Bootloader firmware does not configure voltage scaling
range value in PWR_CR1 register.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-
USART2_RX pin Input
bootloader up mode.
PA2 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in input
USART3_RX pin Input
bootloader pull-up mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.

310/436 AN2606 Rev 61

AN2606 STM32L412xx/422xx devices bootloader

Table 137. STM32L412xx/422xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USARTx Used to automatically detect the serial baud rate from

SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1010010x
I2C1 bootloader
(where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1010010x
I2C2 bootloader
(where x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1010010x
I2C3 bootloader
(where x = 0 for write and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.

AN2606 Rev 61 311/436

435
STM32L412xx/422xx devices bootloader AN2606

Table 137. STM32L412xx/422xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU bootloader
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader statup after SPI initialisation as soon as the bit DMATx enable on SPI
CR2 register is set to 0x1, the MISO line will be set to 3.3 V.

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

312/436 AN2606 Rev 61

AN2606 STM32L412xx/422xx devices bootloader

63.2 Bootloader selection

The figures below show the bootloader selection mechanism.

Figure 78. Dual bank boot Implementation for STM32L412xx/422xx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

AN2606 Rev 61 313/436

435
STM32L412xx/422xx devices bootloader AN2606

Figure 79.Bootloader V13.x selection for STM32L412xx/422xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes
Detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
Execute DFU
bootloader using USB
no
interrupts
no

USB cable yes

Detected

MS51432V1

314/436 AN2606 Rev 61

AN2606 STM32L412xx/422xx devices bootloader

63.3 Bootloader version

Table 138 lists the STM32L412xx/422xx devices bootloader version.

Table 138. STM32L412xx/422xx bootloader versions

Version
Description Known limitations
number

– On connection phase, USART responds with

two ACK bytes (0x79) instead of one.
– PcROP option bytes cannot be written as
Bootloader uses Byte access while PcROP
V13.1 Initial bootloader version
must be accessed using Half-Word access.
Workaround: load a code snippet in SRAM
using Bootloader interface, then jump to it, and
that code writes PcROP value.

AN2606 Rev 61 315/436

435
STM32L43xxx/44xxx devices bootloader AN2606

64 STM32L43xxx/44xxx devices bootloader

64.1 Bootloader configuration

The bootloader V9.1 version is updated to fix known limitations relative to USB-DFU
interface, and is implemented on devices with version information ID equal to 0x10 (refer to
Table 140 for more details).
The STM32L43xxx/44xxx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 139 shows the hardware resources used by this bootloader.

Table 139. STM32L43xxx/44xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for

HSI enabled system clock configured to 60 MHz and for USART,
I2C, SPI and USB bootloader operation.
The clock recovery system (CRS) is enabled for the
- DFU bootloader to allow USB to be clocked by
HSI48 48 MHz.
RCC
The HSE is used only when the CAN interface is
HSE enabled selected. The HSE must have one of the following
values [24,20,18,16,12,9,8,6,4] MHz.
The CSS interrupt is enabled when HSE is enabled.
- Any failure (or removal) of the external clock
Common to all generates system reset
bootloaders 12 Kbytes, starting from address 0x20000000 are
RAM -
used by the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is selected.
Power -
Bootloader firmware does not configure voltage
scaling range value in PWR_CR1 register.
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input
USART1_RX pin Input
bootloader no pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
input no pull mode.

316/436 AN2606 Rev 61

AN2606 STM32L43xxx/44xxx devices bootloader

Table 139. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART2 configuration is 8-bit,

USART2 Enabled
even parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
bootloader pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3
PC11 pin: USART3 in reception mode. Used in input
bootloader USART3_RX pin Input
pull-up mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
USARTx Used to automatically detect the serial baud rate
SysTick timer Enabled
bootloaders from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1001000x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1001000x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain no pull
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1001000x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PC0 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
PC1 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.

AN2606 Rev 61 317/436

435
STM32L43xxx/44xxx devices bootloader AN2606

Table 139. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate
CAN1_RX pin Input
push-pull, pull-up mode.
CAN1 bootloader PB9 pin: CAN1 in transmission mode. Used in
CAN1_TX pin Output
alternate push-pull, pull-up mode.
This timer is used to determine the value of the HSE.
TIM16 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

318/436 AN2606 Rev 61

AN2606 STM32L43xxx/44xxx devices bootloader

Table 139. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
USB peripheral is used by the bootloader.
DFU bootloader
PA11: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

AN2606 Rev 61 319/436

435
STM32L43xxx/44xxx devices bootloader AN2606

64.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 80. Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

320/436 AN2606 Rev 61

AN2606 STM32L43xxx/44xxx devices bootloader

Figure 81. Bootloader V9.x selection for STM32L43xxx/44xxx

System Reset

Configure System clock to

60 MHz with HSI
Disable all interrupt
System Init (Clock, GPIOs, sources and other
IWDG, SysTick) interfaces clocks

Disable all interrupt Disable all interrupt

Configure USB Device FS sources and other sources and other Configure
using CRS and HSI48 as interfaces clocks interfaces clocks USARTx
clock source

Execute Execute Execute

Configure I2Cx BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

Configure SPIx

0x7F received on
USARTx yes

HSE detected no
no
Generate System
I2C Address yes reset
yes
Detected
Disable all interrupt
sources and other
no
interfaces clocks

SPIx detects yes Reconfigure System

Synchro mechanism clock to 60 MHz

no
Disable other Configure CAN
no interfaces clocks
Frame detected
on CANx yes
Execute DFU Execute
bootloader using USB BL_CAN_Loop for
no interrupts CANx

USB cable
yes
Detected

MSv38484V1

AN2606 Rev 61 321/436

435
STM32L43xxx/44xxx devices bootloader AN2606

64.3 Bootloader version

Table 140 lists the STM32L43xxx/44xxx devices bootloader versions.

Table 140. STM32L43xxx/44xxx bootloader versions

Version
Description Known limitations
number

Check the Version Information ID of your STM32L43xxx/44xxx

device, which can be read at 0x1FFF6FF2 address.
Version Information ID equal to 0xFF:
– For memory write operations using DFU interface: If the buffer size
is larger than 256 bytes and not multiple of 8 bytes, the write
memory operation result is corrupted. Workaround: if the file size is
larger than 256 bytes, add byte padding to align it on 8-bytes
multiple size.
– For the USB-DFU interface, the CRS (clock recovery system) is not
correctly configured and this may lead to random USB
communication errors (depending on temperature and voltage). In
V9.1 Initial bootloader version
most case communication error will manifest by a "Stall" response
to setup packets.
– On the “Go” command, system bootloader de-init clears the
RTCAPBEN bit in the RCC_APB1ENR register
Workaround: manually call __HAL_RCC_RTC_CLK_ENABLE() in the
software which sets the RTCAPBEN bit.
Version Information ID equal to 0x10: None
– PcROP option bytes cannot be written as Bootloader uses Byte
access while PcROP must be accessed using Half-Word access.
Workaround: load a code snippet in SRAM using Bootloader
interface then jump to it, and that code writes the PcROP value.

322/436 AN2606 Rev 61

AN2606 STM32L43xxx/44xxx devices bootloader

Table 140. STM32L43xxx/44xxx bootloader versions (continued)

Version
Description Known limitations
number

– SPI write operation fail Limitation:

a. During bootloader SPI write flash memory operation, some
random 64-bits (2 double-words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation which is interrupted
by SPI DMA and it leads to double access on same flash memory
address and the 64-bits are not written.
Workarounds:
a. WA1: add a delay between sending write command and its ACK
request. Its duration must be the duration of the 256-Bytes flash
memory write time.
b. WA2: read back after write and in case of error start write again.
c. WA3: Patch in RAM to write in flash memory that implements
V9.1 Initial bootloader version write memory without 64-bits cast. WA1 and WA3 are more efficient
(continued) (continued) than WA2 in terms of total programming time.
How critical is the limitation:
a. The limitation leads to a modification in customer SPI host
software by adding 3-4 ms delay to each write operation.
b. The delay is not waste because it is anyway the flash memory
write period of time that host has to wait anyway (so instead of
waiting by sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and cannot impact
USART/I2C/CAN
– If the RTC is used by application prior to booting (through a system
reset) on system bootloader, it is possible that CAN interface does
not work correctly (cannot establish connection) unless a power
cycle is performed or RTC is reset by application before booting on
System Bootloader

AN2606 Rev 61 323/436

435
STM32L45xxx/46xxx devices bootloader AN2606

65 STM32L45xxx/46xxx devices bootloader

65.1 Bootloader configuration

The STM32L45xxx/46xxx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 141 shows the hardware resources used by this bootloader.

Table 141. STM32L45xxx/46xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 72 MHz and for USART, I2C, SPI
and USB bootloader operation.
The clock recovery system (CRS) is
- enabled for the DFU bootloader to allow
USB to be clocked by HSI48 48 MHz.
RCC The system clock frequency is 60 MHz.
HSE enabled The HSE is used only when the CAN interface is
selected. The HSE must have one of the following
values [24,20,18,16,12,9,8,6,4] MHz.
The CSS interrupt is enabled when HSE is enabled.
- Any failure (or removal) of the external clock generates
Common to all
system reset
bootloaders
12 Kbytes, starting from address 0x20000000 are used
RAM -
by the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is selected.
Power -
Bootloader firmware does not configure voltage scaling
range value in PWR_CR1 register.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no
USART1_RX pin Input
bootloader pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-
USART2_RX pin Input
bootloader up mode.
PA2 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.

324/436 AN2606 Rev 61

AN2606 STM32L45xxx/46xxx devices bootloader

Table 141. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit, even

USART3 Enabled
parity, and one stop bit
USART3
PC11 pin: USART3 in reception mode. Used in input
bootloader USART3_RX pin Input
pull-up mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
USARTx Used to automatically detect the serial baud rate from
SysTick timer Enabled
bootloaders the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b1001010x
I2C1 bootloader
(where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b1001010x
I2C2 bootloader
(where x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b1001010x
I2C3 bootloader
(where x = 0 for write and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drainno pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

AN2606 Rev 61 325/436

435
STM32L45xxx/46xxx devices bootloader AN2606

Table 141. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate
CAN1_RX pin Input
push-pull, pull-up mode.
CAN1 bootloader PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
This timer is used to determine the value of the HSE.
TIM16 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

326/436 AN2606 Rev 61

AN2606 STM32L45xxx/46xxx devices bootloader

Table 141. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU bootloader
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

AN2606 Rev 61 327/436

435
STM32L45xxx/46xxx devices bootloader AN2606

65.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 82. Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

328/436 AN2606 Rev 61

AN2606 STM32L45xxx/46xxx devices bootloader

Figure 83.Bootloader V9.x selection for STM32L45xxx/46xxx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
yes
on USARTx

no

I2C Address
yes
Detected HSE detected no

Generate System
no reset
yes

Disable all interrupt

Synchro mechanism sources and other
yes interfaces clocks
detected on SPIx

Reconfigure System
no clock to 60 MHz
no

Frame detected Disable other Configure CAN

yes
on CANx interfaces clocks

Execute DFU Execute

no
bootloader using USB BL_CAN_Loop for
interrupts CANx
USB cable
yes
Detected

MSv45964V1

AN2606 Rev 61 329/436

435
STM32L45xxx/46xxx devices bootloader AN2606

65.3 Bootloader version

Table 142 lists the STM32L45xxx/46xxx devices bootloader versions.

Table 142. STM32L45xxx/46xxx bootloader versions

Version number Description Known limitations

– PcROP option bytes cannot be written as

Bootloader uses Byte access while PcROP
must be accessed using Half-Word access.
Workaround: load a code snippet in SRAM
using Bootloader interface then jump to it, and
that code writes the PcROP value.
– SPI write operation fail limitation:
a. During Bootloader SPI write flash memory
operation, some random 64-bits (2 double-
words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation
which is interrupted by SPI DMA and it leads to
double access on same flash memory address
and the 64-bits are not written
Workarounds:
a. WA1: add a delay between sending write
V9.2 Initial bootloader version command and its ACK request. Its duration
must be the duration of the 256-Bytes flash
memory write time.
b. WA2: read back after write and in case of
error start write again.
c. WA3: Patch in RAM to write in flash memory
that implements write memory without 64-bits
cast. WA1 and WA3 are more efficient than
WA2 in terms of total programming time
How critical is the limitation:
a. The limitation leads to a modification in
customer SPI host software by adding 3-4 ms
delay to each write operation.
b. The delay is not waste because it is anyway
the flash memory write period of time that host
has to wait anyway (so instead of waiting by
sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and
cannot impact USART/I2C/CAN.

330/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

66 STM32L47xxx/48xxx devices bootloader

Two bootloader versions are available on STM32L47xxx/48xxx:

• V10.x supporting USART, I2C and DFU (USB FS device).
This version is embedded in STM32L47xxx/48xxx rev. 2 and rev. 3 devices.
• V9.x supporting USART, I2C, SPI, CAN and DFU (USB FS device).
This version is embedded in STM32L47xxx/48xxx rev. 4 devices.

66.1 Bootloader V10.x

66.1.1 Bootloader configuration

The STM32L47xxx/48xxx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 143 shows the hardware resources used by this bootloader.

Table 143. STM32L47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for system clock
HSI enabled configured to 24 MHz and for USART and I2C bootloader
operation.
The HSE is used only when the USB interface is selected
HSE enabled and the LSE is not present. The HSE must have one of the
following values: 24,20,18,16,12,9,8,6,4 MHz.
The LSE is used to trim the MSI which is configured to 48
MHz as USB clock source. The LSE must be equal to
RCC LSE enabled
32,768 kHz. If the LSE is not detected, the HSE is used
instead if USB is connected.
The MSI is configured to 48 MHz and is used as USB clock
MSI enabled source. The MSI is used only if LSE is detected, otherwise,
HSE is used if USB is connected.
Common to all The CSS interrupt is enabled when LSE or HSE is enabled.
bootloaders - Any failure (or removal) of the external clock generates
system reset.
12 Kbytes, starting from address 0x20000000 are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader
Power -
firmware does not configure voltage scaling range value in
PWR_CR1 register.

AN2606 Rev 61 331/436

435
STM32L47xxx/48xxx devices bootloader AN2606

Table 143. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no pull
USART1_RX pin Input
bootloader mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-up
USART2_RX pin Input
bootloader mode.
PA2 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3
PC11 pin: USART3 in reception mode. Used i input pull-up
bootloader USART3_RX pin Input
mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 bootloader Slave 7-bit address: 0b1000011x
(where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
I2C2 bootloader Slave 7-bit address: 0b1000011x
(where x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
I2C3 bootloader Slave 7-bit address is 0b1000011x
(where x = 0 for write and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

332/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

Table 143. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
DFU bootloader USB_DP pin mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
TIM17 Enabled the HSE frequency is determined, the system clock is
configured to 24 MHz using PLL and HSE.

For USARTx and I2Cx bootloaders no external clock is required.

USB bootloader (DFU) requires either an LSE (low-speed external clock) or a HSE (high-
speed external clock):
• In case, the LSE is present regardless the HSE presence, the MSI is configured and
trimmed by the LSE to provide an accurate clock equal to 48 MHz, which is the clock
source of the USB. The system clock is kept clocked to 24 MHz by the HSI.
• In case, the HSE is present, the system clock and USB clock is configured respectively
to 24 MHz and 48 MHz with HSE as clock source.

AN2606 Rev 61 333/436

435
STM32L47xxx/48xxx devices bootloader AN2606

66.1.2 Bootloader selection

Figure 84 and Figure 85 show the bootloader selection mechanism.

Figure 84. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V10.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

334/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

Figure 85.Bootloader V10.x selection for STM32L47xxx/48xxx

Bootloader

Configure System clock

to 24 MHz with HSI

LSE detected no

yes
Configure USB clock to 48
MHz with HSI as clock source
Configure USB clock to 48
MHz with MSI as clock source

System Init (Clock, GPIOs,

IWDG, SysTick)
Disable all
interrupt sources
Configure USB OTG FS yes
device Configure
USARTx

Configure all I2Cs

Execute
BL_USART_Loop
for USARTx

0x7F received
on USARTx
Disable all
yes
interrupt sources
no

Execute
BL_I2C_Loop for
I2C Address I2Cx
Detected yes
MSI used as USB
no
clock source
no
yes HSE detected no

USB cable Generate System

Detected yes reset

yes Reconfigure System clock

to 24 MHz and USB clock
to 48 MHz with HSE

Execute DFU bootloader

using USB interrupts
MSv38432V2

AN2606 Rev 61 335/436

435
STM32L47xxx/48xxx devices bootloader AN2606

66.1.3 Bootloader version

Table 144 lists the STM32L47xxx/48xxx devices bootloader V10.x versions:

Table 144. STM32L47xxx/48xxx bootloader V10.x versions

Version
Description Known limitations
number

For memory write operations using DFU interface: If

the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation result
V10.1 Initial bootloader version is corrupted.
Workaround: if the file size is larger than 256 bytes,
add byte padding to align it on 8-bytes multiple size.
Write in SRAM is corrupted.
For memory write operations using DFU interface: If
the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation result
V10.2 Fix write in SRAM issue
is corrupted.
Workaround: if the file size is larger than 256 bytes,
add byte padding to align it on 8-bytes multiple size.
– For memory write operations using DFU interface: If
the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation
result is corrupted.
Add support of MSI as USB clock
Workaround: if the file size is larger than 256 bytes,
source (MSI is trimmed by LSE).
add byte padding to align it on 8-bytes multiple size.
V10.3 Update dual bank boot feature to
– PcROP option bytes cannot be written as
support the case when user stack
Bootloader uses Byte access while PcROP must be
is mapped in SRAM2.
accessed using Half-Word access.
Workaround: load a code snippet in SRAM using
Bootloader interface then jump to it, and that code
writes the PcROP value.

336/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

66.2 Bootloader V9.x

66.2.1 Bootloader configuration

The STM32L47xxx/48xxx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 145 shows the hardware resources used by this bootloader.

Table 145. STM32L47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for
HSI enabled system clock configured to 72 MHz and for
USART and I2C bootloader operation.
The HSE is used only when the USB interface
is selected and the LSE is not present. The
HSE must have one of the following values:
HSE enabled
24,20,18,16,12,8,6,4 MHz.
System is clocked at 72 MHz if USB is used or
60 MHz if CAN is used.
The LSE is used to trim the MSI which is
RCC configured to 48 MHz as USB clock source.
LSE enabled The LSE must be equal to 32,768 kHz. If the
LSE is not detected, the HSE is used instead if
USB is connected.
The MSI is configured to 48 MHz and is used
as USB clock source. The MSI is used only if
MSI enabled
Common to all LSE is detected, otherwise, HSE is used if
bootloaders USB is connected.
The CSS interrupt is enabled when LSE or
CSS HSE is enabled. Any failure (or removal) of the
external clock generates system reset.
13 Kbytes, starting from address 0x20000000
RAM -
are used by the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset (if the hardware IWDG
option was previously enabled by the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is
Power - selected. Bootloader firmware does not
configure voltage scaling range value in
PWR_CR1 register.
Once initialized the USART1 configuration is 8-
USART1 Enabled
bit, even parity, and one stop bit
USART1 PA10 pin: USART2 in reception mode. Used in
USART1_RX pin Input
bootloader input no pull mode.
PA9 pin: USART2 in transmission mode. Used
USART1_TX pin Output
in input no pull mode.

AN2606 Rev 61 337/436

435
STM32L47xxx/48xxx devices bootloader AN2606

Table 145. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the USART2 configuration is 8-
USART2 Enabled
bit, even parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input
bootloader input pull-up mode.
PA2 pin: USART2 in transmission mode. Used
USART2_TX pin Output
in input pull-up mode.
Once initialized the USART3 configuration is 8-
USART3 Enabled
bit, even parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
bootloader input pull-up mode.
PC10 pin: USART3 in transmission mode
USART3_TX pin Output
Used in input pull-up mode.
USARTx Used to automatically detect the serial baud
SysTick timer Enabled
bootloaders rate from the host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C1 Enabled mode, analog filter ON. Slave 7-bit address:
0b1000011x (where x = 0 for write and x = 1 for
I2C1 bootloader read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C2 Enabled mode, analog filter ON. Slave 7-bit address:
0b1000011x (where x = 0 for write and x = 1 for
I2C2 bootloader read)
PB10 pin: clock line is used in open-drain no
I2C2_SCL pin Input/output
pull mode.
PB11 pin: data line is used in open-drain no
I2C2_SDA pin Input/output
pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, slave
I2C3 Enabled mode, analog filter ON. Slave 7-bit address:
0b1000011x (where x = 0 for write and x = 1 for
I2C3 bootloader read)
PC0 pin: clock line is used in open-drain no
I2C3_SCL pin Input/output
pull mode.
PC1 pin: data line is used in open-drain no pull
I2C3_SDA pin Input/output
mode.

338/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

Table 145. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up
SPI1 Enabled
to 8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in push-
SPI1_MOSI pin Input
pull, pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-
SPI1_MISO pin Output
pull, pull-down mode
PA5 pin: slave clock line, used in push-pull,
SPI1_SCK pin Input
pull-down mode
PA4 pin: slave chip select pin used in push-
SPI1_NSS pin Input
pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up
SPI2 Enabled
to 8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware
PB15 pin: slave data Input line, used in push-
SPI2_MOSI pin Input
pull, pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-
SPI2_MISO pin Output
pull, pull-down mode
PB13 pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PB12 pin: slave chip select pin used in push-
SPI2_NSS pin Input
pull, pull-down mode.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11-bit identifier.
PB8 pin: CAN1 in reception mode. Used in
CAN1 bootloader CAN1_RX pin Input
alternate push-pull, pull-up mode.
PB9 pin: CAN1 in transmission mode. Used in
CAN1_TX pin Output
alternate push-pull, pull-up mode.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used
USB Enabled for USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V
as USB peripheral is used by the bootloader.
DFU bootloader
PA11 pin: USB FS DM line. Used in alternate
USB_DM pin
push-pull, no pull mode.
Input/output PA12 pin: USB FS DP line. Used in alternate
USB_DP pin push-pull, no pull mode.
No external pull-up resistor is required.

In case, the HSE is present, the system clock and USB clock is configured respectively to
72 MHz and 48 MHz with PLL (clocked by HSE) as a clock source.
Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

AN2606 Rev 61 339/436

435
STM32L47xxx/48xxx devices bootloader AN2606

66.2.2 Bootloader selection

Figure 86 and Figure 87 show the bootloader selection mechanism.

Figure 86. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

340/436 AN2606 Rev 61

AN2606 STM32L47xxx/48xxx devices bootloader

Figure 87.Bootloader V9.x selection for STM32L47xxx/48xxx

Bootloader

Configure System clock to 72 MHz

with HSI

LSE detected no

yes

Configure USB clock to 48 MHz

with MSI as clock source
Configure USB clock to 48 MHz with HSI
as clock source

System Init(Clock,
GPIOs,IWDG,Systick)

Configure USB OTG FS device Disable all interrupt Disable all interrupt sources
Disable all interrupt sources
sources and other and other interfaces clocks
and other interfaces clocks
interfaces clocks

Configure I2Cx Execute BL_SPI_Loop Execute BL_I2C_Loop

Configure USARTx
for SPIx for I2Cx

Configure SPIx Execute

BL_USART_Loop
for USARTx

0x7F received on
yes
USARTx
MSI used as USB clock
no source
yes
I2C Address
yes no
Detected
no
HSE detected no no HSE detected
Synchro mechanism yes
detected on SPIx yes
yes
no yes Generate System yes
Reconfigure System reset
no USB cable clock to 60 MHz
Detected Reconfigure System clock
to 72 MHz and USB clock
no Configure CAN to 48 MHz

Frame yes
detected on Execute
CANx BL_CAN_Loop Execute DFU bootloader
for CANx using USB interrupts

MSv38404V1

AN2606 Rev 61 341/436

435
STM32L47xxx/48xxx devices bootloader AN2606

66.2.3 Bootloader version

Table 146 lists the STM32L47xxx/48xxx devices bootloader V9.x versions:

Table 146. STM32L47xxx/48xxx bootloader V9.x versions

Version
Description Known limitations
number

For memory write operations using DFU interface: If the

buffer size is larger than 256 bytes and not multiple of 8
bytes, the write memory operation result is corrupted.
V9.0 Initial bootloader version Workaround: if the file size is larger than 256 bytes, add
byte padding to align it on 8-bytes multiple size.
Write in SRAM is corrupted
V9.1 Deprecated version (not used) None
– For memory write operations using DFU interface: If
the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation result
is corrupted.
Workaround: if the file size is larger than 256 bytes,
add byte padding to align it on 8-bytes multiple size.
V9.2 Fix write in SRAM issue
– PcROP option bytes cannot be written as Bootloader
uses Byte access while PcROP must be accessed
using Half-Word access.
Workaround: load a code snippet in SRAM using
Bootloader interface then jump to it, and that code
writes the PcROP value.

342/436 AN2606 Rev 61

AN2606 STM32L496xx/4A6xx devices bootloader

67 STM32L496xx/4A6xx devices bootloader

67.1 Bootloader configuration

The STM32L496xx/4A6xx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 147 shows the hardware resources used by this bootloader.

Table 147. STM32L496xx/4A6xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 72 MHz and for USART, I2C and SPI bootloader
operation.
The clock recovery system (CRS) is enabled for the DFU
-
bootloader to allow USB to be clocked by HSI 48 MHz.
RCC The HSE is used only when the CAN interface is selected.
HSE enabled The HSE must have one of the following values:
24,20,18,16,12,9,8,6,4 MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
Common to all reset
bootloaders 12 Kbytes, starting from address 0x20000000 are used by the
RAM -
bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The DFU cannot be used to communicate with bootloader if
voltage scaling range 2 is selected. Bootloader firmware does
Power -
not configure voltage scaling range value in PWR_CR1
register.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no pull
USART1_RX pin Input
bootloader mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input no pull
USART2_RX pin Input
bootloader mode.
PA2 pin: USART2 in transmission mode. Used in input no pull
USART2_TX pin Output
mode.

AN2606 Rev 61 343/436

435
STM32L496xx/4A6xx devices bootloader AN2606

Table 147. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit, even

USART3 Enabled
parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in input no pull
USART3_RX pin Input
bootloader mode.
PC10 pin: USART3 in transmission mode. Used in input no
USART3_TX pin Output
pull mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C1 Enabled filter ON.
I2C1 – Slave 7-bit address: 0b1001100x (where x = 0 for write and
bootloader x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C2 Enabled filter ON.
I2C2 – Slave 7-bit address: 0b1001100x (where x = 0 for write and
bootloader x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C3 Enabled filter ON.
I2C3 – Slave 7-bit address: 0b1001100x (where x = 0 for write and
bootloader x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

344/436 AN2606 Rev 61

AN2606 STM32L496xx/4A6xx devices bootloader

Table 147. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-down
SPI1 SPI1_MOSI pin Input
mode
bootloader
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull, pull-down
SPI2 SPI2_MOSI pin Input
mode
bootloader
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
Once initialized the CAN1 configuration is:Baudrate 125
CAN1 Enabled
kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1_RX pin Input
pull, pull-up mode.
CAN1
bootloader PB9 pin: CAN1 in transmission mode. Used in alternate push-
CAN1_TX pin Output
pull, pull-up mode.
This timer is used to determine the value of the HSE. Once
TIM16 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

AN2606 Rev 61 345/436

435
STM32L496xx/4A6xx devices bootloader AN2606

Table 147. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB OTG FS configured in forced device mode.

USB OTG FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU
bootloader PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

346/436 AN2606 Rev 61

AN2606 STM32L496xx/4A6xx devices bootloader

67.2 Bootloader selection

The figures below show the bootloader selection mechanism.

Figure 88. Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

AN2606 Rev 61 347/436

435
STM32L496xx/4A6xx devices bootloader AN2606

Figure 89.Bootloader V9.x selection for STM32L496xx/4A6xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS using

CRS and HSI48 as clock
source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes HSE detected no
Detected

Generate System
no reset
yes

Disable all interrupt

Synchro mechanism yes sources and other
detected on SPIx interfaces clocks

Reconfigure System
no clock to 60 MHz
no

Frame detected Disable other Configure CAN

on CANx yes
interfaces clocks

Execute DFU Execute

no
bootloader using USB BL_CAN_Loop for
interrupts CANx
USB cable yes
Detected

MSv44808V1

348/436 AN2606 Rev 61

AN2606 STM32L496xx/4A6xx devices bootloader

67.3 Bootloader version

Table 148 lists the STM32L496xx/4A6xx devices bootloader versions.

Table 148. STM32L496xx/4A6xx bootloader version

Version
Description Known limitations
number

– The Bank Erase command is aborted by the bootloader device, and

the NACK (0x1F) is sent to the host. Workaround: Perform Bank
erase operation through page erase using the Erase command
(0x44).
– SPI write operation fail
Limitation:
a. During Bootloader SPI write flash memory operation, some
random 64-bits (2 double-words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation which is interrupted
by SPI DMA and it leads to double access on same flash memory
address and the 64-bits are not written
Workarounds:
a. WA1: add a delay between sending write command and its ACK
request. Its duration must be the duration of the 256-Bytes flash
memory write time.
V9.3 Initial bootloader version b. WA2: read back after write and in case of error start write again.
c. WA3: Patch in RAM to write in flash memory that implements write
memory without 64-bits cast.
WA1 and WA3 are more efficient than WA2 in terms of total
programming time
How critical is the limitation:
a. The limitation leads to a modification in customer SPI host
software by adding 3-4 ms delay to each write operation.
b. The delay is not waste because it is anyway the flash memory
write period of time that host has to wait anyway (so instead of
waiting by sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and cannot impact
USART/I2C/CAN.
– PcROP option bytes cannot be written as Bootloader uses Byte
access while PcROP must be accessed using Half-Word access.
Workaround: load a code snippet in SRAM using Bootloader
interface then jump to it, and that code writes the PcROP value.

AN2606 Rev 61 349/436

435
STM32L4P5xx/4Q5xx devices bootloader AN2606

68 STM32L4P5xx/4Q5xx devices bootloader

68.1 Bootloader configuration

The STM32L4P5xx/4Q5xx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 151 shows the hardware resources used by this bootloader.

Table 149. STM32L4P5xx/4Q5xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock

source for system clock configured to 60
HSI enabled
MHz and for USART, I2C, SPI and USB
bootloader operation.
The clock recovery system (CRS) is
- enabled for the DFU bootloader to allow
USB to be clocked by HSI 48 MHz.
RCC
The HSE is used only when the CAN
interface is selected. The HSE must have
HSE enabled
one of the following values
24,20,18,16,12,9,8,6,4 MHz.
The CSS interrupt is enabled when HSE
- is enabled. Any failure (or removal) of the
external clock generates system reset
Common to all 16 Kbytes starting from address
bootloaders RAM - 0x20000000 are used by the bootloader
firmware
28 Kbytes starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
The DFU cannot be used to communicate
with bootloader if the voltage scaling
Power - range 2 is selected. Bootloader firmware
does not configure voltage scaling range
value in PWR_CR1 register.
Once initialized the USART1
USART1 Enabled configuration is 8-bit, even parity, and one
stop bit
USART1
PA10 pin: USART1 in reception mode.
bootloader USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode.

350/436 AN2606 Rev 61

AN2606 STM32L4P5xx/4Q5xx devices bootloader

Table 149. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART2

USART2 Enabled configuration is 8-bit, even parity, and one
stop bit
USART2
bootloader PA3 pin: USART2 in reception mode.
USART2_RX pin Input
Used in input pull-up mode.
USART2_TX pin Output PA2 pin: USART2 in transmission mode
Once initialized the USART3
USART3 Enabled configuration is 8-bit, even parity, and one
stop bit
USART3
PC11 pin: USART3 in reception mode.
bootloader USART3_RX pin Input
Used in input pull-up mode.
PC10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1011011x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB7 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C2 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1011011x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain
I2C2_SCL pin Input/output
no pull mode.
PB11 pin: data line is used in open-drain
I2C2_SDA pin Input/output
no pull mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C3 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1011011x
I2C3 bootloader (where x = 0 for write and x = 1 for read)
PC0 pin: clock line is used in open-drain
I2C3_SCL pin Input/output
no pull mode.
PC1 pin: data line is used in open-drain
I2C3_SDA pin Input/output
no pull mode.

AN2606 Rev 61 351/436

435
STM32L4P5xx/4Q5xx devices bootloader AN2606

Table 149. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in
SPI1_MOSI pin Input
SPI1 bootloader push-pull, pull-down mode
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PB15 pin: slave data Input line, used in
SPI2_MOSI pin Input
SPI2 bootloader push-pull, pull-down mode
PB14 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PB13 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PB12 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.
Once initialized the CAN1 configuration
CAN1 Enabled is:
Baudrate 125 kbps, 11 -bit identifier.
CAN1 bootloader PB8 pin: CAN1 in reception mode. Used
CAN1_RX pin Input
in alternate push-pull, pull-up mode.
PB9 pin: CAN1 in transmission mode.
CAN1_TX pin Output
Used in alternate push-pull, pull-up mode.

352/436 AN2606 Rev 61

AN2606 STM32L4P5xx/4Q5xx devices bootloader

Table 149. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device

mode.
USB FS interrupt vector is enabled and
USB Enabled used for USB DFU communications.
Note: VDDUSB IO must be connected to
3.3 V as USB peripheral is used by the
DFU bootloader bootloader.
PA11: USB DM line. Used in alternate
USB_DM pin
push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate
USB_DP pin push-pull, no pull mode.
No external pull-up resistor is required

AN2606 Rev 61 353/436

435
STM32L4P5xx/4Q5xx devices bootloader AN2606

68.2 Bootloader selection

Figure 92 and Figure 93 show the bootloader selection mechanisms.

Figure 90. Dual bank boot implementation for STM32L4P5xx/4Q5xx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

354/436 AN2606 Rev 61

AN2606 STM32L4P5xx/4Q5xx devices bootloader

Figure 91.Bootloader V9.x selection for STM32L4P5xx/4Q5xx

System Reset

Configure System clock to 60

MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

HSE detected no
Synchro mechanism
yes
detected on SPIx
Generate
yes System reset

no Disable all interrupt

yes sources and other
no interfaces clocks

Frame detected on
Reconfigure System
CANx
clock to 60 MHz

Disable other
no interfaces clocks Configure CAN

USB cable Execute DFU Execute

yes bootloader using BL_CAN_Loop
Detected
USB interrupts for CANx

MS49689V1

AN2606 Rev 61 355/436

435
STM32L4P5xx/4Q5xx devices bootloader AN2606

68.3 Bootloader version

Table 150 lists the STM32L4P5xx/4Q5xx devices bootloader versions.

Table 150. STM32L4P5xx/4Q5xx bootloader versions

Version
Description Known limitations
number

– PcROP option bytes cannot be written as

bootloader uses byte access while PcROP must
Initial bootloader version on cut be accessed using half-word access.
V9.0
1.0 samples Workaround: load a code snippet in SRAM using
bootloader interface then jump to it, and that code
writes PcROP value.

356/436 AN2606 Rev 61

AN2606 STM32L4Rxxx/4Sxxx devices bootloader

69 STM32L4Rxxx/4Sxxx devices bootloader

69.1 Bootloader configuration

The STM32L4Rxx/4Sxx bootloader is activated by applying Pattern 6 (described in Table 2).
Table 151 shows the hardware resources used by this bootloader.

Table 151. STM32L4Rxxx/4Sxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 60 MHz and for USART, I2C, SPI and USB
bootloader operation.
The clock recovery system (CRS) is enabled for the DFU
-
bootloader to allow USB to be clocked by HSI 48 MHz.
RCC The HSE is used only when the CAN interface is selected.
HSE enabled The HSE must have one of the following values:
24,20,18,16,12,9,8,6,4 MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
reset
Common to all
bootloaders 12 Kbytes starting from address 0x20000000 are used by
RAM -
the bootloader firmware
28672 bytes starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader
Power -
firmware does not configure voltage scaling range value in
PWR_CR1 register.
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in input no pull
USART1_RX pin Input
bootloader mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-up
USART2_RX pin Input
bootloader mode.
PA2 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.

AN2606 Rev 61 357/436

435
STM32L4Rxxx/4Sxxx devices bootloader AN2606

Table 151. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is 8-bit, even

USART3 Enabled
parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
bootloader up mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloaders host for USARTx bootloaders.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C1 Enabled filter ON.
I2C1 Slave 7-bit address: 0b1010000x
bootloader (where x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C2 Enabled filter ON.
I2C2 Slave 7-bit address: 0b1010000x
bootloader (where x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C3 Enabled filter ON.
I2C3 Slave 7-bit address: 0b1010000x
bootloader (where x = 0 for write and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

358/436 AN2606 Rev 61

AN2606 STM32L4Rxxx/4Sxxx devices bootloader

Table 151. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
bootloader PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull, pull-
SPI2_MOSI pin Input
SPI2 down mode
bootloader PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1_RX pin Input
pull, pull-up mode.
CAN1
bootloader PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
This timer is used to determine the value of the HSE. Once
TIM16 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

AN2606 Rev 61 359/436

435
STM32L4Rxxx/4Sxxx devices bootloader AN2606

Table 151. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU
peripheral is used by the bootloader.
bootloader
USB_DM pin PA11: USB DM line.
Input/output PA12: USB DP line
USB_DP pin
No external pull-up resistor is required

360/436 AN2606 Rev 61

AN2606 STM32L4Rxxx/4Sxxx devices bootloader

69.2 Bootloader selection

Figure 92 and Figure 93 show the bootloader selection mechanisms.

Figure 92. Dual bank boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

AN2606 Rev 61 361/436

435
STM32L4Rxxx/4Sxxx devices bootloader AN2606

Figure 93.Bootloader V9.x selection for STM32L4Rxx/4Sxx

System Reset

Configure System clock to 60

MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

HSE detected no
Synchro mechanism
yes
detected on SPIx
Generate
yes System reset

no Disable all interrupt

yes sources and other
no interfaces clocks

Frame detected on
Reconfigure System
CANx
clock to 60 MHz

Disable other
no interfaces clocks Configure CAN

USB cable Execute DFU Execute

yes bootloader using BL_CAN_Loop
Detected
USB interrupts for CANx

MS49689V1

362/436 AN2606 Rev 61

AN2606 STM32L4Rxxx/4Sxxx devices bootloader

69.3 Bootloader version

Table 152 lists the STM32L4Rxx/4Sxx devices bootloader versions.

Table 152. STM32L4Rxx/4Sxx bootloader versions

Version
Description Known limitations
number

V9.0 Initial bootloader version on cut 1.0 samples – None

AN2606 Rev 61 363/436

435
STM32L552xx/STM32L562xx devices bootloader AN2606

70 STM32L552xx/STM32L562xx devices bootloader

70.1 Bootloader configuration

The STM32L552xx/562xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 153 shows the hardware resources used by this bootloader.

Table 153. STM32L552xx/562xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL

HSI enabled
clocked by HSI).
The clock recovery system (CRS) is enabled for
RCC
- the DFU bootloader to allow USB to be clocked by
HSI 48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
Common to all
bootloaders 16 Kbytes starting from address 0x20000000 are
RAM -
used by the bootloader firmware
System memory - 32 Kbytes starting from address 0x0BF90000.
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 bootloader USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 bootloader USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 bootloader USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

364/436 AN2606 Rev 61

AN2606 STM32L552xx/STM32L562xx devices bootloader

Table 153. STM32L552xx/562xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
Slave 7-bit address: 0b0101100x
I2C1 bootloader (where x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
Slave 7-bit address: 0b0101100x
I2C2 bootloader (where x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
Slave 7-bit address: 0b0101100x (where x = 0 for
I2C3 bootloader write and x = 1 for read)
PC0 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC1 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

AN2606 Rev 61 365/436

435
STM32L552xx/STM32L562xx devices bootloader AN2606

Table 153. STM32L552xx/562xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB5 pin: slave data Input line, used in push-pull,
SPI3_MOSI pin Input
pull-down mode
SPI3 bootloader
PG10 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
pull-down mode
PG9 pin: slave clock line, used in push-pull, pull-
SPI3_SCK pin Input
down mode
PG12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI3_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

366/436 AN2606 Rev 61

AN2606 STM32L552xx/STM32L562xx devices bootloader

Table 153. STM32L552xx/562xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN1 configuration is:

Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN bootloader
TransmitPause = DISABLE
ProtocolException = ENABLE
PB9 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input/
alternate push-pull, pull-up mode.
PB8 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-up mode.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU bootloader USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

Table 154. STM32L552cc/562xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of
Data Data status data Status data
Function Opcode data sent data
sent received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when
0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP 0.5
Must be run when 0x82 0x4 0x1 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1

AN2606 Rev 61 367/436

435
STM32L552xx/STM32L562xx devices bootloader AN2606

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

368/436 AN2606 Rev 61

AN2606 STM32L552xx/STM32L562xx devices bootloader

70.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 94. Bootloader V9.x selection for STM32L552xx/562xx

System Reset

Configure System clock to

60 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

Device
Execute
BL_FDCAN loop

Configure I2Cx

Configure SPIx Disable all interrupt

sources and other
interfaces clocks
FDCAN frame Disable all interrupt Disable all interrupt
detected yes sources and other Configure
sources and other
interfaces clocks interfaces clocks USARTx
no
Execute Execute Execute
0x7F received BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
on USARTx yes for SPIx for I2Cx for USARTx

no

I2C Address
yes
Detected

no

no
Execute DFU
Synchro mechanism yes bootloader using USB
detected on SPIx
interrupts

no

USB cable yes

Detected

MS52834V1

AN2606 Rev 61 369/436

435
STM32L552xx/STM32L562xx devices bootloader AN2606

70.3 Bootloader version

Table 155 lists the STM32L552xx/562xx devices bootloader versions.

Table 155. STM32L552xx/562xx bootloader versions

Version
Description Known limitations
number

– USART3 not working

– SPI3 not working
– OB launch not working on USB-DFU
Initial bootloader version on – No read/write SRAM2 in all protocols
V13.0
cut1.0 samples – Read Secure Option bytes only implemented on
USART/I2C
– Regression from TZen = 1 to TZen = 0 is done
automatically on RDP regression
– Not able to set TZen to 1 option byte using all
interfaces of the BL
No WA available
– Cannot set RDP level 0.5 nor option bytes in
RDP level 0.5 using BL interfaces
No WA available
Release supported only in cut2.0
– Multiple reset seen when enabling HW IWDG
– Fix all issues on previous
option byte in TZen = 1
release
No WA available
V9.0 – Add FDCAN support
– Not able to set secure option bytes setting when
– New command added for TZen TZen = 1 and RDP level is 0
disable No WA available
– Support of sales type 256KB – “Go” Command on USB is not working
– FDCAN erase not working as page number
endianness is not aligned with the protocol
(device waits for LSB first but host sends MSB
first)
– WA - Send data MSB first to the BL
– Option byte programming is not working
properly when using FDCAN interface. This
– Fix all known limitations of
makes the change of the Option byte not
previous release
effective until a power off/power on.
– Add enable BOOT_LOCK BL
V9.1 – FDCAN erase not working as page number
command
endianness is not aligned with the protocol
– Add support of RDP L1 to 0.5 (device waits for LSB first but host sends MSB
regression first)
– WA - Send data MSB first to the BL
– Fix all known limitations of
FDCAN Readout unprotect command does not
V9.2 previous release
send the command ID to the host
– Version for silicon revision Z

Note: When jumping to the BL the cache must be disabled.

370/436 AN2606 Rev 61

AN2606 STM32WBA52xx devices bootloader

71 STM32WBA52xx devices bootloader

71.1 Bootloader Configuration

The STM32WBA52xx bootloader is activated by applying Pattern12 (described in Table 2).
Table 156 shows the hardware resources used by this bootloader.

Table 156. STM32WBA52xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked

RCC HSI enabled
by HSI).
16 Kbytes starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all
bootloaders 32 Kbytes starting from address 0x0BF88000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit

USART1 PA8 pin: USART1 in reception mode. Used in alternate

USART1_RX pin Input
bootloader push-pull, pull-up mode.
PB12 pin: USART1 in transmission mode.
USART1_TX pin Output
Not set until USART1 is detected.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA11 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
bootloader push-pull, pull-up mode.
PA12 pin: USART2 in transmission mode.
USART2_TX pin Output
Not set until USART2 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 – Slave 7-bit address: 0b1100110x (where x = 0 for write
bootloader and x = 1 for read)
I2C1_SCL pin Input/output PB2 pin: clock line is used in open-drain pull up mode.
I2C1_SDA pin Input/output PB1 pin: data line is used in open-drain pull up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
I2C3 – Slave 7-bit address: 0b1100110x (where x = 0 for write
bootloader and x = 1 for read)
I2C3_SCL pin Input/output PA6 pin: clock line is used in open-drain pull up mode.
I2C3_SDA pin Input/output PA7 pin: data line is used in open-drain pull up mode.

AN2606 Rev 61 371/436

435
STM32WBA52xx devices bootloader AN2606

Table 156. STM32WBA52xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3
PB8 pin: slave data Input line, used in push-pull, no pull
bootloader SPI3_MOSI pin Input
mode
PB9 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode
SPI3_SCK pin Input PA0 pin: slave clock line, used in push-pull, no pull mode
PA5 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.

Table 157. STM32WBA52xx special commands

Special commands supported (USART/I2C/SPI)
Opcode - 0x50

Number of
Sub- Number of Number of
Data status data Status data
Function Opcode data sent Data sent data
received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when
0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP 0.5
Must be run when 0x82 0x4 0x1 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have 3 values (0: WRP area, 1: WRP1A, 2: WRP2A)

372/436 AN2606 Rev 61

AN2606 STM32WBA52xx devices bootloader

71.2 Bootloader selection

Figure 95.Bootloader V11.x selection for STM32WBA52xx

System Reset

Disable all interrupt

sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
Detected

no Disable all other

Disable all other Disable all other interfaces clocks
interfaces clocks interfaces clocks

Configure USARTx
SPIx detects Synchro yes
mechanism

Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx
no

MSv38431V2

71.3 Bootloader version

Table 158. STM32WBA52xx bootloader versions
Version number Description Known limitations

V11.0 Initial bootloader version None

AN2606 Rev 61 373/436

435
STM32WB10xx/15xx devices bootloader AN2606

72 STM32WB10xx/15xx devices bootloader

72.1 Bootloader configuration

The STM32WB10xx/15xx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 161 shows the hardware resources used by this bootloader.

Table 159. STM32WB10xx/15xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz

RCC MSI enabled
(using PLL clocked by MSI).
16 Kbytes starting from address
RAM - 0x20000000 are used by the bootloader
firmware

Common to all 28 Kbytes starting from address

bootloaders System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1
USART1 Enabled configuration is 8-bit, even parity, and one
stop bit
USART1 bootloader PA10 pin: USART1 in reception mode.
USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1001111x (where x
I2C1 bootloader = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB7 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.

374/436 AN2606 Rev 61

AN2606 STM32WB10xx/15xx devices bootloader

Table 159. STM32WB10xx/15xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in
SPI1_MOSI pin Input
SPI1 bootloader push-pull, pull-down mode
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.

AN2606 Rev 61 375/436

435
STM32WB10xx/15xx devices bootloader AN2606

72.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 96. Bootloader V11.x selection for STM32WB10xx/15xx

Bootloader

Disable all
interrupt sources

System Init ( Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
detected

no
yes Disable all other
no interfaces clocks

Disable all other Disable all other Configure

interfaces clocks interfaces clocks USARTx
SPIx detects
Synchro
mechanism
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

MSv38443V2

376/436 AN2606 Rev 61

AN2606 STM32WB10xx/15xx devices bootloader

72.3 Bootloader version

Table 160. STM32WB10xx/15xx bootloader versions
Version
Description Known limitations
number

– I2C Write Protect command (0x73) performs a

Read Unprotect instead of disabling write
protection.
V11.1 Initial bootloader version
– Workaround: Use No-Stretch Write Unprotect
command (0x74) that is performing correctly the
write unprotect operation

AN2606 Rev 61 377/436

435
STM32WB30xx/35xx/50xx/55xx devices bootloader AN2606

73 STM32WB30xx/35xx/50xx/55xx devices bootloader

73.1 Bootloader configuration

The STM32WBxxx bootloader is activated by applying Pattern 16 (described in Table 2).
Table 161 shows the hardware resources used by this bootloader.

Table 161. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz

MSI enabled
(using PLL clocked by MSI).
RCC The clock recovery system (CRS) is
- enabled for the DFU bootloader to allow
USB to be clocked by HSI 48 MHz.
20 Kbytes starting from address
RAM - 0x20000000 are used by the bootloader
Common to all firmware
bootloaders
28 Kbytes starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1
USART1 Enabled configuration is 8-bit, even parity, and one
stop bit
USART1 bootloader PA10 pin: USART1 in reception mode.
USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address,
I2C1 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1001111x (where x
I2C1 bootloader = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB7 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.

378/436 AN2606 Rev 61

AN2606 STM32WB30xx/35xx/50xx/55xx devices bootloader

Table 161. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

I2C speed: up to 1 MHz, 7-bit address,
I2C3 Enabled slave mode, analog filter ON.
Slave 7-bit address: 0b1001111x (where x
I2C3 bootloader = 0 for write and x = 1 for read)
PC0 pin: clock line is used in open-drain
I2C3_SCL pin Input/output
no pull mode.
PC1 pin: data line is used in open-drain
I2C3_SDA pin Input/output
no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data Input line, used in
SPI1_MOSI pin Input
SPI1 bootloader push-pull, pull-down mode
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PB15 pin: slave data Input line, used in
SPI2_MOSI pin Input
SPI2 bootloader push-pull, pull-down mode
PB14 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PB13 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PB12 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.

AN2606 Rev 61 379/436

435
STM32WB30xx/35xx/50xx/55xx devices bootloader AN2606

Table 161. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device

mode.
USB FS interrupt vector is enabled and
USB Enabled used for USB DFU communications.
Note: VDDUSB IO must be connected to
3.3 V as USB peripheral is used by the
DFU bootloader bootloader.
PA11: USB DM line. Used in input no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in input no pull
USB_DP pin mode.
No external pull-up resistor is required

380/436 AN2606 Rev 61

AN2606 STM32WB30xx/35xx/50xx/55xx devices bootloader

73.2 Bootloader selection

Figure 97 shows the bootloader selection mechanism.

Figure 97. Bootloader V13.0 selection for STM32WB30xx/35xx/50xx/55xx

System Reset

Configure System clock to 64

MHz with MSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

Synchro mechanism
yes
detected on SPIx
no
Disable other
interfaces clocks
no

Execute DFU
USB cable bootloader using
yes
Detected USB interrupts

MS51473V1

AN2606 Rev 61 381/436

435
STM32WB30xx/35xx/50xx/55xx devices bootloader AN2606

73.3 Bootloader version

Table 162. STM32WB30xx/35xx/50xx/55xx bootloader versions
Version
Description Known limitations
number

– Readout Unprotect Command is not working

properly as at the end of the command an
NVIC_SystemReset is done instead of a flash
option bytes reload.
This makes the change of the RDP level not
effective until a power off power on.
V13.5 Initial bootloader version
– I2C Write Protect command (0x73) performs a
Read Unprotect instead of disabling write
protection.
Workaround: Uses No-Stretch Write Unprotect
command (0x74) that is performing correctly the
write unprotect operation

Note: Instability when performing multiple resets during operations ongoing causing Overrun or
FrameError errors on USART Bootloader and not recoverable unless Hardware Reset is
performed. Fixed by workaround in FUS V1.0.1 and V1.0.2.

382/436 AN2606 Rev 61

AN2606 STM32WLE5xx/55xx devices bootloader

74 STM32WLE5xx/55xx devices bootloader

74.1 Bootloader configuration

The STM32WLE5xx/55xx bootloader is activated by applying Pattern 13 (described in
Table 2). Table 163 shows the hardware resources used by this bootloader.

Table 163. STM32WLE5xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz (using PLL

RCC HSI enabled
clocked by HSI).
8 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
Common to all 16 Kbytes starting from address 0x1FFF0000,
bootloaders System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized the USART1 configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
bootloader alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit,
USART2 Enabled
even parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input
bootloader alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 61 383/436

435
STM32WLE5xx/55xx devices bootloader AN2606

Table 163. STM32WLE5xx/55xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
PA7 pin: slave data Input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1 bootloader
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data Input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2 bootloader
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

384/436 AN2606 Rev 61

AN2606 STM32WLE5xx/55xx devices bootloader

74.2 Bootloader selection

Figure 98 shows the bootloader selection mechanism.

Figure 98. Bootloader V12.x selection for STM32WLE5xx/55xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received
yes
on USARTx

Disable all other

yes interfaces clocks
no

Disable all other Configure

interfaces clocks USARTx
SPIx detects
no Synchro
mechanism Execute Execute
BL_SPI_Loop BL_USART_Loop
for SPIx for USARTx

MSv38476V1

74.3 Bootloader version

Table 164. STM32WLE5xx/55xx bootloader versions
Version number Description Known limitations

BL cannot write/read the following option bytes:

V12.2 Initial bootloader version on rev. Z samples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)
BL cannot write/read the following option bytes:
V12.3 Final bootloader version on rev Z samples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)
BL cannot write/read the following option bytes:
V12.4 Final bootloader version on rev Ysamples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)

AN2606 Rev 61 385/436

435
STM32U535xx/545xx devices bootloader AN2606

75 STM32U535xx/545xx devices bootloader

75.1 Bootloader configuration

The STM32U535xx/545xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 165 shows the hardware resources used by this bootloader.

Table 165. STM32U535xx/545xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked

HSI enabled
RCC by HSI).
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes starting from address 0x20000000 are used by
RAM -
the bootloader firmware
Common to all
bootloaders 64 Kbytes starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized the USART3 configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in alternate
USART3_RX pin Input
bootloader push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C1 Enabled analog filter ON.
I2C1 bootloader – Slave 7-bit address: 0b1101000x (where x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.

386/436 AN2606 Rev 61

AN2606 STM32U535xx/545xx devices bootloader

Table 165. STM32U535xx/545xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C2 Enabled analog filter ON.
I2C2 bootloader – Slave 7-bit address: 0b1101000x (where x = 0 for write
and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode,
I2C3 Enabled analog filter ON.
I2C3 bootloader – Slave 7-bit address: 0b1101000x (where x = 0 for write
and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data Input line, used in push-pull, pull-down
bootloader SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
PA4 pin: slave chip select pin used in push-pull, no pull
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2
PB15 pin: slave data Input line, used in push-pull, no pull
bootloader SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.

AN2606 Rev 61 387/436

435
STM32U535xx/545xx devices bootloader AN2606

Table 165. STM32U535xx/545xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PB5 pin: slave data Input line, used in push-pull, no pull
SPI3_MOSI pin Input
bootloader mode
PG10 pin: slave data Input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
FDCAN – AutoRetransmission = ENABLE
bootloader – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input/
push-pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for USB DFU
communications.
DFU bootloader
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

388/436 AN2606 Rev 61

AN2606 STM32U535xx/545xx devices bootloader

Table 166. STM32U535xx/545xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of status
Data Status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone
disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP
0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 61 389/436

435
STM32U535xx/545xx devices bootloader AN2606

75.2 Bootloader selection

Figure 99 shows the bootloader selection mechanism.

Figure 99. Bootloader V9.x selection for STM32U535xx/545xx

System reset
Or JumpToBL

Disable all
Exexute
0x7F detected interrupt sources
De-Init system Yes BL_USART_Loop
on USARTx and other
Configure system for USARTx
interfaces clocks
clock to 60 MHz
with HSI and PLL
No

Disable all
System Init (Clock, Execute
FDCAN frame interrupt sources
GPIOs, IWDG, Yes BL_FDCAN_Loop
detected and other
SysTick) for FDCANx
interfaces clocks

No
Configure
USARTx Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks
Configure USB FS
device
No No

Disable all
SPIx detects Execute
Configure I2Cx interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interfaces clocks

No
Configure SPIx

Disable all
Execute DFU
USB cable interrupt sources
Yes bootloader using
detected and other
USB interrupts
interfaces clocks
MS57522V2

Configure
FDCANx

390/436 AN2606 Rev 61

AN2606 STM32U535xx/545xx devices bootloader

75.3 Bootloader version

Table 167. STM32U535xx/545xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not

V9.1 Initial bootloader version
send the command ID to the host

AN2606 Rev 61 391/436

435
STM32U575xx/85xx devices bootloader AN2606

76 STM32U575xx/85xx devices bootloader

76.1 Bootloader configuration

The STM32U575xx/85xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 168 shows the hardware resources used by this bootloader.

Table 168. STM32U575xx/85xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

RCC HSI enabled
HSI).
16 Kbytes starting from address 0x20000000 are used by the
RAM -
Common to bootloader firmware
all 64 Kbytes starting from address 0x0BF90000, contain the
bootloaders System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate push-
USART1_RX pin Input
bootloader pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized the USART2 configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Once initialized the USART3 configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in alternate
USART3_RX pin Input
bootloader push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in alternate
USART3_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C1 Enabled filter ON.
I2C1 – Slave 7-bit address: 0b1011010x (where x = 0 for write and
bootloader x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.

392/436 AN2606 Rev 61

AN2606 STM32U575xx/85xx devices bootloader

Table 168. STM32U575xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C2 Enabled filter ON.
I2C2 – Slave 7-bit address: 0b1011010x (where x = 0 for write and
bootloader x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C3 Enabled filter ON.
I2C3 – Slave 7-bit address: 0b1011010x (where x = 0 for write and
bootloader x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data Input line, used in push-pull, pull-down
bootloader SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2
PB15 pin: slave data Input line, used in push-pull, pull-down
bootloader SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

AN2606 Rev 61 393/436

435
STM32U575xx/85xx devices bootloader AN2606

Table 168. STM32U575xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PB5 pin: slave data Input line, used in push-pull, pull-down
SPI3_MOSI pin Input
bootloader mode
PG10 pin: slave data Input line, used in push-pull, pull-down
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, pull-down
SPI3_NSS pin Input
mode.
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
FDCAN – AutoRetransmission = ENABLE
bootloader – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, pull-up mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, pull-up mode.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU
peripheral is used by the bootloader.
bootloader
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

394/436 AN2606 Rev 61

AN2606 STM32U575xx/85xx devices bootloader

Table 169. STM32U575xx/585xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of status
Data Status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone
disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP
0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 61 395/436

435
STM32U575xx/85xx devices bootloader AN2606

76.2 Bootloader selection

Figure 100. Bootloader V9.x selection for STM32U575xx/85xx

System reset
Or JumpToBL

Disable all
Exexute
0x7F detected interrupt sources
De-Init system Yes BL_USART_Loop
on USARTx and other
Configure system for USARTx
interfaces clocks
clock to 60 MHz
with HSI and PLL
No

Disable all
System Init (Clock, Execute
FDCAN frame interrupt sources
GPIOs, IWDG, Yes BL_FDCAN_Loop
detected and other
SysTick) for FDCANx
interfaces clocks

No
Configure
USARTx Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks
Configure USB FS
device
No No

Disable all
SPIx detects Execute
Configure I2Cx interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interfaces clocks

No
Configure SPIx

Disable all
Execute DFU
USB cable interrupt sources
Yes bootloader using
detected and other
USB interrupts
interfaces clocks
MS57522V2

Configure
FDCANx

76.3 Bootloader version

Table 170. STM32U575xx/85xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.2 Initial bootloader version
the command ID to the host

396/436 AN2606 Rev 61

AN2606 STM32U595xx/599xx/5A5xx/5A9xx devices bootloader

77 STM32U595xx/599xx/5A5xx/5A9xx devices
bootloader

77.1 Bootloader configuration

The STM32U595xx/599xx/5A5xx/5A9xx bootloader is activated by applying Pattern 12
(described in Table 2). Table 171 shows the hardware resources used by this bootloader.

Table 171. STM32U595xx/599xx/5A5xx/5A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
- 20 MHz derived from the PLLQ is used for FDCAN
RCC When USB cable is detected, SW tries to detect if a quartz is
plugged in the board to configure the USBPHY clock.
HSE enabled
Supported quartz: 8, 12, 16, 20, 24, 26, and 32 MHz
Common to
If no quartz is detected a system reset is triggered.
all
bootloaders 16 Kbytes starting from address 0x20000000 are used by the
RAM -
bootloader firmware
64 Kbytes starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate push-
USART1_RX pin Input
bootloader pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized the USART2 configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART1 is detected.
Once initialized the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
USART3 PC11 pin: USART3 in reception mode. Used in alternate push-
USART3_RX pin Input
bootloader pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.

AN2606 Rev 61 397/436

435
STM32U595xx/599xx/5A5xx/5A9xx devices bootloader AN2606

Table 171. STM32U595xx/599xx/5A5xx/5A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C1 Enabled filter ON.
I2C1 – Slave 7-bit address: 0b1100000x, where x = 0 for write and
bootloader x = 1 for read.
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C2 Enabled filter ON.
I2C2 – Slave 7-bit address: 0b1100000x, where x = 0 for write and
bootloader x = 1 for read.
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C3 Enabled filter ON.
I2C3 – Slave 7-bit address: 0b1100000x, where x = 0 for write and
bootloader x = 1 for read.
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
SPI1_MOSI pin Input PA7 pin: slave data Input line, used in push-pull, no pull mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1 SPI1_MISO pin Output
mode
bootloader
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
SPI1_NSS pin Input PA4 pin: slave chip select pin used in push-pull, no pull mode.
PB15 pin: slave data Input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2 SPI2_MISO pin Output
mode
bootloader
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
SPI3_MOSI pin Input PB5 pin: slave data Input line, used in push-pull, no pull mode
PG10 pin: slave data Input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
SPI3
bootloader PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.

398/436 AN2606 Rev 61

AN2606 STM32U595xx/599xx/5A5xx/5A9xx devices bootloader

Table 171. STM32U595xx/599xx/5A5xx/5A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

USB HS configured in forced device mode.

USB Enabled USB HS interrupt vector is enabled and used for USB DFU
communications.
DFU
bootloader USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
FDCAN – AutoRetransmission = ENABLE
bootloader – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.

Table 172. STM32U595xx/599xx/5A5xx/5A9xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of
Data status data Status data
Function Opcode data sent Data sent data
received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when
0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP 0.5
Must be run when 0x82 0x4 0x1 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

AN2606 Rev 61 399/436

435
STM32U595xx/599xx/5A5xx/5A9xx devices bootloader AN2606

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

400/436 AN2606 Rev 61

AN2606 STM32U595xx/599xx/5A5xx/5A9xx devices bootloader

77.2 Bootloader selection

Figure 101 shows the bootloader selection mechanism.

Figure 101. Bootloader V9.x selection for STM32U595xx/599xx/5A5xx/5A9xx

System Reset
Or JumpToBL

Disable all
Execute
0x7F detected on interrupt sources
De-Init system Yes BL_USART_Loop
USARTx and other
Configure System for USARTx
interface clocks
clock to 60 MHz
with HSI and PLL
No

System Init Disable all

Execute
(Clock, GPIOs, FDCAN Frame interrupt sources
Yes BL_FDCAN_Loop
IWDG, SysTick) detected and other
for FDCANx
interface clocks

No

Configure
USB HS device Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interface clocks

No No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interface clocks

Configure I2Cx No

Stop, DeInit
USB cable USB IP, and
Yes System Reset
detected start quartz
detection
Configure SPIx

Re-configure
Execute DFU No
Configure System and Quartz
MS57512V2

bootloader using Yes

FDCANx USB clocks detected?
USB interrupts
using HSE

77.3 Bootloader version

Table 173. STM32U595xx/599xx/5A5xx/5A9xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.2 Initial bootloader version
the command ID to the host

AN2606 Rev 61 401/436

435
STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader AN2606

78 STM32U5F7xx/5F9xx/5G7xx/5G9xx devices
bootloader

78.1 Bootloader configuration

The STM32U5F7xx/5F9xx/5G7xx/5G9xx bootloader is activated by applying Pattern 12
(described in Table 2). Table 174 shows the hardware resources used by this bootloader.

Table 174. STM32U5F7xx/5F9xx/5G7xx/5G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
- 20 MHz derived from the PLLQ is used for FDCAN
RCC When USB cable is detected, SW tries to detect if a quartz is
HSE plugged in the board to configure the USBPHY clock.
enabled Supported quartz: 8, 12, 16, 20, 24, 26, and 32 MHz
Common to If no quartz detected a system reset is triggered.
all
bootloaders 16 Kbytes starting from address 0x20000000 are used by the
RAM -
bootloader firmware
64 Kbytes starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized the USART1 configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
bootloader push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized the USART2 configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
bootloader pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART1 is detected.
Once initialized the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
USART3 PC11 pin: USART3 in reception mode. Used in alternate
USART3_RX pin Input
bootloader push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.

402/436 AN2606 Rev 61

AN2606 STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader

Table 174. STM32U5F7xx/5F9xx/5G7xx/5G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C1 Enabled filter ON.
I2C1 – Slave 7-bit address: 0b1101001x, where x = 0 for write and
bootloader x = 1 for read.
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C2 Enabled filter ON.
I2C2 – Slave 7-bit address: 0b1101001x, where x = 0 for write and
bootloader x = 1 for read.
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, slave mode, analog
I2C3 Enabled filter ON.
I2C3 – Slave 7-bit address: 0b1101001x, where x = 0 for write and
bootloader x = 1 for read.
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
SPI1_MOSI pin Input PA7 pin: slave data Input line, used in push-pull, no pull mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1 SPI1_MISO pin Output
mode
bootloader
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
SPI1_NSS pin Input PA4 pin: slave chip select pin used in push-pull, no pull mode.
PB15 pin: slave data Input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2 SPI2_MISO pin Output
mode
bootloader
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
SPI3_MOSI pin Input PB5 pin: slave data Input line, used in push-pull, no pull mode
PG10 pin: slave data Input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
SPI3
bootloader PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.

AN2606 Rev 61 403/436

435
STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader AN2606

Table 174. STM32U5F7xx/5F9xx/5G7xx/5G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

USB HS configured in forced device mode.

USB Enabled USB HS interrupt vector is enabled and used for USB DFU
communications.
DFU
bootloader USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
FDCAN – AutoRetransmission = ENABLE
bootloader – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.

Table 175. STM32U5F7xx/5F9xx/5G7xx/5G9xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of
Data status data Status data
Function Opcode data sent Data sent data
received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when
0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP 0.5
Must be run when 0x82 0x4 0x1 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

404/436 AN2606 Rev 61

AN2606 STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 61 405/436

435
STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader AN2606

78.2 Bootloader selection

Figure 101 shows the bootloader selection mechanism.

Figure 102. Bootloader V9.x selection for STM32U5F7xx/5F9xx/5G7xx/5G9xx

System Reset
Or JumpToBL

Disable all
Execute
0x7F detected on interrupt sources
De-Init system Yes BL_USART_Loop
USARTx and other
Configure System for USARTx
interface clocks
clock to 60 MHz
with HSI and PLL
No

System Init Disable all

Execute
(Clock, GPIOs, FDCAN Frame interrupt sources
Yes BL_FDCAN_Loop
IWDG, SysTick) detected and other
for FDCANx
interface clocks

No

Configure
USB HS device Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interface clocks

No No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interface clocks

Configure I2Cx No

Stop, DeInit
USB cable USB IP, and
Yes System Reset
detected start quartz
detection
Configure SPIx

Re-configure
Execute DFU No
Configure System and Quartz
MS57512V2

bootloader using Yes

FDCANx USB clocks detected?
USB interrupts
using HSE

78.3 Bootloader version

Table 176. STM32U5F7xx/5F9xx/5G7xx/5G9xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.0 Initial bootloader version
the command ID to the host

406/436 AN2606 Rev 61

AN2606 Device-dependent bootloader parameters

79 Device-dependent bootloader parameters

The bootloader protocol command set and sequences for each serial peripheral are the
same for all STM32 devices. However, some parameters depend on device and bootloader
version:
• PID (Product ID)
• Valid RAM addresses (RAM area used during bootloader execution is not accessible)
accepted by the bootloader when the Read Memory, Go and Write Memory commands
are requested.
• System memory area.
Table 177 shows the values of these parameters for each STM32 device.

Table 177. Bootloader device-dependent parameters

STM32 System
Device PID BL ID RAM
series memory

0x20000000 -
STM32C011xx 0x443 0x51
0x20002FFF 0x1FFF0000 -
C0
0x20002000 - 0x1FFF17FF
STM32C031xx 0x453 0x52
0x200017FF
0x20000800 -
STM32F05xxx and STM32F030x8 0x440 0x21
0x20001FFF 0x1FFFEC00 -
0x20000800 - 0x1FFFF7FF
STM32F03xx4/6 0x444 0x10
0x20000FFF
0x20001800 - 0x1FFFD800 -
STM32F030xC 0x442 0x52
0x20007FFF 0x1FFFF7FF
0x1FFFC400 -
STM32F04xxx 0x445 0xA1 NA
0x1FFFF7FF
F0
0x1FFFC400 -
STM32F070x6 0x445 0xA2 NA
0x1FFFF7FF
0x1FFFC800 -
STM32F070xB 0x448 0xA2 NA
0x1FFFF7FF
0x20001800 - 0x1FFFC800 -
STM32F071xx/072xx 0x448 0xA1
0x20003FFF 0x1FFFF7FF
0x1FFFD800 -
STM32F09xxx 0x442 0x50 NA
0x1FFFF7FF

AN2606 Rev 61 407/436

435
Device-dependent bootloader parameters AN2606

Table 177. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20000200 -
Low-density 0x412 NA
0x200027FF
0x20000200 -
Medium-density 0x410 NA
0x20004FFF
0x20000200 - 0x1FFFF000 -
STM32F10xxx High-density 0x414 NA
0x2000FFFF 0x1FFFF7FF
0x20000200 -
F1 Medium-density value line 0x420 0x10
0x20001FFF
0x20000200 -
High-density value line 0x428 0x10
0x20007FFF
0x20001000 - 0x1FFFB000 -
STM32F105xx/107xx 0x418 NA
0x2000FFFF 0x1FFFF7FF
0x20000800 - 0x1FFFE000 -
STM32F10xxx XL-density 0x430 0x21
0x20017FFF 0x1FFFF7FF
0x20 0x20002000 - 0x1FFF0000 -
F2 STM32F2xxxx 0x411
0x33 0x2001FFFF 0x1FFF77FF

0x20001400 -
STM32F373xx 0x41
0x20007FFF
0x432
0x20001000 -
STM32F378xx 0x50
0x20007FFF
STM32F302xB(C)/303xB(C) 0x41 0x20001400 -
0x422
STM32F358xx 0x50 0x20009FFF

STM32F301xx/302x4(6/8) 0x40 0x20001800 - 0x1FFFD800 -

F3 0x439
0x20003FFF 0x1FFFF7FF
STM32F318xx 0x50
STM32F303x4(6/8)/ 0x20001800 -
0x438 0x50
334xx/328xx 0x20002FFF
0x20001800 -
STM32F302xD(E)/303xD(E) 0x446 0x40
0x2000FFFF
0x20001800 -
STM32F398xx 0x446 0x50
0x2000FFFF

408/436 AN2606 Rev 61

AN2606 Device-dependent bootloader parameters

Table 177. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20002000 -
0x31
0x2001FFFF
STM32F40xxx/41xxx 0x413
0x20003000 -
0x91
0x2001FFFF
0x70 0x20003000 -
STM32F42xxx/43xxx 0x419
0x91 0x2002FFFF

0x20003000 -
STM32F401xB(C) 0x423 0xD1
0x2000FFFF
0x20003000 -
STM32F401xD(E) 0x433 0xD1
0x20017FFF
0x20003000 - 0x1FFF0000 -
F4 STM32F410xx 0x458 0xB1
0x20007FFF 0x1FFF77FF

0x20003000 -
STM32F411xx 0x431 0xD0
0x2001FFFF
0x20003000 -
STM32F412xx 0x441 0x90
0x2003FFFF
0x20003000 -
STM32F446xx 0x421 0x90
0x2001FFFF
0x20003000 -
STM32F469xx/479xx 0x434 0x90
0x2005FFFF
0x20003000 -
STM32F413xx/423xx 0x463 0x90
0x2004FFFF
0x20004000 - 0x1FF00000 -
STM32F72xxx/73xxx 0x452 0x90
0x2003FFFF 0x1FF0EDBF
0x20004000 - 0x1FF00000 -
0x70
0x2004FFFF 0x1FF0EDBF
F7 STM32F74xxx/75xxx 0x449
0x20004000 - 0x1FF00000 -
0x90
0x2004FFFF 0x1FF0EDBF
0x20004000 - 0x1FF00000 -
STM32F76xxx/77xxx 0x451 0x93
0x2007FFFF 0x1FF0EDBF

AN2606 Rev 61 409/436

435
Device-dependent bootloader parameters AN2606

Table 177. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20001000 - 0x1FFF0000 -
STM32G03xxx/04xxx 0x466 0x52
0x20001FFF 0x1FFF1FFF
0x20002700 - 0x1FFF0000 -
STM32G07xxx/08xxx 0x460 0xB3
0x20009000 0x1FFF6FFF
0x1FFF0000 -
0x20004000 - 0x1FFF6FFF
STM32G0B0xx 0x467 0xD0
0x20020000 0x1FFF8000 -
G0
0x1FFFEFFF
0x1FFF0000 -
0x20004000 - 0x1FFF6FFF
STM32G0B1xx/0C1xx 0x467 0x92
0x20020000 0x1FFF8000 -
0x1FFFEFFF
0x20001000 - 0x1FFF0000 -
STM32G05xxx/061xx 0x456 0x51
0x20002000 0x1FFF1FFF
0x20004000 – 0x1FFF0000 -
STM32G431xx/441xx 0x468 0xD4
0x20005800 0x1FFF7000
0x20004000 – 0x1FFF0000 -
G4 STM32G47xxx/48xxx 0x469 0xD5
0x20018000 0x1FFF7000
0x20004000 - 0x1FFF0000 -
STM32G491xx/A1xx 0x479 0xD2
0x2001C000 0x1FFF7000
0x20004000 - 0x0BF87000 -
STM32H503xx 0x474 0xE1
0x20007FFF 0x0BF8FFFF
H5
0x20000000 - 0x0BF97000 -
STM32H563xx/573xx 0x484 0xE3
0x2009FFFF 0x0BF9FFFF
0x20004100 -
0x2001FFFF 0x1FF00000 -
STM32H72xxx/73xxx 0x483 0x93
0x24004000 - 0x1FF1E7FF
0x2404FFFF
0x20004100 -
0x2001FFFF 0x1FF00000 -
H7 STM32H74xxx/75xxx 0x450 0x91
0x24005000 - 0x1FF1E7FF
0x2407FFFF
0x20004100 -
0x2001FFFF 0x1FF00000 -
STM32H7A3xx/B3xx 0x480 0x92
0x24034000 - 0x1FF13FFF
0x2407FFFF

410/436 AN2606 Rev 61

AN2606 Device-dependent bootloader parameters

Table 177. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x1FF00000 -
STM32L01xxx/02xxx 0x457 0xC3 NA
0x1FF00FFF
0x20001000 - 0x1FF00000 -
STM32L031xx/041xx 0x425 0xC0
0x20001FFF 0x1FF00FFF
0x20001000 - 0x1FF00000 -
L0 STM32L05xxx/06xxx 0x417 0xC0
0x20001FFF 0x1FF00FFF
0x20001000 -
0x41
0x20004FFF 0x1FF00000 -
STM32L07xxx/08xxx 0x447
0x20001400 - 0x1FF01FFF
0xB2
0x20004FFF
0x20000800 -
STM32L1xxx6(8/B) 0x416 0x20
0x20003FFF
STM32L1xxx6(8/B)A 0x429 0x20 0x20001000 -
STM32L1xxxC 0x427 0x40 0x20007FFF 0x1FF00000 -
L1
0x1FF01FFF
0x20001000 -
STM32L1xxxD 0x436 0x45
0x2000BFFF
0x20001000 -
STM32L1xxxE 0x437 0x40
0x20013FFF
0x20002100 - 0x1FFF0000 -
STM32L412xx/422xx 0x464 0xD1
0x20008000 0x1FFF6FFF
0x20003100 - 0x1FFF0000 -
STM32L43xxx/44xxx 0x435 0x91
0x2000BFFF 0x1FFF6FFF
0x20003100 - 0x1FFF0000 -
STM32L45xxx/46xxx 0x462 0x92
0x2001FFFF 0x1FFF6FFF
0x20003000 -
0xA3
0x20017FFF 0x1FFF0000 -
L4 STM32L47xxx/48xxx 0x415
0x20003100 - 0x1FFF6FFF
0x92
0x20017FFF
0x20003100 - 0x1FFF0000 -
STM32L496xx/4A6xx 0x461 0x93
0x2003FFFF 0x1FFF6FFF
0x20003200 - 0x1FFF0000 -
STM32L4Rxx/4Sxx 0x470 0x95
0x2009FFFF 0x1FFF6FFF
0x20004000 - 0x1FFF0000 -
STM32L4P5xx/Q5xx 0x471 0x90
0x2004FFFF 0x1FFF6FFF
0x20004000 - 0x0BF90000 -
L5 STM32L552xx/562xx 0x472 0x92
0x2003FFFF 0x0BF97FFF
0x20000000 - 0x0BF88000 -
WBA STM32WBA52xx 0x492 0XB0
0x20001FFF 0x0BF8FFFF

AN2606 Rev 61 411/436

435
Device-dependent bootloader parameters AN2606

Table 177. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20005000 - 0x1FFF0000 -
STM32WB10xx/15xx 0x494 0xB1
0x20040000 0x1FFF7000
WB
0x20004000 - 0x1FFF0000 -
STM32WB30xx/35xx/50xx/WB55xx 0x495 0xD5
0x2000BFFF 0x1FFF7000
0x20002000 - 0x1FFF0000 -
WL STM32WLE5xx/WL55xx 0x497 0xC4
0x2000FFFF 0x1FFF3FFF
0x20004000 - 0x0BF90000 -
STM32U535xx/545xx 0x455 0x91
0x2023FFFF 0x0BF9FFFF
0x20004000 - 0x0BF90000 -
STM32U575xx/ STM32U585xx 0x482 0x92
0x200BFFFF 0x0BF9FFFF
U5
0x20004000 - 0x0BF90000 -
STM32U595xx/599xx/5A9xx 0x481 0x92
0x2026FFFF 0x0BF9FFFF
0x20004000 - 0x0BF90000 -
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0x476 0x90
0x202EFFFF 0x0BF9FFFF

412/436 AN2606 Rev 61

AN2606 Bootloader timings

80 Bootloader timings

This section presents the timings of the bootloader firmware to use for correct
synchronization between host and the STM32 device.
Two types of timings are described, namely STM32 device bootloader resources
initialization duration, and communication interface selection duration.
After these timings the bootloader is ready to receive and execute host commands.

80.1 Bootloader startup timing

After bootloader reset, the host must wait until the STM32 bootloader is ready to start
detection phase with a specific interface communication. This time corresponds to
bootloader startup timing, during which resources used by bootloader are initialized.

Figure 103. Bootloader startup timing description

Table 178. Bootloader startup timings (ms) for STM32 devices

Minimum bootloader HSE
Device
startup timeout

STM32F03xx4/6 1.612 NA
STM32F05xxx and STM32F030x8 devices 1.612 NA
STM32F04xxx 0.058 NA
STM32F071xx/072xx 0.058 NA
HSE connected 3
STM32F070x6 200
HSE not connected 230
HSE connected 6
STM32F070xB 200
HSE not connected 230
STM32F09xxx 2 NA

AN2606 Rev 61 413/436

435
Bootloader timings AN2606

Table 178. Bootloader startup timings (ms) for STM32 devices (continued)
Minimum bootloader HSE
Device
startup timeout

STM32F030xC 2 NA
STM32F10xxx 1.227 NA
PA9 pin low 1.396
STM32F105xx/107xx NA
PA9 pin high 524.376
STM32F10xxx XL-density 1.227 NA
V2.x 134 NA
STM32F2xxxx
V3.x 84.59 0.790
HSE connected 45
STM32F301xx/302x4(6/8) 560.5
HSE not connected 560.8
HSE connected 43.4
STM32F302xB(C)/303xB(C) 2.236
HSE not connected 2.36
HSE connected 7.53 NA
STM32F302xD(E)/303xD
HSE not connected 146.71 NA
STM32F303x4(6/8)/334xx/328xx 0.155 NA
STM32F318xx 0.182 NA
STM32F358xx 1.542 NA
HSE connected 43.4
STM32F373xx 2.236
HSE not connected 2.36
STM32F378xx 1.542 NA
STM32F398xx 1.72 NA
V3.x 84.59 0.790
STM32F40xxx/41xxx
V9.x 74 96
STM32F401xB(C) 74.5 85
STM32F401xD(E) 74.5 85
STM32F410xx 0.614 NA
STM32F411xx 74.5 85
STM32F412xx 0.614 180
STM32F413xx/423xx 0.642 165
V7.x 82 97
STM32F429xx/439xx
V9.x 74 97
STM32F446xx 73.61 96
STM32F469xx/479xx 73.68 230
STM32F72xxx/73xxx 17.93 50
STM32F74xxx/75xxx 16.63 50

414/436 AN2606 Rev 61

AN2606 Bootloader timings

Table 178. Bootloader startup timings (ms) for STM32 devices (continued)
Minimum bootloader HSE
Device
startup timeout

STM32G03xxx/04xxx 0.390 NA
STM32G07xxx/08xxx 0.390 NA
STM32G0Bxxx/Cxxx 0.390 NA
STM32G05xxx/061xx 0.390 NA
STM32G4xxxx 0.390 NA
STM32H503xx 0,238 NA
STM32H563xx/73xx 0.292 NA
STM32H72xxx/73xxx 53.975 NA
STM32H74xxx/75xxx 53.975 2
STM32H7A3xx/B3xx 545 NA
STM32L01xxx/02xxx 0.63 NA
STM32L031xx/041xx 0.62 NA
STM32L05xxx/06xxx 0.22 NA
V4.x 0.61 NA
STM32L07xxx/08xxx
V11.x 0.71 NA
STM32L1xxx6(8/B)A 0.542 NA
STM32L1xxx6(8/B) 0.542 NA
STM32L1xxxC 0.708 80
STM32L1xxxD 0.708 80
STM32L1xxxE 0.708 200
STM32L43xxx/44xxx 0.86 100
STM32L45xxx/46xxx 0.86 NA
LSE connected 55
V10.x 100
LSE not connected 2560
STM32L47xxx/48xxx
LSE connected 55.40
V9.x 100
LSE not connected 2560.51
STM32L412xx/422xx 0.86 NA
STM32L496xx/4A6xx 76.93 100
STM32L4P5xx /Q5xx NA NA
STM32L4Rxx/4Sxx NA NA
STM32L552xx/562xx 0.390 NA
STM32BA52xx 0.390 NA
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.390 NA
STM32WLE5xx/WL55xx 0.390 NA

AN2606 Rev 61 415/436

435
Bootloader timings AN2606

Table 178. Bootloader startup timings (ms) for STM32 devices (continued)
Minimum bootloader HSE
Device
startup timeout

STM32U535xx/545xx 0.390 NA
STM32U575xx/85xx 0.390 NA
STM32U595xx/599xx/5A5xx/5A9xx 0.390 NA
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.390 NA

80.2 USART connection timing

USART connection timing is the time that the host must wait for between sending the
synchronization data (0x7F) and receiving the first acknowledge response (0x79).

Figure 104. USART connection timing description

Host Host
sends receives
0x7F 0x79 (ACK)

a b a
Bootloader
execution time

Device Device Bootloader

receives sends ACK ready to receive
0x7F byte 0x79 and execute
commands

a Duration of 1 byte sending through USART (depends on Baudrate)

b Duration of USART peripheral configuration MS35041V1

1. Receiving characters different from 0x7F (or line glitches) causes bootloader to start communication using
a wrong baudrate. Bootloader measures the signal length between rising edge of the first bit to the falling
edge of the last bit to deduce the baudrate value
2. Bootloader does not realign the calculated baudrate to standard baudrate values (i.e. 1200, 9600, 115200).

Note: PA9 pin (USB_VBUS) on STM32F105xx/107xx devices is used to detect the USB host
connection. The initialization of USB peripheral is performed only if PA9 is high at detection
phase, which means that a host is connected to the port and delivering 5 V on the USB bus.
When PA9 level is high at detection phase, more time is required to initialize and shutdown
the USB peripheral. To minimize bootloader detection time when PA9 pin is not used, keep
PA9 low during USART detection phase, from the moment the device is reset, until a device
ACK is sent.

416/436 AN2606 Rev 61

AN2606 Bootloader timings

Table 179. USART bootloader minimum timings (ms) for STM32 devices
One USART USART USART
Device
byte sending configuration connection

STM32F03xx4/6 0.078125 0.0064 0.16265

STM32F05xxx and STM32F030x8 devices 0.078125 0.0095 0.16575
STM32F04xxx 0.078125 0.007 0.16325
STM32F071xx/072xx 0.078125 0.007 0.16325
STM32F070x6 0.078125 0.014 0.17
STM32F070xB 0.078125 0.08 0.23
STM32F09xxx 0.078125 0.07 0.22
STM32F030xC 0.078125 0.07 0.22
STM32F10xxx 0.078125 0.002 0.15825
PA9 pin low 0.007 0.16325
STM32F105xx/107xx 0.078125
PA9 pin High 105 105.15625
STM32F10xxx XL-density 0.078125 0.006 0.16225
V2.x
STM32F2xxxx 0.078125 0.009 0.16525
V3.x
HSE connected
STM32F301xx/302x4(6/8) 0.078125 0.002 0.15825
HSE not connected
HSE connected
STM32F302xB(C)/303xB(C) 0.078125 0.002 0.15825
HSE not connected
STM32F302xD(E)/303xD 0.078125 0.002 0.15885
STM32F303x4(6/8)/334xx/328xx 0.078125 0.002 0.15825
STM32F318xx 0.078125 0.002 0.15825
STM32F358xx 0.15625 0.001 0.3135
HSE connected
STM32F373xx 0.078125 0.002 0.15825
HSE not connected
STM32F378xx 0.15625 0.001 0.3135
STM32F398xx 0.078125 0.002 0.15885
V3.x 0.009 0.16525
STM32F40xxx/41xxx 0.078125
V9.x 0.0035 0.15975
STM32F401xB(C) 0.078125 0.00326 0.15951
STM32F401xD(E) 0.078125 0.00326 0.15951
STM32F410xx 0.078125 0.002 0.158
STM32F411xx 0.078125 0.00326 0.15951
STM32F412xx 0.078125 0.002 0.158
STM32F413xx/423xx 0.078125 0.002 0.158

AN2606 Rev 61 417/436

435
Bootloader timings AN2606

Table 179. USART bootloader minimum timings (ms) for STM32 devices (continued)
One USART USART USART
Device
byte sending configuration connection

V7.x 0.007 0.16325

STM32F429xx/439xx 0.078125
V9.x 0.00326 0.15951
STM32F446xx 0.078125 0.004 0.16
STM32F469xx/479xx 0.078125 0.003 0.159
STM32F72xxx/73xxx 0.078125 0.070 0.22
STM32F74xxx/75xxx 0.078125 0.065 0.22
STM32G03xxx/04xxx 0.078125 0.01 0.11
STM32G07xxx/08xxx 0.078125 0.01 0.11
STM32G0Bxxx/Cxxx 0.078125 0.01 0.11
STM32G05xxx/061xx 0.078125 0.01 0.11
STM32G4xxxx 0.078125 0.003 0.159
STM32H503xx 0.048 0.05 0.101
STM32H563xx/73xx 0.047 0.06 0.100
STM32H72xxx/73xxx 0.078125 0.072 0.22825
STM32H74xxx/75xxx 0.078125 0.072 0.22825
STM32H7A3xx/B3xx 0.078125 0.072 0.22825
STM32L01xxx/02xxx 0.078125 0.016 0.17
STM32L031xx/041xx 0.078125 0.018 0.174
STM32L05xxx/06xxx 0.078125 0.018 0.17425
V4.x 0.078125 0.017 0.173
STM32L07xxx/08xxx
V11.x 0.078125 0.017 0.158
STM32L1xxx6(8/B)A 0.078125 0.008 0.16425
STM32L1xxx6(8/B) 0.078125 0.008 0.16425
STM32L1xxxC 0.078125 0.008 0.16425
STM32L1xxxD 0.078125 0.008 0.16425
STM32L1xxxE 0.078125 0.008 0.16425
STM32L412xx/422xx 0.078125 0.005 0.2
STM32L43xxx/44xxx 0.078125 0.003 0.159
STM32L45xxx/46xxx 0.078125 0.07 0.22
V10.x 0.078125 0.003 0.159
STM32L47xxx/48xxx
V9.x 0.078125 0.003 0.159
STM32L496xx/4A6xx 0.078125 0.003 0.159
STM32L4Rxx/4Sxx NA NA NA
STM32L4P5xx/4Q5xx NA NA NA

418/436 AN2606 Rev 61

AN2606 Bootloader timings

Table 179. USART bootloader minimum timings (ms) for STM32 devices (continued)
One USART USART USART
Device
byte sending configuration connection

STM32L552xx/562xx 0.078125 0.01 0.11

STM32WBA52xx 0.078125 0.001 NA
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.078125 0.003 0.159
STM32WLE5xx/WL55xx 0.078125 0.001 0.110
STM32U535xx/545xx 0.078125 0.001 NA
STM32U575xx/85xx 0.078125 0.001 NA
STM32U595xx/599xx/5A5xx/5A9xx 0.078125 0.001 NA
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.078125 0.001 NA

80.3 USB connection timing

USB connection timing is the time that the host must wait for between plugging the USB
cable and establishing a correct connection with the device. This timing includes
enumeration and DFU components configuration. USB connection depends on the host.

Figure 105. USB connection timing description

Device
reset

a
Bootloader
execution time

Bootloader
ready to start
detection phase

a Duration of Bootloader resources initialization

MSv35042V1

Note: For STM32F105xx/107xx devices, if the external HSE crystal frequency is different from
25 MHz (14.7456 MHz or 8 MHz), the device performs several unsuccessful enumerations
(with connect/disconnect sequences) before establishing a correct connection with the host.
This is due to the HSE automatic detection mechanism based on Start Of Frame (SOF)
detection.

AN2606 Rev 61 419/436

435
Bootloader timings AN2606

Table 180. USB bootloader minimum timings (ms) for STM32 devices
Device USB connection

STM32F04xxx 350
STM32F070x6 TBD
STM32F070xB 320
HSE = 25 MHz 460
STM32F105xx/107xx HSE = 14.7465 MHz 4500
HSE = 8 MHz 13700
STM32F2xxxx 270
STM32F301xx/302x4(6/8) 300
STM32F302xB(C)/303xB(C) 300
STM32F302xD(E)/303xD 100
STM32F373xx 300
V3.x 270
STM32F40xxx/41xxx
V9.x 250
STM32F401xB(C) 250
STM32F401xD(E) 250
STM32F411xx 250
STM32F412xx 380
STM32F413xx/423xx 350
V7.x
STM32F429xx/439xx 250
V9.x
STM32F446xx 200
STM32F469xx/479xx 270
STM32F72xxx/73xxx 320
STM32F74xxx/75xxx 230
STM32G0B1xx/C1xx 300
STM32G4xxxx 300
STM32H503xx 251
STM32H563xx/73xx 245
STM32H72xxx/73xxx 53.9764
STM32H74xxx/75xxx 53.9764
STM32H7A3xx/B3xx 53.9764
STM32L07xxx/08xxx 140
STM32L1xxxC 849
STM32L1xxxD 849
STM32L412xx/422xx 820

420/436 AN2606 Rev 61

AN2606 Bootloader timings

Table 180. USB bootloader minimum timings (ms) for STM32 devices (continued)
Device USB connection

STM32L43xxx/44xxx 820
STM32L45xxx/46xxx 330
V10.x
STM32L47xxx/48xxx 300
V9.x
STM32L496xx/4A6xx 430
STM32L4P5xx/4Q5xx NA
STM32L4Rxx/4Sxx NA
STM32L552xx/L562xx 300
STM32WB30xx/35xx/50xx/55xx 300
STM32U535xx/545xx 300
STM32U575xx/85xx 300
STM32U595xx/599xx/5A5xx/5A9xx 300
STM32U5F7xx/5F9xx/5G7xx/5G9xx 300

AN2606 Rev 61 421/436

435
Bootloader timings AN2606

80.4 I2C connection timing

I2C connection timing is the time that the host must wait for between sending I2C device
address and sending command code. This timing includes I2C line stretching duration.

Figure 106. I2C connection timing description

Host sends start Host receives

condition + acknowledge
device address

a b
Bootloader
execution time

Device Bootloader
acknowledges its ready to receive
address and and execute
stretch line commands

a
Duration of start + 1 byte sending through I2C (depends on communication speed)
b Duration of I2C line stretching
MS35043V1

Note: For I2C communication, a timeout mechanism is implemented and must be respected to
execute bootloader commands correctly. This timeout is implemented between two I2C
frames in the same command (example: for Write memory command, a timeout is inserted
between command sending frame and address memory sending frame). The same timeout
period is inserted between two successive data receptions or transmissions in the same I2C
frame. If the timeout period elapses, a system reset is generated to avoid bootloader crash.
In Erase memory and Read-out unprotect commands, consider the duration of the operation
when implementing the host side. After sending the code of pages to erase, the host must
wait until the bootloader device performs page erasing to complete the remaining steps of
erase command.

Table 181. I2C bootloader minimum timings (ms) for STM32 devices
Start condition
I2C line
Device + one I2C byte I2C connection I2C timeout
stretching
sending

STM32F04xxx 0.0225 0.0025 0.0250 1000

STM32F070x6 0.0225 0.0025 0.0245 1000
STM32F070xB 0.0225 0.0025 0.0245 1000
STM32F071xx/072xx 0.0225 0.0025 0.0250 1000
STM32F09xxx 0.0225 0.0025 0.0245 1000
STM32F030xC 0.0225 0.0025 0.0250 1000
STM32F303x4(6/8)/334xx/328xx 0.0225 0.0027 0.0252 1000

422/436 AN2606 Rev 61

AN2606 Bootloader timings

Table 181. I2C bootloader minimum timings (ms) for STM32 devices (continued)
Start condition
I2C line
Device + one I2C byte I2C connection I2C timeout
stretching
sending

STM32F318xx 0.0225 0.0027 0.0252 1000

STM32F358xx 0.0225 0.0055 0.0280 10
STM32F378xx 0.0225 0.0055 0.0280 10
STM32F398xx 0.0225 0.0020 0.0245 1500
STM32F40xxx/41xxx 0.0225 0.0022 0.0247 1000
STM32F401xB(C) 0.0225 0.0022 0.0247 1000
STM32F401xD(E) 0.0225 0.0022 0.0247 1000
STM32F410xx 0.0225 0.0020 0.0245 1000
STM32F411xx 0.0225 0.0022 0.0247 1000
STM32F412xx 0.0225 0.0020 0.0245 1000
STM32F413xx/423xx 0.0225 0.0020 0.0245 1000
V7.x 0.0225 0.0033 0.0258 1000
STM32F42xxx/43xxx
V9.x 0.0225 0.0022 0.0247 1000
STM32F446xx 0.0225 0.0020 0.0245 1000
STM32F469xx/479xx 0.0225 0.0020 0.0245 1000
STM32F72xxx/73xxx 0.0225 0.0020 0.0245 1000
STM32F74xxx/75xxx 0.0225 0.0020 0.0245 500
STM32G03xxx/04xxx 0.0225 0.0020 0.0245 1000
STM32G07xxx/08xxx 0.0225 0.0020 0.0245 1000
STM32G0Bxx/Cxx 0.0225 0.0020 0.0245 1000
STM32G05xxx/061xx 0.0225 0.0020 0.0245 1000
STM32G4xxxx 0.0225 0.0020 0.0245 1000
STM32H503xx 0.038 0.03 0.041 1000
STM32H563xx/73xx 0.039 0.02 0.041 1000
STM32H72xxx/73xxx 0.0225 0.05 0.0745 1000
STM32H74xxx/75xxx 0.0225 0.05 0.0725 1000
STM32H7A3xx/7B3xx 0.0225 0.05 0.0745 1000
STM32L07xxx/08xxx 0.0225 0.0020 0.0245 1000
STM32L412xx/422xx 0.0225 0.0020 0.o245 1000
STM32L43xxx/44xxx 0.0225 0.0020 0.0245 1000
STM32L45xxx/46xxx 0.0225 0.0020 0.0245 1000
V10.x 0.0225 0.0020 0.0245 1000
STM32L47xxx/48xxx
V9.x 0.0225 0.0020 0.0245 1000

AN2606 Rev 61 423/436

435
Bootloader timings AN2606

Table 181. I2C bootloader minimum timings (ms) for STM32 devices (continued)
Start condition
I2C line
Device + one I2C byte I2C connection I2C timeout
stretching
sending

STM32L496xx/4A6xx 0.0225 0.0020 0.0245 1000

STM32L4P5xx/4Q5xx NA NA NA NA
STM32L4Rxx/4Sxx NA NA NA NA
STM32L552xx/L562xx 0.0225 0.0020 0.0245 1000
STM32WBA52xx 0.0225 0.0020 0.0245 1000
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.0225 0.0020 0.0245 1000
STM32U535xx/545xx 0.0225 0.0020 0.0245 1000
STM32U575xx/85xx 0.0225 0.0020 0.0245 1000
STM32U595xx/599xx/5A5xx/5A9xx 0.0225 0.0020 0.0245 1000
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.0225 0.0020 0.0245 1000

424/436 AN2606 Rev 61

AN2606 Bootloader timings

80.5 SPI connection timing

SPI connection timing is the time that the host must wait for between sending the
synchronization data (0xA5) and receiving the first acknowledge response (0x79).

Figure 107. SPI connection timing description

Host Host receives

sends ACK byte
0x5A 0x79

a b a
Bootloader
execution time

Device Device Bootloader

receives sends ACK ready to receive
0x5A byte 0x79 and execute
commands

a Duration of 1 byte sending through SPI (depends on communication speed)

b Delay between two bytes MS35044V1

Table 182. SPI bootloader minimum timings (ms) for STM32 devices
Device One SPI byte sending Delay between two bytes SPI connection

All products 0.001 0.008 0.01

AN2606 Rev 61 425/436

435
Example of function to use the “ExitSecureMemory” function AN2606

Appendix A Example of function to use the

“ExitSecureMemory” function

/**
**************************************************************************
****
* @file main.c
**************************************************************************
****
*/

/* Includes ---------------------------------------------------------------
---*/
#include "main.h"

/* Private function prototypes --------------------------------------------

---*/
static void ConfigClock(void);

void JUMP_WITHOUT_PARAM(uint32_t jump_address);

void JUMP_WITH_PARAM(uint32_t jump_address, uint32_t magic, uint32_t
applicationVectorAddress);

/* Private functions ------------------------------------------------------

---*/

/**
* @brief Main program
* @param None
* @retval None
*/
int main(void)
{
ConfigClock();

uint32_t application_address = 0x08000800;

uint32_t exit_secure_memory_address = 0x1FFF1E00;
uint32_t magic_number = 0x08192A3C;
uint32_t exit_with_magic_number = 0x0;

if (exit_with_magic_number)
{
JUMP_WITH_PARAM(exit_secure_memory_address, magic_number,
application_address);
}

426/436 AN2606 Rev 61

AN2606 Example of function to use the “ExitSecureMemory” function

else
{
JUMP_WITHOUT_PARAM(exit_secure_memory_address);
}
}

/**
* @brief ConfigClock
* @param None
* @retval None
*/
static void ConfigClock(void)
{
/* Will be developped as per the template of the needed project */
}

/**
* @brief JUMP_WITHOUT_PARAM
* @param jump_address
* @retval None
*/
void JUMP_WITHOUT_PARAM(uint32_t jump_address)
{
asm ("LDR R1, [R0]"); // jump_address
asm ("LDR R2, [R0,#4]");
asm ("MOV SP, R1");
asm ("BX R2");
}

/**
* @brief JUMP_WITH_PARAM
* @param jump_address, magic, applicationVectorAddress
* @retval None
*/
void JUMP_WITH_PARAM(uint32_t jump_address, uint32_t magic, uint32_t
applicationVectorAddress))
{
asm ("MOV R3, R0"); // jump_address
asm ("LDR R0, [R3]");
asm ("MOV SP, R0");
asm ("LDR R0, [R3,#4]");
asm ("BX R0");
}

AN2606 Rev 61 427/436

435
Example of function to use the “ExitSecureMemory” function AN2606

/************************ (C) COPYRIGHT STMicroelectronics *****END OF

FILE****/

428/436 AN2606 Rev 61

AN2606 Revision history

81 Revision history

Table 183. Document revision history

Date Revision Changes

Updated Table 1: Applicable products, Section 3: Glossary, Table 3: Embedded

bootloaders, Table 177: Bootloader device-dependent parameters, Table 178:
Bootloader startup timings (ms) for STM32 devices, Table 179: USART bootloader
21-Feb-2019 36 minimum timings (ms) for STM32 devices, Table 180: USB bootloader minimum
timings (ms) for STM32 devices, Table 181: I2C bootloader minimum timings (ms) for
STM32 devices.
Added Section 73: STM32WB30xx/35xx/50xx/55xx devices bootloader
Updated Table 1: Applicable products, Section 3: Glossary, Table 177: Bootloader
device-dependent parameters, Table 178: Bootloader startup timings (ms) for STM32
devices, Table 179: USART bootloader minimum timings (ms) for STM32 devices,
06-May-2019 37 Table 180: USB bootloader minimum timings (ms) for STM32 devices, Table 181: I2C
bootloader minimum timings (ms) for STM32 devices.
Added Section 46: STM32G431xx/441xx devices bootloader, Section 47:
STM32G47xxx/48xxx devices bootloader
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 71: STM32F413xx/423xx configuration in system
memory boot mode, Table 113: STM32H74xxx/75xxx configuration in system
memory boot mode, Table 114: STM32H74xxx/75xxx bootloader version, Table 119:
STM32L031xx/041xx configuration in system memory boot mode, Table 140:
STM32L43xxx/44xxx bootloader versions, Table 141: STM32L45xxx/46xxx
configuration in system memory boot mode, Table 148: STM32L496xx/4A6xx
bootloader version, Table 162: STM32WB30xx/35xx/50xx/55xx bootloader versions,
08-Jul-2019 38 Table 177: Bootloader device-dependent parameters, Table 178: Bootloader startup
timings (ms) for STM32 devices, Table 179: USART bootloader minimum timings
(ms) for STM32 devices, Table 180: USB bootloader minimum timings (ms) for
STM32 devices, Table 181: I2C bootloader minimum timings (ms) for STM32 devices
– Section 3: Glossary, Section 4.1: Bootloader activation, Section 41.1: Bootloader
configuration, Section 46.1: Bootloader configuration
– Figure 64: Bootloader V9.x selection for STM32H74xxx/75xxx, Figure 92: Dual bank
boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x
Added Note: in Section 4.2, Note: in Section 15.3, Note: in Section 52.1, Note: in
Section 54.1, Section 41: STM32G03xxx/STM32G04xxx devices bootloader

AN2606 Rev 61 429/436

435
Revision history AN2606

Table 183. Document revision history (continued)

Date Revision Changes

Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 90: STM32G03xx/04xxx bootloader versions,
Table 138: STM32L412xx/422xx bootloader versions, Table 140:
STM32L43xxx/44xxx bootloader versions, Table 142: STM32L45xxx/46xxx
bootloader versions, Table 144: STM32L47xxx/48xxx bootloader V10.x versions,
Table 146: STM32L47xxx/48xxx bootloader V9.x versions, Table 148:
STM32L496xx/4A6xx bootloader version, Table 150: STM32L4P5xx/4Q5xx
16-Sep-2019 39 bootloader versions, Table 177: Bootloader device-dependent parameters,
Table 178: Bootloader startup timings (ms) for STM32 devices, Table 179: USART
bootloader minimum timings (ms) for STM32 devices, Table 180: USB bootloader
minimum timings (ms) for STM32 devices, Table 181: I2C bootloader minimum
timings (ms) for STM32 devices
– Section 3: Glossary, Section 4.2: Bootloader identification
Added Figure 59: Dual bank boot implementation for STM32G47xxx/48xxx bootloader
V13.x, Section 70: STM32L552xx/STM32L562xx devices bootloader, note in
Section 73.3: Bootloader version
Updated Table 3: Embedded bootloaders, Table 155: STM32L552xx/562xx bootloader
03-Oct-2019 40
versions, Table 162: STM32WB30xx/35xx/50xx/55xx bootloader versions
Updated:
– Table 82: STM32F72xxx/73xxx bootloader V9.x versions, Table 84:
STM32F74xxx/75xxx bootloader V7.x versions, Table 86: STM32F74xxx/75xxx
bootloader V9.x versions, Table 88: STM32F76xxx/77xxx bootloader V9.x versions,
Table 89: STM32G03xxx/G04xxx configuration in system memory boot mode,
25-Oct-2019 41 Table 114: STM32H74xxx/75xxx bootloader version, Table 150:
STM32L4P5xx/4Q5xx bootloader versions, Table 153: STM32L552xx/562xx
configuration in system memory boot mode, Table 178: Bootloader startup timings
(ms) for STM32 devices, Table 179: USART bootloader minimum timings (ms) for
STM32 devices, Table 181: I2C bootloader minimum timings (ms) for STM32 devices
– Section 18: STM32F2xxxx devices bootloader
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 177: Bootloader device-dependent parameters,
Table 178: Bootloader startup timings (ms) for STM32 devices, Table 179: USART
bootloader minimum timings (ms) for STM32 devices, Table 180: USB bootloader
05-Dec-2019 42 minimum timings (ms) for STM32 devices, Table 181: I2C bootloader minimum
timings (ms) for STM32 devices
– Section 3: Glossary
Added: Section 53: STM32H7A3xx/B3xx devices bootloader, Section 68:
STM32L4P5xx/4Q5xx devices bootloader, Section 74: STM32WLE5xx/55xx devices
bootloader

430/436 AN2606 Rev 61

AN2606 Revision history

Table 183. Document revision history (continued)

Date Revision Changes

Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 99: STM32G431xx/441xx configuration in system
memory boot mode, Table 101: STM32G47xxx/48xxx configuration in system
memory boot mode, Table 102: STM32G47xxx/48xxx bootloader version, Table 114:
STM32H74xxx/75xxx bootloader version, Table 116: STM32H7A3xx/7B3xx
bootloader version, Table 150: STM32L4P5xx/4Q5xx bootloader versions, Table 153:
STM32L552xx/562xx configuration in system memory boot mode, Table 155:
STM32L552xx/562xx bootloader versions, Table 161:
STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode,
Table 177: Bootloader device-dependent parameters
– Section 3: Glossary, Section 39: STM32F74xxx/75xxx devices bootloader,
Section 41.1: Bootloader configuration, Section 42.1: Bootloader configuration,
Section 46.1: Bootloader configuration, Section 47.1: Bootloader configuration,
Section 52.1: Bootloader configuration
Added:
– Section 4.5: Bootloader UART baudrate detection, Section 4.6: Programming
04-Jun-2020 43
constraints, Section 4.7: ExitSecureMemory feature
– Note: in: Section 28.1.1: Bootloader configuration, Section 28.2.1: Bootloader
configuration, Section 29.1: Bootloader configuration, Section 30.1: Bootloader
configuration, Section 32.1: Bootloader configuration, Section 33.1: Bootloader
configuration, Section 34.1: Bootloader configuration, Section 35.1.1: Bootloader
configuration, Section 35.2.1: Bootloader configurationSection 36.1: Bootloader
configuration, Section 37.1: Bootloader configuration, Section 38.1: Bootloader
configuration, Section 39.1.1: Bootloader configuration, Section 39.2.1: Bootloader
configuration, Section 40.1: Bootloader configuration
– Figure 80: Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x,
Figure 82: Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x,
Figure 88: Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x
– Appendix A: Example of function to use the “ExitSecureMemory” function
Deleted Figure 48. Access to securable memory area from the bootloader for
STM32G03xxx/G04xxx, Figure 50. Access to securable memory area from the
bootloader for STM32G07xxx/G08xxx, Figure 52. Access to securable memory area,
Figure 54. Access to securable memory area
Introduced STM32H72xxx/73xxx devices, hence added Section 51:
STM32H72xxx/73xxx devices bootloader and its subsections.
Updated Section 3: Glossary, note in Section 41.1: Bootloader configuration and
Section 73.1: Bootloader configuration.
Updated Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 8: ExitSecureMemory entry address, Table 101:
STM32G47xxx/48xxx configuration in system memory boot mode, Table 116:
STM32H7A3xx/7B3xx bootloader version, Table 131: STM32L1xxxC configuration in
29-Jul-2020 44 system memory boot mode, Table 133: STM32L1xxxD configuration in system memory
boot mode, Table 135: STM32L1xxxE configuration in system memory boot mode,
Table 153: STM32L552xx/562xx configuration in system memory boot mode,
Table 177: Bootloader device-dependent parameters, Table 178: Bootloader startup
timings (ms) for STM32 devices, Table 179: USART bootloader minimum timings (ms)
for STM32 devices, Table 180: USB bootloader minimum timings (ms) for STM32
devices and Table 181: I2C bootloader minimum timings (ms) for STM32 devices.
Updated Figure 64: Bootloader V9.x selection for STM32H74xxx/75xxx.
Minor text edits across the whole document.

AN2606 Rev 61 431/436

435
Revision history AN2606

Table 183. Document revision history (continued)

Date Revision Changes

Introduced STM32WB30xx, STM32WB35xx, STM32Wl55xx in Table 1: Applicable

products, Table 3: Embedded bootloaders and in Section 3: Glossary
Updated:
– Table 65: STM32F410xx configuration in system memory boot mode, Table 71:
STM32F413xx/423xx configuration in system memory boot mode, Table 77:
STM32F446xx configuration in system memory boot mode, Table 79:
STM32F469xx/479xx configuration in system memory boot mode, Table 81:
STM32F72xxx/73xxx configuration in system memory boot mode, Table 85:
STM32F74xxx/75xxx configuration in system memory boot mode, Table 87:
STM32F76xxx/77xxx configuration in system memory boot mode, Table 91:
STM32G07xxx/8xxx configuration in system memory boot mode, Table 99:
STM32G431xx/441xx configuration in system memory boot mode, Table 100:
STM32G431xx/441xx bootloader version, Table 101: STM32G47xxx/48xxx
configuration in system memory boot mode, Table 113: STM32H74xxx/75xxx
configuration in system memory boot mode, Table 114: STM32H74xxx/75xxx
bootloader version, Table 115: STM32H7A3xx/7B3xx configuration in system
memory boot mode, Table 116: STM32H7A3xx/7B3xx bootloader version, Table 117:
06-Nov-2020 45 STM32L01xxx/02xxx configuration in system memory boot mode, Table 119:
STM32L031xx/041xx configuration in system memory boot mode, Table 124:
STM32L07xxx/08xxx bootloader versions, Table 125: STM32L07xxx/08xxx
configuration in system memory boot mode, Table 137: STM32L412xx/422xx
configuration in system memory boot mode, Table 149: STM32L4P5xx/4Q5xx
configuration in system memory boot mode, Table 151: STM32L4Rxxx/4Sxxx
configuration in system memory boot mode, Table 153: STM32L552xx/562xx
configuration in system memory boot mode, Table 161:
STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode,
Table 163: STM32WLE5xx/55xx configuration in system memory boot mode,
Table 164: STM32WLE5xx/55xx bootloader versions, Table 177: Bootloader device-
dependent parameters, Table 178: Bootloader startup timings (ms) for STM32
devices, Table 179: USART bootloader minimum timings (ms) for STM32 devices
– title of Table 73: STM32WB30xx/35xx/50xx/55xx devices bootloader, Table 161:
STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode,
Table 74: STM32WLE5xx/55xx devices bootloader, Table 163: STM32WLE5xx/55xx
configuration in system memory boot mode, Table 98: Bootloader V12.x selection for
STM32WLE5xx/55xx, Table 164: STM32WLE5xx/55xx bootloader versions
Upadated:
– Table 3: Embedded bootloaders, Table 89: STM32G03xxx/G04xxx configuration in
system memory boot mode, Table 101: STM32G47xxx/48xxx configuration in system
memory boot mode, Table 140: STM32L43xxx/44xxx bootloader versions, Table 142:
02-Dec-2020 46
STM32L45xxx/46xxx bootloader versions
Added following notes:
– Note: on page 312, Note: on page 319, Note: on page 327, Note: on page 339, Note:
on page 346

432/436 AN2606 Rev 61

AN2606 Revision history

Table 183. Document revision history (continued)

Date Revision Changes

Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 8:
ExitSecureMemory entry address, Table 88: STM32F76xxx/77xxx bootloader V9.x
versions, Table 101: STM32G47xxx/48xxx configuration in system memory boot
mode, Table 137: STM32L412xx/422xx configuration in system memory boot mode,
Table 139: STM32L43xxx/44xxx configuration in system memory boot mode,
Table 141: STM32L45xxx/46xxx configuration in system memory boot mode,
Table 145: STM32L47xxx/48xxx configuration in system memory boot mode,
Table 147: STM32L496xx/4A6xx configuration in system memory boot mode,
Table 149: STM32L4P5xx/4Q5xx configuration in system memory boot mode,
16-Feb-2021 47 Table 151: STM32L4Rxxx/4Sxxx configuration in system memory boot mode,
Table 153: STM32L552xx/562xx configuration in system memory boot mode,
Table 161: STM32WB30xx/35xx/50xx/55xx configuration in system memory boot
mode, Table 177: Bootloader device-dependent parameters, Table 178: Bootloader
startup timings (ms) for STM32 devices, Table 179: USART bootloader minimum
timings (ms) for STM32 devices, Table 180: USB bootloader minimum timings (ms)
for STM32 devices, Table 181: I2C bootloader minimum timings (ms) for STM32
devices
– Section 3: Glossary
Added Section 43: STM32G0B0xx device bootloader and Section 44:
STM32G0B1xx/0C1xx device bootloader
Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 8:
ExitSecureMemory entry address, Table 177: Bootloader device-dependent
parameters, Table 178: Bootloader startup timings (ms) for STM32 devices,
01-Apr-2021 48
Table 179: USART bootloader minimum timings (ms) for STM32 devices, Table 181:
I2C bootloader minimum timings (ms) for STM32 devices
Added Section 45: STM32G05xxx/061xx devices bootloader and Section 48:
STM32G491xx/4A1xx devices bootloader
Updated:
– Section 3: Glossary, Section 28.2.1: Bootloader configuration
– Table 3, Table 13,from Table 15 to Table 20, from Table 23 to Table 28, Table 29,
Table 31, Table 33, Table 37, Table 39, Table 41, Table 43, Table 45, Table 47,
Table 49, Table 51, Table 53, Table 55, Table 57, Table 59, Table 60, Table 61,
Table 63, Table 65, Table 67, Table 69, Table 71, Table 73, Table 75, Table 77,
Table 79, Table 81, Table 83, Table 85, Table 87, Table 89, Table 91, Table 93,
06-Jul-2021 49
Table 95, Table 97, Table 99, Table 101, Table 102, Table 103, Table 111, Table 113,
Table 115, Table 115, Table 117, Table 119, Table 121, Table 122, Table 123,
Table 125, Table 127, Table 129, Table 130, Table 131, Table 132, Table 133,
Table 135, Table 136, Table 137, Table 139, Table 141, Table 143, Table 145,
Table 147, Table 149, Table 151, Table 153, Table 161, Table 163, Table 177
Added Table 154: STM32L552cc/562xx special commands and Section 72:
STM32WB10xx/15xx devices bootloader
Updated:
– Section 3: Glossary, Section 43.1: Bootloader configuration, Section 44.1:
Bootloader configuration,
23-Sep-2021 50
– Table 1, Table 2, Table 3, Table 92, Table 112, Table 114, Table 116, Table 140,
Table 160, Table 162, Table 177, Table 178, Table 179, Table 180, Table 181
Added Section 76: STM32U575xx/85xx devices bootloader

AN2606 Rev 61 433/436

435
Revision history AN2606

Table 183. Document revision history (continued)

Date Revision Changes

Updated:
20-Oct-2021 51 – Table 3, Table 60,Table 92, Table 112,Table 177
– Section 28.2.1: Bootloader configuration
Updated:
– Section 3: Glossary, Section 4.1: Bootloader activation,
– Table 1, Table 2, Table 3, Table 7, Table 92, Table 114, Table 177
04-Feb-2022 52
– Figure 54
Added Section 5: STM32C011xx devices bootloader and Section 6: STM32C031xx
devices bootloader
Updated:
– Table 3, Table 111, Table 112, Table 177.
01-Mar-2022 53 – Section 4.1: Bootloader activation, , Section 41.1: Bootloader configuration,
Section 42.1: Bootloader configuration, Section 43.1: Bootloader configuration,
Section 45.1: Bootloader configuration
Updated:
20-Apr-2022 54
– Table 3, Table 111, Table 115, Table 116, Table 177
Updated:
22-Jun-2022 55
– Table 3, Table 113, Table 112, Table 177
Added Section 4.8: IWDG usage in Bootloader, Section 71: STM32WBA52xx devices
bootloader
Updated:
– Table 1, Table 2, Table 3, Table 7, Table 114, Table 115, Table 164, Table 177,
14-Dec-2022 56
Table 178, Table 179, Table 181
– Section 3: Glossary, Section 4.1: Bootloader activation
– added note 1 in Table 91, Table 93, Table 95, Table 99, Table 101, Table 103,
Table 137
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 7: Flash memory alignment constraints on STM32
products, Table 177: Bootloader device-dependent parameters, Table 178:
Bootloader startup timings (ms) for STM32 devices, Table 179: USART bootloader
minimum timings (ms) for STM32 devices, Table 180: USB bootloader minimum
21-Feb-2023 57
timings (ms) for STM32 devices, Table 181: I2C bootloader minimum timings (ms) for
STM32 devices
– Section 3: Glossary, Section 4.2: Bootloader identification
Added Section 49: STM32H503xx devices bootloader, Section 50:
STM32H563xx/573xx devices bootloader, Section 77:
STM32U595xx/599xx/5A5xx/5A9xx devices bootloader
Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 177: Bootloader
device-dependent parameters, Table 178: Bootloader startup timings (ms) for STM32
devices, Table 179: USART bootloader minimum timings (ms) for STM32 devices,
04-Apr-2023 58
Table 180: USB bootloader minimum timings (ms) for STM32 devices, Table 181: I2C
bootloader minimum timings (ms) for STM32 devices
– Section 3: Glossary
Added Section 75: STM32U535xx/545xx devices bootloader

434/436 AN2606 Rev 61

AN2606 Revision history

Table 183. Document revision history (continued)

Date Revision Changes

Updated Table 3: Embedded bootloaders, Table 92: STM32G07xx/08xxx bootloader

21-Jun-2023 59 versions, and Table 177: Bootloader device-dependent parameters.
Minor text edits across the whole document.
Updated Section 2: Related documents, note in Section 4.1: Bootloader activation,
Section 50.3: Bootloader version, and Section 63.1: Bootloader configuration.
Updated Table 2: Bootloader activation patterns, Table 3: Embedded bootloaders,
Table 62: STM32F401xB(C) bootloader versions, Table 95: STM32G0B1xx/0C1xx
configuration in system memory boot mode, Table 105: STM32H503xx configuration in
system memory boot mode, Table 108: STM32H563xx/573xx configuration in system
memory boot mode, Table 110: STM32H563xx/573xx bootloader version, Table 111:
STM32H72xxx/73xxx configuration in system memory boot mode, Table 113:
STM32H74xxx/75xxx configuration in system memory boot mode, Table 115:
STM32H7A3xx/7B3xx configuration in system memory boot mode, Table 153:
STM32L552xx/562xx configuration in system memory boot mode, Table 155:
25-Oct-2023 60 STM32L552xx/562xx bootloader versions, Table 165: STM32U535xx/545xx
configuration in system memory boot mode, Table 165: STM32U535xx/545xx
configuration in system memory boot mode, Table 167: STM32U535xx/545xx
bootloader versions, Table 170: STM32U575xx/85xx bootloader versions, Table 171:
STM32U595xx/599xx/5A5xx/5A9xx configuration in system memory boot mode,
Table 173: STM32U595xx/599xx/5A5xx/5A9xx bootloader versions, and Table 178:
Bootloader startup timings (ms) for STM32 devices.
Updated Figure 61: Bootloader V14 selection for STM32H503xx, Figure 62: Bootloader
V14 selection for STM32H563xx/573xx, Figure 99: Bootloader V9.x selection for
STM32U535xx/545xx, Figure 100: Bootloader V9.x selection for STM32U575xx/85xx,
and Figure 101: Bootloader V9.x selection for STM32U595xx/599xx/5A5xx/5A9xx.
Minor text edits across the whole document.
Added STM32U5F7xx, STM32U5F9xx, STM32U5G7xx, and STM32U5G9xx devices.
Updated Table 1: Applicable products, Table 3: Embedded bootloaders, and tables 177
to 181.
11-Jan-2024 61 Updated Section 3: Glossary.
Added Section 78: STM32U5F7xx/5F9xx/5G7xx/5G9xx devices bootloader and its
subsections.
Minor text edits across the whole document.

AN2606 Rev 61 435/436

435
 AN2606

IMPORTANT NOTICE – READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgment.

Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of purchasers’ products.

No license, express or implied, to any intellectual property right is granted by ST herein.

Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.

ST and the ST logo are trademarks of ST. For additional information about ST trademarks, refer to www.st.com/trademarks. All other
product or service names are the property of their respective owners.

Information in this document supersedes and replaces information previously supplied in any prior versions of this document.

© 2024 STMicroelectronics – All rights reserved

436/436 AN2606 Rev 61