AN2606

Application note
STM32 microcontroller system memory boot mode

Introduction
This document applies to the products listed in Table 1, referred to as STM32 throughout the
document.
It describes the supported peripherals and hardware requirements to consider when using the
bootloader, stored in the internal boot ROM (system memory) of STM32 devices, and
programmed during production.
Its main task is to download the application program to the internal flash memory through one of
the available serial peripherals (such as USART, CAN, USB, I2C, I3C, SPI, FDCAN). A
communication protocol is defined for each interface, with a compatible command set and
sequence.

February 2025 AN2606 Rev 65 1/508

www.st.com 2
 AN2606

Table 1. Applicable products

Type Part number or product series
STM32C0 series: STM32C011xx, STM32C031xx, STM32C051xx, STM32C071xx, STM32C091xx,
STM32C092xx
STM32F0 series: STM32F03xxx, STM32F04xxx, STM32F05xxx, STM32F07xxx, STM32F09xxx
STM32F1 series
STM32F2 series
STM32F3 series: STM32F301xx, STM32F302xx, STM32F303xx, STM32F318xx, STM32F328xx,
STM32F334xx, STM32F358xx, STM32F373xx, STM32F378xx, STM32F398xx
STM32F4 series: STM32F401xx, STM32F405xx, STM32F407xx, STM32F410xx, STM32F411xx,
STM32F412xx, STM32F413xx, STM32F415xx, STM32F417xx, STM32F423xx,
STM32F427xx, STM32F429xx, STM32F437xx, STM32F439xx, STM32F446xx,
STM32F469xx, STM32F479xx
STM32F7 series: STM32F722xx, STM32F723xx, STM32F732xx, STM32F733xx, STM32F745xx,
STM32F746xx, STM32F756xx, STM32F765xx, STM32F767xx, STM32F769xx,
STM32F777xx, STM32F779xx
STM32G0 series: STM32G030xx, STM32G031xx, STM32G041xx, STM32G07xxx, STM32G08xxx,
STM32G0B0xx, STM32G0B1xx, STM32G0C1xx, STM32G050xx, STM32G051xx,
STM32G061xx
STM32G4 series: STM32G431xx, STM32G441xx, STM32G47xxx, STM32G48xxx, STM32G491xx,
STM32G4A1xx
STM32H5 series: STM32H503xx, STM32H562xx, STM32H563xx, STM32H573xx, STM32H523xx,
STM32H533xx
STM32H7 series: STM32H72xxx, STM32H73xxx, STM32H74xxx, STM32H75xxx, STM32H7A3xx,
STM32H7B0xx, STM32H7B3xx, STM32H7R3xx, STM32H7R7xx, STM32H7S3xx,
STM32H7S7xx
Microcontrollers
STM32L0 series
STM32L1 series: STM32L100xx, STM32L151xx, STM32L152xx, STM32L162xx
STM32L4 series: STM32L431xx, STM32L432xx, STM32L433xx, STM32L442xx, STM32L443xx,
STM32L451xx, STM32L452xx, STM32L462xx, STM32L471xx, STM32L475xx,
STM32L476xx, STM32L486xx, STM32L496xx, STM32L4A6xx, STM32L4R5xx,
STM32L4R7xx, STM32L4R9xx, STM32L4S5xx, STM32L4S7xx, STM32L4S9xx,
STM32L412xx, STM32L422xx, STM32L4P5xx, STM32L4Q5xx, STM32L431xx,
STM32L432xx, STM32L433xx, STM32L442xx, STM32L443xx, STM32L451xx,
STM32L452xx, STM32L462xx, STM32L471xx, STM32L475xx, STM32L476xx,
STM32L486xx, STM32L496xx, STM32L4A6xx, STM32L4R5xx, STM32L4R7xx,
STM32L4R9xx, STM32L4S5xx, STM32L4S7xx, STM32L4S9xx, STM32L412xx,
STM32L422xx, STM32L4P5xx, STM32L4Q5xx
STM32L5 series: STM32L552xx, STM32L562xx
STM32U0 series: STM32U031xx, STM32U073xx, STM32U083xx
STM32U3 series: STM32U375xx, STM32U385xx
STM32U5 series: STM32U535xx, STM32U545xx, STM32U575xx, STM32U585xx, STM32U595xx,
STM32U599xx, STM32U5A5xx,STM32U5A9xx, STM32U5F7xx, STM32U5F9xx,
STM32U5G7xx, STM32U5G9xx
STM32WB series: STM32WB10xx, STM32WB15xx, STM32WB30xx, STM32WB35xx, STM32WB50xx,
STM32WB55xx
STM32WBA series: STM32WBA52xx, STM32WBA54xx, STM32WBA55xx, STM32WBA62xx,
STM32WBA63xx, STM32WBA64xx, STM32WBA65xx
STM32WB0 series: STM32WB05xx, STM32WB06xx, STM32WB07xx, STM32WB09xx
STM32WL series: STM32WLE5xx STM32WL55xx

2/508 AN2606 Rev 65

AN2606 Contents

Contents

1 General information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

2 Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

3 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

4 General bootloader description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

4.1 Bootloader activation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.2 Bootloader identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
4.3 Hardware connection requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.4 Bootloader memory management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.5 Bootloader UART baudrate detection . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.6 Programming constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.7 ExitSecureMemory feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.7.1 ExitSecureMemory v1.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.7.2 ExitSecureMemory v1.1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4.8 IWDG usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
4.9 Bootloader models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
4.10 Boot constraints on BL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

5 STM32C011xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
5.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
5.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
5.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

6 STM32C031xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
6.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
6.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

7 STM32C051xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
7.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
7.2 Boot model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

AN2606 Rev 65 3/508

17
Contents AN2606

7.3 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

7.4 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

8 STM32C071xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
8.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
8.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
8.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

9 STM32C091xx/92xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
9.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
9.2 Boot model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
9.3 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
9.4 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

10 STM32F03xx4/6 devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
10.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
10.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
10.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

11 STM32F030xC devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
11.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
11.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
11.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

12 STM32F05xxx and STM32F030x8 devices . . . . . . . . . . . . . . . . . . . . . . 78

12.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
12.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
12.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

13 STM32F04xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
13.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
13.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
13.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

14 STM32F070x6 devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

4/508 AN2606 Rev 65

AN2606 Contents

14.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

14.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
14.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

15 STM32F070xB devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
15.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
15.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
15.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

16 STM32F071xx/072xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
16.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
16.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
16.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

17 STM32F09xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
17.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
17.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
17.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

18 STM32F10xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
18.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
18.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
18.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

19 STM32F105xx/107xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
19.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
19.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
19.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
19.3.1 How to identify STM32F105xx/107xx bootloader versions . . . . . . . . . 102
19.3.2 Bootloader unavailability on STM32F105xx/STM32F107xx devices
with date code lower than 937 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
19.3.3 USART bootloader Get-Version command returns 0x20
instead of 0x22 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
19.3.4 PA9 excessive power consumption when USB cable is plugged
in bootloader V2.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

20 STM32F10xxx XL-density devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

AN2606 Rev 65 5/508

17
Contents AN2606

20.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

20.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
20.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

21 STM32F2xxxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

21.1 Bootloader V2.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
21.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
21.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
21.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
21.2 Bootloader V3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110
21.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
21.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
21.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

22 STM32F301xx/302x4(6/8) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

22.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114
22.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116
22.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .116

23 STM32F302xB(C)/303xB(C) devices . . . . . . . . . . . . . . . . . . . . . . . . . . 117

23.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
23.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119
23.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .119

24 STM32F302xD(E)/303xD(E) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

24.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
24.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
24.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

25 STM32F303x4(6/8)/334xx/328xx devices . . . . . . . . . . . . . . . . . . . . . . . 123

25.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
25.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
25.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

26 STM32F318xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

26.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

6/508 AN2606 Rev 65

AN2606 Contents

26.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

26.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

27 STM32F358xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

27.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
27.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
27.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

28 STM32F373xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

28.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
28.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
28.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

29 STM32F378xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

29.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
29.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
29.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

30 STM32F398xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

30.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
30.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
30.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

31 STM32F40xxx/41xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138

31.1 Bootloader V3.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
31.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
31.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
31.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
31.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
31.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
31.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
31.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146

32 STM32F401xB(C) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

32.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
32.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

AN2606 Rev 65 7/508

17
Contents AN2606

32.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

33 STM32F401xD(E) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

33.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
33.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
33.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156

34 STM32F410xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

34.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
34.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
34.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

35 STM32F411xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

35.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
35.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
35.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

36 STM32F412xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

36.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
36.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
36.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

37 STM32F413xx/423xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

37.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
37.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
37.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

38 STM32F42xxx/43xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

38.1 Bootloader V7.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
38.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
38.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
38.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
38.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
38.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185
38.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
38.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

8/508 AN2606 Rev 65

AN2606 Contents

39 STM32F446xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

39.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
39.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
39.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

40 STM32F469xx/479xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

40.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198
40.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
40.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204

41 STM32F72xxx/73xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

41.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
41.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
41.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

42 STM32F74xxx/75xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211

42.1 Bootloader V7.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211
42.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
42.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
42.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
42.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
42.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
42.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
42.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

43 STM32F76xxx/77xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

43.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
43.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
43.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

44 STM32G03xxx/STM32G04xxx devices . . . . . . . . . . . . . . . . . . . . . . . . 228

44.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
44.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
44.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

45 STM32G07xxx/08xxx device bootloader . . . . . . . . . . . . . . . . . . . . . . . 231

AN2606 Rev 65 9/508

17
Contents AN2606

45.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231

45.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
45.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
45.3.1 Compatibility break on boot sequence . . . . . . . . . . . . . . . . . . . . . . . . . 235

46 STM32G0B0xx device bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

46.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
46.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
46.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

47 STM32G0B1xx/0C1xx device bootloader . . . . . . . . . . . . . . . . . . . . . . 241

47.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
47.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
47.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

48 STM32G05xxx/061xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

48.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
48.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
48.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

49 STM32G431xx/441xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

49.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250
49.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
49.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

50 STM32G47xxx/48xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

50.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
50.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
50.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

51 STM32G491xx/4A1xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

51.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
51.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
51.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265

10/508 AN2606 Rev 65

AN2606 Contents

52 STM32H503xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

52.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
52.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
52.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

53 STM32H523xx/533xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

53.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272
53.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
53.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278

54 STM32H562xx/563xx/573xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . 279

54.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
54.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283
54.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

55 STM32H72xxx/73xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

55.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
55.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
55.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

56 STM32H74xxx/75xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

56.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
56.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
56.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

57 STM32H7A3xx/7B3xx/7B0xx devices . . . . . . . . . . . . . . . . . . . . . . . . . 299

57.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
57.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
57.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

58 STM32H7Rxxx/7Sxxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

58.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
58.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .311
58.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
58.4 Jump to bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312

AN2606 Rev 65 11/508

17
Contents AN2606

59 STM32L01xxx/02xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313

59.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
59.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
59.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

60 STM32L031xx/041xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

60.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
60.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
60.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319

61 STM32L05xxx/06xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

61.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320
61.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
61.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

62 STM32L07xxx/08xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323

62.1 Bootloader V4.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
62.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323
62.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
62.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
62.2 Bootloader V11.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
62.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
62.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
62.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330

63 STM32L1xxx6(8/B)A devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

63.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
63.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
63.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

64 STM32L1xxx6(8/B) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

64.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
64.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
64.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

65 STM32L1xxxC devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

12/508 AN2606 Rev 65

AN2606 Contents

65.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

65.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
65.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

66 STM32L1xxxD devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

66.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339
66.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
66.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

67 STM32L1xxxE devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343

67.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343
67.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345
67.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

68 STM32L412xx/422xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347

68.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347
68.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350
68.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352

69 STM32L43xxx/44xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

69.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353
69.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
69.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359

70 STM32L45xxx/46xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361

70.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 361
70.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365
70.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

71 STM32L47xxx/48xxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368

71.1 Bootloader V10.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
71.1.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 368
71.1.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
71.1.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
71.2 Bootloader V9.x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

AN2606 Rev 65 13/508

17
Contents AN2606

71.2.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

71.2.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377
71.2.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379

72 STM32L496xx/4A6xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380

72.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380
72.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384
72.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386

73 STM32L4P5xx/4Q5xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387

73.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
73.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
73.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

74 STM32L4Rxxx/4Sxxx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

74.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
74.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398
74.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400

75 STM32L552xx/62xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

75.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401
75.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
75.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406

76 STM32WB10xx/15xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407

76.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407
76.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
76.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410

77 STM32WB30xx/35xx/50xx/55xx devices . . . . . . . . . . . . . . . . . . . . . . . 411

77.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .411
77.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
77.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415

78 STM32WBA52xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

78.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

14/508 AN2606 Rev 65

AN2606 Contents

78.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

78.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

79 STM32WBA54xx/55xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419

79.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
79.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
79.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422

80 STM32WBA62xx/63xx/64xx/65xx devices . . . . . . . . . . . . . . . . . . . . . . 423

80.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423
80.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426
80.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426

81 STM32WB05xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

81.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
81.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
81.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428

82 STM32WB06xx/07xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

82.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429
82.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
82.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430

83 STM32WB09xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431

83.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 431
83.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
83.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432

84 STM32WLE5xx/55xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433

84.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
84.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
84.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435

85 STM32U031xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436

85.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436

AN2606 Rev 65 15/508

17
Contents AN2606

85.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439

85.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440

86 STM32U073xx/83xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441

86.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
86.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
86.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

87 STM32U375xx/85xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446

87.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
87.2 SPI1 pinout on WLCSP68-G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
87.3 Boot model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
87.4 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
87.5 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452

88 STM32U535xx/545xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453

88.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
88.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
88.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458

89 STM32U575xx/85xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459

89.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
89.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
89.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463

90 STM32U595xx/99xx/A5xx/A9xx devices . . . . . . . . . . . . . . . . . . . . . . . 464

90.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
90.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
90.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

91 STM32U5F7xx/F9xx/G7xx/G9xx devices . . . . . . . . . . . . . . . . . . . . . . . 469

91.1 Bootloader configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469
91.2 Bootloader selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473
91.3 Bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

16/508 AN2606 Rev 65

AN2606 Contents

92 Device-dependent bootloader parameters . . . . . . . . . . . . . . . . . . . . . 474

93 Bootloader timings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481

93.1 Bootloader startup timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
93.2 USART connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
93.3 USB connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
93.4 I2C connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
93.5 SPI connection timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493

Appendix A Example of ExitSecureMemory v1.0 function . . . . . . . . . . . . . . . . 494

Appendix B Example of ExitSecureMemory v1.1 function . . . . . . . . . . . . . . . . 496

94 Revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499

AN2606 Rev 65 17/508

17
List of tables AN2606

List of tables

Table 1. Applicable products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Table 2. Bootloader activation patterns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Table 3. Embedded bootloaders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Table 4. STM32 F2, F4, and F7 voltage range configuration using bootloader . . . . . . . . . . . . . . . . 48
Table 5. Supported memory area by Write, Read, Erase, and Go commands. . . . . . . . . . . . . . . . . 48
Table 6. Jitter software calculation on bootloader USART detection . . . . . . . . . . . . . . . . . . . . . . . . 49
Table 7. Flash memory alignment constraints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Table 8. ExitSecureMemory entry address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Table 9. BL and boot by product series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Table 10. STM32C011xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 58
Table 11. STM32C011xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Table 12. STM32C031xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 60
Table 13. STM32C031xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Table 14. STM32C051xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 62
Table 15. STM32C051xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Table 16. STM32C071xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 66
Table 17. STM32C071xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Table 18. STM32C091xx/92xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . 69
Table 19. STM32C091xx/92xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Table 20. STM32F03xx4/6 configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 74
Table 21. STM32F03xx4/6 bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Table 22. STM32F030xC configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 76
Table 23. STM32F030xC bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Table 24. STM32F05xxx and STM32F030x8 devices configuration in system memory boot mode . 78
Table 25. STM32F05xxx and STM32F030x8 devices bootloader versions . . . . . . . . . . . . . . . . . . . . 79
Table 26. STM32F04xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 80
Table 27. STM32F04xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Table 28. STM32F070x6 configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . . 83
Table 29. STM32F070x6 bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Table 30. STM32F070xB configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 87
Table 31. STM32F070xB bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Table 32. STM32F071xx/072xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 91
Table 33. STM32F071xx/072xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Table 34. STM32F09xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 94
Table 35. STM32F09xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Table 36. STM32F10xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . . 96
Table 37. STM32F10xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Table 38. STM32F105xx/107xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 99
Table 39. STM32F105xx/107xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Table 40. STM32F10xxx XL-density configuration in system memory boot mode . . . . . . . . . . . . . . 105
Table 41. STM32F10xxx XL-density bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Table 42. STM32F2xxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 107
Table 43. STM32F2xxxx bootloader V2.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Table 44. STM32F2xxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . . 110
Table 45. STM32F2xxxx bootloader V3.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Table 46. STM32F301xx/302x4(6/8) configuration in system memory boot mode. . . . . . . . . . . . . . 114
Table 47. STM32F301xx/302x4(6/8) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Table 48. STM32F302xB(C)/303xB(C) configuration in system memory boot mode . . . . . . . . . . . . 117

18/508 AN2606 Rev 65

AN2606 List of tables

Table 49. STM32F302xB(C)/303xB(C) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Table 50. STM32F302xD(E)/303xD(E) configuration in system memory boot mode . . . . . . . . . . . . 120
Table 51. STM32F302xD(E)/303xD(E) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Table 52. STM32F303x4(6/8)/334xx/328xx configuration in system memory boot mode . . . . . . . . 123
Table 53. STM32F303x4(6/8)/334xx/328xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Table 54. STM32F318xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 125
Table 55. STM32F318xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Table 56. STM32F358xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 128
Table 57. STM32F358xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Table 58. STM32F373xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 130
Table 59. STM32F373xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Table 60. STM32F378xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 133
Table 61. STM32F378xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Table 62. STM32F398xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 135
Table 63. STM32F398xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Table 64. STM32F40xxx/41xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 138
Table 65. STM32F40xxx/41xxx bootloader V3.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Table 66. STM32F40xxx/41xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 142
Table 67. STM32F40xxx/41xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Table 68. STM32F401xB(C) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . 147
Table 69. STM32F401xB(C) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
Table 70. STM32F401xD(E) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . 152
Table 71. STM32F401xD(E) bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
Table 72. STM32F410xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 157
Table 73. STM32F410xx bootloader V11.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
Table 74. STM32F411xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 162
Table 75. STM32F411xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Table 76. STM32F412xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 167
Table 77. STM32F412xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172
Table 78. STM32F413xx/423xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 173
Table 79. STM32F413xx/423xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Table 80. STM32F42xxx/43xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 179
Table 81. STM32F42xxx/43xxx bootloader V7.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
Table 82. STM32F42xxx/43xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 185
Table 83. STM32F42xxx/43xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Table 84. STM32F446xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 192
Table 85. STM32F446xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Table 86. STM32F469xx/479xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 198
Table 87. STM32F469xx/479xx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Table 88. STM32F72xxx/73xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 205
Table 89. STM32F72xxx/73xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Table 90. STM32F74xxx/75xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 211
Table 91. STM32F74xxx/75xxx bootloader V7.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Table 92. STM32F74xxx/75xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 215
Table 93. STM32F74xxx/75xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
Table 94. STM32F76xxx/77xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 221
Table 95. STM32F76xxx/77xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
Table 96. STM32G03xxx/G04xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . 228
Table 97. STM32G03xxx/04xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230
Table 98. STM32G07xxx/8xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 231
Table 99. STM32G07xxx/08xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Table 100. STM32G0B0xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 236

AN2606 Rev 65 19/508

22
List of tables AN2606

Table 101. STM32G0B0xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

Table 102. STM32G0B1xx/0C1xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . 241
Table 103. STM32G0B1xx/0C1xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Table 104. STM32G05xxx/061xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 246
Table 105. STM32G05xxx/061xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Table 106. STM32G431xx/441xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 250
Table 107. STM32G431xx/441xx bootloader version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254
Table 108. STM32G47xxx/48xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 255
Table 109. STM32G47xxx/48xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259
Table 110. STM32G491xx/4A1xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 261
Table 111. STM32G491xx/4A1xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
Table 112. STM32H503xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 266
Table 113. STM32H503xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Table 114. STM32H503xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271
Table 115. STM32H523xx/533xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 272
Table 116. STM32H523xx/533xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276
Table 117. STM32H523xx/533xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Table 118. STM32H562xx/563xx/573xx configuration in system memory boot mode . . . . . . . . . . . . 279
Table 119. STM32H562xx/563xx/573xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282
Table 120. STM32H562xx/563xx/573xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
Table 121. STM32H72xxx/73xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 285
Table 122. STM32H72xxx/73xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
Table 123. STM32H74xxx/75xxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 291
Table 124. STM32H74xxx/75xxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296
Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode . . . . . . . . . . . 299
Table 126. STM32H7A3xx/7B3xx/7B0xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
Table 127. STM32H7Rxxx/7Sxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 306
Table 128. STM32H7Rxxx/7Sxxx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310
Table 129. STM32H7Rxxx/7Sxxx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
Table 130. STM32L01xxx/02xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 313
Table 131. STM32L01xxx/02xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
Table 132. STM32L031xx/041xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 317
Table 133. STM32L031xx/041xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Table 134. STM32L05xxx/06xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 320
Table 135. STM32L05xxx/06xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
Table 136. STM32L07xxx/08xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 323
Table 137. STM32L07xxx/08xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Table 138. STM32L07xxx/08xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 327
Table 139. STM32L07xxx/08xxx bootloader V11.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
Table 140. STM32L1xxx6(8/B)A configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 331
Table 141. STM32L1xxx6(8/B)A bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Table 142. STM32L1xxx6(8/B) configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . 333
Table 143. STM32L1xxx6(8/B) bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Table 144. STM32L1xxxC configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 335
Table 145. STM32L1xxxC bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338
Table 146. STM32L1xxxD configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 339
Table 147. STM32L1xxxD bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342
Table 148. STM32L1xxxE configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . . . 343
Table 149. STM32L1xxxE bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
Table 150. STM32L412xx/422xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 347
Table 151. STM32L412xx/422xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352
Table 152. STM32L43xxx/44xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 353

20/508 AN2606 Rev 65

AN2606 List of tables

Table 153. STM32L43xxx/44xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 359

Table 154. STM32L45xxx/46xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 361
Table 155. STM32L45xxx/46xxx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Table 156. STM32L47xxx/48xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 368
Table 157. STM32L47xxx/48xxx bootloader V10.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373
Table 158. STM32L47xxx/48xxx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 374
Table 159. STM32L47xxx/48xxx bootloader V9.x versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
Table 160. STM32L496xx/4A6xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 380
Table 161. STM32L496xx/4A6xx bootloader version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
Table 162. STM32L4P5xx/4Q5xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 387
Table 163. STM32L4P5xx/4Q5xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Table 164. STM32L4Rxxx/4Sxxx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 394
Table 165. STM32L4Rxx/4Sxx bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400
Table 166. STM32L552xx/62xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 401
Table 167. STM32L552xx/62xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Table 168. STM32L552xx/62xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406
Table 169. STM32WB10xx/15xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 407
Table 170. STM32WB10xx/15xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
Table 171. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode . . . . . . . . . 411
Table 172. STM32WB30xx/35xx/50xx/55xx bootloader versions. . . . . . . . . . . . . . . . . . . . . . . . . . . . 415
Table 173. STM32WBA52xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . . . . 416
Table 174. STM32WBA52xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
Table 175. STM32WBA52xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418
Table 176. STM32WBA54xx/55xx configuration in system memory boot mode . . . . . . . . . . . . . . . . 419
Table 177. STM32WBA54xx/55xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420
Table 178. STM32WBA54xx/55xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
Table 179. STM32WBA62xx/63xx/64xx/65xx configuration in system memory boot mode . . . . . . . . 423
Table 180. STM32WBA62xx/63xx/64xx/65xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Table 181. STM32WBA62xx/63xx/64xx/65xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . 426
Table 182. STM32WB05xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 427
Table 183. STM32WB05xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
Table 184. STM32WB06xx/07xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 429
Table 185. STM32WB06xx/07xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Table 186. STM32WB09xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 431
Table 187. STM32WB09xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Table 188. STM32WLE5xx/55xx configuration in system memory boot mode. . . . . . . . . . . . . . . . . . 433
Table 189. STM32WLE5xx/55xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Table 190. STM32U031xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . . . . . 436
Table 191. STM32U031xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 440
Table 192. STM32U073xx/83xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 441
Table 193. STM32U073xx/83xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
Table 194. STM32U375xx/85xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 446
Table 195. STM32U375xx/385xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
Table 196. STM32U375xx/85xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
Table 197. STM32U535xx/545xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . 453
Table 198. STM32U535xx/545xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Table 199. STM32U535xx/545xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
Table 200. STM32U575xx/85xx configuration in system memory boot mode . . . . . . . . . . . . . . . . . . 459
Table 201. STM32U575xx/585xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
Table 202. STM32U575xx/85xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
Table 203. STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode . . . . . . . . . 464
Table 204. STM32U595xx/99xx/A5xx/A9xx special commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467

AN2606 Rev 65 21/508

22
List of tables AN2606

Table 205. STM32U595xx/99xx/A5xx/A9xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468

Table 206. STM32U5F7xx/F9xx/G7xx/G9xx configuration in system memory boot mode. . . . . . . . . 469
Table 207. STM32U5F7xx/F9xx/G7xx/G9xx special commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
Table 208. STM32U5F7xx/F9xx/G7xx/G9xx bootloader versions . . . . . . . . . . . . . . . . . . . . . . . . . . . 473
Table 209. Bootloader device-dependent parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
Table 210. Bootloader startup timings (ms) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Table 211. USART bootloader minimum timings (ms) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
Table 212. USB bootloader minimum timings (ms) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
Table 213. I2C bootloader minimum timings (ms) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
Table 214. SPI bootloader minimum timings (ms) for STM32 devices . . . . . . . . . . . . . . . . . . . . . . . . 493
Table 215. Document revision history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499

22/508 AN2606 Rev 65

AN2606 List of figures

List of figures

Figure 1. USART connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Figure 2. USB connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Figure 3. I2C connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 4. SPI connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Figure 5. CAN connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Figure 6. ExitSecureMemory function usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Figure 7. Access to securable memory area from the bootloader . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Figure 8. Defining an MPU region . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Figure 9. BL_V1 (left) and BL_V2 (right) models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Figure 10. Boot_V1 (left) and Boot_V2 (right) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Figure 11. Boot_V3_1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Figure 12. Boot_V3_2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Figure 13. Bootloader V5.x selection for STM32C011xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Figure 14. Bootloader V5.x selection for STM32C031xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Figure 15. Bootloader V11.0 selection for STM32C051xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Figure 16. Bootloader V13.1 selection for STM32C071xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Figure 17. Bootloader V18.1 selection for STM32C091xx/92xx devices . . . . . . . . . . . . . . . . . . . . . . . 72
Figure 18. Bootloader selection for STM32F03xx4/6 devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Figure 19. Bootloader selection for STM32F030xC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Figure 20. Bootloader selection for STM32F05xxx and STM32F030x8 devices . . . . . . . . . . . . . . . . . 79
Figure 21. Bootloader selection for STM32F04xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Figure 22. Bootloader selection for STM32F070x6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Figure 23. Bootloader selection for STM32F070xB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Figure 24. Bootloader selection for STM32F071xx/072xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Figure 25. Bootloader selection for STM32F09xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Figure 26. Bootloader selection for STM32F10xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Figure 27. Bootloader selection for STM32F105xx/107xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Figure 28. Bootloader selection for STM32F10xxx XL-density devices. . . . . . . . . . . . . . . . . . . . . . . 106
Figure 29. Bootloader V2.x selection for STM32F2xxxx devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Figure 30. Bootloader V3.x selection for STM32F2xxxx devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Figure 31. Bootloader selection for STM32F301xx/302x4(6/8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Figure 32. Bootloader selection for STM32F302xB(C)/303xB(C) devices. . . . . . . . . . . . . . . . . . . . . 119
Figure 33. Bootloader selection for STM32F302xD(E)/303xD(E) . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Figure 34. Bootloader selection for STM32F303x4(6/8)/334xx/328xx . . . . . . . . . . . . . . . . . . . . . . . . 124
Figure 35. Bootloader selection for STM32F318xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
Figure 36. Bootloader selection for STM32F358xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Figure 37. Bootloader selection for STM32F373xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
Figure 38. Bootloader selection for STM32F378xx devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
Figure 39. Bootloader selection for STM32F398xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
Figure 40. Bootloader V3.x selection for STM32F40xxx/41xxx devices . . . . . . . . . . . . . . . . . . . . . . 140
Figure 41. Bootloader V9.x selection for STM32F40xxx/41xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Figure 42. Bootloader selection for STM32F401xB(C) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Figure 43. Bootloader selection for STM32F401xD(E) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Figure 44. Bootloader V11.x selection for STM32F410xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
Figure 45. Bootloader selection for STM32F411xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
Figure 46. Bootloader V9.x selection for STM32F412xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Figure 47. Bootloader V9.x selection for STM32F413xx/423xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Figure 48. Dual bank boot implementation for STM32F42xxx/43xxx Bootloader V7.x . . . . . . . . . . . 182

AN2606 Rev 65 23/508

25
List of figures AN2606

Figure 49. Bootloader V7.x selection for STM32F42xxx/43xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

Figure 50. Dual bank boot implementation for STM32F42xxx/43xxx bootloader V9.x . . . . . . . . . . . 189
Figure 51. Bootloader V9.x selection for STM32F42xxx/43xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Figure 52. Bootloader V9.x selection for STM32F446xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Figure 53. Dual bank boot implementation for STM32F469xx/479xx Bootloader V9.x . . . . . . . . . . . 202
Figure 54. Bootloader V9.x selection for STM32F469xx/479xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Figure 55. Bootloader V9.x selection for STM32F72xxx/73xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Figure 56. Bootloader V7.x selection for STM32F74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Figure 57. Bootloader V9.x selection for STM32F74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Figure 58. Dual bank boot implementation for STM32F76xxx/77xxx Bootloader V9.x . . . . . . . . . . . 225
Figure 59. Bootloader V9.x selection for STM32F76xxx/77xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226
Figure 60. Bootloader V5.x selection for STM32G03xxx/G04xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
Figure 61. Bootloader V11.0 selection for STM32G07xxx/G08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Figure 62. Bootloader selection for STM32G0B0xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Figure 63. Bootloader selection for STM32G0B1xx/0C1xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Figure 64. Bootloader selection for STM32G05xxx/061xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Figure 65. Bootloader selection for STM32G431xx/441xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
Figure 66. Bootloader selection for STM32G47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258
Figure 67. Dual bank boot implementation for STM32G47xxx/48xxx bootloader V13.x . . . . . . . . . . 259
Figure 68. Bootloader selection for STM32G491xx/4A1xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
Figure 69. Bootloader V14 selection for STM32H503xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
Figure 70. Bootloader V14 selection for STM32H523xx/533xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277
Figure 71. Bootloader V14 selection for STM32H562xx/563xx/573xx. . . . . . . . . . . . . . . . . . . . . . . . 283
Figure 72. Bootloader V9.0 selection for STM32H72xxx/73xxx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Figure 73. Bootloader V9.x selection for STM32H74xxx/75xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
Figure 74. Bootloader V9.x selection for STM32H7A3xx/7B3xx/7B0xx. . . . . . . . . . . . . . . . . . . . . . . 304
Figure 75. Bootloader V14.x selection for STM32H7Rxxx/7Sxxx . . . . . . . . . . . . . . . . . . . . . . . . . . . 311
Figure 76. Bootloader selection for STM32L01xxx/02xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
Figure 77. Bootloader selection for STM32L031xx/041xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
Figure 78. Bootloader selection for STM32L05xxx/06xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322
Figure 79. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V4.x. . . . . . . . . . . . 325
Figure 80. Bootloader V4.x selection for STM32L07xxx/08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Figure 81. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V11.x. . . . . . . . . . . 329
Figure 82. Bootloader V11.x selection for STM32L07xxx/08xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
Figure 83. Bootloader selection for STM32L1xxx6(8/B)A devices. . . . . . . . . . . . . . . . . . . . . . . . . . . 332
Figure 84. Bootloader selection for STM32L1xxx6(8/B) devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334
Figure 85. Bootloader selection for STM32L1xxxC devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
Figure 86. Bootloader selection for STM32L1xxxD devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341
Figure 87. Bootloader selection for STM32L1xxxE devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345
Figure 88. Dual bank boot Implementation for STM32L412xx/422xx bootloader V9.x . . . . . . . . . . . 350
Figure 89. Bootloader V13.x selection for STM32L412xx/422xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351
Figure 90. Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x . . . . . . . . . . . 357
Figure 91. Bootloader V9.x selection for STM32L43xxx/44xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
Figure 92. Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x. . . . . . . . . . . . 365
Figure 93. Bootloader V9.x selection for STM32L45xxx/46xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366
Figure 94. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V10.x. . . . . . . . . . . 371
Figure 95. Bootloader V10.x selection for STM32L47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372
Figure 96. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V9.x. . . . . . . . . . . . 377
Figure 97. Bootloader V9.x selection for STM32L47xxx/48xxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378
Figure 98. Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x . . . . . . . . . . . 384
Figure 99. Bootloader V9.x selection for STM32L496xx/4A6xx. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
Figure 100. Dual bank boot implementation for STM32L4P5xx/4Q5xx bootloader V9.x . . . . . . . . . . . 391

24/508 AN2606 Rev 65

AN2606 List of figures

Figure 101. Bootloader V9.x selection for STM32L4P5xx/4Q5xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392

Figure 102. Dual bank boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x . . . . 398
Figure 103. Bootloader V9.x selection for STM32L4Rxx/4Sxx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399
Figure 104. Bootloader V9.x selection for STM32L552xx/62xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
Figure 105. Bootloader V11.x selection for STM32WB10xx/15xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409
Figure 106. Bootloader V13.0 selection for STM32WB30xx/35xx/50xx/55xx . . . . . . . . . . . . . . . . . . . 414
Figure 107. Bootloader V11.x selection for STM32WBA52xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418
Figure 108. Bootloader V11.x selection for STM32WBA54xx/55xx . . . . . . . . . . . . . . . . . . . . . . . . . . . 422
Figure 109. Bootloader V13.2 selection for STM32WBA62xx/63xx/64xx/65xx . . . . . . . . . . . . . . . . . . 426
Figure 110. Bootloader V2.x selection for STM32WB05xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428
Figure 111. Bootloader V4.x selection for STM32WB06xx/07xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430
Figure 112. Bootloader V1.x selection for STM32WB09xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
Figure 113. Bootloader V12.x selection for STM32WLE5xx/55xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Figure 114. Bootloader V11.x selection for STM32U031xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439
Figure 115. Bootloader V13.x selection for STM32U073xx/83xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
Figure 116. Bootloader V14.2 selection for STM32U375xx/85xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
Figure 117. Bootloader V9.x selection for STM32U535xx/545xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457
Figure 118. Bootloader V9.x selection for STM32U575xx/85xx . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463
Figure 119. Bootloader V9.x selection for STM32U595xx/99xx/A5xx/A9xx. . . . . . . . . . . . . . . . . . . . . 468
Figure 120. Bootloader V9.x selection for STM32U5F7xx/F9xx/G7xx/G9xx . . . . . . . . . . . . . . . . . . . . 473
Figure 121. Bootloader startup timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Figure 122. USART connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
Figure 123. USB connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
Figure 124. I2C connection timing description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
Figure 125. SPI connection timing description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493

AN2606 Rev 65 25/508

25
General information AN2606

1 General information

This document applies to Arm®(a)-based devices.

2 Related documents

For each supported product refer to the following documents, available on www.st.com:
• Datasheet or databrief
• Reference manual
• Application notes
– AN3154: CAN protocol used in the STM32 bootloader
– AN3155: USART protocol used in the STM32 bootloader
– AN3156: USB DFU protocol used in the STM32 bootloader
– AN4221: I2C protocol used in the STM32 bootloader
– AN4286: SPI protocol used in the STM32 bootloader
– AN5405: FDCAN protocol used in the STM32 bootloader
– AN5927: I3C protocol used in the STM32 bootloader

a. Arm is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere.

26/508 AN2606 Rev 65

AN2606 Glossary

3 Glossary

C0 series:
STM32C011xx indicates STM32C011xx devices
STM32C031xx indicates STM32C031xx devices
STM32C051xx indicates STM32C051xx devices
STM32C071xx indicates STM32C071xx devices
STM32C091xx/92xx indicates STM32C091xx and STM32C092xx devices
F0 series:
STM32F03xxx indicates STM32F030x4, STM32F030x6, STM32F038x6,
STM32F030xC, STM32F031x4, and STM32F031x6 devices
STM32F04xxx indicates STM32F042x4 and STM32F042x6 devices
STM32F05xxx and STM32F030x8 devices indicates STM32F051x4, STM32F051x6,
STM32F051x8, STM32F058x8, and STM32F030x8 devices
STM32F07xxx indicates STM32F070x6, STM32F070xB, STM32F071xB,
STM32F072x8, and STM32F072xB devices
STM32F09xxx indicates STM32F091xx and STM32F098xx devices
F1 series:
STM32F10xxx indicates Low-density, Medium-density, High-density, Low-density
value line, Medium-density value line, and High-density value line devices:
Low-density devices are STM32F101xx, STM32F102xx, and STM32F103xx
microcontrollers, where the flash memory density ranges between 16 and
32 Kbytes.
Medium-density devices are STM32F101xx, STM32F102xx, and STM32F103xx
microcontrollers, where the flash memory density ranges between 64 and
128 Kbytes.
High-density devices are STM32F101xx and STM32F103xx microcontrollers,
where the flash memory density ranges between 256 and 512 Kbytes.
Low-density value line devices are STM32F100xx microcontrollers, where the
flash memory density ranges between 16 and 32 Kbytes.
Medium-density value line devices are STM32F100xx microcontrollers, where
the flash memory density ranges between 64 and 128 Kbytes.
High-density value line devices are STM32F100xx microcontrollers, where the
flash memory density ranges between 256 and 512 Kbytes.
STM32F105xx/107xx indicates STM32F105xx and STM32F107xx devices
STM32F10xxx XL-density indicates STM32F101xx and STM32F103xx devices,
where the flash memory density ranges between 768 Kbytes and 1 Mbyte.
F2 series:
STM32F2xxxx indicates STM32F215xx, STM32F205xx, STM32F207xx, and
SMT32F217xx devices

AN2606 Rev 65 27/508

507
Glossary AN2606

F3 series:
STM32F301xx/302x4(6/8) indicates STM32F301x4, STM32F301x6, STM32F301x8,
STM32F302x4, STM32F302x6, and STM32F302x8 devices
STM32F302xB(C)/303xB(C) indicates STM32F302xB, STM32F302xC,
STM32F303xB and STM32F303xC devices
STM32F302xD(E)/303xD(E) indicates STM32F302xD, STM32F302xE,
STM32F303xD, and STM32F303xE devices
STM32F303x4(6/8)/334xx/328xx indicates STM32F303x4, STM32F303x6,
STM32F303x8, STM32F334x4, STM32F334x6, STM32F334x8, and STM32F328x8
devices
STM32F318xx indicates STM32F318x8 devices
STM32F358xx indicates STM32F358xC devices
STM32F373xx indicates STM32F373x8, STM32F373xB and STM32F373xC devices
STM32F378xx indicates STM32F378xC devices
STM32F398xx indicates STM32F398xE devices
F4 series:
STM32F40xxx/41xxx indicates STM32F405xx, STM32F407xx, STM32F415xx, and
SMT32F417xx devices
STM32F401xB(C) indicates STM32F401xB and STM32F401xC devices
STM32F401xD(E) indicates STM32F401xD and STM32F401xE devices
STM32F410xx indicates STM32F410x8 and STM32F410xB devices
STM32F411xx indicates STM32F411xD and STM32F411xE devices
STM32F412xx indicates STM32F412Cx, STM32F412Rx, STM32F412Vx and
STM32F412Zx devices
STM32F413xx/423xx indicates STM32F413xG, STM32F413xH and STM32F423xH
devices
STM32F42xxx/43xxx indicates STM32F427xx, STM32F429xx, STM32F437xx, and
STM32F439xx devices
STM32F446xx indicates STM32F446xE and STM32F446xC devices
STM32F469xx/479xx indicates STM32F469xE, STM32F469xG, STM32F469xI,
STM32F479xG, and STM32F479xI devices
F7 series:
STM32F72xxx/73xxx indicates STM32F722xx, STM32F723xx, STM32F732xx, and
STM32F733xx devices
STM32F74xxx/75xxx indicates STM32F745xx, STM32F746xx, and STM32F756xx
devices
STM32F76xxx/77xxx indicates STM32F765xx, STM32F767xx, STM32F769xx,
STM32F777xx, and STM32F779xx devices

28/508 AN2606 Rev 65

AN2606 Glossary

G0 series:
STM32G03xxx/04xxx indicates STM32G03xxx, and STM32G04xxx devices
STM32G07xxx/08xxx indicates STM32G07xxx, and STM32G08xxx devices
STM32G0B0xx indicates STM32G0B0xx devices
STM32G0B1xx/C1xx indicates STM32G0B1xx, and STM32G0C1xxx devices
STM32G05xxx/061xx indicates STM32G050xx, STM32G051xx, and STM32G061xx
devices
G4 series:
STM32G431xx/441xx indicates STM32G431xx and STM32G441xx devices
STM32G47xxx/48xxx indicates STM32G471xx, STM32G473xx, STM32G474xx,
STM32G483xx, and STM32G484xx devices
STM32G491xx/A1xx indicates STM32G491xx and STM32G4A1xx devices
H5 series:
STM32H503xx indicates STM32H503xx devices
STM32H562/63xx/73xx indicates STM32H562xx, STM32H563xx, and STM32H573xx
devices
STM32H523xx/33xx indicates STM32H523xx and STM32H533xx devices
H7 series:
STM32H72xxx/73xxx indicates STM32H72xxx and STM32H73xxx devices
STM32H74xxx/75xxx indicates STM32H74xxx and STM32H75xxx devices
STM32H7A3xx/7B3xx/7B0xx indicates STM32H7A3xx, STM32H7B3xx, and
STM32H7B0xx devices
STM32H7Rxxx/7Sxxx indicates STM32H7R3xx, STM32H7R7xx, STM32H7S3xx and
STM32H7S7xx devices
L0 series:
STM32L01xxx/02xxx indicates STM32L011xx and STM32L021xx devices
STM32L031xx/041xx indicates STM32L031xx and STM32L041xx devices
STM32L05xxx/06xxx indicates STM32L051xx, STM32L052xx, STM32L053xx,
STM32L062xx, and STM32L063xx ultra-low power devices
STM32L07xxx/08xxx indicates STM32L071xx, STM32L072xx, STM32L073xx,
STM32L081xx, STM32L082xx, and STM32L083xx devices
L1 series:
STM32L1xxx6(8/B) indicates STM32L1xxV6T6, STM32L1xxV6H6, STM32L1xxR6T6,
STM32L1xxR6H6, STM32L1xxC6T6, STM32L1xxC6H6, STM32L1xxV8T6,
STM32L1xxV8H6, STM32L1xxR8T6, STM32L1xxR8H6, STM32L1xxC8T6,
STM32L1xxC8H6, STM32L1xxVBT6, STM32L1xxVBH6, STM32L1xxRBT6,
STM32L1xxRBH6, STM32L1xxCBT6, and STM32L1xxCBH6 ultra-low power devices
STM32L1xxx6(8/B)A indicates STM32L1xxV6T6-A, STM32L1xxV6H6-A,
STM32L1xxR6T6-A, STM32L1xxR6H6-A, STM32L1xxC6T6-A, STM32L1xxC6H6-A,
STM32L1xxV8T6-A, STM32L1xxV8H6-A, STM32L1xxR8T6-A, STM32L1xxR8H6-A,
STM32L1xxC8T6-A, STM32L1xxC8H6-A, STM32L1xxVBT6-A, STM32L1xxVBH6-A,
STM32L1xxRBT6-A, STM32L1xxRBH6-A, STM32L1xxCBT6-A, and
STM32L1xxCBH6-A ultra-low power devices

AN2606 Rev 65 29/508

507
Glossary AN2606

STM32L1xxxC indicates STM32L1xxVCT6, STM32L1xxVCH6, STM32L1xxRCT6,

STM32L1xxUCY6, STM32L1xxCCT6, and STM32L1xxCCU6 ultra-low power devices
STM32L1xxxD indicates STM32L1xxZDT6, STM32L1xxQDH6, STM32L1xxVDT6,
STM32L1xxRDY6, STM32L1xxRDT6, STM32L1xxZCT6, STM32L1xxQCH6,
STM32L1xxRCY6, STM32L1xxVCT6-A, and STM32L1xxRCT6-A ultra-low power
devices
STM32L1xxxE indicates STM32L1xxZET6, STM32L1xxQEH6, STM32L1xxVET6,
STM32L1xxVEY6, and STM32L1xxRET6 ultra-low power devices
L4 series:
STM32L412xx/422xx indicates STM32L412xB, STM32L412x8, and STM32L422xB
devices
STM32L43xxx/44xxx indicates STM32L431xx, STM32L432xx, STM32L433xx and
STM32L442xx, and STM32L443xx devices
STM32L45xxx/46xxx indicates STM32L451xx, STM32L452xx, and STM32L462xx
devices
STM32L47xxx/48xxx indicates STM32L471xx, STM32L475xx, STM32L476xx, and
STM32L486xx devices
STM32L496xx/4A6xx indicates STM32L496xE, STM32L496xG, and STM32L4A6xG
devices
STM32L4Rxxx/4Sxxx indicates STM32L4R5xx, STM32L4R7xx, STM32L4R9xx,
STM32L4S5xx, STM32L4S7xx, and STM32L4S9xx devices
STM32L4P5xx/4Q5xx indicates STM32L4P5xx/STM32L4Q5xx devices
L5 series:
STM32L552xx/62xx indicates STM32L552xx and STM32L562xx devices
U0 series:
STM32U031xx indicates STM32U031xx devices
STM32U073xx/83xx indicates STM32U073xx and STM32U083xx devices
U3 series:
STM32U375xx/85xx indicates STM32U375xx and STM32U385xx devices
U5 series:
STM32U535xx/45xx indicates STM32U535xx and STM32U545xx devices
STM32U575xx/85xx indicates STM32U575xx and STM32U585xxdevices
STM32U595xx/99xx/A5xx/A9xx indicates STM32U595xx, STM32U599xx,
STM32U5A5xx, and STM32U5A9xx devices
STM32U5F7xx/F9xx/G7xx/G9xx indicates STM32U5F7xx, STM32U5F9xx,
STM32U5G7xx, and STM32U5G9xx devices
WB series:
STM32WB10xx/15xx indicates STM32WB10xx and STM32WB15xx devices
STM32WB30xx/35xx/50xx/55xx indicates STM32WB30xx, STM32WB35xx,
STM32WB50xx, and STM32WB55xx devices
WBA series:
STM32WBA52xx indicates STM32WBA52xx devices
STM32WBA54xx/55xx indicates STM32WBA54xx and STM32WBA55xx devices

30/508 AN2606 Rev 65

AN2606 Glossary

STM32WBA62xx/63xx/64xx/65xx indicates STM32WBA54xx, STM32WBA55xx,

STM32WBA64xx, and STM32WBA65xx devices
WB0 series:
STM32WB0xx indicates STM32WB05xx, STM32WB06xx, STM32WB07xx, and
STM32WB09xx devices
WL series:
STM32WLE5xx/55xx indicates STM32WLE5xx and STM32WL55xx devices

Note: BL_USART_Loop refers to the USART bootloader execution loop.

BL_CAN_Loop refers to the CAN bootloader execution loop.
BL_FDCAN_Loop refers to the FDCAN execution loop.
BL_I2C_Loop refers to the I2C bootloader execution loop.
BL_I3C_Loop refers to the I3C bootloader execution loop.
BL_SPI_Loop refers to the SPI bootloader execution loop.

AN2606 Rev 65 31/508

507
General bootloader description AN2606

4 General bootloader description

4.1 Bootloader activation

The bootloader is activated by applying one of the patterns described in Table 2.
If boot from Bank2 option is activated (for products supporting this feature), the bootloader
executes Dual Boot mechanism as described in figures “Dual bank boot implementation for
STM32xxxx” (example: Figure 48), otherwise bootloader selection protocol is executed as
described in figures “Bootloader VY.x selection for STM32xxxx” (example: Figure 29), where
STM32xxxx is the relative STM32 product.
When readout protection Level2 is activated, the MCU does not boot on system memory,
and bootloader cannot be executed (unless jumping to it from flash user code, all
commands are not accessible except Get, GetID, and GetVersion).

Table 2. Bootloader activation patterns

Pattern Condition

Pattern 1 Boot0(pin) = 1 and Boot1(pin) = 0

Pattern 2 Boot0(pin) = 1 and nBoot1(bit) = 1
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 1
Pattern 3 Boot0(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 1
Pattern 4 Boot0(pin) = 0, BFB2(bit) = 0 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 0
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2(bit) = 0
Pattern 5 Boot0(pin) = 0, BFB2(bit) = 1 and both banks do not contain valid code
Boot0(pin) = 1, Boot1(pin) = 0 and BFB2 (bit) = 1
Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1
nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Pattern 6
Boot0(pin) = 0, nBoot0_SW(bit) = 1 and main flash memory empty
nBoot0(bit) = 1, nBoot0_SW(bit)=0 and main flash memory empty
Boot0(pin) = 1, nBoot1(bit) = 1 and BFB2(bit) = 0
Pattern 7 Boot0(pin) = 0, BFB2(bit) = 1 and both banks do not contain valid code
Boot0(pin) = 1, nBoot1(bit) = 1 and BFB2(bit) = 1
Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x0040
Pattern 8
Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x0040

32/508 AN2606 Rev 65

AN2606 General bootloader description

Table 2. Bootloader activation patterns (continued)

Pattern Condition

nDBANK(bit) = 1, Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x0040

nDBANK(bit) = 1, Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x0040
nDBANK(bit) = 0, nDBOOT(bit) = 1, Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x0040

Pattern 9 nDBANK(bit) = 0, nDBOOT(bit) = 1, Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x0040

nDBANK(bit) = 0, nDBOOT(bit) = 0, BOOT_ADDx(optionbyte) out of memory range or in ICP memory
range
nDBANK(bit) = 0, nDBOOT(bit) = 0, BOOT_ADDx(optionbyte) in flash memory range and both banks
do not contain valid code
Boot(pin) = 0 and BOOT_ADD0(optionbyte) = 0x1FF0
Pattern 10
Boot(pin) = 1 and BOOT_ADD1(optionbyte) = 0x1FF0
BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, nBOOT0_SEL(bit) = 1 and nBoot0(bit) = 0
BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, Boot0(pin) = 1 and nBOOT0_SEL(bit) = 1
Pattern 11
BOOT_LOCK(bit) = 0, nBOOT0_SEL(bit) = 1, nBoot0(bit) = 1 and main flash empty
BOOT_LOCK(bit) = 0, Boot0(pin) = 0, nBOOT0_SEL(bit) = 0 and main flash empty
TZEN = 1 = 0, Boot0(pin) = 0, nSWBoot0(bit) = 1 and NSBOOTADD0 [24:0] = Address(1)
TZEN = 1 = 0, Boot0(pin) = 1, nSWBoot0(bit) = 1 and NSBOOTADD1 [24:0] = Address(1)
TZEN = 1 = 0, nBoot0(bit) = 0, nSWBoot0(bit) = 0 and NSBOOTADD1 [24:0] = Address(1)
TZEN = 0, nBoot0(bit) = 1, nSWBoot0(bit) = 0 and NSBOOTADD0 [24:0] = Address(1)
TZEN = 1, Boot0(pin) = 0, nSWBoot0(bit) = 1 and SECBOOTADD0 [24:0] = Address(1) and
RSSCMD = 0
Pattern 12 TZEN = 1, Boot0(pin) = 1, nSWBoot0(bit) = 1 and RSSCMD = 0, BOOT_LOCK = 0 or
(BOOT_LOCK = 1 and SECBOOTADD0 [24:0] = Address(1))
TZEN = 1, nBoot0(bit) = 1, nSWBoot0(bit) = 0 and SECBOOTADD0 [24:0] = Address(1) and
RSSCMD = 0, BOOT_LOCK = 0 or (BOOT_LOCK = 1 and SECBOOTADD0 [24:0] = Address(1))
TZEN = 1, nBoot0(bit) = 0, nSWBoot0(bit) = 0 and RSSCMD = 0, BOOT_LOCK = 0 or
BOOT_LOCK = 1 and SECBOOTADD1 [24:0] = Address(1)
TZEN = 1, RSSCMD = 0x1C0, BOOT_LOCK=0 or (BOOT_LOCK = 1 and
SECBOOTADD0 [24:0] = Address(1))
nBoot0(bit) = 0, nBoot1(bit) = 1 and nSWBoot0(bit) = 0
nBoot0(bit) = 1, nBoot1(bit) = 1, nSWBoot0(bit) = 0 and user flash empty
Pattern 13
nBoot1(bit) = 1, nSWBoot0(bit) = 1 and Boot0(pin) = 1
nBoot1(bit) = 1, nSWBoot0(bit) = 1, Boot0(pin) = 0 and user flash empty
BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, Boot0(pin) = 1 and nSWBoot0(bit) = 1
BOOT_LOCK(bit) = 0, nBoot1(bit) = 1, nBoot0(bit) = 0 and nSWBoot0(bit) = 0

Pattern 14 BOOT_LOCK(bit) = 0, Boot0(pin) = 0, nSWBoot0(bit) = 1, BFB2(bit) = 1 and both banks do not

contain valid code
BOOT_LOCK(bit) = 0, nBoot0(bit) = 1, nSWBoot0(bit) = 0, BFB2(bit) = 1 and both banks do not
contain valid code

AN2606 Rev 65 33/508

507
General bootloader description AN2606

Table 2. Bootloader activation patterns (continued)

Pattern Condition

BOOT_LOCK(bit)=0, Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1

Pattern 15
BOOT_LOCK(bit)=0, nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Boot0(pin) = 1, nBoot1(bit) = 1 and nBoot0_SW(bit) = 1
Pattern 16 nBoot0(bit) = 0, nBoot1(bit) = 1 and nBoot0_SW(bit) = 0
Boot0(pin) = 0, nBoot0_SW(bit) = 1 and main flash memory empty
PRODUCT_STATE = Open and Boot0(pin) = 1
Pattern 17
PRODUCT_STATE = Provisioning
Pattern 18 Force PA10 high during HW reset
1. Device dependent: 0x17F200 for STM32L5, STM32U5, and STM32WBA6, 0x17F1E00 for STM32U3, 0x17F1000 for
STM32WBA5.

Note: nBoot0_SW means either nSWBoot0 or nBOOT0_SEL, depending upon the product.
Note: BOOT_LOCK implementation is product dependent. See the reference manual for more
details.
In addition to the patterns described above, the user can execute bootloader by performing
a jump to system memory from user code. Before jumping to bootloader:
• Disable all peripheral clocks
• Disable used PLL
• Disable interrupts
• Clear pending interrupts
System memory boot mode can be exited by getting out from bootloader activation
condition and generating hardware reset or using Go command to execute user code.
Note: When executing the Go command, the peripheral registers used by the bootloader are not
initialized to their default reset values before jumping to the user application. They must be
reconfigured in the user application if they are used. So, if the application uses the IWDG,
the IWDG prescaler value must be adapted to meet requirements (since the prescaler was
set to its maximum value). For some products, not all reset values are set. For more
information, refer to the known limitations detailed for each product bootloader version.
Note: On devices with dual bank boot, to jump to system memory from user code the user must
first remap the system memory bootloader at address 0x00000000 using SYSCFG register
(except for STM32F7 series), then jump to bootloader. For the STM32F7 series, the user
must disable nDBOOT and/or nDBANK features (in option bytes), then jump to bootloader.
For STM32L0 series, the jump to system memory from user code is not possible.
Note: For STM32 devices embedding bootloader using the DFU/CAN interface in which the
external clock source (HSE) is required for DFU/CAN operations, the detection of the HSE
value is done dynamically by the bootloader firmware and is based on the internal oscillator
clock (HSI, MSI). When (because of temperature variations or other conditions) the internal
oscillator precision is altered above the tolerance band (1% around the theoretical value),
the bootloader can calculate a wrong HSE frequency value. In this case, the bootloader
DFU/CAN interfaces can malfunction, or not work at all.

34/508 AN2606 Rev 65

AN2606 General bootloader description

4.2 Bootloader identification

Depending upon the device, the bootloader can support one or more embedded serial
peripherals used to download the code to the internal flash memory. The bootloader
identifier (ID) provides information about the supported serial peripherals.
For a given STM32 device, the bootloader is identified by means of the:
1. Bootloader (protocol) version: version of the serial peripheral (e.g. USART, CAN,
USB) communication protocol used in the bootloader. This version can be retrieved
using the bootloader Get Version command.
2. Bootloader identifier (ID): version of the STM32 device bootloader, coded on one
byte in the 0xXY format, where:
– X specifies the embedded serial peripheral(s) used by the device bootloader:
X = 1: one USART is used
X = 2: two USARTs are used
X = 3: USART, CAN, and DFU are used
X = 4: USART and DFU are used
X = 5: USART and I2C are used
X = 6: I2C is used
X = 7: USART, CAN, DFU, and I2C are used
X = 8: I2C and SPI are used
X = 9: USART, CAN (or FDCAN), DFU, I2C, and SPI are used
X = 10: USART, I2C, and DFU are used
X = 11: USART, I2C, and SPI are used
X = 12: USART and SPI are used
X = 13: USART, DFU, I2C, and SPI are used
X = 14: USART, DFU, I2C, I3C, FDCAN, and SPI are used
X = 15: USART, USB-DFU, I2C, and I3C are used
X = 16: USART, USB-DFU, FDCAN, and SPI are used
X = 17: USART, SPI, and FDCAN are used
X = 18: USART, SPI, FDCAN, and I2C are used
– Y specifies the device bootloader version
For example, if the bootloader ID is 0x10, this is the first version, which uses only
one USART.
The bootloader ID is programmed in the last byte address - 1 of the device system
memory and can be read by using the “Read memory” command or by direct
access to the system memory via JTAG/SWD.
Note: The bootloader ID format is applied to all STM32 products, except the STM32F1xx devices.
The bootloader version for the STM32F1xx applies only to the embedded device bootloader
version and not to its supported protocols.

AN2606 Rev 65 35/508

507
General bootloader description AN2606

Table 3 provides identification information of the bootloaders embedded in STM32 devices.

Table 3. Embedded bootloaders

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1 USART (V3.1)
STM32C011xx 0x51 0x1FFF17FE
I2C1 I2C1(V1.1)
USART1 USART (V3.1)
STM32C031xx 0x52 0x1FFF17FE
I2C1 I2C1(V1.1)
USART1/USART2 USART (V4.0)
STM32C051xx I2C1/I2C2 0xB0 0x1FFF2FFE I2C (V2.0)
SPI1/SPI2 SPI (V2.0)
C0
USART1/USART2 USART (V3.1)
I2C1/I2C2 I2C1(V1.2)
STM32C071xx 0xD1 0x1FFF67FE
SPI1/SPI2 SPI (V1.1)
USB DFU USB (V2.2)
USART1/USART2/USART3 USART (V4.0)
I2C1/I2C2 I2C (V2.0)
STM32C091xx/92xx 0x121 0x1FFF3FFE
SPI1/SPI2 SPI (V2.0)
FDCAN1 FDCAN (V2.2)
STM32F05xxx/STM32F030x8 USART1/USART2 0x21 0x1FFFF7A6 USART (V3.1)
STM32F03xx4/6 USART1 0x10 0x1FFFF7A6 USART (V3.1)
USART1 USART (V3.1)
STM32F030xC 0x52 0x1FFFF796
I2C1 I2C1(V1.0)
USART1/USART2 USART (V3.1)
STM32F04xxx DFU (USB device FS) 0xA1 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
F0 STM32F071xx/072xx DFU (USB device FS) 0xA1 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F070x6 DFU (USB device FS) 0xA2 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F070xB DFU (USB device FS) 0xA3 0x1FFFF6A6 DFU (V2.2)
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F09xxx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
Low-density USART1 NA NA USART (V2.2)
Medium-density USART1 NA NA USART (V2.2)
High-density USART1 NA NA USART (V2.2)
STM32F10xxx
Medium-density
USART1 0x10 0x1FFFF7D6 USART (V2.2)
value line
F1 High-density
USART1 0x10 0x1FFFF7D6 USART (V2.2)
value line
USART
USART1/USART2 (remapped)
(V2.2(1))
STM32F105xx/107xx CAN2 (remapped) NA NA
CAN (V2.0)
DFU (USB device)
DFU(V2.2)
STM32F10xxx XL-density USART1/USART2 (remapped) 0x21 0x1FFFF7D6 USART (V3.0)

36/508 AN2606 Rev 65

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3 0x20 0x1FFF77DE USART (V3.0)
F2 STM32F2xxxx USART1/USART3 USART (V3.1)
CAN2 0x33 0x1FFF77DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32F373xx 0x41 0x1FFFF7A6
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32F378xx 0x50 0x1FFFF7A6
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F302xB(C)/303xB(C) 0x41 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32F358xx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
F3 STM32F301xx/302x4(6/8) 0x40 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32F318xx 0x50 0x1FFFF796
I2C1/ I2C3 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F302xD(E)/303xD(E) 0x40 0x1FFFF796
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32F303x4(6/8)/334xx/328xx 0x50 0x1FFFF796
I2C1 I2C (V1.0)
USART1/USART2 USART (V3.1)
STM32F398xx 0x50 0x1FFFF796
I2C1/I2C3 I2C (V1.0)

AN2606 Rev 65 37/508

507
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3 USART (V3.1)
CAN2 0x31 0x1FFF77DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
STM32F40xxx/41xxx USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
DFU (USB device FS) 0x91 0x1FFF77DE DFU (V2.2)
I2C1/I2C2/I2C3 SPI(V1.1)
SPI1/SPI2 I2C (V1.0)
USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
0x70 0x1FFF76DE
DFU (USB device FS) DFU (V2.2)
I2C1 I2C (V1.0)
STM32F42xxx/43xxx USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
DFU (USB device FS) 0x91 0x1FFF76DE DFU (V2.2)
SPI1/ SPI2/ SPI4 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.0)
USART1/USART2 USART (V3.1)
DFU (USB device FS) DFU (V2.2)
STM32F401xB(C) 0xD1 0x1FFF76DE
SPI1/SPI2/ SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.0)
USART1/USART2 USART (V3.1)
DFU (USB device FS) DFU (V2.2)
STM32F401xD(E) 0xD1 0x1FFF76DE
SPI1/SPI2/SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.1)
USART1/USART2 USART (V3.1)
F4
STM32F410xx I2C1/I2C2/I2C4 0xB1 0x1FFF76DE I2C (V1.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2 USART (V3.1)
DFU (USB device FS) DFU (V2.2)
STM32F411xx 0xD0 0x1FFF76DE
SPI1/SPI2/ SPI3 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.1)
USART1/USART2 USART (V3.1)
USART3/CAN2 CAN (V2.0)
STM32F412xx DFU (USB device FS) 0x91 0x1FFF76DE DFU (V2.2)
SPI1/SPI3/SPI4 SPI (V1.1)
I2C1/I2C2/I2C3/I2C4 I2C (V1.2)
USART1/USART2 USART (V3.1)
USART3/CAN2 CAN (V2.0)
STM32F413xx/423xx DFU (USB device FS) 0x90 0x1FFF76DE DFU (V2.2)
I2C1/I2C2/I2C3/I2C4 I2C (V1.2)
SPI1/SPI3/SPI4 SPI (V1.1)
USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
STM32F446xx DFU (USB device FS) 0x90 0x1FFF76DE DFU (V2.2)
SPI1/ SPI2/SPI4 SPI(V1.1)
I2C1/I2C2/I2C3 I2C (V1.2)
USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32F469xx/479xx CAN2 0x90 0x1FFF76DE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2/ SPI4 SPI (V1.1)

38/508 AN2606 Rev 65

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3 USART (V3.1)
CAN1 CAN (V2.0)
STM32F72xxx/73xxx DFU (USB device FS) 0x90 0x1FF0EDBE DFU (V2.2)
I2C1/I2C2/I2C3 I2C (V1.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
0x70 0x1FF0EDBE
CAN2 CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
F7 STM32F74xxx/75xxx USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
CAN2 0x90 0x1FF0EDBE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART3 USART (V3.1)
CAN2 CAN (V2.0)
STM32F76xxx/77xxx DFU (USB device FS) 0x93 0x1FF0EDBE DFU (V2.2)
I2C1/I2C2/I2C3 I2C (V1.2)
SPI1/SPI2/SPI4 SPI (V1.2)
USART1/USART2/USART3 USART (V3.1)
STM32G07xxx/08xxx I2C1/I2C2 0xB3 0x1FFF6FFE I2C (V1.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2 USART (V3.1)
STM32G03xxx/04xxx 0x53 0x1FFF1FFE
I2C1\I2C2 I2C (V1.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2 I2C (V1.2)
STM32G0B0xx 0xD0 0x1FFF9FFE
SPI1/SPI2 SPI (V1.1)
G0
DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2 I2C (V1.2)
STM32G0B1xx/0C1xx SPI1/SPI2 0x92 0x1FFF9FFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN FDCAN (V1.0)
USART1/USART2 USART (V3.1)
STM32G05xxx/061xx 0x51 0x1FFF1FFE
I2C1/I2C2 I2C (V1.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3 I2C (V1.2)
STM32G431xx/441xx 0xD4 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3/I2C4 I2C (V1.2)
G4 STM32G47xxx/48xxx 0xD5 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C2/I2C3 I2C (V1.2)
STM32G491xx/4A1xx 0xD2 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)

AN2606 Rev 65 39/508

507
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2/USART3 USART (V4.0)
I2C2 I2C (V2.0)
I3C1 I3C (V1.0)
STM32H503xx 0xE2 0x0BF8FFFE
SPI1/SPI2/SPI3 SPI (V2.0)
USB DFU USB (V3.0)
FDCAN1 FDCAN (V2.0)
USART1/USART2/USART3 USART (V4.0)
I2C3/I2C4 I2C (V2.0)
I3C1 I3C (V1.0)
H5 STM32H562xx/63xx/73xx 0xE4 0x0BF9FAFE
SPI1/SPI2/SPI3 SPI (V2.0)
USB DFU USB (V3.0)
FDCAN2 FDCAN (V2.0)
USART1/USART2/USART3 USART (V4.0)
I2C1/I2C3 I2C (V2.0)
I3C1 I3C (V1.0)
STM32H523xx/33xx 0xE2 0x0BF8FFFE
SPI1/SPI2/SPI3 SPI (V2.0)
USB DFU USB (V3.0)
FDCAN2 FDCAN (V2.0)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32H72xxx/73xxx DFU (USB device FS) 0x93 0x1FF1E7FE DFU (V2.2)
SPI1/SPI2/SPI3/SPI4 SPI (V1.1)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.1)
STM32H74xxx/75xxx DFU (USB device FS) 0x91 0x1FF1E7FE DFU (V2.2)
SPI1/SPI2/SPI3/SPI4 SPI (V1.1)
FDCAN1 FDCAN (V1.1)

H7 USART1/USART2/USART3 USART (V3.1)

I2C1/I2C2/I2C3 I2C (V1.2)
STM32H7A3xx/7B3xx/7B0xx DFU (USB device FS) 0x92 0x1FF13FFE DFU (V2.2)
SPI1/SPI2/SPI3 SPI (V1.2)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V4.0)
UART4
I2C1/I2C2/I2C3 I2C (V2.0)
STM32H7Rxxx/7Sxxx DFU (USB device FS) 0xE3 0x1FF1FCFE DFU (V2.2)
SPI1/SPI2/SPI3 SPI (V2.0)
FDCAN2 FDCAN (V2.1)
I3C1 I3C (V1.0)

40/508 AN2606 Rev 65

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART2 USART (V3.1)
STM32L01xxx/02xxx 0xC3 0x1FF00FFE
SPI1 SPI (V1.1)
USART2 USART (V3.1)
STM32L031xx/041xx 0xC0 0x1FF00FFE
SPI1 SPI (V1.1)
USART1/USART2 USART (V3.1)
STM32L05xxx/06xxx 0xC0 0x1FF00FFE
L0 SPI1/ SPI2 SPI (V1.1)
USART1/USART2 USART (V3.1)
0x41 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
STM32L07xxx/08xxx USART1/USART2 USART (V3.1)
SPI1/SPI2 0xB2 0x1FF01FFE SPI (V1.1)
I2C1/I2C2 I2C (V1.2)
STM32L1xxx6(8/B) USART1/USART2 0x20 0x1FF00FFE USART (V3.0)
STM32L1xxx6(8/B)A USART1/USART2 0x20 0x1FF00FFE USART (V3.1)
USART1/USART2 USART (V3.1)
STM32L1xxxC 0x40 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
L1
USART1/USART2 USART (V3.1)
STM32L1xxxD 0x45 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32L1xxxE 0x40 0x1FF01FFE
DFU (USB device FS) DFU (V2.2)

AN2606 Rev 65 41/508

507
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L412xx/422xx 0xD1 0x1FFF6FFE DFU (V2.2)
DFU (USB device FS)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L43xxx/44xxx CAN1 0x91 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L45xxx/46xxx CAN1 0x92 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/ USART3 USART (V3.1)
I2C1/I2C2/I2C3 0xA3 0x1FFF6FFE I2C (V1.2)
DFU (USB device FS) DFU (V2.2)
STM32L47xxx/48xxx USART1/USART2/ USART3 USART (V3.1)
L4 I2C/I2C2/I2C3 I2C (V1.2)
SPI1/SPI2 0x92 0x1FFF6FFE SPI (V1.1)
CAN1 CAN(V2.0)
DFU (USB device FS) DFU(V2.2)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L496xx/4A6xx CAN1 0x93 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L4Rxxx/STM32L4Sxxx CAN1 0x95 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32L4P5xx/Q5xx CAN1 0x90 0x1FFF6FFE CAN (V2.0)
DFU (USB device FS) DFU (V2.2)
SPI1/SPI2 SPI (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
L5 STM32L552xx/562xx SPI1/SPI2/SPI3 0x92 0x0BF97FFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.0)
USART1/USART2/USART3 USART (V3.1)
STM32U031xx I2C1/I2C2/I2C3 0xB0 0x1FFF37FE I2C (V1.2)
SPI1/SPI2 SPI (V1.1)
U0 USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U073xx/83xx 0xD0 0x1FFF67FE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)

42/508 AN2606 Rev 65

AN2606 General bootloader description

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART3 USART(V4.0)
I2C1/I2C2/I2C3 I2C (V2.0)
I3C1 I3C(V1.0)
U3 STM32U375xx/385xx 0xE2 0x0BF98FFE
SPI1/SPI2/SPI3 SPI (V2.0)
DFU (USB device FS) DFU (V3.0)
FDCAN1 FDCAN (V2.2)
USART1/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U535xx/545xx SPI1/SPI2/SPI3 0x91 0x0BF99EFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U575xx/STM32U585xx SPI1/SPI2/SPI3 0x92 0x0BF99EFE SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
U5
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U595xx/599xx/
SPI1/SPI2/SPI3 0x92 0x0BF99EFE SPI (V1.1)
STM32U5A5xx/5A9xx
DFU (USB device HS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
USART1/USART2/USART3 USART (V3.1)
I2C1/I2C2/I2C3 I2C (V1.2)
STM32U5F7xx/5F9xx/
SPI1/SPI2/SPI3 0x90 0x0BF99EFE SPI (V1.1)
STM32U5G7xx/5G9xx
DFU (USB device HS) DFU (V2.2)
FDCAN1 FDCAN (V1.1)
USART1 USART (V3.1)
STM32WB10xx/15xx I2C1 0xB1 0x1FFF6FFE I2C (V1.2)
SPI1 SPI (V1.1)
WB USART1 USART (V3.2)
I2C1/I2C3 I2C (V1.2)
STM32WB30xx/35xx/50xx/55xx 0xD5 0x1FFF6FFE
SPI1/SPI2 SPI (V1.1)
DFU (USB device FS) DFU (V2.2)
USART1/USART2 USART (V3.1)
STM32WBA52xx I2C1/I2C3 0xB0 0x0BF8FEFE I2C (V1.2)
SPI3 SPI (V1.1)
USART1/USART2 USART (V3.1)
STM32WBA54xx/55xx I2C1/I2C3 0xB1 0x0BF8FEFE I2C (V1.2)
WBA
SPI3 SPI (V1.1)
USART1/USART2 USART (V4.0)
I2C1/I2C3 I2C (V2.0)
STM32WBA62xx/63xx/64xx/65xx 0xD2 0x0BF97EFE
SPI2/SPI3 SPI (V2.0)
DFU (USB device FS) DFU (V3.0)
STM32WB05xx USART (V2.0)
WB0 STM32WB06xx/7xx USART1 NA NA USART (V4.0)
STM32WB09xx USART (V1.0)

AN2606 Rev 65 43/508

507
General bootloader description AN2606

Table 3. Embedded bootloaders (continued)

Bootloader ID Bootloader
Series

Device Supported serial peripherals Memory (protocol)

ID version
location
USART1/USART2 USART (V3.1)
WL STM32WLE5xx/55xx 0xC4 0x1FFF3EFE
SPI1/SPI2 SPI (V1.1)
1. For connectivity line devices, the USART bootloader returns V2.0 instead of V2.2 for the protocol version. For more details
refer to the “STM32F105xx and STM32F107xx revision Z” errata sheet available from www.st.com.

44/508 AN2606 Rev 65

AN2606 General bootloader description

4.3 Hardware connection requirements

To use the USART bootloader, the host must be connected to the RX and TX pins of the
desired USARTx interface via a serial cable.

Figure 1. USART connection

+V 1

R
RX 2 TX
RS232
Transceiver
STM32
UART Host TX RX Microcontroller
GND GND

MSv35098V1

1. A pull-up resistor must be added, if they are not connected on host side.
2. An RS232 transceiver must be connected to adapt the voltage level (3.3 to 12 V) between the STM32
device and the host.
Note: Typically V is 3.3 V, and R is 100 KΩ. These values depend upon the application and the
used hardware.

To use the DFU, connect the microcontroller USB interface to a USB host (such as a PC).

Figure 2. USB connection

1
+V
10K
36K

1.5K

VBus
DP DP
STM32
USB Host
DM DM Microcontroller
GND GND

MS35037V1

1. This additional circuit permits to connect a pull-up resistor to DP pin using VBus when needed. Refer to
product section (table describing STM32 configuration in system memory boot mode) to know if an external
pull-up resistor must be connected to DP pin.
Note: V typically is 3.3 V. This value depends upon the application and the used hardware.

AN2606 Rev 65 45/508

507
General bootloader description AN2606

To use the I2C bootloader, connect the host (controller) and the desired I2Cx interface
(target) together via the data (SDA) and clock (SCL) pins. A 1.8 KΩ pull-up resistor must be
connected to both SDA and SCL lines.

Figure 3. I2C connection

+V

1.8K

1.8K
SCL SCL
STM32
I2C Host
SDA SDA Microcontroller
GND GND

MS35038V1

Note: V is typically 3.3 V. This value depends upon the application and the used hardware.

To use the SPI bootloader, connect the host (master) and the desired SPIx interface (slave)
together via the MOSI, MISO, SCK and NSS pins. The NSS pin can be connected to GND.
A pull-down resistor must be connected to the SCK line.

Figure 4. SPI connection

NSS NSS
MOSI MOSI
MISO MISO
SPI host STM32
SCK SCK

GND GND

MS35039V2

Note: The resistor is typically 10 KΩ, its value depends upon the application and the used
hardware.

To use the CAN interface, the host must be connected to the RX and TX pins of the desired
CANx interface via CAN transceiver and a serial cable. A 120 Ω resistor must be added as
terminating resistor.

46/508 AN2606 Rev 65

AN2606 General bootloader description

Figure 5. CAN connection

RX CAN_H TX
CAN CAN STM32
CAN Host

120

120
Transceiv Transceiv
TX er er RX Microcontroller
CAN_L
GND GND

MS35040V1

Note: When a bootloader firmware supports DFU, it is mandatory that no USB host is connected
to the USB peripheral during the selection phase of the other interfaces. After selection
phase, the user can plug a USB cable without impacting the selected bootloader execution,
except for commands generating a system reset.
It is recommended to keep the RX pins of unused bootloader interfaces (USART_RX,
SPI_MOSI, and CAN_RX, if present) at a known (low or high) level and keep the USB D+/D-
lines, if present, on the same level (low/high) at the startup of the bootloader (detection
phase). Leaving these pins floating during the detection phase can result in activation of
unused interfaces.

4.4 Bootloader memory management

All write operations using bootloader commands must be word-aligned (the address must
be a multiple of 4). The number of data to write must be a multiple of 4 as well (non-aligned
half page write addresses are accepted).
Some products embed a bootloader with specific features:
• On products that do not support mass erase operation, to perform this operation using
the bootloader, two options are available:
– Erase all sectors one by one using the Erase command
– Set protection level to Level 1. Then, set it to Level 0 (using the Read protect and
then the Read unprotect command). This operation results in a mass erase of the
internal flash memory.
• Bootloader firmware of STM32 L1 and L0 series supports Data memory in addition to
standard memories (internal flash, internal SRAM, option bytes and System memory).
The start address and the size of this area depends on product, refer to the reference
manual for more information. Data memory can be read and written but cannot be
erased using the Erase command. When writing in a Data memory location, the
bootloader firmware manages the erase operation of this location before any write. A
write to Data memory must be word-aligned (address to be written must be a multiple
of 4) and the number of data must also be a multiple of 4. To erase a Data memory
location, write 0s at this location.
• Bootloader firmware of the F2, F4, F7, and L4 series supports OTP memory in addition
to standard memories (internal flash, internal SRAM, option bytes and System
memory). The start address and the size of this area depends on product, refer to the
reference manual for more information. OTP memory can be read and written but

AN2606 Rev 65 47/508

507
General bootloader description AN2606

cannot be erased using Erase command. When writing in an OTP memory location,
make sure that the relative protection bit is not reset.
• For STM32 F2, F4, and F7 series the internal flash memory write operation format
depends on voltage range. By default write operations are allowed by one byte format
(half-word, word, and double-word operations are not allowed). To increase the speed
of write operation, the user must apply the adequate voltage range that allows write
operation by half-word, word or double-word and update this configuration on the fly by
the bootloader software through a virtual memory location. This memory location is not
physical but can be read and written using usual bootloader read/write operations
according to the protocol in use. This memory location contains four bytes, described in
Table 4. It can be accessed by 1, 2, 3, or 4 bytes. However, reserved bytes must
remain at their default values (0xFF), otherwise the request is NACK-ed.

Table 4. STM32 F2, F4, and F7 voltage range configuration using bootloader
Address Size Description

This byte controls the current value of the voltage range.

– 0x00: voltage range [1.8 V, 2.1 V]
– 0x01: voltage range [2.1 V, 2.4 V]
– 0x02: voltage range [2.4 V, 2.7 V]
0xFFFF0000 1 byte – 0x03: voltage range [2.7 V, 3.6 V]
– 0x04: voltage range [2.7 V, 3.6 V] and double word write/erase
operation is used. In this case it is mandatory to supply 9 V
through the VPP pin (refer to the product reference manual for
more details about the double-word write procedure).
– Others: all other values are not supported and are NACK-ed.
0xFFFF0001 1 byte
Reserved. 0xFF is the default value, all other values are not
0xFFFF0002 1 byte
supported and are NACK-ed.
0xFFFF0003 1 byte

Table 5 lists the valid memory areas, depending upon the bootloader commands.

Table 5. Supported memory area by Write, Read, Erase, and Go commands

Memory area Write command Read command Erase command Go command

Flash Supported Supported Supported Supported

RAM Supported Supported Not supported Supported
System memory Not supported Supported Not supported Not supported
Data memory Supported Supported Not supported Not supported
OTP memory Supported Supported Not supported Not supported

4.5 Bootloader UART baudrate detection

For the UART interface baudrate detection, there are two implemented mechanisms:
• Software baudrate detection using internal HSI and timer (use GPIO as input, detect
falling edge and rising edge as explained in AN3155).

48/508 AN2606 Rev 65

AN2606 General bootloader description

The devices using this mechanism are subject to software jitter (variable error of
baudrate calculation) that can reach up to ±5%. In this case, the host connecting to the
STM32 bootloader UART interface must support a ±5% deviation in baudrate.
The software jitter value is variable and different at each retry, so it is possible to use
multiple retry connections to overcome it. Connect and check for correct bootloader
answer, if the answer is not correct, reset the device and retry connection until the
correct answer is received. At this point, the rest of the communication is not impacted.
It is also possible to reduce the software jitter by reducing baudrate value (as an
example, use 56000 instead of 115200 bps).
Table 6 provides the maximum software jitter value for the 115200 bps baudrate. The
lower the baudrate, the lower the software jitter.
• Baudrate detection using UART auto-baudrate feature. Devices using this mechanism
do not present any software jitter.

Table 6. Jitter software calculation on bootloader USART detection

Series or product Detection method Maximum software jitter

STM32C011xx
STM32C031xx Auto-baudrate Not applicable
STM32C051xx USART1
STM32C051xx USART2 Software baudrate detection -2%
STM32C071xx USART1 Auto-baudrate Not applicable
STM32C071xx USART2 Software baudrate detection -2%
STM32C091xx/92xx USART1 Auto-baudrate Not applicable
STM32C091xx/92xx USART2/3 Software baudrate detection -2%
STM32F0 -1%
STM32F1 -3%
STM32F2 -5%
Software baudrate detection
STM32F3 -2%
STM32F4 -6%
STM32F7 -6%
STM32G05xxx/061xx USART1 Auto-baudrate Not applicable
STM32G05xxx/061xx USART2 -2%
STM32G07/8x USART3 Software baudrate detection
-4%
STM32G03/4x USART2
STM32G07/8x USART1/USART2
STM32G03/4x USART1
STM32G0B/Cxxx
Auto-baudrate Not applicable
STM32G4
STM32H5
STM32H7

AN2606 Rev 65 49/508

507
General bootloader description AN2606

Table 6. Jitter software calculation on bootloader USART detection (continued)

Series or product Detection method Maximum software jitter

STM32L0 -2%
STM32L1 Software baudrate detection -3%
STM32L4 -5%
STM32L5
STM32U031xx USART1/2 Auto-baudrate Not applicable
STM32U073/83xx USART1/2
STM32U073/83xx USART3 Software baudrate detection -2%
STM32U3
STM32U5
STM32WB
Auto-baudrate Not applicable
STM32WBA
STM32WB0
STM32WL

4.6 Programming constraints

When using the bootloader interface to write in the flash memory, respect the alignment on
the programmed address detailed in Table 7. If the address is not aligned, the operation
fails, and all following program operations fail as well.

Table 7. Flash memory alignment constraints

Series Alignment

STM32C0 8 bytes
STM32F0 4 bytes
STM32F1 4 bytes
STM32F2 4 bytes
STM32F3 4 bytes
STM32F4 4 bytes
STM32F7 8 bytes
STM32G0 4 bytes
STM32G4 8 bytes
STM32H5 16 bytes
16 bytes (H7Rxx/H7Sxx devices)
STM32H7
8 bytes (all other devices)
STM32L0 8 bytes
STM32L1 8 bytes

50/508 AN2606 Rev 65

AN2606 General bootloader description

Table 7. Flash memory alignment constraints (continued)

Series Alignment

STM32L4 8 bytes
STM32L5 16 bytes
STM32U0 8 bytes
STM32U3 8 bytes
STM32U5 16 bytes
STM32WB 8 bytes
STM32WBA 16 bytes
STM32WB0 4 bytes
STM32WL 8 bytes

Examples of alignment:
• 4 bytes: 0x0800 0014 is aligned and passes, 0x0800 0012 is not aligned and fails
• 8 bytes: 0x0800 0010 is aligned and passes, 0x0800 0014 is not aligned and fails
Note: On STM32F4 and STM32F7 it is possible to change the alignment constraint by writing in
the device feature space.

4.7 ExitSecureMemory feature

The securable memory area is used to isolate secure boot code/data, which handles
sensitive information (secrets), from application code. The secure boot code access is
controlled by HW (FLASH registers and option bytes, depending on the product). The code
is executed once at boot, then locked by HW until the next reset.
The ExitSecureMemory is a software hosted on the system memory. When the user boot
code jumps to it, it is possible to enable the hide protection area, and then jump to the
application code. The size of the Hide Protection Area (HDP) must be set by the user to the
needed value before jumping to the ExitSecureMemory function.

4.7.1 ExitSecureMemory v1.0

As shown in Figure 6, two methods can be used.
1. Jump to the secure memory function without parameters: the application must be
loaded just after the defined secure memory area (HDP and size).
2. Jump to the secure memory function using two parameters:
a) Magic number: 0x08192A3C is used to secure boot code/data in flash/Bank1 and
jump in case of a single/dual bank product, 0x08192A3D is used to secure boot
code/data and jump to application in Bank2 in case of a dual bank product
b) User address = Application address: the application can be loaded to any desired
address

AN2606 Rev 65 51/508

507
General bootloader description AN2606

Figure 6. ExitSecureMemory function usage

System memory User flash memory

Boot code/data Boot code/data

1 SEC/HDP_SIZE
Bootloader (to protect) (hidden)

Application Application
ExitSecureMemory
3
2

Jump to the secure memory area without parameters

System memory User Flash memory

1 Boot code/data Boot code/data

SEC/HDP_SIZE
Bootloader (to protect) (hidden)

ExitSecureMemory 3
2
Application Application

MS53655V2
Jump to the secure memory area with parameters (magic number and application address)

For more information regarding the option bytes configuration, see the reference manual.
For examples of functions that can be used to call ExitSecureMemory, see Appendix A.
For more details refer to Figure 7.

52/508 AN2606 Rev 65

AN2606 General bootloader description

Figure 7. Access to securable memory area from the bootloader

Jump to secure
memory address

No R1 = Magic number and

R2 = User address ?

Yes
Flash dual bank

Check link register to know from Single bank Dual bank

Jump to user address
which bank comes the jump

Valid magic Bank1 Valid magic Bank2

Set bank’s securable
number ? number ?
memory bit

Yes
Set securable Set securable
memory bit (Bank1) memory bit (Bank1)
Jump just after securable Set securable
memory area memory bit

Jump to user Jump to user

MS51971V2
address address
Jump to user
address

1. The bootloader does not check the integrity of the user address, it is up to the user to ensure the validity of the address to
jump to.

4.7.2 ExitSecureMemory v1.1

Compared to the ExitSecureMemory v1.0, the user can define an MPU region. This is done
using the CPU R3 register, before jumping to the software, that runs as shown in Figure 8.

Figure 8. Defining an MPU region

Jump to secure
memory address

Activate the MPU region Activate the MPU region

Yes No
using the provided R3 = 0xFF? using the provided
region number region number

Execute
MS56536V1

ExitSecureMemory
v1.0
MS56536V1

AN2606 Rev 65 53/508

507
General bootloader description AN2606

Table 8. ExitSecureMemory entry address

MCU ExitSecureMemory address Version address Version

STM32G07xxx/08xxx 0x1FFF6800
STM32G03xxx/04xxx 0x1FFF1E00
STM32G0
STM32G0Bxxx/0Cxxx 0x1FFF6800
STM32G05xxx/061xx 0x1FFF6800
STM32G47xxx/48xxx 0x1FFF6800 Not available V1.0
STM32G4 STM32G431xx/441xx 0x1FFF6800
STM32G491xx/4A1xx 0x1FFF6800
STM32C011xx 0x1FFF1600
STM32C031xx 0x1FFF1600
STM32C0 STM32C051xx 0x1FFF2E00 0x1FFF2F8C
STM32C071xx 0x1FFF1600 0x1FFF618C V1.1 (0x11)
STM32C091xx/92xx 0x1FFF3E00 0x1FFF3F8C
STM32U031xx 0x1FFF3500 0x1FFF368C
STM32U0 V1.1 (0x11)
STM32U073xx/83xx 0x1FFF6000 0x1FFF618C

4.8 IWDG usage

The bootloader does not enable IWDG, it only tries to update the prescaler value if the
IWDG was enabled by HW (through option bytes) or by SW in case of an application that
jumps to bootloader.
If the IWDG was not enabled before the boot on bootloader (using HW boot or by a jump
from an application), the watchdog prescaler value update bit (PVU) is set to 1 when the
bootloader tries to change the prescaler value.
This value does not change, it remains at 0x1 as the prescaler update never happens
(IWDG is not enabled), even after the jump. When using the bootloader to jump to the
application, and when there is the need to enable the IWDG, consider that the PVU bit in the
IWDG_SR register is set to 1.

4.9 Bootloader models

To address the evolution of STM32 devices on security, the bootloader (BL) is now available
on different models.
1. Legacy model - BL_V1 (see left side of Figure 9):
The system memory is non secure and allocated to the bootloader. In some projects a
SW (functionally independent from the bootloader) called ExitSecureMemory is
implemented on the same zone as the BL.
2. New BL model - BL_V2 (see right side of Figure 9)
The system memory is split between secure and nonsecure areas. The secure area
contains the System Flash Secure Package (SFSP), the nonsecure contains the BL.

54/508 AN2606 Rev 65

AN2606 General bootloader description

Figure 9. BL_V1 (left) and BL_V2 (right) models

BL SFSP Secure
Non secure
ExitSecureMemory BL Non secure

User flash User flash

MS56765V1
BL_V1 BL_V2

AN2606 Rev 65 55/508

507
General bootloader description AN2606

4.10 Boot constraints on BL

Boot depends upon the MCU (see Table 9), and adds new constraints to the BL.
• Legacy products - Boot_V1
When correctly set, the boot is directly on the BL (left side of Figure 10)
• Products with security but no TrustZone isolation - Boot_V2 (right side of Figure 10)
When correctly set and boot on the BL is possible, the boot starts on the SFSP, then it
jumps to the bootloader. This adds a constraint to the boot timing.
• Products with security using TrustZone isolation - Boot_V3
On this category there are two possibilities:
a) Boot depending on TrustZone value - Boot_V3_1 (see Figure 11)
When TZEN is enabled, some constraints are added to the BL functionalities:
> Boot timing is different from the TZEN disabled use case
> Before jumping to the BL, the SFSP maps all the needed resources by the BL
to the nonsecure domain. A jump from the BL (“Go” command) to an
application using other resources does not work.
> Some secure option bytes are not be accessible as the bootloader is
nonsecure. Some APIs are added on the SFSP to guarantee that the BL can
modify them on open products states (Open, RDP L0).
> Some parts of the SRAM are used by the SFSP and remain on Secure
domain when jumping to the BL, so are not accessible by the customer
through BL
b) Boot not depending on TrustZone value - Boot_V3_2 (see Figure 12)
Boot goes through SFSP first, then jumps to the BL. In this model, some
constraints are added to the BL functionalities on both TZEN states:
> Boot timing includes SFSP timing.
> Before jumping to the BL, the SFSP map all the needed resources by the BL
to the nonsecure domain. A jump from the BL (“Go” command) to an
application using other resources does not work.
> Some secure option bytes are not be accessible by the Bootloader as it is
nonsecure. Some APIs are added on the SFSP to guarantee that the BL can
modify them on open products states (Open).
> Some parts of the SRAM are used by the SFSP and remain on Secure
domain when jumping to the BL, consequently they are not accessible by the
customer through BL.

Table 9. BL and boot by product series

Series BL model Boot

STM32H7 Boot_V2 (see Figure 10)

STM32L5, STM32U3, STM32U5, STM32WBA BL_V2 Boot_V3_1 (see Figure 11)
STM32H5 Boot_V3_2 (see Figure 12)
Others BL_V1 Boot_V1 (see Figure 10)

56/508 AN2606 Rev 65

AN2606 General bootloader description

Figure 10. Boot_V1 (left) and Boot_V2 (right)

Boot

Jump SFSP

Boot

Bootloader Bootloader

MS56766V1
BL_V1 BL_V2

Figure 11. Boot_V3_1

Boot

Jump SFSP

Boot

Bootloader Bootloader

MS56767V1
TZEN disabled TZEN enabled

Figure 12. Boot_V3_2

Boot

Jump SFSP

Bootloader
MS56771V1

AN2606 Rev 65 57/508

507
STM32C011xx devices AN2606

5 STM32C011xx devices

5.1 Bootloader configuration

The STM32C011xx bootloader is activated by applying Pattern 11 (see Table 2). Table 10
shows the hardware resources used by this bootloader.

Table 10. STM32C011xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz (no PLL)
3.5 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
6 Kbytes, starting from address 0x1FFF0000 contain
Common to all System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset if the hardware IWDG option was previously
enabled by the user.
Securable memory The address to jump to for the securable memory area
- -
area is 0x1FFF1600
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input
USART1 USART1_RX pin Input
pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1100100x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode

Note: On WLCSP12, SO8N, TSSOP20, and UFQFN20 packages USART1 PA9/PA10 IOs are
remapped on PA11/PA12.

58/508 AN2606 Rev 65

AN2606 STM32C011xx devices

5.2 Bootloader selection

Figure 13 shows the bootloader selection mechanism.

Figure 13. Bootloader V5.x selection for STM32C011xx devices

System reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USARTx

Configure I2Cx

0x7F received Yes

on USARTx

No

Disable all interrupt Disable all interrupt

Yes sources and other sources and other
I2Cx address
interfaces clocks interfaces clocks
detected

No
Execute Execute
BL_I2C_Loop BL_USART_Loop
for I2Cx for USARTx
MS56841V1

5.3 Bootloader version

Table 11 lists the STM32C011xx devices bootloader versions.

Table 11. STM32C011xx bootloader versions

Version number Description Known limitations

V5.1 Initial bootloader version None

AN2606 Rev 65 59/508

507
STM32C031xx devices AN2606

6 STM32C031xx devices

6.1 Bootloader configuration

The STM32C031xx bootloader is activated by applying Pattern 11 (see Table 2). Table 12
shows the hardware resources used by this bootloader.

Table 12. STM32C031xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz (no PLL)
3.5 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware.
6 Kbytes, starting from address 0x1FFF0000,
Common to all System memory -
contain the bootloader firmware.
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset if the hardware IWDG option was
previously enabled by the user.
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF1600
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
input pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
– Analog filter ON
I2C1 – Target 7-bit address: 0b1100011x (x = 0 for write
and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin
mode.
Input/output
PB7 pin: data line is used in open-drain no pull
I2C1_SDA pin
mode.

Note: On TSSOP20 and UFQFN28 packages USART1 PA9/PA10 IOs are remapped on
PA11/PA12.

60/508 AN2606 Rev 65

AN2606 STM32C031xx devices

6.2 Bootloader selection

Figure 14 shows the bootloader selection mechanism.

Figure 14. Bootloader V5.x selection for STM32C031xx devices

System reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USARTx

Configure I2Cx

0x7F received Yes

on USARTx

No

Disable all interrupt Disable all interrupt

Yes sources and other sources and other
I2Cx address
interfaces clocks interfaces clocks
detected

No
Execute Execute
BL_I2C_Loop BL_USART_Loop
for I2Cx for USARTx
MS56841V1

6.3 Bootloader version

Table 13 lists the STM32C031xx devices bootloader versions.

Table 13. STM32C031xx bootloader versions

Version number Description Known limitations

V5.2 Initial bootloader version None

AN2606 Rev 65 61/508

507
STM32C051xx devices AN2606

7 STM32C051xx devices

7.1 Bootloader configuration

The STM32C051xx bootloader is activated by applying Pattern 11 (see Table 2). Table 14
shows the hardware resources used by this bootloader.

Table 14. STM32C051xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz, derived directly from

RCC HSI enabled
the HSI
5 Kbytes, starting from address 0x2000 0000, are used by
RAM -
the bootloader firmware.
Common to
all 12 Kbytes, starting from address 0x1FFF 0000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset if the
hardware IWDG option was previously enabled by the user.
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF 2E00
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART in reception mode.
PA12 pin: as PA10 pin does not exist on WLCSP15,
USART1_RX pin Input
TSSOP20, and UFQFN28, PA12 is remapped to PA10.
USART1 Used in alternate function with pull-up mode.
PA9 pin: USART in transmission mode.
PA11 pin: as PA9 pin does not exist on WLCSP15,
USART1_TX pin Output TSSOP20, and UFQFN28, PA11 is to PA9.
Kept in reset configuration until 0x7F detected on
USART_RX.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled
parity, and one stop bit.
PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
function, pull-up mode
USART2
PA2 pin: USART2 in transmission mode. Kept in reset
USART2_TX pin Output
configuration until 0x7F detected on USART_RX
Used for USART detection. Baudrate calculation is based on
EXTI line 11 Input
this line interrupt.

62/508 AN2606 Rev 65

AN2606 STM32C051xx devices

Table 14. STM32C051xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1110110x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1110110x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Target mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: target data Input line, used in alternate function, pull
SPI1 SPI1_MOSI pin Input
down mode.
PA6 pin: target data output line, used in alternate function,
SPI1_MISO pin(1) Output
pull down mode
PA5 pin: target clock line, used in alternate function, pull
SPI1_SCK pin
down mode.
Input
PA4 pin: slave chip select pin used in alternate function, pull
SPI1_NSS pin
down mode.

AN2606 Rev 65 63/508

507
STM32C051xx devices AN2606

Table 14. STM32C051xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: Slave data Input line, used in alternate function,
SPI2 SPI2_MOSI pin Input
pull down mode.
PB14 pin: Slave data output line, used in alternate function,
SPI2_MISO pin(1) Output
pull down mode
PB13 pin: Slave clock line, used in alternate function, pull
SPI2_SCK pin
down mode.
Input
PB12 pin: slave chip select pin used in alternate function,
SPI2_NSS pin
pull down mode.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

7.2 Boot model

The bootloader follows boot model V2 (see Section 4.10), there are no specific constraints.

64/508 AN2606 Rev 65

AN2606 STM32C051xx devices

7.3 Bootloader selection

Figure 15 shows the bootloader selection mechanism.

Figure 15. Bootloader V11.0 selection for STM32C051xx devices

System reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USARTx

Configure I2Cx

0x7F received Yes

on USARTx

No

Disable all interrupt Disable all interrupt

Yes sources and other sources and other
I2Cx address
interfaces clocks interfaces clocks
detected

No Configure
Execute
BL_I2C_Loop USARTx TX
for I2Cx

Execute
BL_USART_Loop
for USARTx

MS52813V2

7.4 Bootloader version

Table 15 lists the STM32C051xx devices bootloader versions.

Table 15. STM32C051xx bootloader versions

Version number Description Known limitations

Empty check flag cleared by error on the bootloader startup phase

– Root cause: on the startup phase the bootloader SW performs a system
deinitialization, leading to write the default value on the FLASH_ACR
register, which overrides the Empty check bit with 0
Initial bootloader – Behavior: when Empty check boot mode is used and the flash memory
V11.0
version is empty, the MCU boots on the bootloader but the flag is cleared by the
SW. If a reset is triggered, the system tries to boot on the empty flash
memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

AN2606 Rev 65 65/508

507
STM32C071xx devices AN2606

8 STM32C071xx devices

8.1 Bootloader configuration

The STM32C071xx bootloader is activated by applying Pattern 11 (see Table 2). Table 14
shows the hardware resources used by this bootloader.

Table 16. STM32C071xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

HSI enabled The system clock frequency is 24 MHz (no PLL)

RCC The clock recovery system (CRS) is enabled for the DFU
HSI48 enabled
bootloader so that USB can be clocked by HSI48 48 MHz
8.75 Kbytes, starting from address 0x20000000, are used by
RAM -
Common to the bootloader firmware.
all
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset if the
hardware IWDG option was previously enabled by the user.
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF1600
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input pull-up
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled
parity, and one stop bit.
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART2 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1110001x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.

66/508 AN2606 Rev 65

AN2606 STM32C071xx devices

Table 16. STM32C071xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1110001x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Target mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: target data Input line, used in push-pull, pull down
SPI1_MOSI pin Input
mode.
PA6 pin: target data output line, used in push-pull, pull down
SPI1_MISO pin(1) Output
mode
SPI1_SCK pin PA5 pin: target clock line, used in push-pull, pull down mode.
Input PA4 pin: slave chip select pin used in push-pull, pull down
SPI1_NSS pin
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: Slave data Input line, used in push-pull, pull down
SPI2 SPI2_MOSI pin Input
mode.
PB14 pin: Slave data output line, used in push-pull, pull
SPI2_MISO pin(1) Output
down mode
PB13 pin: Slave clock line, used in push-pull, pull down
SPI2_SCK pin
mode.
Input
PB12 pin: slave chip select pin used in push-pull, pull down
SPI2_NSS pin
mode.
USB FS configured in forced device mode. USB FS interrupt
USB Enabled
vector is enabled and used for USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no pull
DFU USB_DM pin
mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required.

AN2606 Rev 65 67/508

507
STM32C071xx devices AN2606

1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

8.2 Bootloader selection

Figure 15 shows the bootloader selection mechanism.

Figure 16. Bootloader V13.1 selection for STM32C071xx devices

System Reset
Or JumpToBL

Disable all
0x7F Execute
De-Init system interrupt sources
detected on Yes BL_USART_Loop
Configure System clock and other
USART Tx for USARTx
to 24 MHz with HSI interfaces clocks
and HSI48 for USB
No

System Init Disable all

(Clock, GPIOs, Execute
I2C address interrupt sources
IWDG, SysTick) Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks

Configure No
USB FS device

Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
No and other
mechanism for SPIx
Configure USARTx interfaces clocks

No

Configure I2Cx Execute DFU

USB cable
Yes bootloader using
detected
USB interrupts
MS56768V1

Configure SPIx

8.3 Bootloader version

Table 15 lists the STM32C071xx devices bootloader versions.

Table 17. STM32C071xx bootloader versions

Version number Description Known limitations

V13.1 Initial bootloader version None

68/508 AN2606 Rev 65

AN2606 STM32C091xx/92xx devices

9 STM32C091xx/92xx devices

9.1 Bootloader configuration

The STM32C091xx/92xx bootloader is activated by applying Pattern 11 (see Table 2).
Table 14 shows the hardware resources used by this bootloader.

Table 18. STM32C091xx/92xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz, derived directly from

RCC HSI enabled
the HSI
5 Kbytes, starting from address 0x2000 0000, are used by
RAM -
the bootloader firmware.
Common to
all 12 Kbytes, starting from address 0x1FFF 0000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset if the
hardware IWDG option was previously enabled by the user.
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF 3E00
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART in reception mode.
PA12 pin: as PA10 pin does not exist on TSSOP20,
USART1_RX pin Input
WLCSP24, and UFQFN28, PA12 is remapped to PA10.
USART1 Used in alternate function with pull-up mode.
PA9 pin: USART in transmission mode.
PA11 pin: as PA9 pin does not exist on TSSOP20,
USART1_TX pin Output WLCSP24, and UFQFN28, PA11 is remapped to PA9.
Kept in reset configuration until 0x7F detected on
USART_RX.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled
parity, and one stop bit.
PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
function, pull-up mode
USART2
PA2 pin: USART2 in transmission mode. Kept in reset
USART2_TX pin Output
configuration until 0x7F detected on USART_RX
Used for USART detection. Baudrate calculation is based on
EXTI line 3 Input
this line interrupt.

AN2606 Rev 65 69/508

507
STM32C091xx/92xx devices AN2606

Table 18. STM32C091xx/92xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the USART3 configuration is: 8- bits, even

USART3 Enabled
parity and 1 Stop bit
PC11 pin: USART in reception mode.
USART3_RX pin Input
Used in alternate function with pull-up mode
USART3 PC10 pin: USART in transmission mode.
USART3_TX pin Output Kept in reset configuration until 0x7F detected on
USART_RX
Used for USART detection. Baudrate calculation is based on
EXTI line 11 Input
this line interrupt
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1110110x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1110110x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Target mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: target data Input line, used in alternate function, pull
SPI1 SPI1_MOSI pin Input
down mode.
PA6 pin: target data output line, used in alternate function,
SPI1_MISO pin(1) Output
pull down mode
PA5 pin: target clock line, used in alternate function, pull
SPI1_SCK pin
down mode.
Input
PA4 pin: slave chip select pin used in alternate function, pull
SPI1_NSS pin
down mode.

70/508 AN2606 Rev 65

AN2606 STM32C091xx/92xx devices

Table 18. STM32C091xx/92xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: Slave data Input line, used in alternate function,
SPI2 SPI2_MOSI pin Input
pull down mode.
PB14 pin: Slave data output line, used in alternate function,
SPI2_MISO pin(1) Output
pull down mode
PB13 pin: Slave clock line, used in alternate function, pull
SPI2_SCK pin
down mode.
Input
PB12 pin: slave chip select pin used in alternate function,
SPI2_NSS pin
pull down mode.
Once initialized the FDCAN configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN Enabled(2)
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
– TransmitPause = DISABLE
– ProtocolException = ENABLE
FDCAN1
FDCAN in reception mode. Used in alternate function with
pull up mode.
FDCAN_Rx pin Input
– PB0 for WLCSP24, UFQFN28, UFQFN32, and LQFP32
– PD0 for UFQFN48, LQFP48, UFBGA64, and LQFP644
FDCAN in transmission mode. Used in alternate function
with pull up mode
FDCAN_Tx pin Output
– PB1 for WLCSP24, UFQFN28, UFQFN32, and LQFP32
– PD1 for UFQFN48, LQFP48, UFBGA64, and LQFP64
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.
2. Only when enabled by engineering bytes. Not supported on TSSOP20 package, even if enabled by engineering bytes.

9.2 Boot model

The bootloader follows boot model V2 (see Section 4.10), there are no specific constraints.

AN2606 Rev 65 71/508

507
STM32C091xx/92xx devices AN2606

9.3 Bootloader selection

Figure 15 shows the bootloader selection mechanism.

Figure 17. Bootloader V18.1 selection for STM32C091xx/92xx devices

System Reset
Or JumpToBL

DeInitialize system

Configure System 0x7F Disable all interrupt Exexute

clock to 48 MHz detected on Yes sources and other BL_USART_Loop
with MSIS (MSI/2) USART Tx interfaces clocks for USARTx

No
System Init
(Clock, GPIOs,
IWDG, SysTick)
Disable all interrupt Exexute
FDCAN frame
Yes sources and other BL_FDCAN_Loop
detected
interfaces clocks for FDCANx

Configure USARTx
No

Disable all interrupt Execute

I2C address
Yes sources and other BL_I2C_Loop for
detected
interfaces clocks I2Cx
Configure I2Cx No

No

Configure SPIx SPIx detects Disable all interrupt Execute

Synchro Yes sources and other BL_SPI_Loop for
mechanism interfaces clocks SPIx

Configure FDCANx

MS56838V1

72/508 AN2606 Rev 65

AN2606 STM32C091xx/92xx devices

9.4 Bootloader version

Table 15 lists the STM32C091xx/92xx devices bootloader versions.

Table 19. STM32C091xx/92xx bootloader versions

Version number Description Known limitations

Empty check flag cleared by error on the bootloader startup phase

– Root cause: on the startup phase the bootloader SW performs a system
deinitialization, leading to write the default value on the FLASH_ACR
register, which overrides the Empty check bit with 0
Initial bootloader – Behavior: when Empty check boot mode is used and the flash memory
V18.1
version is empty, the MCU boots on the bootloader but the flag is cleared by the
SW. If a reset is triggered, the system tries to boot on the empty flash
memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

AN2606 Rev 65 73/508

507
STM32F03xx4/6 devices AN2606

10 STM32F03xx4/6 devices

10.1 Bootloader configuration

The STM32F03xx4/6 bootloader is activated by applying Pattern 2 (see Table 2). Table 20
shows the hardware resources used by this bootloader.

Table 20. STM32F03xx4/6 configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL clocked

RCC HSI enabled
by HSI). 1 flash Wait State.
2 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.

Common to all 3 Kbytes, starting from address 0x1FFFEC00 contain the

System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset if the
IWDG -
hardware IWDG option was previously enabled by the
user.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
USART1 PA10 pin: USART1 in reception mode. Used in input pull-
USART1_RX pin Input
(on PA10/PA9) up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
USART1 PA15 pin: USART1 in reception mode. Used in input pull-
USART1_RX pin Input
(on PA14/PA15) up mode.
PA14 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USART1s SysTick timer Enabled
host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: After the STM32F03xx4/6 device has booted in bootloader mode, serial wire debug (SWD)
communication is no longer possible until the system is reset. This is because the SWD
uses the PA14 pin (SWCLK), already used by the bootloader (USART1_TX).

74/508 AN2606 Rev 65

AN2606 STM32F03xx4/6 devices

10.2 Bootloader selection

Figure 18 shows the bootloader selection mechanism.

Figure 18. Bootloader selection for STM32F03xx4/6 devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35015V1

10.3 Bootloader version

Table 21 lists the STM32F03xx4/6 devices bootloader versions.

Table 21. STM32F03xx4/6 bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

instead of one are sent when a Read Memory or
V1.0 Initial bootloader version
Write Memory command is sent and the RDP level is
active.

AN2606 Rev 65 75/508

507
STM32F030xC devices AN2606

11 STM32F030xC devices

11.1 Bootloader configuration

The STM32F030xC bootloader is activated by applying Pattern 2 (see Table 2). Table 22
shows the hardware resources used by this bootloader.

Table 22. STM32F030xC configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI 8 MHz

RCC HSI enabled
as clock source.
6 Kbytes, starting from address 0x20000000, are used
Common to all RAM -
by the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain
System memory -
the bootloader firmware.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in input
USART1 USART1_RX pin Input
pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-
USART2_RX pin Input
(on PA2/PA3) up mode.
PA2 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
USART2 PA15 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
(on PA14/PA15) pull-up mode.
PA14 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
Target 7-bit address: 0b1000001x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

76/508 AN2606 Rev 65

AN2606 STM32F030xC devices

Note: After the devices have booted in bootloader mode using USART2, the serial wire debug
(SWD) communication is no more possible until the system is reset, because SWD uses
PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

11.2 Bootloader selection

Figure 19 shows the bootloader selection mechanism.

Figure 19.Bootloader selection for STM32F030xC

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

0x7F received on Disable all interrupt

USARTx sources and other
yes interfaces clock’s
no
Disable all interrupt
Configure
sources and other
USARTx
I2Cx Address interfaces clock’s
Detected
no Execute
Execute
BL_I2C_Loop for BL_USART_Loop
I2Cx for USARTx

MSv36789V1

11.3 Bootloader version

Table 23 lists the STM32F030xC devices bootloader versions.

Table 23. STM32F030xC bootloader versions

Version number Description Known limitations

PA13 is set in input pull-up mode even if not used

V5.2 Initial bootloader version
by the bootloader

AN2606 Rev 65 77/508

507
STM32F05xxx and STM32F030x8 devices AN2606

12 STM32F05xxx and STM32F030x8 devices

12.1 Bootloader configuration

The STM32F05xxx and STM32F030x8 devices bootloader is activated by applying
Pattern 2 (described in Table 2). Table 24 shows the hardware resources used by this
bootloader.

Table 24. STM32F05xxx and STM32F030x8 devices configuration in system memory boot mode
Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using

RCC HSI enabled PLL clocked by HSI).
1 flash Wait State.
2 Kbytes, starting from address 0x20000000,
RAM -
are used by the bootloader firmware.
Common to all 3 Kbytes, starting from address 0x1FFFEC00,
System memory -
contain the bootloader firmware.
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset if the hardware IWDG
option was previously enabled by the user.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8
USART2 Enabled
bits, even parity, and one stop bit.
PA15 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA14 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: After the STM32F05xxx and STM32F030x8 devices have booted in bootloader mode, the
serial wire debug (SWD) communication is no more possible until the system is reset,
because SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_TX).

78/508 AN2606 Rev 65

AN2606 STM32F05xxx and STM32F030x8 devices

12.2 Bootloader selection

Figure 20 shows the bootloader selection mechanism.

Figure 20. Bootloader selection for STM32F05xxx and STM32F030x8 devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35014V1

12.3 Bootloader version

Table 25 lists the STM32F05xxx and STM32F030x8 devices bootloader versions.

Table 25. STM32F05xxx and STM32F030x8 devices bootloader versions

Version
Description Known limitations
number

– At bootloader startup, the HSITRIM value is set

to 0 (in HSITRIM bits on RCC_CR register)
instead of default value (16), as a consequence
a deviation is generated in crystal
measurement. For better results, use the
smallest supported crystal value (i.e. 4 MHz).
V2.1 Initial bootloader version
– For the USART interface, two consecutive
NACKs instead of 1 NACK are sent when a
Read Memory or Write Memory command is
sent and the RDP level is active.
– PA13 is set in input pull-up mode even if not
used by the Bootloader.

AN2606 Rev 65 79/508

507
STM32F04xxx devices AN2606

13 STM32F04xxx devices

13.1 Bootloader configuration

The STM32F04xxx bootloader is activated by applying Pattern 6 (described in Table 2).
Table 26 shows the hardware resources used by this bootloader.

Table 26. STM32F04xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48 MHz

HSI enabled
as clock source.
RCC
The clock recovery system (CRS) is enabled for the DFU to
-
allow USB to be clocked by HSI48 48 MHz.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
Common to all the bootloader firmware
13 Kbytes, starting from address 0x1FFFC400, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input pull-up
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA15 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PA14 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111110x (x = 0 for write and x = 1
for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

80/508 AN2606 Rev 65

AN2606 STM32F04xxx devices

Table 26. STM32F04xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12: USB DP line
USB_DP pin No external pull-up resistor is required. Used in alternate
push-pull, no pull mode.

Note: After the devices have booted in bootloader mode using USART2, the serial wire debug
(SWD) communication is no more possible until the system is reset, because SWD uses
PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.
Note: Due to empty check mechanism present on these products, it is not possible to jump from
user code to system bootloader. Such jump results in a jump back to user flash memory
space. If the first four bytes of User flash (at 0x0800 0000) are empty at the moment of jump
(i.e. erase first sector before jump or execute code from SRAM while flash is empty), then
system bootloader is executed when jumped to.

AN2606 Rev 65 81/508

507
STM32F04xxx devices AN2606

13.2 Bootloader selection

Figure 21 shows the bootloader selection mechanism.

Figure 21. Bootloader selection for STM32F04xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure USB FS device

0x7F received
yes
on USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
I2Cx Address
Detected yes interfaces clock’s interfaces clock’s

Disable other
no interfaces clock’s Execute Configure
no BL_I2C_Loop for USARTx
I2Cx
USB
Detected Execute DFU
bootloader using USB Execute
interrupts BL_USART_Loop
for USARTx

MS35025V1

13.3 Bootloader version

Table 27. STM32F04xxx bootloader versions
Version
Description Known limitations
number

V10.0 Initial bootloader version At bootloader startup, the HSITRIM value is set to 0 (in
HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated
Add dynamic support of in crystal measurement.
USART/USB interfaces on For better results, use the smallest supported crystal
V10.1
PA11/12 IOs for small value (4 MHz).
packages.
PA13 is set in input pull-up mode even if not used by
the bootloader.

82/508 AN2606 Rev 65

AN2606 STM32F070x6 devices

14 STM32F070x6 devices

14.1 Bootloader configuration

The STM32F070x6 bootloader is activated by applying Pattern 6 (described in Table 2).
Table 28 shows the hardware resources used by this bootloader.

Table 28. STM32F070x6 configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
At startup, the system clock frequency is configured to 48
HSI enabled MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader interfaces
RCC and must have one of the following values: 24, 18, 16, 12,
HSE enabled
8, 6, 4 MHz. The PLL is used to generate 48 MHz for USB
Common to all and system clock.
The CSS interrupt is enabled for HSE. Any failure (or
-
removal) of the external clock generates system reset.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
13 Kbytes, starting from address 0x1FFFC400, contain the
System memory -
bootloader firmware.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
USART1 PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
push-pull, pull-up mode.
USART1_TX pin Output PA9 pin: USART1 in transmission mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
USART2
USART2_RX pin Input PA15 pin: USART2 in reception mode
USART2_TX pin Output PA14 pin: USART2 in transmission mode
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, Target mode
I2C1 Enabled
– Analog filter ON
I2C1
– Target 7-bit address: 0b0111110x x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain mode.
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
DFU
USB_DM pin PA11 pin: USB FS DM line
Input/output PA12 pin: USB FS DP line.
USB_DP pin
No external pull-up resistor is required.

AN2606 Rev 65 83/508

507
STM32F070x6 devices AN2606

Note: If HSI deviation exceeds 1% the bootloader might not function correctly.
Note: After the STM32F070x6 devices have booted in bootloader mode using USART2, the serial
wire debug (SWD) communication is no more possible until the system is reset, because
SWD uses PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 8, 6, or 4 MHz, the system clock is
configured to 48 MHz with HSE as clock source. The DFU interface, USART1,
USART2, and I2C1 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source and only USART1,
USART2, and I2C1 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.
Note: Due to empty check mechanism present on this product, it is not possible to jump from user
code to system bootloader. Such jump results in a jump back to user flash space, but if the
first four bytes of user flash (at 0x0800 0000) are empty at the moment of jump (i.e. erase
first sector before jump or execute code from SRAM while flash is empty), then system
bootloader is executed when jumped to.

84/508 AN2606 Rev 65

AN2606 STM32F070x6 devices

14.2 Bootloader selection

Figure 22 shows the bootloader selection mechanism.

Figure 22. Bootloader selection for STM32F070x6

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24, 18, 16, no

12, 8, 6, 4 MHz ?

yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

Configure I2Cx

0x7F received
yes
on USARTx

yes
no
Disable all interrupt
sources and other
interfaces clock’s
I2Cx Address
Detected yes
Disable all interrupt
Disable other sources and other Configure
interfaces clock’s interfaces clock’s USARTx
no
no

Execute DFU Execute Execute

USB cable
bootloader using USB BL_I2C_Loop for BL_USART_Loop
Detected & USB
interrupts I2Cx for USARTx
configured

MSv36794V1

AN2606 Rev 65 85/508

507
STM32F070x6 devices AN2606

14.3 Bootloader version

Table 29 lists the STM32F070x6 devices bootloader versions.

Table 29. STM32F070x6 bootloader versions

Version
Description Known limitations
number

V10.2 Initial bootloader version At bootloader startup, the HSITRIM value is set to
0 (in HSITRIM bits on RCC_CR register) instead
of default value (16), as a consequence a
Clock configuration fixed deviation is generated in crystal measurement.
V10.3
to HSI 8 MHz For better results, use the smallest supported
crystal value (4 MHz).

86/508 AN2606 Rev 65

AN2606 STM32F070xB devices

15 STM32F070xB devices

15.1 Bootloader configuration

The STM32F070xB bootloader is activated by applying Pattern 2 (described in Table 2).
Table 30 shows the hardware resources used by this bootloader.

Table 30. STM32F070xB configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
At startup, the system clock frequency is configured to 48
HSI enabled MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader interfaces
and must have one of the following values: 24, 18, 16, 12,
RCC HSE enabled
8, 6, 4 MHz. The PLL is used to generate 48 MHz for USB
and system clock.
Common to all
The clock security system (CSS) interrupt is enabled for
- HSE. Any failure (or removal) of the external clock
generates a system reset.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
12 Kbytes, starting from address 0x1FFFC800, contain the
System memory -
bootloader firmware.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in input pull-
USART1_TX pin Output
up mode
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA15 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA14 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111011x (x = 0 for write and x =
1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 87/508

507
STM32F070xB devices AN2606

Table 30. STM32F070xB configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
DFU PA11 pin: USB FS DM line used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output
PA12 pin: USB FS DP line used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.

Note: If HSI deviation exceeds 1% the bootloader might not function correctly.
Note: After the devices have booted in bootloader mode using USART2, the serial wire debug
(SWD) communication is no more possible until the system is reset, because SWD uses
PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 8, 6, or 4 MHz, the system clock is
configured to 48 MHz with HSE as clock source. The DFU interface, USART1,
USART2, and I2C1 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source and only USART1,
USART2, and I2C1 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

88/508 AN2606 Rev 65

AN2606 STM32F070xB devices

15.2 Bootloader selection

Figure 23 shows the bootloader selection mechanism.

Figure 23.Bootloader selection for STM32F070xB

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24, 18, 16, 12, 8, no

6, 4 MHz ?

yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

Configure I2Cx

0x7F received
yes
on USARTx

yes
no
Disable all interrupt
sources and other
interfaces clock’s
I2Cx Address
Detected yes
Disable all interrupt
Disable other sources and other Configure
interfaces clock’s interfaces clock’s USARTx
no
no

Execute DFU Execute Execute

USB cable
bootloader using USB BL_I2C_Loop for BL_USART_Loop
Detected & USB
interrupts I2Cx for USARTx
configured

MSv36795V1

AN2606 Rev 65 89/508

507
STM32F070xB devices AN2606

15.3 Bootloader version

Table 31 lists the STM32F070xB devices bootloader versions.

Table 31. STM32F070xB bootloader versions

Version
Description Known limitations
number

V10.2 Initial bootloader version At bootloader startup, the HSITRIM value is set to 0 (in
HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated
Clock configuration fixed in crystal measurement. For better results, use the
V10.3 smallest supported crystal value (4 MHz).
to HSI 8 MHz
PA13 is set in alternate push-pull mode even if not
used by the bootloader.

90/508 AN2606 Rev 65

AN2606 STM32F071xx/072xx devices

16 STM32F071xx/072xx devices

16.1 Bootloader configuration

The STM32F071xx/072xx bootloader is activated by applying Pattern 2 (described in
Table 2). Table 32 shows the hardware resources used by this bootloader.

Table 32. STM32F071xx/072xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48 MHz

HSI enabled
as clock source.
RCC
CRS is enabled for the DFU to allow USB to be clocked by
-
HSI48 48 MHz.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
Common to all the bootloader firmware
12 Kbytes, starting from address 0x1FFFC800, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input pull-up
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA15 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode
PA14 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, Target mode
I2C1 Enabled
– Analog filter ON
I2C1 – Target 7-bit address: 0b0111011x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.

AN2606 Rev 65 91/508

507
STM32F071xx/072xx devices AN2606

Table 32. STM32F071xx/072xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12: USB DP line
USB_DP pin No external pull-up resistor is required. Used in alternate
push-pull, no pull mode.

Note: After the devices have booted in bootloader mode using USART2, the serial wire debug
(SWD) communication is no more possible until the system is reset, because SWD uses
PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

92/508 AN2606 Rev 65

AN2606 STM32F071xx/072xx devices

16.2 Bootloader selection

Figure 24 shows the bootloader selection mechanism.

Figure 24. Bootloader selection for STM32F071xx/072xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure USB FS device

0x7F received on
yes
USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
sources and other
I2Cx Address
Detected yes interfaces clock’s interfaces clock’s

Disable other
no interfaces clock’s Execute Configure
no BL_I2C_Loop for USARTx
I2Cx
USB
Detected Execute DFU
bootloader using USB Execute
interrupts BL_USART_Loop
for USARTx

MS35026V1

16.3 Bootloader version

Table 33 lists the STM32F071xx/072xx devices bootloader versions.

Table 33. STM32F071xx/072xx bootloader versions

Version
Description Known limitations
number

At bootloader startup, the HSITRIM value is set to (0) (in

HSITRIM bits on RCC_CR register) instead of default
value (16), as a consequence a deviation is generated in
V10.1 Initial bootloader version crystal measurement. For better results, use the smallest
supported crystal value (4 MHz).
PA13 set in alternate push-pull, pull-up mode even if not
used by bootloader.

AN2606 Rev 65 93/508

507
STM32F09xxx devices AN2606

17 STM32F09xxx devices

17.1 Bootloader configuration

The STM32F09xxx bootloader is activated by applying Pattern 6 (described in
Table 2).Table 34 shows the hardware resources used by this bootloader.

Table 34. STM32F09xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48 MHz as

RCC HSI enabled
clock source.
Common 6 Kbytes, starting from address 0x20000000, are used by the
RAM -
to all bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain the
System memory -
bootloader firmware.
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in input pull-up
USART1 USART1_RX pin Input
mode
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PA3 pin: USART2 in reception mode. Used in input pull-up
mode.
USART2_RX pin Input
PA15 pin: USART2 in reception mode. Used in input pull-up
USART2
mode.
PA2 pin: USART2 in transmission mode. Used in alternate
push-pull, pull-up mode.
USART2_TX pin Output
PA14 pin: USART2 in transmission mode. Used in alternate
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the host
USARTx SysTick timer Enabled
for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
Target 7-bit address: 0b1000001x (x = 0 for write and x = 1 for
read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

94/508 AN2606 Rev 65

AN2606 STM32F09xxx devices

Note: After the devices have booted in bootloader mode using USART2, the serial wire debug
(SWD) communication is no longer possible until the system is reset, because SWD uses
PA14 pin (SWCLK), already used by the bootloader (USART2_RX).
The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

17.2 Bootloader selection

Figure 25. Bootloader selection for STM32F09xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

0x7F received on Disable all interrupt

USARTx sources and other
yes interfaces clock’s
no
Disable all interrupt
Configure
sources and other
USARTx
I2Cx Address interfaces clock’s
Detected
no Execute
Execute
BL_I2C_Loop for BL_USART_Loop
I2Cx for USARTx

MSv36789V1

17.3 Bootloader version

Table 35 lists the STM32F09xxx devices bootloader versions.

Table 35. STM32F09xxx bootloader versions

Version
Description Known limitations
number

At bootloader startup, the HSITRIM value is set to 0 in HSITRIM bits

on RCC_CR register instead of default value (16). As a consequence,
Initial bootloader
V5.0 a deviation is generated in crystal measurement. For better results,
version
use the smallest supported crystal value (4 MHz).
PA13 set in input pull-up mode even if not used by the bootloader.

AN2606 Rev 65 95/508

507
STM32F10xxx devices AN2606

18 STM32F10xxx devices

18.1 Bootloader configuration

The STM32F10xxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 36 shows the hardware resources used by this bootloader.

Table 36. STM32F10xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz using the PLL.
512 byte starting from address 0x20000000, are used
RAM -
by the bootloader firmware.
2 Kbytes, starting from address 0x1FFFF000 contain
Common to all System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset
IWDG -
(if the hardware IWDG option was previously enabled
by the user).
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output push-pull
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

96/508 AN2606 Rev 65

AN2606 STM32F10xxx devices

18.2 Bootloader selection

Figure 26 shows the bootloader selection mechanism.

Figure 26. Bootloader selection for STM32F10xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

No
Yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx
MS35004V1

18.3 Bootloader version

Table 37 lists the STM32F10xxx devices bootloader versions:

Table 37. STM32F10xxx bootloader versions

Version number Description

V2.0 Initial bootloader version

– Updated Go Command to initialize the main stack pointer
– Updated Go command to return NACK when jump address is in the Option byte
V2.1 area or System memory area
– Updated Get ID command to return the device ID on two bytes
– Update the bootloader version to V2.1
– Updated Read Memory, Write Memory and Go commands to deny access with
a NACK response to the first 0x200 bytes of RAM used by the bootloader
V2.2
– Updated Readout Unprotect command to initialize the whole RAM content to
0x0 before ROP disable operation

AN2606 Rev 65 97/508

507
STM32F10xxx devices AN2606

Note: The bootloader ID format is applied to all STM32 devices except the STM32F1xx devices.
The bootloader version for the STM32F1xx applies only to the embedded device’s
bootloader version and not to its supported protocols.

98/508 AN2606 Rev 65

AN2606 STM32F105xx/107xx devices

19 STM32F105xx/107xx devices

19.1 Bootloader configuration

The STM32F105xx/107xx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 38 shows the hardware resources used by this bootloader.

Table 38. STM32F105xx/107xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using the PLL.

This is used only for USARTx and during CAN2, USB
HSI enabled detection for CAN and DFUs (once CAN or DFU is
selected, the clock source is derived from the external
crystal).
The external clock is mandatory only for DFU and CAN
bootloaders and it must provide one of the following
RCC frequencies: 8 MHz, 14.7456 MHz or 25 MHz.
HSE enabled For CAN bootloader, the PLL is used only to generate
48 MHz when 14.7456 MHz is used as HSE.
For DFU, the PLL is used to generate a 48 MHz system
clock from all supported external clock frequencies.
Common to all
The CSS interrupt is enabled for the CAN and DFUs.
- Any failure (or removal) of the external clock will
generate system reset.
4 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware.
18 Kbytes, starting from address 0x1FFFB000 contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset
IWDG -
(if the hardware IWDG option was previously enabled by
the user).
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output push-pull
no pull mode.
Once initialized, the USART2 configuration is 8 bits,
USART2 Enabled even parity, and one stop bit. The USART2 uses its
remapped pins.
USART2
USART2_RX pin Input PD6 pin: USART2 receive (remapped pin)
USART2_TX pin Output push-pull PD5 pin: USART2 transmit (remapped pin)
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx bootloader.

AN2606 Rev 65 99/508

507
STM32F105xx/107xx devices AN2606

Table 38. STM32F105xx/107xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the CAN2 configuration is baudrate 125

kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during the CAN bootloader
execution because CAN1 manages the communication
between CAN2 and SRAM.
CAN2
PB5 pin: CAN2 receives (remapped pin). Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
PB6 pin: CAN2 transmits (remapped pin). Used in input
CAN2_TX pin Output push-pull
no pull mode.
USB Enabled USB OTG FS configured in forced device mode
USB_VBUS pin Input PA9: Power supply voltage line
DFU USB_DM pin PA11 pin: USB_DM line
Input/output PA12 pin: USB_DP line.
USB_DP pin
No external pull-up resistor is required

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU and CAN bootloaders, but only for the
selection phase. An external clock (8, 14.7456, or 25 MHz) is required for DFU and CAN
bootloader execution after the selection phase.

100/508 AN2606 Rev 65

AN2606 STM32F105xx/107xx devices

19.2 Bootloader selection

Figure 27 shows the bootloader selection mechanism.

Figure 27. Bootloader selection for STM32F105xx/107xx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

USB cable
yes
Detected

no yes
Disable all
interrupt sources HSE= 8MHz,
no 0x7F received on
USARTx 14.7456MHz or
Configure 25 MHz
USARTx
no
yes
Frame detected on Execute
CANx BL_USART_Loop
Reconfigure System
for USARTx
clock to 48MHz and
yes USB clock to 48 MHz

HSE= 8MHz, Execute DFU

no bootloader using USB
14.7456MHz or no
25 MHz interrupts

Generate System
yes
reset
Reconfigure System
clock to 48MHz

Disable all
interrupt sources

Configure CAN

Execute
BL_CAN_Loop for
CANx
MS35005V1

AN2606 Rev 65 101/508

507
STM32F105xx/107xx devices AN2606

19.3 Bootloader version

Table 39 lists the STM32F105xx/107xx devices bootloader versions:

Table 39. STM32F105xx/107xx bootloader versions

Version number Description

V1.0 Initial bootloader version

– Bootloader detection mechanism updated to fix the issue when GPIOs of
unused peripherals in this bootloader are connected to low level or left floating
during the detection phase. For more details refer to Section 19.3.2.
– Vector table set to 0x1FFFB000 instead of 0x00000000
– Go command updated (for all bootloaders): USART1, USART2, CAN2,
V2.0 GPIOA, GPIOB, GPIOD and SysTick peripheral registers are set to their
default reset values
– DFU: USB pending interrupt cleared before executing the Leave DFU
command
– DFU subprotocol version changed from V1.0 to V1.2
– Bootloader version updated to V2.0
– Fixed PA9 excessive consumption described in Section 19.3.4.
– Get-Version command (defined in AN3155) corrected. It returns 0x22 instead
V2.1
of 0x20 in bootloader V2.0. Refer to Section 19.3.3 for more details.
– Bootloader version updated to V2.1
– Fixed DFU option bytes descriptor (set to ‘e’ instead of ‘g’ because it is
read/write and not erasable).
V2.2 – Fixed DFU polling timings for flash Read/Write/Erase operations.
– Robustness enhancements for DFU interface.
– Updated bootloader version to V2.2.

Note: The bootloader ID format is applied to all STM32 devices except the STM32F1xx products.
The version for STM32F1xx applies only to the embedded device’s bootloader version and
not to its supported protocols.

19.3.1 How to identify STM32F105xx/107xx bootloader versions

Bootloader V1.0 is implemented on devices whose date code is lower than 937. Bootloader
V2.0 and V2.1 are implemented on devices with a date code higher than or equal to 937.
Bootloader V2.2 is implemented on devices with a date code higher than or equal to 227.
Refer to the datasheets to find the date code on the device marking)
There are two ways to distinguish between bootloader versions:
• When using the USART bootloader, the Get-Version command defined in AN3155 has
been corrected in V2.1 version. It returns 0x22 instead of 0x20 as in bootloader V2.0.
• The values of the vector table at the beginning of the bootloader code are different. The
user software (or via JTAG/SWD) reads 0x1FFFE945 at address 0x1FFFB004 for
bootloader V2.0 0x1FFFE9A1 for bootloader V2.1, and 0x1FFFE9C1 for bootloader
V2.2.

102/508 AN2606 Rev 65

AN2606 STM32F105xx/107xx devices

The DFU version can be read through the bcdDevice field of the DFU Device Descriptor:
• V2.1 in bootloader V2.1
• V2.2 in bootloader V2.2.

19.3.2 Bootloader unavailability on STM32F105xx/STM32F107xx devices

with date code lower than 937
Description
The bootloader cannot be used if the USART1_RX (PA10), USART2_RX (PD6, remapped),
CAN2_Rx (PB5, remapped), OTG_FS_DM (PA11), and/or OTG_FS_DP (PA12) pin(s) are
held low or left floating during the bootloader activation phase.
The bootloader cannot be connected through CAN2 (remapped), DFU (OTG FS in Device
mode), USART1 or USART2 (remapped).
On 64-pin packages, the USART2_RX signal remapped PD6 pin is not available and it is
internally grounded. In this case, the bootloader cannot be used at all.

Workaround
• For 64-pin packages
None. The bootloader cannot be used.
• For 100-pin packages
Depending on the used peripheral, the pins for the unused peripherals must be kept at
a high level during the bootloader activation phase as described below:
– If USART1 is used to connect to the bootloader, PD6 and PB5 must be kept at a
high level.
– If USART2 is used to connect to the bootloader, PA10, PB5, PA11, and PA12 must
be kept at a high level.
– If CAN2 is used to connect to the bootloader, PA10, PD6, PA11, and PA12 must be
kept at a high level.
– If DFU is used to connect to the bootloader, PA10, PB5, and PD6 must be kept at
a high level.
Note: This limitation applies only to STM32F105xx and STM32F107xx devices with a date code
lower than 937. STM32F105xx and STM32F107xx devices with a date code higher or equal
to 937 are not impacted. See STM32F105xx and STM32F107xx datasheets for where to
find the date code on the device marking.

19.3.3 USART bootloader Get-Version command returns 0x20

instead of 0x22
Description
In USART mode, the Get-Version command (defined in AN3155) returns 0x20 instead of
0x22. This limitation is present on bootloader versions V1.0 and V2.0, while it is fixed in
bootloader version 2.1.

Workaround
None.

AN2606 Rev 65 103/508

507
STM32F105xx/107xx devices AN2606

19.3.4 PA9 excessive power consumption when USB cable is plugged

in bootloader V2.0
Description
When connecting a USB cable after booting from System-Memory mode, PA9 pin
(connected to VBUS = 5 V) is also shared with USART TX pin, configured as alternate
push-pull and forced to 0 since the USART peripheral is not yet clocked. As a consequence,
a current higher than 25 mA is drained by PA9 I/O and may affect the I/O pad reliability.
This limitation is fixed in bootloader version 2.1 by configuring PA9 as alternate function
push-pull when a correct 0x7F is received on RX pin and the USART is clocked. Otherwise,
PA9 is configured as alternate input floating.

Workaround
None.

104/508 AN2606 Rev 65

AN2606 STM32F10xxx XL-density devices

20 STM32F10xxx XL-density devices

20.1 Bootloader configuration

The STM32F10xxx XL-density bootloader is activated by applying Pattern 3 (described in
Table 2). Table 40 shows the hardware resources used by this bootloader.

Table 40. STM32F10xxx XL-density configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz

RCC HSI enabled
using the PLL.
2 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware.
6 Kbytes, starting from address
Common to all System memory - 0x1FFFE000 contain the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in input pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output push-pull
Used in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration
USART2 Enabled
is 8 bits, even parity, and one stop bit.
PD6 pin: USART2 receives (remapped
USART2_RX pin Input
USART2 pins). Used in input pull-up mode.
PD5 pin: USART2 transmits (remapped
USART2_TX pin Output push-pull pins). Used in alternate push-pull, pull-up
mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

AN2606 Rev 65 105/508

507
STM32F10xxx XL-density devices AN2606

20.2 Bootloader selection

Figure 28. Bootloader selection for STM32F10xxx XL-density devices

System Reset

BFB2 bit reset

(BFB2 = 0)

yes

If Value
@0x08080000 is
yes
within int. SRAM
address Jump to user code
in Bank2
no no

If Value
@0x08000000 is
yes
within int. SRAM
address Jump to user code
in Bank1
no

Continue Bootloader execution

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)
yes Configure
USARTx

0x7F received on Execute

USARTx BL_USART_Loop
for USARTx

no
MS35006V1

20.3 Bootloader version

Table 41. STM32F10xxx XL-density bootloader versions
Version number Description

V2.1 Initial bootloader version

Note: The bootloader ID format is applied to all STM32 devices families except the STM32F1xx
family. The bootloader version for the STM32F1xx applies only to the embedded device
bootloader version and not to its supported protocols.

106/508 AN2606 Rev 65

AN2606 STM32F2xxxx devices

21 STM32F2xxxx devices

Two bootloader versions are available on STM32F2xxxx devices:

• V2.x supporting USART1 and USART3
This version is embedded in revisions A, Z, and B
• V3.x supporting USART1, USART3, CAN2, and DFU (USB FS device)
This version is embedded in all other revisions (Y, X, W, 1, V, 2, 3, and 4)

21.1 Bootloader V2.x

21.1.1 Bootloader configuration

The STM32F2xxxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 42 shows the hardware resources used by this bootloader.

Table 42. STM32F2xxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 24 MHz.

RAM - 8 Kbytes, starting from address 0x20000000.
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value and
Common to all IWDG - is periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed).
The voltage range can be configured in run time using
bootloader commands.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
USART1
USART1_RX pin Input PA10 pin: USART1 in reception mode
USART1_TX pin Output PA9 pin: USART1 in transmission mode
Once initialized, the USART3 configuration is 8 bits, even
USART3 Enabled
parity, and one stop bit.
USART3 (on
PC10/PC11) USART3_RX pin Input PC11 pin: USART3 in reception mode
USART3_TX pin Output PC10 pin: USART3 in transmission mode

AN2606 Rev 65 107/508

507
STM32F2xxxx devices AN2606

Table 42. STM32F2xxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART3 configuration is 8 bits, even

USART3 Enabled
parity, and one stop bit
USART3 (on
PB10/PB11) USART3_RX pin Input PB11 pin: USART3 in reception mode
USART3_TX pin Output PB10 pin: USART3 in transmission mode
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader code.

21.1.2 Bootloader selection

Figure 29 shows the bootloader selection mechanism.

Figure 29. Bootloader V2.x selection for STM32F2xxxx devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no
yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35010V1

108/508 AN2606 Rev 65

AN2606 STM32F2xxxx devices

21.1.3 Bootloader version

Table 43 lists the STM32F2xxxx devices V2.x bootloader versions:

Table 43. STM32F2xxxx bootloader V2.x versions

Version
Description Known limitations
number

When a Read Memory command or Write Memory command is

issued with an unsupported memory address and a correct address
checksum (i.e. address 0x6000 0000), the command is aborted by
the bootloader device, but the NACK (0x1F) is not sent to the host.
Initial bootloader As a result, the next two bytes (the number of bytes to be
V2.0
version read/written and its checksum) are considered as a new command
and its checksum.
For the CAN interface, the Write Unprotect command is not
functional. Use Write Memory command and write directly to the
option bytes in order to disable the write protection.(1)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as
the command is NACK-ed anyway (as an unsupported new command).

AN2606 Rev 65 109/508

507
STM32F2xxxx devices AN2606

21.2 Bootloader V3.x

21.2.1 Bootloader configuration

The STM32F2xxxx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 44 shows the hardware resources used by this bootloader.

Table 44. STM32F2xxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using the PLL.

The HSI clock source is used at startup (interface detection
HSI enabled phase) and when USARTx interfaces are selected (once
CAN or DFU is selected, the clock source is derived from
the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the CAN or the
HSE enabled DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple of
1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates system
reset.
Common to all
8 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.
29 Kbytes, starting from address 0x1FF00000 contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Voltage range is set to 1.62 V, 2.1 V. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed).
The voltage range can be configured in run time using
bootloader commands.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in no pull
USART1_TX pin Output
mode.
Once initialized, the USART3 configuration is 8 bits, even
USART3 Enabled
parity, and one stop bit.
USART3 (on PB11 pin: USART3 in reception mode. Used in pull-up
USART3_RX pin Input
PB10/PB11) mode
PB10 pin: USART3 in transmission mode. Used in pull-up
USART3_TX pin Output
mode

110/508 AN2606 Rev 65

AN2606 STM32F2xxxx devices

Table 44. STM32F2xxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART3 configuration is 8 bits, even

USART3 Enabled
parity, and one stop bit.
USART3 (on PC11 pin: USART3 in reception mode. Used in pull-up
USART3_RX pin Input
PC10/PC11) mode.
PC10 pin: USART3 in transmission mode. Used in pull-up
USART3_TX pin Output
mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
Once initialized, the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
USB Enabled USB OTG FS configured in forced device mode
USB_DM pin PA11: USB DM line. Used in input no pull mode.
DFU
Input/output PA12: USB DP line. Used in inpt no pull mode.
USB_DP pin
No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
CAN2 and
TIM11 Enabled the HSE frequency is determined, the system clock is
DFUs
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx. This
internal clock is also used for CAN and DFU (USB FS device), but only for the selection
phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is required for CAN
and DFU execution after the selection phase.

AN2606 Rev 65 111/508

507
STM32F2xxxx devices AN2606

21.2.2 Bootloader selection

Figure 30 shows the bootloader selection mechanism.

Figure 30. Bootloader V3.x selection for STM32F2xxxx devices

System Reset

yes Disable all

System Init (Clock, GPIOs,
interrupt sources
IWDG, SysTick)

Configure
Configure USB OTG FS
USARTx
device

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx

yes
no

Frame detected HSE detected

no
on CANx pin yes

yes

no no HSE detected no Disable all

interrupt sources
Generate System
USB cable
Yes reset Reconfigure System
Detected
clock to 60MHz
Reconfigure System
clock to 60MHz and
Configure CAN
USB clock to 48 MHz

Execute
Execute DFU BL_CAN_Loop for
bootloader using USB CANx
interrupts

MS35011V1

112/508 AN2606 Rev 65

AN2606 STM32F2xxxx devices

21.2.3 Bootloader version

Table 45 lists the STM32F2xxxx devices V3.x bootloader versions:

Table 45. STM32F2xxxx bootloader V3.x versions

Version
Description Known limitations
number

– When a Read Memory command or Write Memory

command is issued with an unsupported memory
address and a correct address checksum (i.e. address
0x6000 0000), the command is aborted by the bootloader
device, but the NACK (0x1F) is not sent to the host. As a
V3.2 Initial bootloader version result, the next two bytes (which are the number of bytes
to be read/written and its checksum) are considered as a
new command and its checksum(1).
– Option bytes, OTP and Device Feature descriptors (in
DFU interface) are set to “g” instead of “e” (not erasable
memory areas).
– For the USART interface, two consecutive NACKs
(instead of 1 NACK) are sent when a Read Memory or
Write Memory command is sent and the RDP level is
Fix V3.2 limitations. DFU
active.
V3.3 interface robustness
enhancement – For the CAN interface, the Write Unprotect command is
not functional. Use Write Memory command and write
directly to the option bytes in order to disable the write
protection.
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02,
0x11, 0x21, 0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as
the command is NACK-ed anyway (as an unsupported new command).

AN2606 Rev 65 113/508

507
STM32F301xx/302x4(6/8) devices AN2606

22 STM32F301xx/302x4(6/8) devices

22.1 Bootloader configuration

The STM32F301xx/302x4(6/8) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 46 shows the hardware resources used by this bootloader.
Table 46. STM32F301xx/302x4(6/8) configuration in system memory boot mode
Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz with HSI48 48 MHz

HSI enabled
as clock source.
The external clock can be used for all bootloader interfaces
and must have one the following values:
RCC HSE enabled 24,18,16,12,9,8,6,4,3 MHz.
The PLL is used to generate the USB48 MHz clock and the
48 MHz clock for the system clock.
The CSS interrupt is enabled for the DFU. Any failure (or
-
Common to all removal) of the external clock generates system reset.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

114/508 AN2606 Rev 65

AN2606 STM32F301xx/302x4(6/8) devices

Table 46. STM32F301xx/302x4(6/8) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
mode.
USB_DP pin
An external pull-up resistor 1.5 KΩ must be connected to
USB_DP pin.

The bootloader has two cases of operation, depending upon the presence of the external
clock (HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4, or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 65 115/508

507
STM32F301xx/302x4(6/8) devices AN2606

22.2 Bootloader selection

Figure 31 shows the bootloader selection mechanism.

Figure 31. Bootloader selection for STM32F301xx/302x4(6/8)

System Reset

Configure System clock to

48 MHz using HSI

HSE= 24,
18, 16, 12, 9, 8, 6, 4, no
3 MHz ?

Yes

Reconfigure System clock to

48 MHz using HSE

System Init (Clock, GPIOs,

IWDG, SysTick) System Init (Clock, GPIOs,
IWDG, SysTick)

Configure USB FS device

yes
USB cable
Detected & USB
configured Disable all interrupt
yes
sources and other
interfaces clock’s Disable other
no interfaces clock’s
Configure
USARTx
0x7F received on
Execute DFU
USARTx
no Execute bootloader using USB
BL_USART_Loop interrupts
for USARTx
MS35027V1

22.3 Bootloader version

Table 47 lists the STM32F301xx/302x4(6/8) devices bootloader versions:

Table 47. STM32F301xx/302x4(6/8) bootloader versions

Version number Description Known limitations

V4.0 Initial bootloader version None

116/508 AN2606 Rev 65

AN2606 STM32F302xB(C)/303xB(C) devices

23 STM32F302xB(C)/303xB(C) devices

23.1 Bootloader configuration

The STM32F302xB(C)/303xB(C) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 48 shows the hardware resources used by this bootloader.

Table 48. STM32F302xB(C)/303xB(C) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

At startup, the system clock frequency is configured to 48

HSI enabled MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader
interfaces and must have one the following values: 24,
RCC
HSE enabled 18,16, 12, 9, 8, 6, 4, 3 MHz.
The PLL is used to generate the USB 48 MHz clock and
the 48 MHz clock for the system clock.
The CSS interrupt is enabled for the DFU. Any failure (or
Common to all -
removal) of the external clock generates system reset.
5 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled parity, and one stop bit. The USART2 uses its remapped
pins.
USART2 PD6 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx bootloader.

AN2606 Rev 65 117/508

507
STM32F302xB(C)/303xB(C) devices AN2606

Table 48. STM32F302xB(C)/303xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
mode.
USB_DP pin
An external pull-up resistor 1.5 KΩ must be connected to
USB_DP pin.

The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4 or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

118/508 AN2606 Rev 65

AN2606 STM32F302xB(C)/303xB(C) devices

23.2 Bootloader selection

Figure 32 shows the bootloader selection mechanism.

Figure 32. Bootloader selection for STM32F302xB(C)/303xB(C) devices

System Reset

Configure System clock to

48MHz using HSI

HSE = 24, 18, 16, 12, 9,

8, 6, 4, 3 MHz
no

yes

Reconfigure System clock

to 48MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

yes

USB configured
and cable Detected yes Execute DFU
Disable all bootloader using USB
interrupt sources interrupts
no
Configure
0x7F received USARTx
no on USARTx

Execute
BL_USART_Loop
for USARTx

MS35016V3

23.3 Bootloader version

Table 49 lists the STM32F302xB(C)/303xB(C) devices bootloader versions.

Table 49. STM32F302xB(C)/303xB(C) bootloader versions

Version number Description Known limitations

V4.1 Initial bootloader version None

AN2606 Rev 65 119/508

507
STM32F302xD(E)/303xD(E) devices AN2606

24 STM32F302xD(E)/303xD(E) devices

24.1 Bootloader configuration

The STM32F302xD(E)/303xD(E) bootloader is activated by applying Pattern 2 (described in
Table 2). Table 50 shows the hardware resources used by this bootloader.

Table 50.STM32F302xD(E)/303xD(E) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 48 MHz with HSI48 48 MHz
HSI enabled
as clock source.
The external clock can be used for all bootloader
interfaces and must have one the following values: 24, 18,
RCC HSE enabled 16, 12, 9, 8, 6, 4, 3 MHz.
The PLL is used to generate the USB 48 MHz clock and
the 48 MHz clock for the system clock.
The CSS interrupt is enabled for the DFU. Any failure (or
-
Common to all removal) of the external clock generates system reset.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
8 Kbytes, starting from address 0x1FFFD800, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
USB FS configured in forced device mode. USB FS
USB Enabled interrupt vector is enabled and used for USB DFU
communications.
PA11 pin: USB FS DM line. Used in alternate push-pull, no
DFU USB_DM pin
pull mode.
Input/output PA12 pin: USB FS DP line. Used in alternate push-pull, no
USB_DP pin pull mode. An external pull-up resistor 1.5 KΩ must be
connected to USB_DP pin.

120/508 AN2606 Rev 65

AN2606 STM32F302xD(E)/303xD(E) devices

The bootloader has two cases of operation depending on the presence of the external clock
(HSE) at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4 or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader
device.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 65 121/508

507
STM32F302xD(E)/303xD(E) devices AN2606

24.2 Bootloader selection

Figure 33. Bootloader selection for STM32F302xD(E)/303xD(E)

System Reset

Configure System clock to

48 MHz using HSI

HSE = 24, 18, 16,

12, 9, 8, 6, 4, 3 no
MHz?

yes
Reconfigure System clock to
48 MHz using HSE
System Init (Clock, GPIOs,
IWDG, SysTick)

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB FS device

USB cable
detected & USB yes
configured yes

Disable all interrupt

no sources and other
interfaces clock’s

Disable other
Configure USARTx interfaces clock’s
0x7F received on
no USARTx
Execute Execute DFU
BL_USART_Loop for bootloader using USB
USARTx interrupts

MSv36790V1

24.3 Bootloader version

Table 51. STM32F302xD(E)/303xD(E) bootloader versions
Version number Description Known limitations

V4.0 Initial bootloader version None

122/508 AN2606 Rev 65

AN2606 STM32F303x4(6/8)/334xx/328xx devices

25 STM32F303x4(6/8)/334xx/328xx devices

25.1 Bootloader configuration

The STM32F303x4(6/8)/334xx/328xx bootloader is activated by applying Pattern 2
(described in Table 2). Table 52 shows the hardware resources used by this bootloader.

Table 52. STM32F303x4(6/8)/334xx/328xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz with HSI 8 MHz

RCC HSI enabled
as clock source.
6 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware

Common to all 8 Kbytes, starting from address 0x1FFFD800, contain

System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C1 Enabled
Analog filter ON Target 7-bit address: 0b0111111x (x = 0
I2C1 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

AN2606 Rev 65 123/508

507
STM32F303x4(6/8)/334xx/328xx devices AN2606

25.2 Bootloader selection

Figure 34 shows the bootloader selection mechanism.

Figure 34. Bootloader selection for STM32F303x4(6/8)/334xx/328xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx
no

MS35029V2

25.3 Bootloader version

Table 53 lists the STM32F303x4(6/8)/334xx/328xx devices bootloader versions:

Table 53. STM32F303x4(6/8)/334xx/328xx bootloader versions

Version number Description Known limitations

V5.0 Initial bootloader version None

124/508 AN2606 Rev 65

AN2606 STM32F318xx devices

26 STM32F318xx devices

26.1 Bootloader configuration

The STM32F318xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 54 shows the hardware resources used by this bootloader.

Table 54. STM32F318xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz with HSI 8 MHz as

RCC HSI enabled
clock source.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
Common to all 8 Kbytes, starting from address 0x1FFFD800, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value,
IWDG - and periodically refreshed to prevent a reset (if the hardware
IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111101x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 125/508

507
STM32F318xx devices AN2606

Table 54. STM32F318xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0111101x (x = 0 for write and x = 1
for read) and digital filter disabled.
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB5 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

26.2 Bootloader selection

Figure 35. Bootloader selection for STM32F318xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx
no

MS35028V2

126/508 AN2606 Rev 65

AN2606 STM32F318xx devices

26.3 Bootloader version

Table 55. STM32F318xx bootloader versions
Version number Description Known limitations

V5.0 Initial bootloader version None

AN2606 Rev 65 127/508

507
STM32F358xx devices AN2606

27 STM32F358xx devices

27.1 Bootloader configuration

The STM32F358xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 56 shows the hardware resources used by this bootloader.

Table 56. STM32F358xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 8 MHz using the HSI.
5 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains
Common to all System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by the
user). Window feature is disabled.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled parity, and one stop bit. The USART2 uses its remapped
pins.
USART2 PD6 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx bootloader.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0110111x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

128/508 AN2606 Rev 65

AN2606 STM32F358xx devices

27.2 Bootloader selection

Figure 36 shows the bootloader selection mechanism.

Figure 36. Bootloader selection for STM32F358xx devices

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx
no

MS35019V2

27.3 Bootloader version

Table 57 lists the STM32F358xx devices bootloader versions.
Table 57. STM32F358xx bootloader versions
Version number Description Known limitations

For USART1 and USART2 interfaces, the maximum

V5.0 Initial bootloader version
baudrate supported by the bootloader is 57600 baud.

AN2606 Rev 65 129/508

507
STM32F373xx devices AN2606

28 STM32F373xx devices

28.1 Bootloader configuration

The STM32F373xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 58 shows the hardware resources used by this bootloader.

Table 58. STM32F373xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

At startup, the system clock frequency is configured to

HSI enabled 48 MHz using the HSI. If an external clock (HSE) is not
present, the system is kept clocked from the HSI.
The external clock can be used for all bootloader interfaces
and must have one the following values: 24, 18, 16, 12, 9, 8,
RCC
HSE enabled 6, 4, 3 MHz.
The PLL is used to generate the USB 48 MHz clock and the
48 MHz clock for the system clock.

Common to all The CSS interrupt is enabled for the DFU. Any failure (or
-
removal) of the external clock generates system reset.
5 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value and
IWDG - is periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled parity, and one stop bit. The USART2 uses its remapped
pins.
USART2 PD6 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx bootloader.

130/508 AN2606 Rev 65

AN2606 STM32F373xx devices

Table 58. STM32F373xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB used in FS mode

PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode. An external pull-up resistor 1.5 KΩ must be
connected to USB_DP pin.

There are two operation modes, depending upon the presence of the external clock (HSE)
at bootloader startup:
• If HSE is present and has a value of 24, 18, 16, 12, 9, 8, 6, 4, or 3 MHz, the system
clock is configured to 48 MHz with HSE as clock source. The DFU interface, USART1
and USART2 are functional and can be used to communicate with the bootloader.
• If HSE is not present, the HSI is kept as default clock source, and only USART1 and
USART2 are functional.
Note: The external clock (HSE) must be kept if it is connected at bootloader startup, because it is
used as system clock source.

AN2606 Rev 65 131/508

507
STM32F373xx devices AN2606

28.2 Bootloader selection

Figure 37 shows the bootloader selection mechanism.

Figure 37. Bootloader selection for STM32F373xx devices

System Reset

Configure System clock to

48MHz using HSI

HSE = 24,
18, 16, 12, 9, 8, 6, 4,
3 MHz
no

yes

Reconfigure System clock

to 48MHz using HSE

System Init (Clock, GPIOs,

System Init (Clock, GPIOs, IWDG, SysTick)
IWDG, SysTick)

Configure USB

yes

USB configured
and cable Detected Execute DFU
yes Disable all bootloader using USB
interrupt sources interrupts
no
Configure
0x7F received USARTx
no on USARTx

Execute
BL_USART_Loop
for USARTx

MS35016V4

28.3 Bootloader version

Table 59 lists the STM32F373xx devices bootloader versions.

Table 59. STM32F373xx bootloader versions

Version number Description Known limitations

V4.1 Initial bootloader version None

132/508 AN2606 Rev 65

AN2606 STM32F378xx devices

29 STM32F378xx devices

29.1 Bootloader configuration

The STM32F378xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 60 shows the hardware resources used by this bootloader.

Table 60. STM32F378xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 8 MHz using the HSI.
4 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware.
8 Kbytes, starting from address 0x1FFFD800, contains
Common to all System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value
and is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by the
user). Window feature is disabled.
Once initialized, the USART1 configuration is 8 bits, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8 bits, even
USART2 Enabled parity, and one stop bit. The USART2 uses its remapped
pins.
USART2 PD6 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx bootloader.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0110111x (x = 0 for write and x
= 1 for read).
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC. No external quartz
is required for the bootloader execution.

AN2606 Rev 65 133/508

507
STM32F378xx devices AN2606

29.2 Bootloader selection

Figure 38 shows the bootloader selection mechanism.

Figure 38. Bootloader selection for STM32F378xx devices

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

yes

I2C Address
detected yes Execute
BL_I2C_Loop for
Configure
I2Cx
USARTx
no

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx
no

MS35018V2

29.3 Bootloader version

Table 61 lists the STM32F378xx devices bootloader versions.
Table 61. STM32F378xx bootloader versions
Version number Description Known limitations

For USART1 and USART2 interfaces, the maximum

V5.0 Initial bootloader version
baudrate supported by the bootloader is 57600 baud.

134/508 AN2606 Rev 65

AN2606 STM32F398xx devices

30 STM32F398xx devices

30.1 Bootloader configuration

The STM32F398xx bootloader is activated by applying Pattern 2 (described in Table 2).
Table 62 shows the hardware resources used by this bootloader.

Table 62.STM32F398xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz with HSI 8 MHz as
RCC HSI enabled
clock source.
6 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware

Common to all 7 Kbytes, starting from address 0x1FFFD800, contain the

System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000000x (x = 0 for write and x =
1 for read).
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 135/508

507
STM32F398xx devices AN2606

Table 62.STM32F398xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, Target mode
I2C3 Enabled
– Analog filter ON
I2C3
– Target 7-bit address: 0b1000000x (x = 0 for write and x =
1 for read).
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB5 pin: data line is used in open-drain no pull mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

30.2 Bootloader selection

Figure 39 shows the bootloader selection mechanism.

Figure 39.Bootloader selection for STM32F398xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

0x7F received yes

on USARTx

Disable all interrupt

sources and other
yes
no interfaces clock’s
Disable other
interfaces clock’s Configure USARTx
I2Cx Address
no Detected
Execute
Execute BL_I2C_Loop
BL_USART_Loop
for I2Cx
for USARTx

MSv36791V1

136/508 AN2606 Rev 65

AN2606 STM32F398xx devices

30.3 Bootloader version

Table 63 lists the STM32F398xx devices bootloader versions.

Table 63. STM32F398xx bootloader versions

Version number Description Known limitations

V5.0 Initial bootloader version None

AN2606 Rev 65 137/508

507
STM32F40xxx/41xxx devices AN2606

31 STM32F40xxx/41xxx devices

31.1 Bootloader V3.x

31.1.1 Bootloader configuration

The STM32F40xxx/41xxx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 64 shows the hardware resources used by this bootloader.

Table 64. STM32F40xxx/41xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using the PLL.

The HSI clock source is used at startup (interface
HSI enabled detection phase) and when USARTx interfaces are
selected (once CAN or DFU is selected, the clock
source is derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the CAN or
HSE enabled the DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple of
1 MHz and ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs.
- Any failure (or removal) of the external clock generates
system reset.
Common to all
8 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware.
29 Kbytes, starting from address 0x1FFF 0000 contain
System memory -
the bootloader firmware.
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in byte
Power - format (half-word, word, and double-word operations
are not allowed). The voltage range can be configured
in run time using bootloader commands.
Once initialized, the USART1 configuration is 8 bits,
USART1 Enabled
even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode

138/508 AN2606 Rev 65

AN2606 STM32F40xxx/41xxx devices

Table 64. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART3 configuration is 8 bits,

USART3 Enabled
even parity, and one stop bit.
USART3 (on PB11 pin: USART3 in reception mode. Used in input
USART3_RX pin Input
PB10/PB11) pull-up mode.
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Once initialized, the USART3 configuration is 8 bits,
USART3 Enabled
even parity, and one stop bit.
USART3 (on PC11 pin: USART3 in reception mode. used in input
USART3_RX pin Input
PC10/PC11) pull-up mode.
PC10 pin: USART3 in transmission mode. used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx.
Once initialized, the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the communication
between CAN2 and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in
CAN2_TX pin Output
alternate push-pull, pull-up mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
DFU mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required
This timer is used to determine the value of the HSE.
CAN2 and
TIM11 Enabled Once the HSE frequency is determined, the system
DFUs
clock is configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx. This
internal clock is also used for CAN and DFU (USB FS device), but only for the selection
phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is required for CAN
and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystals (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 65 139/508

507
STM32F40xxx/41xxx devices AN2606

31.1.2 Bootloader selection

Figure 40 shows the bootloader selection mechanism.

Figure 40. Bootloader V3.x selection for STM32F40xxx/41xxx devices

System Reset

yes Disable all

System Init (Clock, GPIOs,
interrupt sources
IWDG, SysTick)

Configure
Configure USB OTG FS
USARTx
device

Execute
0x7F received on BL_USART_Loop
USARTx for USARTx

yes
no

Frame detected HSE detected

no
on CANx pin yes

yes

no no HSE detected no Disable all

interrupt sources
Generate System
USB cable
yes reset Reconfigure System
Detected
clock to 60MHz
Reconfigure System
clock to 60MHz and
Configure CAN
USB clock to 48 MHz

Execute
Execute DFU BL_CAN_Loop for
bootloader using USB CANx
interrupts

MS35012V3

140/508 AN2606 Rev 65

AN2606 STM32F40xxx/41xxx devices

31.1.3 Bootloader version

Table 65 lists the STM32F40xxx/41xxx devices V3.x bootloader versions:

Table 65. STM32F40xxx/41xxx bootloader V3.x versions

Version
Description Known limitations
number

– When a Read Memory command or Write Memory command is issued

with an unsupported memory address and a correct address checksum
(i.e. address 0x6000 0000), the command is aborted by the bootloader
device, but the NACK (0x1F) is not sent to the host. As a result, the
next two bytes (which are the number of bytes to be read/written and
V3.0 Initial bootloader version its checksum) are considered as a new command and its checksum(1).
– Option bytes, OTP and Device Feature descriptors (in DFU interface)
are set to “g” instead of “e” (not erasable memory areas).
After executing Go command (jump to user code) the bootloader resets
AHB1ENR value to 0x0000 0000 and thus CCM RAM, when present, is
not active (must be re-enabled by user code at startup)
– For the USART interface, two consecutive NACKs (instead of 1 NACK)
are sent when a Read Memory or Write Memory command is sent and
the RDP level is active.
– Fix V3.0 limitations – For the CAN interface, the Write Unprotect command is not functional.
V3.1 – DFU interface robustness Use Write Memory command and write directly to the option bytes in
enhancement order to disable the write protection.
After executing Go command (jump to user code) the bootloader resets
AHB1ENR value to 0x0000 0000 and thus CCM RAM, when present, is
not active (must be re-enabled by user code at startup)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code (0x00, 0x01, 0x02, 0x11, 0x21,
0x31, 0x43, 0x44, 0x63, 0x73, 0x82 or 0x92), the limitation is not perceived from the host, as the command is NACK-ed
anyway (as an unsupported new command).

31.2 Bootloader V9.x

31.2.1 Bootloader configuration

The STM32F40xxx/41xxx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 66 shows the hardware resources used by this bootloader.
Note: The bootloader version V9.0 is embedded only in STM32F405xx/415xx devices in
WLCSP90 package.
Version V9.1 is populated in all packages of the product.

AN2606 Rev 65 141/508

507
STM32F40xxx/41xxx devices AN2606

Table 66. STM32F40xxx/41xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz using the PLL.
The HSI clock source is used at startup (interface detection
HSI enabled phase) and when USART or SPI or I2C interfaces are
selected (once CAN or DFU is selected, the clock source is
derived from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the CAN or the
HSE enabled DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple of
1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates system
Common to all reset.
12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed).
The voltage range can be configured in run time using
bootloader commands.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
USART3 (on
PB11 pin: USART3 in reception mode. Used in input pull-up
PB10/PB11) USART3_RX pin Input
mode.
USART3_TX pin Output PB10 pin: USART3 in transmission mode
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
USART3 (on PC11 pin: USART3 in reception mode. Used in input pull-up
USART3_RX pin Input
PC10/PC11) mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

142/508 AN2606 Rev 65

AN2606 STM32F40xxx/41xxx devices

Table 66. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C2_SCL pin PF1 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC9 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 143/508

507
STM32F40xxx/41xxx devices AN2606

Table 66. STM32F40xxx/41xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz, Polarity: CPOL low, CPHA low,
– NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin PA5 pin: slave clock line, used in push-pull, pull-down mode
Input PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz, Polarity: CPOL low, CPHA low,
– NSS hardware.
SPI2 PI3 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
PI2 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PI1 pin: slave clock line, used in push-pull, pull-down mode
PI0 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
DFU mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
CAN2 and
TIM11 Enabled the HSE frequency is determined, the system clock is
DFUs
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS device),
but only for the selection phase. An external clock multiple of 1 MHz (between 4 and
26 MHz) is required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

144/508 AN2606 Rev 65

AN2606 STM32F40xxx/41xxx devices

31.2.2 Bootloader selection

Figure 41. Bootloader V9.x selection for STM32F40xxx/41xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device

Configure I2Cx Disable all

interrupt sources

Configure SPIx yes Configure

USARTx

Execute
0x7F received on
USARTx BL_USART_Loo
p for USARTx

no yes

Frame detected
on CANx no HSE detected

yes
no HSE detected no

Generate System
yes
Yes reset
USB cable
Detected
Reconfigure System
clock to 60MHz and Disable all
Disable all interrupt USB clock to 48 MHz interrupt sources
no sources
no
yes
Reconfigure System
Execute DFU clock to 60MHz
Execute
I2Cx Address BL_I2C_Loop for bootloader using
Detected I2Cx USB interrupts
Configure CAN

yes
no Execute
Disable all BL_CAN_Loop for
interrupt sources CANx
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35012V2

AN2606 Rev 65 145/508

507
STM32F40xxx/41xxx devices AN2606

31.2.3 Bootloader version

Table 67 lists the STM32F40xxx/41xxx devices V9.x bootloader versions.

Table 67. STM32F40xxx/41xxx bootloader V9.x versions

Version
Description Known limitations
number

This bootloader is an updated – For the USART interface, two consecutive NACKs (instead of
version of bootloader v3.1. 1 NACK) are sent when a Read Memory or Write Memory
command is sent and the RDP level is active.
This new version of bootloader
supports I2C1, I2C2, I2C3, SPI1 – For the CAN interface, the Write Unprotect command is not
and SPI2 interfaces. functional. Use Write Memory command and write directly to
V9.0
the option bytes in order to disable the write protection.
The RAM used by this bootloader is
increased from 8 to 12 Kb. After executing Go command (jump to user code) the
bootloader resets AHB1ENR value to 0x0000 0000 and thus
The ID of this bootloader is 0x90.
CCM RAM, when present, is not active (must be re-enabled by
The connection time is increased. user code at startup)
This bootloader is an updated
version of bootloader v9.0 that will
be populated in all packages even
V9.1 the one embedding the V3.1 None
bootloader version.
It contains fixes of the known
limitations of the V9.0

146/508 AN2606 Rev 65

AN2606 STM32F401xB(C) devices

32 STM32F401xB(C) devices

32.1 Bootloader configuration

The STM32F401xB(C) bootloader is activated by applying Pattern 1 (described in Table 2).
Table 68 shows the hardware resources used by this bootloader.

Table 68. STM32F401xB(C) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the PLL.

The HSI clock source is used at startup (interface detection
HSI enabled phase) and when USART or SPI or I2C interface is selected
(once DFU is selected, the clock source is derived from the
external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the DFU (USB FS
HSE enabled device) interface is selected. The external clock must
provide a frequency multiple of 1 MHz and ranging from 4 to
26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates system
Common to all reset.
12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
IWDG - is periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed).
The voltage range can be configured in run time using
bootloader commands.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PD6 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PD5 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.

AN2606 Rev 65 147/508

507
STM32F401xB(C) devices AN2606

Table 68. STM32F401xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Used to automatically detect the serial baud rate from the

USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB3 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0111010x (x = 0 for write and x = 1
for read).
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin PA5 pin: slave clock line, used in push-pull, pull-down mode
Input PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin
mode.

148/508 AN2606 Rev 65

AN2606 STM32F401xB(C) devices

Table 68. STM32F401xB(C) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2 SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin
mode
Input
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull, pull-down
SPI3 SPI3_MOSI pin Input
mode
PC11 pin: slave data output line, used in push-pull, pull-
SPI3_MISO pin Output
down mode
PC10 pin: slave clock line, used in push-pull, pull-down
SPI3_SCK pin
mode
Input
PA15 pin: slave chip select pin used in push-pull, pull-down
SPI3_NSS pin
mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output
DFU PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
TIM11 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS device),
but only for the selection phase. An external clock, multiple of 1 MHz (between 4 and
26 MHz), is required for CAN and DFU execution after the selection phase.

AN2606 Rev 65 149/508

507
STM32F401xB(C) devices AN2606

Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

32.2 Bootloader selection

Figure 42. Bootloader selection for STM32F401xB(C)

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received on
USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35030V1

150/508 AN2606 Rev 65

AN2606 STM32F401xB(C) devices

32.3 Bootloader version

Table 69. STM32F401xB(C) bootloader versions
Version number Description Known limitations

– After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
0000 and thus CCM RAM, when present, is not
V13.0 Initial bootloader version active (must be re-enabled by user code at startup)
– The bootloader does not support the reset of
SPRMOD bit during RDP regression

AN2606 Rev 65 151/508

507
STM32F401xD(E) devices AN2606

33 STM32F401xD(E) devices

33.1 Bootloader configuration

The STM32F401xD(E) bootloader is activated by applying Pattern 1 (described in Table 2).
Table 70 shows the hardware resources used by this bootloader.

Table 70. STM32F401xD(E) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The system clock frequency is 60 MHz using the PLL.
The HSI clock source is used at startup (interface detection
HSI enabled phase) and when USART or SPI or I2C interface is
selected (once DFU is selected, the clock source is
derived from the external crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when the DFU (USB
HSE enabled FS device) interface is selected.
The external clock must provide a frequency multiple of
1 MHz, ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the DFU. Any failure (or
-
removal) of the external clock generates system reset.
Common to all 12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Voltage range is set to 1.62 V, 2.1 V. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed).
The voltage range can be configured in run time using
bootloader commands.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PD6 pin: USART2 in reception mode. Used in pull-up
USART2 USART2_RX pin Input
mode.
PD5 pin: USART2 in transmission mode. Used in pull-up
USART2_TX pin Output
mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

152/508 AN2606 Rev 65

AN2606 STM32F401xD(E) devices

Table 70. STM32F401xD(E) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x =
1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x =
1 for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB3 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x =
1 for read)
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.

AN2606 Rev 65 153/508

507
STM32F401xD(E) devices AN2606

Table 70. STM32F401xD(E) configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI2 PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
SPI2_NSS pin Input
down mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI3 PC12 pin: slave data input line, used in push-pull, pull-
SPI3_MOSI pin Input
down mode
PC11 pin: slave data output line, used in push-pull, pull-
SPI3_MISO pin Output
down mode
PC10 pin: slave clock line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PA15 pin: slave chip select pin used in push-pull, pull-down
SPI3_NSS pin Input
mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
DFU USB_DP pin mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
TIM11 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx,
and SPIx bootloaders. This internal clock is also used for DFU (USB FS device), but only for
the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

154/508 AN2606 Rev 65

AN2606 STM32F401xD(E) devices

33.2 Bootloader selection

Figure 43 shows the bootloader selection mechanism.

Figure 43. Bootloader selection for STM32F401xD(E)

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received
on USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx
MS35031V1

AN2606 Rev 65 155/508

507
STM32F401xD(E) devices AN2606

33.3 Bootloader version

Table 71 lists the STM32F401xD(E) devices bootloader version.

Table 71. STM32F401xD(E) bootloader versions

Version
Description Known limitations
number

After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
V13.1 Initial bootloader version
0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup)

156/508 AN2606 Rev 65

AN2606 STM32F410xx devices

34 STM32F410xx devices

34.1 Bootloader configuration

The STM32F410xx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 72 shows the hardware resources used by this bootloader.

Table 72. STM32F410xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

RCC HSI enabled configured to 60 MHz and for USART and I2C bootloader
operation.
5 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware

Common to all The IWDG prescaler is configured to its maximum value. It is

IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The voltage range is [1.8V, 3.6V]. In this range:
– Flash wait states: 3.
– System clock frequency 60 MHz.
Power -
– ART Accelerator enabled.
– Flash write operation by byte (refer to bootloader memory
management section for more information).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

AN2606 Rev 65 157/508

507
STM32F410xx devices AN2606

Table 72. STM32F410xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000111x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1000111x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain no pull mode.
The I2C4 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C4 Enabled – Target mode
– Analog filter ON
– Target 7-bit address: 0b1000111x (x = 0 for write and x = 1
for read)
I2C4 PB15 pin: clock line is used in open-drain no pull mode for
STM32F410Cx/Rx devices.
I2C4_SCL pin Input/output
PB10 pin: clock line is used in open-drain no pull mode for
STM32F410Tx devices.
PB14 pin: data line is used in open-drain no pull mode for
STM32F410Cx/Rx devices.
I2C4_SDA pin Input/output
PB3 pin: data line is used in open-drain no pull mode for
STM32F410Tx devices.

158/508 AN2606 Rev 65

AN2606 STM32F410xx devices

Table 72. STM32F410xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
mode for STM32F410Cx/Rx devices.
SPI1_MOSI pin Input
PB5 pin: slave data input line, used in push-pull, pull-down
SPI1 mode for STM32F410Tx devices.
PA6 pin: slave data output line, used in push-pull, pull-down
mode for STM32F410Cx/Rx devices.
SPI1_MISO pin Output
PB4 pin: slave data output line, used in push-pull, pull-down
mode for STM32F410Tx devices.
SPI1_SCK pin PA5 pin: slave clock line, used in push-pull, pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-up mode
Input for STM32F410Cx/Rx devices.
SPI1_NSS pin
PA15 pin: slave chip select pin used in push-pull, pull-down
mode for STM32F410Tx devices.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PC3 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
PC2 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 65 159/508

507
STM32F410xx devices AN2606

34.2 Bootloader selection

Figure 44 shows the bootloader selection mechanism.

Figure 44.Bootloader V11.x selection for STM32F410xx

System Reset

Disable all interrupt

sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
Detected

no Disable all other

Disable all other Disable all other interfaces clocks
interfaces clocks interfaces clocks

Configure USARTx
SPIx detects Synchro yes
mechanism

Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx
no

MSv38431V2

160/508 AN2606 Rev 65

AN2606 STM32F410xx devices

34.3 Bootloader version

Table 73 lists the STM32F410xx devices bootloader V11.x versions.

Table 73. STM32F410xx bootloader V11.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V11.0 Initial bootloader version
and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)
After executing Go command (jump to user code) the
Support I2C4 and SPI1 for bootloader resets AHB1ENR value to 0x0000 0000
V11.1
STM32F410Tx devices and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)

AN2606 Rev 65 161/508

507
STM32F411xx devices AN2606

35 STM32F411xx devices

35.1 Bootloader configuration

The STM32F411xx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 74 shows the hardware resources used by this bootloader.

Table 74. STM32F411xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the PLL.

The HSI clock source is used at startup (interface detection
HSI enabled phase) and when USART or SPI or I2C interface is selected
(once DFU is selected, the clock source is derived from the
external crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when the DFU (USB FS
HSE enabled device) interface is selected.
The external clock must provide a frequency multiple of 1 MHz
and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the DFU. Any failure (or
-
Common to removal) of the external clock generates system reset.
all 12 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the hard-
ware IWDG option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range internal
flash write operations are allowed only in byte format (half-
Power - word, word, and double-word operations are not allowed). The
voltage range can be configured in run time using bootloader
commands.
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PD6 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PD5 pin: USART2 in transmission mode. Used in input pull-up
USART2_TX pin Output
mode.

162/508 AN2606 Rev 65

AN2606 STM32F411xx devices

Table 74. STM32F411xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Used to automatically detect the serial baud rate from the host
USARTx SysTick timer Enabled
for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x = 1 for
read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x = 1 for
read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB3 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0111001x (x = 0 for write and x = 1 for
read)
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.

AN2606 Rev 65 163/508

507
STM32F411xx devices AN2606

Table 74. STM32F411xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
SPI2 PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
SPI3 PC12 pin: slave data input line, used in push-pull, pull-down
SPI3_MOSI pin Input
mode
PC11 pin: slave data output line, used in push-pull, pull-down
SPI3_MISO pin Output
mode
SPI3_SCK pin Input PC10 pin: slave clock line, used in push-pull, pull-down mode
PA15 pin: slave chip select pin used in push-pull, pull-down
SPI3_NSS pin Input
mode.
USB Enabled USB OTG FS configured in forced device mode
USB_DM pin PA11: USB DM line. Used in alternate push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull mode.
DFU USB_DP pin
No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once the
TIM11 Enabled HSE frequency is determined, the system clock is configured to
60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

164/508 AN2606 Rev 65

AN2606 STM32F411xx devices

35.2 Bootloader selection

Figure 45 shows the bootloader selection mechanism.

Figure 45. Bootloader selection for STM32F411xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device
Disable all
interrupt sources
Configure I2Cx
Configure
USARTx
yes
Configure SPIx
Execute
BL_USART_Loop
for USARTx
0x7F received on
USARTx

no

USB cable HSE detected no

yes
Detected
yes Generate System
Yes reset
no Disable all
interrupt sources
Reconfigure System
clock to 60MHz and
I2Cx Address USB clock to 48 MHz
Execute
Detected BL_I2C_Loop for
no I2Cx
Execute DFU
yes bootloader using USB
no
interrupts
Disable all
interrupt sources
SPIx detects
Synchro
mechanism Execute
BL_SPI_Loop for
SPIx MS35032V1

AN2606 Rev 65 165/508

507
STM32F411xx devices AN2606

35.3 Bootloader version

The following table lists the STM32F411xx devices bootloader version.

Table 75. STM32F411xx bootloader versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V13.0 Initial bootloader version
and thus CCM RAM, when present, is not active
(must be re-enabled by user code at startup)

166/508 AN2606 Rev 65

AN2606 STM32F412xx devices

36 STM32F412xx devices

36.1 Bootloader configuration

The STM32F412xx bootloader is activated by applying Pattern 1 (described in Table 2).
Table 76 shows the hardware resources used by this bootloader.

Table 76.STM32F412xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 60 MHz and for USART and I2C bootloader
operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system clock
RCC HSE enabled is configured to 60 MHz with HSE as clock source. The HSE
frequency must be a multiple of 1 MHz, ranging from 4 to 26
MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates a system
reset.
16 Kbytes, starting from address 0x20000000, are used by
Common to all RAM -
the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The voltage range is [1.8V, 3.6V]. In this range:
– Flash wait states: 3.
– System clock frequency 60 MHz.
Power -
– ART Accelerator enabled.
– Flash write operation by byte (refer to bootloader memory
management section for more information).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PD6 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PD5 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.

AN2606 Rev 65 167/508

507
STM32F412xx devices AN2606

Table 76.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PB11 pin: USART3 in reception mode. Used in input pull-up
USART3 USART3_RX pin Input
mode.
PB10 pin: USART3 in transmission mode. Used in input pull-
USART3_TX pin Output
up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
Once initialized the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between CAN2
and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000110x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1000110x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PF1 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PF0 pin: data line is used in open-drain no pull mode.

168/508 AN2606 Rev 65

AN2606 STM32F412xx devices

Table 76.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1000110x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain no pull mode.
The I2C4 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C4 Enabled – Target mode
I2C4 – Analog filter ON
– Target 7-bit address: 0b1000110x (x = 0 for write and x = 1
for read)
I2C4_SCL pin PB15 pin: clock line is used in open-drain no pull mode.
Input/output
I2C4_SDA pin PB14 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin PA5 pin: slave clock line, used in push-pull, pull-down mode
Input
SPI1_NSS pin PA4 pin: slave chip select pin used in push-pull, pull-up mode.

AN2606 Rev 65 169/508

507
STM32F412xx devices AN2606

Table 76.STM32F412xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PC12 pin: slave data input line, used in push-pull, pull-down
SPI3_MOSI pin Input
mode
PC11 pin: slave data output line, used in push-pull, pull-down
SPI3_MISO pin Output
mode
SPI3_SCK pin PC10 pin: slave clock line, used in push-pull, pull-down mode
Input PA15 pin: slave chip select pin used in push-pull, pull-up
SPI3_NSS pin
mode.
The SPI4 configuration is:
– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI4 PE14 pin: slave data input line, used in push-pull, pull-down
SPI4_MOSI pin Input
mode
PE13 pin: slave data output line, used in push-pull, pull-down
SPI4_MISO pin Output
mode
SP4_SCK pin PE12 pin: slave clock line, used in push-pull, pull-down mode
Input PE11 pin: slave chip select pin used in push-pull, pull-up
SPI4_NSS pin
mode.
USB Enabled USB OTG FS configured in forced device mode
PA11 pin: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
DFU mode.
Input/output
PA12 pin: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required.
This timer is used to determine the value of the HSE. Once
CAN2 and
TIM11 Enabled HSE frequency is determined, the system clock is configured
DFUs
to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

170/508 AN2606 Rev 65

AN2606 STM32F412xx devices

36.2 Bootloader selection

Figure 46 shows the bootloader selection mechanism.

Figure 46.Bootloader V9.x selection for STM32F412xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx

no
yes

I2Cx Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CANx
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CANx

MSv38454V2

AN2606 Rev 65 171/508

507
STM32F412xx devices AN2606

36.3 Bootloader version

The following table lists the STM32F412xx devices bootloader V9.x versions.

Table 77. STM32F412xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code)

the bootloader resets AHB1ENR value to 0x0000
V9.0 Initial bootloader version 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)
After executing Go command (jump to user code)
the bootloader resets AHB1ENR value to 0x0000
V9.1 Fix USART3 interface pinout 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at
startup)

172/508 AN2606 Rev 65

AN2606 STM32F413xx/423xx devices

37 STM32F413xx/423xx devices

37.1 Bootloader configuration

The STM32F413xx/423xx bootloader is activated by applying Pattern 1 (described in
Table 2h). The following table shows the hardware resources used by this bootloader.

Table 78. STM32F413xx/423xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system
RCC HSE enabled clock configured to 60 MHz with HSE as clock source.
The HSE frequency must be multiple of 1 MHz and
ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates
system reset.
16 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
Common to all
60 Kbytes, starting from address 0x1FF00000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by the
user).
The voltage range is [1.8V, 3.6V]
In this range:
– Flash wait states 4.
Power - – System clock frequency 60 MHz.
– ART Accelerator enabled.
– Flash write operation by byte (refer to Bootloader
memory management for more information).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PD6 pin: USART2 in reception mode. Used in input pull-
USART2 USART2_RX pin Input
up mode.
PD5 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.

AN2606 Rev 65 173/508

507
STM32F413xx/423xx devices AN2606

Table 78. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PB11 pin: USART3 in reception mode. Used in input pull-
USART3 USART3_RX pin Input
up mode.
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the communication
CAN2 between CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
I2C1 Target 7-bit address: 0b1001011x (x = 0 for write and x =
1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
I2C2 Target 7-bit address: 0b1001011x (x = 0 for write and x =
1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
I2C3 Target 7-bit address: 0b1001011x (x = 0 for write and x =
1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PB4 pin: data line is used in open-drain no pull mode.

174/508 AN2606 Rev 65

AN2606 STM32F413xx/423xx devices

Table 78. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C4 Enabled Analog filter ON
I2C4 Target 7-bit address: 0b1001011x (x = 0 for write and x =
1 for read)
I2C4_SCL pin Input/output PB15 pin: clock line is used in open-drain no pull mode.
I2C4_SDA pin Input/output PB14 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
SPI1 Enabled – Full Duplex
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1_MOSI pin Input
SPI1 down mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
SPI3 Enabled – Full Duplex
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull, pull-
SPI3_MOSI pin Input
SPI3 down mode
PC11 pin: slave data output line, used in push-pull, pull-
SPI3_MISO pin Output
down mode
PC10 pin: slave clock line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PA15 pin: slave chip select pin used in push-pull, pull-
SPI3_NSS pin Input
down mode.

AN2606 Rev 65 175/508

507
STM32F413xx/423xx devices AN2606

Table 78. STM32F413xx/423xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI4 configuration is:
– Slave mode
SPI4 Enabled – Full Duplex
– 8-bit MSB, speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull, pull-
SPI4_MOSI pin Input
SPI4 down mode
PE13 pin: slave data output line, used in push-pull, pull-
SPI4_MISO pin Output
down mode
PE12 pin: slave clock line, used in push-pull, pull-down
SP4_SCK pin Input
mode
PE11 pin: slave chip select pin used in push-pull, pull-
SPI4_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
DFU
Input/output PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and
TIM11 Enabled Once HSE frequency is determined, the system clock is
DFUs
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

176/508 AN2606 Rev 65

AN2606 STM32F413xx/423xx devices

37.2 Bootloader selection

Figure 47 shows the bootloader selection mechanism.

Figure 47.Bootloader V9.x selection for STM32F413xx/423xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx

no
yes

I2C Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CAN
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CAN2

MSv42229V1

AN2606 Rev 65 177/508

507
STM32F413xx/423xx devices AN2606

37.3 Bootloader version

The following table lists the STM32F413xx/423xx devices bootloader V9.x versions.

Table 79. STM32F413xx/423xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)

178/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

38 STM32F42xxx/43xxx devices

38.1 Bootloader V7.x

38.1.1 Bootloader configuration

The STM32F42xxx/43xxx bootloader is activated by applying Pattern 5 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 80. STM32F42xxx/43xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz using

the PLL.
The HSI clock source is used at startup
HSI enabled (interface detection phase) and when USART
or I2C interfaces are selected (once CAN or
DFU is selected, the clock source is derived
from the external crystal).
The system clock frequency is 60 MHz.
RCC The HSE clock source is used only when the
CAN or the DFU (USB FS device) interfaces
HSE enabled are selected.
The external clock must provide a frequency
multiple of 1 MHz and ranging from 4 MHz to
26 MHz.
The CSS interrupt is enabled for the CAN and
Common to all - DFUs. Any failure (or removal) of the external
clock /generates system reset.
8 Kbytes, starting from address 0x20000000,
RAM -
are used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed to
IWDG -
prevent watchdog reset (if the hardware IWDG
option was previously enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this
range internal flash write operations are
allowed only in byte format (half-word, word,
Power -
and double-word operations are not allowed).
The voltage range can be configured in run
time using bootloader commands.

AN2606 Rev 65 179/508

507
STM32F42xxx/43xxx devices AN2606

Table 80. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8 bits,

USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
input no pull mode.
PA9 pin: USART1 in transmission mode. Used
USART1_TX pin Output
in input no pull mode.
Once initialized, the configuration is 8 bits,
USART3 Enabled
even parity, and one stop bit
USART3 PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PB10/PB11) input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized, the configuration is 8 bits,
USART3 Enabled
even parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
(on PC10/PC11) input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host for USARTx.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because CAN1 manages
the communication between CAN2 and
CAN2 SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used
CAN2_TX pin Output
in alternate push pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Slave
I2C1 Enabled
mode, Analog filter ON Target 7-bit address:
0b0111000x (x = 0 for write and x = 1 for read).
I2C1
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB9 pin: data line is used in open-drain no pull
I2C1_SDA pin Input/output
mode.

180/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

Table 80. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB OTG FS configured in forced device

USB Enabled
mode
PA11: USB DM line. Used in alternate push
USB_DM pin
DFU pull no pull mode.
Input/output PA12: USB DP line. Used in alternate push
USB_DP pin pull no pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the
HSE. Once the HSE frequency is determined,
CAN2 and DFUs TIM11 Enabled
the system clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 65 181/508

507
STM32F42xxx/43xxx devices AN2606

38.1.2 Bootloader selection

Figure 48 and Figure 49 show the bootloader selection mechanism.

Figure 48. Dual bank boot implementation for STM32F42xxx/43xxx Bootloader V7.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

1. CCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

182/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

Figure 49. Bootloader V7.x selection for STM32F42xxx/43xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS Disable all

yes
device interrupt sources

Configure
Configure I2Cx USARTx

Execute
0x7F received BL_USART_Loop
on USARTx for USARTx

yes
no
Execute
BL_I2C_Loop for
I2Cx
I2C Address
Detected yes

HSE detected
no no

yes yes
Frame detected
no on CANx HSE detected no Disable all
interrupt sources
Generate System
no yes reset
Reconfigure System
clock to 60MHz
Reconfigure System
USB cable clock to 60MHz and
Detected USB clock to 48 MHz Configure CAN

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MS35022V1

AN2606 Rev 65 183/508

507
STM32F42xxx/43xxx devices AN2606

38.1.3 Bootloader version

The following table lists the STM32F42xxx/43xxx devices bootloader V7.x versions.
.

Table 81. STM32F42xxx/43xxx bootloader V7.x versions

Version
Description Known limitations
number

For the CAN interface, the Write Unprotect

command is not functional. Use Write Memory
command and write directly to the option bytes to
disable the write protection.
For the USB DFU interface, in Dual Bank mode, the
Erase operation is not functional for the second
V7.0 Initial bootloader version
bank. Return to Single Bank mode, erase desired
sector(s) and then reactivate the Dual Bank mode.
After executing Go command (jump to user code)
the bootloader resets AHB1ENR value to 0x0000
0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup).

184/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

38.2 Bootloader V9.x

38.2.1 Bootloader configuration

The STM32F42xxx/43xxx bootloader is activated by applying Pattern 5 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 82. STM32F42xxx/43xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz using the PLL.

The HSI clock source is used at startup (interface
detection phase) and when USART or SPI or I2C
HSI enabled
interfaces are selected (once CAN or DFU is
selected, the clock source is derived from the
external crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when the CAN or
HSE enabled the DFU (USB FS device) interfaces are selected.
The external clock must provide a frequency multiple
of 1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs.
- Any failure (or removal) of the external clock
Common to all generates system reset.
12 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
29 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In this range
internal flash write operations are allowed only in byte
Power - format (half-word, word, and double-word operations
are not allowed). The voltage range can be
configured in run time using bootloader commands.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in input
USART1 USART1_RX pin Input
no pull mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
input no pull mode.

AN2606 Rev 65 185/508

507
STM32F42xxx/43xxx devices AN2606

Table 82. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity,

USART3 Enabled
and one stop bit
USART3 PB11 pin: USART3 in reception mode. Used in input
USART3_RX pin Input
(on PB10/PB11) pull-up mode.
PB10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
input pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit.
USART3
(on PC10/PC11) USART3_RX pin Input PC11 pin: USART3 in reception mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode.
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx.
Once initialized the CAN2 configuration is: Baudrate
125 kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader
execution because CAN1 manages the
communication between CAN2 and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate
CAN2_RX pin Input
push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in
CAN2_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target
I2C1 Enabled
mode, Analog filter ON Target 7-bit address:
I2C1 0b0111000x (x = 0 for write and x = 1 for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target
I2C2 Enabled
mode, Analog filter ON Target 7-bit address:
I2C2 0b0111000x (x = 0 for write and x = 1 for read).
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target
I2C3 Enabled
mode, Analog filter ON Target 7-bit address:
I2C3 0b0111000x (x = 0 for write and x = 1 for read).
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain mode.

186/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

Table 82. STM32F42xxx/43xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

SPI1 Enabled Slave mode, Full Duplex, -bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1 PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.
The SPI2 configuration is:
SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2 PI2 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PI1 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PI0 pin: slave chip select pin used in push-pull, pull-
SPI2_NSS pin Input
down mode.
The SPI4 configuration is:
SPI4 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
MHz, Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull,
SPI4_MOSI pin Input
pull-down mode
SPI4 PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
pull-down mode
PE12 pin: slave clock line, used in push-pull, pull-
SP4_SCK pin Input
down mode
PE11 pin: slave chip select pin used in push-pull, pull-
SPI4_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode
PA11: USB DM line. Used in alternate push-pull no
USB_DM pin
pull mode.
DFU
Input/output PA12: USB DP line. Used in alternate push-pull no
USB_DP pin pull mode.
No external pull-up resistor is required
This timer is used to determine the value of the HSE.
CAN2 and DFUs TIM11 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

AN2606 Rev 65 187/508

507
STM32F42xxx/43xxx devices AN2606

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS
device), but only for the selection phase. An external clock multiple of 1 MHz (between 4
and 26 MHz) is required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

188/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

38.2.2 Bootloader selection

Figure 50 and Figure 51 show the bootloader selection mechanism.

Figure 50. Dual bank boot implementation for STM32F42xxx/43xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1) Protection level2
no
Set Bank Swap to enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35023V1

1. CCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

AN2606 Rev 65 189/508

507
STM32F42xxx/43xxx devices AN2606

Figure 51. Bootloader V9.x selection for STM32F42xxx/43xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

device

Disable all interrupt

sources
Configure I2Cx
yes
Configure USARTx
Configure SPIx

Execute
BL_USART_Loop for
0x7F received USARTx
on USARTx

no Execute
BL_I2C_Loop for
yes
I2Cx
I2C Address
Detected

Execute
no
yes BL_SPI_Loop for
SPIx
Synchro
mechanism detected
on SPIx yes

no HSE detected
no
HSE detected
Frame detected yes
no yes no
on CANx
Disable all interrupt
sources
yes
no Generate System
reset
Reconfigure System clock
Reconfigure System to 60MHz
USB cable clock to 60MHz and
Detected USB clock to 48 MHz
Configure CAN

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MS35024V1

190/508 AN2606 Rev 65

AN2606 STM32F42xxx/43xxx devices

38.2.3 Bootloader version

Table 83 lists the STM32F42xxx/43xxx devices bootloader V9.x versions.

Table 83. STM32F42xxx/43xxx bootloader V9.x versions

Version
Description Known limitations
number

This bootloader is an updated

For the USB DFU interface, in Dual Bank mode, the
version of bootloader v7.0.
Erase operation is not functional for the second
This new version of bootloader
bank. Return to Single Bank mode, erase desired
supports I2C2, I2C3, SPI1, SPI2,
sector(s) and then reactivate the Dual Bank mode.
V9.0 and SPI4 interfaces.
The RAM used by this bootloader After executing Go command (jump to user code)
is increased from 8 Kb to 12 Kb. the bootloader resets AHB1ENR value to 0x0000
The ID of this bootloader is 0x90 0000 and thus CCM RAM, when present, is not
The connection time is increased. active (must be re-enabled by user code at startup)

For the CAN interface, the Write Unprotect

This bootloader is an updated command is not functional. Use Write Memory
version of bootloader v9.0. This command and write directly to the option bytes in
new version implements the new order to disable the write protection.
I2C No-stretch commands (I2C For the USB DFU interface, in Dual Bank mode, the
protocol v1.1) and the capability of Erase operation is not functional for the second
V9.1
disabling PcROP when RDP1 is bank. Return to Single Bank mode, erase desired
enabled with ReadOutUnprotect sector(s) and then reactivate the Dual Bank mode.
command for all protocols(USB, After executing Go command (jump to user code)
USART, CAN, I2C and SPI). The the bootloader resets AHB1ENR value to 0x0000
ID of this bootloader is 0x91 0000 and thus CCM RAM, when present, is not
active (must be re-enabled by user code at startup)

AN2606 Rev 65 191/508

507
STM32F446xx devices AN2606

39 STM32F446xx devices

39.1 Bootloader configuration

The STM32F446xx bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 84.STM32F446xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source

for system clock configured to 60 MHz and
HSI enabled
for USART, I2C and SPI bootloader
operation.
The HSE is used only when the CAN or the
DFU (USB FS device) interfaces are
selected. In this case the system clock
RCC
HSE enabled configured to 60 MHz with HSE as clock
source.
The HSE frequency must be multiple of
1 MHz and ranging from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN
- and DFUs. Any failure (or removal) of the
external clock generates system reset.
12 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware
Common to all
29 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically refreshed
IWDG - to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the
user).
The voltage range is [1.71 V, 3.6 V].
In this range:
- Flash wait states: 3.
- System Clock 60 MHz.
Power -
- Prefetch disabled.
- Flash write operation by byte (refer to
section bootloader memory management
for more information).

192/508 AN2606 Rev 65

AN2606 STM32F446xx devices

Table 84.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit,

USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode.
Once initialized, the configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3 (on PB11 pin: USART3 in reception mode.
USART3_RX pin Input
PB10/PB11) Used in input pull-up mode.
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized, the configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3 (on PC11 pin: USART3 in reception mode.
USART3_RX pin Input
PC10/PC11) Used in input pull-up mode
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host for USARTx.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because in CAN1
manages the communication between
CAN2 CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in
CAN2_RX pin Input
alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode.
CAN2_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C1 Enabled Target mode, Analog filter ON
Target 7-bit address: 0b0111100x
I2C1 (x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain no
I2C1_SCL pin Input/output
pull mode.
PB9 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.

AN2606 Rev 65 193/508

507
STM32F446xx devices AN2606

Table 84.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C2 Enabled Target mode, Analog filter ON
Target 7-bit address: 0b0111100x
I2C2 (x = 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-drain no
I2C2_SCL pin Input/output
pull mode.
PF0 pin: data line is used in open-drain no
I2C2_SDA pin Input/output
pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C3 Enabled Target mode, Analog filter ON
Target 7-bit address: 0b0111100x
I2C3 (x = 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-drain no
I2C3_SCL pin Input/output
pull mode.
PC9 pin: data line is used in open-drain no
I2C3_SDA pin Input/output
pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed
SPI1 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PA7 pin: slave data input line, used in push-
SPI1_MOSI pin Input
pull, pull-down mode
SPI1
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-pull,
SPI1_SCK pin Input
pull-down mode
PA4 pin: slave chip select pin used in push-
SPI1_NSS pin Input
pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed
SPI2 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PB15 pin: slave data input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2
PB14 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PC7 pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PB12 pin: slave chip select pin used in
SPI2_NSS pin Input
push-pull, pull-down mode.

194/508 AN2606 Rev 65

AN2606 STM32F446xx devices

Table 84.STM32F446xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed
SPI4 Enabled
up to 8 MHz, Polarity: CPOL low, CPHA
low, NSS hardware.
PE14 pin: slave data input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4
PE13 pin: slave data output line, used in
SPI4_MISO pin Output
push-pull, pull-down mode
PE12 pin: slave clock line, used in push-
SPI4_SCK pin Input
pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced device
USB Enabled
mode
PA11: USB DM line. Used in alternate
USB_DM pin
DFU push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate push-
USB_DP pin pull, no pull mode.
No external pull-up resistor is required
This timer is used to determine the value of
the HSE. Once the HSE frequency is
CAN2 and DFUs TIM17 Enabled
determinated, the system clock is
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 65 195/508

507
STM32F446xx devices AN2606

39.2 Bootloader selection

Figure 52 shows the bootloader selection mechanism.

Figure 52.Bootloader V9.x selection for STM32F446xx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS device

Disable all
interrupt sources
Configure I2Cx yes
Configure
USARTx
Configure SPIx

Execute
BL_USART_Loop
0x7F received for USARTx
on USARTx

no

Execute
I2C address yes Disable all
BL_I2C_Loop for
detected interrupt sources
I2Cx

no

Execute
Synchro mechanism Disable all
yes BL_I2C_Loop for
detected on SPIx interrupt sources
SPIx

yes

no
HSE detected
no
no

yes yes
Frame detected
on CANx HSE detected no Disable all
interrupt sources
Generate System
yes reset
no Reconfigure System
clock to 60MHz
Reconfigure System
clock to 60MHz and
USB cable USB clock to 48 MHz Configure CAN
Detected

Execute DFU Execute

bootloader using USB BL_CAN_Loop for
interrupts CAN2

MSv36763V2

196/508 AN2606 Rev 65

AN2606 STM32F446xx devices

39.3 Bootloader version

The following table lists the STM32F446xx devices bootloader V9.x versions:

Table 85. STM32F446xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active (must
be re-enabled by user code at startup)

AN2606 Rev 65 197/508

507
STM32F469xx/479xx devices AN2606

40 STM32F469xx/479xx devices

40.1 Bootloader configuration

The STM32F469xx/479xx bootloader is activated by applying Pattern 5 (described in
Table 2). Table 86 shows the hardware resources used by this bootloader.

Table 86. STM32F469xx/479xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz

using the PLL.
The HSI clock source is used at startup
HSI enabled (interface detection phase) and when
USART or SPI or I2C interfaces are
selected (once CAN or DFU is selected,
the clock source is derived from external
crystal).
The system clock frequency is 60 MHz.
RCC
The HSE clock source is used only when
the CAN or the DFU (USB FS device)
HSE enabled interfaces are selected.
The external clock must provide a
frequency multiple of 1 MHz and ranging
from 4 MHz to 26 MHz.
The CSS interrupt is enabled for the CAN
- and DFUs. Any failure (or removal) of the
external clock generates system reset.
Common to all
12 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware
29 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Voltage range is set to [1.62 V, 2.1 V]. In
this range internal flash write operations
are allowed only in byte format (half-word,
Power - word, and double-word operations are not
allowed). The voltage range can be
configured in run time using bootloader
commands.

198/508 AN2606 Rev 65

AN2606 STM32F469xx/479xx devices

Table 86. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit,

USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in input no pull mode.
Once initialized, the configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3 (on
USART3_RX pin Input PB11 pin: USART3 in reception mode.
PB10/PB11)
PB10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Once initialized, the configuration is 8-bit,
USART3 Enabled
even parity, and one stop bit
USART3 (on PC11 pin: USART3 in reception mode.
USART3_RX pin Input
PC10/PC11) Used in input pull-up mode.
PC10 pin: USART3 in transmission mode.
USART3_TX pin Output
Used in input pull-up mode.
Used to automatically detect the serial
USARTx SysTick timer Enabled
baud rate from the host for USARTx.
Once initialized the CAN2 configuration is:
Baudrate 125 kbps, 11-bit identifier.
Note: CAN1 is clocked during CAN2
CAN2 Enabled
bootloader execution because CAN1
manages the communication between
CAN2 CAN2 and SRAM.
PB05 pin: CAN2 in reception mode. Used
CAN2_RX pin Input
in alternate push-pull, pull-up mode.
PB13 pin: CAN2 in transmission mode.
CAN2_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
– Analog filter ON
I2C1 – Target 7-bit address: 0b1000100x (x = 0
for write and x = 1 for read).
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB9 pin: data line is used in open-drain no
I2C1_SDA pin Input/output
pull mode.

AN2606 Rev 65 199/508

507
STM32F469xx/479xx devices AN2606

Table 86. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit address,
I2C2 Enabled Target mode, Analog filter ON Target 7-bit
address: 0b1000100x (x = 0 for write and
x = 1 for read).
I2C2
PF0 pin: clock line is used in open-drain
I2C2_SCL pin Input/output
no pull mode.
PF1 pin: data line is used in open-drain no
I2C2_SDA pin Input/output
pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address,
I2C3 Enabled Target mode, Analog filter ON Target 7-bit
address: 0b1000100x (x = 0 for write and
x = 1 for read).
I2C3
PA8 pin: clock line is used in open-drain
I2C3_SCL pin Input/output
no pull mode.
PC9 pin: data line is used in open-drain no
I2C3_SDA pin Input/output
pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI1 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PA7 pin: slave data input line, used in
SPI1_MOSI pin Input
push-pull, pull-down mode
SPI1
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
SPI1_NSS pin Input
push-pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI2 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PI3 pin: slave data input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2
PI2 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PI1pin: slave clock line, used in push-pull,
SPI2_SCK pin Input
pull-down mode
PI0 pin: slave chip select pin used in push-
SPI2_NSS pin Input
pull, pull-down mode.

200/508 AN2606 Rev 65

AN2606 STM32F469xx/479xx devices

Table 86. STM32F469xx/479xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB,
SPI4 Enabled
Speed up to 8 MHz, Polarity: CPOL low,
CPHA low, NSS hardware.
PE14 pin: slave data input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4
PE13 pin: slave data output line, used in
SPI4_MISO pin Output
push-pull, pull-down mode
PE12 pin: slave clock line, used in push-
SP4_SCK pin Input
pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced device
mode. USB_OTG_FS interrupt vector is
USB Enabled
enabled and used for USB DFU
communications.
DFU PA11 pin: USB DM line. Used in alternate
USB_DM pin
push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in alternate
USB_DP pin push-pull, no pull mode.
No external pull-up resistor is required.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 48 MHz) is
required for CAN and DFUs execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 65 201/508

507
STM32F469xx/479xx devices AN2606

40.2 Bootloader selection

Figure 53 and Figure 54 show the bootloader selection mechanism.

Figure 53. Dual bank boot implementation for STM32F469xx/479xx Bootloader V9.x

System Reset

If Boot = 0 no

yes

If value of
first address of Bank2
yes
is within int. SRAM
address
Set Bank Swap to
Bank2

no
Jump to user code Protection
no
in Bank2 level2 enabled

Continue Bootloader
If value of
execution
first address of Bank1
yes
is within int. SRAM yes
address

no If value of
first address of Bank2
yes
is within int. SRAM
Protection address
yes
level2 enabled

no

no Set Bank Swap to Set Bank Swap to Set Bank Swap to

Bank1 Bank1 Bank2

Continue Bootloader Jump to user code Jump to user code Jump to user code
execution in Bank1 in Bank1 in Bank2

MSv38429V1

202/508 AN2606 Rev 65

AN2606 STM32F469xx/479xx devices

Figure 54.Bootloader V9.x selection for STM32F469xx/479xx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick)

Disable all interrupt

Configure USB OTG FS
Disable all interrupt Disable all interrupt sources and other
device
sources and other sources and other interfaces clocks
interfaces clocks interfaces clocks
Configure I2Cx Configure USARTx

Configure SPIx Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx

0x7F received
yes
on USARTx

no

I2C Address
yes
Detected

no

no HSE detected

Synchro mechanism HSE detected no

yes
detected on SPIx
Generate System yes
reset
yes
Disable all interrupt
no Disable other sources and other
interfaces clocks interfaces clocks

Frame detected
yes
on CANx Reconfigure
Reconfigure System System clock to
clock to 60MHz and 60MHz
USB clock to 48 MHz
no

Configure CAN
Execute DFU
USB cable bootloader using USB
yes
Detected interrupts
Execute
BL_CAN_Loop for
CAN2
no
MSv38430V2

AN2606 Rev 65 203/508

507
STM32F469xx/479xx devices AN2606

40.3 Bootloader version

Table 87 lists the STM32F469xx/479xx devices V9.x bootloader versions:

Table 87. STM32F469xx/479xx bootloader V9.x versions

Version
Description Known limitations
number

After executing Go command (jump to user code) the

bootloader resets AHB1ENR value to 0x0000 0000
V9.0 Initial bootloader version
and thus CCM RAM, when present, is not active
(must be re-enabled by user code at startup).

204/508 AN2606 Rev 65

AN2606 STM32F72xxx/73xxx devices

41 STM32F72xxx/73xxx devices

41.1 Bootloader configuration

The STM32F72xxx/73xxx bootloader is activated by applying Pattern 8 (described in
Table 2). Table 88 shows the hardware resources used by this bootloader.

Table 88. STM32F72xxx/73xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock

source for system clock configured to
HSI enabled
60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN
or the DFU (USB FS device) interfaces
are selected. In this case the system
RCC HSE enabled clock configured to 60 MHz with HSE
as clock source.
The HSE frequency must be a multiple
of 1 MHz. ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the
CAN and DFUs. Any failure (or
-
removal) of the external clock
generates system reset.
16 Kbytes, starting from address
RAM - 0x20000000, are used by the
Common to all bootloader firmware
59 Kbytes, starting from address
System memory - 0x1FF00000, contain the bootloader
firmware
The IWDG prescaler is configured to
its maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
The voltage range is [1.8V, 3.6V]
In this range:
- Flash wait states: 3.
Power - - System clock frequency 60 MHz.
- ART Accelerator enabled.
- Flash write operation by byte (refer to
bootloader memory management
section for more information).

AN2606 Rev 65 205/508

507
STM32F72xxx/73xxx devices AN2606

Table 88. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-

USART1 Enabled
bit, even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in input no pull mode.
PA9 pin: USART1 in transmission
USART1_TX pin Output
mode. Used in input no pull mode.
Once initialized, the configuration is 8-
USART3 Enabled
bit, even parity, and one stop bit
USART3 PB11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PB11/PB10) Used in input pull-up mode.
PB10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
Once initialized, the configuration is 8-
USART3 Enabled
bit, even parity, and one stop bit
USART3 PC11 pin: USART3 in reception mode.
USART3_RX pin Input
(on PC11/PC10) Used in input pull-up mode.
PC10 pin: USART3 in transmission
USART3_TX pin Output
mode. Used in input pull-up mode.
Used to automatically detect the serial
USARTx SysTick timer Enabled
baud rate from the host for USARTx.
Once initialized the CAN1
CAN1 Enabled configuration is: Baudrate 125 kbps,
11-bit identifier.
PD0 pin: CAN1 in reception mode.
CAN1 CAN1_RX pin Input Used in alternate push-pull, pull-up
mode.
PD1 pin: CAN1 in transmission mode.
CAN1_TX pin Output Used in alternate push-pull, pull-up
mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit
I2C1 Enabled address, Target mode, Analog filter ON
Target 7-bit address: 0b1001001x (x =
I2C1 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-
I2C1_SCL pin Input/output
drain no pull mode.
PB9 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.

206/508 AN2606 Rev 65

AN2606 STM32F72xxx/73xxx devices

Table 88. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 400 kHz, 7-bit
I2C2 Enabled address, Target mode, Analog filter ON
Target 7-bit address: 0b1001101x (x =
I2C2 0 for write and x = 1 for read)
PF1 pin: clock line is used in open-
I2C2_SCL pin Input/output
drain no pull mode.
PF0 pin: data line is used in open-drain
I2C2_SDA pin Input/output
no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit
I2C3 Enabled address, Target mode, Analog filter ON
Target 7-bit address: 0b1001001x (x =
I2C3 0 for write and x = 1 for read)
PA8 pin: clock line is used in open-
I2C3_SCL pin Input/output
drain no pull mode.
PC9 pin: data line is used in open-
I2C3_SDA pin Input/output
drain no pull mode.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI1 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in
SPI1_MOSI pin Input
push-pull, pull-down mode
SPI1
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
SPI1_NSS pin Input
push-pull, pull-down mode.
The SPI2 configuration is:
Slave mode, Full Duplex, 8-bit MSB,
SPI2 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in
SPI2_MOSI pin Input
push-pull, pull-down mode
SPI2
PI2 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PI1 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PI0 pin: slave chip select pin used in
SPI2_NSS pin Input
push-pull, pull-down mode.

AN2606 Rev 65 207/508

507
STM32F72xxx/73xxx devices AN2606

Table 88. STM32F72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

Slave mode, Full Duplex, 8-bit MSB,
SPI4 Enabled
Speed up to 8 MHz, Polarity: CPOL
low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in
SPI4_MOSI pin Input
push-pull, pull-down mode
SPI4
PE13 pin: slave data output line, used
SPI4_MISO pin Output
in push-pull, pull-down mode
PE12 pin: slave clock line, used in
SP4_SCK pin Input
push-pull, pull-down mode
PE11 pin: slave chip select pin used in
SPI4_NSS pin Input
push-pull, pull-down mode.
USB OTG FS configured in forced
USB Enabled
device mode
PA11 pin: USB DM line. Used in
USB_DM pin
DFU alternate push-pull, no pull mode.
Input/output PA12 pin: USB DP line. Used in
USB_DP pin alternate push-pull, no pull mode.
No external pull-up resistor is required.
This timer is used to determine the
value of the HSE. Once HSE
CAN1 and DFUs TIM11 Enabled frequency is determined, the system
clock is configured to 60 MHz using
PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

208/508 AN2606 Rev 65

AN2606 STM32F72xxx/73xxx devices

41.2 Bootloader selection

Figure 55 shows the bootloader selection mechanism.

Figure 55. Bootloader V9.x selection for STM32F72xxx/73xxx

6\VWHP5HVHW

6\VWHP,QLW &ORFN*3,2V
,:'*6\V7LFN \HV

&RQILJXUH86%27*)6
GHYLFH \HV
'LVDEOHDOOLQWHUUXSW
\HV VRXUFHVDQGRWKHU
LQWHUIDFHVFORFNV
&RQILJXUH,&[
'LVDEOHDOOLQWHUUXSW 'LVDEOHDOOLQWHUUXSW
VRXUFHVDQGRWKHU VRXUFHVDQGRWKHU &RQILJXUH
LQWHUIDFHVFORFNV LQWHUIDFHVFORFNV 86$57[
&RQILJXUH63,[

([HFXWH ([HFXWH ([HFXWH

%/B63,B/RRS %/B,&B/RRS %/B86$57B/RRS
IRU63,[ IRU,&[ IRU86$57[
[)UHFHLYHGRQ
86$57[

QR
\HV

,&$GGUHVV
'HWHFWHG

QR
+6(GHWHFWHG QR QR +6(GHWHFWHG

6\QFKURPHFKDQLVP *HQHUDWH6\VWHP
GHWHFWHGRQ63,[ \HV UHVHW \HV

'LVDEOHDOOLQWHUUXSW
'LVDEOHRWKHU
VRXUFHVDQGRWKHU
QR LQWHUIDFHVFORFNV
LQWHUIDFHVFORFNV
QR

)UDPHGHWHFWHG 5HFRQILJXUH6\VWHP 5HFRQILJXUH6\VWHP

RQ&$1[ FORFNWR 0+]DQG FORFNWR 0+]
86%FORFNWR0+]

QR &RQILJXUH&$1
([HFXWH')8
ERRWORDGHUXVLQJ86%
86%FDEOH LQWHUUXSWV ([HFXWH
\HV
'HWHFWHG %/B&$1B/RRSIRU
&$1[

06Y9

AN2606 Rev 65 209/508

507
STM32F72xxx/73xxx devices AN2606

41.3 Bootloader version

Table 89 lists the STM32F72xxx/73xxx devices bootloader V9.x versions.

Table 89. STM32F72xxx/73xxx bootloader V9.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps) connection

may fail due to software jitter leading to wrong
baudrate calculation.
V9.0 Initial bootloader version In that case bootloader may respond with a baudrate
up to ± 5% different from host baudrate.
Workaround: use baudrates lower than 57600 bps if
host tolerance to baudrate error is lower than ± 5%

210/508 AN2606 Rev 65

AN2606 STM32F74xxx/75xxx devices

42 STM32F74xxx/75xxx devices

Two bootloader versions are available:

• V7.x supporting USART1, USART3, CAN2, I2C1, I2C2, I2C3, and DFU (USB FS
device). This version is embedded in STM32F74xxx/75xxx rev. A devices.
• V9.x supporting USART1, USART3, CAN2, I2C1, I2C2, I2C3, SPI1, SPI2, SPI4, and
DFU (USB FS device). This version is embedded in STM32F74xxx/75xxx rev. Z and
rev. 1 devices.
Note: When readout protection Level2 is activated, STM32F74xxx/75xxx devices can boot also on
system memory and all commands are not accessible except Get, GetID, and GetVersion.

42.1 Bootloader V7.x

42.1.1 Bootloader configuration

The STM32F74xxx/75xxx bootloader is activated by applying Pattern 8 (described in
Table 2). Table 90 shows the hardware resources used by this bootloader.

Table 90. STM32F74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for system
HSI enabled clock configured to 60 MHz and for USART and I2C
bootloader operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system
RCC HSE enabled clock configured to 60 MHz with HSE as clock source.
The HSE frequency must be multiple of 1 MHz and
ranging from 4 to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates system
reset.
16 Kbytes, starting from address 0x20000000, are used
RAM -
Common to all by the bootloader firmware
60 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The voltage range is [1.8V, 3.6V]. In this range:
- Flash wait states: 3.
- System clock frequency 60 MHz.
Power -
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader
memory management section for more information).

AN2606 Rev 65 211/508

507
STM32F74xxx/75xxx devices AN2606

Table 90. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
USART3 (on PB11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
PB10/PB11) up mode.
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
USART3
PC11 pin: USART3 in reception mode. Used in input pull-
(on USART3_RX pin Input
up mode.
PC10/PC11)
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 CAN2 and SRAM.
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, Target mode
I2C1 Enabled
– Analog filter ON
I2C1
– Target 7-bit address: 0b1000101x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address, Target mode
I2C2 Enabled
– Analog filter ON
I2C2
– Target 7-bit address: 0b1000101x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.

212/508 AN2606 Rev 65

AN2606 STM32F74xxx/75xxx devices

Table 90. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled
– Target mode, Analog filter ON
I2C3
– Target 7-bit address: 0b1000101x (x = 0 for write and x
= 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.
USB Enabled USB OTG FS configured in forced device mode.
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
DFU
Input/output PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and
TIM11 Enabled Once HSE frequency is determined, the system clock is
DFUs
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

AN2606 Rev 65 213/508

507
STM32F74xxx/75xxx devices AN2606

42.1.2 Bootloader selection

Figure 56.Bootloader V7.x selection for STM32F74xxx/75xxx

System Reset
yes

System Init (Clock, GPIOs,

IWDG, SysTick) yes
Disable all interrupt
sources and other
Configure USB OTG FS interfaces clocks
device
Disable all interrupt
sources and other Configure
interfaces clocks USARTx
Configure I2Cx

Execute Execute
BL_I2C_Loop BL_USART_Loop
0x7F received on for I2Cx for USARTx
USARTx
yes

no

I2C Address
Detected HSE detected no no HSE detected

no Generate System
yes reset yes

Disable all interrupt

Frame detected Disable other
sources and other
on CANx interfaces clocks
interfaces clocks
no

no Reconfigure System Reconfigure System

clock to 60MHz and clock to 60MHz
USB clock to 48 MHz
USB cable
yes
Detected
Configure CAN
Execute DFU
bootloader using USB
interrupts Execute
BL_CAN_Loop for
CAN2

MSv37792V1

42.1.3 Bootloader version

Table 91. STM32F74xxx/75xxx bootloader V7.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps) connection may fail due to

software jitter leading to wrong baudrate calculation. In that case
bootloader may respond with a baudrate up to ± 5% different from host
V7.0 Initial bootloader version baudrate.
Workaround: use baudrates lower than 57600 bps if host tolerance to
baudrate error is lower than ± 5%

214/508 AN2606 Rev 65

AN2606 STM32F74xxx/75xxx devices

42.2 Bootloader V9.x

42.2.1 Bootloader configuration

The STM32F74xxx/75xxx bootloader is activated by applying Pattern 8 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 92. STM32F74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 60 MHz and for USART, I2C and SPI
bootloader operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system
HSE enabled clock configured to 60 MHz with HSE as clock source.
RCC The HSE frequency must be multiple of 1 MHz and
ranging from 4 to 26 MHz.
The CSS interrupt
is enabled for the CAN and DFU
-
bootloaders. Any failure (or removal) of the
external clock generates system reset.
16 Kbytes, starting from address 0x20000000, are used
Common to all RAM -
by the bootloader firmware
60 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The voltage range is 1.8 V, 3.6V. In this range:
- Flash wait states: 3.
- System clock frequency 60 MHz.
Power -
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader
memory management section for more information).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.

AN2606 Rev 65 215/508

507
STM32F74xxx/75xxx devices AN2606

Table 92. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
USART3 (on PB11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
PB10/PB11) up mode.
PB10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
USART3 (on PC11 pin: USART3 in reception mode. Used in input pull-
USART3_RX pin Input
PC10/PC11) up mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
Once initialized the CAN2 configuration is: Baudrate 125
kbps, 11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between
CAN2 and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate push-
CAN2_RX pin Input
pull, pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate
CAN2_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000101x (x = 0 for write and x
= 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1000101x (x = 0 for write and x
= 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.

216/508 AN2606 Rev 65

AN2606 STM32F74xxx/75xxx devices

Table 92. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1000101x (x = 0 for write and x
= 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1 SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
SPI2 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8 MHz,
Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
SPI2 PI2 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PI1 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PI0 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

AN2606 Rev 65 217/508

507
STM32F74xxx/75xxx devices AN2606

Table 92. STM32F74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull, pull-
SPI4 SPI4_MOSI pin Input
down mode
PE13 pin: slave data output line, used in push-pull, pull-
SPI4_MISO pin Output
down mode
PE12 pin: slave clock line, used in push-pull, pull-down
SP4_SCK pin Input
mode
PE11 pin: slave chip select pin used in push-pull, pull-
SPI4_NSS pin Input
down mode.
USB Enabled USB OTG FS configured in forced device mode.
PA11 pin: USB DM line. Used in alternate push-pull, no
USB_DM pin
DFU pull mode.
Input/output
PA12 pin: USB DP line. Used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.
This timer is used to determine the value of the HSE.
CAN2 and
TIM11 Enabled Once HSE frequency is determined, the system clock is
DFUs
configured to 60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx, I2Cx
I2Cx, and SPIx bootloaders. This internal clock is also used for CAN and DFU (USB FS
device), but only for the selection phase. An external clock multiple of 1 MHz (between 4
and 26 MHz) is required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

218/508 AN2606 Rev 65

AN2606 STM32F74xxx/75xxx devices

42.2.2 Bootloader selection

Figure 57 shows the bootloader selection mechanism.

Figure 57.Bootloader V9.x selection for STM32F74xxx/75xxx

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx

no
yes

I2C Address
Detected

no
HSE detected no no HSE detected

Synchro mechanism Generate System

detected on SPIx yes reset yes

Disable all interrupt

Disable other
sources and other
no interfaces clocks
interfaces clocks
no

Frame detected Reconfigure System Reconfigure System

on CANx clock to 60MHz and clock to 60MHz
USB clock to 48 MHz

no Configure CAN
Execute DFU
bootloader using USB
USB cable interrupts Execute
yes
Detected BL_CAN_Loop for
CAN2

MSv36793V1

AN2606 Rev 65 219/508

507
STM32F74xxx/75xxx devices AN2606

42.2.3 Bootloader version

The following table lists the STM32F74xxx/75xxx bootloader V9.x versions:

Table 93. STM32F74xxx/75xxx bootloader V9.x versions

Version
Description Known limitations
number

At high UART baudrates (115200 bps)

connection may fail due to software jitter
leading to wrong baudrate calculation.
In that case bootloader may respond with a
V9.0 Initial bootloader version baudrate up to ± 5% different from host
baudrate.
Workaround: use baudrates lower than
57600 bps if host tolerance to baudrate
error is lower than ± 5%

220/508 AN2606 Rev 65

AN2606 STM32F76xxx/77xxx devices

43 STM32F76xxx/77xxx devices

43.1 Bootloader configuration

The STM32F76xxx/77xxx bootloader is activated by applying Pattern 9 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 94. STM32F76xxx/77xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 60 MHz and for USART and I2C bootloader
operation.
The HSE is used only when the CAN or the DFU (USB FS
device) interfaces are selected. In this case the system clock
HSE
RCC configured to 60 MHz with HSE as clock source.
enabled
The HSE frequency must be a multiple of 1 MHz, ranging from
4 to 26 MHz.
The CSS interrupt is enabled for the CAN and DFUs. Any
- failure (or removal) of the external clock generates system
reset.
16 Kbytes, starting from address 0x20000000, are used by the
Common RAM -
bootloader firmware
to all
59 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The voltage range is [1.8 V, 3.6 V]
In this range:
- Flash wait states: 3.
Power - - System clock frequency 60 MHz.
- ART Accelerator enabled.
- Flash write operation by byte (refer to bootloader memory
management section for more information).
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
USART3 (on PB11 pin: USART3 in reception mode. Used in input pull-up
USART3_RX pin Input
PB11/PB10) mode.
PB10 pin: USART3 in transmission mode. Used in input pull-up
USART3_TX pin Output
mode.

AN2606 Rev 65 221/508

507
STM32F76xxx/77xxx devices AN2606

Table 94. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and one

USART3 Enabled
stop bit
USART3 (on PC11 pin: USART3 in reception mode. Used in input pull-up
USART3_RX pin Input
PC11/PC10) mode.
PC10 pin: USART3 in transmission mode. Used in input pull-up
USART3_TX pin Output
mode.
Used to automatically detect the serial baud rate from the host
USARTx SysTick timer Enabled
for USARTx.
Once initialized the CAN2 configuration is: Baudrate 125 kbps,
11-bit identifier.
CAN2 Enabled Note: CAN1 is clocked during CAN2 bootloader execution
because CAN1 manages the communication between CAN2
and SRAM.
CAN2
PB5 pin: CAN2 in reception mode. Used in alternate push-pull,
CAN2_RX pin Input
pull-up mode.
PB13 pin: CAN2 in transmission mode. Used in alternate push-
CAN2_TX pin Output
pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode, Analog
I2C1 Enabled filter ON
I2C1 Target 7-bit address: 0b1001001x (x = 0 for write and x = 1 for
read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode, Analog
I2C2 Enabled filter ON
I2C2 Target 7-bit address: 0b1001001x (x = 0 for write and x = 1 for
read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 400 kHz, 7-bit address, Target mode, Analog
I2C3 Enabled filter ON
I2C3 Target 7-bit address: 0b1001001x (x = 0 for write and x = 1 for
read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.

222/508 AN2606 Rev 65

AN2606 STM32F76xxx/77xxx devices

Table 94. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

SPI1 Enabled Slave mode, Full Duplex, 8-bit MSB, Speed up to 8 MHz,
Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
SPI1
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2
SPI2_MOSI pin Input PI3 pin: slave data input line, used in push-pull, pull-down mode
PI2 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PI1 pin: slave clock line, used in push-pull, pull-down mode
PI0 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.
The SPI4 configuration is:
– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI4 PE14 pin: slave data input line, used in push-pull, pull-down
SPI4_MOSI pin Input
mode
PE13 pin: slave data output line, used in push-pull, pull-down
SPI4_MISO pin Output
mode
SP4_SCK pin Input PE12 pin: slave clock line, used in push-pull, pull-down mode
PE11 pin: slave chip select pin used in push-pull, pull-down
SPI4_NSS pin Input
mode.

AN2606 Rev 65 223/508

507
STM32F76xxx/77xxx devices AN2606

Table 94. STM32F76xxx/77xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB Enabled USB OTG FS configured in forced device mode

PA11 pin: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
DFU
Input/output PA12 pin: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required.
This timer is used to determine the value of the HSE. Once
CAN2 and
TIM11 Enabled HSE frequency is determined, the system clock is configured to
DFUs
60 MHz using PLL and HSE.

The system clock is derived from the embedded internal high-speed RC for USARTx and
I2Cx bootloaders. This internal clock is also used for CAN and DFU (USB FS device), but
only for the selection phase. An external clock multiple of 1 MHz (between 4 and 26 MHz) is
required for CAN and DFU execution after the selection phase.
Note: Due to HSI deviation and since HSI is used to detect HSE value, use low rather than high
frequency HSE crystal values (low frequency values are better detected due to larger error
margin). For example, it is better to use 8 MHz instead of 25 MHz.

224/508 AN2606 Rev 65

AN2606 STM32F76xxx/77xxx devices

43.2 Bootloader selection

Figure 58 and Figure 59 show the bootloader selection mechanism.

Figure 58. Dual bank boot implementation for STM32F76xxx/77xxx Bootloader V9.x

System Reset

nDBANK = 0 &
yes
nDBOOT = 0

Select BOOT_ADDx by BOOT0

no Pin(1)

Compute entire boot address from

BOOT_ADDx
Protection level2
enabled yes

no If boot address is out of Protection level2

yes yes
memory range or in ICP enabled
Jump to AXIM-Flash
Continue Bootloader
base address 0x0800
execution
0000 no
no
Continue Bootloader
execution
If boot address is in
RAM memory (SRAM1, yes
SRAM2, DTCM RAM)

no

If the code in boot

address is valid(2)
yes

If boot address is in
yes
Bank2

Set Bank Swap to

Bank2

no
Jump to address
defined by
BOOT_ADDx
If boot address is in
no yes
Bank1
Set Bank Swap to
Bank1

no
Jump to address
defined by
BOOT_ADDx

Protection level2
yes
enabled

no

Jump to AXIM-Flash
Continue Bootloader
base address 0x0800
execution
0000

MSv38482V2

1. Only BOOT_ADD0 value is considered whatever the BOOT0 pin state, as described in Table 95.
2. ITCM RAM is not considered valid as stack pointer address for the dual bank boot mechanism.

AN2606 Rev 65 225/508

507
STM32F76xxx/77xxx devices AN2606

Figure 59. Bootloader V9.x selection for STM32F76xxx/77xxx

Bootloader

System Init (Clock, GPIOs,

IWDG, SysTick) yes

Configure USB OTG FS

device yes
Disable all interrupt
yes sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received on
USARTx
yes
no

I2C Address
Detected HSE detected no no HSE detected

Generate System
no reset
yes yes

Disable all interrupt

Disable other
Synchro mechanism sources and other
interfaces clocks
detected on SPIx interfaces clocks

no Reconfigure System Reconfigure System

no clock to 60 MHz and clock to 60 MHz
USB clock to 48 MHz
Frame detected
on CANx Configure CAN
Execute DFU
bootloader using USB
no interrupts Execute
BL_CAN_Loop for
CANx
USB cable
yes
Detected

MSv38483V2

226/508 AN2606 Rev 65

AN2606 STM32F76xxx/77xxx devices

43.3 Bootloader version

The following table lists the STM32F76xxx/77xxx devices bootloader V9.x versions.

Table 95. STM32F76xxx/77xxx bootloader V9.x versions

Version
Description Known limitations
number

When the flash memory is configured to the dual

bank boot mode (nDBANK=nDBOOT=0),
whatever the BOOT0 Pin state only
BOOT_ADD0 value is considered (when BOOT0
Pin=1, BOOT_ADD0 value is considered not the
BOOT_ADD1).
Workaround: to manage dual bank boot with
BOOT_ADD0 only, refer to AN4826 "STM32F7
series flash memory dual bank mode”
At high UART baudrates (115200 bps)
V9.3 Initial bootloader version
connection may fail due to software jitter leading
to wrong baudrate calculation.
In that case bootloader may respond with a
baudrate up to ± 5% different from host baudrate.
Workaround: use baudrates lower than
57600 bps if host tolerance to baudrate error is
lower than ± 5%.
Bank2 sector erase issue when using USB
interface. Erasing a sector from bank2 with index
(i) leads to erase sector (i+4)

AN2606 Rev 65 227/508

507
STM32G03xxx/STM32G04xxx devices AN2606

44 STM32G03xxx/STM32G04xxx devices

44.1 Bootloader configuration

The STM32G03xxx/G04xxx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader. Note
that STM32G030x do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 96. STM32G03xxx/G04xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
4 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
Common to all System memory - 8 Kbytes, starting from address 0x1FFF0000
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF1D00
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate
USARTx bootloader SysTick timer Enabled
from the host for USARTx.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
Target 7-bit address: 0b1010110x
I2C1 (x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.

228/508 AN2606 Rev 65

AN2606 STM32G03xxx/STM32G04xxx devices

Table 96. STM32G03xxx/G04xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
Target 7-bit address: 0b1010110x (x = 0 for write
I2C2 and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.

Note: On SO8, WLCSP18, TSSOP20, and UFQFN28 packages USART1 PA9/PA10 IOs are
remapped on PA11/PA12.

44.2 Bootloader selection

Figure 60 shows the bootloader selection mechanism.

Figure 60. Bootloader V5.x selection for STM32G03xxx/G04xxx

System reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure autobaudrate
USARTx

Configure I2Cx

0x7F received Yes

on USARTx

No

Disable all interrupt Disable all interrupt

Yes sources and other sources and other
I2Cx address
interfaces clocks interfaces clocks
detected

No Execute Configure non

BL_I2C_Loop autobaudrate
for I2Cx USARTx

Execute
BL_USART_Loop
for USARTx
MS56834V1

AN2606 Rev 65 229/508

507
STM32G03xxx/STM32G04xxx devices AN2606

44.3 Bootloader version

Table 97 lists the STM32G03xxx/G04xxx devices bootloader versions.

Table 97. STM32G03xxx/04xxx bootloader versions

Version number Description Known limitations

– Supports only 48- and 32-pin packages

– Issue is seen for both packages, if PA3
V5.1 Initial bootloader version stays to low level, system is stuck in the
USART2 detection sequence and no
other interface is detected.
Issue is seen for all packages (except SO8,
no PA3 pin), if PA3 stays to low level,
Add support to small packages
V5.2 system is stuck in the USART2 detection
8/20 and 28 pins
sequence and no other interface is
detected.
V5.3 Fix V5.2 limitations None

230/508 AN2606 Rev 65

AN2606 STM32G07xxx/08xxx device bootloader

45 STM32G07xxx/08xxx device bootloader

45.1 Bootloader configuration

The STM32G07xxx/G08xxx bootloader is activated by applying Pattern 11 (described in
Table 2). Table 98 shows the hardware resources used by this bootloader.
When using Pattern 11, consider that STM32G070xx devices do not have
BOOT_LOCK(bit).

Table 98. STM32G07xxx/8xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
12 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware

Common to all 28 Kbytes, starting from address 0x1FFF0000,

System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the securable memory
- -
area area is 0x1FFF6800
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 65 231/508

507
STM32G07xxx/08xxx device bootloader AN2606

Table 98. STM32G07xxx/8xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
– Analog filter ON
I2C1 – Target 7-bit address: 0b1010001x (x = 0 for write
and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
– Analog filter ON
I2C2 – Target 7-bit address: 0b1010001x (x = 0 for write
and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode.
SPI1
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

232/508 AN2606 Rev 65

AN2606 STM32G07xxx/08xxx device bootloader

Table 98. STM32G07xxx/8xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 65 233/508

507
STM32G07xxx/08xxx device bootloader AN2606

45.2 Bootloader selection

Figure 61 shows the bootloader selection mechanism.

Figure 61. Bootloader V11.0 selection for STM32G07xxx/G08xxx

Bootloader

Disable all interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure autobaudrate
USARTx
yes

Configure SPIx
yes

0x7F received
on USARTx Disable all other
yes interfaces clocks

no

I2C address Configure non

Disable all other Disable all other autobaudrate
detected
interfaces clocks interfaces clocks USARTx

no
Execute Execute Execute
no BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
Synchro mechanism
detected on SPIx

MS51450V2

45.3 Bootloader version

Table 99 lists the STM32G07xxx/8xxx devices bootloader versions.

Table 99. STM32G07xxx/08xxx bootloader versions

Version number Description Known limitations

V11.0 Initial bootloader version Not supporting packages smaller than LQFP64
V11.1 Supporting all packages None

234/508 AN2606 Rev 65

AN2606 STM32G07xxx/08xxx device bootloader

Table 99. STM32G07xxx/08xxx bootloader versions (continued)

Version number Description Known limitations

– Option byte launch missing when using USART

protocol
– RCC register RCC_ICSCR is not set to its default
value when Go command is used. HSITRIM
value is set to a value different from default.
Added securable memory
V11.2 – RCC registers are not set to their default value
area feature
when Go command is used (HSITRIM is not
correctly reset).
– Enabling SRAM parity check option byte causes
bootloader crash if the SRAM is not initialized
before enabling this feature.
– Empty check flag cleared by bootloader at boot
Fixed V11.2 limitations and
V11.3 – Compatibility break on boot sequence versus
added SW enhancements
older versions(1)
1. See Section 45.3.1.

45.3.1 Compatibility break on boot sequence

Some enhancements introduced in V11.3 break the compatibility with the boot sequence of
versions V11.2 and V11.1.
The major change is the addition of initialization of hardware peripherals (for the exact list
refer to Section 45.1) used by the bootloader to their default values (as defined in RM0444).
The main impact is seen in two cases:
1. When jumping to the bootloader from user flash, the first operation is to reset the
peripherals to their default values.
2. Usage of the “Empty check” boot mode
– Empty check flag is raised by HW on a POR or option byte change when the user
flash is empty.
– This detection leads to boot on the bootloader.
– As per the new boot sequence, the bootloader clears this flag.
– Using a reset while the user flash is not yet programmed leads to a wrong boot on
an empty user flash.
Avoid resets (except POR or option byte change) while the user flash is not
programmed by the bootloader.

AN2606 Rev 65 235/508

507
STM32G0B0xx device bootloader AN2606

46 STM32G0B0xx device bootloader

46.1 Bootloader configuration

The STM32G0B0xx bootloader is activated by applying Pattern 11 (described in Table 2).
The following table shows the hardware resources used by this bootloader. Note that
STM32G0B0xx do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 100. STM32G0B0xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL

HSI enabled clocked by HSI). If an external clock (HSE) is not
present, the system is kept clocked from the HSI
RCC The external clock can be used for all bootloader
interfaces and must have one of the following values
HSE enabled
[48, 32, 16, 12, 8] MHz. The PLL is used to generate
48 MHz for USB and system clock.
16 Kbytes, starting from address 0x20000000, are
RAM -
Common to all used by the bootloader firmware
The bootloader firmware is shared on two banks:
- 28 Kbytes, starting from address 0x1FFF0000 until
System memory -
0x1FFF6FFF
- Part of the 28 KB (0x1FFF8000 – 0x1FFFEFFF)
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to for the exit securable
- -
area memory area is 0x1FFF6800
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.

236/508 AN2606 Rev 65

AN2606 STM32G0B0xx device bootloader

Table 100. STM32G0B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even

USART3 Enabled
parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
Target 7-bit address: 0b1011101x
I2C1 (x = 0 for write and x = 1 for read)
PB6 pin: clock line is used in open-drain pull-up
I2C1_SCL pin Input/output
mode.
PB7 pin: data line is used in open-drain pull-up
I2C1_SDA pin Input/output
mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
Target 7-bit address: 0b1011101x
I2C2 (x = 0 for write and x = 1 for read)
PB10 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PB11 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode.
SPI1
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

AN2606 Rev 65 237/508

507
STM32G0B0xx device bootloader AN2606

Table 100. STM32G0B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode.
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in Forced Device mode. USB
FS interrupt vector is enabled and used for USB
USB Enabled DFU communications. Note: VDDUSB IO must be
connected to 3.3 V as USB peripheral is used by the
DFU(2) bootloader.‘
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.
2. USB DFU is not available on LQFP32 package.

238/508 AN2606 Rev 65

AN2606 STM32G0B0xx device bootloader

46.2 Bootloader selection

Figure 62 shows the bootloader selection mechanism.

Figure 62. Bootloader selection for STM32G0B0xx

System reset

Configure System clock to

60 MHz using HSI

HSE= 48, 32, 16, no

12, 8 MHz ?

yes
Reconfigure System clock to
60 MHz using HSE System Init (Clock, GPIOs,
IWDG, SysTick)

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

Configure I2Cx
yes

Configure SPIx

Disable all interrupt

Configure USARTx sources and other
interfaces clocks

0x7F received Disable all interrupt

on USARTx sources and other
interfaces clocks

no Disable all interrupt

sources and other Execute Execute
interfaces clocks BL_I2C_Loop for BL_USART_Loop
I2Cx address I2Cx for USARTx
detected
Execute
BL_SPI_Loop
for SPIx
no

Synchro mechanism yes

detected on SPIx
no Disable other
interfaces clocks
no

USB cable Execute DFU

detected and USB bootloader using USB
configured interrupts
MS54534V3

AN2606 Rev 65 239/508

507
STM32G0B0xx device bootloader AN2606

46.3 Bootloader version

Table 101 lists the STM32G0B0xx devices bootloader versions.

Table 101. STM32G0B0xx bootloader versions

Version
Description Known limitations
number

Erase multiple sectors not working on Bank2

– Root cause: wrong BUSY bit check on Bank2 leads to generate
FLITF error after one sector erase
– Workaround: erase only by one sector when targeting Bank2

Empty check flag cleared by error on the bootloader startup phase

Initial – Root cause: on the startup phase the bootloader SW performs a
V13.0 bootloader system deinitialization, leading to write the default value on the
version FLASH_ACR register, which overrides the Empty check bit with 0
– Behavior: when Empty check boot mode is used and the flash
memory is empty, the MCU boots on the bootloader but the flag is
cleared by the SW. If a reset is triggered, the system tries to boot on
the empty flash memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

240/508 AN2606 Rev 65

AN2606 STM32G0B1xx/0C1xx device bootloader

47 STM32G0B1xx/0C1xx device bootloader

47.1 Bootloader configuration

The STM32G0B1xx/0C1xx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 102. STM32G0B1xx/0C1xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL

HSI enabled
clocked by HSI).
RCC CRS is enabled for the DFU to allow USB to be clocked
-
by HSI48 48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
Common to all
The bootloader firmware is shared on two banks:
- 28 Kbytes, starting from address 0x1FFF0000 until
System memory -
0x1FFF6FFF
- Part of the 28 KB (0x1FFF8000 – 0x1FFFEFFF)
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Securable memory The address to jump to for the securable memory area
- -
area is 0x1FFF6800
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 65 241/508

507
STM32G0B1xx/0C1xx device bootloader AN2606

Table 102. STM32G0B1xx/0C1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
I2C1 – Target 7-bit address: 0b1011101x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
I2C2 – Target 7-bit address: 0b1011101x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode.
SPI1
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode.
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.

242/508 AN2606 Rev 65

AN2606 STM32G0B1xx/0C1xx device bootloader

Table 102. STM32G0B1xx/0C1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode.
SPI2
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode.
PB12 pin: slave chip select pin used in push-pull, pull-
down.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
USB FS configured in Forced device mode. USB FS
interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.‘
USB_DM pin PA11: USB DM line. Used in no pull mode.
Input/output PA12: USB DP line. Used in no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input
push-pull, pull-up mode.
PD1 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-up mode.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 65 243/508

507
STM32G0B1xx/0C1xx device bootloader AN2606

47.2 Bootloader selection

Figure 63 shows the bootloader selection mechanism.

Figure 63. Bootloader selection for STM32G0B1xx/0C1xx

System Reset Configure System clock to

60 MHz with HSI

System Init (Clock, GPIOs,

Configure USB OTG FS device
IWDG, SysTick)

Configure I2Cx

Configure SPIx
Execute
BL_FDCAN loop
Configure USARTx

Configure FDCANx
Disable all interrupt
sources and other
interfaces clocks
FDCAN frame Disable all interrupt Disable all interrupt
detected yes sources and other
sources and other
interfaces clocks interfaces clocks
no
Execute Execute Execute
0x7F received BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
on USARTx yes for SPIx for I2Cx for USARTx

no

I2C address
yes
detected

no

no
Execute DFU
Synchro mechanism yes bootloader using USB
detected on SPIx
interrupts

no

USB cable yes

detected

MS56835V1

244/508 AN2606 Rev 65

AN2606 STM32G0B1xx/0C1xx device bootloader

47.3 Bootloader version

Table 103 lists the STM32G0B1xx/0C1xx devices bootloader versions.

Table 103. STM32G0B1xx/0C1xx bootloader versions

Version
Description Known limitations
number

When jumping to an application, the Go command disables the debug

access port by writing a wrong value on the FLASH_ACR register (bit
DBG_SWEN).

Erase multiple sectors not working on Bank2

– Root cause: wrong BUSY bit check on Bank2 leads to generate
FLITF error after one sector erase
– Workaround: erase only by one sector when targeting Bank2
Initial
V9.2 bootloader Empty check flag cleared by error on the bootloader startup phase
version
– Root cause: on the startup phase the bootloader SW performs a
system deinitialization, leading to write the default value on the
FLASH_ACR register, which overrides the Empty check bit with 0
– Behavior: when Empty check boot mode is used and the flash
memory is empty, the MCU boots on the bootloader but the flag is
cleared by the SW. If a reset is triggered, the system tries to boot on
the empty flash memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

AN2606 Rev 65 245/508

507
STM32G05xxx/061xx devices AN2606

48 STM32G05xxx/061xx devices

48.1 Bootloader configuration

The STM32G05xxx/061xx bootloader is activated by applying Pattern 11 (described in
Table 2). The following table shows the hardware resources used by this bootloader. Note
that STM32G050x do not have BOOT_LOCK(bit), so consider that when using Pattern 11.

Table 104. STM32G05xxx/061xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL

RCC HSI enabled
clocked by HSI).
4 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware

Common to all 8 Kbytes, starting from address 0x1FFF0000, contain the

System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF6800
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
USARTx Used to automatically detect the serial baud rate from the
SysTick timer Enabled
bootloader host for USART2s.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1100010x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.

246/508 AN2606 Rev 65

AN2606 STM32G05xxx/061xx devices

Table 104. STM32G05xxx/061xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1100010x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.

AN2606 Rev 65 247/508

507
STM32G05xxx/061xx devices AN2606

48.2 Bootloader selection

Figure 64 shows the bootloader selection mechanism.

Figure 64. Bootloader selection for STM32G05xxx/061xx

System reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure autobaudrate
USARTx

0x7F received
yes
on USARTx
yes
no
Disable all interrupt
Disable all interrupt
sources and other
no I2Cx address sources and other
interfaces clocks
detected interfaces clocks

Execute Configure non

BL_I2C_Loop for autobaudrate
I2Cx USARTx

Execute
BL_USART_Loop
for USARTx
MS56836V1

48.3 Bootloader version

Table 105 lists the STM32G05xxx/061xx devices bootloader versions.

248/508 AN2606 Rev 65

AN2606 STM32G05xxx/061xx devices

Table 105. STM32G05xxx/061xx bootloader versions

Version number Description Known limitations

Initial bootloader
V5.0 USART2 SW jitter issue on detection phase
version
Non-stretch command not working as expected and stretching the line
– Root cause: wrong BUSY check leads to not entering BUSY byte
generation while waiting for the Non stretch command to complete
Fix V5.0 – Behavior: when running a non-stretch commands instead of receiving a
V5.1 BUSY byte (0x76) while command is running; the BL is stretching the line
limitation
and no data is sent to the host.. This is noticed only on the non-stretch
erase command, as it can take few ms, and can cause an issue if the host
does not support the line stretching.
– Workaround: patch in RAM to use the correct check

AN2606 Rev 65 249/508

507
STM32G431xx/441xx devices AN2606

49 STM32G431xx/441xx devices

49.1 Bootloader configuration

The STM32G431xx/441xx bootloader is activated by applying Pattern 15 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 106. STM32G431xx/441xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the PLL

HSI enabled
clocked by HSI)
RCC
CRS is enabled for the DFU to allow USB to be clocked
-
by HSI48 48 MHz
16 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
Common to all
28 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
Securable The address to jump to the exit securable memory area
- -
memory area @0x1FFF6800
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
PC11 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

250/508 AN2606 Rev 65

AN2606 STM32G431xx/441xx devices

Table 106. STM32G431xx/441xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1010100x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin PC4 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PA8 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1010100x (x = 0 for write and
x = 1 for read)
I2C3_SCL pin PC8 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PC9 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1 SPI1_MOSI pin Input
down mode.
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin
mode.
Input
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin
down mode.

AN2606 Rev 65 251/508

507
STM32G431xx/441xx devices AN2606

Table 106. STM32G431xx/441xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode.
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode.
PB12 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for USB
DFU communications.
DFU
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode. No
USB_DP pin
external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

252/508 AN2606 Rev 65

AN2606 STM32G431xx/441xx devices

49.2 Bootloader selection

The following figure shows the bootloader selection mechanism.

Figure 65. Bootloader selection for STM32G431xx/441xx

System reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx
Disable all interrupt Disable all interrupt Disable all interrupt
sources and other sources and other sources and other
interfaces clocks interfaces clocks interfaces clocks
Configure USARTx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C address
yes
detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
no Execute DFU
bootloader using USB
interrupts
no

USB cable yes

detected

MS51432V2

AN2606 Rev 65 253/508

507
STM32G431xx/441xx devices AN2606

49.3 Bootloader version

Table 107. STM32G431xx/441xx bootloader version
Version number Description Known limitations

V13.3 (0xD3) Initial bootloader version CCSRAM not supported

Fix V13.3 limitations
V13.4 (0xD4) -
Add CCSRAM support

254/508 AN2606 Rev 65

AN2606 STM32G47xxx/48xxx devices

50 STM32G47xxx/48xxx devices

50.1 Bootloader configuration

The STM32G47xxx/48xxx bootloader is activated by applying Pattern 14 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 108. STM32G47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the

HSI enabled
PLL clocked by HSI)
RCC
CRS is enabled for the DFU to allow USB to be
-
clocked by HSI48 48 MHz
16 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
Common to all
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
- The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG
- watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to the exit securable memory
- -
area area @0x1FFF6800
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 65 255/508

507
STM32G47xxx/48xxx devices AN2606

Table 108. STM32G47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
Target 7-bit address: 0b1010011x
I2C2 (x = 0 for write and x = 1 for read)
PC4 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PA8 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
Target 7-bit address: 0b1010011x
I2C3 (x = 0 for write and x = 1 for read)
PC8 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The I2C4 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C4 Enabled Analog filter ON
Target 7-bit address: 0b1010011x
I2C4 (x = 0 for write and x = 1 for read)
PC6 pin: clock line is used in open-drain pull-up
I2C4_SCL pin Input/output
mode.
PC7 pin: data line is used in open-drain pull-up
I2C4_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1 SPI1_MOSI pin Input
pull-down mode.
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull no pull-
SPI1_SCK pin Input
up, pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

256/508 AN2606 Rev 65

AN2606 STM32G47xxx/48xxx devices

Table 108. STM32G47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull,
SPI2_MOSI pin Input
npull-down mode.
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, n pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 65 257/508

507
STM32G47xxx/48xxx devices AN2606

50.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 66. Bootloader selection for STM32G47xxx/48xxx

System reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx
Disable all interrupt Disable all interrupt Disable all interrupt
sources and other sources and other sources and other
interfaces clocks interfaces clocks interfaces clocks
Configure USARTx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C address
yes
detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
no Execute DFU
bootloader using USB
interrupts
no

USB cable yes

detected

MS51432V2

258/508 AN2606 Rev 65

AN2606 STM32G47xxx/48xxx devices

Figure 67. Dual bank boot implementation for STM32G47xxx/48xxx bootloader V13.x

System Reset

If Boot from
FLASH
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader executio
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MS52833V1

50.3 Bootloader version

Table 109. STM32G47xxx/48xxx bootloader version
Version number Description Known limitations

V13.3 (0xD3) Initial bootloader version Boot from bank2 is not working

AN2606 Rev 65 259/508

507
STM32G47xxx/48xxx devices AN2606

Table 109. STM32G47xxx/48xxx bootloader version (continued)

Version number Description Known limitations

V13.4 (0xD4) Fix V13.3 limitations CCSRAM/ENGI not supported

– Fix V13.4 limitations
V13.5 (0xD5) None
– Add CCSRAM/ENGI support

260/508 AN2606 Rev 65

AN2606 STM32G491xx/4A1xx devices

51 STM32G491xx/4A1xx devices

51.1 Bootloader configuration

The STM32G491xx/4A1xx bootloader is activated by applying Pattern 15 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 110. STM32G491xx/4A1xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 72 MHz (using the

HSI enabled
PLL clocked by HSI)
RCC
CRS is enabled for the DFU to allow USB to be
-
clocked by HSI48 48 MHz
16 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware
Common to all
28 Kbytes, starting from address 0x1FFF0000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Securable memory The address to jump to the exit securable memory
- -
area area @0x1FFF6800
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 65 261/508

507
STM32G491xx/4A1xx devices AN2606

Table 110. STM32G491xx/4A1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
Target 7-bit address: 0b1011111x
I2C2 (x = 0 for write and x = 1 for read)
PC4 pin: clock line is used in open-drain pull-up
I2C2_SCL pin Input/output
mode.
PA8 pin: data line is used in open-drain pull-up
I2C2_SDA pin Input/output
mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
Target 7-bit address: 0b1011111x
I2C3 (x = 0 for write and x = 1 for read)
PC8 pin: clock line is used in open-drain pull-up
I2C3_SCL pin Input/output
mode.
PC9 pin: data line is used in open-drain pull-up
I2C3_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1 SPI1_MOSI pin Input
pull-down mode.
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode.(1)
PA5 pin: slave clock line, used in push-pull no pull-
SPI1_SCK pin Input
up, pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.

262/508 AN2606 Rev 65

AN2606 STM32G491xx/4A1xx devices

Table 110. STM32G491xx/4A1xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull,
SPI2_MOSI pin Input
npull-down mode.
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode.(1)
PB13 pin: slave clock line, used in push-pull, n pull-
SPI2_SCK pin Input
down mode.
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as bit DMATx enable on SPI
CR2 register is set to 0x1, the MISO line is set to 3.3 V.

AN2606 Rev 65 263/508

507
STM32G491xx/4A1xx devices AN2606

51.2 Bootloader selection

Figure 68. Bootloader selection for STM32G491xx/4A1xx

System reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx
Disable all interrupt Disable all interrupt Disable all interrupt
sources and other sources and other sources and other
interfaces clocks interfaces clocks interfaces clocks
Configure USARTx

Execute Execute Execute

BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C address
yes
detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
no Execute DFU
bootloader using USB
interrupts
no

USB cable yes

detected

MS51432V2

264/508 AN2606 Rev 65

AN2606 STM32G491xx/4A1xx devices

51.3 Bootloader version

Table 111. STM32G491xx/4A1xx bootloader version
Version number Description Known limitations

V13.2 Initial bootloader version None

AN2606 Rev 65 265/508

507
STM32H503xx devices AN2606

52 STM32H503xx devices

52.1 Bootloader configuration

The STM32H503xx bootloader is activated by applying Pattern 17 (described in Table 2).
Table 112 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_2 (see Section 4.10), so it inherits all its constraints.

Table 112. STM32H503xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 200 MHz (using PLL

HSI enabled
clocked by the HSI)
RCC CRS is enabled for the DFU to allow USB to be
-
clocked by HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x24000000, are
Common to all RAM -
used by the bootloader firmware
35 Kbytes, starting from address 0x0BF87000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as
USART1_TX pin Output
input until USART1 is detected.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA15 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA5 pin: USART2 in transmission mode. Set as
USART2_TX pin Output
input until USART2 is detected.
Once initialized, the configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
PA3 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-down mode.
PA4 pin: USART3 in transmission mode. Set as
USART3_TX pin Output
input until USART3 is detected.

266/508 AN2606 Rev 65

AN2606 STM32H503xx devices

Table 112. STM32H503xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz, 7-bit address, Target
I2C2 Enabled mode, Analog filter ON
– Target 7-bit address: 0b1100111x, x = 0 for write
I2C2 and x = 1 for read
PB3 pin: clock line is used in open-drain. pull up
I2C2_SCL pin Input/output
mode.
PB4 pin: data line is used in open-drain, pull up
I2C2_SDA pin Input/output
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, no
SPI1 SPI1_MOSI pin Input
pull mode.
PA0 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
PA8 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PB8 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PB1 pin: slave data input line, used in push-pull no
SPI2 SPI2_MOSI pin Input
pull mode
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
no pull mode.
PB10 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PB12 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.

AN2606 Rev 65 267/508

507
STM32H503xx devices AN2606

Table 112. STM32H503xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull no
SPI3 SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PD2 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for
USB Enabled USB DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as
DFU USB peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode. No
USB_DP pin
external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB5 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, no pull mode.
PB15 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, no pull mode.

268/508 AN2606 Rev 65

AN2606 STM32H503xx devices

Table 112. STM32H503xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

– Mode: target mode

– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: disabled
– Status FIFO: disabled
– DMA Req status: disabled
I3C Enabled – DMA Req control: disabled
– IBI: enabled
– Additional data after IBI ack-ed: 1 byte
I3C
– IBI configuration: Mandatory Data Byte (MDB)
– All IT disabled except RXFNE (Receive FIFO
Interrupt)
The RXFNE interruption is disabled after SYNC
byte detection by the bootloader.
PB6 pin: I3C1 in transmission mode. Used in
I3C1_SCL pin
alternate push-pull, no pull mode.
Input/output
PB7 pin: I3C1 in transmission mode. Used in
I3C1_SDA pin
alternate push-pull, no pull mode.

Table 113. STM32H503xx special commands

Special commands supported (USART/I2C/SPI/FDCAN/I3C)
Opcode - 0x50

Sub- Number of Number Number of status

Data sent Data Status data
Function Opcode data sent of data data received
(MSB first) received received
(2 bytes) (2 bytes) received (2 bytes)

Change Product state

product 0x01 0x4 targeted 0x0 NA 0x1 0x0
state Ex: 0x00000017
Reset 0x02 0x4 0x0 0x0 NA 0x1 0x0

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data are sent on USB frame by byte (LSB first). No need to add number of data to transmit
• Returned data and status are formatted on the USB native protocol

AN2606 Rev 65 269/508

507
STM32H503xx devices AN2606

52.2 Bootloader selection

Figure 69. Bootloader V14 selection for STM32H503xx

System reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USARTx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 200 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
broadcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx

MS57511V4

270/508 AN2606 Rev 65

AN2606 STM32H503xx devices

52.3 Bootloader version

Table 114. STM32H503xx bootloader version
Version number Description Known limitations

Bootloader crash when jumping to it with (HiDe Protection

V14.1 Initial bootloader version
Level = 3 + product state ≥ Provisioned)
– Fix known limitations
V14.2 – Change BL system clock None
from 160 to 200 MHz

AN2606 Rev 65 271/508

507
STM32H523xx/533xx devices AN2606

53 STM32H523xx/533xx devices

53.1 Bootloader configuration

The STM32H523xx/533xx bootloader is activated by applying Pattern 17 (described in
Table 2). Table 115 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_2 (see Section 4.10), so it inherits all its constraints.

Table 115. STM32H523xx/533xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 200 MHz (using PLL

HSI enabled
clocked by the HSI)
RCC CRS is enabled for the DFU to allow USB to be
-
clocked by HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x20000000, are
Common to all RAM -
used by the bootloader firmware
35 Kbytes, starting from address 0x0BF97000,
System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as
USART1_TX pin Output
input until USART1 is detected.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as
USART2_TX pin Output
input until USART2 is detected.
Once initialized, the configuration is 8-bit, even
USART3 Enabled
parity, and one stop bit
PD9 pin: USART3 in reception mode. Used in
USART3 USART3_RX pin Input
alternate push-pull, pull-down mode.
PD8 pin: USART3 in transmission mode. Set as
USART3_TX pin Output
input until USART3 is detected.

272/508 AN2606 Rev 65

AN2606 STM32H523xx/533xx devices

Table 115. STM32H523xx/533xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
– Analog filter ON
I2C3 – Target 7-bit address: 0b1101110x, x = 0 for write
and x = 1 for read
PB8 pin: clock line is used in open-drain. pull up
I2C3_SCL pin
mode.
Input/output
PB9 pin: data line is used in open-drain, pull up
I2C3_SDA pin
mode.
The I2C4 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C4 Enabled – Target mode
– Analog filter ON
I2C4 – Target 7-bit address: 0b1101110x, x = 0 for write
and x = 1 for read
PA8 pin: clock line is used in open-drain. pull up
I2C4_SCL pin
mode.
Input/output
PC9 pin: data line is used in open-drain, pull up
I2C4_SDA pin
mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, no
SPI1 SPI1_MOSI pin Input
pull mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
PA5 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin
mode.
Input
PA4 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin
pull mode.

AN2606 Rev 65 273/508

507
STM32H523xx/533xx devices AN2606

Table 115. STM32H523xx/533xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PC1 pin: slave data input line, used in push-pull, no
pull mode in all packages except LQFP48,
UFQFN48, and WLCSP39.
SPI2 SPI2_MOSI pin Input
PB15 pin: Slave data Input line, used in push-pull,
no pull mode in LQFP48, UFQFN48, and WLCSP39
packages.
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
no pull mode.
PB10 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin
mode.
Input
PB12 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin
pull mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull no
SPI3 SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin
mode.
Input
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin
pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for
USB DFU communications.
DFU PA11: USB DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin
pull mode.- No external pull-up resistor is required

274/508 AN2606 Rev 65

AN2606 STM32H523xx/533xx devices

Table 115. STM32H523xx/533xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN2 configuration is:

– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN2 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB5 pin: FDCAN2 in reception mode. Used in
FDCAN2_Rx pin Input
alternate push-pull, no pull mode.
PB13 pin: FDCAN2 in transmission mode. Used in
FDCAN2_Tx pin Output
alternate push-pull, no pull mode.
– Mode: target mode
– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: disabled
– Status FIFO: disabled
– DMA Req status: disabled
I3C1 Enabled – DMA Req control: disabled
– IBI: enabled
– Additional data after IBI ack-ed: 1 byte
– IBI configuration: Mandatory Data Byte (MDB)
I3C – All IT disabled except RXFNE (Receive FIFO
Interrupt). The RXFNE interruption is disabled
after SYNC byte detection by the bootloader.
PB6 pin: I3C1 in transmission mode. Used in
alternate push-pull, no pull mode in all packages
except LQFP48, UFQFN48, and WLCSP39.
I3C1_SCL pin
PB8 pin: I3C1 in transmission mode. Used in
Input/output alternate push-pull, no pull mode in LQFP48,
UFQFN48 and WLCSP39 packages..
PB7 pin: I3C1 in transmission mode. Used in
I3C1_SDA pin
alternate push-pull, no pull mode.

AN2606 Rev 65 275/508

507
STM32H523xx/533xx devices AN2606

Table 116. STM32H523xx/533xx special commands

Special commands supported (USART/I2C/SPI/FDCAN/I3C)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data sent Data status data
Function Opcode data sent data data
(MSB first) received received
(2 bytes) (2 bytes) received received
(2 bytes)

Product state
Change
0x01 0x4 targeted 0x0 NA 0x1 0x0
product state
Ex: 0x00000017
Reset 0x02 0x4 0x0 0x0 NA 0x1 0x0
Data RAM address – NA if
– 0x0 if
provisioning where data to success
0x83 0x4 success 0x1 0x0
Only when BL provision is – Error code
– 0x1 if fail
is on HDPL = 1 written if fail

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data are sent on USB frame by byte (LSB first). No need to add number of data to transmit
• Returned data and status is formatted on the USB native protocol

276/508 AN2606 Rev 65

AN2606 STM32H523xx/533xx devices

53.2 Bootloader selection

Figure 70 shows the bootloader selection mechanism.

Figure 70. Bootloader V14 selection for STM32H523xx/533xx

System Reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USARTx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 200 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
broadcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx
(only if I3C is
enabled by OB)
MS56544V2

AN2606 Rev 65 277/508

507
STM32H523xx/533xx devices AN2606

53.3 Bootloader version

Table 117. STM32H523xx/533xx bootloader version
Version number Description Known limitations

– PKG_ID wrongly detected when PKG_ID > 0xF

V14.0 Initial bootloader version
– I2C/I3C not working on BL as wrong pinout applied
V14.2 Fix known limitations None

278/508 AN2606 Rev 65

AN2606 STM32H562xx/563xx/573xx devices

54 STM32H562xx/563xx/573xx devices

54.1 Bootloader configuration

The STM32H562xx/563xx/573xx bootloader is activated by applying Pattern 17 (described
in Table 2). Table 118 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_2 (see Section 4.10), so it inherits all its constraints.

Table 118. STM32H562xx/563xx/573xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 200 MHz (using PLL clocked

HSI enabled
by the HSI)
RCC CRS is enabled for the DFU to allow USB to be clocked by
-
HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN

Common to all RAM 16 Kbytes, starting from address 0x20000000, are used by
-
the bootloader firmware
35 Kbytes, starting from address 0x0BF97000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART2 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PD9 pin: USART3 in reception mode. Used in alternate push-
USART3 USART3_RX pin Input
pull, pull-down mode.
PD8 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART3 is detected.

AN2606 Rev 65 279/508

507
STM32H562xx/563xx/573xx devices AN2606

Table 118. STM32H562xx/563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1100101x, x = 0 for write and x = 1
for read
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain. pull up mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain, pull up mode.
The I2C4 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C4 Enabled – Target mode
I2C4 – Analog filter ON
– Target 7-bit address: 0b1100101x, x = 0 for write and x = 1
for read
I2C4_SCL pin Input/output PD12 pin: clock line is used in open-drain. pull up mode.
I2C4_SDA pin Input/output PD13 pin: data line is used in open-drain, pull up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data input line, used in push-pull, no pull
SPI1_MOSI pin Input
mode.
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode.
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode.
SPI1_NSS pin Input PA4 pin: slave chip select pin used in push-pull, no pull mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI2
SPI2_MOSI pin Input PC1 pin: slave data input line, used in push, pull no pull mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode.
SPI2_SCK pin Input PB10 pin: slave clock line, used in push-pull, no pull mode.
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.

280/508 AN2606 Rev 65

AN2606 STM32H562xx/563xx/573xx devices

Table 118. STM32H562xx/563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI3 configuration is:

– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PC12 pin: slave data input line, used in push-pull no pull
SPI3_MOSI pin Input
mode
PC11 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode.
SPI3_SCK pin Input PC10 pin: slave clock line, used in push-pull, no pull mode.
PA15 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for USB DFU
communications.
PA11: USB DM line. Used in alternate push-pull, no pull
DFU USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required
Once initialized the FDCAN2 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN2 Enabled
– Mode = FDCAN_MODE_NORMAL AutoRetransmission =
ENABLE
FDCAN – TransmitPause = DISABLE
– ProtocolException = ENABLE
PB5 pin: FDCAN2 in reception mode. Used in alternate push-
FDCAN2_Rx pin Input
pull, no pull mode.
PB13 pin: FDCAN2 in transmission mode. Used in alternate
FDCAN2_Tx pin Output
push-pull, no pull mode.

AN2606 Rev 65 281/508

507
STM32H562xx/563xx/573xx devices AN2606

Table 118. STM32H562xx/563xx/573xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

– Mode: target mode

– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: disabled
– Status FIFO: disabled
– DMA Req status: disabled
I3C Enabled – DMA Req control: disabled
– IBI: enabled
I3C – Additional data after IBI ack-ed: 1 byte
– IBI configuration: Mandatory Data Byte (MDB)
– All IT disabled except RXFNE (Receive FIFO Interrupt)
The RXFNE interruption is disabled after SYNC byte
detection by the bootloader.
PB6 pin: I3C1 in transmission mode. Used in alternate push-
I3C1_SCL pin
pull, no pull mode.
Input/output
PB7 pin: I3C1 in transmission mode. Used in alternate push-
I3C1_SDA pin
pull, no pull mode.

Table 119. STM32H562xx/563xx/573xx special commands

Special commands supported (USART/I2C/SPI/FDCAN/I3C)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data sent Data status data
Function Opcode data sent data data
(MSB first) received received
(2 bytes) (2 bytes) received received
(2 bytes)

Product state
Change product
0x01 0x4 targeted 0x0 NA 0x1 0x0
state
Ex: 0x00000017
Reset 0x02 0x4 0x0 0x0 NA 0x1 0x0
Data RAM address – NA if
– 0x0 if
provisioning where data to success
0x83 0x4 success 0x1 0x0
Only when BL is provision is – Error code
– 0x1 if fail
on HDPL = 1 written if fail

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data are sent on USB frame by byte (LSB first). No need to add number of data to transmit
• Returned data and status is formatted on the USB native protocol

282/508 AN2606 Rev 65

AN2606 STM32H562xx/563xx/573xx devices

54.2 Bootloader selection

Figure 71 shows the bootloader selection mechanism.

Figure 71. Bootloader V14 selection for STM32H562xx/563xx/573xx

System reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USARTx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 200 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
broadcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx

MS57511V4

AN2606 Rev 65 283/508

507
STM32H562xx/563xx/573xx devices AN2606

54.3 Bootloader version

Table 120. STM32H562xx/563xx/573xx bootloader version
Version
Description Known limitations
number

V14.5 Fix known limitations (1) None

– Fix known limitations
V14.4 – Change BL system clock EEPROM sector erase not working on 1 Mbyte devices.
from 160 to 200 MHz
Bootloader crash when jumping to it with the following condition
V14.3 Initial bootloader version
(TrustZone® enabled + HiDe Protection = 3 + Product state ≥ Provisioned)
1. Only on 1 Mbytes devices.

A standalone EraseEEPROM function is added on the system memory at address

0x0BF9 F500. When an erase sector is needed:
1. Write at RAM address 0x2000 4000 (LSB to MSB)
c) Byte0: number of sectors to erase (N)
d) Byte1 to N (every byte contains the sector number, that is, 0 to 7 for Bank1, 8 to 15
for Bank2)
e) Example: to erase sector 3, 4, and 13, write 0x0303040D at address 0x20004000.
2. After the erase, go back to the bootloader.
3. To continue using the bootloader, a reconnect is needed.

284/508 AN2606 Rev 65

AN2606 STM32H72xxx/73xxx devices

55 STM32H72xxx/73xxx devices

55.1 Bootloader configuration

The STM32H72xxx/73xxx bootloader is activated by applying Pattern 10 (described in
Table 2). Table 121 shows the hardware resources used by this bootloader.

Table 121. STM32H72xxx/73xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 66 MHz (using PLL clocked by

HSI enabled
the HSI)
RCC CRS is enabled for the DFU to allow USB to be clocked by
-
HSI48 48 MHz
- 20 MHz derived from the PLLQ is used for FDCAN
16 Kbytes, starting from address 0x24000000, are used by
RAM -
the bootloader firmware
128 Kbytes, starting from address 0x1FF00000 contain the
Common to all
System memory - bootloader firmware. The bootloader start address is
0x1FF09800.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Voltage is set to Voltage Range 3.
Bootloader SW is writing to the PWR_CR3 register using 4
Power -
bytes, locking this register. Only Power off/on unlocks it. This
is fixed on the BL with 0x93 version.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
USART1 push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output push-pull, pull-up mode. Set as input until USART1 is
detected on the BL version 0x93.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2_RX pin Input
USART2 pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output push-pull, pull-up mode. Set as input until USART2 is
detected on the BL version 0x93.

AN2606 Rev 65 285/508

507
STM32H72xxx/73xxx devices AN2606

Table 121. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PB11 pin: USART3 in reception mode. Used in alternate
USART3 (on USART3_RX pin Input
push-pull, pull-down mode.
PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in alternate
USART3_TX pin Output push-pull, pull-down mode. Set as input until USART3 is
detected on the BL version 0x93.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PD9 pin: USART3 in reception mode. Used in alternate push-
USART3 (on USART3_RX pin Input
pull, pull-down mode.
PD8/PD9)
PD8 pin: USART3 in transmission mode. Used in alternate
USART3_TX pin Output push-pull, pull-down mode. Set as input until USART3 is
detected on the BL version 0x93.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1011100x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1011100x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PF1 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1011100x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PA8 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC9 pin: data line is used in open-drain no pull mode.

286/508 AN2606 Rev 65

AN2606 STM32H72xxx/73xxx devices

Table 121. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
PA7 pin: slave data input line, used in push-pull, no pull
SPI1_MOSI pin Input
mode.
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode.
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode.
SPI1_NSS pin Input PA4 pin: slave chip select pin used in push-pull, no pull mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PC12 pin: slave data input line, used in push-pull no pull
SPI3_MOSI pin Input
mode
PC11 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode.
SPI3_SCK pin Input PC10 pin: slave clock line, used in push-pull, no pull mode.
PA15 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
The SPI4 configuration is:
– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull, pull-down
SPI4_MOSI pin Input
SPI4 mode
PE13 pin: slave data output line, used in push-pull, pull-down
SPI4_MISO pin Output
mode.
SPI4_SCK pin Input PE12 pin: slave clock line, used in push-pull, pull-dpwn mode.
PE11 pin: slave chip select pin used in push-pull, pull-up
mode.
SPI4_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.

AN2606 Rev 65 287/508

507
STM32H72xxx/73xxx devices AN2606

Table 121. STM32H72xxx/73xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB Enabled USB FS interrupt vector is enabled and used for USB DFU
communications.
PA11: USB DM line. Used in alternate push-pull, no pull
DFU USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL AutoRetransmission =
FDCAN (on ENABLE
PH13/PH14) TransmitPause = DISABLE
ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input
push-pull, pull-down mode.
PH13 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, pull-down mode.
Once initialized the FDCAN1 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL AutoRetransmission =
FDCAN (on ENABLE
PD1/PD0) TransmitPause = DISABLE
ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input
pull, pull-down mode.
PD1 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, pull-down mode.

288/508 AN2606 Rev 65

AN2606 STM32H72xxx/73xxx devices

55.2 Bootloader selection

Figure 72 shows the bootloader selection mechanism.

Figure 72. Bootloader V9.0 selection for STM32H72xxx/73xxx

System Reset

Configure System clock to

66 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS Device

Configure I2Cx

Configure SPIx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MS54027V2

AN2606 Rev 65 289/508

507
STM32H72xxx/73xxx devices AN2606

55.3 Bootloader version

Table 124 lists the STM32H72xxx/73xxx devices bootloader versions.

Table 122. STM32H72xxx/73xxx bootloader version

Version
Description Known limitations
number

– TCM_AXI OB cannot be modified using all BL interfaces

V9.1 Initial bootloader version – String returned describing the memory size when using
USB is wrong
– Crash loop when booting on the BL, setting RDP to
Level1, doing a reset or power on/off and the USB cable
is plugged.
– BL is not working in RDP Level1 when
Fix all issues of previous
V9.2 TCM_AXI_SHARED option byte is not “0”. Value of this
release
OB must be set to “0” before going to RDP L1.
– Bootloader SW is writing to the PWR_CR3 register using
4 bytes, which is locking this register. Only Power off/on
will unlock it.
– Fix all issues of
previous release.
V9.3 – Modify USART TX None
from push pull mode in
the previous versions
to input.

290/508 AN2606 Rev 65

AN2606 STM32H74xxx/75xxx devices

56 STM32H74xxx/75xxx devices

56.1 Bootloader configuration

The STM32H74xxx/75xxx bootloader is activated by applying Pattern 10 (described in
Table 2). Table 123 shows the hardware resources used by this bootloader.

Table 123. STM32H74xxx/75xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz using the HSI.

The HSI clock source is used at startup (interface
HSI enabled
detection phase) and when USART or SPI or I2C
interface is selected.
RCC
CRS is enabled for the DFU to allow USB to be
-
clocked by HSI48 48 MHz
Clock used for the FDCAN is fixed to 20 MHz and is
-
derived from PLLQ
16 Kbytes, starting from address 0x20000000, and
208 Kbytes (reduced to 20 Kbytes in V9.1 version)
RAM -
starting from address 0x24000000, are used by the
Common to all bootloader firmware
122 Kbytes, starting from address 0x1FF00000
System memory - contain the bootloader firmware. The bootloader start
address is 0x1FF09800.
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Voltage is set to Range 3. Bootloader software writes
to the PWR_CR3 register using 4 bytes, which locks
Power -
this register. Only Power off/on unlocks it. This is
fixed on the bootloader with 0x91 version.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 (on USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9/PA10)
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output alternate push-pull, pull-up mode. Set as input until
USART1 is detected on the bootloader version 0x91.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
USART1 (on PB15 pin: USART1 in reception mode.Used in input
USART1_RX pin Input
PB14/PB15) pull-up mode.
PB14 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate function push pull pull-up mode.

AN2606 Rev 65 291/508

507
STM32H74xxx/75xxx devices AN2606

Table 123. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity,

USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2_RX pin Input alternate push-pull, no pull mode. Used in alternate
USART2
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output alternate push-pull, pull-up mode. Set as input until
USART3 is detected on the bootloader version 0x91.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
PB11 pin: USART3 in reception mode. Used in
USART3_RX pin Input
USART3 alternate push-pull, pull-up mode.
PB10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output alternate push-pull, pull-up mode. Set as input until
USART3 is detected on the bootloader version 0x91.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C1 Enabled mode, Analog filter ON
– Target 7-bit address: 0b1001110x (x = 0 for write
I2C1 and x = 1 for read)
PB6 pin: clock line is used in open-drain no pull
I2C1_SCL pin Input/output
mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C2 Enabled mode, Analog filter ON
– Target 7-bit address: 0b1001110x (x = 0 for write
I2C2 and x = 1 for read)
PF1 pin: clock line is used in open-drain no pull
I2C2_SCL pin Input/output
mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C3 Enabled mode, Analog filter ON
– Target 7-bit address: 0b1001110x (x = 0 for write
I2C3 and x = 1 for read)
PA8 pin: clock line is used in open-drain no pull
I2C3_SCL pin Input/output
mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.

292/508 AN2606 Rev 65

AN2606 STM32H74xxx/75xxx devices

Table 123. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, no
SPI1 SPI1_MOSI pin Input
pull mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull mode.
PA5 pin: slave clock line, used in push-pull, no pull
SPI1_SCK pin Input
mode.
PA4 pin: slave chip select pin used in push-pull, no
SPI1_NSS pin Input
pull mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in push-pull, no
SPI2 SPI2_MOSI pin Input
pull mode.
PI2 pin: slave data output line, used in push-pull, no
SPI2_MISO pin Output
pull mode.
PI1 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PI0 pin: slave chip select pin used in push-pull, no
SPI2_NSS pin Input
pull mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull, no
SPI3 SPI3_MOSI pin Input
pull mode.
PC11 pin: slave data output line, used in push-pull,
SPI3_MISO pin Output
no pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.

AN2606 Rev 65 293/508

507
STM32H74xxx/75xxx devices AN2606

Table 123. STM32H74xxx/75xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull, no
SPI4 SPI4_MOSI pin Input
pull mode.
PE13 pin: slave data output line, used in push-pull,
SPI4_MISO pin Output
no pull mode.
PE12 pin: slave clock line, used in push-pull, no pull
SPI4_SCK pin Input
mode.
PE11 pin: slave chip select pin used in push-pull, no
SPI4_NSS pin Input
pull mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for USB
DFU communications.
PA11: USB DM line. Used in alternate push-pull, no
DFU USB_DM pin
pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no
USB_DP pin pull mode.
No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
AutoRetransmission = ENABLE
FDCAN – TransmitPause = DISABLE
– ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-up mode.
PH13 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-up mode.

Note: To connect to the bootloader USART1 using PB14/PB15 pins, user must send two
synchronization bytes. Baudrate is limited to 115200.
DFU mode does not support USBREGEN mode. If STM32 is powered by an 1.8 V source, it
is not possible to use the BL DFU unless 3.3 V is provided

294/508 AN2606 Rev 65

AN2606 STM32H74xxx/75xxx devices

56.2 Bootloader selection

Figure 73 shows the bootloader selection mechanism.

Figure 73. Bootloader V9.x selection for STM32H74xxx/75xxx

System Reset

Configure System clock to

64 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS Device

Configure I2Cx

Configure SPIx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MSv45966V4

AN2606 Rev 65 295/508

507
STM32H74xxx/75xxx devices AN2606

56.3 Bootloader version

Table 124 lists the STM32H74xxx/75xxx devices bootloader versions.

Table 124. STM32H74xxx/75xxx bootloader version

Version
Description Known limitations
number
– Go command is not working
– USART2 connection is not working
V13.2
Initial bootloader version – SPI1 connection is not working
(0xD2)
– Mass erase does not work correctly on I2C (only
Bank2 is erased in this command)
– Switch USB clock input from HSE to HSI48
V13.3 – Bank erase is not working on USART/SPI and I2C
with CRS
(0xD3) – DFU mass-erase not working
– Fix known limitations on the V13.2

296/508 AN2606 Rev 65

AN2606 STM32H74xxx/75xxx devices

Table 124. STM32H74xxx/75xxx bootloader version (continued)

Version
Description Known limitations
number
– First ACK not received on Go command when
using USART or SPI
– On the FDCAN write memory, write of data with
length > 63 bytes fails
– If PB15 is set to GND, user cannot connect to BL
interfaces. Only the USB is able to connect as it
uses interrupt for detection. PB15 must not be
pulled down if USART1 on PB14/PB15 is not used
– Jump issue on some application.Application stack
pointer must be lower than (RAM end @ - 16 bytes)
– Add support of FDCAN interface to guarantee it is working
V9.0 – Fix V13.3 limitations – Additional reset needed after power off/on to
(0x90) – V9.0 is the latest version in production and enable connection to the BL interfaces. As a
replaces V13.2 and V13.3 workaround user can add a pull up on PA11 pin.’
– Cannot program the "CM4_BOOT_ADDx" option
byte using BL in dual core case
– FDCAN Get version command is giving a bad
FDCAN protocol version (0x11). It must be 0 x10
(V1.0)
– SRAM1/SRAM2/SRAM3 (0x30000000-
0x30047FFF) and ITCM memories not accessible
by the BL
– Number of supported commands is wrong (13
instead of 11)

AN2606 Rev 65 297/508

507
STM32H74xxx/75xxx devices AN2606

Table 124. STM32H74xxx/75xxx bootloader version (continued)

Version
Description Known limitations
number
If PB15 is set to GND, user cannot connect to BL
interfaces

SRAM1/SRAM2/SRAM3 (0x30000000 to
0x30047FFF) and ITCM memories not accessible by
the BL

Jump issue on some applications. Application stack

pointer must be lower than (RAM end address - 16
bytes) to guarantee it is working

Fix V9.0 limitations Erase on bank2 not working as expected

– Fix the configuration of PWR control register – Root cause: check bad busy value while erasing on
CR3. Bootloader is no more blocking the bank2.
change of PWR source – Behavior: when erase on bank2 is requested, SW
– Adjust USB, I2C erase and program timings exits while the operation is ongoing. Sending a new
V9.1 and fix them command invoking the flash memory after the
(0x91) – Fix FDCAN version from V1.0 to V1.1 erase can hang the system.
– Fix write issue when using FDCAN – Workaround: worst case erase timing from the
product datasheet can be added after the erase
– Fix missing PCROP disable in RDP level1
command to allow the FLITF to complete the erase.
regression
A safer method is to use a RAM patch for the erase
– Update option byte support to handle all command.
possible use cases

Same data are output on the USART1_TX PB14

when using USART1 on PA10/PA9.
– Root cause: both USART1 TX pins PA9 and PB14
configured as alternate push pull-up and
PB15/PB14 pins not disabled when PA10/PA9 set
used by the customer.
– Behavior: same data are output on USART1 TX
pins PA9 and PB14.
– Caution: take care to what PB14 is connected on
your design to not damage it when using USART1
on PA10/PA9.

298/508 AN2606 Rev 65

AN2606 STM32H7A3xx/7B3xx/7B0xx devices

57 STM32H7A3xx/7B3xx/7B0xx devices

57.1 Bootloader configuration

The STM32H7A3xx/7B3xx/7B0xx bootloader is activated by applying Pattern 10 (described
in Table 2). Table 125 shows the hardware resources used by this bootloader.

Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

HSI enabled The system clock frequency is 64 MHz using the HSI.
CRS is enabled for the DFU to allow USB to be clocked
-
RCC by HSI48 48 MHz
Clock used for the FDCAN is fixed to 20 MHz and is
-
derived from PLLQ
16 Kbytes, starting from address 0x24000000, are
RAM -
used by the bootloader firmware
128 Kbytes, starting from address 0x1FF00000 contain
Common to all
System memory - the bootloader firmware. The bootloader start address
is 0x1FF0A000
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent watchdog
IWDG -
reset (if the hardware IWDG option was previously
enabled by the user).
Bootloader software writes to PWR_CR3 register using
Power - four bytes, which locks it, only Power off/on unlocks it.
Fixed on the bootloader with 0x92 versions.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1_RX pin Input
USART1 alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output alternate push-pull, pull-up mode. Set as input until
USART1 is detected on the bootloader version 0x92.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input
USART2 push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output alternate push-pull, pull-up mode. Set as input until
USART2 is detected on the bootloader version 0x92.

AN2606 Rev 65 299/508

507
STM32H7A3xx/7B3xx/7B0xx devices AN2606

Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity,

USART3 Enabled
and one stop bit
PB11 pin: USART3 in reception mode. Used in
USART3 on USART3_RX pin Input
alternate push-pull, pull-down mode.
(PB10/PB11)
PB10 pin: USART3 in transmission mode. Used in
USART3_TX pin Output alternate push-pull, pull-down mode. Set as input until
USART3 is detected on the bootloader version 0x92.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
PD9 pin: USART3 in reception mode. Used in alternate
USART3 on USART3_RX pin Input
push-pull, pull-down mode.
(PD8/PD9)
PD8 pin: USART3 in transmission mode. Used in
USART3_TX pin Output alternate push-pull, pull-down mode. Set as input until
USART3 is detected on the bootloader version 0x92.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C1 Enabled mode, Analog filter ON
I2C1 – Target 7-bit address: 0b10101111x (x = 0 for write
and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB9 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C2 Enabled mode, Analog filter ON
I2C2 – Target 7-bit address: 0b10101111x (x = 0 for write
and x = 1 for read)
I2C2_SCL pin Input/output PF1 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PF0 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target
I2C3 Enabled mode, Analog filter ON
I2C3 – Target 7-bit address: 0b10101111x (x = 0 for write
and x = 1 for read)
I2C3_SCL pin Input/output PA8 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC9 pin: data line is used in open-drain no pull mode.

300/508 AN2606 Rev 65

AN2606 STM32H7A3xx/7B3xx/7B0xx devices

Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, no
SPI1 SPI1_MOSI pin Input
pull-up no pull-down mode.
PA6 pin: slave data output line, used in push-pull, no
SPI1_MISO pin Output
pull-up no pull-down mode.
PA5 pin: slave clock line, used in push-pull no pull-up,
SPI1_SCK pin Input
no pull-up no pull-down mode.
PA4 pin: slave chip select pin used in push-pull, pull-
SPI1_NSS pin Input
down mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PI3 pin: slave data input line, used in push-pull, no pull
SPI2 SPI2_MOSI pin Input
mode.
PI2 pin: slave data output line, used in push-pull, no
SPI2_MISO pin Output
pull mode.
PI1 pin: slave clock line, used in push-pull, no pull
SPI2_SCK pin Input
mode.
PI0 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PC12 pin: slave data input line, used in push-pull, no
SPI3 SPI3_MOSI pin Input
pull mode
PC11 pin: slave data output line, used in push-pull, no
SPI3_MISO pin Output
pull mode.
PC10 pin: slave clock line, used in push-pull, no pull
SPI3_SCK pin Input
mode.
PA15 pin: slave chip select pin used in push-pull, no
SPI3_NSS pin Input
pull mode.

AN2606 Rev 65 301/508

507
STM32H7A3xx/7B3xx/7B0xx devices AN2606

Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI4 configuration is:

– Slave mode
– Full Duplex
SPI4 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PE14 pin: slave data input line, used in push-pull, no
SPI4 SPI4_MOSI pin Input
pull up, no pull down mode
PE13 pin: slave data output line, used in push-pull, no
SPI4_MISO pin Output
pull up, no pull down mode.
PE12 pin: slave clock line, used in push-pull, no pull up,
SPI4_SCK pin Input
no pull down mode.
PE11 pin: slave chip select pin used in push-pull, no
SPI4_NSS pin Input
pull up, no pull down mode.
USB FS configured in forced device mode.
USB Enabled USB FS interrupt vector is enabled and used for USB
DFU communications.
DFU PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required.
Once initialized the FDCAN1 configuration is:
Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN on AutoRetransmission = ENABLE
(PH13/PH14) TransmitPause = DISABLE
ProtocolException = ENABLE
PH14 pin: FDCAN1 in reception mode. Used in
FDCAN1_Rx pin Input
alternate push-pull, pull-down mode.
PH13 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

302/508 AN2606 Rev 65

AN2606 STM32H7A3xx/7B3xx/7B0xx devices

Table 125. STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized the FDCAN1 configuration is:

Connection bit rate 250 kbit/s
Data bit rate 1000 kbit/s
FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
Mode = FDCAN_MODE_NORMAL
FDCAN on AutoRetransmission = ENABLE
(PD1/PD0) TransmitPause = DISABLE
ProtocolException = ENABLE
PD0 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input
push-pull, pull-down mode.
PD1 pin: FDCAN1 in transmission mode. Used in
FDCAN1_Tx pin Output
alternate push-pull, pull-down mode.

AN2606 Rev 65 303/508

507
STM32H7A3xx/7B3xx/7B0xx devices AN2606

57.2 Bootloader selection

Figure 73 shows the bootloader selection mechanism.

Figure 74. Bootloader V9.x selection for STM32H7A3xx/7B3xx/7B0xx

Configure System clock to

System Reset
64 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure
USB OTG FS device

Configure I2Cx

Configure SPIx

Configure USARTx Disable all interrupt

Exexute
sources and other
BL_FDCAN loop
interfaces clocks

Disable all interrupt Disable all interrupt

FD-CAN frame Configure
yes sources and other sources and other
detected USARTx TX
interfaces clocks interfaces clocks
no
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
0x7F received
yes for SPIx for I2Cx for USARTx
on USARTx

no

I2Cx address
yes
detected

no

SPIx detects
no
Synchro yes
mechanism

no

USB cable Execute DFU

yes bootloader using
detected
USB interrupts

MSv45966V5

304/508 AN2606 Rev 65

AN2606 STM32H7A3xx/7B3xx/7B0xx devices

57.3 Bootloader version

Table 126 lists the STM32H7A3xx/7B3xx/7B0xx devices bootloader versions.

Table 126. STM32H7A3xx/7B3xx/7B0xx bootloader version

Version
Description Known limitations
number

– String returned describing the flash memory size when

using USB is wrong (expected value 256 x 8 KB, but
V9.0 Initial bootloader version returns 256 x 2 KB)
– OTP memory is not supported by the bootloader
– Crash loop when booting on the bootloader, setting
RDP to Level1, doing a reset or power on/off and the
Fixes all issues of previous USB cable is plugged.
V9.1
release. – Bootloader software is writing to the PWR_CR3
register using four bytes, which is locking this register.
Only Power off/on unlocks it
– Fix all issues of previous
release
V9.2 – Modify USART TX from None
push pull mode in the
previous versions to input.

AN2606 Rev 65 305/508

507
STM32H7Rxxx/7Sxxx devices AN2606

58 STM32H7Rxxx/7Sxxx devices

58.1 Bootloader configuration

The STM32H7Rxxx/7S7xxx bootloader is activated by applying Pattern 17 (described in
Table 2). Table 127 shows the hardware resources used by this bootloader.

Table 127. STM32H7Rxxx/7Sxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 380 MHz using the PLL

HSI enabled
clocked by HSI
RCC - 20 MHz derived from the PLLQ is used for FDCAN.
CRS is enabled for the DFU to allow USB to be clocked by
HSI48 enabled
HSI48 48 MHz.
16 Kbytes, starting from address 0x24020000, are used by
Common to all RAM -
the bootloader firmware
32 Kbytes, starting from address 0x1FF18000 contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1_RX pin Input
USART1 push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output push-pull, pull-up mode. Set as input until USART1 is
detected on the bootloader version 0x91.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2_RX pin Input push-pull, no pull mode. Used in alternate push-pull, no
USART2
pull mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output push-pull, no pull mode. Set as input until USART3 is
detected on the bootloader version 0x91.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PD9 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
push-pull, no pull mode.
PD8 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART3.

306/508 AN2606 Rev 65

AN2606 STM32H7Rxxx/7Sxxx devices

Table 127. STM32H7Rxxx/7Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

UART4 Enabled
one stop bit
PD0 pin: UART4 in reception mode. Used in alternate
UART4 UART4_RX pin Input
push-pull, no pull mode.
PD1 pin: UART4 in transmission mode. Set as input until
UART4_TX pin Output
UART4 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 (1) – Analog filter ON
– Target 7-bit address: 0b1100001x (x = 0 for write and x =
1 for read)
I2C1_SCL pin PB8 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1100001x (x = 0 for write and x =
1 for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1100001x (x = 0 for write and x =
1 for read)
I2C3_SCL pin PA8 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PC9 pin: data line is used in open-drain pull-up mode.

AN2606 Rev 65 307/508

507
STM32H7Rxxx/7Sxxx devices AN2606

Table 127. STM32H7Rxxx/7Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, no pull
SPI1_MOSI pin Input
mode.
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode.
SPI1_SCK pin PA5 pin: slave clock line, used in push-pull, no pull mode.
Input PA4 pin: slave chip select pin used in push-pull, no pull
SPI1_NSS pin
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode.
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode.
SPI2_SCK pin PB13 pin: slave clock line, used in push-pull, no pull mode.
Input PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PC12 pin: slave data input line, used in push-pull, no pull
SPI3_MOSI pin Input
mode.
PB4 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode.
SPI3_SCK pin PB3 pin: slave clock line, used in push-pull, no pull mode.
Input PA15 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin
mode.

308/508 AN2606 Rev 65

AN2606 STM32H7Rxxx/7Sxxx devices

Table 127. STM32H7Rxxx/7Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB Enabled USB FS interrupt vector is enabled and used for USB DFU
communications.
DFU PM12: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output
PM11: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN2 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB5 pin: FDCAN2 in reception mode. Used in alternate
FDCAN2_Rx pin Input
push-pull, pull-up mode.
PB1 pin: FDCAN2 in transmission mode. Used in alternate
FDCAN2_Tx pin Output
push-pull, pull-up mode.
– Mode: target mode
– Aval timing:0x4E
– DMA Reg RX: disabled
– DMA Req TX: disabled
– Status FIFO: disabled
– DMA Req status: disabled
I3C1 Enabled – DMA Req control: disabled
– IBI: Enabled
I3C1(1) – Additional data after IBI ACK-ed: 1 byte
– IBI configuration: Mandatory Data Byte (MDB)
– All IT disabled except RXFNE (Receive FIFO Interrupt).
The RXFNE interruption is disabled after SYNC byte
detection by the bootloader.
PB8 pin: I3C1 in transmission mode. Used in alternate
I3C1_SCL pin
push-pull, no pull mode.
Input/output
PB7 pin: I3C1 in transmission mode. Used in alternate
I3C1_SDA pin
push-pull, no pull mode.
1. I2C1 and I3C1 are exclusive: only one of them can be used, depending on the option byte FLASH_OBW2SR_I2C_NI3C.

AN2606 Rev 65 309/508

507
STM32H7Rxxx/7Sxxx devices AN2606

Table 128. STM32H7Rxxx/7Sxxx special commands

Special commands supported (USART/I2C/SPI/FDCAN/USB/I3C)
Based on Go/Read commands on virtual addresses

Function Command Virtual address Data received

Get Security State 0xFF010001

Read 4 bytes security status
Get product state 0xFF010002
0xFF83xxxx (xxxx indicates LSB address of the
Data Provisioning
wrapper on the SRAM: 0x2404xxxx)
0xFF0100xx (xx indicates new product state value:
Change Product State Go N/A
17 for provisioning, 72 for closed, and 5C for locked)
0xFF02xxxx (xxxx indicates LSB address of the
Change Secure OB
wrapper on the SRAM: 0x2404xxxx)(1)
1. According to data written at address 0x2404xxxx, you can select option byte:
0: secure option byte i-Rot Select
1: secure option byte Writeprotection
2: secure option byte writeunprotect
3: secure option byte HDP.
For secure option bytes i-Rot Select, Writeprotection or HDP start and HDP end, the register values will be at address
(0x2404xxxx + 0x00000004).
Example: HDP options bytes:
write at 0x24040000 the value 0x00000003
write at 0x24040004 the value 0x00EE0011 (EE: HDPend, 11:HDPstart)
go at 0xFF020000.

310/508 AN2606 Rev 65

AN2606 STM32H7Rxxx/7Sxxx devices

58.2 Bootloader selection

Figure 73 shows the bootloader selection mechanism.

Figure 75. Bootloader V14.x selection for STM32H7Rxxx/7Sxxx

System reset Disable all

or JumpToBL Exexute
0x7F detected interrupt sources
Yes BL_USART_Loop
on USARTx and other
for USARTx
interface clocks

De-Init system
Configure system No
clock to 380 MHz
with HSI and PLL
Disable all
Exexute
FDCAN frame interrupt sources
Yes BL_FDCAN_Loop
detected and other
for FDCANx
System Init (Clock, interface clocks
GPIOs, IWDG,
SysTick)
No

Disable all
Execute
Configure USB FS I2C address interrupt sources
Yes BL_I2C_Loop
device detected and other
for I2Cx
interface clocks

No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
No interface clocks

Configure I2Cx
No

Disable all
Configure SPIx I3Cx detects Execute
interrupt sources
broadcast and Yes BL_I3C_Loop
and other
synchro byte for I3Cx
interface clocks

Configure No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx
(only if I3C is
enabled by OB)
MS56537V2

AN2606 Rev 65 311/508

507
STM32H7Rxxx/7Sxxx devices AN2606

58.3 Bootloader version

Table 129 lists the STM32H7Rxxx/7Sxxx devices bootloader versions.

Table 129. STM32H7Rxxx/7Sxxx bootloader version

Version number Description Known limitations
V14.3 Initial bootloader version None

58.4 Jump to bootloader

If a user application jumping to the bootloader has the protection clock bits (xSPICKP or
FMCCKP) enabled, the bootloader will be stuck/crash on the clock configuration.
The following fields cannot be modified when FMCCKP bit from RCC_CKPROT register is
set to 1: PLL1ON, PLL2ON, PLL1QEN, PLL2REN, HSEON, HSION, CSION, FMCEN,
FMCLPEN, and FMCRST.
The following fields cannot be modified when xSPICKP bit from RCC_CKPROTR register is
set to 1: PLL2ON, PLL2SEN, PLL2TEN, HSEON, HSION, CSION, XSPIxEN, XSPIxLPEN,
and XSPIxRST..
Refer to the section describing clock protection on RM0477.
At the startup; the bootloader deinitialises all the peripherals (including the clock), then
reconfigures the clock based on PLL1 from HSI. In this case the bootloader is not be able to
switch correctly to the needed default clock (crash or hang may be seen, depending on the
application clock configuration)
Ensure that the protection clock bits (xSPICKP or FMCCKP) are disabled before jumping to
the BL.

312/508 AN2606 Rev 65

AN2606 STM32L01xxx/02xxx devices

59 STM32L01xxx/02xxx devices

59.1 Bootloader configuration

The STM32L01xxx/02xxx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 130 shows the hardware resources used by this bootloader.

Table 130. STM32L01xxx/02xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16

RCC HSI enabled
MHz as clock source.
2 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware

Common to all 4 Kbytes, starting from address 0x1FF00000,

System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 (on PA10 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
PA9/PA10) pull-up mode.
PA9 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 (on PA3 pin: USART2 in reception mode.Used in input
USART2_RX pin Input
PA2/PA3) pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USART2 SysTick timer Enabled
from the host for USARTx.

AN2606 Rev 65 313/508

507
STM32L01xxx/02xxx devices AN2606

Table 130. STM32L01xxx/02xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up to 8
SPI1 Enabled
MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1 (for all device
PA6 pin: slave data output line, used in push-pull,
packages except SPI1_MISO pin Output
pull-down mode
TSSOP14)
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI1 configuration is:
Slave mode, Full Duplex, 8-bit MSB, Speed up to
SPI1 Enabled
8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
PA14 pin: slave data output line, used in push-pull,
pull-down mode.
SPI1 (only for Note: This IO is also used as SWCLK for debug
SPI1_MISO pin Output
devices on interface, as a consequence debugger cannot
TSSOP14 package) connect to the device in "on-the-fly" mode when the
bootloader is running.
PA13 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input Note: NSS pin synchronization is required on
bootloader with SPI1 interface for devices on
TSSOP14 package.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.
Note: Due to empty check mechanism present on this product, it is not possible to jump from user
code to system bootloader. Such jump results in a jump back to user flash memory space.
But if the first 4 bytes of user flash memory (at 0x0800 0000) are empty at the moment of
the jump (i.e. erase first sector before jump or execute code from SRAM while flash is
empty), then system bootloader is executed when jumped to.

314/508 AN2606 Rev 65

AN2606 STM32L01xxx/02xxx devices

59.2 Bootloader selection

The Table 76 shows the bootloader selection mechanism.

Figure 76. Bootloader selection for STM32L01xxx/02xxx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received
yes
on USARTx

Disable all other

yes interfaces clocks
no

Disable all other Configure

interfaces clocks USARTx
SPIx detects
no Synchro
mechanism Execute Execute
BL_SPI_Loop BL_USART_Loop
for SPIx for USARTx

MSv38476V1

AN2606 Rev 65 315/508

507
STM32L01xxx/02xxx devices AN2606

59.3 Bootloader version

The following table lists the STM32L01xxx/02xxx devices bootloader versions.

Table 131. STM32L01xxx/02xxx bootloader versions

Version
Description Known limitations
number

Bootloader not functional with SPI1 interface for devices

V12.2 Initial bootloader version
on TSSOP14 package.
For the SPI1 interface for devices in TSSOP14, a falling
edge on NSS pin is required before staring
Adds support of SPI interface
communication, to properly synchronize the SPI interface.
V12.3 for devices in TSSOP14
If the NSS pin is grounded (all time from device reset) the
package.
SPI communication is not synchronized and bootloader
does not work properly with the SPI interface.

316/508 AN2606 Rev 65

AN2606 STM32L031xx/041xx devices

60 STM32L031xx/041xx devices

60.1 Bootloader configuration

The STM32L031xx/041xx bootloader is activated by applying Pattern 2 (described in
Table 2). The following table shows the hardware resources used by this bootloader.

Table 132. STM32L031xx/041xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16

RCC HSI enabled
MHz as clock source.
4 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware

Common to all 4 Kbytes, starting from address 0x1FF00000,

System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 (on PA10 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
PA9/PA10) pull-up mode.
PA9 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
input pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
USART2 (on PA3 pin: USART2 in reception mode. Used in input
USART2_RX pin Input
PA2/PA3) pull-up mode.
PA2 pin: USART2 in transmission mode.Used in
USART2_TX pin Output
input pull-up mode.
Used to automatically detect the serial baud rate
USART2 SysTick timer Enabled
from the host for USARTx.

AN2606 Rev 65 317/508

507
STM32L031xx/041xx devices AN2606

Table 132. STM32L031xx/041xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

Slave mode, Full Duplex, 8-bit MSB, Speed up to
SPI1 Enabled
8 MHz, Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
PA6 pin: slave data output line, used in push-pull,
SPI1 SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.
The bootloader Read/Write commands do not support SRAM space for this product.

318/508 AN2606 Rev 65

AN2606 STM32L031xx/041xx devices

60.2 Bootloader selection

Figure 77 shows the bootloader selection mechanism.

Figure 77. Bootloader selection for STM32L031xx/041xx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received on
yes
USARTx
Disable all other
interfaces clocks

no
yes Configure
Disable all other USARTx
interfaces clocks
SPIx detects
no Execute
Synchro
BL_USART_Loop
mechanism Execute for USARTx
BL_SPI_Loop for
SPIx
MS35035V1

60.3 Bootloader version

Table 133 lists the STM32L031xx/041xx devices bootloader versions.

Table 133. STM32L031xx/041xx bootloader versions

Version number Description Known limitations

V12.0 Initial bootloader version None

AN2606 Rev 65 319/508

507
STM32L05xxx/06xxx devices AN2606

61 STM32L05xxx/06xxx devices

61.1 Bootloader configuration

The STM32L05xxx/06xxx bootloader is activated by applying Pattern 1 (described in
Table 2). Table 134 shows the hardware resources used by this bootloader.

Table 134. STM32L05xxx/06xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
Power - Voltage range is set to Voltage Range 1.
4 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
Common to all
4 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

320/508 AN2606 Rev 65

AN2606 STM32L05xxx/06xxx devices

Table 134. STM32L05xxx/06xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2 SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

AN2606 Rev 65 321/508

507
STM32L05xxx/06xxx devices AN2606

61.2 Bootloader selection

Figure 78 shows the bootloader selection mechanism.

Figure 78. Bootloader selection for STM32L05xxx/06xxx

System Reset

Disable all
interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

0x7F received on
yes
USARTx
Disable all other
interfaces clocks

no
yes Configure
Disable all other USARTx
interfaces clocks
SPIx detects
no Execute
Synchro
BL_USART_Loop
mechanism Execute for USARTx
BL_SPI_Loop for
SPIx
MS35035V1

61.3 Bootloader version

Table 135 lists the STM32L05xxx/06xxx devices bootloader versions:

Table 135. STM32L05xxx/06xxx bootloader versions

Version
Description Known limitations
number

PA13 set in alternate push-pull, pull-up mode and PA14

V12.0 Initial bootloader version
set in alternate pull-up pull-down mode even if not used.

322/508 AN2606 Rev 65

AN2606 STM32L07xxx/08xxx devices

62 STM32L07xxx/08xxx devices

Two bootloader versions are available on STM32L07xxx/08xxx devices:

• V4.x supporting USART1, USART2 USART2, and DFU (USB FS device). This version
is embedded in STM32L072xx/73xx and STM32L082xx/83xx devices.
• V11.x supporting USART1, USART2, I2C1, I2C2, SPI1 and SPI2. This version is
embedded in other STM32L071xx/081xx devices.

62.1 Bootloader V4.x

62.1.1 Bootloader configuration

The STM32L07xxx/08xxx bootloader is activated by applying Pattern 2 or Pattern 7 when
dual bank boot feature is available (described in Table 2). Table 136 shows the hardware
resources used by this bootloader.

Table 136. STM32L07xxx/08xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
4 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware.
Common to all 8 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART2 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART2 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.

AN2606 Rev 65 323/508

507
STM32L07xxx/08xxx devices AN2606

Table 136. STM32L07xxx/08xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode. USB FS interrupt

USB Enabled
vector is enabled and used for USB DFU communications.
PA11 pin: USB FS DM line. Used in alternate push-pull, no
DFU USB_DM pin
pull mode.
Input/output
PA12 pin: USB FS DP line. Used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

324/508 AN2606 Rev 65

AN2606 STM32L07xxx/08xxx devices

62.1.2 Bootloader selection

Figure 79 and Figure 80 show the bootloader selection mechanism.

Figure 79. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V4.x

System Reset

If Boot0 = 0 no

yes

If Value of first
address of Bank2 is Protection
within int. SRAM
yes no
level2 enabled
address
Set Bank Swap to
Bank2
Continue Bootloader
no Jump to user yes
execution
code in Bank2

If Value of first If Value of first

address of Bank1 is address of Bank2 is
within int. SRAM within int. SRAM
address address
yes yes

no

no
Protection
level2 enabled
yes

Set Bank Swap to Set Bank Swap to Set Bank Swap to

no Bank1 Bank1 Bank2

Continue Bootloader
Jump to user Jump to user Jump to user
execution
code in Bank1 code in Bank1 code in Bank2

MSv38477V1

AN2606 Rev 65 325/508

507
STM32L07xxx/08xxx devices AN2606

Figure 80. Bootloader V4.x selection for STM32L07xxx/08xxx

Bootloader

Configure System clock

to 32 MHz with HSI

Configure USB clock to 48

MHz with HSI as clock source

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB FS device

0x7F received on
yes
USARTx
Disable all
interrupt sources
no
Configure
USARTx
USB cable
yes
Detected
no Execute
Execute DFU bootloader BL_USART_Loop
using USB interrupts for USARTx

MSv38442V1

62.1.3 Bootloader version

Table 137 lists the STM32L07xxx/08xxx devices bootloader versions.

Table 137. STM32L07xxx/08xxx bootloader versions

Version number Description Known limitations

PA4, PA5, PA6 and PA7 IOs are configured in

V4.0 Initial bootloader version
pull-down mode despite not used by bootloader
This new version implements PA4, PA5, PA6 and PA7 IOs are configured in
V4.1
the Dual Bank Boot feature. pull-down mode despite not used by bootloader

326/508 AN2606 Rev 65

AN2606 STM32L07xxx/08xxx devices

62.2 Bootloader V11.x

62.2.1 Bootloader configuration

The STM32L07xxx/08xxx bootloader is activated by applying Pattern 2 or Pattern 7 when
dual bank boot feature is available (see in Table 2). Table 138 shows the hardware
resources used by this bootloader.

Table 138. STM32L07xxx/08xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 32 MHz with HSI 16 MHz as

RCC HSI enabled
clock source.
5 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
Common to all 8 Kbytes, starting from address 0x1FF00000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART2 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART2 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
– Target 7-bit address: 0b1000010x
I2C1
– (x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: I2C1 clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: I2C1 data line is used in open-drain no pull mode.

AN2606 Rev 65 327/508

507
STM32L07xxx/08xxx devices AN2606

Table 138. STM32L07xxx/08xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 400 kHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
– Target 7-bit address: 0b1000010x
I2C2
– (x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: I2C2 clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: I2C2 data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
SPI2 mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.

The system clock is derived from the embedded internal high-speed RC for all bootloader
interfaces. No external quartz is required for bootloader operations.

328/508 AN2606 Rev 65

AN2606 STM32L07xxx/08xxx devices

62.2.2 Bootloader selection

Figure 81 and Figure 82 show the bootloader selection mechanism.

Figure 81. Dual bank boot implementation for STM32L07xxx/08xxx bootloader V11.x

System Reset

If Boot0 = 0 no

yes

If Value of first
address of Bank2 is Protection
within int. SRAM
yes no
level2 enabled
address
Set Bank Swap to
Bank2
Continue Bootloader
no Jump to user yes
execution
code in Bank2

If Value of first If Value of first

address of Bank1 is address of Bank2 is
within int. SRAM within int. SRAM
address address
yes yes

no

no
Protection
level2 enabled
yes

Set Bank Swap to Set Bank Swap to Set Bank Swap to

no Bank1 Bank1 Bank2

Continue Bootloader
Jump to user Jump to user Jump to user
execution
code in Bank1 code in Bank1 code in Bank2

MSv38477V1

AN2606 Rev 65 329/508

507
STM32L07xxx/08xxx devices AN2606

Figure 82. Bootloader V11.x selection for STM32L07xxx/08xxx

Bootloader

Disable all
interrupt sources

System Init ( Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
detected

no
yes Disable all other
no interfaces clocks

Disable all other Disable all other Configure

interfaces clocks interfaces clocks USARTx
SPIx detects
Synchro
mechanism
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

MSv38443V2

62.2.3 Bootloader version

Table 139 lists the STM32L07xxx/08xxx devices bootloader versions:

Table 139. STM32L07xxx/08xxx bootloader V11.x versions

Version number Description Known limitations

V11.1 Initial bootloader version None

V11.2 This new version implements the Dual Bank Boot feature. None

330/508 AN2606 Rev 65

AN2606 STM32L1xxx6(8/B)A devices

63 STM32L1xxx6(8/B)A devices

63.1 Bootloader configuration

The STM32L1xxx6(8/B)A bootloader is activated by applying Pattern 1 (described in
Table 2). Table 140 shows the hardware resources used by this bootloader.

Table 140. STM32L1xxx6(8/B)A configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz.

2 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware.
4 Kbytes, starting from address 0x1FF00000
System memory -
contain the bootloader firmware.
Common to all
The IWDG prescaler is configured to its maximum
value and is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Power - Voltage is set to Voltage Range 1.
Once initialized, the USART1 configuration is 8
USART1 Enabled
bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration is 8
USART2 Enabled
bits, even parity, and one stop bit.
PD6 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.
Used to automatically detect the serial baud rate
USARTx SysTick timer Enabled
from the host.

The system clock is derived from the embedded internal high-speed RC, no external . No
external quartz is required for the bootloader execution.

AN2606 Rev 65 331/508

507
STM32L1xxx6(8/B)A devices AN2606

63.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 83. Bootloader selection for STM32L1xxx6(8/B)A devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35033V1

63.3 Bootloader version

The following table lists the STM32L1xxx6(8/B)A devices bootloader versions:

Table 141. STM32L1xxx6(8/B)A bootloader versions

Version
Description Known limitations
number

When a Read Memory or Write Memory command is

issued with an unsupported memory address and a
correct address checksum (i.e. address 0x6000 0000),
the command is aborted by the bootloader device, but the
V2.0 Initial bootloader version
NACK (0x1F) is not sent to the host. As a result, the next
two bytes ( the number of bytes to be read/written and its
checksum) are considered as a new command and its
checksum.(1)
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code, the limitation is not
perceived from the host, as the command is NACK-ed anyway (as an unsupported new command).

332/508 AN2606 Rev 65

AN2606 STM32L1xxx6(8/B) devices

64 STM32L1xxx6(8/B) devices

64.1 Bootloader configuration

The STM32L1xxx6(8/B) bootloader is activated by applying Pattern 1 (described in Table 2).
The following table shows the hardware resources used by this bootloader.

Table 142. STM32L1xxx6(8/B) configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz.

2 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware.
4 Kbytes, starting from address
System memory - 0x1FF00000 contain the bootloader
Common to all firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
Once initialized, the USART2 configuration
USART2 Enabled
is 8 bits, even parity, and one stop bit.
PD6 pin: USART2 in reception mode. Used
USART2 USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host.

The system clock is derived from the embedded internal high-speed RC, no external . No
external quartz is required for the bootloader execution.

AN2606 Rev 65 333/508

507
STM32L1xxx6(8/B) devices AN2606

64.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 84. Bootloader selection for STM32L1xxx6(8/B) devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

0x7F received on
USARTx

no yes

Disable all
interrupt sources

Configure
USARTx

Execute
BL_USART_Loop
for USARTx

MS35007V1

64.3 Bootloader version

The following table lists the STM32L1xxx6(8/B) devices bootloader versions:

Table 143. STM32L1xxx6(8/B) bootloader versions

Version
Description Known limitations
number

– When a Read Memory or Write Memory command is

issued with an unsupported memory address and a
correct address checksum (i.e. address 0x6000 0000),
the command is aborted by the bootloader device, but
the NACK (0x1F) is not sent to the host. As a result, the
V2.0 Initial bootloader version
next two bytes (the number of bytes to be read/written
and its checksum) are considered as a new command
and its checksum.(1)
– PA13/14/15 is configured in alternate push-pull (PA14
in pull-down) even if not used.
1. If the “number of data - 1” (N-1) to be read/written is not equal to a valid command code, the limitation is not
perceived from the host, as the command is NACK-ed anyway (as an unsupported new command).

334/508 AN2606 Rev 65

AN2606 STM32L1xxxC devices

65 STM32L1xxxC devices

65.1 Bootloader configuration

The STM32L1xxxC bootloader is activated by applying Pattern 1 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 144. STM32L1xxxC configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
HSI enabled USARTx and during USB detection for DFU
(once the DFU is selected, the clock source
is derived from the external crystal).
The external clock is mandatory only for the
DFU and must be in the following range:
RCC [24, 16, 12, 8, 6, 4, 3, 2] MHz.
HSE enabled
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU.
- Any failure (or removal) of the external
Common to all clock generates a system reset.
4 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog resets (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity and 1 stop bit.
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

AN2606 Rev 65 335/508

507
STM32L1xxxC devices AN2606

Table 144. STM32L1xxxC configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity and 1 stop bit. The
USART2 uses its remapped pins.
USART2 PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled rate from the host for the USARTx
bootloader.
USB Enabled USB used in FS mode
PA11: USB DM line. Used in input no pull
USB_DM pin
DFU mode.
Input/output
PA12: USB DP line. Used in input no pull
USB_DP pin
mode.

The system clock is derived from the embedded internal high-speed RC for the USARTx
bootloader. This internal clock is also used the for DFU, but only for the selection phase. An
external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for the execution of
the DFU after the selection phase.

336/508 AN2606 Rev 65

AN2606 STM32L1xxxC devices

65.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 85. Bootloader selection for STM32L1xxxC devices

System Reset

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB

USB cable
yes
Detected

no

HSE = 24, 16, 12, 8,

no
0x7F received on 6, 4, 3, 2 MHz
no USARTx

Generate System
yes yes reset

Reconfigure System
Disable all clock to 32MHz and
interrupt sources USB clock to 48 MHz

Configure
Execute DFU
USARTx
bootloader using USB
interrupts
Execute
BL_USART_Loop
for USARTx

MS35008V1

AN2606 Rev 65 337/508

507
STM32L1xxxC devices AN2606

65.3 Bootloader version

The following table lists the STM32L1xxxC devices bootloader versions.

Table 145. STM32L1xxxC bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

instead of 1 NACK are sent when a Read Memory
Initial bootloader or Write Memory command is sent and the RDP
V4.0
version level is active.
PA13/14/15 configured in alternate push-pull, pull
(PA14 in pull-down) even if not used

338/508 AN2606 Rev 65

AN2606 STM32L1xxxD devices

66 STM32L1xxxD devices

66.1 Bootloader configuration

The STM32L1xxxD bootloader is activated by applying Pattern 4 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 146. STM32L1xxxD configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
HSI enabled USARTx and during USB detection for DFU
(once the DFU is selected, the clock source
is derived from the external crystal).
The external clock is mandatory only for
DFU and it must be in the following range:
RCC [24, 16, 12, 8, 6, 4, 3, 2] MHz.
HSE enabled
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU.
- Any failure (or removal) of the external
Common to all clock generates system reset.
4 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

AN2606 Rev 65 339/508

507
STM32L1xxxD devices AN2606

Table 146. STM32L1xxxD configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity, and one stop bit. The
USART2 uses its remapped pins.
USART2 PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host for USARTx bootloader.
USB Enabled USB used in FS mode
PA11: USB DM line. Used in alternate
USB_DM pin
DFU push-pull, no pull mode.
Input/output
PA12: USB DP line. Used in alternate push-
USB_DP pin
pull, no pull mode.

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU, but only for the selection phase. An
external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for DFU execution
after the selection phase.

340/508 AN2606 Rev 65

AN2606 STM32L1xxxD devices

66.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 86. Bootloader selection for STM32L1xxxD devices

System Reset

BFB2 bit reset

(BFB2 = 0)

Protection
no yes
level2 enabled
If Value
@0x08030000 is
yes yes
within int. SRAM
address Jump to user code
in Bank2 If Value
no no @0x08030000 is
yes
within int. SRAM
If Value address
@0x08000000 is Jump to user code
yes in Bank2
within int. SRAM
address Jump to user code no
in Bank1
no If Value
@0x08000000 is
Continue Bootloader execution yes
within int. SRAM
address
Jump to user code
Disable all in Bank1
interrupt sources no

CPU blocked
System Init (Clock, GPIOs, (halted)
IWDG, SysTick)

Configure USB
yes

USB cable Generate System

Detected HSE detected no
reset

yes
no yes

Configure Reconfigure System

0x7F received on USARTx clock to 32MHz and
USARTx USB clock to 48 MHz
no
Execute
BL_USART_Loop
for USARTx
Execute DFU
bootloader using USB
interrupts MS35009V2

AN2606 Rev 65 341/508

507
STM32L1xxxD devices AN2606

66.3 Bootloader version

The following table lists the STM32L1xxxD devices bootloader versions:

Table 147. STM32L1xxxD bootloader versions

Version
Description Known limitations
number

– In the bootloader code the PA13

(JTMS/SWDIO) I/O output speed is
configured to 400 kHz, as a
consequence some debugger cannot
connect to the device in Serial Wire
mode when the bootloader is running.
V4.1 Initial bootloader version – When the DFU is selected, the RTC is
reset and thus all RTC information (such
as calendar, alarm) are lost including
backup registers. Note: When the
USART bootloader is selected there is
no change on the RTC configuration
(including backup registers).
– Stack overflow by 8 bytes when jumping
to Bank1/Bank2 if BFB2=0 or when
Read Protection level is set to 2.
Workaround: the user code must force in
the startup file the top of stack address
before to jump to the main program. This
can be done in the “Reset_Handler”
routine.
Fix V4.1 limitations (available on Rev.Z – When the Stack of the user code is
V4.2
devices only) placed outside the SRAM (i.e. @
0x2000C000) the bootloader cannot
jump to that user code which is
considered invalid. This might happen
when using compilers which place the
stack at a non-physical address at the
top of the SRAM (i,e. @ 0x2000C000).
Workaround: place manually the stack at
a physical address.
– For the USART interface, two
Fix V4.2 limitations. consecutive NACKs (instead of 1 NACK)
V4.5 DFU interface robustness enhancements are sent when a Read Memory or Write
(available on Rev.Y devices only). Memory command is sent and the RDP
level is active.

342/508 AN2606 Rev 65

AN2606 STM32L1xxxE devices

67 STM32L1xxxE devices

67.1 Bootloader configuration

The STM32L1xxxE bootloader is activated by applying Pattern 4 (described in Table 2). The
following table shows the hardware resources used by this bootloader.

Table 148. STM32L1xxxE configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 16 MHz

using the HSI. This is used only for
HSI enabled USARTx and during USB detection for DFU
(once the DFU is selected, the clock source
is derived from the external crystal).
The external clock is mandatory only for
DFU and it must be in the following range:
RCC [24, 16, 12, 8, 6, 4, 3, 2] MHz.
HSE enabled
The PLL is used to generate the USB
48 MHz clock and the 32 MHz clock for the
system clock.
The CSS interrupt is enabled for the DFU.
- Any failure (or removal) of the external
Common to all clock generates system reset.
4 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware.
8 Kbytes, starting from address
System memory - 0x1FF00000 contains the bootloader
firmware.
The IWDG prescaler is configured to its
maximum value and is periodically
IWDG - refreshed to prevent watchdog reset (if the
hardware IWDG option was previously
enabled by the user).
Power - Voltage is set to Voltage Range 1.
Once initialized, the USART1 configuration
USART1 Enabled
is 8 bits, even parity, and one stop bit.
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.

AN2606 Rev 65 343/508

507
STM32L1xxxE devices AN2606

Table 148. STM32L1xxxE configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the USART2 configuration

USART2 Enabled is 8 bits, even parity, and one stop bit. The
USART2 uses its remapped pins.
USART2 PD6 pin: USART2 in reception mode. Used
USART2_RX pin Input
in alternate push-pull, pull-up mode.
PD5 pin: USART2 in transmission mode.
USART2_TX pin Output
Used in alternate push-pull, pull-up mode.
Used to automatically detect the serial baud
USARTx SysTick timer Enabled
rate from the host for USARTx bootloader.
USB Enabled USB used in FS mode
DFU USB_DM pin PA11: USB DM line.
Input/output
USB_DP pin PA12: USB DP line.

The system clock is derived from the embedded internal high-speed RC for USARTx
bootloader. This internal clock is used also for DFU, but only for the selection phase. An
external clock in the range of [24, 16, 12, 8, 6, 4, 3, 2] MHz is required for DFU execution
after the selection phase.

344/508 AN2606 Rev 65

AN2606 STM32L1xxxE devices

67.2 Bootloader selection

The figure below shows the bootloader selection mechanism.

Figure 87. Bootloader selection for STM32L1xxxE devices

System Reset
no

BFB2 bit reset Protection level2

(BFB2 = 0) enabled

yes yes

If Value
no If Value @0x08040000 is @0x08040000 is within yes
yes
within int. SRAM address int. SRAM address

Jump to user code Jump to user code

no in Bank2 no in Bank2

If Value @0x08000000 is If Value @0x08000000 is

yes yes
within int. SRAM address within int. SRAM address

Jump to user code

in Bank1
no Jump to user code
no
in Bank1
Continue Bootloader execution
CPU blocked
(halted)

Disable all interrupt sources

System Init (Clock, GPIOs, HSE Generate

no
IWDG, SysTick) detected System Reset

Configure USB
Reconfigure System
clock to 32MHz and
USB cable USB clock to 48 MHz
detected
yes

no yes
Execute DFU
bootloader using USB
0x7F received interrupts
Configure USARTx
on USARTx

Execute BL_USART_Loop
no for USARTx

MS35034V3

AN2606 Rev 65 345/508

507
STM32L1xxxE devices AN2606

67.3 Bootloader version

Table 149 lists the STM32L1xxxE devices bootloader versions:

Table 149. STM32L1xxxE bootloader versions

Version number Description Known limitations

For the USART interface, two consecutive NACKs

(instead of 1 NACK) are sent when a Read
Memory or Write Memory command is sent and
V4.0 Initial bootloader version the RDP level is active.
PA13/14/15 configured in alternate push-pull, pull
(PA14 in pull-down) even if not used.

346/508 AN2606 Rev 65

AN2606 STM32L412xx/422xx devices

68 STM32L412xx/422xx devices

68.1 Bootloader configuration

The STM32L412xx/422xx bootloader is activated by applying Pattern 16 (described in
Table 2). Table 150 shows the hardware resources used by this bootloader.

Table 150. STM32L412xx/422xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 72 MHz and for USART, I2C, SPI and
RCC USB bootloader operation.
CRS is enabled for the DFU to allow USB to be clocked
-
by HSI48 48 MHz.
12 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain
Common to all System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is selected.
Power -
Bootloader firmware does not configure voltage scaling
range value in PWR_CR1 register.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode.
Once initialized, the configuration is 8-bit, even parity,
USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-
USART2 USART2_RX pin Input
up mode.
PA2 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
PC11 pin: USART3 in reception mode. Used in input
USART3 USART3_RX pin Input
pull-up mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.

AN2606 Rev 65 347/508

507
STM32L412xx/422xx devices AN2606

Table 150. STM32L412xx/422xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Used to automatically detect the serial baud rate from

USARTx SysTick timer Enabled
the host for USARTx.
The I2C1 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
Target 7-bit address: 0b1010010x
I2C1
(x = 0 for write and x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
Target 7-bit address: 0b1010010x
I2C2
(x = 0 for write and x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
Target 7-bit address: 0b1010010x
I2C3
(x = 0 for write and x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode.(1)
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.

348/508 AN2606 Rev 65

AN2606 STM32L412xx/422xx devices

Table 150. STM32L412xx/422xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode.(1)
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
USB FS configured in forced device mode.
USB FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required
1. SPI Tx (MISO) is handled by DMA. On the bootloader statup after SPI initialisation as soon as the bit DMATx enable on SPI
CR2 register is set to 0x1, the MISO line will be set to 3.3 V.

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

AN2606 Rev 65 349/508

507
STM32L412xx/422xx devices AN2606

68.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 88. Dual bank boot Implementation for STM32L412xx/422xx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

350/508 AN2606 Rev 65

AN2606 STM32L412xx/422xx devices

Figure 89.Bootloader V13.x selection for STM32L412xx/422xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes
Detected

no

Disable other
Synchro mechanism interfaces clocks
yes
detected on SPIx
Execute DFU
bootloader using USB
no
interrupts
no

USB cable yes

Detected

MS51432V1

AN2606 Rev 65 351/508

507
STM32L412xx/422xx devices AN2606

68.3 Bootloader version

Table 151 lists the STM32L412xx/422xx devices bootloader version.

Table 151. STM32L412xx/422xx bootloader versions

Version number Description Known limitations

– On connection phase, USART responds with two

ACK bytes (0x79) instead of one.
– PcROP option bytes cannot be written as
Bootloader uses Byte access while PcROP must
V13.1 Initial bootloader version
be accessed using half-word access.
Workaround: load a code snippet in SRAM using
Bootloader interface, then jump to it, and that code
writes PcROP value.

352/508 AN2606 Rev 65

AN2606 STM32L43xxx/44xxx devices

69 STM32L43xxx/44xxx devices

69.1 Bootloader configuration

The bootloader V9.1 version is updated to fix known limitations relative to USB-DFU
interface, and is implemented on devices with version information ID equal to 0x10 (refer to
Table 153 for more details).
The STM32L43xxx/44xxx bootloader is activated by applying Pattern 16 (described in
Table 2). Table 152 shows the hardware resources used by this bootloader.

Table 152. STM32L43xxx/44xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system

HSI enabled clock configured to 60 MHz and for USART, I2C, SPI
and USB bootloader operation.
CRS is enabled for the DFU to allow USB to be clocked
-
by HSI48 48 MHz.
RCC The HSE is used only when the CAN interface is
HSE enabled selected. The HSE must have one of the following
values [24,20,18,16,12,9,8,6,4] MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates
system reset
Common to all 12 Kbytes, starting from address 0x20000000, are used
RAM -
by the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value.
It is periodically refreshed to prevent watchdog reset (if
IWDG -
the hardware IWDG option was previously enabled by
the user).
The DFU cannot be used to communicate with
bootloader if the voltage scaling range 2 is selected.
Power -
Bootloader firmware does not configure voltage scaling
range value in PWR_CR1 register.
Once initialized, the configuration is 8-bit, even parity,
USART1 Enabled
and one stop bit
PA10 pin: USART1 in reception mode. Used in input no
USART1 USART1_RX pin Input
pull mode.
PA9 pin: USART1 in transmission mode. Used in input
USART1_TX pin Output
no pull mode.

AN2606 Rev 65 353/508

507
STM32L43xxx/44xxx devices AN2606

Table 152. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity,

USART2 Enabled
and one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-
USART2 USART2_RX pin Input
up mode.
PA2 pin: USART2 in transmission mode. Used in input
USART2_TX pin Output
pull-up mode.
Once initialized, the configuration is 8-bit, even parity,
USART3 Enabled
and one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in input
USART3_RX pin Input
pull-up mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
Used to automatically detect the serial baud rate from
USARTx SysTick timer Enabled
the host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
I2C1 – Target 7-bit address: 0b1001000x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
I2C2 – Target 7-bit address: 0b1001000x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
I2C3 – Target 7-bit address: 0b1001000x (x = 0 for write and
x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

354/508 AN2606 Rev 65

AN2606 STM32L43xxx/44xxx devices

Table 152. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-
SPI1_MOSI pin Input
down mode
SPI1
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
SPI2
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-
down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate
CAN1_RX pin Input
push-pull, pull-up mode.
CAN1 PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
This timer is used to determine the value of the HSE.
TIM16 Enabled Once the HSE frequency is determined, the system
clock is configured to 60 MHz using PLL and HSE.

AN2606 Rev 65 355/508

507
STM32L43xxx/44xxx devices AN2606

Table 152. STM32L43xxx/44xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.
SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as
soon as the bit DMATx enable on SPI CR2 register is set to 0x1, the MISO line is set to
3.3 V.

356/508 AN2606 Rev 65

AN2606 STM32L43xxx/44xxx devices

69.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 90. Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

AN2606 Rev 65 357/508

507
STM32L43xxx/44xxx devices AN2606

Figure 91. Bootloader V9.x selection for STM32L43xxx/44xxx

System Reset

Configure System clock to

60 MHz with HSI
Disable all interrupt
System Init (Clock, GPIOs, sources and other
IWDG, SysTick) interfaces clocks

Disable all interrupt Disable all interrupt

Configure USB Device FS sources and other sources and other Configure
using CRS and HSI48 as interfaces clocks interfaces clocks USARTx
clock source

Execute Execute Execute

Configure I2Cx BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

Configure SPIx

0x7F received on
USARTx yes

HSE detected no
no
Generate System
I2C Address yes reset
yes
Detected
Disable all interrupt
sources and other
no
interfaces clocks

SPIx detects yes Reconfigure System

Synchro mechanism clock to 60 MHz

no
Disable other Configure CAN
no interfaces clocks
Frame detected
on CANx yes
Execute DFU Execute
bootloader using USB BL_CAN_Loop for
no interrupts CANx

USB cable
yes
Detected

MSv38484V1

358/508 AN2606 Rev 65

AN2606 STM32L43xxx/44xxx devices

69.3 Bootloader version

Table 153 lists the STM32L43xxx/44xxx devices bootloader versions.

Table 153. STM32L43xxx/44xxx bootloader versions

Version
Description Known limitations
number

Check the Version Information ID of your STM32L43xxx/44xxx

device, which can be read at 0x1FFF6FF2 address.
Version Information ID equal to 0xFF:
– For memory write operations using DFU interface: If the buffer size
is larger than 256 bytes and not multiple of 8 bytes, the write
memory operation result is corrupted. Workaround: if the file size is
larger than 256 bytes, add byte padding to align it on 8-bytes
multiple size.
– For the USB-DFU interface, the CRS (clock recovery system) is not
correctly configured and this may lead to random USB
communication errors (depending on temperature and voltage). In
V9.1 Initial bootloader version
most case communication error will manifest by a "Stall" response
to setup packets.
– On the Go command, system bootloader de-init clears the
RTCAPBEN bit in the RCC_APB1ENR register
Workaround: manually call __HAL_RCC_RTC_CLK_ENABLE() in the
software which sets the RTCAPBEN bit.
Version Information ID equal to 0x10: None
– PcROP option bytes cannot be written as Bootloader uses Byte
access while PcROP must be accessed using half-word access.
Workaround: load a code snippet in SRAM using Bootloader
interface then jump to it, and that code writes the PcROP value.

AN2606 Rev 65 359/508

507
STM32L43xxx/44xxx devices AN2606

Table 153. STM32L43xxx/44xxx bootloader versions (continued)

Version
Description Known limitations
number

– SPI write operation fail Limitation:

a. During bootloader SPI write flash memory operation, some
random 64-bits (2 double-words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation which is interrupted
by SPI DMA and it leads to double access on same flash memory
address and the 64-bits are not written.
Workarounds:
a. WA1: add a delay between sending write command and its ACK
request. Its duration must be the duration of the 256-Bytes flash
memory write time.
b. WA2: read back after write and in case of error start write again.
c. WA3: Patch in RAM to write in flash memory that implements
V9.1 Initial bootloader version write memory without 64-bits cast. WA1 and WA3 are more efficient
(continued) (continued) than WA2 in terms of total programming time.
How critical is the limitation:
a. The limitation leads to a modification in customer SPI host
software by adding 3-4 ms delay to each write operation.
b. The delay is not waste because it is anyway the flash memory
write period of time that host has to wait anyway (so instead of
waiting by sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and cannot impact
USART/I2C/CAN
– If the RTC is used by application prior to booting (through a system
reset) on system bootloader, it is possible that CAN interface does
not work correctly (cannot establish connection) unless a power
cycle is performed or RTC is reset by application before booting on
System Bootloader

360/508 AN2606 Rev 65

AN2606 STM32L45xxx/46xxx devices

70 STM32L45xxx/46xxx devices

70.1 Bootloader configuration

The STM32L45xxx/46xxx bootloader is activated by applying Pattern 16 (described in
Table 2). Table 154 shows the hardware resources used by this bootloader.

Table 154. STM32L45xxx/46xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 72 MHz and for USART, I2C, SPI and USB
bootloader operation.
CRS is enabled for the DFU to allow USB to be clocked by
-
HSI48 48 MHz.

RCC The system clock frequency is 60 MHz.

HSE enabled The HSE is used only when the CAN interface is selected.
The HSE must have one of the following values
[24,20,18,16,12,9,8,6,4] MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
reset
Common to all
12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader firmware
Power -
does not configure voltage scaling range value in
PWR_CR1 register.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PA2 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.

AN2606 Rev 65 361/508

507
STM32L45xxx/46xxx devices AN2606

Table 154. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
USART3 PC11 pin: USART3 in reception mode. Used in input pull-up
USART3_RX pin Input
mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C1 Enabled Analog filter ON
I2C1 – Target 7-bit address: 0b1001010x (x = 0 for write and x =
1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C2 Enabled Analog filter ON
I2C2 – Target 7-bit address: 0b1001010x (x = 0 for write and x =
1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz, 7-bit address, Target mode,
I2C3 Enabled Analog filter ON
I2C3 – Target 7-bit address: 0b1001010x (x = 0 for write and x =
1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

362/508 AN2606 Rev 65

AN2606 STM32L45xxx/46xxx devices

Table 154. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
SPI2
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1_RX pin Input
pull, pull-up mode.
CAN1 PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
This timer is used to determine the value of the HSE. Once
TIM16 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

AN2606 Rev 65 363/508

507
STM32L45xxx/46xxx devices AN2606

Table 154. STM32L45xxx/46xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
peripheral is used by the bootloader.
DFU
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin mode.
No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

364/508 AN2606 Rev 65

AN2606 STM32L45xxx/46xxx devices

70.2 Bootloader selection

The following figures show the bootloader selection mechanism.

Figure 92. Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

AN2606 Rev 65 365/508

507
STM32L45xxx/46xxx devices AN2606

Figure 93.Bootloader V9.x selection for STM32L45xxx/46xxx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
yes
on USARTx

no

I2C Address
yes
Detected HSE detected no

Generate System
no reset
yes

Disable all interrupt

Synchro mechanism sources and other
yes interfaces clocks
detected on SPIx

Reconfigure System
no clock to 60 MHz
no

Frame detected Disable other Configure CAN

yes
on CANx interfaces clocks

Execute DFU Execute

no
bootloader using USB BL_CAN_Loop for
interrupts CANx
USB cable
yes
Detected

MSv45964V1

366/508 AN2606 Rev 65

AN2606 STM32L45xxx/46xxx devices

70.3 Bootloader version

Table 155 lists the STM32L45xxx/46xxx devices bootloader versions.

Table 155. STM32L45xxx/46xxx bootloader versions

Version number Description Known limitations

– PcROP option bytes cannot be written as

Bootloader uses Byte access while PcROP
must be accessed using half-word access.
Workaround: load a code snippet in SRAM
using Bootloader interface then jump to it, and
that code writes the PcROP value.
– SPI write operation fail limitation:
a. During Bootloader SPI write flash memory
operation, some random 64-bits (2 double-
words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation
which is interrupted by SPI DMA and it leads to
double access on same flash memory address
and the 64-bits are not written
Workarounds:
a. WA1: add a delay between sending write
V9.2 Initial bootloader version command and its ACK request. Its duration
must be the duration of the 256-Bytes flash
memory write time.
b. WA2: read back after write and in case of
error start write again.
c. WA3: Patch in RAM to write in flash memory
that implements write memory without 64-bits
cast. WA1 and WA3 are more efficient than
WA2 in terms of total programming time
How critical is the limitation:
a. The limitation leads to a modification in
customer SPI host software by adding 3-4 ms
delay to each write operation.
b. The delay is not waste because it is anyway
the flash memory write period of time that host
has to wait anyway (so instead of waiting by
sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and
cannot impact USART/I2C/CAN.

AN2606 Rev 65 367/508

507
STM32L47xxx/48xxx devices AN2606

71 STM32L47xxx/48xxx devices

Two bootloader versions are available:

• V10.x supporting USART, I2C and DFU (USB FS device).
This version is embedded in STM32L47xxx/48xxx rev. 2 and rev. 3 devices.
• V9.x supporting USART, I2C, SPI, CAN and DFU (USB FS device).
This version is embedded in STM32L47xxx/48xxx rev. 4 devices.

71.1 Bootloader V10.x

71.1.1 Bootloader configuration

The STM32L47xxx/48xxx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 156 shows the hardware resources used by this bootloader.

Table 156. STM32L47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for system clock
HSI enabled configured to 24 MHz and for USART and I2C bootloader
operation.
The HSE is used only when the USB interface is selected and
HSE enabled the LSE is not present. The HSE must have one of the
following values: 24, 20, 18, 16, 12,9, 8, 6, and 4 MHz.
The LSE is used to trim the MSI which is configured to 48
MHz as USB clock source. The LSE must be equal to
RCC LSE enabled
32.768 kHz. If the LSE is not detected, the HSE is used
instead if USB is connected.
The MSI is configured to 48 MHz and is used as USB clock
MSI enabled source. The MSI is used only if LSE is detected, otherwise,
HSE is used if USB is connected.
Common to all The CSS interrupt is enabled when LSE or HSE is enabled.
- Any failure (or removal) of the external clock generates
system reset.
12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader firmware
Power -
does not configure voltage scaling range value in PWR_CR1
register.

368/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

Table 156. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PA3 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PA2 pin: USART2 in transmission mode. Used in input pull-up
USART2_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
USART3 PC11 pin: USART3 in reception mode. Used i input pull-up
USART3_RX pin Input
mode.
USART3_TX pin Output PC10 pin: USART3 in transmission mode
Used to automatically detect the serial baud rate from the host
USARTx SysTick timer Enabled
for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000011x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1000011x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 369/508

507
STM32L47xxx/48xxx devices AN2606

Table 156. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address is 0b1000011x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PC0 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain no pull mode.
USB Enabled USB OTG FS configured in forced device mode
USB_DM pin PA11: USB DM line. Used in alternate push-pull, no pull mode.
Input/output PA12: USB DP line. Used in alternate push-pull, no pull mode.
DFU USB_DP pin
No external pull-up resistor is required
This timer is used to determine the value of the HSE. Once
TIM17 Enabled the HSE frequency is determined, the system clock is
configured to 24 MHz using PLL and HSE.

For USARTx and I2Cx bootloaders no external clock is required.

USB bootloader (DFU) requires either an LSE (low-speed external clock) or a HSE (high-
speed external clock):
• If the LSE is present regardless of the HSE presence, the MSI is configured and
trimmed by the LSE to provide an accurate clock equal to 48 MHz, which is the clock
source of the USB. The system clock is kept clocked to 24 MHz by the HSI.
• If the HSE is present, the system clock and USB clock are configured, respectively, to
24 MHz and 48 MHz with HSE as clock source.

370/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

71.1.2 Bootloader selection

Figure 94 and Figure 95 show the bootloader selection mechanism.

Figure 94. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V10.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

AN2606 Rev 65 371/508

507
STM32L47xxx/48xxx devices AN2606

Figure 95.Bootloader V10.x selection for STM32L47xxx/48xxx

Bootloader

Configure System clock

to 24 MHz with HSI

LSE detected no

yes
Configure USB clock to 48
MHz with HSI as clock source
Configure USB clock to 48
MHz with MSI as clock source

System Init (Clock, GPIOs,

IWDG, SysTick)
Disable all
interrupt sources
Configure USB OTG FS yes
device Configure
USARTx

Configure all I2Cs

Execute
BL_USART_Loop
for USARTx

0x7F received
on USARTx
Disable all
yes
interrupt sources
no

Execute
BL_I2C_Loop for
I2C Address I2Cx
Detected yes
MSI used as USB
no
clock source
no
yes HSE detected no

USB cable Generate System

Detected yes reset

yes Reconfigure System clock

to 24 MHz and USB clock
to 48 MHz with HSE

Execute DFU bootloader

using USB interrupts
MSv38432V2

372/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

71.1.3 Bootloader version

Table 157 lists the STM32L47xxx/48xxx devices bootloader V10.x versions:

Table 157. STM32L47xxx/48xxx bootloader V10.x versions

Version
Description Known limitations
number

For memory write operations using DFU interface: If

the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation result
V10.1 Initial bootloader version is corrupted.
Workaround: if the file size is larger than 256 bytes,
add byte padding to align it on 8-bytes multiple size.
Write in SRAM is corrupted.
For memory write operations using DFU interface: If
the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation result
V10.2 Fix write in SRAM issue
is corrupted.
Workaround: if the file size is larger than 256 bytes,
add byte padding to align it on 8-bytes multiple size.
– For memory write operations using DFU interface: If
the buffer size is larger than 256 bytes and not
multiple of 8 bytes, the write memory operation
result is corrupted.
Add support of MSI as USB clock
Workaround: if the file size is larger than 256 bytes,
source (MSI is trimmed by LSE).
add byte padding to align it on 8-bytes multiple size.
V10.3 Update dual bank boot feature to
– PcROP option bytes cannot be written as
support the case when user stack
Bootloader uses Byte access while PcROP must be
is mapped in SRAM2.
accessed using half-word access.
Workaround: load a code snippet in SRAM using
Bootloader interface then jump to it, and that code
writes the PcROP value.

AN2606 Rev 65 373/508

507
STM32L47xxx/48xxx devices AN2606

71.2 Bootloader V9.x

71.2.1 Bootloader configuration

The STM32L47xxx/48xxx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 158 shows the hardware resources used by this bootloader.

Table 158. STM32L47xxx/48xxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment
The HSI is used at startup as clock source for system clock
HSI enabled configured to 72 MHz and for USART and I2C bootloader
operation.
The HSE is used only when the USB interface is selected
and the LSE is not present. The HSE must have one of the
HSE enabled following values: 24, 20, 18, 16, 12, 8, 6, 4 MHz.
System is clocked at 72 MHz if USB is used or 60 MHz if
CAN is used.
The LSE is used to trim the MSI which is configured to 48
RCC
MHz as USB clock source. The LSE must be equal to
LSE enabled
32.768 kHz. If the LSE is not detected, the HSE is used
instead if USB is connected.
The MSI is configured to 48 MHz and is used as USB clock
MSI enabled source. The MSI is used only if LSE is detected, otherwise,
HSE is used if USB is connected.
Common to all
The CSS interrupt is enabled when LSE or HSE is enabled.
CSS Any failure (or removal) of the external clock generates
system reset.
13 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader
Power -
firmware does not configure voltage scaling range value in
PWR_CR1 register.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.

374/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

Table 158. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
Once initialized, the configuration is
USART2 Enabled
8-bit, even parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PA2 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.
Once initialized, the configuration is
USART3 Enabled
8-bit, even parity, and one stop bit
PC11 pin: USART3 in reception mode. Used in input pull-
USART3 USART3_RX pin Input
up mode.
PC10 pin: USART3 in transmission mode Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1000011x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1000011x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1000011x (x = 0 for write and
x = 1 for read)
I2C3_SCL pin PC0 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 375/508

507
STM32L47xxx/48xxx devices AN2606

Table 158. STM32L47xxx/48xxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware

SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-
SPI1_MISO pin Output
down mode(1)
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin
mode
Input
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin
mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware

SPI2 PB15 pin: slave data input line, used in push-pull, pull-
SPI2_MOSI pin Input
down mode
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode(1)
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin
mode
Input
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin
mode.
Once initialized the CAN1 configuration is: Baudrate 125
CAN1 Enabled
kbps, 11-bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1 CAN1_RX pin Input
pull, pull-up mode.
PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
USB FS configured in forced device mode. USB FS
interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
PA11 pin: USB FS DM line. Used in alternate push-pull, no
USB_DM pin
pull mode.
Input/output
PA12 pin: USB FS DP line. Used in alternate push-pull, no
USB_DP pin
pull mode. No external pull-up resistor is required.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

376/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

If the HSE is present, the system clock and USB clock are configured, respectively, to 72
and 48 MHz with PLL (clocked by HSE) as a clock source.
Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

71.2.2 Bootloader selection

Figure 96 and Figure 97 show the bootloader selection mechanism.

Figure 96. Dual bank boot implementation for STM32L47xxx/48xxx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

AN2606 Rev 65 377/508

507
STM32L47xxx/48xxx devices AN2606

Figure 97.Bootloader V9.x selection for STM32L47xxx/48xxx

Bootloader

Configure System clock to 72 MHz

with HSI

LSE detected no

yes

Configure USB clock to 48 MHz

with MSI as clock source
Configure USB clock to 48 MHz with HSI
as clock source

System Init(Clock,
GPIOs,IWDG,Systick)

Configure USB OTG FS device Disable all interrupt Disable all interrupt sources
Disable all interrupt sources
sources and other and other interfaces clocks
and other interfaces clocks
interfaces clocks

Configure I2Cx Execute BL_SPI_Loop Execute BL_I2C_Loop

Configure USARTx
for SPIx for I2Cx

Configure SPIx Execute

BL_USART_Loop
for USARTx

0x7F received on
yes
USARTx
MSI used as USB clock
no source
yes
I2C Address
yes no
Detected
no
HSE detected no no HSE detected
Synchro mechanism yes
detected on SPIx yes
yes
no yes Generate System yes
Reconfigure System reset
no USB cable clock to 60 MHz
Detected Reconfigure System clock
to 72 MHz and USB clock
no Configure CAN to 48 MHz

Frame yes
detected on Execute
CANx BL_CAN_Loop Execute DFU bootloader
for CANx using USB interrupts

MSv38404V1

378/508 AN2606 Rev 65

AN2606 STM32L47xxx/48xxx devices

71.2.3 Bootloader version

Table 159 lists the STM32L47xxx/48xxx devices bootloader V9.x versions:

Table 159. STM32L47xxx/48xxx bootloader V9.x versions

Version
Description Known limitations
number

For memory write operations using DFU interface: If the

buffer size is larger than 256 bytes and not multiple of 8
bytes, the write memory operation result is corrupted.
V9.0 Initial bootloader version Workaround: if the file size is larger than 256 bytes, add
byte padding to align it on 8-bytes multiple size.
Write in SRAM is corrupted
V9.1 Deprecated version (not used) None
For memory write operations using DFU interface: If the
buffer size is larger than 256 bytes and not multiple of 8
bytes, the write memory operation result is corrupted.
Workaround: if the file size is larger than 256 bytes, add
byte padding to align it on 8-bytes multiple size.

PcROP option bytes cannot be written as the bootloader

uses byte access while PcROP must be accessed using
half-word access.
Workaround: load a code snippet in SRAM using
Bootloader interface then jump to it, and that code
writes the PcROP value.

During bootloader SPI write flash memory operation,

some random 64 bits (2 double-words) may be left blank
at 0xFF.
Root cause: the bootloader uses 64-bit cast write
operation, interrupted by SPI DMA. This leads to double
access on same flash memory address, and the 64 bits
V9.2 Fix write in SRAM issue are not written.
Workarounds:
– WA1: add a delay between sending write command
and its ACK request. Its duration must be the duration
of the 256-byte flash memory write time.
– WA2: read back after write, and, in case of error, start
write again.
– WA3: patch in RAM to write in flash memory that
implements write without 64-bit cast.
WA1 and WA3 are more efficient than WA2 in terms of
total programming time.
The limitation leads to a modification in customer SPI
host software by adding 3-4 ms delay to each write
operation. This time is not lost, because it is anyway the
flash memory write time, the host must wait anyway (so
instead of waiting by sending ACK requests, host waits
by delay).
Limitation has been seen only on SPI and cannot impact
USART/I2C/CAN/USB.

AN2606 Rev 65 379/508

507
STM32L496xx/4A6xx devices AN2606

72 STM32L496xx/4A6xx devices

72.1 Bootloader configuration

The STM32L496xx/4A6xx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 160 shows the hardware resources used by this bootloader.

Table 160. STM32L496xx/4A6xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 72 MHz and for USART, I2C and SPI bootloader
operation.
CRS is enabled for the DFU to allow USB to be clocked by
-
HSI 48 MHz.
RCC The HSE is used only when the CAN interface is selected.
HSE enabled The HSE must have one of the following values:
24,20,18,16,12,9,8,6,4 MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
reset
Common to all
12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The DFU cannot be used to communicate with bootloader if
voltage scaling range 2 is selected. Bootloader firmware does
Power -
not configure voltage scaling range value in PWR_CR1
register.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no pull
USART1_TX pin Output
mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in input no pull
USART2 USART2_RX pin Input
mode.
PA2 pin: USART2 in transmission mode. Used in input no pull
USART2_TX pin Output
mode.

380/508 AN2606 Rev 65

AN2606 STM32L496xx/4A6xx devices

Table 160. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in input no pull
USART3 USART3_RX pin Input
mode.
PC10 pin: USART3 in transmission mode. Used in input no
USART3_TX pin Output
pull mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1001100x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1001100x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1001100x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PC0 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 381/508

507
STM32L496xx/4A6xx devices AN2606

Table 160. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
SPI2 mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
Once initialized the CAN1 configuration is:Baudrate 125
CAN1 Enabled
kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1_RX pin Input
pull, pull-up mode.
CAN1 PB9 pin: CAN1 in transmission mode. Used in alternate push-
CAN1_TX pin Output
pull, pull-up mode.
This timer is used to determine the value of the HSE. Once
TIM16 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

382/508 AN2606 Rev 65

AN2606 STM32L496xx/4A6xx devices

Table 160. STM32L496xx/4A6xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB OTG FS configured in forced device mode.

USB OTG FS interrupt vector is enabled and used for USB
USB Enabled DFU communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required

Note: If VDDUSB pin is not connected to VDD, SPI flash memory write operations may be
corrupted due to voltage issue. For more details, refer to product’s datasheet and errata
sheet.

AN2606 Rev 65 383/508

507
STM32L496xx/4A6xx devices AN2606

72.2 Bootloader selection

The figures below show the bootloader selection mechanism.

Figure 98. Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x

System Reset

If Boot0 = 0

yes
no

If Value of first
address of Bank2 is
yes
within int. SRAM
address(1)
Protection level2 no
Set Bank Swap to
enabled
Bank2
no

Jump to user code yes Continue Bootloader

If Value of first in Bank2 execution
address of Bank1 is
within int. SRAM
address(1) If Value of first
yes address of Bank2 is
within int. SRAM yes
address(1)
no

Protection level2 no
yes
enabled
Set Bank Swap to Set Bank Swap to Set Bank Swap to
Bank1 Bank1 Bank2
no

Jump to user code Jump to user code Jump to user code

Continue Bootloader
in Bank1 in Bank1 in Bank2
execution

MS35021V1

384/508 AN2606 Rev 65

AN2606 STM32L496xx/4A6xx devices

Figure 99.Bootloader V9.x selection for STM32L496xx/4A6xx

System Reset

Configure System clock to

72 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS using

CRS and HSI48 as clock
source Disable all interrupt
sources and other
interfaces clocks
Configure I2Cx
Disable all interrupt Disable all interrupt
sources and other sources and other Configure
interfaces clocks interfaces clocks USARTx
Configure SPIx
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
0x7F received
on USARTx yes

no

I2C Address
yes HSE detected no
Detected

Generate System
no reset
yes

Disable all interrupt

Synchro mechanism yes sources and other
detected on SPIx interfaces clocks

Reconfigure System
no clock to 60 MHz
no

Frame detected Disable other Configure CAN

on CANx yes
interfaces clocks

Execute DFU Execute

no
bootloader using USB BL_CAN_Loop for
interrupts CANx
USB cable yes
Detected

MSv44808V1

AN2606 Rev 65 385/508

507
STM32L496xx/4A6xx devices AN2606

72.3 Bootloader version

Table 161 lists the STM32L496xx/4A6xx devices bootloader versions.

Table 161. STM32L496xx/4A6xx bootloader version

Version
Description Known limitations
number

– The Bank Erase command is aborted by the bootloader device, and

the NACK (0x1F) is sent to the host. Workaround: Perform Bank
erase operation through page erase using the Erase command
(0x44).
– SPI write operation fail
Limitation:
a. During Bootloader SPI write flash memory operation, some
random 64-bits (2 double-words) may be left blank at 0xFF.
Root cause:
a. Bootloader uses 64-bits cast write operation which is interrupted
by SPI DMA and it leads to double access on same flash memory
address and the 64-bits are not written
Workarounds:
a. WA1: add a delay between sending write command and its ACK
request. Its duration must be the duration of the 256-Bytes flash
memory write time.
V9.3 Initial bootloader version b. WA2: read back after write and in case of error start write again.
c. WA3: Patch in RAM to write in flash memory that implements write
memory without 64-bits cast.
WA1 and WA3 are more efficient than WA2 in terms of total
programming time
How critical is the limitation:
a. The limitation leads to a modification in customer SPI host
software by adding 3-4 ms delay to each write operation.
b. The delay is not waste because it is anyway the flash memory
write period of time that host has to wait anyway (so instead of
waiting by sending ACK requests, host will wait by delay).
c. Limitation has been seen only on SPI and cannot impact
USART/I2C/CAN.
– PcROP option bytes cannot be written as Bootloader uses Byte
access while PcROP must be accessed using half-word access.
Workaround: load a code snippet in SRAM using Bootloader
interface then jump to it, and that code writes the PcROP value.

386/508 AN2606 Rev 65

AN2606 STM32L4P5xx/4Q5xx devices

73 STM32L4P5xx/4Q5xx devices

73.1 Bootloader configuration

The STM32L4P5xx/4Q5xx bootloader is activated by applying Pattern 7 (described in
Table 2). Table 164 shows the hardware resources used by this bootloader.

Table 162. STM32L4P5xx/4Q5xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 60 MHz and for USART, I2C, SPI and USB
bootloader operation.
CRS is enabled for the DFU to allow USB to be clocked by
-
HSI 48 MHz.
RCC The HSE is used only when the CAN interface is selected.
HSE enabled The HSE must have one of the following values 24, 20, 18,
16, 12, 9, 8, 6, 4 MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
reset
Common to all
16 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader firmware
Power -
does not configure voltage scaling range value in PWR_CR1
register.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
USART2 PA3 pin: USART2 in reception mode. Used in input pull-up
USART2_RX pin Input
mode.
USART2_TX pin Output PA2 pin: USART2 in transmission mode

AN2606 Rev 65 387/508

507
STM32L4P5xx/4Q5xx devices AN2606

Table 162. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in input pull-up
USART3 USART3_RX pin Input
mode.
PC10 pin: USART3 in transmission mode. Used in input pull-
USART3_TX pin Output
up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1011011x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1011011x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain no pull mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1011011x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PC0 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain no pull mode.

388/508 AN2606 Rev 65

AN2606 STM32L4P5xx/4Q5xx devices

Table 162. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
SPI2 mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1 CAN1_RX pin Input
pull, pull-up mode.
PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.

AN2606 Rev 65 389/508

507
STM32L4P5xx/4Q5xx devices AN2606

Table 162. STM32L4P5xx/4Q5xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
PA11: USB DM line. Used in alternate push-pull, no pull
USB_DM pin
mode.
Input/output
PA12: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required

390/508 AN2606 Rev 65

AN2606 STM32L4P5xx/4Q5xx devices

73.2 Bootloader selection

Figure 102 and Figure 103 show the bootloader selection mechanisms.

Figure 100. Dual bank boot implementation for STM32L4P5xx/4Q5xx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

AN2606 Rev 65 391/508

507
STM32L4P5xx/4Q5xx devices AN2606

Figure 101.Bootloader V9.x selection for STM32L4P5xx/4Q5xx

System Reset

Configure System clock to 60

MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

HSE detected no
Synchro mechanism
yes
detected on SPIx
Generate
yes System reset

no Disable all interrupt

yes sources and other
no interfaces clocks

Frame detected on
Reconfigure System
CANx
clock to 60 MHz

Disable other
no interfaces clocks Configure CAN

USB cable Execute DFU Execute

yes bootloader using BL_CAN_Loop
Detected
USB interrupts for CANx

MS49689V1

392/508 AN2606 Rev 65

AN2606 STM32L4P5xx/4Q5xx devices

73.3 Bootloader version

Table 163 lists the STM32L4P5xx/4Q5xx devices bootloader versions.

Table 163. STM32L4P5xx/4Q5xx bootloader versions

Version
Description Known limitations
number

– PcROP option bytes cannot be written as

bootloader uses byte access while PcROP must
Initial bootloader version on cut be accessed using half-word access.
V9.0
1.0 samples Workaround: load a code snippet in SRAM using
bootloader interface then jump to it, and that code
writes PcROP value.

AN2606 Rev 65 393/508

507
STM32L4Rxxx/4Sxxx devices AN2606

74 STM32L4Rxxx/4Sxxx devices

74.1 Bootloader configuration

The STM32L4Rxx/4Sxx bootloader is activated by applying Pattern 6 (described in Table 2).
Table 164 shows the hardware resources used by this bootloader.

Table 164. STM32L4Rxxx/4Sxxx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The HSI is used at startup as clock source for system clock

HSI enabled configured to 60 MHz and for USART, I2C, SPI and USB
bootloader operation.
CRS is enabled for the DFU to allow USB to be clocked by
-
HSI 48 MHz.
RCC The HSE is used only when the CAN interface is selected.
HSE enabled The HSE must have one of the following values: 24, 20, 18,
16, 12, 9, 8, 6, 4 MHz.
The CSS interrupt is enabled when HSE is enabled. Any
- failure (or removal) of the external clock generates system
reset.
Common to all 12 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
28672 bytes starting from address 0x1FFF0000, contain
System memory -
the bootloader firmware
The IWDG prescaler is configured to its maximum value. It
is periodically refreshed to prevent watchdog reset (if the
IWDG -
hardware IWDG option was previously enabled by the
user).
The DFU cannot be used to communicate with bootloader if
the voltage scaling range 2 is selected. Bootloader
Power -
firmware does not configure voltage scaling range value in
PWR_CR1 register.
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in input no pull
USART1 USART1_RX pin Input
mode.
PA9 pin: USART1 in transmission mode. Used in input no
USART1_TX pin Output
pull mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in input pull-up
USART2 USART2_RX pin Input
mode.
PA2 pin: USART2 in transmission mode. Used in input pull-
USART2_TX pin Output
up mode.

394/508 AN2606 Rev 65

AN2606 STM32L4Rxxx/4Sxxx devices

Table 164. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

Once initialized, the configuration is 8-bit, even parity, and

USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in input pull-
USART3 USART3_RX pin Input
up mode.
PC10 pin: USART3 in transmission mode. Used in input
USART3_TX pin Output
pull-up mode.
Used to automatically detect the serial baud rate from the
USARTx SysTick timer Enabled
host for USARTx.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1010000x (x = 0 for write and
x = 1 for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain no pull mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain no pull mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1010000x (x = 0 for write and
x = 1 for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain no pull mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain no pull mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1010000x (x = 0 for write and
x = 1 for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain no pull mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 395/508

507
STM32L4Rxxx/4Sxxx devices AN2606

Table 164. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
SPI1
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
PA5 pin: slave clock line, used in push-pull, pull-down
SPI1_SCK pin Input
mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
SPI2
PB14 pin: slave data output line, used in push-pull, pull-
SPI2_MISO pin Output
down mode
PB13 pin: slave clock line, used in push-pull, pull-down
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does
not use it.
Once initialized the CAN1 configuration is:
CAN1 Enabled
Baudrate 125 kbps, 11 -bit identifier.
PB8 pin: CAN1 in reception mode. Used in alternate push-
CAN1_RX pin Input
pull, pull-up mode.
CAN1 PB9 pin: CAN1 in transmission mode. Used in alternate
CAN1_TX pin Output
push-pull, pull-up mode.
This timer is used to determine the value of the HSE. Once
TIM16 Enabled the HSE frequency is determined, the system clock is
configured to 60 MHz using PLL and HSE.

396/508 AN2606 Rev 65

AN2606 STM32L4Rxxx/4Sxxx devices

Table 164. STM32L4Rxxx/4Sxxx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line.
Input/output PA12: USB DP line
USB_DP pin
No external pull-up resistor is required

AN2606 Rev 65 397/508

507
STM32L4Rxxx/4Sxxx devices AN2606

74.2 Bootloader selection

Figure 102 and Figure 103 show the bootloader selection mechanisms.

Figure 102. Dual bank boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x

System Reset

If Boot0 = 0
no

yes

If Value of first Protection level2 no

address of Bank2 is yes enabled
within int. SRAM
address
Set Bank Swap to
Bank2 yes
no
Continue Bootloader execution
Jump to user code
in Bank2 If Value of first
If Value of first address of Bank2 is
within int. SRAM yes
address of Bank1 is
within int. SRAM address
address
yes
no
no
Set Bank Swap to Set Bank Swap to
Bank1 Bank2
Protection
level2 enabled yes
Jump to user code Jump to user code
in Bank1 in Bank2
Set Bank Swap to
no Bank1

Continue Bootloader Jump to user code

execution in Bank1
MSv36786V1

398/508 AN2606 Rev 65

AN2606 STM32L4Rxxx/4Sxxx devices

Figure 103.Bootloader V9.x selection for STM32L4Rxx/4Sxx

System Reset

Configure System clock to 60

MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

HSE detected no
Synchro mechanism
yes
detected on SPIx
Generate
yes System reset

no Disable all interrupt

yes sources and other
no interfaces clocks

Frame detected on
Reconfigure System
CANx
clock to 60 MHz

Disable other
no interfaces clocks Configure CAN

USB cable Execute DFU Execute

yes bootloader using BL_CAN_Loop
Detected
USB interrupts for CANx

MS49689V1

AN2606 Rev 65 399/508

507
STM32L4Rxxx/4Sxxx devices AN2606

74.3 Bootloader version

Table 165 lists the STM32L4Rxx/4Sxx devices bootloader versions.

Table 165. STM32L4Rxx/4Sxx bootloader versions

Version number Description Known limitations

V9.0 Initial bootloader version on cut 1.0 samples None

400/508 AN2606 Rev 65

AN2606 STM32L552xx/62xx devices

75 STM32L552xx/62xx devices

75.1 Bootloader configuration

The STM32L552xx/62xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 166 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 166. STM32L552xx/62xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
RCC CRS is enabled for the DFU to allow USB to be clocked by HSI
-
48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
Common
to all 16 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
System memory - 32 Kbytes, starting from address 0x0BF90000.
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the hardware
IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in alternate push-
USART1 USART1_RX pin Input
pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate push-
USART1_TX pin Output
pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate push-
USART2_TX pin Output
pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
PC11 pin: USART3 in reception mode. Used in alternate push-
USART3 USART3_RX pin Input
pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in alternate
USART3_TX pin Output
push-pull, pull-up mode.

AN2606 Rev 65 401/508

507
STM32L552xx/62xx devices AN2606

Table 166. STM32L552xx/62xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b0101100x (x = 0 for write and x = 1 for
read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b0101100x (x = 0 for write and x = 1 for
read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b0101100x (x = 0 for write and x = 1 for
read)
I2C3_SCL pin PC0 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.

SPI1 SPI1_MOSI pin Input PA7 pin: slave data input line, used in push-pull, pull-down mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down mode.
SPI1_NSS pin Input Note: This IO can be tied to GND if the SPI master does not use
it.

402/508 AN2606 Rev 65

AN2606 STM32L552xx/62xx devices

Table 166. STM32L552xx/62xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
SPI2 mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not use
it.
The SPI configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3_MOSI pin Input PB5 pin: slave data input line, used in push-pull, pull-down mode
SPI3
PG10 pin: slave data output line, used in push-pull, pull-down
SPI3_MISO pin Output
mode
SPI3_SCK pin Input PG9 pin: slave clock line, used in push-pull, pull-down mode
PG12 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI3_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not use
it.
Once initialized the FDCAN1 configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB9 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, pull-up mode.
PB8 pin: FDCAN1 in transmission mode. Used in alternate push-
FDCAN1_Tx pin Output
pull, pull-up mode.

AN2606 Rev 65 403/508

507
STM32L552xx/62xx devices AN2606

Table 166. STM32L552xx/62xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

Table 167. STM32L552xx/62xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of
Data Data status data Status data
Function Opcode data sent data
sent received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and RDP = 1
Regression from RDP
L1 to RDP 0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and RDP = 1

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

404/508 AN2606 Rev 65

AN2606 STM32L552xx/62xx devices

75.2 Bootloader selection

Figure 104 shows the bootloader selection mechanism.

Figure 104. Bootloader V9.x selection for STM32L552xx/62xx

System Reset

Configure System clock to

60 MHz with HSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB OTG FS

Device
Execute
BL_FDCAN loop

Configure I2Cx

Configure SPIx Disable all interrupt

sources and other
interfaces clocks
FDCAN frame Disable all interrupt Disable all interrupt
detected yes sources and other Configure
sources and other
interfaces clocks interfaces clocks USARTx
no
Execute Execute Execute
0x7F received BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
on USARTx yes for SPIx for I2Cx for USARTx

no

I2C Address
yes
Detected

no

no
Execute DFU
Synchro mechanism yes bootloader using USB
detected on SPIx
interrupts

no

USB cable yes

Detected

MS52834V1

AN2606 Rev 65 405/508

507
STM32L552xx/62xx devices AN2606

75.3 Bootloader version

Table 168 lists the STM32L552xx/62xx devices bootloader versions.

Table 168. STM32L552xx/62xx bootloader versions

Version
Description Known limitations
number

– USART3 not working

– SPI3 not working
– OB launch not working on USB-DFU
Initial bootloader version on – No read/write SRAM2 in all protocols
V13.0
cut1.0 samples – Read Secure Option bytes only implemented on
USART/I2C
– Regression from TZEN = 1 to TZEN = 0 is done
automatically on RDP regression
– Unable to set TZEN to 1 option byte using all
interfaces of the BL
No workarounds available
– Cannot set RDP level 0.5 nor option bytes in
RDP level 0.5 using BL interfaces
No workarounds available
Release supported only in cut2.0
– Multiple reset seen when enabling HW IWDG
– Fix all issues on previous
option byte in TZEN = 1
release
No workarounds available
V9.0 – Add FDCAN support
– Unable to set secure option bytes setting when
– New command added for TZEN = 1 and RDP level is 0
TZEN disable No workarounds available
– Support of sales type 256 KB – Go command on USB is not working
– FDCAN erase not working as page number
endianness is not aligned with the protocol
(device waits for LSB first but host sends MSB
first)
– WA - Send data MSB first to the BL
– Option byte programming is not working
properly when using FDCAN interface. This
– Fix all known limitations of
makes the change of the Option byte not
previous release
effective until a power off/power on.
– Add enable BOOT_LOCK BL
V9.1 – FDCAN erase not working as page number
command
endianness is not aligned with the protocol
– Add support of RDP L1 to 0.5 (device waits for LSB first but host sends MSB
regression first)
– WA - Send data MSB first to the BL
– Fix all known limitations of
FDCAN Readout unprotect command does not
V9.2 previous release
send the command ID to the host
– Version for silicon revision Z

Note: When jumping to the BL the cache must be disabled.

406/508 AN2606 Rev 65

AN2606 STM32WB10xx/15xx devices

76 STM32WB10xx/15xx devices

76.1 Bootloader configuration

The STM32WB10xx/15xx bootloader is activated by applying Pattern 6 (described in
Table 2). Table 171 shows the hardware resources used by this bootloader.

Table 169. STM32WB10xx/15xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz (using PLL clocked by

RCC MSI enabled
MSI).
16 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
Common to all 28 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1001111x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 407/508

507
STM32WB10xx/15xx devices AN2606

Table 169. STM32WB10xx/15xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
SPI1 mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master does not
use it.

408/508 AN2606 Rev 65

AN2606 STM32WB10xx/15xx devices

76.2 Bootloader selection

Figure 105 shows the bootloader selection mechanism.

Figure 105. Bootloader V11.x selection for STM32WB10xx/15xx

Bootloader

Disable all
interrupt sources

System Init ( Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
detected

no
yes Disable all other
no interfaces clocks

Disable all other Disable all other Configure

interfaces clocks interfaces clocks USARTx
SPIx detects
Synchro
mechanism
Execute Execute Execute
BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

MSv38443V2

AN2606 Rev 65 409/508

507
STM32WB10xx/15xx devices AN2606

76.3 Bootloader version

Table 170. STM32WB10xx/15xx bootloader versions
Version
Description Known limitations
number

– I2C Write Protect command (0x73) performs a Read

Unprotect instead of disabling write protection.
V11.1 Initial bootloader version – Workaround: Use No-Stretch Write Unprotect
command (0x74) that is performing correctly the
write unprotect operation

410/508 AN2606 Rev 65

AN2606 STM32WB30xx/35xx/50xx/55xx devices

77 STM32WB30xx/35xx/50xx/55xx devices

77.1 Bootloader configuration

The STM32WB30xx/35xx/50xx/55xx bootloader is activated by applying Pattern 16
(described in Table 2). Table 171 shows the hardware resources used by this bootloader.

Table 171. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 64 MHz

MSI enabled
(using PLL clocked by MSI).
RCC
CRS is enabled for the DFU to allow USB
-
to be clocked by HSI 48 MHz.
20 Kbytes, starting from address
RAM - 0x20000000, are used by the bootloader
firmware
Common to all
28 Kbytes, starting from address
System memory - 0x1FFF0000, contain the bootloader
firmware
The IWDG prescaler is configured to its
maximum value. It is periodically
IWDG - refreshed to prevent watchdog reset (if
the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit,
USART1 Enabled
even parity, and one stop bit
PA10 pin: USART1 in reception mode.
USART1 USART1_RX pin Input
Used in alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode.
USART1_TX pin Output
Used in alternate push-pull, pull-up mode.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
– Analog filter ON
I2C1 – Target 7-bit address: 0b1001111x (x = 0
for write and x = 1 for read)
PB6 pin: clock line is used in open-drain
I2C1_SCL pin Input/output
no pull mode.
PB7 pin: data line is used in open-drain
I2C1_SDA pin Input/output
no pull mode.

AN2606 Rev 65 411/508

507
STM32WB30xx/35xx/50xx/55xx devices AN2606

Table 171. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
– Analog filter ON
I2C3 – Target 7-bit address: 0b1001111x (x = 0
for write and x = 1 for read)
PC0 pin: clock line is used in open-drain
I2C3_SCL pin Input/output
no pull mode.
PC1 pin: data line is used in open-drain
I2C3_SDA pin Input/output
no pull mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PA7 pin: slave data input line, used in
SPI1_MOSI pin Input
SPI1 push-pull, pull-down mode
PA6 pin: slave data output line, used in
SPI1_MISO pin Output
push-pull, pull-down mode
PA5 pin: slave clock line, used in push-
SPI1_SCK pin Input
pull, pull-down mode
PA4 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.

412/508 AN2606 Rev 65

AN2606 STM32WB30xx/35xx/50xx/55xx devices

Table 171. STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled – 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS
hardware.
PB15 pin: slave data input line, used in
SPI2_MOSI pin Input
SPI2 push-pull, pull-down mode
PB14 pin: slave data output line, used in
SPI2_MISO pin Output
push-pull, pull-down mode
PB13 pin: slave clock line, used in push-
SPI2_SCK pin Input
pull, pull-down mode
PB12 pin: slave chip select pin used in
push-pull, pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the
SPI master does not use it.
USB FS configured in forced device
mode.
USB FS interrupt vector is enabled and
USB Enabled used for USB DFU communications.
Note: VDDUSB IO must be connected to
3.3 V as USB peripheral is used by the
DFU bootloader.
PA11: USB DM line. Used in input no pull
USB_DM pin
mode.
Input/output PA12: USB DP line. Used in input no pull
USB_DP pin mode.
No external pull-up resistor is required

AN2606 Rev 65 413/508

507
STM32WB30xx/35xx/50xx/55xx devices AN2606

77.2 Bootloader selection

Figure 106 shows the bootloader selection mechanism.

Figure 106. Bootloader V13.0 selection for STM32WB30xx/35xx/50xx/55xx

System Reset

Configure System clock to 64

MHz with MSI

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure USB Device FS

using CRS and HSI48 as
clock source

Configure I2Cx

Configure SPIx

Disable all interrupt

0x7F received on sources and other
yes interfaces clocks
USARTx Disable all Disable all
interrupt sources interrupt sources
and other and other
no interfaces clocks interfaces clocks Configure USARTx

I2C Address Execute Execute Execute

yes
Detected BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx

no

Synchro mechanism
yes
detected on SPIx
no
Disable other
interfaces clocks
no

Execute DFU
USB cable bootloader using
yes
Detected USB interrupts

MS51473V1

414/508 AN2606 Rev 65

AN2606 STM32WB30xx/35xx/50xx/55xx devices

77.3 Bootloader version

Table 172. STM32WB30xx/35xx/50xx/55xx bootloader versions
Version
Description Known limitations
number

– Readout Unprotect Command is not working

properly as at the end of the command an
NVIC_SystemReset is done instead of a flash
option bytes reload.
This makes the change of the RDP level not
effective until a power off/on.
V13.5 Initial bootloader version
– I2C Write Protect command (0x73) performs a
Read Unprotect instead of disabling write
protection.
Workaround: Uses No-Stretch Write Unprotect
command (0x74) that is performing correctly the
write unprotect operation

Note: Instability when performing multiple resets during operations ongoing causing Overrun or
FrameError errors on USART Bootloader and not recoverable unless Hardware Reset is
performed. Fixed by workaround in FUS V1.0.1 and V1.0.2.

AN2606 Rev 65 415/508

507
STM32WBA52xx devices AN2606

78 STM32WBA52xx devices

78.1 Bootloader configuration

The STM32WBA52xx bootloader is activated by applying Pattern12 (described in Table 2).
Table 173 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 173. STM32WBA52xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked

RCC HSI enabled
by HSI).
16 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
Common to all 32 Kbytes, starting from address 0x0BF88000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA8 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PB12 pin: USART1 in transmission mode. Not set until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA11 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA12 pin: USART2 in transmission mode. Not set until
USART2_TX pin Output
USART2 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1100110x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB2 pin: clock line is used in open-drain pull up mode.
Input/output
I2C1_SDA pin PB1 pin: data line is used in open-drain pull up mode.

416/508 AN2606 Rev 65

AN2606 STM32WBA52xx devices

Table 173. STM32WBA52xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1100110x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PA6 pin: clock line is used in open-drain pull up mode.
Input/output
I2C3_SDA pin PA7 pin: data line is used in open-drain pull up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 PB8 pin: slave data input line, used in push-pull, no pull
SPI3_MOSI pin Input
mode
PB9 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode
SPI3_SCK pin Input PA0 pin: slave clock line, used in push-pull, no pull mode
PA5 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.

Table 174. STM32WBA52xx special commands

Special commands supported (USART/I2C/SPI)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and RDP = 1
Regression from RDP
L1 to RDP 0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and RDP = 1
Unlock write protection
Must be run when 0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
RDP = 1
1. 0xYY can have 3 values (0: WRP area, 1: WRP1A, 2: WRP2A)

AN2606 Rev 65 417/508

507
STM32WBA52xx devices AN2606

78.2 Bootloader selection

Figure 107.Bootloader V11.x selection for STM32WBA52xx

System Reset

Disable all interrupt

sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

0x7F received
yes
on USARTx

no

I2Cx Address
yes
Detected

no Disable all other

Disable all other Disable all other interfaces clocks
interfaces clocks interfaces clocks

Configure USARTx
SPIx detects Synchro yes
mechanism

Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
SPIx I2Cx for USARTx
no

MSv38431V2

78.3 Bootloader version

Table 175. STM32WBA52xx bootloader versions
Version number Description Known limitations

V11.0 Initial bootloader version None

418/508 AN2606 Rev 65

AN2606 STM32WBA54xx/55xx devices

79 STM32WBA54xx/55xx devices

79.1 Bootloader configuration

The STM32WBA54xx/55xx bootloader is activated by applying Pattern12 (described in
Table 2). Table 176 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 176. STM32WBA54xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

RCC HSI enabled
HSI).
6 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
Common to all 28 Kbytes, starting from address 0x0BF88000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA8 pin: USART1 in reception mode. Used in alternate push-
USART1 USART1_RX pin Input
pull, pull-up mode.
PB12 pin: USART1 in transmission mode. Not set until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA11 pin: USART2 in reception mode. Used in alternate
USART2 USART2_RX pin Input
push-pull, pull-up mode.
PA12 pin: USART2 in transmission mode. Not set until
USART2_TX pin Output
USART2 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1100110x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB2 pin: clock line is used in open-drain pull up mode.
Input/output
I2C1_SDA pin PB1 pin: data line is used in open-drain pull up mode.

AN2606 Rev 65 419/508

507
STM32WBA54xx/55xx devices AN2606

Table 176. STM32WBA54xx/55xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1100110x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PA6 pin: clock line is used in open-drain pull up mode.
Input/output
I2C3_SDA pin PA7 pin: data line is used in open-drain pull up mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI3
SPI3_MOSI pin Input PB8 pin: slave data input line, used in push-pull, no pull mode
PB9 pin: slave data output line, used in push-pull, no pull
SPI3_MISO pin Output
mode
SPI3_SCK pin PA0 pin: slave clock line, used in push-pull, no pull mode
Input
SPI3_NSS pin PA5 pin: slave chip select pin used in push-pull, no pull mode.
USB FS configured in forced device mode. USB FS interrupt
USB Enabled
vector is enabled and used for USB DFU communications.
PM12: USB DM line. Used in alternate push-pull, no pull
DFU USB_DM pin
mode.
Input/output
PM11: USB DP line. Used in alternate push-pull, no pull
USB_DP pin
mode. No external pull-up resistor is required.

Table 177. STM32WBA54xx/55xx special commands

Special commands supported (USART/I2C/SPI)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and RDP = 1

420/508 AN2606 Rev 65

AN2606 STM32WBA54xx/55xx devices

Table 177. STM32WBA54xx/55xx special commands (continued)

Special commands supported (USART/I2C/SPI)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

Regression from RDP

L1 to RDP 0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and RDP = 1
Unlock write protection
Must be run when 0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
RDP = 1
1. 0xYY can have three values (0: WRP area, 1: WRP1A, 2: WRP2A)

AN2606 Rev 65 421/508

507
STM32WBA54xx/55xx devices AN2606

79.2 Bootloader selection

Figure 108.Bootloader V11.x selection for STM32WBA54xx/55xx

System reset

Disable all interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure SPIx

Configure USARTx

0x7F received
yes
on USARTx

no

I2Cx address
yes
detected

no Disable all other

Disable all other Disable all other interfaces clocks
interfaces clocks interfaces clocks

SPIx detects Configure

yes USARTx TX
Synchro mechanism

Execute Execute Execute

BL_SPI_Loop for BL_I2C_Loop for BL_USART_Loop
no
SPIx I2Cx for USARTx

MSv38431V4

79.3 Bootloader version

Table 178. STM32WBA54xx/55xx bootloader versions
Version number Description Known limitations

V11.1 Initial bootloader version None

422/508 AN2606 Rev 65

AN2606 STM32WBA62xx/63xx/64xx/65xx devices

80 STM32WBA62xx/63xx/64xx/65xx devices

80.1 Bootloader configuration

The STM32WBA62xx/63xx/64xx/65xx bootloader is activated by applying Pattern12
(described in Table 2). Table 179 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 179. STM32WBA62xx/63xx/64xx/65xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using HSI through

HSI enabled
PLL1 source).
RCC
Enabled only when USB cable detected.
HSE enabled
HSE must be 32 MHz to have the USB working.

Common to 12 Kbytes, starting from address 0x2000 0000 are used by

RAM -
all the bootloader firmwaree
64 Kbytes, starting from address 0x0BF9 0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA8 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
function, pull-up mode.
PB12 pin: USART1 in transmission mode. Kept in reset
USART1_TX pin Output
configuration until 0x7F detected on USART_RX.
Once initialized, the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
PA11 pin: USART3 in reception mode. Used in alternate push-
USART3 USART3_RX pin Input
pull, pull-up mode.
PA12 pin: USART2 in transmission mode. Kept in reset
USART3_TX pin Output
configuration until 0x7F detected on USART_RX.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1101111x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB2 pin: clock line is used in open-drain no pull mode.
Input/output
I2C1_SDA pin PB1 pin: data line is used in open-drain no pull mode.

AN2606 Rev 65 423/508

507
STM32WBA62xx/63xx/64xx/65xx devices AN2606

Table 179. STM32WBA62xx/63xx/64xx/65xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C3 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1101111x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PA6 pin: clock line is used in open-drain no pull mode.
Input/output
I2C3_SDA pin PA7 pin: data line is used in open-drain no pull mode.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB14 pin: Slave data Input line, used in alternate function with
SPI2 SPI2_MOSI pin Input
no pull.
PB0 pin: Slave data output line used in alternate function with
SPI2_MISO pin(1) Output
no pull.
PA9 pin: Slave clock line, used in alternate function with no
SPI2_SCK pin
pull.
Input
PA10 pin: slave chip select pin used in alternate function with
SPI2_NSS pin
no pull.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB8 pin: Slave data Input line, used in alternate function with
SPI3 SPI3_MOSI pin Input
pull down.
PB9 pin: Slave data output line used in alternate function with
SPI3_MISO pin Output
no pull.
PA0 pin: Slave clock line, used in alternate function with no
SPI3_SCK pin
pull.
Input
PA5 pin: slave chip select pin used in alternate function with
SPI3_NSS pin
no pull.
USB configured in device mode. USB interrupt vector is
USB Enabled
enabled and used for DFU communications.
DFU USB_DM pin PD7: USB DM line. Used in alternate function, no pull mode.
Input/output PD6: USB DP line. Used in alternate function, no pull mode.
USB_DP pin
No external pull-up resistor is required.

424/508 AN2606 Rev 65

AN2606 STM32WBA62xx/63xx/64xx/65xx devices

1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

Table 180. STM32WBA62xx/63xx/64xx/65xx special commands

Special commands supported (USART/I2C/SPI)
Opcode - 0x50

Number of
Sub- Number of Number of Status
Data status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and RDP = 1
Regression from RDP
L1 to RDP 0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and RDP = 1
Unlock write protection
Must be run when 0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
RDP = 1
1. 0xYY can have three values (0: WRP area, 1: WRP1A, 2: WRP2A)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not in two bytes
• Data is sent on USB frame byte per byte. No need to add the number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 65 425/508

507
STM32WBA62xx/63xx/64xx/65xx devices AN2606

80.2 Bootloader selection

Figure 109.Bootloader V13.2 selection for STM32WBA62xx/63xx/64xx/65xx

System Reset
Or JumpToBL

Disable all
0x7F Exexute
interrupt sources
detected on Yes BL_USART_Loop
Denitialize system and other
USART Tx for USARTx
interfaces clocks
Configure System
clock to 60 MHz
from HSI ĺ3// No

Disable all
Execute
System Init I2C address interrupt sources
Yes BL_I2C_Loop for
(&ORFN*3,2V detected and other
I2Cx
IWDG, SysTick) interfaces clocks

No

Configure USB
HS device Disable all
63,[GHWHFWV Execute
interrupt sources
Synchro Yes BLB63,B/RRSIRU
and other
mechanism 63,[
interfaces clocks

Configure
USARTx No No

Stop, DeInit USB

USB cable Quartz
Yes ,3, and start No System reset
detected detected
Configure I2Cx quartz detection

Yes

Disable all then

&RQILJXUH63,[ Re-configure
execute DFU
System and USB
bootloader using
clocks using HSE
USB interrupts

MS56840V1

80.3 Bootloader version

Table 181. STM32WBA62xx/63xx/64xx/65xx bootloader versions
Version number Description Known limitations

V13.2 Initial bootloader version None

426/508 AN2606 Rev 65

AN2606 STM32WB05xx devices

81 STM32WB05xx devices

81.1 Bootloader configuration

The STM32WB05xx bootloader is activated by applying Pattern 18 (described in Table 2).
Table 182 shows the hardware resources used by this bootloader.

Table 182. STM32WB05xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz using HSI
RAM - The last 3 Kbytes of the last bank
Common to all
6 Kbytes, starting from address 0x10000000,
System memory -
contain the bootloader firmware
USART Enabled Once initialized, the configuration is 8-bit, no parity
PB0 pin: USART in reception mode. Used in
USART_RX pin Input
USART alternate push-pull, pull-up mode.
PA1 pin: USART in transmission mode. Not set until
USART_TX pin Output
USART is detected.

AN2606 Rev 65 427/508

507
STM32WB05xx devices AN2606

81.2 Bootloader selection

Figure 110 shows the bootloader selection mechanism.

Figure 110. Bootloader V2.x selection for STM32WB05xx

System reset or
JumpToBL

Configure system clock

to 16 MHz from HSI

System Init (clock, GPIOs)

Configure USART

0x7F detected No
on USART?

Yes

MS56627V1
Execute BL_USART_Loop
for USART
MS56627V1

81.3 Bootloader version

Table 183. STM32WB05xx bootloader versions
Version number Description Known limitations

V2.0 Final bootloader version None

428/508 AN2606 Rev 65

AN2606 STM32WB06xx/07xx devices

82 STM32WB06xx/07xx devices

82.1 Bootloader configuration

The STM32WB06xx/07xx bootloader is activated by applying Pattern 18 (described in
Table 2). Table 184 shows the hardware resources used by this bootloader.

Table 184. STM32WB06xx/07xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz using HSI
RAM - The last 3 Kbytes of the last bank
Common to all
6 Kbytes, starting from address 0x10000000,
System memory -
contain the bootloader firmware
USART Enabled Once initialized, the configuration is 8-bit, no parity
PA8 pin: USART in reception mode. Used in
USART_RX pin Input
USART alternate push-pull, pull-up mode.
PA9 pin: USART in transmission mode. Not set until
USART_TX pin Output
USART is detected.

AN2606 Rev 65 429/508

507
STM32WB06xx/07xx devices AN2606

82.2 Bootloader selection

Figure 111 shows the bootloader selection mechanism.

Figure 111. Bootloader V4.x selection for STM32WB06xx/07xx

System reset or
JumpToBL

Configure system clock

to 16 MHz from HSI

System Init (clock, GPIOs)

Configure USART

0x7F detected No
on USART?

Yes

MS56627V1
Execute BL_USART_Loop
for USART
MS56627V1

82.3 Bootloader version

Table 185. STM32WB06xx/07xx bootloader versions
Version number Description Known limitations

V4.0 Final bootloader version None

430/508 AN2606 Rev 65

AN2606 STM32WB09xx devices

83 STM32WB09xx devices

83.1 Bootloader configuration

The STM32WB09xx bootloader is activated by applying Pattern 18 (described in Table 2).
Table 186 shows the hardware resources used by this bootloader.

Table 186. STM32WB09xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

RCC HSI enabled The system clock frequency is 16 MHz using HSI
RAM - The last 3 Kbytes of the last bank
Common to all
6 Kbytes, starting from address 0x10000000,
System memory -
contain the bootloader firmware
USART Enabled Once initialized, the configuration is 8-bit, no parity
PB0 pin: USART in reception mode. Used in
USART_RX pin Input
USART alternate push-pull, pull-up mode.
PA1 pin: USART in transmission mode. Not set until
USART_TX pin Output
USART is detected.

AN2606 Rev 65 431/508

507
STM32WB09xx devices AN2606

83.2 Bootloader selection

Figure 113 shows the bootloader selection mechanism.

Figure 112. Bootloader V1.x selection for STM32WB09xx

System reset or
JumpToBL

Configure system clock

to 16 MHz from HSI

System Init (clock, GPIOs)

Configure USART

0x7F detected No
on USART?

Yes

MS56627V1
Execute BL_USART_Loop
for USART
MS56627V1

83.3 Bootloader version

Table 187. STM32WB09xx bootloader versions
Version number Description Known limitations

V1.0 Final bootloader version None

432/508 AN2606 Rev 65

AN2606 STM32WLE5xx/55xx devices

84 STM32WLE5xx/55xx devices

84.1 Bootloader configuration

The STM32WLE5xx/55xx bootloader is activated by applying Pattern 13 (described in
Table 2). Table 188 shows the hardware resources used by this bootloader.

Table 188. STM32WLE5xx/55xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz (using PLL

RCC HSI enabled
clocked by HSI).
8 Kbytes, starting from address 0x20000000, are
RAM -
used by the bootloader firmware

Common to all 16 Kbytes, starting from address 0x1FFF0000,

System memory -
contain the bootloader firmware
The IWDG prescaler is configured to its maximum
value. It is periodically refreshed to prevent
IWDG -
watchdog reset (if the hardware IWDG option was
previously enabled by the user).
Once initialized, the configuration is 8-bit, even
USART1 Enabled
parity, and one stop bit
PA10 pin: USART1 in reception mode. Used in
USART1 USART1_RX pin Input
alternate push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in
USART1_TX pin Output
alternate push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even
USART2 Enabled
parity, and one stop bit
PA3 pin: USART2 in reception mode. Used in
USART2 USART2_RX pin Input
alternate push-pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in
USART2_TX pin Output
alternate push-pull, pull-up mode.

AN2606 Rev 65 433/508

507
STM32WLE5xx/55xx devices AN2606

Table 188. STM32WLE5xx/55xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI1 configuration is:

– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
PA7 pin: slave data input line, used in push-pull,
SPI1_MOSI pin Input
pull-down mode
SPI1
PA6 pin: slave data output line, used in push-pull,
SPI1_MISO pin Output
pull-down mode
PA5 pin: slave clock line, used in push-pull, pull-
SPI1_SCK pin Input
down mode
PA4 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI1_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.
The SPI2 configuration is:
– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware
PB15 pin: slave data input line, used in push-pull,
SPI2_MOSI pin Input
pull-down mode
SPI2
PB14 pin: slave data output line, used in push-pull,
SPI2_MISO pin Output
pull-down mode
PB13 pin: slave clock line, used in push-pull, pull-
SPI2_SCK pin Input
down mode
PB12 pin: slave chip select pin used in push-pull,
pull-down mode.
SPI2_NSS pin Input
Note: This IO can be tied to GND if the SPI master
does not use it.

434/508 AN2606 Rev 65

AN2606 STM32WLE5xx/55xx devices

84.2 Bootloader selection

Figure 113 shows the bootloader selection mechanism.

Figure 113. Bootloader V12.x selection for STM32WLE5xx/55xx

System Reset

Disable all interrupt sources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure SPIx

Configure USARTx

0x7F received
yes
on USARTx

yes
no

Disable all other Disable all other

interfaces clocks interfaces clocks
SPIx detects
no Synchro
mechanism Execute Execute
BL_SPI_Loop BL_USART_Loop
for SPIx for USARTx

MSv38476V2

84.3 Bootloader version

Table 189. STM32WLE5xx/55xx bootloader versions
Version number Description Known limitations

BL cannot write/read the following option bytes:

V12.2 Initial bootloader version on rev. Z samples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)
BL cannot write/read the following option bytes:
V12.3 Final bootloader version on rev. Z samples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)
BL cannot write/read the following option bytes:
V12.4 Final bootloader version on rev. Y samples – FLASH_SFR (Offset - 0x80)
– FLASH_SRRVR (Offset - 0x84)

AN2606 Rev 65 435/508

507
STM32U031xx devices AN2606

85 STM32U031xx devices

85.1 Bootloader configuration

The STM32U031xx bootloader is activated by applying Pattern 11 (described in Table 2).
Table 190 shows the hardware resources used by this bootloader.

Table 190. STM32U031xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

HSI16 The system clock frequency is 24 MHz (using PLL clocked by

RCC
enabled HSI16).
5 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
Common to all 14 Kbytes, starting from address 0x1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF3500
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART in reception mode. Used in alternate
USART1_RX pin Input
USART1 function input, pull-up mode.
PA9 pin: USART in transmission mode. Kept in reset
USART1_TX pin Output configuration until 0x7F is detected on USART_RX. PA11 is
remapped to PA9 on the TSSOP20 package.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PA3 pin: USART in reception mode. Used in alternate function
USART2 USART2_RX pin Input
input, pull-up mode.
PA2 pin: USART in transmission mode. Kept in reset
USART2_TX pin Output
configuration until 0x7F is detected on USART_RX.
Once initialized, the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
PC11 pin: USART in reception mode. Used in alternate
USART3_RX pin Input
function input, pull-up mode.
USART3
PC10 pin: USART in transmission mode. Kept in reset
USART3_TX pin Output
configuration until 0x7F is detected on USART_RX.
Used on detection on USART and its IT for baudrate
EXTI line 11 Input
calculation

436/508 AN2606 Rev 65

AN2606 STM32U031xx devices

Table 190. STM32U031xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1101011x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1101011x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1101011x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PB3 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in alternate function, pull-
SPI1_MOSI pin Input
SPI1 down mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin(1) Output
mode
PA5 pin: slave clock line, used in alternate function, pull-down
SPI1_SCK pin mode. PA1 pin is used instead of PA5 on TSSOP20 package.
Input Used on push-pull, pull-up mode
PA4 pin: slave chip select pin used in alternate function, pull-
SPI1_NSS pin
down mode.

AN2606 Rev 65 437/508

507
STM32U031xx devices AN2606

Table 190. STM32U031xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in alternate function, no
SPI2 SPI2_MOSI pin Input
pull mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin(1) Output
mode
PB13 pin: slave clock line, used in alternate function, no pull
SPI2_SCK pin Input
mode
PB12 pin: slave chip select pin used in alternate function, no
SPI2_NSS pin Input
pull mode.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as the bit DMATx enable on
SPI CR2 register is set to 1, the MISO line is set to 3.3 V.

438/508 AN2606 Rev 65

AN2606 STM32U031xx devices

85.2 Bootloader selection

Figure 114 shows the bootloader selection mechanism.

Figure 114. Bootloader V11.x selection for STM32U031xx

Bootloader

Deinitialize all used

resources

System Init (Clock, GPIOs,

IWDG, SysTick)

Configure I2Cx

Configure USARTx
yes

Configure SPIx
yes

0x7F received
on USARTx Disable all other
yes interfaces clocks

no

I2C address Configure

Disable all other Disable all other
detected USARTx TX
interfaces clocks interfaces clocks

no
Execute Execute Execute
no BL_SPI_Loop BL_I2C_Loop BL_USART_Loop
for SPIx for I2Cx for USARTx
Synchro mechanism
detected on SPIx

MS56837V1

AN2606 Rev 65 439/508

507
STM32U031xx devices AN2606

85.3 Bootloader version

Table 191. STM32U031xx bootloader versions
Version
Description Known limitations
number

Empty check flag cleared by error on the bootloader startup phase

– Root cause: on the startup phase the bootloader SW performs a
system deinitialization, leading to write the default value on the
FLASH_ACR register, which overrides the Empty check bit with 0
Initial
V11.1 bootloader – Behavior: when Empty check boot mode is used and the flash
version memory is empty, the MCU boots on the bootloader but the flag is
cleared by the SW. If a reset is triggered, the system tries to boot on
the empty flash memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

440/508 AN2606 Rev 65

AN2606 STM32U073xx/83xx devices

86 STM32U073xx/83xx devices

86.1 Bootloader configuration

The STM32U073xx/83xx bootloader is activated by applying Pattern 11 (described in
Table 2). Table 192 shows the hardware resources used by this bootloader.

Table 192. STM32U073xx/83xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 24 MHz (using PLL clocked

HSI enabled
by HSI).
RCC
The clock recovery system (CRS) is enabled for the DFU
HSI48 enabled
bootloader to allow USB to be clocked by HSI48 48 MHz
8.5 Kbytes, starting from address 0x2000000, are used by
RAM -
Common to all the bootloader firmware
26 Kbytes, starting from address 1FFF0000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Securable The address to jump to for the securable memory area is
- -
memory area 0x1FFF6000
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART in reception mode. Used in alternate
USART1 USART1_RX pin Input
function, pull-up mode.
PA9 pin: USART in transmission mode. Kept in reset
USART1_TX pin Output
configuration until 0x7F is detected on USART_RX.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART in reception mode. Used in alternate
USART2 USART2_RX pin Input
function, pull-up mode.
PA2 pin: USART in transmission mode. Kept in reset
USART2_TX pin Output
configuration until 0x7F is detected on USART_RX.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PC11 pin: USART in reception mode. Used in alternate
USART3_RX pin Input
function, pull-up mode.
USART3
PC10 pin: USART in transmission mode. Kept in reset
USART3_TX pin Output
configuration until 0x7F is detected on USART_RX.
Used on detection on USART and its IT for baudrate
EXTI line 11 Input
calculation

AN2606 Rev 65 441/508

507
STM32U073xx/83xx devices AN2606

Table 192. STM32U073xx/83xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1101010x (x = 0 for write and x = 1
for read)
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1101010x (x = 0 for write and x = 1
for read)
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1101010x (x = 0 for write and x = 1
for read)
I2C3_SCL pin PB3 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PB4 pin: data line is used in open-drain pull-up mode.
The SPI configuration is:
– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: slave data input line, used in alternate function,
SPI1 SPI1_MOSI pin Input
pull-down mode
PA6 pin: slave data output line, used in push pull, pull-down
SPI1_MISO pin(1) Output
mode
PA5 pin: slave clock line, used in alternate function, pull-
SPI1_SCK pin
down mode
Input
PA4 pin: slave chip select pin used in alternate function, pull-
SPI1_NSS pin
down mode.

442/508 AN2606 Rev 65

AN2606 STM32U073xx/83xx devices

Table 192. STM32U073xx/83xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI configuration is:

– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB15 pin: slave data input line, used in alternate function,
SPI2 SPI2_MOSI pin Input
pull-down mode
PB14 pin: slave data output line, used in push-pull, pull
SPI2_MISO pin(1) Output
mode
PB13 pin: slave clock line, used in alternate function, pull-
SPI2_SCK pin
down mode
Input
PB12 pin: slave chip select pin used in alternate function,
SPI2_NSS pin
pull-down mode.
USB configured in device mode. USB interrupt vector is
USB Enabled
enabled and used for USB DFU communications.
PA11: USB DM line. Used in additional function mode,
DFU USB_DM pin
behaving as input until communication starts.
Input/output
PA12: USB DP line. Used in additional function mode,
USB_DP pin
behaving as input until communication starts.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization, as soon as the bit DMATx enable on
SPI CR2 register is set to 1, the MISO line is set to 3.3 V.

AN2606 Rev 65 443/508

507
STM32U073xx/83xx devices AN2606

86.2 Bootloader selection

Figure 115 shows the bootloader selection mechanism.

Figure 115. Bootloader V13.x selection for STM32U073xx/83xx

System Reset
or JumpToBL

Disable all
Exexute
De-Init system 0x7F detected interrupt sources
Yes BL_USART_Loop
Configure system clock on USARTx and other
for USARTx
to 24 MHz with HSI and interface clocks
PLL and HSI48 for USB

No

System Init (Clock, Disable all

Execute
GPIOs, IWDG, SysTick) I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interface clocks

Configure USB FS No
device

Disable all
SPIx detects Execute
interrupt sources
No synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
Configure USARTx interface clocks

No

Configure I2Cx
Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts

Configure SPIx

MS56538V2

444/508 AN2606 Rev 65

AN2606 STM32U073xx/83xx devices

86.3 Bootloader version

Table 193. STM32U073xx/83xx bootloader versions
Version
Description Known limitations
number

Empty check flag cleared by error on the bootloader startup phase

– Root cause: on the startup phase the bootloader SW performs a
system deinitialization, leading to write the default value on the
FLASH_ACR register, which overrides the Empty check bit with 0
Initial
V13.0 bootloader – Behavior: when Empty check boot mode is used and the flash memory
version is empty, the MCU boots on the bootloader but the flag is cleared by
the SW. If a reset is triggered, the system tries to boot on the empty
flash memory, and crashes.
– Caution: Avoid using reset on this case. if the system crashes, an
option byte change or POR is needed to reboot.

AN2606 Rev 65 445/508

507
STM32U375xx/85xx devices AN2606

87 STM32U375xx/85xx devices

87.1 Bootloader configuration

The STM32U375xx/85xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 194 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 194. STM32U375xx/85xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 48 MHz (using MSIS source,

MSI enabled
that is, MSI divided by 2)).
48 MHz derived from the MSIK (MSI divided by 2) is used for
RCC -
FDCAN
CRS is enabled for the DFU so that USB can be clocked by
HSI48
HSI 48 MHz
Common
to all 16 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
40 Kbytes, starting from address 0xBF8 F000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
function, pull-up mode.
PA9 pin: USART1 in transmission mode. Kept in reset
USART1_TX pin Output
configuration until 0x7F detected on USART_RX.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
function, pull-up mode.
PC10 pin: USART3 in transmission mode. Kept in reset
USART3_TX pin Output
configuration until 0x7F detected on USART_RX.
The I2C1 configuration is:
– I2C speed: up to 400 kHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1101100x (x = 0 for write and x = 1
for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.

446/508 AN2606 Rev 65

AN2606 STM32U375xx/85xx devices

Table 194. STM32U375xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PA7 pin: Slave data Input line, used in alternate function with
pull down. On release v14.2, PG4 pin is used instead of PA7
SPI1_MOSI pin Input
on WLCSP68-G package. Used on alternate function with pull
down.
SPI1 PA6 pin: Slave data output line used in alternate function with
(1) pull down. On release v14.2, PG3 pin is used instead of PA6
SPI1_MISO pin Output
on WLCSP68-G package. Used on alternate function with pull
down.
PA5 pin: Slave clock line, used in alternate function with pull
down. On release v14.2, PG2 pin is used instead of PA5 on
SPI1_SCK pin Input
WLCSP68-G package. Used on alternate function with pull
down.
PA4 pin: slave chip select pin used in alternate function with
pull down. On release v14.2, PG5 pin is used instead of PA4
SPI1_NSS pin Input
on WLCSP68-G package. Used on alternate function with pull
down.

AN2606 Rev 65 447/508

507
STM32U375xx/85xx devices AN2606

Table 194. STM32U375xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PD4 pin: Slave data Input line, used in alternate function with
SPI2 SPI2_MOSI pin Input
pull down.
PD3 pin: Slave data output line used in alternate function with
SPI2_MISO pin(1) Output
pull down.
PD1 pin: Slave clock line, used in alternate function with pull
SPI2_SCK pin Input
down.
PD0 pin: slave chip select pin used in alternate function with
SPI2_NSS pin Input
pull down.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB5 pin: Slave data Input line, used in alternate function with
SPI3 SPI3_MOSI pin Input
pull down.
PB4 pin: Slave data output line used in alternate function with
SPI3_MISO pin(1) Output
pull down.
PB3 pin: Slave clock line, used in alternate function with pull
SPI3_SCK pin Input
down.
PA15 pin: slave chip select pin used in alternate function with
SPI3_NSS pin Input
pull down.
Once initialized the configuration is:
– Connection bit rate 600 kbit/s
– Data bit rate 2400 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN1
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input/
function, pull-up mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
function, pull-up mode.

448/508 AN2606 Rev 65

AN2606 STM32U375xx/85xx devices

Table 194. STM32U375xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB configured in device mode.

USB Enabled USB interrupt vector is enabled and used for DFU
communications.
DFU PA11: USB DM line. Used in alternate function with no pull
USB_DM pin
mode.
Input/output
PA12: USB DP line. Used in alternate function with no pull
USB_DP pin
mode. No external pull-up resistor is required.
Mode: target mode
Aval timing:0x4E
DMA Reg RX: disabled
DMA Req TX: disabled
Status FIFO: disabled
DMA Req status: disabled
DMA Req control: disabled
I3C Enabled
IBI: enabled
I3C1 Additional data after IBI ack-ed: 1 byte
IBI configuration: Mandatory Data Byte (MDB)
All IT disabled except RXFNE (Receive FIFO
Interrupt)
The RXFNE interruption is disabled after SYNC byte
detection by the bootloader.
I3C_SCL pin Input/Output PB13 pin: clock line is used in open-drain pull up mode.
I3C_SDA pin Input/Output PA1 pin: clock line is used in open-drain pull up mode.
1. SPI Tx (MISO) is handled by DMA. On the bootloader start-up after SPI initialization as soon as the bit DMATx enable on
SPI CR2 register is set to 0x1, the MISO line is set to 3.3 V.

87.2 SPI1 pinout on WLCSP68-G

The SPI1 pinout on the WLCSP68-G package is different from all the other packages: it
uses pins PG5/PG2/PG3/PG4 instead of pins PA4/PA5/PA6/PA7. This makes it possible to
use an independent voltage for the SPI1 pins through VDDIO2, to provide them a voltage
different from the global MCU voltage (3.3 V).
When using 1.2 V for these pins, the HSLV feature must be enabled on PortG. To protect
this feature, which can damage the pins in case of bad usage, some SW option bytes are
reserved. Bits 22 and 23 from Flash OPTR registers must be written to 0b11 while enabling
IOHSLV feature (refer to RM0487 for OPTR register description).

87.3 Boot model

The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

AN2606 Rev 65 449/508

507
STM32U375xx/85xx devices AN2606

Table 195. STM32U375xx/385xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of status
Data Status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone
disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP
0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

450/508 AN2606 Rev 65

AN2606 STM32U375xx/85xx devices

87.4 Bootloader selection

Figure 116. Bootloader V14.2 selection for STM32U375xx/85xx

System Reset
Or JumpToBL
Disable all
0x7F Exexute
interrupt sources
DenitIalize detected on Yes BL_USART_Loo
and other
system USART Tx p for USARTx
interfaces clocks
Configure
System clock to No
48 MHz with
MSIS (MSI/2)
Disable all
FDCAN Exexute
interrupt sources
frame Yes BL_FDCAN_Loo
and other
System Init detected p for FDCANx
interfaces clocks
(Clock, GPIOs,
IWDG, SysTick)
No

Configure USB Disable all

Execute
FS device I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks

Configure No
USARTx

Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interfaces clocks
Configure I2Cx

No

Disable all Execute

Configure SPIx I3Cx detects
interrupt sources BL_I3C_Loop
braodcast and Yes
and other for I3Cx
synchro byte
interfaces clocks

Configure
No
FDCANx

Execute DFU
USB cable
Yes bootloader using
detected
USB interrupts
Configure I3Cx

MS56839V1

AN2606 Rev 65 451/508

507
STM32U375xx/85xx devices AN2606

87.5 Bootloader version

Table 196. STM32U375xx/85xx bootloader versions
Version
Description Known limitations
number

– Erasing multiple flash memory pages at the same

time is not working, only the first page is erased
V14.1 Initial bootloader version
– FDCAN: cannot erase more than 32 flash memory
sectors on the same time
– Correct known limitations
– Switch SPI1 support on PortG when using
– FDCAN: cannot erase more than 32 flash memory
V14.2 WLCSP68-G package instead of PortA
sectors on the same time
– Add SW OB support to Enable HSLV for
PortG SPI1 pins

452/508 AN2606 Rev 65

AN2606 STM32U535xx/545xx devices

88 STM32U535xx/545xx devices

88.1 Bootloader configuration

The STM32U535xx/545xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 197 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 197. STM32U535xx/545xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
RCC CRS is enabled for the DFU so that USB can be clocked by
HSI48 enabled
HSI 48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
Common 16 Kbytes, starting from address 0x20000000, are used by
to all RAM -
the bootloader firmware
64 Kbytes, starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.
The I2C1 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.

AN2606 Rev 65 453/508

507
STM32U535xx/545xx devices AN2606

Table 197. STM32U535xx/545xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C2 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
PA4 pin: slave chip select pin used in push-pull, no pull
SPI1_NSS pin Input
mode.

454/508 AN2606 Rev 65

AN2606 STM32U535xx/545xx devices

Table 197. STM32U535xx/545xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB5 pin: slave data input line, used in push-pull, no pull
SPI3 SPI3_MOSI pin Input
mode
PG10 pin: slave data input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input/
push-pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.

AN2606 Rev 65 455/508

507
STM32U535xx/545xx devices AN2606

Table 197. STM32U535xx/545xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB Enabled USB FS interrupt vector is enabled and used for USB DFU
communications.
DFU
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

Table 198. STM32U535xx/545xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of status
Data Status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone
disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP
0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

456/508 AN2606 Rev 65

AN2606 STM32U535xx/545xx devices

88.2 Bootloader selection

Figure 117 shows the bootloader selection mechanism.

Figure 117. Bootloader V9.x selection for STM32U535xx/545xx

System reset
Or JumpToBL

Disable all
Exexute
0x7F detected interrupt sources
De-Init system Yes BL_USART_Loop
on USARTx and other
Configure system for USARTx
interfaces clocks
clock to 60 MHz
with HSI and PLL
No

Disable all
System Init (Clock, Execute
FDCAN frame interrupt sources
GPIOs, IWDG, Yes BL_FDCAN_Loop
detected and other
SysTick) for FDCANx
interfaces clocks

No
Configure
USARTx Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks
Configure USB FS
device
No No

Disable all
SPIx detects Execute
Configure I2Cx interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interfaces clocks

No
Configure SPIx

Disable all
Execute DFU
USB cable interrupt sources
Yes bootloader using
detected and other
USB interrupts
interfaces clocks
MS57522V2

Configure
FDCANx

AN2606 Rev 65 457/508

507
STM32U535xx/545xx devices AN2606

88.3 Bootloader version

Table 199. STM32U535xx/545xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not

V9.1 Initial bootloader version
send the command ID to the host

458/508 AN2606 Rev 65

AN2606 STM32U575xx/85xx devices

89 STM32U575xx/85xx devices

89.1 Bootloader configuration

The STM32U575xx/85xx bootloader is activated by applying Pattern 12 (described in
Table 2). Table 200 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 200. STM32U575xx/85xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
RCC CRS is enabled for the DFU so that USB can be clocked by
HSI48 enabled
HSI 48 MHz.
- 20 MHz derived from the PLLQ is used for FDCAN
Common 16 Kbytes, starting from address 0x20000000, are used by
to all RAM -
the bootloader firmware
64 Kbytes, starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Used in alternate
USART1_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Used in alternate
USART2_TX pin Output
push-pull, pull-up mode.
Once initialized, the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Used in alternate
USART3_TX pin Output
push-pull, pull-up mode.

AN2606 Rev 65 459/508

507
STM32U575xx/85xx devices AN2606

Table 200. STM32U575xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1011010x (x = 0 for write and x = 1
for read)
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI1 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, pull-down
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, pull-down
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, pull-down mode
PA4 pin: slave chip select pin used in push-pull, pull-down
SPI1_NSS pin Input
mode.

460/508 AN2606 Rev 65

AN2606 STM32U575xx/85xx devices

Table 200. STM32U575xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI2 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data input line, used in push-pull, pull-down
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, pull-down
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, pull-down mode
PB12 pin: slave chip select pin used in push-pull, pull-down
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI3 Enabled
– 8-bit MSB
– Speed up to 8 MHz
– Polarity: CPOL low, CPHA low, NSS hardware.
PB5 pin: slave data input line, used in push-pull, pull-down
SPI3 SPI3_MOSI pin Input
mode
PG10 pin: slave data input line, used in push-pull, pull-down
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, pull-down
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, pull-down
SPI3_NSS pin Input
mode.
Once initialized the configuration is:
– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, pull-up mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, pull-up mode.

AN2606 Rev 65 461/508

507
STM32U575xx/85xx devices AN2606

Table 200. STM32U575xx/85xx configuration in system memory boot mode (continued)

Bootloader Feature/Peripheral State Comment

USB FS configured in forced device mode.

USB FS interrupt vector is enabled and used for USB DFU
USB Enabled communications.
Note: VDDUSB IO must be connected to 3.3 V as USB
DFU peripheral is used by the bootloader.
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

Table 201. STM32U575xx/585xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of status
Data Status data
Function Opcode data sent Data sent data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone
disable
Must be run when 0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP
0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

462/508 AN2606 Rev 65

AN2606 STM32U575xx/85xx devices

89.2 Bootloader selection

Figure 118. Bootloader V9.x selection for STM32U575xx/85xx

System reset
Or JumpToBL

Disable all
Exexute
0x7F detected interrupt sources
De-Init system Yes BL_USART_Loop
on USARTx and other
Configure system for USARTx
interfaces clocks
clock to 60 MHz
with HSI and PLL
No

Disable all
System Init (Clock, Execute
FDCAN frame interrupt sources
GPIOs, IWDG, Yes BL_FDCAN_Loop
detected and other
SysTick) for FDCANx
interfaces clocks

No
Configure
USARTx Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interfaces clocks
Configure USB FS
device
No No

Disable all
SPIx detects Execute
Configure I2Cx interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interfaces clocks

No
Configure SPIx

Disable all
Execute DFU
USB cable interrupt sources
Yes bootloader using
detected and other
USB interrupts
interfaces clocks
MS57522V2

Configure
FDCANx

89.3 Bootloader version

Table 202. STM32U575xx/85xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.2 Initial bootloader version
the command ID to the host

AN2606 Rev 65 463/508

507
STM32U595xx/99xx/A5xx/A9xx devices AN2606

90 STM32U595xx/99xx/A5xx/A9xx devices

90.1 Bootloader configuration

The STM32U595xx/99xx/A5xx/A9xx bootloader is activated by applying Pattern 12
(described in Table 2). Table 203 shows the hardware resources used by this bootloader.
The bootloader follows boot model V3_1 (see Section 4.10), so it inherits all its constraints.

Table 203. STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked by

HSI enabled
HSI).
- 20 MHz derived from the PLLQ is used for FDCAN
RCC When USB cable is detected, SW tries to detect if a quartz is
plugged in the board to configure the USBPHY clock.
HSE enabled
Supported quartz: 8, 12, 16, 20, 24, 26, and 32 MHz
Common If no quartz is detected a system reset is triggered.
to all
16 Kbytes, starting from address 0x20000000, are used by the
RAM -
bootloader firmware
64 Kbytes, starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and one
USART1 Enabled
stop bit
PA10 pin: USART1 in reception mode. Used in alternate push-
USART1 USART1_RX pin Input
pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and one
USART2 Enabled
stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART1 is detected.
Once initialized the configuration is 8-bit, even parity, and one
USART3 Enabled
stop bit
PC11 pin: USART3 in reception mode. Used in alternate push-
USART3 USART3_RX pin Input
pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.

464/508 AN2606 Rev 65

AN2606 STM32U595xx/99xx/A5xx/A9xx devices

Table 203. STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1100000x (x = 0 for write and x = 1
for read).
I2C1_SCL pin Input/output PB6 pin: clock line is used in open-drain pull-up mode.
I2C1_SDA pin Input/output PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1100000x (x = 0 for write and x = 1
for read).
I2C2_SCL pin Input/output PB10 pin: clock line is used in open-drain pull-up mode.
I2C2_SDA pin Input/output PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1100000x (x = 0 for write and x = 1
for read).
I2C3_SCL pin Input/output PC0 pin: clock line is used in open-drain pull-up mode.
I2C3_SDA pin Input/output PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI1
SPI1_MOSI pin Input PA7 pin: slave data input line, used in push-pull, no pull mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
SPI1_NSS pin Input PA4 pin: slave chip select pin used in push-pull, no pull mode.

AN2606 Rev 65 465/508

507
STM32U595xx/99xx/A5xx/A9xx devices AN2606

Table 203. STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI3 SPI3_MOSI pin Input PB5 pin: slave data input line, used in push-pull, no pull mode
PG10 pin: slave data input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
USB HS configured in forced device mode.
USB Enabled USB HS interrupt vector is enabled and used for USB DFU
communications.
DFU
USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

466/508 AN2606 Rev 65

AN2606 STM32U595xx/99xx/A5xx/A9xx devices

Table 203. STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

Once initialized the configuration is:

– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate push-
FDCAN1_Rx pin Input/
pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.

Table 204. STM32U595xx/99xx/A5xx/A9xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number of
Data status data Status data
Function Opcode data sent Data sent data
received received received
(2 bytes) (2 bytes) received
(2 bytes)

TrustZone disable
Must be run when
0x82 0x4 0x0 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Regression from
RDP L1 to RDP 0.5
Must be run when 0x82 0x4 0x1 0x0 NA 0x1 0x0
TZEN = 1 and
RDP = 1
Unlock write
protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when
RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

AN2606 Rev 65 467/508

507
STM32U595xx/99xx/A5xx/A9xx devices AN2606

90.2 Bootloader selection

Figure 119 shows the bootloader selection mechanism.

Figure 119. Bootloader V9.x selection for STM32U595xx/99xx/A5xx/A9xx

System Reset
Or JumpToBL

Disable all
Execute
0x7F detected on interrupt sources
De-Init system Yes BL_USART_Loop
USARTx and other
Configure System for USARTx
interface clocks
clock to 60 MHz
with HSI and PLL
No

System Init Disable all

Execute
(Clock, GPIOs, FDCAN Frame interrupt sources
Yes BL_FDCAN_Loop
IWDG, SysTick) detected and other
for FDCANx
interface clocks

No

Configure
USB HS device Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interface clocks

No No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interface clocks

Configure I2Cx No

Stop, DeInit
USB cable USB IP, and
Yes System Reset
detected start quartz
detection
Configure SPIx

Re-configure
Execute DFU No
Configure System and Quartz
MS57512V2

bootloader using Yes

FDCANx USB clocks detected?
USB interrupts
using HSE

90.3 Bootloader version

Table 205. STM32U595xx/99xx/A5xx/A9xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.2 Initial bootloader version
the command ID to the host

468/508 AN2606 Rev 65

AN2606 STM32U5F7xx/F9xx/G7xx/G9xx devices

91 STM32U5F7xx/F9xx/G7xx/G9xx devices

91.1 Bootloader configuration

The STM32U5F7xx/F9xx/G7xx/G9xx bootloader is activated by applying Pattern 12
(described in Table 2). Table 206 shows the hardware resources used by this bootloader.

Table 206. STM32U5F7xx/F9xx/G7xx/G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The system clock frequency is 60 MHz (using PLL clocked

HSI enabled
by HSI).
- 20 MHz derived from the PLLQ is used for FDCAN
RCC When USB cable is detected, SW tries to detect if a quartz is
plugged in the board to configure the USBPHY clock.
HSE enabled
Supported quartz: 8, 12, 16, 20, 24, 26, and 32 MHz
If no quartz is detected, a system reset is triggered.
Common to all
16 Kbytes, starting from address 0x20000000, are used by
RAM -
the bootloader firmware
64 Kbytes, starting from address 0x0BF90000, contain the
System memory -
bootloader firmware
The IWDG prescaler is configured to its maximum value. It is
IWDG - periodically refreshed to prevent watchdog reset (if the
hardware IWDG option was previously enabled by the user).
Once initialized, the configuration is 8-bit, even parity, and
USART1 Enabled
one stop bit
PA10 pin: USART1 in reception mode. Used in alternate
USART1 USART1_RX pin Input
push-pull, pull-up mode.
PA9 pin: USART1 in transmission mode. Set as input until
USART1_TX pin Output
USART1 is detected.
Once initialized, the configuration is 8-bit, even parity, and
USART2 Enabled
one stop bit
PA3 pin: USART2 in reception mode. Used in alternate push-
USART2 USART2_RX pin Input
pull, pull-up mode.
PA2 pin: USART2 in transmission mode. Set as input until
USART2_TX pin Output
USART1 is detected.
Once initialized the configuration is 8-bit, even parity, and
USART3 Enabled
one stop bit
PC11 pin: USART3 in reception mode. Used in alternate
USART3 USART3_RX pin Input
push-pull, pull-up mode.
PC10 pin: USART3 in transmission mode. Set as input until
USART3_TX pin Output
USART1 is detected.

AN2606 Rev 65 469/508

507
STM32U5F7xx/F9xx/G7xx/G9xx devices AN2606

Table 206. STM32U5F7xx/F9xx/G7xx/G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The I2C1 configuration is:

– I2C speed: up to 1 MHz
– 7-bit address
I2C1 Enabled – Target mode
I2C1 – Analog filter ON
– Target 7-bit address: 0b1101001x (x = 0 for write and x = 1
for read).
I2C1_SCL pin PB6 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C1_SDA pin PB7 pin: data line is used in open-drain pull-up mode.
The I2C2 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C2 Enabled – Target mode
I2C2 – Analog filter ON
– Target 7-bit address: 0b1101001x (x = 0 for write and x = 1
for read).
I2C2_SCL pin PB10 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C2_SDA pin PB11 pin: data line is used in open-drain pull-up mode.
The I2C3 configuration is:
– I2C speed: up to 1 MHz
– 7-bit address
I2C3 Enabled – Target mode
I2C3 – Analog filter ON
– Target 7-bit address: 0b1101001x (x = 0 for write and x = 1
for read).
I2C3_SCL pin PC0 pin: clock line is used in open-drain pull-up mode.
Input/output
I2C3_SDA pin PC1 pin: data line is used in open-drain pull-up mode.
The SPI1 configuration is:
– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI1 PA7 pin: slave data input line, used in push-pull, no pull
SPI1_MOSI pin Input
mode
PA6 pin: slave data output line, used in push-pull, no pull
SPI1_MISO pin Output
mode
SPI1_SCK pin Input PA5 pin: slave clock line, used in push-pull, no pull mode
PA4 pin: slave chip select pin used in push-pull, no pull
SPI1_NSS pin Input
mode.

470/508 AN2606 Rev 65

AN2606 STM32U5F7xx/F9xx/G7xx/G9xx devices

Table 206. STM32U5F7xx/F9xx/G7xx/G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

The SPI2 configuration is:

– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
SPI2 PB15 pin: slave data input line, used in push-pull, no pull
SPI2_MOSI pin Input
mode
PB14 pin: slave data output line, used in push-pull, no pull
SPI2_MISO pin Output
mode
SPI2_SCK pin Input PB13 pin: slave clock line, used in push-pull, no pull mode
PB12 pin: slave chip select pin used in push-pull, no pull
SPI2_NSS pin Input
mode.
The SPI3 configuration is:
– Slave mode
– Full Duplex
SPI Enabled
– 8-bit MSB
– Speed up to 8 MHz
Polarity: CPOL low, CPHA low, NSS hardware.
PB5 pin: slave data input line, used in push-pull, no pull
SPI3 SPI3_MOSI pin Input
mode
PG10 pin: slave data input line, used in push-pull, no pull
SPI3_MISO pin Output
mode
PG9 pin: slave data output line, used in push-pull, no pull
SPI3_SCK pin Input
mode
PG12 pin: slave chip select pin used in push-pull, no pull
SPI3_NSS pin Input
mode.
USB HS configured in forced device mode. USB HS interrupt
USB Enabled
vector is enabled and used for USB DFU communications.

DFU USB_DM pin PA11: USB DM line. Used in input no pull mode.
Input/output PA12: USB DP line. Used in input no pull mode.
USB_DP pin
No external pull-up resistor is required

AN2606 Rev 65 471/508

507
STM32U5F7xx/F9xx/G7xx/G9xx devices AN2606

Table 206. STM32U5F7xx/F9xx/G7xx/G9xx configuration in system memory boot mode

Bootloader Feature/Peripheral State Comment

Once initialized the configuration is:

– Connection bit rate 250 kbit/s
– Data bit rate 1000 kbit/s
– FrameFormat = FDCAN_FRAME_FD_BRS
FDCAN1 Enabled
– Mode = FDCAN_MODE_NORMAL
– AutoRetransmission = ENABLE
FDCAN
– TransmitPause = DISABLE
– ProtocolException = ENABLE
PB8 pin: FDCAN1 in reception mode. Used in alternate
FDCAN1_Rx pin Input/
push-pull, no pull mode.
PB9 pin: FDCAN1 in transmission mode. Used in alternate
FDCAN1_Tx pin Output
push-pull, no pull mode.

Table 207. STM32U5F7xx/F9xx/G7xx/G9xx special commands

Special commands supported (USART/I2C/SPI/FDCAN)
Opcode - 0x50

Number of
Sub- Number of Number Status
Data status data
Function Opcode data sent Data sent of data data
received received
(2 bytes) (2 bytes) received received
(2 bytes)

TrustZone disable
Must be run when TZEN = 1 0x82 0x4 0x0 0x0 NA 0x1 0x0
and RDP = 1
Regression from RDP L1 to
RDP 0.5
0x82 0x4 0x1 0x0 NA 0x1 0x0
Must be run when TZEN = 1
and RDP = 1
Unlock write protection
0x82 0x4 0xYY02(1) 0x0 NA 0x1 0x0
Must be run when RDP = 1
1. 0xYY can have four values (0: WRP area, 1: WRP1A, 2: WRP2A, 3: WRP1B, 4: WRP2B)

Note: USB special commands are slightly different from the other protocols as per the USB
protocol specificities:
• No Opcode is used, Sub-Opcode is used directly
• Sub-Opcode is treated in a single byte and not two bytes
• Data is sent on USB frame byte per byte. No need to add number of data to be
transmitted
• Returned data and status is formatted on the USB native protocol

472/508 AN2606 Rev 65

AN2606 STM32U5F7xx/F9xx/G7xx/G9xx devices

91.2 Bootloader selection

Figure 119 shows the bootloader selection mechanism.

Figure 120. Bootloader V9.x selection for STM32U5F7xx/F9xx/G7xx/G9xx

System Reset
Or JumpToBL

Disable all
Execute
0x7F detected on interrupt sources
De-Init system Yes BL_USART_Loop
USARTx and other
Configure System for USARTx
interface clocks
clock to 60 MHz
with HSI and PLL
No

System Init Disable all

Execute
(Clock, GPIOs, FDCAN Frame interrupt sources
Yes BL_FDCAN_Loop
IWDG, SysTick) detected and other
for FDCANx
interface clocks

No

Configure
USB HS device Disable all
Execute
I2C address interrupt sources
Yes BL_I2C_Loop
detected and other
for I2Cx
interface clocks

No No
Configure
USARTx
Disable all
SPIx detects Execute
interrupt sources
Synchro Yes BL_SPI_Loop
and other
mechanism for SPIx
interface clocks

Configure I2Cx No

Stop, DeInit
USB cable USB IP, and
Yes System Reset
detected start quartz
detection
Configure SPIx

Re-configure
Execute DFU No
Configure System and Quartz
MS57512V2

bootloader using Yes

FDCANx USB clocks detected?
USB interrupts
using HSE

91.3 Bootloader version

Table 208. STM32U5F7xx/F9xx/G7xx/G9xx bootloader versions
Version number Description Known limitations

FDCAN Readout unprotect command does not send

V9.0 Initial bootloader version
the command ID to the host

AN2606 Rev 65 473/508

507
Device-dependent bootloader parameters AN2606

92 Device-dependent bootloader parameters

The bootloader protocol command set and sequences for each serial peripheral are the
same for all STM32 devices. Some parameters depend on device and bootloader version:
• PID (Product ID)
• Valid RAM addresses (RAM area used during bootloader execution is not accessible)
accepted by the bootloader when the Read Memory, Go and Write Memory commands
are requested.
• System memory area.
Table 209 shows the values of these parameters for each STM32 device.

Table 209. Bootloader device-dependent parameters

STM32 System
Device PID BL ID RAM
series memory

0x20000000 -
STM32C011xx 0x443 0x51
0x20002FFF 0x1FFF0000 -
0x20002000 - 0x1FFF17FF
STM32C031xx 0x453 0x52
0x200017FF
0x20001400 - 0x1FFF0000 -
C0 STM32C051xx 0x44C 0xB0
0x20002FFF 0x1FFF2FFF
0x20002300 - 0x1FFF0000 -
STM32C071xx 0x493 0xD1
0x20005FFF 0x1FFF6FFF
0x20002400 - 0x1FFF0000 -
STM32C091xx/92xx 0x44D 0x121
0x200077FF 0x1FFF3FFF
0x20000800 -
STM32F05xxx and STM32F030x8 0x440 0x21
0x20001FFF 0x1FFFEC00 -
0x20000800 - 0x1FFFF7FF
STM32F03xx4/6 0x444 0x10
0x20000FFF
0x20001800 - 0x1FFFD800 -
STM32F030xC 0x442 0x52
0x20007FFF 0x1FFFF7FF
0x1FFFC400 -
STM32F04xxx 0x445 0xA1 NA
0x1FFFF7FF
F0
0x1FFFC400 -
STM32F070x6 0x445 0xA2 NA
0x1FFFF7FF
0x1FFFC800 -
STM32F070xB 0x448 0xA2 NA
0x1FFFF7FF
0x20001800 - 0x1FFFC800 -
STM32F071xx/072xx 0x448 0xA1
0x20003FFF 0x1FFFF7FF
0x1FFFD800 -
STM32F09xxx 0x442 0x50 NA
0x1FFFF7FF

474/508 AN2606 Rev 65

AN2606 Device-dependent bootloader parameters

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20000200 -
Low-density 0x412 NA
0x200027FF
0x20000200 -
Medium-density 0x410 NA
0x20004FFF
0x20000200 - 0x1FFFF000 -
STM32F10xxx High-density 0x414 NA
0x2000FFFF 0x1FFFF7FF
0x20000200 -
F1 Medium-density value line 0x420 0x10
0x20001FFF
0x20000200 -
High-density value line 0x428 0x10
0x20007FFF
0x20001000 - 0x1FFFB000 -
STM32F105xx/107xx 0x418 NA
0x2000FFFF 0x1FFFF7FF
0x20000800 - 0x1FFFE000 -
STM32F10xxx XL-density 0x430 0x21
0x20017FFF 0x1FFFF7FF
0x20 0x20002000 - 0x1FFF0000 -
F2 STM32F2xxxx 0x411
0x33 0x2001FFFF 0x1FFF77FF

0x20001400 -
STM32F373xx 0x41
0x20007FFF
0x432
0x20001000 -
STM32F378xx 0x50
0x20007FFF
STM32F302xB(C)/303xB(C) 0x41 0x20001400 -
0x422
STM32F358xx 0x50 0x20009FFF

STM32F301xx/302x4(6/8) 0x40 0x20001800 - 0x1FFFD800 -

F3 0x439
0x20003FFF 0x1FFFF7FF
STM32F318xx 0x50
0x20001800 -
STM32F303x4(6/8)/334xx/328xx 0x438 0x50
0x20002FFF
0x20001800 -
STM32F302xD(E)/303xD(E) 0x446 0x40
0x2000FFFF
0x20001800 -
STM32F398xx 0x446 0x50
0x2000FFFF

AN2606 Rev 65 475/508

507
Device-dependent bootloader parameters AN2606

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20002000 -
0x31
0x2001FFFF
STM32F40xxx/41xxx 0x413
0x20003000 -
0x91
0x2001FFFF
0x70 0x20003000 -
STM32F42xxx/43xxx 0x419
0x91 0x2002FFFF

0x20003000 -
STM32F401xB(C) 0x423 0xD1
0x2000FFFF
0x20003000 -
STM32F401xD(E) 0x433 0xD1
0x20017FFF
0x20003000 - 0x1FFF0000 -
F4 STM32F410xx 0x458 0xB1
0x20007FFF 0x1FFF77FF

0x20003000 -
STM32F411xx 0x431 0xD0
0x2001FFFF
0x20003000 -
STM32F412xx 0x441 0x90
0x2003FFFF
0x20003000 -
STM32F446xx 0x421 0x90
0x2001FFFF
0x20003000 -
STM32F469xx/479xx 0x434 0x90
0x2005FFFF
0x20003000 -
STM32F413xx/423xx 0x463 0x90
0x2004FFFF
0x20004000 - 0x1FF00000 -
STM32F72xxx/73xxx 0x452 0x90
0x2003FFFF 0x1FF0EDBF
0x20004000 - 0x1FF00000 -
0x70
0x2004FFFF 0x1FF0EDBF
F7 STM32F74xxx/75xxx 0x449
0x20004000 - 0x1FF00000 -
0x90
0x2004FFFF 0x1FF0EDBF
0x20004000 - 0x1FF00000 -
STM32F76xxx/77xxx 0x451 0x93
0x2007FFFF 0x1FF0EDBF

476/508 AN2606 Rev 65

AN2606 Device-dependent bootloader parameters

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20001000 - 0x1FFF0000 -
STM32G03xxx/04xxx 0x466 0x52
0x20001FFF 0x1FFF1FFF
0x20001000 - 0x1FFF0000 -
STM32G05xxx/061xx 0x456 0x51
0x20002000 0x1FFF1FFF
0x20002700 - 0x1FFF0000 -
STM32G07xxx/08xxx 0x460 0xB3
0x20009000 0x1FFF6FFF

G0 0x1FFF0000 -
0x20004000 - 0x1FFF6FFF
STM32G0B0xx 0x467 0xD0
0x20020000 0x1FFF8000 -
0x1FFFEFFF
0x1FFF0000 -
0x20004000 - 0x1FFF6FFF
STM32G0B1xx/0C1xx 0x467 0x92
0x20020000 0x1FFF8000 -
0x1FFFEFFF
0x20004000 – 0x1FFF0000 -
STM32G431xx/441xx 0x468 0xD4
0x20005800 0x1FFF7000
0x20004000 – 0x1FFF0000 -
G4 STM32G47xxx/48xxx 0x469 0xD5
0x20018000 0x1FFF7000
0x20004000 - 0x1FFF0000 -
STM32G491xx/A1xx 0x479 0xD2
0x2001C000 0x1FFF7000
0x20004000 - 0x0BF87000 -
STM32H503xx 0x474 0xE1
0x20007FFF 0x0BF8FFFF
0x20000000 - 0x0BF97000 -
H5 STM32H562xx/563xx/573xx 0x484 0xE3
0x2009FFFF 0x0BF9FFFF
0x20004000 - 0x0BF97000 -
STM32H523xx/533xx 0x478 0xE2
0x20043FFF 0x0BF9FFFF

AN2606 Rev 65 477/508

507
Device-dependent bootloader parameters AN2606

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20004100 -
0x2001FFFF 0x1FF00000 -
STM32H72xxx/73xxx 0x483 0x93
0x24004000 - 0x1FF1E7FF
0x2404FFFF
0x20004100 -
0x2001FFFF 0x1FF00000 -
STM32H74xxx/75xxx 0x450 0x91
0x24005000 - 0x1FF1E7FF
0x2407FFFF
0x20004100 -
H7 0x2001FFFF 0x1FF00000 -
STM32H7A3xx/7B3xx/7B0xx 0x480 0x92
0x24034000 - 0x1FF13FFF
0x2407FFFF
0x24000000 -
0x2401FFFF
0x24024000 -
0x24071FFF 0x1FF18000 -
STM32H7Rxxx/7Sxxx 0x485 0xE3
0x20000000 - 0x1FF1FFFF
0x2002FFFF
0x00000000 -
0x0002FFFF(1)
0x1FF00000 -
STM32L01xxx/02xxx 0x457 0xC3 NA
0x1FF00FFF
0x20001000 - 0x1FF00000 -
STM32L031xx/041xx 0x425 0xC0
0x20001FFF 0x1FF00FFF
0x20001000 - 0x1FF00000 -
L0 STM32L05xxx/06xxx 0x417 0xC0
0x20001FFF 0x1FF00FFF
0x20001000 -
0x41
0x20004FFF 0x1FF00000 -
STM32L07xxx/08xxx 0x447
0x20001400 - 0x1FF01FFF
0xB2
0x20004FFF
0x20000800 -
STM32L1xxx6(8/B) 0x416 0x20
0x20003FFF
STM32L1xxx6(8/B)A 0x429 0x20 0x20001000 -
STM32L1xxxC 0x427 0x40 0x20007FFF 0x1FF00000 -
L1
0x1FF01FFF
0x20001000 -
STM32L1xxxD 0x436 0x45
0x2000BFFF
0x20001000 -
STM32L1xxxE 0x437 0x40
0x20013FFF

478/508 AN2606 Rev 65

AN2606 Device-dependent bootloader parameters

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x20002100 - 0x1FFF 0000 -

STM32L412xx/422xx 0x464 0xD1
0x20008000 0x1FFF6FFF
0x20003100 - 0x1FFF 0000 -
STM32L43xxx/44xxx 0x435 0x91
0x2000BFFF 0x1FFF6FFF
0x20003100 - 0x1FFF 0000 -
STM32L45xxx/46xxx 0x462 0x92
0x2001FFFF 0x1FFF6FFF
0x20003000 -
0xA3
0x20017FFF 0x1FFF 0000 -
L4 STM32L47xxx/48xxx 0x415
0x20003100 - 0x1FFF6FFF
0x92
0x20017FFF
0x20003100 - 0x1FFF 0000 -
STM32L496xx/4A6xx 0x461 0x93
0x2003FFFF 0x1FFF6FFF
0x20003200 - 0x1FFF 0000 -
STM32L4Rxx/4Sxx 0x470 0x95
0x2009FFFF 0x1FFF6FFF
0x20004000 - 0x1FFF 0000 -
STM32L4P5xx/Q5xx 0x471 0x90
0x2004FFFF 0x1FFF6FFF
0x20004000 - 0x0BF9 0000 -
L5 STM32L552xx/562xx 0x472 0x92
0x2003FFFF 0x0BF9 7FFF
0x20001500 – 0x1FFF 0000 –
STM32U031xx 0x459 0xB0
0x20002FFF 0x1FFF 37FF
U0
0x20002170 – 0x1FFF 0000 –
STM32U073xx/83xx 0x489 0xD0
0x20009FFF 0x1FFF 67FF
0x20004000 - 0x0BF8 F000 -
U3 STM32U375xx/ STM32U385xx 0x454 0xE2
0x2003FFFF 0x0BF9 FFFF
0x20004000 - 0x0BF90000 -
STM32U535xx/545xx 0x455 0x91
0x2023FFFF 0x0BF9FFFF
0x20004000 - 0x0BF90000 -
STM32U575xx/ STM32U585xx 0x482 0x92
0x200BFFFF 0x0BF9FFFF
U5
0x20004000 - 0x0BF90000 -
STM32U595xx/599xx/5A9xx 0x481 0x92
0x2026FFFF 0x0BF9FFFF
0x20004000 - 0x0BF90000 -
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0x476 0x90
0x202EFFFF 0x0BF9FFFF
0x20005000 - 0x1FFF 0000 -
STM32WB10xx/15xx 0x494 0xB1
0x20040000 0x1FFF7000
WB
0x20004000 - 0x1FFF 0000 -
STM32WB30xx/35xx/50xx/WB55xx 0x495 0xD5
0x2000BFFF 0x1FFF7000

AN2606 Rev 65 479/508

507
Device-dependent bootloader parameters AN2606

Table 209. Bootloader device-dependent parameters (continued)

STM32 System
Device PID BL ID RAM
series memory

0x2000 0000 - 0x0BF8 8000 -

STM32WBA52xx 0x492 0xB0
0x2000 1FFF 0x0BF8 FFFF
0x2000 1800 - 0x0BF8 8000 -
WBA STM32WBA54xx/55xx 0x492 0xB1
0x2000 1FFF 0x0BF8 FFFF
0x2000 3000 - 0x0BF9 0000 -
STM32WBA62xx/63xx/64xx/65xx 0x4B0 0xD2
0x2007 FFFF 0x0BF9 FFFF
0x2000 2000 - 0x1FFF 0000 -
WL STM32WLE5xx/WL55xx 0x497 0xC4
0x2000 FFFF 0x1FFF3FFF
1. Addresses are listed with the max values, but depending on option bytes, the end values can change.

480/508 AN2606 Rev 65

AN2606 Bootloader timings

93 Bootloader timings

This section details the timings of the bootloader firmware to use for correct synchronization
between the host and the STM32 device.
Two types of timings are described, namely STM32 device bootloader resources
initialization duration, and communication interface selection duration.
After these timings the bootloader is ready to receive and execute host commands.

93.1 Bootloader startup timing

After bootloader reset, the host must wait until the STM32 bootloader is ready to start
detection phase with a specific interface communication. This time corresponds to
bootloader startup timing, during which resources used by bootloader are initialized.

Figure 121. Bootloader startup timing description

Table 210. Bootloader startup timings (ms)

Device Minimum startup HSE timeout

STM32C011xx 2.1 NA
STM32C031xx 2.1 NA
STM32C051xx 2.262 NA
STM32C071xx 2.358 NA
STM32C091xx/92xx 1.527 NA
STM32F03xx4/6 1.612 NA
STM32F05xxx and STM32F030x8 devices 1.612 NA
STM32F04xxx 0.058 NA
STM32F071xx/072xx 0.058 NA

AN2606 Rev 65 481/508

507
Bootloader timings AN2606

Table 210. Bootloader startup timings (ms) (continued)

Device Minimum startup HSE timeout

HSE connected 3
STM32F070x6 200
HSE not connected 230
HSE connected 6
STM32F070xB 200
HSE not connected 230
STM32F09xxx 2 NA
STM32F030xC 2 NA
STM32F10xxx 1.227 NA
PA9 pin low 1.396
STM32F105xx/107xx NA
PA9 pin high 524.376
STM32F10xxx XL-density 1.227 NA
V2.x 134 NA
STM32F2xxxx
V3.x 84.59 0.790
HSE connected 45
STM32F301xx/302x4(6/8) 560.5
HSE not connected 560.8
HSE connected 43.4
STM32F302xB(C)/303xB(C) 2.236
HSE not connected 2.36
HSE connected 7.53 NA
STM32F302xD(E)/303xD
HSE not connected 146.71 NA
STM32F303x4(6/8)/334xx/328xx 0.155 NA
STM32F318xx 0.182 NA
STM32F358xx 1.542 NA
HSE connected 43.4
STM32F373xx 2.236
HSE not connected 2.36
STM32F378xx 1.542 NA
STM32F398xx 1.72 NA
V3.x 84.59 0.790
STM32F40xxx/41xxx
V9.x 74 96
STM32F401xB(C) 74.5 85
STM32F401xD(E) 74.5 85
STM32F410xx 0.614 NA
STM32F411xx 74.5 85
STM32F412xx 0.614 180
STM32F413xx/423xx 0.642 165
V7.x 82 97
STM32F429xx/439xx
V9.x 74 97

482/508 AN2606 Rev 65

AN2606 Bootloader timings

Table 210. Bootloader startup timings (ms) (continued)

Device Minimum startup HSE timeout

STM32F446xx 73.61 96
STM32F469xx/479xx 73.68 230
STM32F72xxx/73xxx 17.93 50
STM32F74xxx/75xxx 16.63 50
STM32G03xxx/04xxx 0.390 NA
STM32G07xxx/08xxx 0.390 NA
STM32G0Bxxx/Cxxx 0.390 NA
STM32G05xxx/061xx 0.390 NA
STM32G4xxxx 0.390 NA
STM32H503xx 0,238 NA
STM32H562xx/63xx/73xx 0.292 NA
STM32H72xxx/73xxx 53.975 NA
STM32H74xxx/75xxx 53.975 2
STM32H7A3xx/7B3xx/7B0xx 545 NA
STM32L01xxx/02xxx 0.63 NA
STM32L031xx/041xx 0.62 NA
STM32L05xxx/06xxx 0.22 NA
V4.x 0.61 NA
STM32L07xxx/08xxx
V11.x 0.71 NA
STM32L1xxx6(8/B)A 0.542 NA
STM32L1xxx6(8/B) 0.542 NA
STM32L1xxxC 0.708 80
STM32L1xxxD 0.708 80
STM32L1xxxE 0.708 200
STM32L43xxx/44xxx 0.86 100
STM32L45xxx/46xxx 0.86 NA
LSE connected 55
V10.x 100
LSE not connected 2560
STM32L47xxx/48xxx
LSE connected 55.40
V9.x 100
LSE not connected 2560.5
STM32L412xx/422xx 0.86 NA
STM32L496xx/4A6xx 76.93 100
STM32L4P5xx /Q5xx 9.891 NA
STM32L4Rxx/4Sxx 10.12 NA
STM32L552xx/562xx 0.390 NA

AN2606 Rev 65 483/508

507
Bootloader timings AN2606

Table 210. Bootloader startup timings (ms) (continued)

Device Minimum startup HSE timeout

STM32U031xx 4.534 NA
STM32U073xx/ STM32U083xx 5.626 NA
STM32U375xx/385xx 4.418 NA
STM32U535xx/545xx 0.390 NA
STM32U575xx/85xx 0.390 NA
STM32U595xx/599xx/5A5xx/5A9xx 0.390 NA
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.390 NA
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.390 NA
STM32WBA52xx 0.390 NA
STM32WBA62xx/63xx/64xx/65xx 2,73 NA
STM32WLE5xx/WL55xx 0.390 NA

93.2 USART connection timing

USART connection timing is the time that the host must wait for between sending the
synchronization data (0x7F) and receiving the first acknowledge response (0x79).

Figure 122. USART connection timing description

Host Host
sends receives
0x7F 0x79 (ACK)

a b a
Bootloader
execution time

Device Device Bootloader

receives sends ACK ready to receive
0x7F byte 0x79 and execute
commands

a Duration of 1 byte sending through USART (depends on Baudrate)

b Duration of USART peripheral configuration MS35041V1

1. Receiving characters different from 0x7F (or line glitches) causes bootloader to start communication using
a wrong baudrate. Bootloader measures the signal length between rising edge of the first bit to the falling
edge of the last bit to deduce the baudrate value
2. Bootloader does not realign the calculated baudrate to standard baudrate values (i.e. 1200, 9600, 115200).

Note: The PA9 pin (USB_VBUS) on STM32F105xx/107xx devices is used to detect the USB host
connection. The initialization of USB peripheral is performed only if PA9 is high at detection

484/508 AN2606 Rev 65

AN2606 Bootloader timings

phase, which means that a host is connected to the port and delivering 5 V on the USB bus.
When PA9 level is high at detection phase, more time is required to initialize and shutdown
the USB peripheral. To minimize bootloader detection time when PA9 pin is not used, keep
PA9 low during USART detection phase, from the moment the device is reset, until a device
ACK is sent.

Table 211. USART bootloader minimum timings (ms)

One USART USART USART
Device
byte sending configuration connection

STM32C011xx 0.138 0.043 0.182

STM32C031xx 0.112 0.028 0.168
STM32C051xx 0.1 0.033 0.23
STM32C071xx 0.1 0.104 0.182
STM32C091xx/92xx 0.1 0.102 0.383
STM32F03xx4/6 0.078125 0.0064 0.16265
STM32F05xxx and STM32F030x8 devices 0.078125 0.0095 0.16575
STM32F04xxx 0.078125 0.007 0.16325
STM32F071xx/072xx 0.078125 0.007 0.16325
STM32F070x6 0.078125 0.014 0.17
STM32F070xB 0.078125 0.08 0.23
STM32F09xxx 0.078125 0.07 0.22
STM32F030xC 0.078125 0.07 0.22
STM32F10xxx 0.078125 0.002 0.15825
PA9 pin low 0.007 0.16325
STM32F105xx/107xx 0.078125
PA9 pin High 105 105.15625
STM32F10xxx XL-density 0.078125 0.006 0.16225
V2.x
STM32F2xxxx 0.078125 0.009 0.16525
V3.x
HSE connected
STM32F301xx/302x4(6/8) 0.078125 0.002 0.15825
HSE not connected
HSE connected
STM32F302xB(C)/303xB(C) 0.078125 0.002 0.15825
HSE not connected
STM32F302xD(E)/303xD 0.078125 0.002 0.15885
STM32F303x4(6/8)/334xx/328xx 0.078125 0.002 0.15825
STM32F318xx 0.078125 0.002 0.15825
STM32F358xx 0.15625 0.001 0.3135
HSE connected
STM32F373xx 0.078125 0.002 0.15825
HSE not connected
STM32F378xx 0.15625 0.001 0.3135

AN2606 Rev 65 485/508

507
Bootloader timings AN2606

Table 211. USART bootloader minimum timings (ms) (continued)

One USART USART USART
Device
byte sending configuration connection

STM32F398xx 0.078125 0.002 0.15885

V3.x 0.009 0.16525
STM32F40xxx/41xxx 0.078125
V9.x 0.0035 0.15975
STM32F401xB(C) 0.078125 0.00326 0.15951
STM32F401xD(E) 0.078125 0.00326 0.15951
STM32F410xx 0.078125 0.002 0.158
STM32F411xx 0.078125 0.00326 0.15951
STM32F412xx 0.078125 0.002 0.158
STM32F413xx/423xx 0.078125 0.002 0.158
V7.x 0.007 0.16325
STM32F429xx/439xx 0.078125
V9.x 0.00326 0.15951
STM32F446xx 0.078125 0.004 0.16
STM32F469xx/479xx 0.078125 0.003 0.159
STM32F72xxx/73xxx 0.078125 0.070 0.22
STM32F74xxx/75xxx 0.078125 0.065 0.22
STM32G03xxx/04xxx 0.078125 0.01 0.11
STM32G07xxx/08xxx 0.078125 0.01 0.11
STM32G0Bxxx/Cxxx 0.078125 0.01 0.11
STM32G05xxx/061xx 0.078125 0.01 0.11
STM32G4xxxx 0.078125 0.003 0.159
STM32H503xx 0.048 0.05 0.101
STM32H562xx/63xx/73xx 0.047 0.06 0.100
STM32H72xxx/73xxx 0.078125 0.072 0.22825
STM32H74xxx/75xxx 0.078125 0.072 0.22825
STM32H7A3xx/7B3xx/7B0xx 0.078125 0.072 0.22825
STM32L01xxx/02xxx 0.078125 0.016 0.17
STM32L031xx/041xx 0.078125 0.018 0.174
STM32L05xxx/06xxx 0.078125 0.018 0.17425
V4.x 0.078125 0.017 0.173
STM32L07xxx/08xxx
V11.x 0.078125 0.017 0.158
STM32L1xxx6(8/B)A 0.078125 0.008 0.16425
STM32L1xxx6(8/B) 0.078125 0.008 0.16425
STM32L1xxxC 0.078125 0.008 0.16425
STM32L1xxxD 0.078125 0.008 0.16425

486/508 AN2606 Rev 65

AN2606 Bootloader timings

Table 211. USART bootloader minimum timings (ms) (continued)

One USART USART USART
Device
byte sending configuration connection

STM32L1xxxE 0.078125 0.008 0.16425

STM32L412xx/422xx 0.078125 0.005 0.2
STM32L43xxx/44xxx 0.078125 0.003 0.159
STM32L45xxx/46xxx 0.078125 0.07 0.22
V10.x 0.078125 0.003 0.159
STM32L47xxx/48xxx
V9.x 0.078125 0.003 0.159
STM32L496xx/4A6xx 0.078125 0.003 0.159
STM32L4Rxx/4Sxx 0.0062 0.0235 0.0307
STM32L4P5xx/4Q5xx 0.0062 0.0235 0.0307
STM32L552xx/562xx 0.078125 0.01 0.11
STM32U031xx 0.012 0.050 0.062
STM32U073xx/STM32U083xx 0.014 0.049 0.077
STM32U031xx 0.012 0.050 0.062
STM32U535xx/545xx 0.078125 0.001 NA
STM32U575xx/85xx 0.078125 0.001 NA
STM32U595xx/599xx/5A5xx/5A9xx 0.078125 0.001 NA
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.078125 0.001 NA
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.078125 0.003 0.159
STM32WBA52xx 0.078125 0.001 NA
STM32WBA62xx/63xx/64xx/65xx 0.102 0.004 0,106
STM32WLE5xx/WL55xx 0.078125 0.001 0.110

93.3 USB connection timing

This is the time that the host must wait for between plugging the USB cable and establishing
a correct connection with the device. It includes enumeration and DFU components
configuration. The USB connection depends upon the host.

AN2606 Rev 65 487/508

507
Bootloader timings AN2606

Figure 123. USB connection timing description

Device
reset

a
Bootloader
execution time

Bootloader
ready to start
detection phase

a Duration of Bootloader resources initialization

MSv35042V1

Note: For STM32F105xx/107xx devices, if the external HSE crystal frequency is different from
25 MHz (14.7456 or 8 MHz), the device performs several unsuccessful enumerations (with
connect/disconnect sequences) before establishing a correct connection with the host. This
is due to the HSE detection mechanism based on Start Of Frame (SOF) detection.

Table 212. USB bootloader minimum timings (ms)

Device USB connection

STM32C011xx NA
STM32C031xx NA
STM32C051xx NA
STM32C071xx 552
STM32C091xx/92xx NA
STM32F04xxx 350
STM32F070x6 TBD
STM32F070xB 320
HSE = 25 MHz 460
STM32F105xx/107xx HSE = 14.7465 MHz 4500
HSE = 8 MHz 13700
STM32F2xxxx 270
STM32F301xx/302x4(6/8) 300
STM32F302xB(C)/303xB(C) 300
STM32F302xD(E)/303xD 100
STM32F373xx 300
V3.x 270
STM32F40xxx/41xxx
V9.x 250

488/508 AN2606 Rev 65

AN2606 Bootloader timings

Table 212. USB bootloader minimum timings (ms) (continued)

Device USB connection

STM32F401xB(C) 250
STM32F401xD(E) 250
STM32F411xx 250
STM32F412xx 380
STM32F413xx/423xx 350
V7.x
STM32F429xx/439xx 250
V9.x
STM32F446xx 200
STM32F469xx/479xx 270
STM32F72xxx/73xxx 320
STM32F74xxx/75xxx 230
STM32G0B1xx/C1xx 300
STM32G4xxxx 300
STM32H503xx 251
STM32H562xx/63xx/73xx 245
STM32H72xxx/73xxx 53.9764
STM32H74xxx/75xxx 53.9764
STM327A3xx/7B3xx/7B0xx 53.9764
STM32L07xxx/08xxx 140
STM32L1xxxC 849
STM32L1xxxD 849
STM32L412xx/422xx 820
STM32L43xxx/44xxx 820
STM32L45xxx/46xxx 330
V10.x
STM32L47xxx/48xxx 300
V9.x
STM32L496xx/4A6xx 430
STM32L4P5xx/4Q5xx 322
STM32L4Rxx/4Sxx 322
STM32L552xx/L562xx 300
STM32U031xx NA
STM32U073xx/ STM32U083xx 241
STM32U375xx/385xx 210
STM32U535xx/545xx 300
STM32U575xx/85xx 300

AN2606 Rev 65 489/508

507
Bootloader timings AN2606

Table 212. USB bootloader minimum timings (ms) (continued)

Device USB connection

STM32U595xx/599xx/5A5xx/5A9xx 300
STM32U5F7xx/5F9xx/5G7xx/5G9xx 300
STM32WB30xx/35xx/50xx/55xx 300
STM32WBA62xx/63xx/64xx/65xx 69

93.4 I2C connection timing

I2C connection timing is the time that the host must wait for between sending I2C device
address and sending command code. This timing includes I2C line stretching duration.

Figure 124. I2C connection timing description

Host sends start Host receives

condition + acknowledge
device address

a b
Bootloader
execution time

Device Bootloader
acknowledges its ready to receive
address and and execute
stretch line commands

a
Duration of start + 1 byte sending through I2C (depends on communication speed)
b Duration of I2C line stretching
MS35043V1

Note: For I2C communication, a timeout mechanism is implemented and must be respected to
execute bootloader commands correctly. This timeout is implemented between two I2C
frames in the same command (example: for Write memory command, a timeout is inserted
between command sending frame and address memory sending frame). The same timeout
period is inserted between two successive data receptions or transmissions in the same I2C
frame. If the timeout period elapses, a system reset is generated to avoid bootloader crash.
In Erase memory and Read-out unprotect commands, consider the duration of the operation
when implementing the host side. After sending the code of pages to erase, the host must
wait until the bootloader device performs page erasing to complete the remaining steps of
erase command.

490/508 AN2606 Rev 65

AN2606 Bootloader timings

Table 213. I2C bootloader minimum timings (ms)

Start condition
I2C line
Device + one I2C byte I2C connection I2C timeout
stretching
sending

STM32C011xx 0.254 0.004 0.060 2000

STM32C031xx 0.028 0.003 0.031 2000
STM32C051xx 0.031 0.019 0.050 2200
STM32C071xx 0.028 0.017 0.046 2000
STM32C091xx/92xx 0.031 0.018 0.049 2000
STM32F030xC 0.0225 0.0025 0.0250 1000
STM32F04xxx 0.0225 0.0025 0.0250 1000
STM32F070x6 0.0225 0.0025 0.0245 1000
STM32F070xB 0.0225 0.0025 0.0245 1000
STM32F071xx/072xx 0.0225 0.0025 0.0250 1000
STM32F09xxx 0.0225 0.0025 0.0245 1000
STM32F303x4(6/8)/334xx/328xx 0.0225 0.0027 0.0252 1000
STM32F318xx 0.0225 0.0027 0.0252 1000
STM32F358xx 0.0225 0.0055 0.0280 10
STM32F378xx 0.0225 0.0055 0.0280 10
STM32F398xx 0.0225 0.0020 0.0245 1500
STM32F40xxx/41xxx 0.0225 0.0022 0.0247 1000
STM32F401xB(C) 0.0225 0.0022 0.0247 1000
STM32F401xD(E) 0.0225 0.0022 0.0247 1000
STM32F410xx 0.0225 0.0020 0.0245 1000
STM32F411xx 0.0225 0.0022 0.0247 1000
STM32F412xx 0.0225 0.0020 0.0245 1000
STM32F413xx/423xx 0.0225 0.0020 0.0245 1000
V7.x 0.0225 0.0033 0.0258 1000
STM32F42xxx/43xxx
V9.x 0.0225 0.0022 0.0247 1000
STM32F446xx 0.0225 0.0020 0.0245 1000
STM32F469xx/479xx 0.0225 0.0020 0.0245 1000
STM32F72xxx/73xxx 0.0225 0.0020 0.0245 1000
STM32F74xxx/75xxx 0.0225 0.0020 0.0245 500
STM32G03xxx/04xxx 0.0225 0.0020 0.0245 1000
STM32G07xxx/08xxx 0.0225 0.0020 0.0245 1000
STM32G0Bxx/Cxx 0.0225 0.0020 0.0245 1000
STM32G05xxx/061xx 0.0225 0.0020 0.0245 1000

AN2606 Rev 65 491/508

507
Bootloader timings AN2606

Table 213. I2C bootloader minimum timings (ms) (continued)

Start condition
I2C line
Device + one I2C byte I2C connection I2C timeout
stretching
sending

STM32G4xxxx 0.0225 0.0020 0.0245 1000

STM32H503xx 0.038 0.03 0.041 1000
STM32H562xx/63xx/73xx 0.039 0.02 0.041 1000
STM32H72xxx/73xxx 0.0225 0.05 0.0745 1000
STM32H74xxx/75xxx 0.0225 0.05 0.0725 1000
STM32H7A3xx/7B3xx/7B0xx 0.0225 0.05 0.0745 1000
STM32L07xxx/08xxx 0.0225 0.0020 0.0245 1000
STM32L412xx/422xx 0.0225 0.0020 0.o245 1000
STM32L43xxx/44xxx 0.0225 0.0020 0.0245 1000
STM32L45xxx/46xxx 0.0225 0.0020 0.0245 1000
V10.x 0.0225 0.0020 0.0245 1000
STM32L47xxx/48xxx
V9.x 0.0225 0.0020 0.0245 1000
STM32L496xx/4A6xx 0.0225 0.0020 0.0245 1000
STM32L4P5xx/4Q5xx 0.0109 0.0020 0.0642 1000
STM32L4Rxx/4Sxx 0.0109 0.0020 0.0642 1000
STM32L552xx/L562xx 0.0225 0.0020 0.0245 1000
STM32U031xx 0.035 0.019 0.106 1000
STM32U073xx/ STM32U083xx 0.016 0.019 0.024 1000
STM32U375xx/385xx 0.021 0.018 0.092 1000
STM32U535xx/545xx 0.0225 0.0020 0.0245 1000
STM32U575xx/85xx 0.0225 0.0020 0.0245 1000
STM32U595xx/599xx/5A5xx/5A9xx 0.0225 0.0020 0.0245 1000
STM32U5F7xx/5F9xx/5G7xx/5G9xx 0.0225 0.0020 0.0245 1000
STM32WB10xx/15xx/30xx/35xx/50xx/55xx 0.0225 0.0020 0.0245 1000
STM32WBA52xx 0.0225 0.0020 0.0245 1000
STM32WBA62xx/63xx/64xx/65xx 0.003 0.019 0.539 1000

492/508 AN2606 Rev 65

AN2606 Bootloader timings

93.5 SPI connection timing

SPI connection timing is the time that the host must wait for between sending the
synchronization data (0xA5) and receiving the first acknowledge response (0x79).

Figure 125. SPI connection timing description

Host Host receives

sends ACK byte
0x5A 0x79

a b a
Bootloader
execution time

Device Device Bootloader

receives sends ACK ready to receive
0x5A byte 0x79 and execute
commands

a Duration of 1 byte sending through SPI (depends on communication speed)

b Delay between two bytes MS35044V1

Table 214. SPI bootloader minimum timings (ms) for STM32 devices
Device One SPI byte sending Delay between two bytes SPI connection

All products 0.001 0.008 0.01

AN2606 Rev 65 493/508

507
Example of ExitSecureMemory v1.0 function AN2606

Appendix A Example of ExitSecureMemory v1.0 function

/**
**************************************************************************
****
* @file main.c
**************************************************************************
****
*/

/* Includes ---------------------------------------------------------------
---*/
#include "main.h"

/* Private function prototypes --------------------------------------------

---*/
static void ConfigClock(void);

void JUMP_WITHOUT_PARAM(uint32_t jump_address);

void JUMP_WITH_PARAM(uint32_t jump_address, uint32_t magic, uint32_t
applicationVectorAddress);

/* Private functions ------------------------------------------------------

---*/

/**
* @brief Main program
* @param None
* @retval None
*/
int main(void)
{
ConfigClock();

uint32_t application_address = 0x08000800;

uint32_t exit_secure_memory_address = 0x1FFF1E00;
uint32_t magic_number = 0x08192A3C;
uint32_t exit_with_magic_number = 0x0;

if (exit_with_magic_number)
{
JUMP_WITH_PARAM(exit_secure_memory_address, magic_number,
application_address);
}
else
{

494/508 AN2606 Rev 65

AN2606 Example of ExitSecureMemory v1.0 function

JUMP_WITHOUT_PARAM(exit_secure_memory_address);
}
}

/**
* @brief ConfigClock
* @param None
* @retval None
*/
static void ConfigClock(void)
{
/* Will be developped as per the template of the needed project */
}

/**
* @brief JUMP_WITHOUT_PARAM
* @param jump_address
* @retval None
*/
void JUMP_WITHOUT_PARAM(uint32_t jump_address)
{
asm ("LDR R1, [R0]"); // jump_address
asm ("LDR R2, [R0,#4]");
asm ("MOV SP, R1");
asm ("BX R2");
}

/**
* @brief JUMP_WITH_PARAM
* @param jump_address, magic, applicationVectorAddress
* @retval None
*/
void JUMP_WITH_PARAM(uint32_t jump_address, uint32_t magic, uint32_t
applicationVectorAddress))
{
asm ("MOV R3, R0"); // jump_address
asm ("LDR R0, [R3]");
asm ("MOV SP, R0");
asm ("LDR R0, [R3,#4]");
asm ("BX R0");
}

/************************ (C) COPYRIGHT STMicroelectronics *****END OF

FILE****/

AN2606 Rev 65 495/508

507
Example of ExitSecureMemory v1.1 function AN2606

Appendix B Example of ExitSecureMemory v1.1 function

/**

**************************************************************************
****
* @file main.c

**************************************************************************
****
*/

/* Includes ---------------------------------------------------------------
---*/
#include "main.h"

/* Private function prototypes --------------------------------------------

---*/
static void ConfigClock(void);
static void Jump_Without_Param(uint32_t exit_secure_address, uint32_t
dummy1, uint32_t dummy2, uint8_t mpu_region_number);
static void Jump_With_Param(uint32_t exit_secure_address, uint32_t magic,
uint32_t application_address, uint8_t mpu_region_number);

/* Private functions ------------------------------------------------------

---*/

/**
* @brief Main program.
* @retval None.
*/
int main(void)
{
ConfigClock();

uint32_t application_address = 0x08008000;

uint32_t exit_secure_address = 0x1FFF6000;
uint8_t mpu_region_number = 0x04;
uint32_t magic_number = 0x08192A3C;
uint32_t with_magic_number = 0x0;

if (with_magic_number)
{
Jump_With_Param(exit_sticky_address, magic_number, application_address,
mpu_region_number);
}

496/508 AN2606 Rev 65

AN2606 Example of ExitSecureMemory v1.1 function

else
{
Jump_Without_Param(exit_sticky_address, 0x0, 0x0, mpu_region_number);
}
}

/**
* @brief Configure system clocks.
* @retval None.
*/
static void ConfigClock(void)
{
/* Will be developped as per the template of the needed project */
}

/**
* @brief Jump to secure exit memory without magic number and user
address.
* @param exit_secure_address Address of exit secure memory.
* @param dummy1 Not used.
* @param dummy2 Not used.
* @param mpu_region_number MPU region to enable.
* @retval None.
*/
static void Jump_Without_Param(uint32_t exit_secure_address, uint32_t
dummy1, uint32_t dummy2, uint8_t mpu_region_number)
{
/**
* R0 = exit_secure_address --> Exit secure memory stack pointer
* R1 = dummy1 --> Dummy data
* R2 = dummy2 --> Dummy data
* R3 = mpu_region_number --> MPU region number
*
* NOTE: Assume R1 and R2 registers are useless so can be moified, but R3
is used for MPU region number and must not be changed
*/
asm ("LDR R1, [R0]"); // Load stack pointer (content of address
pointed by R0) in R1
asm ("LDR R2, [R0,#4]"); // Load jump address (content of address pointed
by R4 + 4) in R2
asm ("MOV SP, R1"); // Change stack pointer register with value from
R1
asm ("BX R2"); // Jump to address pointed by R2
}

/**

AN2606 Rev 65 497/508

507
Example of ExitSecureMemory v1.1 function AN2606

* @brief Jump to secure exit memory with parameters.

* @param exit_secure_address Address of exit secure memory.
* @param magic Magic number value.
* @param application_address Application address.
* @param mpu_region_number MPU region to enable.
* @retval None
*/
static void Jump_With_Param(uint32_t exit_secure_address, uint32_t magic,
uint32_t application_address, uint8_t mpu_region_number)
{
/**
* R0 = exit_secure_address --> Exit secure memory stack pointer
* R1 = magic --> Magic number
* R2 = application_address --> User application start address
* R3 = mpu_region_number --> MPU region number
*
* NOTE: R1, R2 and R3 registers must not be changed in below code
*/
asm ("MOV R4, R0"); // Backup R0 in R4
asm ("LDR R0, [R4]"); // Load stack pointer (content of address
pointed by R4) in R0
asm ("MOV SP, R0"); // Change stack pointer register with value from
R0
asm ("LDR R0, [R4,#4]"); // Load jump address (content of address pointed
by R4 + 4) in R0
asm ("BX R0"); // Jump to address pointed by R0

498/508 AN2606 Rev 65

AN2606 Revision history

94 Revision history

Table 215. Document revision history

Date Revision Changes

Updated Table 1: Applicable products, Section 3: Glossary, Table 3: Embedded

bootloaders, Table 209: Bootloader device-dependent parameters, Table 210:
Bootloader startup timings (ms), Table 211: USART bootloader minimum timings (ms),
21-Feb-2019 36 Table 212: USB bootloader minimum timings (ms), Table 213: I2C bootloader minimum
timings (ms).
Added Section 77: STM32WB30xx/35xx/50xx/55xx devices
Updated Table 1: Applicable products, Section 3: Glossary, Table 209: Bootloader
device-dependent parameters, Table 210: Bootloader startup timings (ms), Table 211:
USART bootloader minimum timings (ms), Table 212: USB bootloader minimum
06-May-2019 37 timings (ms), Table 213: I2C bootloader minimum timings (ms).
Added Section 49: STM32G431xx/441xx devices, Section 50: STM32G47xxx/48xxx
devices.
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 78: STM32F413xx/423xx configuration in system
memory boot mode, Table 123: STM32H74xxx/75xxx configuration in system
memory boot mode, Table 124: STM32H74xxx/75xxx bootloader version, Table 132:
STM32L031xx/041xx configuration in system memory boot mode, Table 153:
STM32L43xxx/44xxx bootloader versions, Table 154: STM32L45xxx/46xxx
configuration in system memory boot mode, Table 161: STM32L496xx/4A6xx
bootloader version, Table 172: STM32WB30xx/35xx/50xx/55xx bootloader versions,
08-Jul-2019 38 Table 209: Bootloader device-dependent parameters, Table 210: Bootloader startup
timings (ms), Table 211: USART bootloader minimum timings (ms), Table 212: USB
bootloader minimum timings (ms), Table 213: I2C bootloader minimum timings (ms)
– Section 3: Glossary, Section 4.1: Bootloader activation, Section 44.1: Bootloader
configuration, Section 49.1: Bootloader configuration
– Figure 73: Bootloader V9.x selection for STM32H74xxx/75xxx, Figure 102: Dual
bank boot implementation for STM32L4Rxxx/STM32L4Sxxx bootloader V9.x
Added Note: in Section 4.2, Note: in Section 18.3, Note: in Section 56.1, Note: in
Section 59.1, Section 44: STM32G03xxx/STM32G04xxx devices
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 97: STM32G03xxx/04xxx bootloader versions,
Table 151: STM32L412xx/422xx bootloader versions, Table 153:
STM32L43xxx/44xxx bootloader versions, Table 155: STM32L45xxx/46xxx
bootloader versions, Table 157: STM32L47xxx/48xxx bootloader V10.x versions,
Table 159: STM32L47xxx/48xxx bootloader V9.x versions, Table 161:
STM32L496xx/4A6xx bootloader version, Table 163: STM32L4P5xx/4Q5xx
16-Sep-2019 39
bootloader versions, Table 209: Bootloader device-dependent parameters,
Table 210: Bootloader startup timings (ms), Table 211: USART bootloader minimum
timings (ms), Table 212: USB bootloader minimum timings (ms), Table 213: I2C
bootloader minimum timings (ms)
– Section 3: Glossary, Section 4.2: Bootloader identification
Added Figure 67: Dual bank boot implementation for STM32G47xxx/48xxx bootloader
V13.x, Section 75: STM32L552xx/62xx devices, note in Section 77.3: Bootloader
version

AN2606 Rev 65 499/508

507
Revision history AN2606

Table 215. Document revision history (continued)

Date Revision Changes

Updated Table 3: Embedded bootloaders, Table 168: STM32L552xx/62xx bootloader

03-Oct-2019 40
versions, Table 172: STM32WB30xx/35xx/50xx/55xx bootloader versions
Updated:
– Table 89: STM32F72xxx/73xxx bootloader V9.x versions, Table 91:
STM32F74xxx/75xxx bootloader V7.x versions, Table 93: STM32F74xxx/75xxx
bootloader V9.x versions, Table 95: STM32F76xxx/77xxx bootloader V9.x versions,
Table 96: STM32G03xxx/G04xxx configuration in system memory boot mode,
25-Oct-2019 41 Table 124: STM32H74xxx/75xxx bootloader version, Table 163:
STM32L4P5xx/4Q5xx bootloader versions, Table 166: STM32L552xx/62xx
configuration in system memory boot mode, Table 210: Bootloader startup timings
(ms), Table 211: USART bootloader minimum timings (ms), Table 213: I2C
bootloader minimum timings (ms)
– Section 21: STM32F2xxxx devices
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 209: Bootloader device-dependent parameters,
Table 210: Bootloader startup timings (ms), Table 211: USART bootloader minimum
05-Dec-2019 42 timings (ms), Table 212: USB bootloader minimum timings (ms), Table 213: I2C
bootloader minimum timings (ms)
– Section 3: Glossary
Added: Section 57: STM32H7A3xx/7B3xx/7B0xx devices, Section 73:
STM32L4P5xx/4Q5xx devices, Section 84: STM32WLE5xx/55xx devices

500/508 AN2606 Rev 65

AN2606 Revision history

Table 215. Document revision history (continued)

Date Revision Changes

Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 106: STM32G431xx/441xx configuration in system
memory boot mode, Table 108: STM32G47xxx/48xxx configuration in system
memory boot mode, Table 109: STM32G47xxx/48xxx bootloader version, Table 124:
STM32H74xxx/75xxx bootloader version, Table 126: STM32H7A3xx/7B3xx/7B0xx
bootloader version, Table 163: STM32L4P5xx/4Q5xx bootloader versions, Table 166:
STM32L552xx/62xx configuration in system memory boot mode, Table 168:
STM32L552xx/62xx bootloader versions, Table 171: STM32WB30xx/35xx/50xx/55xx
configuration in system memory boot mode, Table 209: Bootloader device-dependent
parameters
– Section 3: Glossary, Section 42: STM32F74xxx/75xxx devices, Section 44.1:
Bootloader configuration, Section 45.1: Bootloader configuration, Section 49.1:
Bootloader configuration, Section 50.1: Bootloader configuration, Section 56.1:
Bootloader configuration
Added:
– Section 4.5: Bootloader UART baudrate detection, Section 4.6: Programming
04-Jun-2020 43
constraints, Section 4.7: ExitSecureMemory feature
– Note: in: Section 31.1.1: Bootloader configuration, Section 31.2.1: Bootloader
configuration, Section 32.1: Bootloader configuration, Section 33.1: Bootloader
configuration, Section 35.1: Bootloader configuration, Section 36.1: Bootloader
configuration, Section 37.1: Bootloader configuration, Section 38.1.1: Bootloader
configuration, Section 38.2.1: Bootloader configurationSection 39.1: Bootloader
configuration, Section 40.1: Bootloader configuration, Section 41.1: Bootloader
configuration, Section 42.1.1: Bootloader configuration, Section 42.2.1: Bootloader
configuration, Section 43.1: Bootloader configuration
– Figure 90: Dual bank boot Implementation for STM32L3x2xx/44xxx bootloader V9.x,
Figure 92: Dual bank boot implementation for STM32L45xxx/46xxx bootloader V9.x,
Figure 98: Dual bank boot Implementation for STM32L496xx/4A6xx bootloader V9.x
– Appendix A: Example of ExitSecureMemory v1.0 function
Deleted Figure 48. Access to securable memory area from the bootloader for
STM32G03xxx/G04xxx, Figure 50. Access to securable memory area from the
bootloader for STM32G07xxx/G08xxx, Figure 52. Access to securable memory area,
Figure 54. Access to securable memory area
Introduced STM32H72xxx/73xxx devices, hence added Section 55:
STM32H72xxx/73xxx devices and its subsections.
Updated Section 3: Glossary, note in Section 44.1: Bootloader configuration and
Section 77.1: Bootloader configuration.
Updated Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 8: ExitSecureMemory entry address, Table 108:
STM32G47xxx/48xxx configuration in system memory boot mode, Table 126:
STM32H7A3xx/7B3xx/7B0xx bootloader version, Table 144: STM32L1xxxC
29-Jul-2020 44 configuration in system memory boot mode, Table 146: STM32L1xxxD configuration in
system memory boot mode, Table 148: STM32L1xxxE configuration in system memory
boot mode, Table 166: STM32L552xx/62xx configuration in system memory boot
mode, Table 209: Bootloader device-dependent parameters, Table 210: Bootloader
startup timings (ms), Table 211: USART bootloader minimum timings (ms), Table 212:
USB bootloader minimum timings (ms) and Table 213: I2C bootloader minimum timings
(ms).
Updated Figure 73: Bootloader V9.x selection for STM32H74xxx/75xxx.
Minor text edits across the whole document.

AN2606 Rev 65 501/508

507
Revision history AN2606

Table 215. Document revision history (continued)

Date Revision Changes

Introduced STM32WB30xx, STM32WB35xx, STM32Wl55xx in Table 1: Applicable

products, Table 3: Embedded bootloaders and in Section 3: Glossary
Updated:
– Table 72: STM32F410xx configuration in system memory boot mode, Table 78:
STM32F413xx/423xx configuration in system memory boot mode, Table 84:
STM32F446xx configuration in system memory boot mode, Table 86:
STM32F469xx/479xx configuration in system memory boot mode, Table 88:
STM32F72xxx/73xxx configuration in system memory boot mode, Table 92:
STM32F74xxx/75xxx configuration in system memory boot mode, Table 94:
STM32F76xxx/77xxx configuration in system memory boot mode, Table 98:
STM32G07xxx/8xxx configuration in system memory boot mode, Table 106:
STM32G431xx/441xx configuration in system memory boot mode, Table 107:
STM32G431xx/441xx bootloader version, Table 108: STM32G47xxx/48xxx
configuration in system memory boot mode, Table 123: STM32H74xxx/75xxx
configuration in system memory boot mode, Table 124: STM32H74xxx/75xxx
bootloader version, Table 125: STM32H7A3xx/7B3xx/7B0xx configuration in system
memory boot mode, Table 126: STM32H7A3xx/7B3xx/7B0xx bootloader version,
06-Nov-2020 45 Table 130: STM32L01xxx/02xxx configuration in system memory boot mode,
Table 132: STM32L031xx/041xx configuration in system memory boot mode,
Table 137: STM32L07xxx/08xxx bootloader versions, Table 138:
STM32L07xxx/08xxx configuration in system memory boot mode, Table 150:
STM32L412xx/422xx configuration in system memory boot mode, Table 162:
STM32L4P5xx/4Q5xx configuration in system memory boot mode, Table 164:
STM32L4Rxxx/4Sxxx configuration in system memory boot mode, Table 166:
STM32L552xx/62xx configuration in system memory boot mode, Table 171:
STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode,
Table 188: STM32WLE5xx/55xx configuration in system memory boot mode,
Table 189: STM32WLE5xx/55xx bootloader versions, Table 209: Bootloader device-
dependent parameters, Table 210: Bootloader startup timings (ms), Table 211:
USART bootloader minimum timings (ms)
– title of Table 77: STM32WB30xx/35xx/50xx/55xx devices, Table 171:
STM32WB30xx/35xx/50xx/55xx configuration in system memory boot mode,
Table 84: STM32WLE5xx/55xx devices, Table 188: STM32WLE5xx/55xx
configuration in system memory boot mode, Table 113: Bootloader V12.x selection
for STM32WLE5xx/55xx, Table 189: STM32WLE5xx/55xx bootloader versions
Upadated:
– Table 3: Embedded bootloaders, Table 96: STM32G03xxx/G04xxx configuration in
system memory boot mode, Table 108: STM32G47xxx/48xxx configuration in system
memory boot mode, Table 153: STM32L43xxx/44xxx bootloader versions, Table 155:
02-Dec-2020 46
STM32L45xxx/46xxx bootloader versions
Added following notes:
– Note: on page 349, Note: on page 356, Note: on page 364, Note: on page 377, Note:
on page 383

502/508 AN2606 Rev 65

AN2606 Revision history

Table 215. Document revision history (continued)

Date Revision Changes

Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 8:
ExitSecureMemory entry address, Table 95: STM32F76xxx/77xxx bootloader V9.x
versions, Table 108: STM32G47xxx/48xxx configuration in system memory boot
mode, Table 150: STM32L412xx/422xx configuration in system memory boot mode,
Table 152: STM32L43xxx/44xxx configuration in system memory boot mode,
Table 154: STM32L45xxx/46xxx configuration in system memory boot mode,
Table 158: STM32L47xxx/48xxx configuration in system memory boot mode,
Table 160: STM32L496xx/4A6xx configuration in system memory boot mode,
Table 162: STM32L4P5xx/4Q5xx configuration in system memory boot mode,
16-Feb-2021 47
Table 164: STM32L4Rxxx/4Sxxx configuration in system memory boot mode,
Table 166: STM32L552xx/62xx configuration in system memory boot mode,
Table 171: STM32WB30xx/35xx/50xx/55xx configuration in system memory boot
mode, Table 209: Bootloader device-dependent parameters, Table 210: Bootloader
startup timings (ms), Table 211: USART bootloader minimum timings (ms),
Table 212: USB bootloader minimum timings (ms), Table 213: I2C bootloader
minimum timings (ms)
– Section 3: Glossary
Added Section 46: STM32G0B0xx device bootloader and Section 47:
STM32G0B1xx/0C1xx device bootloader
Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 8:
ExitSecureMemory entry address, Table 209: Bootloader device-dependent
01-Apr-2021 48 parameters, Table 210: Bootloader startup timings (ms), Table 211: USART
bootloader minimum timings (ms), Table 213: I2C bootloader minimum timings (ms)
Added Section 48: STM32G05xxx/061xx devices and Section 51:
STM32G491xx/4A1xx devices
Updated:
– Section 3: Glossary, Section 31.2.1: Bootloader configuration
– Table 3, Table 20,from Table 22 to Table 27, from Table 30 to Table 35, Table 36,
Table 38, Table 40, Table 44, Table 46, Table 48, Table 50, Table 52, Table 54,
Table 56, Table 58, Table 60, Table 62, Table 64, Table 66, Table 67, Table 68,
Table 70, Table 72, Table 74, Table 76, Table 78, Table 80, Table 82, Table 84,
Table 86, Table 88, Table 90, Table 92, Table 94, Table 96, Table 98, Table 100,
06-Jul-2021 49 Table 102, Table 104, Table 106, Table 108, Table 109, Table 110, Table 121,
Table 123, Table 125, Table 125, Table 130, Table 132, Table 134, Table 135,
Table 136, Table 138, Table 140, Table 142, Table 143, Table 144, Table 145,
Table 146, Table 148, Table 149, Table 150, Table 152, Table 154, Table 156,
Table 158, Table 160, Table 162, Table 164, Table 166, Table 171, Table 188,
Table 209
Added Table 167: STM32L552xx/62xx special commands and Section 76:
STM32WB10xx/15xx devices
Updated:
– Section 3: Glossary, Section 46.1: Bootloader configuration, Section 47.1:
Bootloader configuration,
23-Sep-2021 50
– Table 1, Table 2, Table 3, Table 99, Table 122, Table 124, Table 126, Table 153,
Table 170, Table 172, Table 209, Table 210, Table 211, Table 212, Table 213
Added Section 89: STM32U575xx/85xx devices

AN2606 Rev 65 503/508

507
Revision history AN2606

Table 215. Document revision history (continued)

Date Revision Changes

Updated:
20-Oct-2021 51 – Table 3, Table 67,Table 99, Table 122,Table 209
– Section 31.2.1: Bootloader configuration
Updated:
– Section 3: Glossary, Section 4.1: Bootloader activation,
04-Feb-2022 52 – Table 1, Table 2, Table 3, Table 7, Table 99, Table 124, Table 209
– Figure 62
Added Section 5: STM32C011xx devices and Section 6: STM32C031xx devices
Updated:
– Table 3, Table 121, Table 122, Table 209.
01-Mar-2022 53 – Section 4.1: Bootloader activation, , Section 44.1: Bootloader configuration,
Section 45.1: Bootloader configuration, Section 46.1: Bootloader configuration,
Section 48.1: Bootloader configuration
Updated:
20-Apr-2022 54
– Table 3, Table 121, Table 125, Table 126, Table 209
Updated:
22-Jun-2022 55
– Table 3, Table 123, Table 122, Table 209
Added Section 4.8: IWDG usage, Section 78: STM32WBA52xx devices
Updated:
– Table 1, Table 2, Table 3, Table 7, Table 124, Table 125, Table 189, Table 209,
14-Dec-2022 56 Table 210, Table 211, Table 213
– Section 3: Glossary, Section 4.1: Bootloader activation
– added note 1 in Table 98, Table 100, Table 102, Table 106, Table 108, Table 110,
Table 150
Updated:
– Table 1: Applicable products, Table 2: Bootloader activation patterns, Table 3:
Embedded bootloaders, Table 7: Flash memory alignment constraints, Table 209:
Bootloader device-dependent parameters, Table 210: Bootloader startup timings
21-Feb-2023 57 (ms), Table 211: USART bootloader minimum timings (ms), Table 212: USB
bootloader minimum timings (ms), Table 213: I2C bootloader minimum timings (ms)
– Section 3: Glossary, Section 4.2: Bootloader identification
Added Section 52: STM32H503xx devices, Section 54: STM32H562xx/563xx/573xx
devices, Section 90: STM32U595xx/99xx/A5xx/A9xx devices
Updated:
– Table 1: Applicable products, Table 3: Embedded bootloaders, Table 209: Bootloader
device-dependent parameters, Table 210: Bootloader startup timings (ms),
04-Apr-2023 58 Table 211: USART bootloader minimum timings (ms), Table 212: USB bootloader
minimum timings (ms), Table 213: I2C bootloader minimum timings (ms)
– Section 3: Glossary
Added Section 88: STM32U535xx/545xx devices
Updated Table 3: Embedded bootloaders, Table 99: STM32G07xxx/08xxx bootloader
21-Jun-2023 59 versions, and Table 209: Bootloader device-dependent parameters.
Minor text edits across the whole document.

504/508 AN2606 Rev 65

AN2606 Revision history

Table 215. Document revision history (continued)

Date Revision Changes

Updated Section 2: Related documents, note in Section 4.1: Bootloader activation,

Section 54.3: Bootloader version, and Section 68.1: Bootloader configuration.
Updated Table 2: Bootloader activation patterns, Table 3: Embedded bootloaders,
Table 69: STM32F401xB(C) bootloader versions, Table 102: STM32G0B1xx/0C1xx
configuration in system memory boot mode, Table 112: STM32H503xx configuration in
system memory boot mode, Table 118: STM32H562xx/563xx/573xx configuration in
system memory boot mode, Table 120: STM32H562xx/563xx/573xx bootloader
version, Table 121: STM32H72xxx/73xxx configuration in system memory boot mode,
Table 123: STM32H74xxx/75xxx configuration in system memory boot mode,
Table 125: STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode,
Table 166: STM32L552xx/62xx configuration in system memory boot mode, Table 168:
STM32L552xx/62xx bootloader versions, Table 197: STM32U535xx/545xx
25-Oct-2023 60
configuration in system memory boot mode, Table 197: STM32U535xx/545xx
configuration in system memory boot mode, Table 199: STM32U535xx/545xx
bootloader versions, Table 202: STM32U575xx/85xx bootloader versions, Table 203:
STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode, Table 205:
STM32U595xx/99xx/A5xx/A9xx bootloader versions, and Table 210: Bootloader
startup timings (ms).
Updated Figure 69: Bootloader V14 selection for STM32H503xx, Figure 71: Bootloader
V14 selection for STM32H562xx/563xx/573xx, Figure 117: Bootloader V9.x selection
for STM32U535xx/545xx, Figure 118: Bootloader V9.x selection for
STM32U575xx/85xx, and Figure 119: Bootloader V9.x selection for
STM32U595xx/99xx/A5xx/A9xx.
Minor text edits across the whole document.
Added STM32U5F7xx, STM32U5F9xx, STM32U5G7xx, and STM32U5G9xx devices.
Updated Table 1: Applicable products, Table 3: Embedded bootloaders, and tables 209
to 213.
11-Jan-2024 61 Updated Section 3: Glossary.
Added Section 91: STM32U5F7xx/F9xx/G7xx/G9xx devices and its subsections.
Minor text edits across the whole document.

AN2606 Rev 65 505/508

507
Revision history AN2606

Table 215. Document revision history (continued)

Date Revision Changes

Updated Table 1: Applicable products, Table 3: Embedded bootloaders, Table 7: Flash

memory alignment constraints, Table 8: ExitSecureMemory entry address, Table 36:
STM32F10xxx configuration in system memory boot mode, Table 102:
STM32G0B1xx/0C1xx configuration in system memory boot mode, Table 112:
STM32H503xx configuration in system memory boot mode, Table 114: STM32H503xx
bootloader version, Table 118: STM32H562xx/563xx/573xx configuration in system
memory boot mode, Table 121: STM32H72xxx/73xxx configuration in system memory
boot mode, Table 123: STM32H74xxx/75xxx configuration in system memory boot
mode, Table 124: STM32H74xxx/75xxx bootloader version, Table 125:
STM32H7A3xx/7B3xx/7B0xx configuration in system memory boot mode, Table 158:
STM32L47xxx/48xxx configuration in system memory boot mode, and Table 209:
Bootloader device-dependent parameters.
06-Mar-2024 62 Updated Section 3: Glossary, Section 4.1: Bootloader activation, Section 69.1:
Bootloader configuration, and Section 70.1: Bootloader configuration.
Added Section 4.7.1: ExitSecureMemory v1.0, Section 4.7.2: ExitSecureMemory v1.1,
Section 53: STM32H523xx/533xx devices, Section 58: STM32H7Rxxx/7Sxxx devices,
Section 79: STM32WBA54xx/55xx devices, Section 85: STM32U031xx devices,
Section 86: STM32U073xx/83xx devices, and their subsections.
Added Appendix B: Example of ExitSecureMemory v1.1 function.
Updated Figure 6: ExitSecureMemory function usage, Figure 7: Access to securable
memory area from the bootloader, Figure 69: Bootloader V14 selection for
STM32H503xx, and Figure 71: Bootloader V14 selection for
STM32H562xx/563xx/573xx.
Minor text edits across the whole document.
Added STM32H562xx devices and STM32WB0 series, hence updated Table 1:
Applicable products, Table 3: Embedded bootloaders, Table 7: Flash memory
alignment constraints, and tables 210 to 214.
Updated Section 3: Glossary and note in Section 69.1: Bootloader configuration.
Added Section 81: STM32WB05xx devices, Section 82: STM32WB06xx/07xx devices,
Section 83: STM32WB09xx devices, and their subsections.
Updated Figure 52: Bootloader V9.x selection for STM32F446xx and Figure 108:
13-May-2024 63
Bootloader V11.x selection for STM32WBA54xx/55xx.
Updated Table 2: Bootloader activation patterns, Table 103: STM32G0B1xx/0C1xx
bootloader versions, Table 121: STM32H72xxx/73xxx configuration in system memory
boot mode, Table 123: STM32H74xxx/75xxx configuration in system memory boot
mode, Table 197: STM32U535xx/545xx configuration in system memory boot mode,
and Table 200: STM32U575xx/85xx configuration in system memory boot mode.
Minor text edits across the whole document.

506/508 AN2606 Rev 65

AN2606 Revision history

Table 215. Document revision history (continued)

Date Revision Changes

Added STM32C071xx and STM32H7B0xx devices, hence updated Table 1: Applicable

products, Table 3: Embedded bootloaders, and tables 209 to 214.
Updated Section 3: Glossary, Section 4.2: Bootloader identification, Section 52.1:
Bootloader configuration, Section 53.1: Bootloader configuration, Section 54.1:
Bootloader configuration, Section 57: STM32H7A3xx/7B3xx/7B0xx devices,
Section 75.1: Bootloader configuration, Section 78.1: Bootloader configuration,
Section 79.1: Bootloader configuration, Section 88.1: Bootloader configuration,
18-Sep-2024 64
Section 89.1: Bootloader configuration, and Section 90.1: Bootloader configuration.
Added Section 4.9: Bootloader models, Section 4.10: Boot constraints on BL,
Section 7: STM32C051xx devices, and Section 45.3.1: Compatibility break on boot
sequence.
Updated Table 8: ExitSecureMemory entry address, Table 99: STM32G07xxx/08xxx
bootloader versions, Table 157: STM32L47xxx/48xxx bootloader V10.x versions, and
Table 158: STM32L47xxx/48xxx configuration in system memory boot mode.
Added STM32C051/91/92xx, STM32U375/385xx, and STM32WBA62/63/64/65xx
devices.
Updated Table 1: Applicable products, Table 3: Embedded bootloaders, tables 6 to 10,
Table 14: STM32C051xx configuration in system memory boot mode, Table 101:
STM32G0B0xx bootloader versions, Table 103: STM32G0B1xx/0C1xx bootloader
versions, Table 105: STM32G05xxx/061xx bootloader versions, Table 107:
STM32G431xx/441xx bootloader version, Table 115: STM32H523xx/533xx
configuration in system memory boot mode, Table 118: STM32H562xx/563xx/573xx
configuration in system memory boot mode, Table 124: STM32H74xxx/75xxx
bootloader version, Table 127: STM32H7Rxxx/7Sxxx configuration in system memory
boot mode, Table 159: STM32L47xxx/48xxx bootloader V9.x versions, Table 176:
STM32WBA54xx/55xx configuration in system memory boot mode, tables 190 to 194,
Table 203: STM32U595xx/99xx/A5xx/A9xx configuration in system memory boot mode,
and tables 209 to 214.
14-Feb-2025 65
Added footnote to Table 100: STM32G0B0xx configuration in system memory boot
mode.
Updated Section 3: Glossary, Section 4.2: Bootloader identification, Section 4.3:
Hardware connection requirements, Section 85.1: Bootloader configuration, and
Section 86.1: Bootloader configuration.
Replaced master/slave with controller target when referring to I2C.
Added Section 7: STM32C051xx devices, Section 9: STM32C091xx/92xx devices,
Section 58.4: Jump to bootloader, Section 80: STM32WBA62xx/63xx/64xx/65xx
devices, Section 87: STM32U375xx/85xx devices, and their subsections.
Updated Figure 4: SPI connection, figures 13 to 15, 60 to 66, 68 to 71, 74 and 75,
Figure 108: Bootloader V11.x selection for STM32WBA54xx/55xx,and figures 113 to
115.
Minor text edits across the whole document.

AN2606 Rev 65 507/508

507
 AN2606

IMPORTANT NOTICE – READ CAREFULLY

STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order
acknowledgment.

Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or
the design of purchasers’ products.

No license, express or implied, to any intellectual property right is granted by ST herein.

Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product.

ST and the ST logo are trademarks of ST. For additional information about ST trademarks, refer to www.st.com/trademarks. All other
product or service names are the property of their respective owners.

Information in this document supersedes and replaces information previously supplied in any prior versions of this document.

© 2025 STMicroelectronics – All rights reserved

508/508 AN2606 Rev 65