2. Memory and bus architecture

2.1 System architecture

An AXI bus matrix, two AHB bus matrices and bus bridges allow interconnecting bus masters with bus slaves, as illustrated in Table 2 and Figure 1 .

Table 2. Bus-master-to-bus-slave interconnect

1. Bold font type denotes 64-bit bus, plain type denotes 32-bit bus.

2. “X” = access possible, “-” = access not possible, shading = access useful/usable.

Figure 1. System architecture

MSV46613V3

2.1.1 Bus matrices

AXI bus matrix in D1 domain

The D1 domain multi AXI bus matrix ensures and arbitrates concurrent accesses from multiple masters to multiple slaves. This allows efficient simultaneous operation of high-speed peripherals.

The arbitration uses a round-robin algorithm with QoS capability.

Refer to Section 2.2: AXI interconnect matrix (AXIM) for more information on AXI interconnect.

AHB bus matrices in D2 and D3 domains

The AHB bus matrices in D2 and D3 domains ensure and arbitrate concurrent accesses from multiple masters to multiple slaves. This allows efficient simultaneous operation of high-speed peripherals.

The arbitration uses a round-robin algorithm.

2.1.2 TCM buses

The DTCM and ITCM (data and instruction tightly coupled RAMs) are connected through dedicated TCM buses directly to the Cortex-M7 core. The MDMA controller can access the DTCM and ITCM through AHBS, a specific CPU slave AHB. The DTCM and ITCM are accessed by Cortex-M7 at CPU clock speed, with zero wait states.

2.1.3 Bus-to-bus bridges

To allow peripherals with different types of buses to communicate together, there is a number of bus-to-bus bridges in the system.

The AHB/APB bridges in D1 and D3 domains allow connecting peripherals on APB3 and APB4 to AHB3 and AHB4, respectively. The AHB/APB bridges in D2 domain allow peripherals on APB1 and APB2 to connect to AHB1. These AHB/APB bridges provide full synchronous interfacing, which allows the APB peripherals to operate with clocks independent of AHB that they connect to.

The AHB/APB bridges also allow APB1 and APB2 peripherals to connect to DMA1 and DMA2 peripheral buses, respectively, without transiting through AHB1.

The AHB/APB bridges convert 8-bit / 16-bit APB data to 32-bit AHB data, by replicating it to the three upper bytes / the upper half-word of the 32-bit word.

The AXI bus matrix incorporates AHB/AXI bus bridge functionality on its slave bus interfaces. The AXI/AHB bus bridges on its master interfaces marked as 32-bit in Figure 1 are outside the matrix.

The Cortex-M7 CPU provides AHB/TCM-bus (ITCM and DTCM buses) translation from its AHBS slave AHB, allowing the MDMA controller to access the ITCM and DTCM.

2.1.4 Inter-domain buses

D2-to-D1 AHB

This 32-bit bus connects the D2 domain to the AXI bus matrix in the D1 domain. It allows bus masters in the D2 domain to access resources (bus slaves) in the D1 domain.

D1-to-D2 AHB

This 32-bit bus connects the D1 domain to the D2 domain AHB bus matrix. It allows bus masters in the D1 domain to access resources (bus slaves) in the D2 domain.

D1-to-D3 AHB

This 32-bit bus connects the D1 domain to the D3 domain AHB bus matrix. It allows bus masters in the D1 domain to access resources (bus slaves) in the D3 domain.

D2-to-D3 AHB

This 32-bit bus connects the D2 domain to the D3 domain AHB bus matrix. It allows bus masters in the D2 domain to access resources (bus slaves) in the D3 domain.

2.1.5 CPU buses

Cortex ^® -M7 AXIM bus

The Cortex ^® -M7 CPU uses the 64-bit AXIM bus to access all memories (excluding ITCM, and DTCM) and AHB3, AHB4, APB3 and APB4 peripherals (excluding AHB1, APB1 and APB2 peripherals).

The AXIM bus connects the CPU to the AXI bus matrix in the D1 domain.

Cortex ^® -M7 ITCM bus

The Cortex ^® -M7 CPU uses the 64-bit ITCM bus for fetching instructions from and accessing data in the ITCM.

Cortex ^® -M7 DTCM bus

The Cortex ^® -M7 CPU uses the 2x32-bit DTCM bus for accessing data in the DTCM. The 2x32-bit DTCM bus allows load/load and load/store instruction pairs to be dual-issued on the DTCM memory. It can also fetch instructions.

Cortex ^® -M7 AHBS bus

The Cortex ^® -M7 CPU uses the 32-bit AHBS slave bus to allow the MDMA controller to access the ITCM and the DTCM.

Cortex ^® -M7 AHBP bus

The Cortex ^® -M7 CPU uses the 32-bit AHBP bus for accessing AHB1, AHB2, APB1 and APB2 peripherals via the AHB bus matrix in the D2 domain.

2.1.6 Bus master peripherals

SDMMC1

The SDMMC1 uses a 32-bit bus, connected to the AXI bus matrix, through which it can access internal AXI SRAM and Flash memories, and external memories through the Octo-SPI controller and the FMC.

SDMMC2

The SDMMC2 uses a 32-bit bus, connected to the AHB bus matrix in D2 domain. Through the system bus matrices, it can access the internal AXI SRAM, SRAM1, SRAM2, SRAM4, backup RAM, Flash memory, and external memories through the Octo-SPI controller and the FMC.

MDMA controller

The MDMA controller has two bus masters: an AXI 64-bit bus, connected to the AXI bus matrix and an AHB 32-bit bus connected to the Cortex-M7 AHBS slave bus.

The MDMA is optimized for DMA data transfers between memories since it supports linked list transfers that allow performing a chained list of transfers without the need for CPU intervention. Through the system bus matrices and the Cortex-M7 AHBS slave bus, the MDMA can access all internal and external memories through the Octo-SPI controller and the FMC.

DMA1 and DMA2 controllers

The DMA1 and DMA2 controllers have two 32-bit buses - memory bus and peripheral bus, connected to the AHB bus matrix in D2 domain.

The memory bus allows DMA data transfers between memories. Through the system bus matrices, the memory bus can access all internal memories except ITCM and DTCM, and external memories through the Octo-SPI controller and the FMC.

The peripheral bus allows DMA data transfers between two peripherals, between two memories or between a peripheral and a memory. Through the system bus matrices, the peripheral bus can access all internal memories except ITCM and DTCM, external memories through the Octo-SPI controller and the FMC, and all AHB and APB peripherals. A direct access to APB1 and APB2 is available, without passing through AHB1. Direct path to APB1 and APB2 bridges allows reducing the bandwidth usage on AHB1 bus by improving data treatment efficiency for APB and AHB peripherals.

BDMA controller

The BDMA controller uses a 32-bit bus, connected to the AHB bus matrix in D3 domain, for DMA data transfers between two peripherals, between two memories or between a peripheral and a memory. BDMA transfers are limited to the D3 domain resources. It can access the internal SRAM4, backup RAM, and AHB4 and APB4 peripherals through the AHB bus matrix in the D3 domain.

Chrom-Art Accelerator (DMA2D)

The DMA2D graphics accelerator uses a 64-bit bus, connected to the AXI bus matrix. Through the system bus matrices, internal AXI SRAM, SRAM1, SRAM2 and Flash memories, and external memories through the Octo-SPI controller and the FMC.

LCD-TFT controller (LTDC)

The LCD-TFT display controller, LTDC, uses a 64-bit bus, connected to the AXI bus matrix, through which it can access internal AXI SRAM and Flash memories, and external memories through the Octo-SPI controller and the FMC.

Ethernet MAC

The Ethernet MAC uses a 32-bit bus, connected to the AHB bus matrix in the D2 domain. Through the system bus matrices, it can access all internal memories except SRAM4, backup RAM, ITCM, DTCM and external memories, through the Octo-SPI controller and the FMC.

USBHS1 peripheral

The USBHS1 peripheral uses 32-bit buses, connected to the AHB bus matrix in the D2 domain. Through the system bus matrices, it can access all internal memories except SRAM4, backup RAM, ITCM, DTCM and external memories, through the Octo-SPI controller and the FMC.

2.1.7 Clocks to functional blocks

Upon reset, clocks to blocks such as peripherals and some memories are disabled (except for the SRAM, DTCM, ITCM and Flash memory). To operate a block with no clock upon reset, the software must first enable its clock through RCC_AHBxENR or RCC_APBxENR register, respectively.

2.2 AXI interconnect matrix (AXIM)

2.2.1 AXI introduction

The AXI (advanced extensible interface) interconnect is based on the Arm® CoreLink™ NIC-400 Network Interconnect. The interconnect has six initiator ports, or ASIBs (AMBA slave interface blocks), and eight target ports, or AMIBs (AMBA master interface blocks). The ASIBs are connected to the AMIBs via an AXI switch matrix.

Each ASIB is a slave on an AXI bus or AHB (advanced high-performance bus). Similarly, each AMIB is a master on an AXI or AHB bus. Where an ASIB or AMIB is connected to an AHB, it converts between the AHB and the AXI protocol.

The AXI interconnect includes a GPV (global programmer view) which contains registers for configuring certain parameters, such as the QoS (quality of service) level at each ASIB.

Any accesses to unallocated address space are handled by the default slave, which generates the return signals. This ensures that such transactions complete and do not block the issuing master and ASIB.

2.2.2 AXI interconnect main features

• • 64-bit AXI bus switch matrix with six ASIBs and eight AMIBs, in D1 domain
• • AHB/AXI bridge function built into the ASIBs
• • concurrent connectivity of multiple ASIBs to multiple AMIBs
• • programmable traffic priority management (QoS - quality of service)
• • software-configurable via GPV

2.2.3 AXI interconnect functional description

Block diagram

The AXI interconnect is shown in Figure 2 .

Figure 2. AXI interconnect

ASIB configuration

Table 3 summarizes the characteristics of the ASIBs.

Table 3. ASIB configuration

AMIB configuration

Table 4 summarizes the characteristics of the AMIBs.

1. 1. Conversion to AHB protocol is done via an AXI/AHB bridge sitting between AXI interconnect and the connected slave.

Quality of service (QoS)

The AXI switch matrix uses a priority-based arbitration when two ASIB simultaneously attempt to access the same AMIB. Each ASIB has programmable read channel and write channel priorities, known as QoS, from 0 to 15, such that the higher the value, the higher the priority. The read channel QoS value is programmed in the AXI interconnect - INI x read QoS register (AXI_INIx_READ_QOS) , and the write channel in the AXI interconnect - INI x write QoS register (AXI_INIx_WRITE_QOS) . The default QoS value for all channels is 0 (lowest priority).

If two coincident transactions arrive at the same AMIB, the higher priority transaction passes before the lower priority. If the two transactions have the same QoS value, then a least-recently-used (LRU) priority scheme is adopted.

The QoS values should be programmed according to the latency requirements for the application. Setting a higher priority for an ASIB ensures a lower latency for transactions initiated by the associated bus master. This can be useful for real-time-constrained tasks, such as graphics processing (LTDC, DMA2D). Assigning a high priority to masters that can make many and frequent accesses to the same slave (such as the Cortex-M7 CPU) can block access to that slave by other lower-priority masters.

Global programmer view (GPV)

The GPV contains configuration registers for the AXI interconnect (see Section 2.2.4 ). These registers are only accessible by the Cortex-M7 CPU.

2.2.4 AXI interconnect registers

AXI interconnect - peripheral ID4 register (AXI_PERIPH_ID_4)

Address offset: 0x1FD0

Reset value: 0x0000 0004

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 4KCOUNT[3:0] : Register file size
0x0: N/A

Bits 3:0 JEP106CON[3:0] : JEP106 continuation code
0x4: Arm ^®

AXI interconnect - peripheral ID0 register (AXI_PERIPH_ID_0)

Address offset: 0x1FE0

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PARTNUM[7:0] : Peripheral part number bits 0 to 7
0x00: Part number = 0x400

Address offset: 0x1FE4

Reset value: 0x0000 00B4

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:4 JEP106ID[3:0] : JEP106 identity bits 0 to 3
0xB: Arm® JEDEC code

Bits 3:0 PARTNUM[11:8] : Peripheral part number bits 8 to 11
0x4: Part number = 0x400

Address offset: 0x1FE8

Reset value: 0x0000 002B

Bits 7:4 REVISION[3:0] : Peripheral revision number
0x2: r0p2

Bit 3 JEDEC : JEP106 code flag
0x1: JEDEC allocated code

Bits 2:0 JEP106ID[6:4] : JEP106 Identity bits 4 to 6
0x3: Arm® JEDEC code

Address offset: 0x1FEC

Reset value: 0x0000 0000

Bits 31:8 Reserved, must be kept at reset value.

0: None

0: None

Address offset: 0x1FF0

Reset value: 0x0000 000D

Bits 31:8 Reserved, must be kept at reset value.

0xD: Common ID value

Address offset: 0x1FF4

Reset value: 0x0000 00F0

Bits 31:8 Reserved, must be kept at reset value.

0xF: Generic IP component class

0x0: Common ID value

Address offset: 0x1FF8

Reset value: 0x0000 0005

Bits 31:8 Reserved, must be kept at reset value.

0x05: Common ID value

AXI interconnect - component ID3 register (AXI_COMP_ID_3)

Address offset: 0x1FFC

Reset value: 0x0000 00B1

Bits 31:8 Reserved, must be kept at reset value.

Bits 7:0 PREAMBLE[27:20] : Preamble bits 20 to 27

0xB1: Common ID value

AXI interconnect - TARG x bus matrix issuing functionality register (AXI_TARGx_FN_MOD_ISS_BM)

Address offset: 0x1008 + 0x1000 * x, where x = 1 to 8

Reset value: 0x0000 0000

Bits 31:2 Reserved, must be kept at reset value.

Bit 1 WRITE_ISS_OVERRIDE : Switch matrix write issuing override for target

0: Normal issuing capability

1: Set switch matrix write issuing capability to 1

Bit 0 READ_ISS_OVERRIDE : Switch matrix read issuing override for target

0: Normal issuing capability

1: Set switch matrix read issuing capability to 1

AXI interconnect - TARG x bus matrix functionality 2 register
(AXI_TARGx_FN_MOD2)

Address offset: \( 0x1024 + 0x1000 * x \) , where \( x = 1, 2, 7 \) and \( 8 \)

Reset value: 0x0000 0000

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 BYPASS_MERGE : Disable packing of beats to match the output data width. Unaligned transactions are not realigned to the input data word boundary.

0: Normal operation

1: Disable packing

AXI interconnect - TARG x long burst functionality modification register
(AXI_TARGx_FN_MOD_LB)

Address offset: \( 0x102C + 0x1000 * x \) , where \( x = 1 \) and \( 2 \)

Reset value: 0x0000 0000

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 FN_MOD_LB : Controls burst breaking of long bursts

0: Long bursts can not be generated at the output of the ASIB

1: Long bursts can be generated at the output of the ASIB

AXI interconnect - TARG x issuing functionality modification register (AXI_TARGx_FN_MOD)

Address offset: 0x1108 + 0x1000 * x, where x = 1, 2, 7 and 8

Reset value: 0x0000 0000

Bits 31:2 Reserved, must be kept at reset value.

Bit 1 WRITE_ISS_OVERRIDE : Override AMIB write issuing capability

• 0: Normal issuing capability
• 1: Force issuing capability to 1

Bit 0 READ_ISS_OVERRIDE : Override AMIB read issuing capability

• 0: Normal issuing capability
• 1: Force issuing capability to 1

AXI interconnect - INI x functionality modification 2 register (AXI_INIx_FN_MOD2)

Address offset: 0x41024 + 0x1000 * x, where x = 1 and 3

Reset value: 0x0000 0000

Bits 31:1 Reserved, must be kept at reset value.

Bit 0 BYPASS_MERGE : Disables alteration of transactions by the up-sizer unless required by the protocol

• 0: Normal operation
• 1: Transactions pass through unaltered where allowed

AXI interconnect - INI x AHB functionality modification register
(AXI_INIx_FN_MOD_AHB)

Address offset: 0x41028 + 0x1000 * x, where x = 1 and 3

Reset value: 0x0000 0000

Bits 31:2 Reserved, must be kept at reset value.

Bit 1 WR_INC_OVERRIDE : Converts all AHB-Lite read transactions to a series of single beat AXI transactions.

0: Override disabled

1: Override enabled

Bit 0 RD_INC_OVERRIDE : Converts all AHB-Lite write transactions to a series of single beat AXI transactions, and each AHB-Lite write beat is acknowledged with the AXI buffered write response.

0: Override disabled

1: Override enabled

AXI interconnect - INI x read QoS register (AXI_INIx_READ_QOS)

Address offset: 0x41100 + 0x1000 * x, where x = 1 to 76

Reset value: 0x0000 0000

Bits 31:4 Reserved, must be kept at reset value.

Bits 3:0 AR_QOS[3:0] : Read channel QoS setting

0x0: Lowest priority

0xF: Highest priority

Address offset: 0x41104 + 0x1000 * x, where x = 1 to 76

Reset value: 0x0000 0000

Bits 31:4 Reserved, must be kept at reset value.

0x0: Lowest priority

0xF: Highest priority

Address offset: 0x41108 + 0x1000 * x, where x = 1 to 76

Reset value: 0x0000 0000

Bits 31:2 Reserved, must be kept at reset value.

0: Normal issuing capability

1: Force issuing capability to 1

0: Normal issuing capability

1: Force issuing capability to 1

2.2.5 AXI interconnect register map

Table 5. AXI interconnect register map and reset values

Table 5. AXI interconnect register map and reset values (continued)

Table 5. AXI interconnect register map and reset values (continued)

Table 5. AXI interconnect register map and reset values (continued)

Table 5. AXI interconnect register map and reset values (continued)

Table 5. AXI interconnect register map and reset values (continued)

Table 5. AXI interconnect register map and reset values (continued)

Refer to Section 2.3 on page 131 for the register boundary addresses.

2.3 Memory organization

2.3.1 Introduction

Program memory, data memory, registers and I/O ports are organized within the same linear 4-Gbyte address space.

The bytes are coded in memory in Little Endian format. The lowest numbered byte in a word is considered the word's least significant byte and the highest numbered byte the most significant.

The addressable memory space is divided into eight main blocks, of 512 Mbytes each.

2.3.2 Memory map and register boundary addresses

Table 6. Memory map and default device memory area attributes

Table 6. Memory map and default device memory area attributes (continued)

All the memory map areas that are not allocated to on-chip memories and peripherals are considered “Reserved”. For the detailed mapping of available memory and register areas, refer to the following table.

The following table gives the boundary addresses of the peripherals available in the devices.

Table 7. Register boundary addresses ⁽¹⁾

1. Accessing a reserved area results in a bus error. Accessing undefined memory space in a peripheral returns zeros.

2.4 Embedded SRAM

The STM32H72x and STM32H73x devices include:

• • 128 Kbytes of AXI-SRAM mapped onto the AXI bus on D1 domain
• • 64 Kbytes of instruction TCM RAM
• • 128 Kbytes of data TCM RAM
• • 192 Kbyte SRAM on D1 domain that can be shared between to Instruction TCM or AXI-SRAM with 64 Kbyte granularity (see Section : RAM shared between ITCM and AXI RAM )
• • 16 Kbyte SRAM1 mapped on D2 domain
• • 16 Kbyte SRAM2 mapped on D2 domain
• • 16 Kbyte SRAM4 mapped on D3 domain

The embedded system SRAM is divided into up to five blocks over the three power domains:

• • D1 domain, AXI SRAM:
  • – AXI SRAM is mapped at address 0x2400 0000 and accessible by all system masters except BDMA through D1 domain AXI bus matrix. AXI SRAM can be used for application data which are not allocated in DTCM RAM or reserved for graphic objects (such as frame buffers)
• • D2 domain, AHB SRAM:
  • – AHB SRAM1 is mapped at address 0x3000 0000 and accessible by all system masters except BDMA, SDMMC1 and LTDC, through D2 domain AHB matrix. AHB SRAM1 can be used as DMA buffers to store peripheral input/output data in D2 domain.
  • – AHB SRAM2 is mapped at address 0x3000 4000 and accessible by all system masters except BDMA, SDMMC1 and LTDC, through D2 domain AHB matrix.

AHB SRAM2 can be used as DMA buffers to store peripheral input/output data in D2 domain.

• • D3 domain, AHB SRAM:
  • – AHB SRAM4 is mapped at address 0x3800 0000 and accessible by most of system masters through D3 domain AHB matrix. AHB SRAM4 can be used as BDMA buffers to store peripheral input/output data in D3 domain. It can also be used to retain some application code/data when D1 and D2 domain enter DStandby mode.

The system AHB SRAM can be accessed as bytes, half-words (16-bit units) or words (32-bit units), while the system AXI SRAM can be accessed as bytes, half-words, words or double-words (64-bit units). These memories can be addressed at maximum system clock frequency without wait state.

The AHB masters can read/write-access an SRAM section concurrently with the Ethernet MAC or the USB OTG HS peripheral accessing another SRAM section. For example, the Ethernet MAC accesses the SRAM2 while the CPU accesses the SRAM1, concurrently.

The TCM SRAMs are dedicated to the Cortex ^® -M7:

• • DTCM-RAM on TCM interface is mapped at the address 0x2000 0000 and accessible by Cortex ^® -M7, and by MDMA through AHBS slave bus of the Cortex ^® -M7 CPU. The DTCM-RAM can be used as read-write segment to host critical real-time data (such as stack and heap) for application running on Cortex ^® -M7 CPU.
• • ITCM-RAM on TCM interface mapped at the address 0x0000 0000 and accessible by Cortex ^® -M7 and by MDMA through AHBS slave bus of the Cortex ^® -M7 CPU. The ITCM-RAM can be used to host code for time-critical routines (such as interrupt handlers) that requires deterministic execution.

The backup RAM is mapped at the address 0x3880 0000 and is accessible by most of the system masters through D3 domain's AHB matrix. With a battery connected to the V _BAT pin, the backup SRAM can be used to retain data during low-power mode (Standby and V _BAT mode).

Error code correction (ECC)

SRAM data are protected by ECC:

• • 7 ECC bits are added per 32-bit word.
• • 8 ECC bits are added per 64-bit word for AXI-SRAM and ITCM-RAM.

The ECC mechanism is based on the SECDED algorithm. It supports single-error correction and double-error detection.

When a half word is written to an internal SRAM (except DTCM and ITCM) and a reset occurs, this half word is not really written to the SRAM after reset. This due to the ECC behavior.

To ensures the data are effectively written to DTCM and ITCM internal memories, read back the programmed data.

The ECC is always active except when the CPU frequency boost feature is used. In that case the ECC is no more active on TCM RAMs. The CPU frequency boost can be enabled through the CPUFREQ_BOOST option byte in FLASH_OPTSR2_PRG register.

Refer to Section 4: Embedded Flash memory (FLASH) for a description of the CPUFREQ_BOOST option byte and to Section 3: RAM ECC monitoring (RAMECC) for details on RAM ECC monitoring.

RAM shared between ITCM and AXI RAM

192 Kbyte of RAM can be used either as ITCM or as AXI SRAM. This feature can be configured through the TCM_AXI_SHARED[1:0] option byte in FLASH_OPTSR2_PRG register as described in Table 8 .

Table 8. ITCM/DTCM/AXI configuration

Refer to Section 4: Embedded Flash memory (FLASH) for a description of the TCM_AXI_SHARED option byte.

2.5 Flash memory overview

The Flash memory interface manages accesses to the Flash memory. It implements the erase and program Flash memory operations and the read and write protection mechanisms.

The Flash memory is organized as follows:

• • A main memory block divided into sectors.
• • An information block:
  • – System memory from which the device boots in System memory boot mode
  • – Option bytes to configure read and write protection, BOR level, watchdog software/hardware and reset when the device is in Standby or Stop mode.

Refer to Section 4: Embedded Flash memory (FLASH) for more details.

2.6 Boot configuration

In the STM32H72x and STM32H73x, two different boot areas can be selected through the BOOT pin and the boot base address programmed in the BOOT_ADD0 and BOOT_ADD1 option bytes as shown in the Table 9 .

Table 9. Boot modes

The values on the BOOT pin are latched on the 4th rising edge of SYSCLK after reset release. It is up to the user to set the BOOT pin after reset.

The BOOT pin is also re-sampled when the device exits the Standby mode. Consequently, they must be kept in the required Boot mode configuration when the device is in the Standby mode.

After startup delay, the selection of the boot area is done before releasing the processor reset.

The BOOT_ADD0 and BOOT_ADD1 address option bytes allows to program any boot memory address from 0x0000 0000 to 0x3FFF 0000 which includes:

• • All Flash address space
• • All RAM address space: ITCM, DTCM RAMs and SRAMs
• • The TCM-RAM

The BOOT_ADD0 / BOOT_ADD1 option bytes can be modified after reset in order to boot from any other boot address after next reset.

If the programmed boot memory address is out of the memory mapped area or a reserved area, the default boot fetch address is programmed as follows:

• • Boot address 0: FLASH at 0x0800 0000
• • Boot address 1: ITCM-RAM at 0x0000 0000

When the Flash level 2 protection is enabled, only boot from Flash memory is available. If the boot address already programmed in the BOOT_ADD0 / BOOT_ADD1 option bytes is out of the memory range or belongs to the RAM address range, the default fetch will be forced from Flash memory at address 0x0800 0000.

Embedded bootloader

The embedded bootloader code is located in system memory. It is programmed by ST during production. It is used to reprogram the Flash memory using one of the following serial interfaces:

• • USART1 on PA9/PA10 pins, USART2 on PA3/2 pins, and USART3 on PB10/PB11 or PD8/PD9 pins.
• • I2C1 on PB6/9 pins, I2C2 on PF0/PF1 pins, and I2C3 on PA8/PC9 pins.
• • USB OTG FS in Device mode (DFU) on PA11/PA12 pins
• • SPI1 on PA7/6/5/4 pins, SPI3 on PC12/11/10/PA15 pins, and SPI4 on PE14/13/12/11 pins.
• • FDCAN1 on PH13/PH14 and PD1/PD0 pins.

For additional information, refer to the application note AN2606.