This answer is not STM32 specific but is based on experience and many such discussions over many (many) years. Others can add to this - it covers the main points (I think) but may not be complete.
It's encouraging to see someone asking these simple but fundamental questions and showing an awareness how such "little things" can 'gang aglae' in real life.
ie "If the micro does not initialise properly ..." really reads " ... when the micro does not initialise properly ..." :-) - and it's obvious that you realise this.
So:
Use of external pullup or pulldown is essential for those really keen on getting a well defined result. This is the single biggest must-do here. All the rest is a bonus. ie Setting to inputs with internal pullxxx is a compromise which will almost always work.
BUT if "almost always" is not good enough for your design then you need external pull xxxs.
Pullup or down does not seem to have an overwhelming better result. It may vary between ICs but can be determined from the data sheet. All things being equal (as they may be) I'd favour pull-down as there is a potential for lower leakage currents to device external circuitry - but this is liable to be minimal in a conformally coated PCB and/or a benign environment.
You may wish to look at startup action if you really care. eg a pulled up pin will start low and transit high at some stage. A pulled down pin will probably stay low throughout. This is probably not important but is mentioned for completeness.
ESD susceptibility will be device specific, quite likely symmetric and on average over many processors probably favours pull down as drivers tend to sink better than source if asymmetric. If you care a lot about ESD then you may wish to use low outputs with pull downs - as a a low impedance path will (probably) offer better ESD protection. But if you care a lot about ESD you will want to design for it in other ways and not rely on in-IC protection as your main protection.
Re question 3 - external pullxxxs is desirable but it seems safe to use values which are at the limiting high end of proper design and then use internal xxx's in parallel if desired. However, as internal pull xxxs often have a 2:1 Reffective you can get largest R and smallest current by using external only. What you of course want to avoid is external pull ups and internal pull downs or vice bersa - but that's unlikely to be an issue.
When I say " ... limiting high end of proper design ... " I mean just that and not "past the limiting ...". ie the pin will have a specified value of resistance which allows the worst case Vin spec to be met. A larger resistor may take less current in the resistor but may start to very slightly turn on the internal switch. ie it may be that there is an Rpulldown_current versus lowest overall current tradeoff as the internal driver starts to see leakage current (which will be extremely small) increasing the current to the dirver and whispering it on very slightly.
If you use eg pulldown you may then find it lower power to set the pin to output and drive it low, but this is an option that can be decided on in due course.
Almost an aside - NEVER allow protection diodes to handle "any significant currents" at any stage during operation. Allowing them to do so can lead to totally inexplicable processor action. The less the current the lower the chance of things gong wrong - and the harder to find it when they do.
This answer is general to processors and peripherals, and has an SRAM specific comment at the end, which is probably pertinent to your specific RAM and CPU.
Output pins can be driven in three different modes:
- open drain - a transistor connects to low and nothing else
- open drain, with pull-up - a transistor connects to low, and a resistor connects to high
- push-pull - a transistor connects to high, and a transistor connects to low (only one is operated at a time)
Input pins can be a gate input with a:
- pull-up - a resistor connected to high
- pull-down - a resistor connected to low
- pull-up and pull-down - both a resistor connected to high and a resistor connected to low (only useful in rare cases).
There is also a Schmitt triggered input mode where the input pin is pulled with a weak pull-up to an initial state. When left alone it persists in its state, but may be pulled to a new state with minimal effort.
Open drain is useful when multiple gates or pins are connected together with an (external or internal) pull-up. If all the pin are high, they are all open circuits and the pull-up drives the pins high. If any pin is low they all go low as they tied together. This configuration effectively forms an AND gate.
_____________________________
Note added November 2019 - 7+ years on: The configuration of combining multiple open collector/drain outputs has traditionally been referred to as a "Wired OR" configuration. CALLING it an OR (even traditionally) does not make it one. If you use negative logic (which traditionally may have been the case) things will be different, but in the following I'll stick to positive logic convention which is what is used as of right unless specifically stated.
The above comment about forming an 'AND' gate has been queried a number of times over the years - and it has been suggested that the result is 'really' an 'OR' gate. It's complex.
The simple picture' is that if several open collector outputs are connected together then if any one of the open collector transistors is turned on then the common output will be low. For the common output to be high all outputs must be off.
If you consider combining 3 outputs - for the result to be high all 3 would need to have been high individually. 111 -> 1. That's an 'AND'.
If you consider each of the output stages as an inverter then for each one to have a high output it's input must be low. So to get a combined high output you need three 000 -> 1 . That's a 'NOR'.
Some have suggested that this is an OR - Any of XYZ with at least 1 of these is a 1 -> 1.
I can't really "force" that idea onto the situation.
_________________________________
When driving an SRAM you probably want to drive either the data lines or the address lines high or low as solidly and rapidly as possible so that active up and down drive is needed, so push-pull is indicated. In some cases with multiple RAMs you may want to do something clever and combine lines, where another mode may be more suitable.
With SRAM with data inputs from the SRAM if the RAM IC is always asserting data then a pin with no pull-up is probably OK as the RAM always sets the level and this minimises load. If the RAM data lines are sometimes open circuit or tristate you will need the input pins to be able to set their own valid state. In very high speed communications you may want to use a pull-up and a pull-down so the parallel effective resistance is the terminating resistance, and the bus idle voltage is set by the two resistors, but this is somewhat specialist.
Best Answer
The information you are looking for is in the manual, but not as obvious as it could be. The table you mentioned on page 160 contains more info:
As you can see, assuming the pin is configured as an input, the value in the ODR registers is the deciding factor as to whether the pin is pull-up or pull-down.
You can set and/or clear all these bits at once by writing a 16-bit value to the appropriate GPIOx_ODR register, or you can set/reset them individually by using the GPIOx_BRR and/or GPIOx_BSRR registers.
Interestingly, the same ODR register controls the pin state (high or low) when the pin is configured as an output.
I've found that I can sometimes learn more about the workings of the STM ARM controllers by reading through their Standard Peripheral Libraries than their reference manuals!