1.IAR 下载配置
1 j4 u9 |+ _$ q3 W5 ^& Z4 W本次使用的硬件环境为MUCLEO-L476开发板，官方下载的软件包中打开IAR的工程文件，IAR的下载配置如下：

默认配置是使用IAR 系统默认配置文件，我们勾选上Oveerride default .board file文件。

( b- ]& n4 J  L  L! _

从下载配置中看IAR环境下载使用的是flash loader 进行下载,使用的配置文件为   IAR  安装路径下的此文件$TOOLKIT_DIR$\config\flashloader\ST\FlashSTM32L4xxxG.board

官方的帮助文档中对flash loader 的描述如下，从如下描述中可知，flash loader 是运行在目标系统（MUCLEO-L476开发板）的一段实现特定flash 操作的接口函数集合，IAR 通过C-SPY将flash loader 加载到目标系统（MUCLEO-L476开发板）RAM中运行，完成目标falsh 的更新任务。
3 c8 b9 w  E" L7 ~& q/ }

The flash loader
A flash loader is usually a rather small program which can program one or more flash memories.
The flash loader consists of a small set of functions, mainly for erasing or writing designated
, B2 u; U4 \& _5 yportions of the flash memory. C-SPY downloads this program into RAM (it must be linked to an
address in RAM). To run the program, C-SPY sets the PC to one of the functions in the flash
4 ?! c  d% \) g- ~loader, writes data and directives for that function into a RAM buffer, and starts execution.
. Y5 s  f3 q, b6 p+ f8 h" @When the function returns, execution will hit a breakpoint. C-SPY will then know that the
function has finished and can proceed to make further

从如下图片能更清晰的看出flash loader 的工作流程：

2 B" O& A5 N$ V3 _  Z% \$ h

• 通过 C-SPY 将 flash loader 程序加载到目标系统预留的RAM区域。
• 通过 C-SPY 将需要下载测程序加载到目标系统预留的RAM区域，如果可执行程序比较大预留的RAM空间可能不能一次完全放下可以分割成多次传输。
• 将 IMAGE 镜像通过 flash loader 将 IMAGE 镜像下载至flash.
• 镜像下载完成后可以释放预留的RAM空间，至此已经完成下载。
  6 F( z- n0 w! R

2. *.board 文件格式说明

此*.board 配置文件的总入口，*.board 文件是什么文件，从IAR的帮助文档摘出如下说明，.board 文件是flash loader 下载镜像的配置文件被IAR 的C-SPY debug 对象引用。

Ext.	Type of file	Output from	Input to
board	Configuration file for flash loader	Text editor	C-SPY

$ G) u2 t/ l6 E0 e+ v

$TOOLKIT_DIR$\config\flashloader\ST\FlashSTM32L4xxxG.board文件内容如下：

1. <?xml version="1.0" encoding="iso-8859-1"?>
   
2. 
   
3. <flash_board>
   
4.   <pass>
   # X. t# c, W% n; V+ k. t
5.     <loader>$TOOLKIT_DIR$\config\flashloader\ST\FlashSTM32L4xxxG.flash</loader>
   
6.     <range>CODE 0x08000000 0x080FFFFF</range>
   , `  i( u' b" b! |  h: _
7.   </pass>
   : D9 w! K0 x$ P; g  P
8. </flash_board>

复制代码

/ S& K6 X) x7 {+ Y2 l: P. m

从如上xml 的配置指定了，flash 的配置说明及FLASH的范围：

3. *.flash 文件格式说明

从配置选项可以看出，此.board主要的配置信息是告诉flash loader 要根据Flash STM32L4xxxG.flash 文件的配置下载镜像，此.flash 的文件是什么文件呢，从iar 的文件说明可知，.flash 文件也是C-SPY加载的文件，主要定义了flash 的相关属性配置。

Ext.	Type of file	Output from	Input to
flash	Configuration file for flash loader	Text editor	C-SPY

1. <?xml version="1.0" encoding="iso-8859-1"?>
   
2. 
   
3. <flash_device>
   
4.   <exe>$TOOLKIT_DIR$\config\flashloader\ST\FlashSTM32L4xxxRAM48K_DUALBANK.out</exe>
   % ?# g6 O6 z; l+ U! b7 I' J+ q
5.   <page>8</page>
   5 m5 n+ Z& H' |7 f# u1 F' ?* B
6.   <block>512 0x800</block>
   
7.   <flash_base>0x08000000</flash_base>
   - V/ u+ k7 T. Q2 B  @5 }' E
8.   <macro>$TOOLKIT_DIR$\config\flashloader\ST\FlashSTM32L4xxx.mac</macro>
   
9.   <online>1</online>
   & T) l! A: y; v6 [
10.   <aggregate>1</aggregate>  
    
11.   <args_doc>"--skip_erase" -Don't erase blocks that read empty.</args_doc>
    
12. </flash_device>

复制代码

如下是上述 xml 文件的配置项说明:

To accommodate a large range of different flash memories, C-SPY uses a few concepts which
detail the characteristics of flash memories.
/ ]8 ~% _8 D/ u  L* s7 N. g! u8 _1 [Page
: G1 ?& ]0 D% rA page is the smallest writable unit of the flash memory. Many flash
: W7 \( |, W4 T' dmemories cannot write less than for example 128 or 256 bytes in a
: j7 b; t( S* z! K& Y1 ysingle write operation. C-SPY will never request the flash loader to write
2 @8 d& w1 a8 [( lanything smaller than a page, and uses padding if necessary to fill out a
page. Of course, some flash memories have no such restrictions and can
; Y: H( b+ z9 \% W% qspecify a page size of 1 byte.
Block
% ?1 x3 i, `! W  N! v4 V0 x# [6 @A block is the smallest erasable unit of the flash memory. For example,
a flash memory with a 256-byte page size could still require that flash
memory should be erased in 4-Kbyte chunks. The block size must
always be a multiple of the page size. A flash memory can consist of
7 C0 ]8 d# W7 C1 I5 r( ?1 Xseveral blocks of different sizes. It can also lack such restrictions, in
which case the block size would be the same as the page size.
Base address
6 G& Y2 Q2 `/ `4 W7 r. [0 NThis is the start address of the flash memory, when it is written. Some
/ R% e. }  i% J- N5 bflash memories are simply memory mapped into a fixed address range
% l' `1 Y3 F* D- a+ C, f$ Wand the base address is then the start of that range. Other flash memories
/ g" e8 f6 L0 nare mapped into different addresses when being programmed and when
the application is later executing. The base address is then the address
1 m' q6 Z  j- L! [9 Cwhere these memories are mapped when being programmed. Yet other
flash memories are not memory mapped at all, but work more like
external disk-like devices. The base address is then simply the preferred
address to be used for the start of the memory when it is being
programmed.
+ c( f7 n5 K9 ]* nFrom the C-SPY perspective, a flash memory starts at a given address and consists of a sequence
5 C1 k0 `& b; Y8 k3 xof blocks (possibly of different sizes), each of which consists of a number of pages. The
sequence can also contain gaps.

7 J8 Z& A. J$ H7 _  G- [

从上述配置文件解析：

STM32L476 的 page 为8byte,共有512 个block 每个  block 大小为2k,总大小为1M,base 地址为0x0800 0000。

FLASH main features
• Up to 1 Mbyte of Flash memory with dual bank architecture supporting read-while-write
capability (RWW).
: T. O3 h7 V. E& \# [  D• Memory organization: 2 banks (Bank 1 and Bank 2)
– main memory: 512 Kbyte per bank
( A& j6 y  o, `" @– information block: 32 Kbyte per bank
! z7 w  ~/ d+ |+ N. g% W3 X3 F• 72-bit wide data read (64 bits plus 8 ECC bits)
• 72-bit wide data write (64 bits plus 8 ECC bits)
• Page erase (2 Kbyte), bank erase and mass erase (both banks)

从上述描述可以看出flash 的最小读写单位是64bit 8bit ECC,最小的编程单位是8byte,每个最小擦除单位为2kbyte,xml 配置和芯片手册里FLASH 的layout 布局是保持一致的。

4. *.mac 文件格式说明

.mac 文件定义了 C-SPY 调用的宏函数，如下宏函数会在 flash loader 的不同阶段调用宏函数。

Ext.	Type of file	Output from	Input to
mac	C-SPY macro definition	Text editor	C-SPY

macro Specifies the path to a C-SPY macro file, which will be loaded in
conjunction with downloading the flash loader. There are three C-SPY
' Z1 j: x. V! U' {macro functions that will be called automatically if they are defined in
this macro file:
: x) ^3 V- l0 _9 u! _  c8 W0 MexecUserFlashInit is called immediately before loading the flash
4 j% X( F7 W0 p0 k9 X' N2 mloader.
! G) _( S' C# L7 ?execUserFlashReset is called immediately after the reset that
# Q! x/ _7 Q1 f$ s) p1 nfollows the loading of the flash loader.
: y) Y4 ~6 F6 e6 R& {- D6 HexecUserFlashExit is called immediately after flash loading has
/ z* g& o* Z* Vfinished, but before the flash loader is unloaded.

$ Y8 H2 ]3 N9 u* Y( n

FlashSTM32L4xxx.mac 内容如下：

1. __var RCC_CFGR;
   ' j* E1 ^9 z" v6 m1 n
2. __var RCC_CR;
   - p$ z( x6 n! N4 ?& N% y3 \
3. __var RCC_CIR;
   
4. __var IWDG_PR;
   ; L3 {* D$ H  T: L' K& g$ Y
5. __var IWDG_RLR;
   $ \" i4 t- f' U) S; E% \
6. __var FLASH_ACR;
   ( W' B; w6 @- s/ h7 i' c5 F9 v& X
7. 
   
8. execUserFlashInit()
   
9. {
   " L9 l$ E. a1 @' x0 |+ s
10. __var tmp;
    ( c2 P) e7 v9 e% _
11. 
    5 O+ W- `; p  D
12. __message "Entry execUserFlashInit";
    * ]$ \; C( U8 X, g
13. 
    
14.   //Stop watchdogs when CPU is halted
    2 t+ z; [4 C* T" ^& \) O. ~1 x
15.   __writeMemory32(__readMemory32(0xE0042008, "Memory") | 0x1800, 0xE0042008, "Memory");
    
16. 
    
17.   //Check if hardware watchdog is enabled
    ( N0 |" r. m* E% c; e9 l
18.   if(!((1<<16) & __readMemory32(0x40022020,"Memory")))
    1 P; a% b) w4 H+ m
19.   {
    % G- v! c8 U. N2 T: N' B
20.     // wait PVU reset
    
21.     while(0x3 & __readMemory32(0x4000300C,"Memory"));
    
22.     IWDG_PR  = __readMemory32(0x40003004, "Memory");
    
23.     IWDG_RLR = __readMemory32(0x40003008, "Memory");
    7 ^) Y2 P( A% a$ |
24.   
      [9 v& ?8 R6 {: a- r% ?
25.     // unlock WDT registers
    8 Q, |2 K2 X9 c- H8 v9 \* L) a0 n
26.     __writeMemory32(0x5555,0x40003000,"Memory");
      a" H: j7 E; t$ h/ O- A
27.     // Prescaler
    , ~; @2 o  ~2 @
28.     __writeMemory32(0x7,0x40003004,"Memory");
    " `3 z! M, d( q) p
29.     // Reload
    
30.     __writeMemory32(0xFFF,0x40003008,"Memory");
    , X5 s- u: G6 t% o
31.     // reload WDT
    
32.     __writeMemory32(0xAAAA,0x40003000,"Memory");
    8 B. }7 o4 {. g0 C* u/ _7 }$ ?; S+ ^
33.   }
    
34. 
    2 E1 o- j8 i$ i6 G4 h1 `
35.   RCC_CR   = __readMemory32(0x40021000, "Memory");
    % L# ^7 b& i( z' {9 s
36.   RCC_CFGR = __readMemory32(0x40021008, "Memory");
    
37.   RCC_CIR  = __readMemory32(0x40021018, "Memory");
    3 f5 u3 G& S; G. H+ `) I
38.   
    
39.   /*Enable HSI16 oscilator and select it as system clock*/
      \: ?" w4 T' z" b6 ^
40.   __writeMemory32(0x00000000, 0x40021018, "Memory");             // RCC_CIR  = 0;
    8 W- B. X4 q! u; v
41.   __writeMemory32(RCC_CR | (1<<8), 0x40021000, "Memory");   // RCC_CR_HSION  = 1;
    
42.   while(!((1<<10) & __readMemory32(0x40021000,"Memory")));
    
43.   tmp = (RCC_CFGR & ~(3<<0)) | (1<<0);
    ; P3 i' I; M5 H3 H% ^+ i( T
44.   __writeMemory32(tmp, 0x40021008, "Memory");                                 // RCC_CFGR_SW  = 1;
    ( M8 c; O0 Z% ]
45.   
    / J6 Y/ }% m4 I, }% R0 a
46.   FLASH_ACR = __readMemory32(0x40022000, "Memory");
    9 K) s$ ~0 [( {7 @
47.   tmp = (FLASH_ACR & ~(0x7<<0)) | (2<<0);
    
48.   tmp &= ~(3<<9);
    * H9 n% p% C, C, @$ G' m
49.   __writeMemory32(tmp, 0x40022000, "Memory"); // 2 WS (3 CPU cycles) & disable caches
    3 J+ z3 B. j- W- H& i
50.   tmp |= (3<<11);
    & k* t  T! a( I; ]
51.   __writeMemory32(tmp, 0x40022000, "Memory"); // reset caches
    9 [( X3 }8 h7 p  ^# ~: ^
52.   
    ) M4 Z# V1 [5 @- ?5 H
53.   if ((0xFF & __readMemory32(0x40022020,"Memory")) != 0xAA)
    3 u; p& W; z$ L# Q) ]3 x
54.   {
    
55.    
    
56.     if (!__messageBoxYesCancel("Do you want to perform mass erase to unlock the device?", "Unlocking device"))
    
57.     {
    
58.       __abortLaunch("Unlock cancelled. Debug session cannot continue.");
    - M% P0 @2 `0 V% [4 p; l8 u1 B
59.     }
    
60. 
    
61.     __writeMemory32(0x45670123, 0x40022008, "Memory"); // FLASH->FKEYR = FLASH_KEY1;
    , t$ y* R+ ?8 [. @+ J4 H# Z
62.     __writeMemory32(0xCDEF89AB, 0x40022008, "Memory"); // FLASH->FKEYR = FLASH_KEY2;
    % T' ^* t6 ]0 N4 {, Y
63. //    __writeMemory32(0x00000000, 0x40022000, "Memory"); // Flash 0 wait state
    
64.     __writeMemory32(0x08192A3B, 0x4002200C, "Memory"); // FLASH->OPTKEYR = FLASH_OPTKEY1;
    
65.     __writeMemory32(0x4C5D6E7F, 0x4002200C, "Memory"); // FLASH->OPTKEYR = FLASH_OPTKEY2;
    
66.       
    ; A- N5 @7 D' b% J* J
67.     __message "Setting FLASH readout protection level 0 (disabled)";
    " _' K3 S, m+ q6 ~+ i
68.   
    
69.     __writeMemory32((__readMemory32(0x40022020,"Memory") & 0xFFFFFF00) | 0xAA, 0x40022020, "Memory");     // Disable readout protection
    
70.    
    : h1 ?9 n4 I/ v; \
71.    
    
72.     __writeMemory32((1<<17) | __readMemory32(0x40022014,"Memory"), 0x40022014, "Memory");                 // Set the Options Start bit OPTSTRT
    
73. 
    
74.     while((1<<16) & __readMemory32(0x40022010,"Memory"));  // Wait while FLASH busy
    * |$ J* Z% e7 d
75.         
    0 a: l/ K* h. i) I0 y
76.     __writeMemory32((1<<27) | __readMemory32(0x40022014,"Memory"), 0x40022014, "Memory");                 // Set the OBL_LAUNCH to Force the option byte loading
    
77.       
    # W5 b7 l9 \/ X! B8 u
78.   }
    ( p- I4 c+ L: r3 h2 J
79. }
    4 a' G5 r, }% J- o; }; k: r1 ~
80. 
    : Q9 u) h  H8 v  O5 i
81. execUserFlashExit()
    
82. {
    ( L' H- B4 b% G; J2 C" l
83. __message "Entry execUserFlashExit";
    
84.   if(!((1<<16) & __readMemory32(0x40022020,"Memory")))
    " ?6 S0 O" g5 e  a
85.   {
      f4 w6 l6 e3 s% C! F# {) U
86.     __writeMemory32(0x5555,0x40003000,"Memory");
    / B0 K! C; j! C9 E: f4 b. |
87.     __writeMemory32(IWDG_PR,0x40003004,"Memory");
    0 ^1 M* i* k- e* m" ^
88.     __writeMemory32(IWDG_RLR,0x40003008,"Memory");
    6 h* _$ U; O( M& E& S7 O: G4 B
89.     __writeMemory32(0xAAAA,0x40003000,"Memory");
    
90.   }
    - Y# `7 s0 J, g. b2 N% W5 f. |. M
91. 
    
92.   //Restore registers modified earlier
    * {/ ?: T+ Y! l8 x% O2 Q' a$ r" _6 Y
93.   __writeMemory32(RCC_CFGR, 0x40021008, "Memory");
    + c: F+ r1 D+ z5 d; D
94.   __writeMemory32(RCC_CR, 0x40021000, "Memory");
    / ^' y% J; l& w; A7 ]. y2 J
95.   __writeMemory32(RCC_CIR, 0x40021018, "Memory");
    & G6 ?8 l$ T9 }  D. t7 b$ F% Q
96. 
    ( L, x% ^: Z. s: f
97.   __writeMemory32(FLASH_ACR, 0x40022000, "Memory");
    
98. }

复制代码

/ _6 t$ _1 W+ m# l

从上述.mac 文件中定义了如下宏函数，并在入口中添加了打印输出：

( k- h9 }& ]: e; @5 B1 }5 l6 S6 c

execUserFlashInit()

& H+ y# E& |1 X, V  `# \4 e

execUserFlashExit()

. V1 l2 J) h1 a3 p  U

5.下载验证

; U7 }0 |. y4 T( w( P1 z, V5 d

macros 文件是可以被C-SPY 调用的执行文件，为了验证个人的猜想在execUserFlashInit 入口和出口追加了log 输出，来确认猜测是否正确。
" Q  g  s) C; R6 K) C( q( j/ E. b2 W" j& m有了上述的配置信息及flash 的初始化处理，flash loader程序就可以吧编译的二进制下载到板子上执行了。准备下环境验证下上述猜测是否正确。

. M7 d, x* o) \* X  K4 g2 e7 C! c

; A  Y2 J" y4 ?- S1 U) R0 `

从debug log 窗口可以发现mac 文件内定义的函数入口打印输出跟预期的是一致的，同时从log 个中也可以看出flash loader（FlashSTM32L4xxxRAM48K_DUALBANK.out） 程序是按照上述描述的方式被C-SPY 加载到目标系统。

  y% y0 W3 r: C

1. Flash loader example
   
2. The following example shows the source code for a complete flash loader (except the source
   
3. code for the framework), but with a flash programming algorithm which simply copies bytes
   
4. from the RAM buffer to the destination address:
   
5. #include "flash_loader.h"
   * s+ T7 b# s6 m( ~3 s
6. uint32_t FlashInit(void *base_of_flash, uint32_t image_size,
   7 B0 C9 S" b4 r" U
7. uint32_t link_address, uint32_t flags)
   
8. {
   
9. return RESULT_OK;
   
10. }
    
11. uint32_t FlashWrite(void *block_start,
    
12. uint32_t offset_into_block,
    
13. uint32_t count,
    # S' r: k" S2 K+ U/ L! r% z5 c
14. char const *buffer)
    ) c5 M3 `7 K- U4 m" X& g4 [/ w
15. {
    
16. char *to = (char*)block_start + offset_into_block;
    ( O5 S" D# J+ ?: j  X* \6 c
17. while (count--)
    
18. {
    * w: x# C# D- Y  G" B! y
19. *to++ = *buffer++;
    4 P8 Z1 q6 }  x
20. }
    
21. return RESULT_OK;
      O/ M5 H# J3 R5 B
22. }
    
23. uint32_t FlashErase(void *block_start, uint32_t block_size)
    ) ^0 _) x. `* _: J. X
24. {
    
25. char *p = (char*)block_start;
    
26. while (block_size--)
    
27. {
    
28. *p++ = 0;
    
29. }
    
30. return RESULT_OK;
    
31. }
    
32. The parameters to FlashWrite and FlashErase, in combination with the flash memory base
    
33. address given in FlashInit, fully specify the addresses of the portions of the flash memory to
    
34. be programmed. Thus, a given flash loader can be used for any number of different flash
    , J/ T* f& R) b% J$ g! }  F" j) m
35. devices, with different total size, page size, or block layout, provided that they all employ the
    ( Q% }9 n7 f$ |5 e3 h$ P
36. same flash programming algorithm. The flash memory configuration file (.flash) is used for
    4 T2 b& M; D$ \
37. specifying such variations between flash memories.
    8 K3 v; h: C4 I% i4 D0 M
38. The reference section at the end of this document describes all framework functions in detail.

复制代码

从上述flash loader 的示例程序中实现了FlashInit/FlashWrite/FlashErase 三个api 函数，我们可以objdump 下flash loader 程序看下内部是否是按照上述方式实现了对应的接口。

1.                 FlashInit:
   
2.   0x200000c4: 0xb510         PUSH   {R4, LR}
   . t$ c5 M% ^. @/ ]
3.   0x200000c6: 0x494a         LDR.N  R1, `.text_8`          ; flash_ie
   
4.   0x200000c8: 0xf500 0x2200  ADD.W  R2, R0, #524288        ; 0x80000
   2 |: ?9 @9 R% S  O/ x+ A
5.   0x200000cc: 0x604a         STR    R2, [R1, #0x4]
   
6.   0x200000ce: 0x2300         MOVS   R3, #0
   ( [# s6 q- V- N& Q0 m+ a7 |
7.   0x200000d0: 0x2200         MOVS   R2, #0
   
8.   0x200000d2: 0x700a         STRB   R2, [R1]
   
9.   0x200000d4: 0x9a02         LDR    R2, [SP, #0x8]
   9 C) G% K; @) E, M! l
10.   0x200000d6: 0xe000         B.N    @200000da
    6 ^4 f5 R- b9 ?9 t8 `; l0 J+ ~
11.                 @200000d8:
    
12.   0x200000d8: 0x1c5b         ADDS   R3, R3, #1
    ( Y8 V- H( v) O/ }9 ]
13.                 @200000da:
    
14.   0x200000da: 0x4293         CMP    R3, R2
    ) H* n0 p, C& g2 K! u1 H2 b5 s6 C
15.   0x200000dc: 0xdbfc         BLT.N  @200000d8
    
16.   0x200000de: 0x4a45         LDR.N  R2, `.text_9`          ; 0x40022008 (1073881096)
    / d6 b& q% d# g' ]- Z
17.   0x200000e0: 0x6993         LDR    R3, [R2, #0x18]
    8 }3 a! ~% u5 {) }0 B
18.   0x200000e2: 0x029b         LSLS   R3, R3, #10
    
19.   0x200000e4: 0xd507         BPL.N  @200000f6
    
20.   0x200000e6: 0x4b44         LDR.N  R3, `.text_10`         ; 0x1fff75e0 (536835552)
    2 D6 g: Y' _8 |
21.   0x200000e8: 0x4c44         LDR.N  R4, `.text_11`         ; 0x3ffc00 (4193280)
    
22.   0x200000ea: 0x881b         LDRH   R3, [R3]
    0 s& w5 m5 h0 Y# r4 D3 K1 q4 R
23.   0x200000ec: 0xea04 0x2383  AND.W  R3, R4, R3, LSL #10
    
24.   0x200000f0: 0xeb00 0x0063  ADD.W  R0, R0, R3, ASR #1
    * L. n8 I& _& V' `, E$ t
25.   0x200000f4: 0x6048         STR    R0, [R1, #0x4]
    
26.                 @200000f6:
    
27.   0x200000f6: 0x4842         LDR.N  R0, `.text_12`         ; 0xe000e100 (-536813312)
    1 S+ v1 ]/ q5 K+ C. e
28.   0x200000f8: 0x4b42         LDR.N  R3, `.text_13`         ; 0xe000e180 (-536813184)
    
29.   0x200000fa: 0x6800         LDR    R0, [R0]
    
30.   0x200000fc: 0x06c0         LSLS   R0, R0, #27
    % p6 c& p2 p$ f3 l. u; h; ?; W
31.   0x200000fe: 0xbf44         ITT    MI
    
32.   0x20000100: 0x2001         MOVMI  R0, #1
      ^- a: ]! I; C
33.   0x20000102: 0x7008         STRBMI R0, [R1]
    
34.   0x20000104: 0x2010         MOVS   R0, #16                ; 0x10
    
35.   0x20000106: 0x6018         STR    R0, [R3]
    4 v4 _3 M! |: Z4 A% C! D0 P
36.   0x20000108: 0x4b3f         LDR.N  R3, `.text_14`         ; 0xc7000ff8 (-956297224)
    . R; ?' G( Y& x
37.   0x2000010a: 0x68d0         LDR    R0, [R2, #0xc]
    . G, i: x" V3 d0 M8 q
38.   0x2000010c: 0x4018         ANDS   R0, R0, R3
    
39.   0x2000010e: 0x6088         STR    R0, [R1, #0x8]
    2 n, b( K" y2 E, J* e4 E7 M
40.   0x20000110: 0x483e         LDR.N  R0, `.text_15`         ; 0x45670123 (1164378403)
    
41.   0x20000112: 0x6010         STR    R0, [R2]
    
42.   0x20000114: 0x483e         LDR.N  R0, `.text_16`         ; 0xcdef89ab (-839939669)
    8 m3 i& w& o. \) w7 {7 c
43.   0x20000116: 0x6010         STR    R0, [R2]
    
44.   0x20000118: 0x68d0         LDR    R0, [R2, #0xc]
    * C$ ]; @# C9 C( |; u- T
45.   0x2000011a: 0xf020 0x60c0  BIC.W  R0, R0, #100663296     ; 0x6000000
    ( b% w6 }3 Q+ x& F. q6 Q
46.   0x2000011e: 0x60d0         STR    R0, [R2, #0xc]
    
47.   0x20000120: 0x68d0         LDR    R0, [R2, #0xc]
    0 h; Y5 h7 w3 n6 X" S
48.   0x20000122: 0xf040 0x7080  ORR.W  R0, R0, #16777216      ; 0x1000000
    * |5 E2 j% X1 S1 n0 i1 B
49.   0x20000126: 0x60d0         STR    R0, [R2, #0xc]
    ; F1 `! }  o# U, Z2 m0 E" `" V; i. g2 e
50.                 @20000128:
    ! V( P1 E6 Z  J0 G+ U" S" }2 g
51.   0x20000128: 0x6890         LDR    R0, [R2, #0x8]
    & q  X1 P* }/ i! |; z# H
52.   0x2000012a: 0x03c0         LSLS   R0, R0, #15
    % m( q: K" k9 I) \
53.   0x2000012c: 0xd4fc         BMI.N  @20000128
    3 k* e5 Y" t0 }! D( P
54.   0x2000012e: 0x2000         MOVS   R0, #0
    5 A% a+ b( i! Q0 i" D) N
55.   0x20000130: 0xbd10         POP    {R4, PC}
    
56.                 `.text_5`:
    . S( A9 F  k' [9 N" B8 t
57.                 FlashWrite:
    
58.   0x20000132: 0xb5f0         PUSH   {R4-R7, LR}
    9 Q5 o% F, z  p( r- ]9 v
59.   0x20000134: 0xf240 0x15ff  MOVW   R5, #511               ; 0x1ff
    
60.   0x20000138: 0x1844         ADDS   R4, R0, R1
    ' ~2 x* R" B% {$ U) ?7 ~$ f* I3 _
61.   0x2000013a: 0x4936         LDR.N  R1, `.text_17`         ; 0x40022010 (1073881104)
    
62.   0x2000013c: 0x600d         STR    R5, [R1]
    + N7 H6 k! K8 B# D; T* Z- t8 @
63.   0x2000013e: 0x2000         MOVS   R0, #0
    
64.   0x20000140: 0x684d         LDR    R5, [R1, #0x4]
    
65.   0x20000142: 0xf045 0x0501  ORR.W  R5, R5, #1
    
66.   0x20000146: 0x604d         STR    R5, [R1, #0x4]
    
67.   0x20000148: 0xe000         B.N    @2000014c
    
68.                 @2000014a:
    4 {. I& c6 e, D0 t
69.   0x2000014a: 0x3a08         SUBS   R2, R2, #8
    * y  m: M0 z9 o( W3 \
70.                 @2000014c:
    
71.   0x2000014c: 0xb162         CBZ    R2, @20000168
    . O+ w! H$ F5 k' j' U' z: [
72.   0x2000014e: 0xe8f3 0x6702  LDRD   R6, R7, [R3], #0x8
    
73.   0x20000152: 0xe8e4 0x6702  STRD   R6, R7, [R4], #0x8
    $ B* N. ?( W5 x  u- N+ y  P
74.   0x20000156: 0xbf00         NOP
    + T/ a/ t; \* @4 K3 H: y/ T. |- L
75.   0x20000158: 0xbf00         NOP
    
76.                 @2000015a:
    4 c4 A' t. s' T( ]9 W8 H+ k
77.   0x2000015a: 0x680d         LDR    R5, [R1]
    - c$ M3 U4 m) I8 x
78.   0x2000015c: 0x03ed         LSLS   R5, R5, #15
    
79.   0x2000015e: 0xd4fc         BMI.N  @2000015a
    
80.   0x20000160: 0x680d         LDR    R5, [R1]
    + ?" B( E  s* c: q" w2 r
81.   0x20000162: 0x07ed         LSLS   R5, R5, #31
    
82.   0x20000164: 0xd4f1         BMI.N  @2000014a
    # A8 M4 j6 P: T% U+ E
83.   0x20000166: 0x2001         MOVS   R0, #1
    4 u0 m  \* l0 K% f3 j& c/ J) y( V5 Q
84.                 @20000168:
    5 |  K8 N% j! Y6 |- _$ a
85.   0x20000168: 0x684a         LDR    R2, [R1, #0x4]
    
86.   0x2000016a: 0x0852         LSRS   R2, R2, #1
    
87.   0x2000016c: 0x0052         LSLS   R2, R2, #1
    
88.   0x2000016e: 0x604a         STR    R2, [R1, #0x4]
    
89.   0x20000170: 0xbdf0         POP    {R4-R7, PC}
    ( z& l, F. j' a3 Q  s1 e; N+ M
90.                 `.text_6`:
    
91.                 FlashErase:
    ; ^+ _$ c/ {% C" h  y6 c5 m5 S2 u
92.   0x20000172: 0x4a28         LDR.N  R2, `.text_17`         ; 0x40022010 (1073881104)
    ( c  Y* \8 ?* x+ a  l$ [  v) i. e  Y
93.   0x20000174: 0xf240 0x13ff  MOVW   R3, #511               ; 0x1ff
    
94.   0x20000178: 0x6013         STR    R3, [R2]
    
95.   0x2000017a: 0x4601         MOV    R1, R0
    ) K* S. {7 t' n/ a8 o. o( a- R
96.   0x2000017c: 0x6853         LDR    R3, [R2, #0x4]
    
97.   0x2000017e: 0xf36f 0x03cb  BFC    R3, #3, #9
    * M9 X7 d. F5 O* i1 g
98.   0x20000182: 0x6053         STR    R3, [R2, #0x4]
    7 d; z6 B: Y8 m3 O
99.   0x20000184: 0x2000         MOVS   R0, #0
    
100.   0x20000186: 0x4b1a         LDR.N  R3, `.text_8`          ; flash_ie
     ! J8 D: N) H# S( T7 w: N8 {% I  Z, D# a
101.   0x20000188: 0x685b         LDR    R3, [R3, #0x4]
       Q( X& `. U, i2 U( y( D) H
102.   0x2000018a: 0x4299         CMP    R1, R3
     9 z/ e/ u* _( N1 P+ M" ~
103.   0x2000018c: 0xd203         BCS.N  @20000196
       ?2 j9 W* J9 v9 |; q' n
104.   0x2000018e: 0x0a09         LSRS   R1, R1, #8
     , @; i$ G5 x; i& q1 C5 e- W" [
105.   0x20000190: 0xf401 0x61ff  AND.W  R1, R1, #2040          ; 0x7f8
     
106.   0x20000194: 0xe007         B.N    @200001a6
     
107.                 @20000196:
     $ O" [* m6 {* ~3 s& G
108.   0x20000196: 0x1ac9         SUBS   R1, R1, R3
     
109.   0x20000198: 0x6853         LDR    R3, [R2, #0x4]
     
110.   0x2000019a: 0x0a09         LSRS   R1, R1, #8
     
111.   0x2000019c: 0xf443 0x6300  ORR.W  R3, R3, #2048          ; 0x800
     . i& }) E8 U' \4 F
112.   0x200001a0: 0xf401 0x61ff  AND.W  R1, R1, #2040          ; 0x7f8
     " z/ U$ h% H+ O5 ^
113.   0x200001a4: 0x6053         STR    R3, [R2, #0x4]
     7 i9 W  F/ I, t
114.                 @200001a6:
     " w/ G4 b" B: ~' I: @* g( m
115.   0x200001a6: 0xf041 0x0102  ORR.W  R1, R1, #2
     
116.   0x200001aa: 0x6853         LDR    R3, [R2, #0x4]
     * |2 g% z4 y7 d% C1 u. j. i
117.   0x200001ac: 0x4319         ORRS   R1, R1, R3
     
118.   0x200001ae: 0x6051         STR    R1, [R2, #0x4]
     ( j6 ~" s( l, x9 a$ g9 s# h
119.   0x200001b0: 0x6851         LDR    R1, [R2, #0x4]
     3 ?2 L" S! r5 d- B% m' x9 W5 {
120.   0x200001b2: 0xf441 0x3180  ORR.W  R1, R1, #65536         ; 0x10000
     
121.   0x200001b6: 0x6051         STR    R1, [R2, #0x4]
     
122.   0x200001b8: 0xbf00         NOP
     1 K+ N. R: P1 ~) f
123.   0x200001ba: 0xbf00         NOP
     
124.                 @200001bc:
     
125.   0x200001bc: 0x6811         LDR    R1, [R2]
     * S/ P% z; S9 L1 f0 J
126.   0x200001be: 0x03c9         LSLS   R1, R1, #15
     # Y$ D7 Q$ M0 L# ?- O% Q- P
127.   0x200001c0: 0xd4fc         BMI.N  @200001bc
     
128.   0x200001c2: 0x6811         LDR    R1, [R2]
     ! O4 W: U& B: G% W) A. N+ t
129.   0x200001c4: 0x07c9         LSLS   R1, R1, #31
     % M7 w) N( @4 l; g
130.   0x200001c6: 0x6851         LDR    R1, [R2, #0x4]
     
131.   0x200001c8: 0xf021 0x0102  BIC.W  R1, R1, #2
     
132.   0x200001cc: 0xbf58         IT     PL
     
133.   0x200001ce: 0x2001         MOVPL  R0, #1
     
134.   0x200001d0: 0x6051         STR    R1, [R2, #0x4]
     
135.   0x200001d2: 0x4770         BX     LR

复制代码

# K: K- y# @1 {2 m8 }4 M1 S* x9 c

上述通过  

ielfdumparm.exe  FlashSTM32L4xxxRAM48K_DUALBANK.out  -o FlashSTM32L4xxxRAM48K_DUALBANK.ASM --code

命令dump 出来的flash loader 程序，跟预期的保持一致实现了FlashInit/FlashWrite/FlashErase 这组API函数，而且通过反汇编的函数地址信息也可以看出对应的函数的link 地址并不是falsh 区域而是内部RAM 的地址，跟C-SPY 调用flash loader 程序的流程是一致的。

3 R6 H( F9 o" w7 z# x# N6 l

/ D2 h' K2 G% x6 c4 l4 l3 O+ e

资料分割线

FlashLoaderGuide.ENU.pdf (233.17 KB, 下载次数: 8)

2022-12-31 18:22 上传

点击文件名下载附件

EWARM_DebuggingGuide.ENU.pdf (7.52 MB, 下载次数: 8)

2022-12-31 18:22 上传

点击文件名下载附件

- `- b& s9 _" z1 @! T  ?

出

$ B) o. v6 j' R  r% ~2 |8 d8 m7 G
6 a( B! X2 q; ]! C# P