STM32WB55 BLE双核flash擦写程序深度解析

简介

STM32WB55的flash擦除有两种机制，一种是只有单核运行下的flash擦除，这种模式下，flash擦除的步骤同其他STM32的flash擦除一样，直接调用HAL库中flash擦除的库函数即可；另一种是双核运行下的flash擦除，这种模式下，因为两颗CPU内核都会访问地址总线，可能会有访问冲突，为了解决这个问题，ST引入了硬件信号量机制，因此，在双核运行下，即当单片机执行BLE应用时，要想擦除flash，就要结合硬件信号量来综合处理，执行步骤比单核下要复杂的多，今天我们就来解析一下双核flash擦除驱动是怎样运行的。

准备变量

在APP_BLE_Init函数中，我们在BLE服务初始化之后，广播启动之前，添加如下代码

/******************** START FLASH TEST SPECIFIC INITIALIZATION *************************/

  NbrOfSectorToBeErased = CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS;
  NbrOfDataToBeWritten = CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS * 512;
  FlashProcessStatus = FLASH_PROCESS_FINISHED;
  FlashOperationReq = FLASH_ERASE_REQ;
  UTIL_SEQ_RegTask(1 << CFG_TASK_FLASH_OPERATION_REQ_ID, UTIL_SEQ_RFU, FlashOperationProc);
  /* Select which mechanism is used by CPU2 to protect its timing versus flash operation */
  SHCI_C2_SetFlashActivityControl(FLASH_ACTIVITY_CONTROL_SEM7);

 /**
   * The error flag shall be cleared before moving forward
   */
  __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_OPTVERR);
/******************** END FLASH TEST SPECIFIC INITIALIZATION ***************************/

变量定义如下

uint32_t NbrOfSectorToBeErased;
uint32_t NbrOfDataToBeWritten;
typedef enum
{
  FLASH_PROCESS_FINISHED,
  FLASH_PROCESS_STARTED,
}FlashProcessStatus_t;

typedef enum
{
  FLASH_ERASE_REQ,
  FLASH_WRITE_REQ,
}FlashOperationReq_t;

#define CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS      (1)

• NbrOfSectorToBeErased直接赋值为一个宏，表示本次要处理的flash扇区个数，STM32WB55的flash每4K字节构成一个扇区，整个扇区的分布在参考手册中

由于flash的擦除只能按扇区擦，即当我们要向flash写入新数据时，首先要擦除一个4K字节扇区，然后才能向这个已经擦除成功的扇区内写入数据。

• NbrOfDataToBeWritten表示本次要写入的数据的个数，注意STM32WB55写入数据时，必须以双字格式写入，即数据的最小写入单位是64bit，用字节表示的话，就是一次性要写入4个字节，因此这个变量表示的含义，是64bit的数据的个数，而非字节个数，这一点非常重要，因此如果要写满一个扇区，则需要写满 4096 / 8 = 512 个字节。我们一般是定义一个uint64_t的数组，然后将要写入的数据拼接成每4个字节一组，填充进该数组，然后将该数组的元素一个一个写进flash。

• FlashProcessStatus 表示flash擦写任务的执行结果，在双核系统运用中，我们专门启动一个后台任务来处理flash事务，这个任务执行一次，并不能保证flash擦写完全成功，因为在任务执行时，需要获取硬件信号量，如果暂时获取不到，任务就会先结束（不阻塞等待），并且返回FLASH_PROCESS_STARTED，表示这个任务的擦写操作还未完成，之后任务会被调度器重新启动，重新启动后的任务根据这个标志判断是要继续擦写flash。

• FlashOperationReq 表示任务执行的阶段，因为我们让擦除和写入操作都由同一个任务完成，那这个任务某一阶段到底是要运行擦除函数还是运行写入函数，就是靠这个变量做区分的。

  FlashProcessStatus和FlashOperationReq的作用，可以用如下这个图来表示：

• 系统中注册一个任务FlashOperationProc，用来专门负责flash区域数据的更新

• SHCI_C2_SetFlashActivityControl(FLASH_ACTIVITY_CONTROL_SEM7);

  这个函数在shci.h文件中有解释

    /**
    * SHCI_C2_SetFlashActivityControl
    * @brief Set the mechanism to be used on CPU2 to prevent the CPU1 to either write or erase in flash
    *
    * @param Source: It can be one of the following list
    *                -  FLASH_ACTIVITY_CONTROL_PES : The CPU2 set the PES bit to prevent the CPU1 to either read or write in flash
    *                -  FLASH_ACTIVITY_CONTROL_SEM7 : The CPU2 gets the semaphore 7 to prevent the CPU1 to either read or write in flash.
    *                                                 This requires the CPU1 to first get semaphore 7 before erasing or writing the flash.
    *
    * @retval Status
    */

  意思就是说通过该函数，让CPU2使用bit位还是使用信号量7来阻止CPU1对flash的读写。

• __HAL_FLASH_CLEAR_FLAG(FLASH_FLAG_OPTVERR);

  这句代码清空了FLASH由于上电可能导致的错误状态位，保证后面关于flash的HAL库函数能够正常运行，建议每次在处理有关flash的应用之前都调用这句代码对错误状态位清理一下

flash擦写任务

这几句代码理解完成后，我们接下来看执行flash擦写的专用任务函数FlashOperationProc

void FlashOperationProc(void)

这个FlashOperationProc任务，是官方给我们提供的现成可用的flash擦写任务，我们直接将这个任务函数添加到应用中即可，有关于该任务执行的步骤，我已经在代码中添加了注释，供大家参考，这里我带大家看一些关键点

首先，整个任务大的框架就是一个if，一个else，通过判断FlashOperationReq变量是FLASH_ERASE_REQ还是FLASH_WRITE_REQ来确定执行擦除还是写入，这个我们在分析FlashOperationReq变量的作用时已经说过了。

代码

first_secure_sector_idx = (READ_BIT(FLASH->SFR, FLASH_SFR_SFSA) >> FLASH_SFR_SFSA_Pos);

这里涉及一个flash寄存器，内容如下

STM32WB的主存储区（见上图flash划分）可以简单的分为两类，一类安全flash，专门存放BLE协议栈，一般处于主存储区的尾部，用户无法访问，另一类非安全flash，存放应用程序，放到主存储区的前面，用户可以访问，因此如果要向flash中写入数据，我们不仅要避开应用程序占用的flash区域，也要避开安全flash区域，这样安全flash的存储起始边界就很重要。官方的参考例程，是将要擦写的flash扇区放到安全flash前面，这样就能保证这块flash是空闲可用的，当然擦写的时候，不能超过扇区的大小，否则会碰到安全flash区域。我们可以通过下图直观的看到flash划分。

STM32WB不同系列flash大小不一样，安全flash的边界也不一样，我们可以通过读取FLASH->SFSA寄存器来获取安全flash的起始地址，以此来确定与应用程序的边界，获取到安全flash的起始地址后，我们往前让出几个扇区，然后把数据写入到这个扇区就行了。注意我们从这个寄存器中读到的数值，并不是直接可用的地址，而是该地址所在的扇区页的编号，例如我们读取flash为1MB的芯片，读到的值为CE，表示安全flash是从第CE（206）个扇区开始的。这样，变量first_secure_sector_idx就存放了安全flash扇区的起始编号。

接下来，将FlashProcessStatus变量值转成FLASH_PROCESS_STARTED，表示flash任务正在运行。

代码

NbrOfSectorToBeErased = FD_EraseSectors(first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS, NbrOfSectorToBeErased);

通过调用驱动函数FD_EraseSectors擦除指定的扇区，函数的第一个入口参数为要擦除的起始扇区的编号，这里我们把first_secure_sector_idx减去我们想要往前让出的扇区的个数，就是我们要擦除的扇区的编号，我们设置为4，从安全flash边界往前让出4个扇区进行擦除，第二个入口参数为要擦除的扇区的个数，我们设置为1，让其擦除一个扇区即可。

#define CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS   (4)

我们先不进FD_EraseSectors函数内部，先知道这个函数有个返回值，返回的是还没有被擦除的扇区的个数，只要返回值不是0，就说明还有扇区没有擦除完，如果是这样，则进代码

      /**
       * There are still sectors to be erased
       * Request the background to run one more time the task
       */
      UTIL_SEQ_SetTask( 1<<CFG_TASK_FLASH_OPERATION_REQ_ID, CFG_SCH_PRIO_0);
      return;

退出当前任务 ，重新激活当前任务，交由调度器重新调度，下次任务执行时继续擦除。

如果返回值为0，则进代码if(NbrOfSectorToBeErased == 0)中，变量值修改

      FlashOperationReq = FLASH_WRITE_REQ;
      FlashProcessStatus = FLASH_PROCESS_FINISHED;
      NbrOfSectorToBeErased = CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS;

其中FlashOperationReq修改，表示当前擦操作已经完成，接下来任务执行时，可以执行写操作。FlashProcessStatus修改，表示当前的flash擦除操作已经完成了，NbrOfSectorToBeErased值恢复为初始值，为后面任务再次被调用执行擦除时做准备。

接下来，进入for循环，执行代码

p_data_flash = (uint64_t*)(FLASH_BASE + ((loop1 + first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS)*FLASH_SECTOR_SIZE*1024));

表示从我们刚才擦除的地址开始读取数据，看是不是都擦写成了0xFF(flash被擦除后的数据就是0xFF)，通过(loop1 + first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS)来计算扇区下标，然后乘上FLASH_SECTOR_SIZE*1024即扇区下标对应的实际地址。

#define FLASH_SECTOR_SIZE                       (4)     /* a sector on stm32wb55xx is 4K bytes */

p_data_flash将存放要检查的扇区的起始地址，循环 for(loop2 = 0; loop2 < (FLASH_SECTOR_SIZE128); loop2++) 表示从当前这个p_data_flash地址开始，以双字（8个字节）为单位检查数据，扇区大小为4 * 1K，1K下有128个双字，那么4K下就有4128个双字，即一个扇区下要检查的双字个数，这样就确定好了循环次数，然后以64bit地址递增读取双字并判断即可。

然后我们看FlashOperationProc任务中，有关写入数据的操作

    NbrOfDataToBeWritten = FD_WriteData(FLASH_BASE
                                        + ((first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS)*FLASH_SECTOR_SIZE*1024)
                                        + (((CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS*512) - NbrOfDataToBeWritten)*8),
                                        FlashDataToWriteTab + (CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS*512) - NbrOfDataToBeWritten,
                                        NbrOfDataToBeWritten);

任务调用驱动函数FD_WriteData来实现数据的写入（写入数据前必须保证FLASH扇区已经被擦除），同样，我们先不进FD_WriteData函数里面查看细节，只要知道它用来写入数据就行，它的返回值是剩余的未写入的数据个数，这里的数据个数是以双字为单位的。函数的第一个入口参数是要写入的数据的目标地址，第二个入口参数是数据的源地址，第三个是要写入的数据个数，同样以双字为单位，我们来分析这个公式

FLASH_BASE + ((first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS)*FLASH_SECTOR_SIZE*1024)
                                        + (((CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS*512) - NbrOfDataToBeWritten)*8)

((first_secure_sector_idx - CFG_OFFSET_OF_FLASH_SECTOR_TO_PROCESS) * FLASH_SECTOR_SIZE * 1024)得到的是要写入的扇区首地址，(CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS*512)表示要处理的扇区里面双字单元的个数，这个数减去现在准备要写入的数据个数，再乘上8就是当前要写的数据的目标地址，这里的NbrOfDataToBeWritten有两层含义，一层表示本次准备要写入的数据个数，一层代表上次还有多少未写入，其实意思是一样的，归根结底还是因为我们的任务不能一次性将所有数据写入完成，任务需要执行很多次，这样上次未写完的数据个数，就自然而然成为本次准备要写入的数据个数了。我们通过下面这个图就能很好的理解地址为什么这么算了。

数据的源地址计算也是同样的道理，只不过这里我们每写完一个双字，指针往后递增一下就可以了。

代码

      for(loop1 = 0; loop1 < (CFG_NBR_OF_FLASH_SECTOR_TO_PROCESS*512); loop1++)

循环读取刚才写入的数据是否与源数据相等，验证写入过程，如果FD_WriteData的返回值不为0，则退出当前任务，并且激活任务，让调度器重新调度，继续写入过程，这跟擦除是一样的。

至此，我们的flash擦写任务代码分析完毕，我们做个总结：

• 这个任务被调度后，执行完毕并不一定完全擦除或者完全写入数据，它会根据驱动函数的返回值，重新启动自身，让调度器重新调度自己，重新尝试擦写
• 这个任务有两个关键变量，一个变量负责该任务本次做擦除还是写入，一个变量负责该任务继续之前的擦除或者写入，还是可以进入到下一个阶段。

驱动函数

好，接下来我们分析刚才漏掉的两个驱动函数，这两个函数在官方的驱动文件flash_driver.c文件中，先看擦除

  /**
   * @brief  Implements the Dual core algorithm to erase multiple sectors in flash with CPU1
   *         It calls for each sector to be erased the API FD_EraseSingleSector()
   *
   * @param  FirstSector:   The first sector to be erased
   *                        This parameter must be a value between 0 and (SFSA - 1)
   * @param  NbrOfSectors:  The number of sectors to erase
   *                        This parameter must be a value between 1 and (SFSA - FirstSector)
   * @retval Number of sectors not erased:
   *                        Depending on the implementation of FD_WaitForSemAvailable(),
   *                        it may still have some sectors not erased when the timing protection has been
   *                        enabled by either CPU1 or CPU2. When the value returned is not 0, the application
   *                        should wait until both timing protection before retrying to erase the last missing sectors.
   *
   *                        In addition, When the returned value is not 0:
   *                        - The Sem2 is NOT released
   *                        - The FLASH is NOT locked
   *                        - SHCI_C2_FLASH_EraseActivity(ERASE_ACTIVITY_OFF) is NOT called
   *                        It is expected that the user will call one more time this function to finish the process
   */
uint32_t FD_EraseSectors(uint32_t FirstSector, uint32_t NbrOfSectors);

在flash_driver.h文件中，有该函数的详细描述，这个函数专门用来在双核系统中执行多个扇区的擦除，第一个入口参数是第一个要被擦除的扇区的编号，第二个入口参数是要擦除的扇区的个数，返回值为还未擦除的扇区的个数，由于时序保护机制，所有的扇区并非可以在一个连续的时间段内完全擦除，因此当返回值非0时，应用程序需要等待定时保护结束再重新尝试擦除。函数内部通过变量single_flash_operation_status来确定扇区是否擦除成功，如果不成功，则修改对应的返回值，返回该函数，下次重新尝试。关键代码

  /**
   *  Take the semaphore to take ownership of the Flash IP
   */
  while(LL_HSEM_1StepLock(HSEM, CFG_HW_FLASH_SEMID));

  HAL_FLASH_Unlock();

  /**
   *  Notify the CPU2 that some flash erase activity may be executed
   *  On reception of this command, the CPU2 enables the BLE timing protection versus flash erase processing
   *  The Erase flash activity will be executed only when the BLE RF is idle for at least 25ms
   *  The CPU2 will prevent all flash activity (write or erase) in all cases when the BL RF Idle is shorter than 25ms.
   */
  SHCI_C2_FLASH_EraseActivity(ERASE_ACTIVITY_ON);

通过获取信号量来获取对flash的操作权，并且解锁flash，并通过shci指令向CPU2发送一个指令，通知CPU2 flash擦除操作将要执行，当CPU2接收到这个指令，它使能基于flash擦除的BLE时序保护处理机制，这种机制使得只有当 BLE RF 闲置至少 25ms 时，才会执行擦除闪存活动，当 BL RF 空闲时间短于 25 ms时，CPU2 在任何情况下都会阻止所有闪存活动（写入或擦除）。

接下来，调用循环体，循环擦除每个扇区

  for(loop_flash = 0; (loop_flash < NbrOfSectors) && (single_flash_operation_status ==  SINGLE_FLASH_OPERATION_DONE) ; loop_flash++)
  {
    single_flash_operation_status = FD_EraseSingleSector(FirstSector+loop_flash);
  }

循环体的截止条件除了扇区个数外，还有单次扇区擦除的结果状态，如果某个扇区擦除的状态为无效，则结束这个循环。之后通过代码

  if(single_flash_operation_status != SINGLE_FLASH_OPERATION_DONE)
  {
    return_value = NbrOfSectors - loop_flash + 1;
  }
  else
  {
    /**
     *  Notify the CPU2 there will be no request anymore to erase the flash
     *  On reception of this command, the CPU2 will disables the BLE timing protection versus flash erase processing
     *  The protection is active until next end of radio event.
     */
    SHCI_C2_FLASH_EraseActivity(ERASE_ACTIVITY_OFF);

    HAL_FLASH_Lock();

    /**
     *  Release the ownership of the Flash IP
     */
    LL_HSEM_ReleaseLock(HSEM, CFG_HW_FLASH_SEMID, 0);

    return_value = 0;
  }

返回还有多少个扇区未擦除，注意由于for循环，loop_flash至少会加1，因此这里有一个NbrOfSectors - loop_flash + 1的操作，总之return_value一定表示有多少个扇区没有处理完毕，如果当前要擦除的这个扇区没有处理完毕，也要算到没有处理的扇区里面。如果能够正常完成for循环，说明给定的扇区已经全部擦除完成，此时向CPU2 发送shci指令，告知擦除操作已经完成，CPU2于是禁用flash擦除相对应的时序保护，时序保护将持续到下一次RADIO事件结束。然后是FLASH上锁，释放flash使用信号量，这跟上面的操作是对称的。

接下来看单一扇区擦除函数，这个函数的入口参数只有一个，即需要擦除的扇区编号

  /**
   * @brief  Implements the Dual core algorithm to erase one sector in flash with CPU1
   *
   *         It expects the following point before calling this API:
   *         - The Sem2 is taken
   *         - The FLASH is unlocked
   *         - SHCI_C2_FLASH_EraseActivity(ERASE_ACTIVITY_ON) has been called
   *         It expects the following point to be done when no more sectors need to be erased
   *         - The Sem2 is released
   *         - The FLASH is locked
   *         - SHCI_C2_FLASH_EraseActivity(ERASE_ACTIVITY_OFF) is called
   *
   *         The two point above are implemented in FD_EraseSectors()
   *         This API needs to be used instead of FD_EraseSectors() in case a provided library is taking
   *         care of these two points and request only a single operation.
   *
   * @param  FirstSector:   The sector to be erased
   *                        This parameter must be a value between 0 and (SFSA - 1)
   * @retval: SINGLE_FLASH_OPERATION_DONE -> The data has been written
   *          SINGLE_FLASH_OPERATION_NOT_EXECUTED -> The data has not been written due to timing protection
   *                                         from either CPU1 or CPU2. On a failure status, the user should check
   *                                         both timing protection before retrying.
   */
  SingleFlashOperationStatus_t FD_EraseSingleSector(uint32_t SectorNumber);

函数的注释中写的很清楚，在调用这个函数前，需要获取flash信号量，flash解锁，通知CPU2 flash擦除要执行，结束这个函数调用后，使用对称的操作。函数的返回值是擦除的状态，成功或失败，失败是因为时序保护机制导致的。函数内部代码如下，注释写的很清楚，它做了一个小的等待后，直接调用函数ProcessSingleFlashOperation，这个函数很重要，负责擦写，第一个入口参数表示是擦除操作还是写入操作，第二个参数代表本次操作的扇区编号，第三个入口参数为0时无意义。我们接下来就到这个函数里面一探究竟。

SingleFlashOperationStatus_t FD_EraseSingleSector(uint32_t SectorNumber)
{
  SingleFlashOperationStatus_t return_value;
  
  /* Add at least 5us (CPU1 up to 64MHz) to guarantee that CPU2 can take SEM7 to protect BLE timing */ 
  for (volatile uint32_t i = 0; i < 35; i++);
  
  /* The last parameter is unused in that case and set to 0 */
  return_value =  ProcessSingleFlashOperation(FLASH_ERASE, SectorNumber, 0);

  return return_value;
}

代码如下：

static SingleFlashOperationStatus_t ProcessSingleFlashOperation(FlashOperationType_t FlashOperationType,
                                                                uint32_t SectorNumberOrDestAddress,
                                                                uint64_t Data)

这个函数是一个局部函数，没有头文件介绍，我们直接看内部执行流程，首先是局部变量

  SemStatus_t cpu1_sem_status;
  SemStatus_t cpu2_sem_status;
  WaitedSemStatus_t waited_sem_status;
  SingleFlashOperationStatus_t return_status;

  uint32_t page_error;
  FLASH_EraseInitTypeDef p_erase_init;

  waited_sem_status = WAITED_SEM_FREE;

  p_erase_init.TypeErase = FLASH_TYPEERASE_PAGES;
  p_erase_init.NbPages = 1;
  p_erase_init.Page = SectorNumberOrDestAddress;

两个硬件信号量状态cpu1_sem_status和cpu2_sem_status用来表示是否时序保护机制允许flash操作，等待状态waited_sem_status表示当时序保护机制阻止flash操作时应该如何处理。page_error将被HAL库函数使用，p_erase_init是HAL库函数调用时需要的入口结构体。我们还是按先全局，后局部的流程看这个函数。

接着代码

do
  {
    /**
     * When the PESD bit mechanism is used by CPU2 to protect its timing, the PESD bit should be polled here.
     * If the PESD is set, the CPU1 will be stalled when reading literals from an ISR that may occur after
     * the flash processing has been requested but suspended due to the PESD bit.
     *
     * Note: This code is required only when the PESD mechanism is used to protect the CPU2 timing.
     * However, keeping that code make it compatible with the two mechanisms.
     */
    while(LL_FLASH_IsActiveFlag_OperationSuspended());

    UTILS_ENTER_CRITICAL_SECTION();

    /**
     *  Depending on the application implementation, in case a multitasking is possible with an OS,
     *  it should be checked here if another task in the application disallowed flash processing to protect
     *  some latency in critical code execution
     *  When flash processing is ongoing, the CPU cannot access the flash anymore.
     *  Trying to access the flash during that time stalls the CPU.
     *  The only way for CPU1 to disallow flash processing is to take CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID.
     */
    cpu1_sem_status = (SemStatus_t)LL_HSEM_GetStatus(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID);
    if(cpu1_sem_status == SEM_LOCK_SUCCESSFUL)
    {
      /**
       *  Check now if the CPU2 disallows flash processing to protect its timing.
       *  If the semaphore is locked, the CPU2 does not allow flash processing
       *
       *  Note: By default, the CPU2 uses the PESD mechanism to protect its timing,
       *  therefore, it is useless to get/release the semaphore.
       *
       *  However, keeping that code make it compatible with the two mechanisms.
       *  The protection by semaphore is enabled on CPU2 side with the command SHCI_C2_SetFlashActivityControl()
       *
       */
      cpu2_sem_status = (SemStatus_t)LL_HSEM_1StepLock(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID);
      if(cpu2_sem_status == SEM_LOCK_SUCCESSFUL)
      {
        /**
         * When CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID is taken, it is allowed to only erase one sector or
         * write one single 64bits data
         * When either several sectors need to be erased or several 64bits data need to be written,
         * the application shall first exit from the critical section and try again.
         */
        if(FlashOperationType == FLASH_ERASE)
        {
          HAL_FLASHEx_Erase(&p_erase_init, &page_error);
        }
        else
        {
          HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, SectorNumberOrDestAddress, Data);
        }
        /**
         *  Release the semaphore to give the opportunity to CPU2 to protect its timing versus the next flash operation
         *  by taking this semaphore.
         *  Note that the CPU2 is polling on this semaphore so CPU1 shall release it as fast as possible.
         *  This is why this code is protected by a critical section.
         */
        LL_HSEM_ReleaseLock(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID, 0);
      }
    }

    UTILS_EXIT_CRITICAL_SECTION();

    if(cpu1_sem_status != SEM_LOCK_SUCCESSFUL)
    {
      /**
       * To avoid looping in ProcessSingleFlashOperation(), FD_WaitForSemAvailable() should implement a mechanism to
       * continue only when CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID is free
       */
      waited_sem_status = FD_WaitForSemAvailable(WAIT_FOR_SEM_BLOCK_FLASH_REQ_BY_CPU1);
    }
    else if(cpu2_sem_status != SEM_LOCK_SUCCESSFUL)
    {
      /**
       * To avoid looping in ProcessSingleFlashOperation(), FD_WaitForSemAvailable() should implement a mechanism to
       * continue only when CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID is free
       */
      waited_sem_status = FD_WaitForSemAvailable(WAIT_FOR_SEM_BLOCK_FLASH_REQ_BY_CPU2);
    }
  }
  while( ((cpu2_sem_status != SEM_LOCK_SUCCESSFUL) || (cpu1_sem_status != SEM_LOCK_SUCCESSFUL))
      && (waited_sem_status != WAITED_SEM_BUSY) );

这是一个相当大的循环，先执行，轮询PESD位，我们前面有提到过，时序保护有两种方式，一种是使用硬件信号量保护，另一种是通过这个PESD位，这个函数是为了兼容这两种方式，所以这里添加了对PESD位的轮询，这样，如果应用程序选择PESD位来做时序保护，也能直接调用这个函数。在使用PESD位来做时序保护时，如果这个位置置1，则CPU1会停到这里，直到等到PESD位清零再执行下面的flash操作，然后调用UTILS_ENTER_CRITICAL_SECTION代码进入临界段，在多任务操作系统中，要在此处检查是否有其他任务阻止flash操作，当flash处理正在进行时，CPU 不能再访问闪存，在此期间尝试访问flash会导致 CPU 停止运行，

CPU1 禁止闪存处理的唯一方法是采取 CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID信号量。因此这里调用代码

cpu1_sem_status = (SemStatus_t)LL_HSEM_GetStatus(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID);

来获取硬件信号量，查看是否有其他任务在执行flash操作，如果这个信号量能拿到，则继续获取CPU2信号量

cpu2_sem_status = (SemStatus_t)LL_HSEM_1StepLock(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID);

如果这个信号量也能拿到，说明CPU2目前没有做时序保护，可以进行flash操作，要注意，CPU2默认使用的是PESD位来做时序保护，因此最前面的通过shci指令通知CPU2使用硬件信号量作为时序保护方法的代码很重要。

当两个硬件信号量全部获取到，此时可以执行的操作是，擦除一个扇区或者写一个双字数据到flash，如果有更多扇区需要擦除或者更多数据写入，则需要退出当前临界段代码重新进入该函数继续执行。接下来根据传进来的第一个入口参数，决定是擦除还是写数据。

        if(FlashOperationType == FLASH_ERASE)
        {
          HAL_FLASHEx_Erase(&p_erase_init, &page_error);
        }
        else
        {
          HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, SectorNumberOrDestAddress, Data);
        }

这里就直接调用HAL库函数去处理了，我们后面再分析这两个库函数。

接下来

LL_HSEM_ReleaseLock(HSEM, CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID, 0);

释放CPU2硬件信号量，由于CPU2会轮询这个信号量，因此要尽快释放，使得CPU2有机会执行下一次flash操作时对应的时序保护操作，这也是为什么这段代码处于临界段的原因。

然后退出临界段。

接下来执行判断

    if(cpu1_sem_status != SEM_LOCK_SUCCESSFUL)
    {
      /**
       * To avoid looping in ProcessSingleFlashOperation(), FD_WaitForSemAvailable() should implement a mechanism to
       * continue only when CFG_HW_BLOCK_FLASH_REQ_BY_CPU1_SEMID is free
       */
      waited_sem_status = FD_WaitForSemAvailable(WAIT_FOR_SEM_BLOCK_FLASH_REQ_BY_CPU1);
    }
    else if(cpu2_sem_status != SEM_LOCK_SUCCESSFUL)
    {
      /**
       * To avoid looping in ProcessSingleFlashOperation(), FD_WaitForSemAvailable() should implement a mechanism to
       * continue only when CFG_HW_BLOCK_FLASH_REQ_BY_CPU2_SEMID is free
       */
      waited_sem_status = FD_WaitForSemAvailable(WAIT_FOR_SEM_BLOCK_FLASH_REQ_BY_CPU2);
    }

函数 FD_WaitForSemAvailable 的内容如下：

__WEAK WaitedSemStatus_t FD_WaitForSemAvailable(WaitedSemId_t WaitedSemId)
{
  /**
   * The timing protection is enabled by either CPU1 or CPU2. It should be decided here if the driver shall
   * keep trying to erase/write the flash until successful or if it shall exit and report to the user that the action
   * has not been executed.
   * WAITED_SEM_BUSY returns to the user
   * WAITED_SEM_FREE keep looping in the driver until the action is executed. This will result in the current stack looping
   * until this is done. In a bare metal implementation, only the code within interrupt handler can be executed. With an OS,
   * only task with higher priority can be processed
   *
   */
  return WAITED_SEM_BUSY;
}

这两个判断其实很精妙，其实这个函数FD_WaitForSemAvailable中的内容是可以根据入口参数进行修改的，当我们前面获取信号量失败后，可以通过这个函数，确定既然失败了，是继续往下走，还是循环的检查直至获取到信号量，而且两个信号量到底哪个获取不到，需要循环检查，这些是可以通过FD_WaitForSemAvailable来定制的，比方我们可以将FD_WaitForSemAvailable的内容设置为，获取不到CPU1硬件信号量时，返回WAITED_SEM_FREE，这样可以在CPU1信号量未获取到时继续执行循环，当获取不到CPU2硬件信号量时，返回WAITED_SEM_BUSY，使其退出当前循环。

我们现在看的例程里面FD_WaitForSemAvailable并没有对入口参数进行区分，都是返回WAITED_SEM_BUSY，那就只要两个其中一个获取不到，就退出当前循环。

最后是循环的判断条件

  while( ((cpu2_sem_status != SEM_LOCK_SUCCESSFUL) || (cpu1_sem_status != SEM_LOCK_SUCCESSFUL))
      && (waited_sem_status != WAITED_SEM_BUSY) );

只要其中一个信号量没有获取成功，并且FD_WaitForSemAvailable的返回值为WAITED_SEM_FREE，则继续这个循环，我们目前返回值都是BUSY，那自然而然只要有一个信号量获取失败，循环就结束了。

然后是等待FLASH忙标记

while(__HAL_FLASH_GET_FLAG(FLASH_FLAG_CFGBSY));

接着

  if(waited_sem_status != WAITED_SEM_BUSY)
  {
    /**
     * The flash processing has been done. It has not been checked whether it has been successful or not.
     * The only commitment is that it is possible to request a new flash processing
     */
    return_status = SINGLE_FLASH_OPERATION_DONE;
  }
  else
  {
    /**
     * The flash processing has not been executed due to timing protection from either the CPU1 or the CPU2.
     * This status is reported up to the user that should retry after checking that each CPU do not
     * protect its timing anymore.
     */
    return_status = SINGLE_FLASH_OPERATION_NOT_EXECUTED;
  }

由于waited_sem_status初始值为free，如果是busy则一定获取信号量失败，并且循环退出了，因为如果是free，则循环一定会执行，此时busy说明操作没有完成，返回未完成状态，如果是free，则操作完毕，循环结束，返回完成状态。

这是擦除驱动函数，接下来看写入数据驱动函数

  /**
   * @brief  Implements the Dual core algorithm to write multiple 64bits data in flash with CPU1
   *         The user shall first make sure the location to be written has been first erase.
   *         Otherwise, the API will loop for ever as it will be not able to write in flash
   *         The only value that can be written even though the destination is not erased is 0.
   *         It calls for each 64bits to be written the API FD_WriteSingleData()
   *
   * @param  DestAddress: Address of the flash to write the first data. It shall be 64bits aligned
   * @param  pSrcBuffer:  Address of the buffer holding the 64bits data to be written in flash
   * @param  NbrOfData:   Number of 64bits data to be written
   * @retval Number of 64bits data not written:
   *                      Depending on the implementation of FD_WaitForSemAvailable(),
   *                      it may still have 64bits data not written when the timing protection has been
   *                      enabled by either CPU1 or CPU2. When the value returned is not 0, the application
   *                      should wait until both timing protection before retrying to write the last missing 64bits data.
   *
   *                      In addition, When the returned value is not 0:
   *                        - The Sem2 is NOT released
   *                        - The FLASH is NOT locked
   *                        It is expected that the user will call one more time this function to finish the process
   */
  uint32_t FD_WriteData(uint32_t DestAddress, uint64_t * pSrcBuffer, uint32_t NbrOfData);

注释中提到，要调用这个函数前必须保证扇区已经被擦除，否则这个API将一直循环，未擦除时只能写入数据0，第一个入口参数时要写入的地址，第二个是源数据的地址，第三个是要写入的双字的个数。

进入函数内部，single_flash_operation_status变量作用同擦除驱动函数一样，记录单次flash操作状态，然后是获取信号量，解锁flash，接着调用循环体

  for(loop_flash = 0; (loop_flash < NbrOfData) && (single_flash_operation_status ==  SINGLE_FLASH_OPERATION_DONE) ; loop_flash++)
  {
    single_flash_operation_status = FD_WriteSingleData(DestAddress+(8*loop_flash), *(pSrcBuffer+loop_flash));
  }

这一步也跟擦除一样，循环结束，如果返回值非0，表示的是未写入的双字的个数。

然后调用

  /**
   * @brief  Implements the Dual core algorithm to write one 64bits data in flash with CPU1
   *         The user shall first make sure the location to be written has been first erase.
   *         Otherwise, the API will loop for ever as it will be not able to write in flash
   *         The only value that can be written even though the destination is not erased is 0.
   *
   *         It expects the following point before calling this API:
   *         - The Sem2 is taken
   *         - The FLASH is unlocked
   *         It expects the following point to be done when no more sectors need to be erased
   *         - The Sem2 is released
   *         - The FLASH is locked
   *
   *         The two point above are implemented in FD_WriteData()
   *         This API needs to be used instead of FD_WriteData() in case a provided library is taking
   *         care of these two points and request only a single operation.
   *
   * @param  DestAddress: Address of the flash to write the data. It shall be 64bits aligned
   * @param  Data:  64bits Data to be written
   * @retval: SINGLE_FLASH_OPERATION_DONE -> The data has been written
   *          SINGLE_FLASH_OPERATION_NOT_EXECUTED -> The data has not been written due to timing protection
   *                                         from either CPU1 or CPU2. On a failure status, the user should check
   *                                         both timing protection before retrying.
   */
  SingleFlashOperationStatus_t FD_WriteSingleData(uint32_t DestAddress, uint64_t Data);

注意这个函数第一个入口参数传入的是要写入数据的地址，因此在前面的循环体中，因为每次是写入双字，即8个字节，因此每次循环有DestAddress+(8*loop_flash)，而pSrcBuffer本身是双字指针，因此只要自身递增就可以，我们看到FD_WriteSingleData第一个入口参数不变，还是数据要写入的地址，第二个入口参数变成了要写入的数据值，这里一定要注意。函数的返回值的含义跟FD_EraseSingleSector是一样的，内容

SingleFlashOperationStatus_t FD_WriteSingleData(uint32_t DestAddress, uint64_t Data)
{
  SingleFlashOperationStatus_t return_value;

  return_value =  ProcessSingleFlashOperation(FLASH_WRITE, DestAddress, Data);

  return return_value;
}

这里最终调用ProcessSingleFlashOperation函数，只不过这里传的第一个参数成了FLASH_WRITE，第三个参数不为0了，ProcessSingleFlashOperation前面已经分析过了，这里不再赘述。

HAL库函数

我们接下来看ProcessSingleFlashOperation中的两个库函数，一个用来擦除，擦除时，传入的参数为

HAL_FLASHEx_Erase(&p_erase_init, &page_error);

注意，要擦除的扇区编号已经在前面传给了结构体p_erase_init

  p_erase_init.TypeErase = FLASH_TYPEERASE_PAGES;
  p_erase_init.NbPages = 1;
  p_erase_init.Page = SectorNumberOrDestAddress;

这个函数的内容如下

/**
  * @brief  Perform an erase of the specified FLASH memory pages.
  * @note   Before any operation, it is possible to check there is no operation suspended
  *         by call HAL_FLASHEx_IsOperationSuspended()
  * @param[in]  pEraseInit Pointer to an @ref FLASH_EraseInitTypeDef structure that
  *         contains the configuration information for the erasing.
  * @param[out]  PageError Pointer to variable that contains the configuration
  *         information on faulty page in case of error (0xFFFFFFFF means that all
  *         the pages have been correctly erased)
  * @retval HAL Status
  */
HAL_StatusTypeDef HAL_FLASHEx_Erase(FLASH_EraseInitTypeDef *pEraseInit, uint32_t *PageError)
{
  HAL_StatusTypeDef status;
  uint32_t index;

  /* Check the parameters */
  assert_param(IS_FLASH_TYPEERASE(pEraseInit->TypeErase));

  /* Process Locked */
  __HAL_LOCK(&pFlash);

  /* Reset error code */
  pFlash.ErrorCode = HAL_FLASH_ERROR_NONE;

  /* Verify that next operation can be proceed */
  status = FLASH_WaitForLastOperation(FLASH_TIMEOUT_VALUE);

  if (status == HAL_OK)
  {
    if (pEraseInit->TypeErase == FLASH_TYPEERASE_PAGES)
    {
      /*Initialization of PageError variable*/
      *PageError = 0xFFFFFFFFU;

      for (index = pEraseInit->Page; index < (pEraseInit->Page + pEraseInit->NbPages); index++)
      {
        /* Start erase page */
        FLASH_PageErase(index);

        /* Wait for last operation to be completed */
        status = FLASH_WaitForLastOperation(FLASH_TIMEOUT_VALUE);

        if (status != HAL_OK)
        {
          /* In case of error, stop erase procedure and return the faulty address */
          *PageError = index;
          break;
        }
      }

      /* If operation is completed or interrupted, disable the Page Erase Bit */
      FLASH_AcknowledgePageErase();
    }

    /* Flush the caches to be sure of the data consistency */
    FLASH_FlushCaches();
  }

  /* Process Unlocked */
  __HAL_UNLOCK(&pFlash);

  return status;
}

这个函数最终会调用FLASH_PageErase实现扇区的擦除，注意这里擦除时只擦除一个扇区，多个扇区擦除是要循环调用单个扇区擦除的函数的。

写入函数

HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, SectorNumberOrDestAddress, Data);

内容也比较简单

/**
  * @brief  Program double word or fast program of a row at a specified address.
  * @note   Before any operation, it is possible to check there is no operation suspended
  *         by call HAL_FLASHEx_IsOperationSuspended()
  * @param  TypeProgram Indicate the way to program at a specified address
  *                       This parameter can be a value of @ref FLASH_TYPE_PROGRAM
  * @param  Address Specifies the address to be programmed.
  * @param  Data Specifies the data to be programmed
  *                This parameter is the data for the double word program and the address where
  *                are stored the data for the row fast program.
  *
  * @retval HAL_StatusTypeDef HAL Status
  */
HAL_StatusTypeDef HAL_FLASH_Program(uint32_t TypeProgram, uint32_t Address, uint64_t Data)
{
  HAL_StatusTypeDef status;

  /* Check the parameters */
  assert_param(IS_FLASH_TYPEPROGRAM(TypeProgram));
  assert_param(IS_ADDR_ALIGNED_64BITS(Address));
  assert_param(IS_FLASH_PROGRAM_ADDRESS(Address));

  /* Process Locked */
  __HAL_LOCK(&pFlash);

  /* Reset error code */
  pFlash.ErrorCode = HAL_FLASH_ERROR_NONE;

  /* Verify that next operation can be proceed */
  status = FLASH_WaitForLastOperation(FLASH_TIMEOUT_VALUE);

  if (status == HAL_OK)
  {
    if (TypeProgram == FLASH_TYPEPROGRAM_DOUBLEWORD)
    {
      /* Check the parameters */
      assert_param(IS_FLASH_PROGRAM_ADDRESS(Address));

      /* Program double-word (64-bit) at a specified address */
      FLASH_Program_DoubleWord(Address, Data);
    }
    else
    {
      /* Check the parameters */
      assert_param(IS_FLASH_FAST_PROGRAM_ADDRESS(Address));

      /* Fast program a 64 row double-word (64-bit) at a specified address */
      FLASH_Program_Fast(Address, (uint32_t)Data);
    }

    /* Wait for last operation to be completed */
    status = FLASH_WaitForLastOperation(FLASH_TIMEOUT_VALUE);

    /* If the program operation is completed, disable the PG or FSTPG Bit */
    CLEAR_BIT(FLASH->CR, TypeProgram);
  }

  /* Process Unlocked */
  __HAL_UNLOCK(&pFlash);

  /* return status */
  return status;
}

结构也同擦除一样，会执行写入一个双字的操作，最终操作的还是寄存器。

至此，我们完成了STM32WB55 双核系统应用下flash擦写代码的解析！