stlink Tools
st-flash · st-info · st-util · st-trace

# Debian / Ubuntu — the package is called stlink-tools
sudo apt install stlink-tools

# Arch
sudo pacman -S stlink

# macOS (Homebrew)
brew install stlink

# From source (newest features: --area, --freq, --connect-under-reset)
git clone https://github.com/stlink-org/stlink.git
cd stlink
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j$(nproc)
sudo cmake --install build

# Verify — every tool accepts --version
st-info --version
st-flash --version

# Rules ship with the source tree (config/udev/rules.d/)
sudo cp stlink/config/udev/rules.d/*.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules
sudo udevadm trigger

# If your distro package installed them, they are usually already in
# /lib/udev/rules.d/  (e.g. 49-stlinkv2-1.rules, 49-stlinkv3.rules)

st-info --version
st-info --probe    [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --serial   [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --flash    [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --pagesize [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --sram     [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --chipid   [--connect-under-reset] [--hot-plug] [--freq=<kHz>]
st-info --descr    [--connect-under-reset] [--hot-plug] [--freq=<kHz>]

st-info --probe

Found 1 stlink programmers
  version:    V2J39S7          # V2 probe, JTAG fw J39, SWIM fw S7
  serial:     0673FF...        # unique probe serial (used with --serial)
  flash:      2097152 (pagesize: 8192)   # 2 MB, 8 KB pages (single-bank)
  sram:       655360           # 640 KB
  chipid:     0x470            # DEV_ID for STM32L4Rxx / L4Sxx
  dev-type:   L4Rx

usage: st-flash [options] read  [file] [addr] [size]
       st-flash [options] write <file> [addr] [size]
       st-flash [options] write <value>
       st-flash [options] erase [addr] [size]
       st-flash [options] reset

options:
  --freq <kHz>            JTAG/SWD frequency, default 1800 kHz
  --serial <serial>       select probe by serial (see st-info --serial)
  --connect-under-reset  pull NRST low while connecting
  --hot-plug             connect without resetting the target
  --reset                reset the target after writing
  --mass-erase           mass-erase the whole chip before writing
  --format {binary|ihex} file format (ihex carries its own address)
  --flash <size>          override detected flash size, e.g. 2M, 128k
  --area <area>           main(default)|system|otp|option|option_boot_add|optcr|optcr1
  --opt                  skip trailing empty (0xFF) bytes
  --debug                extra debug output
  --version / --help

# 1. ELF -> raw binary (strips ELF headers, keeps loadable sections)
arm-none-eabi-objcopy -O binary firmware.elf firmware.bin

# 2. Flash at the main-flash base 0x08000000
st-flash write firmware.bin 0x08000000

# 3. Reset into the new firmware (or add --reset to step 2)
st-flash reset

/* STM32L4R5 register-level blinky — RM0432 addresses */
#include <stdint.h>

#define RCC_BASE      0x40021000UL
#define RCC_AHB2ENR   (*(volatile uint32_t *)(RCC_BASE + 0x4C))
#define GPIOB_BASE    0x48000400UL
#define GPIOB_MODER   (*(volatile uint32_t *)(GPIOB_BASE + 0x00))
#define GPIOB_BSRR    (*(volatile uint32_t *)(GPIOB_BASE + 0x18))
#define LED_PIN       7u          /* PB7 = LD2 (blue) on Nucleo-L4R5ZI */

static void delay(volatile uint32_t n) { while (n--) __asm__ volatile("nop"); }

int main(void) {
    RCC_AHB2ENR |= (1u << 1);                   /* GPIOBEN */
    GPIOB_MODER &= ~(3u << (LED_PIN * 2));       /* clear mode bits   */
    GPIOB_MODER |=  (1u << (LED_PIN * 2));       /* 01 = general output */

    for (;;) {
        GPIOB_BSRR = (1u << LED_PIN);            /* BSy: set   pin high */
        delay(400000);
        GPIOB_BSRR = (1u << (LED_PIN + 16));     /* BRy: reset pin low  */
        delay(400000);
    }
}

#include <stdint.h>

extern uint32_t _sidata, _sdata, _edata, _sbss, _ebss, _estack;
int  main(void);

void Reset_Handler(void) {
    uint32_t *src = &_sidata, *dst = &_sdata;
    while (dst < &_edata) *dst++ = *src++;      /* copy .data  flash->RAM */
    for (dst = &_sbss; dst < &_ebss; ) *dst++ = 0; /* zero .bss           */
    main();
    for (;;);
}
void Default_Handler(void) { for (;;); }

/* First two words: initial MSP, then Reset_Handler — MUST be at flash base */
__attribute__((section(".isr_vector"), used))
void (* const g_vectors[])(void) = {
    (void (*)(void))&_estack,   /* 0x08000000: initial stack pointer */
    Reset_Handler,              /* 0x08000004: reset vector          */
    Default_Handler,            /* NMI       */
    Default_Handler,            /* HardFault */
};

ENTRY(Reset_Handler)

MEMORY {
  FLASH (rx)  : ORIGIN = 0x08000000, LENGTH = 2048K
  RAM   (rwx) : ORIGIN = 0x20000000, LENGTH = 640K
}
_estack = ORIGIN(RAM) + LENGTH(RAM);   /* 0x200A0000 (top of SRAM) */

SECTIONS {
  .isr_vector : { KEEP(*(.isr_vector)) }          > FLASH
  .text       : { *(.text*) *(.rodata*) }         > FLASH
  _sidata = LOADADDR(.data);
  .data : { _sdata = .; *(.data*) _edata = .; }    > RAM AT > FLASH
  .bss  : { _sbss = .; *(.bss*) *(COMMON) _ebss = .; } > RAM
}

# Cortex-M4F: hard-float ABI, single-precision FPU
arm-none-eabi-gcc -mcpu=cortex-m4 -mthumb \
    -mfpu=fpv4-sp-d16 -mfloat-abi=hard \
    -Os -Wall -ffreestanding -nostdlib \
    -T minimal.ld startup.c main.c -o firmware.elf

arm-none-eabi-objcopy -O binary firmware.elf firmware.bin
st-flash --reset write firmware.bin 0x08000000

# Read back exactly as many bytes as the .bin, then compare
SIZE=$(stat -c %s firmware.bin)
st-flash read readback.bin 0x08000000 $SIZE
cmp firmware.bin readback.bin && echo "MATCH"

# Dump the first 4 KB of flash (bootloader/vector inspection)
st-flash read dump.bin 0x08000000 0x1000

# Dump the ENTIRE 2 MB flash
st-flash read full_flash.bin 0x08000000 0x200000

# Read the 96-bit unique device ID (12 bytes @ 0x1FFF7590)
st-flash read uid.bin 0x1FFF7590 0xC
xxd uid.bin

# Full-chip mass erase (no address = wipe everything)
st-flash erase

# Targeted section erase: one 8 KB page at 0x08004000
st-flash erase 0x08004000 0x2000

# Mass-erase implicitly, then program, then reset — one shot
st-flash --mass-erase --reset write firmware.bin 0x08000000

# Read the current option-byte word
st-flash --area=option read optbytes.bin 0x4

# RDP levels (byte at bits [7:0] of the option register):
#   0xAA = Level 0 (no protection)
#   0xBB = Level 1 (debug blocked; user flash inaccessible)
#   0xCC = Level 2 (PERMANENT lock — never write this!)

# Un-brick: force RDP back to Level 0 -> triggers a full mass erase.
# Value depends on the other option bits; read first, then write the
# modified word with the RDP field set to 0xAA.
st-flash --area=option write 0xFFEFF8AA

st-util [options]

  -h, --help                 Print this help
  -V, --version              Print the version
  -v, --verbose[=N]          Verbose logging (0..99)
  -p, --listen_port=PORT     GDB server listen port (default: 4242)
  -m, --multi                Extended mode: keep listening after GDB disconnects
  -n, --no-reset, --hot-plug Do not reset the board on connection
  -u, --connect-under-reset  Attach while holding NRST low
  -F, --freq=1M              SWD/JTAG frequency (e.g. 1800k, 1M, 4M)
      --semihosting          Enable ARM semihosting (printf via debugger)
      --serial <serial>      Select probe by serial number

st-util
# st-util 1.8.0
# Listening at *:4242...

# Keep the server alive across GDB restarts:
st-util -m --semihosting

arm-none-eabi-gdb firmware.elf

# inside gdb:
(gdb) target extended-remote localhost:4242
(gdb) load                 # flash the ELF's sections into the STM32
(gdb) monitor reset        # st-util: also 'halt', 'resume', 'jtag_reset'
(gdb) tbreak main          # temporary breakpoint at main()
(gdb) continue
(gdb) info registers
(gdb) stepi                # single-step one instruction
(gdb) x/4xw 0x08000000     # dump reset vector: MSP then Reset_Handler
(gdb) print/x *(uint32_t*)0xE0042000   # DBGMCU_IDCODE -> 0x....0470

st-trace [options]

  -h, --help            Print this help
  -V, --version         Print the version
  -v, --verbose[=N]     Verbosity level (0..99)
  -c, --clock=XX        Core (HCLK) frequency; suffix k/m/g  (e.g. --clock=120m)
  -t, --trace=XX        SWO trace frequency; suffix k/m/g    (e.g. --trace=2m)
  -n, --no-reset        Do not reset the board on connection
  -s, --serial=XX       Select probe by serial number
  -f, --force           Ignore most initialization errors

# Core running at 120 MHz, SWO at 2 MHz. Stop the running firmware first
# is not needed; st-trace resets and configures trace, then streams.
st-trace --clock=120m --trace=2m

# If init is fussy (already-running target), relax with --force / --no-reset
st-trace -c 120m -t 2m --no-reset --force

#include <stdint.h>

#define ITM_PORT0  (*(volatile uint32_t *)0xE0000000)  /* stimulus port 0     */
#define ITM_TER    (*(volatile uint32_t *)0xE0000E00)  /* trace enable regs   */

static void itm_putc(char c) {
    if (ITM_TER & 1u) {                       /* port 0 enabled by st-trace */
        while ((ITM_PORT0 & 1u) == 0) { }     /* wait until FIFO ready      */
        *(volatile uint8_t *)0xE0000000 = (uint8_t)c;  /* 8-bit write */
    }
}

void itm_puts(const char *s) { while (*s) itm_putc(*s++); }

/* in main(): itm_puts("hello from L4R5 over SWO\r\n"); */