Firmware updates and flash banks on an STM32L496

[cambesol]

Hello Forum,

I have a question regarding OTA and toggling between flash banks on a STM32L496. I have read many forum posts on here relating to this and I have reached a point where I need assistance as debugging iteratively is taking a lot of time.

I am developing a firmware update process that has the update code as part of the application, not as part of the bootloader. Serial messages are received containing the binary data (derived from a *.bin image) and are written to the flash bank which is currently not in use.

The part has a flash memory layout as follows:

Flash Area	Memory start address	Size	Name
BANK 1	0x0800 0000	2k	page 0
	0x0800 0800	2k	page 1
	0x0800 1000	2k	page 2
	...
	0x0807 F800	2k	page 255
BANK 2	0x0808 0000	2k	page 256
	0x0808 0800	2k	page 257
	0x0808 1000	2k	page 258
	...
	0x080F F800	2k	page 511

If I have freshly reprogrammed the part using the ST-Linkv2 programmer, the code checks which bank the image is running from as follows:

uint32_t fb_mode = LL_SYSCFG_GetFlashBankMode();
if (fb_mode == 0)
{
    /* Running from BANK 1 */
}
else
{
   /* Running from BANK 2 */
}

I then erase all 255 pages of the flash bank which I am not running in. Once this completes successfully, I write sequentially to the bank I want to run from after the OTA is completed. Without labouring the point, if I was running from Bank 1, then I would perform the following pseudo operations:

HAL_StatusTypeDef status = HAL_OK;
uint64_t *ptr = buffer; /* Contiguous array of 256 bytes of binary image. */

status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08080000, *ptr++);
status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08080800, *ptr++);
status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08081000, *ptr++);

This is performed in a loop and the pointer is updated to match the wrte-size. The point I am trying to make is the addresses of the writes are dendent on which block the image is running from.

If I was running from flash bank 2, I would expect the following:

status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08000000, *ptr++);
status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08000800, *ptr++);
status = HAL_FLASH_Program(FLASH_TYPEPROGRAM_DOUBLEWORD, 0x08001000, *ptr++);

Here we are writing directly to Bank 1. After this is completed, I would update the flash Options Bytes as follows:

/* Get the current configuration */
HAL_FLASHEx_OBGetConfig(&obConfig);
uint32_t fb_mode = LL_SYSCFG_GetFlashBankMode();
if (fb_mode == 0) {
/* Explicitly boot from Bank 2 following reset
* as we are running from Bank 1. 
*/
    obConfig.USERConfig = OB_BFB2_ENABLE;
}
else {
/* Explicitly boot from Bank 1 following reset
* as we are running from Bank 2. 
*/
    obConfig.USERConfig = OB_BFB2_DISABLE;
}
/* Initiating the modifications */
result = HAL_FLASH_Unlock();
/* program if unlock is successful */
if (result == HAL_OK) {
    result = HAL_FLASH_OB_Unlock();
}
/* Program if unlock is successful. */
if ((READ_BIT(FLASH->CR, FLASH_CR_OPTLOCK) == RESET)) {
    result = HAL_FLASHEx_OBProgram(&obConfig);
}
/* No return as the last call triggers a reset. */

The problem I have is that this sequence works perfectly until the second OTA and at that point I cannot write to the Bank 1 first address. I have read on these forums that OTA updates should always be written to Bank 2 and the swapping is provided automatically by the OB_OFB2_ENABLE/DISABLE mechanism. I just need to confirm that this is the case or do I inspect the fb_mode value and write to the flash bank which I am not running from.

Thank you for any help that you can offer.