Can I implement STM32F7 bank switch via option bytes and Level2, chip protection?

[ASiem.3]

Hi,

we are using dual bank mode for stable firmware update. We simply set bootaddr0 in option bytes to the opposite bank and reboot the new firmware. Everything works fine.

Now we want to enable Level2 chip protection for security reasons. Now I read that one cannot change option bytes in Level2 protection mode.

The question is if this still works in Level2 protection mode? And if not how do you implement bank switch in Level2 protection mode.

Here the current code:

         // Check current setup and toggle boot address

         if( flash_getBankInfo() != 1 ){

            obInit.BootAddr0 = BANK1_ADDR;

         }

         else {

            obInit.BootAddr0 = BANK2_ADDR;

         }

         // Program new boot address

         obInit.OptionType = OPTIONBYTE_BOOTADDR_0;

         rc = HAL_FLASHEx_OBProgram(&obInit);

[GLASS]

I think that option bytes update for each update is not a good idea.

What can happen if power lost or unexpected event during this critical write?

Combined with RDP2 level​ if you lost dualbankmode option you can brick the board...

On F4 we use remap to swap bank from our bootloader

Use ram function is necessary to avoid bad fetch during bank swap.

See an4767 (not for f7 so you need to give a look in RM to adapt...)​

​

[ASiem.3]

Thanks GLASS, yes I was mainly looking for some sample code as all application notes I read just explained what to do but never how. Now I found some sample code that uses remapping. Since we use HAL I discovered that there even is a HAL function for swapping banks.

[Piranha]

> we are using dual bank mode for stable firmware update.

Not only you don't need dual bank and dual boot feature for reliable firmware update, but it's actually harder to do that with dual boot.

The reference manual shows it very clearly that at RDP level 2 option bytes cannot be modified. And, as GLASS already said, it's a bad idea in general, because it is dangerous and also wears out flash for option bytes uselessly.

https://community.st.com/s/question/0D53W00000LeYBeSAN/booting-with-dual-flash-banks-vs-bank-swap

Just implement a normal bootloader:

https://community.st.com/s/question/0D50X0000AFpTmUSQV/using-nvicsystemreset-in-bootloaderapplication-jumps

[ASiem.3]

Thanks Piranha, yes I'm aware of the drawbacks of using option byte rewrite.

And yes, we have a bootloader in place that works just fine. And we swap only if we update firmware which is not happening often.