🛠 Mise à jour OTA par bascule de banque sur le STM32H743ZI : 2 Mo de flash double banque

What you will build

The STM32H743ZI's 2 MB flash is dual-bank — the board sheet calls out bank-swap OTA updates as a headline feature. This tutorial designs the update scheme: run from bank 1, download a new image into bank 2, verify, swap, and keep a rollback path — plus the 4 KB backup SRAM (with its SB156 test jumper) as the place to keep the boot decision across power loss.

Architecture

• Bank 1: running application (boot address region).
• Bank 2: staging area for the incoming image.
• A small bootloader (or a well-tested app-resident updater) decides the bank at start-up.
• Backup SRAM (4 KB, VBAT-domain): boot counter / "image good" flag — survives resets and, with VBAT applied, power cycles. The board even ships a backup-SRAM test jumper (SB156) for VBAT experiments.

Step 1 — Flash the staging bank

/* Erase + program the new image into bank 2 (HAL, STM32H7). */
FLASH_EraseInitTypeDef er = {
  .TypeErase    = FLASH_TYPEERASE_SECTORS,
  .Banks        = FLASH_BANK_2,
  .Sector       = 0,
  .NbSectors    = 9,          /* cover the image area - size for YOUR layout */
  .VoltageRange = FLASH_VOLTAGE_RANGE_3
};
uint32_t sec_err;
HAL_FLASHEx_Erase(&er, &sec_err);

/* Program in 256-bit (32-byte) flash words as required by the H7 family. */
HAL_FLASH_Program(FLASH_TYPEPROGRAM_FLASHWORD, bank2_dst, (uint32_t)chunk, chunk_len);

Step 2 — Verify, then swap

1. Hash or CRC the written bank 2 content and compare against the manifest sent with the image.
2. Arm the swap: write the boot flag into backup SRAM *before* touching bank configuration, so a power cut mid-update leaves a defined state.
3. Reconfigure the bank mapping (option bytes / bank swap) so bank 2 becomes the execution base, then reset.

Step 3 — Rollback policy

On boot: if the backup-SRAM "image good" flag is absent after N attempts, swap back to the previous bank. Because both banks hold complete images, rollback is a remap, not a reflash.

Expected result

You can push a new firmware over your transport (the LwIP tutorial's Ethernet is the obvious carrier), watch the board reboot into the new image, and pull the plug mid-transfer without bricking: the old bank stays bootable until the swap is armed.

Common pitfalls

• Erasing the bank you are executing from: bank 2 is the staging area precisely so the running code never erases itself — keep the rule absolute.
• Forgetting the H7's 256-bit FLASHWORD programming granularity — byte-wise programming helpers from F-series ports do not apply.
• Keeping the boot flag only in regular SRAM: it vanishes on power loss ; the 4 KB backup SRAM domain is the right home.
• Skipping the errata sheet ES0392 before heavy flash/DMA interplay — the board sheet explicitly warns to read it for DMA/cache-heavy use.