STM32H7x option_write reads incorrect address in flash

Start in src/flash/nor/stm32h7x.c and compare stm32h7_read_flash_reg_by_index, used by option_write, with stm32x_read_flash_reg, used by option_read. Reproduce with the STM32H757BIT6 configuration, then run the documented stm32h7x option_read and option_write commands across the referenced commits. Done means option_write reads the correct flash address and updates the option byte as expected.

A recently added support for STM32H7R/H7Sx MCUs (https://github.com/STMicroelectronics/OpenOCD/commit/aa109db19ffd22eb05e18b010140fb562934533b) broke stm32h7x option_write command on STM32H757BIT6. I tested stm32h7x option_write command with 3 different commits:

• Most recent commit - https://github.com/STMicroelectronics/OpenOCD/commit/0a084c29345576911fb8d10fcbd158d0361b6186
• Added support for STM32H7R/H7Sx - https://github.com/STMicroelectronics/OpenOCD/commit/aa109db19ffd22eb05e18b010140fb562934533b
• One commit prior to adding support for STM32H7R/H7Sx - https://github.com/STMicroelectronics/OpenOCD/commit/b62cbc2e853189e730fd94e6d9c0a1d3ceb2661f

Hardware

• STM32H757BIT6 - dual core
• STLINK-V3MINIE

Software

OpenOCD is running in a Docker container:

RUN git clone https://github.com/STMicroelectronics/OpenOCD.git && \
    cd OpenOCD && \
    git checkout insert_git_commit_here && \
    ./bootstrap && \
    ./configure --enable-stlink && \
    make -j$(nproc) && \
    make install && \
    cd .. && \
    rm -rf OpenOCD

I am running OpenOCD with the following command
openocd -f openocd_stm32h757.cfg

I am connecting to the OpenOCD with telnet
telnet 127.0.0.1 4444

Configuration file:

# openocd_stm32h757.cfg
source [find interface/stlink-dap.cfg]
transport select dapdirect_swd
source [find target/stm32h7x_dual_bank.cfg]
reset_config srst_only 

Test results

I tried disabling booting of CM4 by changing option byte FLASH_OPTSR_PRG and also tried stm32h7x option_write example in the OpenOCD documentation section 12.5.2. The output of the commands tested with different commits are shown in a table below. Only commit b62cbc2 produced expected results and wrote the option byte.

Observations

Different functions are used in src/flash/nor/stm32h7x.c for reading values for commands option_read and option_write.

Conclusion

It seems function stm32h7_read_flash_reg_by_index in src/flash/nor/stm32h7x.c used in option_write command reads incorrect address from flash.

Thanks in advance!