STM32H7x option_write reads incorrect address in flash

[novakmichalinfo]

A recently added support for STM32H7R/H7Sx MCUs (aa109db) broke stm32h7x option_write command on STM32H757BIT6. I tested stm32h7x option_write command with 3 different commits:

• Most recent commit - 0a084c2
• Added support for STM32H7R/H7Sx - aa109db
• One commit prior to adding support for STM32H7R/H7Sx - b62cbc2

Hardware

• STM32H757BIT6 - dual core
• STLINK-V3MINIE

Software

OpenOCD is running in a Docker container:

RUN git clone https://github.com/STMicroelectronics/OpenOCD.git && \
    cd OpenOCD && \
    git checkout insert_git_commit_here && \
    ./bootstrap && \
    ./configure --enable-stlink && \
    make -j$(nproc) && \
    make install && \
    cd .. && \
    rm -rf OpenOCD

I am running OpenOCD with the following command
openocd -f openocd_stm32h757.cfg

I am connecting to the OpenOCD with telnet
telnet 127.0.0.1 4444

Configuration file:

# openocd_stm32h757.cfg
source [find interface/stlink-dap.cfg]
transport select dapdirect_swd
source [find target/stm32h7x_dual_bank.cfg]
reset_config srst_only 

Test results

I tried disabling booting of CM4 by changing option byte FLASH_OPTSR_PRG and also tried stm32h7x option_write example in the OpenOCD documentation section 12.5.2. The output of the commands tested with different commits are shown in a table below. Only commit b62cbc2 produced expected results and wrote the option byte.

Command	Most recent 0a084c2	STM32H7R/H7Sx support aa109db	Prior to adding support b62cbc2
reset	-	-	-
stm32h7x option_read 0 0x1c	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1bc6aaf0
stm32h7x option_write 0 0x20 0x00000000 0x00400000	Failed to read memory at 0x51e3be78 error while reading from address 0x51e3be78	Failed to read memory at 0xe000edf4 error while reading from address 0x856d9473	-
stm32h7x option_read 0 0x1c	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1b86aaf0
stm32h7x option_write 0 0x20 0x8000000 0x8000000	Failed to read memory at 0x51e3be78 error while reading from address 0x51e3be78	Failed to read memory at 0xe000edf4 error while reading from address 0x856d9473	-
stm32h7x option_read 0 0x1c	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1bc6aaf0	Option Register: <0x5200201c> = 0x1b86aaf0

Observations

Different functions are used in src/flash/nor/stm32h7x.c for reading values for commands option_read and option_write.

commit	OpenOCD command	function in stm32h7x.c
aa109db	stm32h7x option_read	stm32x_read_flash_reg
aa109db	stm32h7x option_write	stm32h7_read_flash_reg_by_index
b310b3b	stm32h7x option_read	stm32x_read_flash_reg
b310b3b	stm32h7x option_write	stm32x_read_flash_reg

Conclusion

It seems function stm32h7_read_flash_reg_by_index in src/flash/nor/stm32h7x.c used in option_write command reads incorrect address from flash.

Thanks in advance!