When working on the I2C bootloader embedded in the System Memory of the STM32G0B0CE (v13.0) and STM32G0B1RE (v9.2) MCUs, we noticed a strange behavior.
The Write Memory (0x31) and No-Stretch Write Memory (0x32) commands of the bootloader does not seem to work with addresses that are not at least 8-byte aligned. Commands issued on 4-byte aligned addresses are acknowledged by the bootloader (the ACK byte (0x79) is received upon the last I2C read of the command), but the data is never written to
memory. The size of the operation does not seem to change this behavior. For example, the bootloader acknowledges a Write Memory command on 0x08000004 but never actually writes it into flash, even though it has been previously erased. The Read Memory command (0x11) on that address returns 0xFF bytes which suggest that the flash has not been programmed.
On the other hand, if we try to perform a write operation on 0x08000000 using a 16 byte payload, everything works as it should (and as a consequence, the address 0x08000004 is also written).
Write memory commands on addresses that are not 4-byte or 8-byte aligned (0x08000002 for example) do not work: the last I2C read of the command fails because the bootloader NAK the I2C read. We are unable to obtain an ACK (0x79), NAK (0x1F) or Busy (0x76) byte for such commands.
On Linux, the stm32flash (https://sourceforge.net/p/stm32flash/code/ci/master/tree/) can reproduce this issue with the following command line:
$ stm32flash /dev/i2c-X -w /path/to/fw.bin -v -F 254:254
With this command, the firmware is written 0xFC bytes at a time, which means that half of the write operations silently fails because half of them are not on 8-byte aligned addresses.
Are there any constraints on the addresses that are passed to the Write Memory commands, or is this a bug in the bootloader ?
