Can't set Option Bytes over USB DFU to STM32G0 System Bootloader

bitkicker · ‎2025-09-15

Hi,

Trying to set Option Bytes over USB with DFU protocol to STM32G0C1VET6's embedded System Bootloader results in a LIBUSB Pipe Error.

Steps to reproduce with details captured further below:

Fully erase user flash using STM32CubeProgrammer connected to target via SWD through J-Link. This erases the user flash (512KB at 0x08000000). Option Bytes are at defaults (128-bytes @ 0x1FFF7800). OTP is at default (1K @ 0x1FFF7000).
Remove J-Link USB connection.
Power-cycle target.
Enumerate target's USB (D+ is PA12, D- is PA11) to host. Since flash is empty micro enters embedded bootloader regardless of the state of BOOT0 pin.
Host sees USB DFU device.
1. `lsusb -vvv` shows DFU device with 3 interface descriptors:
  1. alt 0 is: @Internal Flash /0x08000000/256*02Kg
  2. alt 1 is: @Internal Flash /0x08000000/256*02Kg
  3. alt 2 is: @Internal Flash /0x08000000/256*02Kg
2. `dfu-util -l` shows DFU device with 3 interface descriptors:
  1. alt=0, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
  2. alt=1, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
  3. alt=2, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
3. STM32CubeProgrammer connects but I can't find a copy of the interface description.
4. STM32_Programmer_CLI connects but I can't find a copy of the interface description.
Write Option Byte SEC_SIZE to 1
1. Not actually sure how to do this in `dfu-util` yet so I do a read of SEC_SIZE instead.
2. In STM32CubeProgrammer set OB->SEC_SIZE field to 1 and click Apply.
3. For CLI execute `STM32_Programmer_CLI -c port=usb1 -ob SEC_SIZE=0x1`
Regardless of which client used the request times out showing a LIBUSB Pipe Error. If instead I program any user flash memory using any client it is successful.

I suspect the problem is with the interface descriptors advertised by the embedded System Bootloader. Both `dfu-util -l` and `lsusb -vvv` show the same 512KB 0x0800000 User Flash block for all 3 alt settings. Comparing my output to other micros suggest alt=0 should be internal flash, alt=1 should be Option Bytes (@ 0x1FFF7800) and alt=2 should be OTP (@ 0x1FFF7000). Per rm0444 page 61. This means it looks like the embedded system bootloader only allows the writing of its main user flash since that's the only address range advertised in the interface descriptors and NOT any Option Bytes or OTP.

Is it possible to write Option Bytes and OTP over USB DFU to this micro?

Thanks!

$ dfu-util -l
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=2, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=1, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=0, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"

$ lsusb -vvv

Bus 001 Device 006: ID 0483:df11 STMicroelectronics STM Device in DFU Mode
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0483 STMicroelectronics
  idProduct          0xdf11 STM Device in DFU Mode
  bcdDevice            2.00
  iManufacturer           1 STMicroelectronics
  iProduct                2 DFU in FS Mode
  iSerial                 3 <REDACTED>
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x002d
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          2 DFU in FS Mode
    bmAttributes         0xc0
      Self Powered
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           0
      bInterfaceClass       254 Application Specific Interface
      bInterfaceSubClass      1 Device Firmware Update
      bInterfaceProtocol      2 
      iInterface              6 @Internal Flash   /0x08000000/256*02Kg
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       1
      bNumEndpoints           0
      bInterfaceClass       254 Application Specific Interface
      bInterfaceSubClass      1 Device Firmware Update
      bInterfaceProtocol      2 
      iInterface              7 @Internal Flash   /0x08000000/256*02Kg
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       2
      bNumEndpoints           0
      bInterfaceClass       254 Application Specific Interface
      bInterfaceSubClass      1 Device Firmware Update
      bInterfaceProtocol      2 
      iInterface              8 @Internal Flash   /0x08000000/256*02Kg
      Device Firmware Upgrade Interface Descriptor:
        bLength                             9
        bDescriptorType                    33
        bmAttributes                       11
          Will Detach
          Manifestation Intolerant
          Upload Supported
          Download Supported
        wDetachTimeout                    255 milliseconds
        wTransferSize                    1024 bytes
        bcdDFUVersion                   1.1a
can't get device qualifier: Resource temporarily unavailable
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0001
  Self Powered

For dfu-util try reading SEC_SIZE Option Byte bank:

 $ dfu-util -d 0483:df11 -a 1 -s 0x1fff7870 -U option_bytes.bin -Z 4
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #1 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 1024
DfuSe interface name: "Internal Flash   "
dfu-util: Page at 0x1fff7870 is not readable
 $

STM32CubeProgrammer

15:07:53:868 : USB speed   : Full Speed (12MBit/s)
15:07:53:868 : Manuf. ID   : STMicroelectronics
15:07:53:868 : Product ID  : DFU in FS Mode
15:07:53:868 : SN          : <REDACTED>
15:07:53:868 : DFU protocol: 1.1
15:07:53:868 : Board       : --
15:07:53:868 : Device ID   : 0x0467
15:07:53:868 : setting the address pointer to address: 0x08000000
15:07:53:869 : setting the address pointer to address: 0x08000000
15:07:53:869 : setting the address pointer to address: 0x1fff7800
15:07:53:869 : receiving packet nbr: 0
15:07:53:869 : sending an abort request
15:07:53:869 : UpLoading data
15:07:53:870 : sending an abort request
15:07:53:870 : setting the address pointer to address: 0x1fff7800
15:07:53:870 : receiving packet nbr: 0
15:07:53:870 : sending an abort request
15:07:53:870 : UpLoading data
15:07:53:870 : sending an abort request
15:07:53:871 : setting the address pointer to address: 0x1fff75e0
15:07:53:871 : receiving packet nbr: 0
15:07:53:871 : sending an abort request
15:07:53:871 : UpLoading data
15:07:53:871 : Database: Config 1 is active.
15:07:53:871 : sending an abort request
15:07:53:871 : setting the address pointer to address: 0x08000000
15:07:54:013 : setting the address pointer to address: 0x08000000
15:07:54:014 : UPLOADING OPTION BYTES DATA ...
15:07:54:014 :   Bank          : 0x00
15:07:54:014 :   Address       : 0x1fff7800
15:07:54:014 :   Size          : 68 Bytes
15:07:54:014 : setting the address pointer to address: 0x1fff7800
15:07:54:014 : receiving packet nbr: 0
15:07:54:014 : sending an abort request
15:07:54:015 : UpLoading data
15:07:54:015 :   Bank          : 0x01
15:07:54:015 :   Address       : 0x1fff7870
15:07:54:015 :   Size          : 4 Bytes
15:07:54:015 : sending an abort request
15:07:54:015 : setting the address pointer to address: 0x1fff7870
15:07:54:016 : receiving packet nbr: 0
15:07:54:016 : sending an abort request
15:07:54:016 : UpLoading data
15:07:54:016 : UPLOADING ...
15:07:54:016 :   Size          : 1024 Bytes
15:07:54:016 :   Address       : 0x8000000
15:07:54:016 : Read progress:
15:07:54:017 : sending an abort request
15:07:54:017 : setting the address pointer to address: 0x08000000
15:07:54:017 : receiving packet nbr: 0
15:07:54:036 : sending an abort request
15:07:54:037 : UpLoading data
15:07:54:037 : Data read successfully
15:07:54:037 : Time elapsed during the read operation is: 00:00:00.007
15:08:10:086 : Option byte command : -ob SEC_SIZE=0x1 
15:08:10:089 : qCmd : -ob SEC_SIZE=0x1 
15:08:10:089 : PROGRAMMING OPTION BYTES AREA ...
15:08:10:090 : sending an abort request
15:08:10:090 : setting the address pointer to address: 0x1fff7800
15:08:10:090 : receiving packet nbr: 0
15:08:10:091 : sending an abort request
15:08:10:092 : UpLoading data
15:08:10:093 : sending an abort request
15:08:10:093 : setting the address pointer to address: 0x1fff7800
15:08:10:094 : receiving packet nbr: 0
15:08:10:094 : sending an abort request
15:08:10:095 : UpLoading data
15:08:10:096 : sending an abort request
15:08:10:097 : setting the address pointer to address: 0x1fff75e0
15:08:10:098 : receiving packet nbr: 0
15:08:10:098 : sending an abort request
15:08:10:099 : UpLoading data
15:08:10:100 : Database: Config 1 is active.
15:08:10:100 :   Bank          : 0x01
15:08:10:100 :   Address       : 0x1fff7870
15:08:10:100 :   Size          : 4 Bytes
15:08:10:102 : sending an abort request
15:08:10:103 : setting the address pointer to address: 0x1fff7870
15:08:10:103 : sending packet nbr: 0
15:08:10:103 : downloading data
15:08:10:136 : libusb get status error [-9] : LIBUSB_ERROR_PIPE  
15:08:10:136 : An error occured while downloading data
15:08:10:136 : libusb get status error [-9] : LIBUSB_ERROR_PIPE  
15:08:10:136 : Reconnecting...
15:08:10:136 : Reconnecting...
15:08:20:134 : Unable to reconnect the target device: time out expired
15:08:20:134 : Uunable to reconnect the target device: time out expired
15:08:20:134 : Error: Downloading Option Bytes Data failed
15:08:20:139 : UPLOADING OPTION BYTES DATA ...
15:08:20:139 :   Bank          : 0x00
15:08:20:139 :   Address       : 0x1fff7800
15:08:20:139 :   Size          : 68 Bytes
15:08:20:140 : Error: Uploading Option Bytes bank: 0 failed
15:08:20:148 : Database: Config 6 is active.
15:08:20:148 : Time elapsed during option Bytes configuration: 00:00:10.047
15:08:20:272 : Warning: Connection to device 0x467 is lost
15:08:20:305 : Disconnected from device.

$ STM32_Programmer_CLI -vb 2 -c port=usb1 -ob SEC_SIZE=0x10
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.17.0                  
      -------------------------------------------------------------------



USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : <REDACTED>
DFU protocol: 1.1
Board       : --
Device ID   : 0x0467
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.
sending an abort request
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.
Device name : STM32G0B0xx/B1xx/C1xx
Flash size  : 512 KBytes (default)
Device type : MCU
Revision ID : --  
Device CPU  : Cortex-M0+
sending an abort request
setting the address pointer to address: 0x08000000

UPLOADING OPTION BYTES DATA ...

  Bank          : 0x00
  Address       : 0x1fff7800
  Size          : 68 Bytes

setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data


  Bank          : 0x01
  Address       : 0x1fff7870
  Size          : 4 Bytes

sending an abort request
setting the address pointer to address: 0x1fff7870
receiving packet nbr: 0
sending an abort request
UpLoading data



PROGRAMMING OPTION BYTES AREA ...
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.

  Bank          : 0x01
  Address       : 0x1fff7870
  Size          : 4 Bytes

sending an abort request
setting the address pointer to address: 0x1fff7870
sending packet nbr: 0
downloading data
libusb get status error [-9] : LIBUSB_ERROR_PIPE  
An error occured while downloading data
libusb get status error [-9] : LIBUSB_ERROR_PIPE  


Reconnecting...
Reconnecting...


Unable to reconnect the target device: time out expired

Uunable to reconnect the target device: time out expired

Error: Downloading Option Bytes Data failed


UPLOADING OPTION BYTES DATA ...

  Bank          : 0x00
  Address       : 0x1fff7800
  Size          : 68 Bytes


Error: Uploading Option Bytes bank: 0 failed
Database: Config 6 is active.
Time elapsed during option Bytes configuration: 00:00:10.042
 $

FBL · ‎2025-09-17

Hi @bitkicker

Before proceeding further, could you please confirm a couple of points?

Have you successfully modified the Option Bytes using another interface such as UART?
Are you able to program the user flash via the USB DFU interface without any issues?
In summary, is the only limitation that Option Bytes are not accessible through the DFU interface, while everything else functions correctly?
Can you check if this bin exceeds the expected size of 10Bytes.
```
option_bytes.bin 
```

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.

bitkicker · ‎2025-09-17

Hey @FBL ,

Yes, I can set SEC_SIZE via any SWD connection using STM32CubeProgrammer GUI or CLI. CLI command is:

STM32_Programmer_CLI -c port=JLINK mode=hotplug -ob SEC_SIZE=0x1

Yes, I can program a binary into flash using either GUI or CLI over either the jlink(SWD) or usb1(USB DFU).

$ STM32_Programmer_CLI -c port=JLINK -d test.bin 0x08060800
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.17.0                  
      -------------------------------------------------------------------

Connecting to J-Link Probe
Device=Cortex-M0
Device ID   : 0x467
Voltage     : 3.29V
Flash size  : 512 KBytes


Memory Programming ...
Opening and parsing file: test.bin
  File          : test.bin
  Size          : 64.00 B 
  Address       : 0x08060800 


Erasing memory corresponding to segment 0:
Erasing internal memory sector 193
Download in Progress:
[==================================================] 100% 

File download complete
Time elapsed during download operation: 00:00:00.066

$ STM32_Programmer_CLI -c port=usb1 -d test.bin 0x08060800
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.17.0                  
      -------------------------------------------------------------------



USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : <REDACTED>
DFU protocol: 1.1
Board       : --
Device ID   : 0x0467
Device name : STM32G0B0xx/B1xx/C1xx
Flash size  : 512 KBytes (default)
Device type : MCU
Revision ID : --  
Device CPU  : Cortex-M0+


Memory Programming ...
Opening and parsing file: test.bin
  File          : test.bin
  Size          : 64.00 B 
  Address       : 0x08060800 


Erasing memory corresponding to segment 0:
Erasing internal memory sector 193
erasing sector 0193 @: 0x08060800 done
Download in Progress:
[==================================================] 100% 

File download complete
Time elapsed during download operation: 00:00:00.031
$

Yes, it appears the only limitation is that Option Bytes and OTP are not accessible through the USB DFU interface, while User Flash writes/reads function correctly. I suspect this is due to the USB DFU limiting its interface descriptions to the 0x0800000 User Flash as shown below. I'd expect address ranges for all three User Flash, OTP and Option Bytes to be listed instead of a triple entry of User Flash.

$ dfu-util -l
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=2, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=1, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=0, name="@Internal Flash   /0x08000000/256*02Kg", serial="<REDACTED>"

The command to read the Option Bytes via dfu-util actually failed so file size is 0. This failure is consistent with USB DFU not allowing Option Byte access.

$ dfu-util -d 0483:df11 -a 1 -s 0x1fff7870 -U option_bytes.bin -Z 4
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #1 ...
Determining device status: state = dfuDNLOAD-IDLE, status = 0
aborting previous incomplete transfer
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 1024
DfuSe interface name: "Internal Flash   "
dfu-util: Page at 0x1fff7870 is not readable
$ ll option_bytes.bin 
-rw-r--r-- 1 vscode vscode 0 Sep 17 15:18 option_bytes.bin
$

bitkicker · ‎2025-09-18

Could how I enter the embedded system bootloader affect the interface description it allows over USB DFU?

My BOOT0 pin is a little difficult to get to. So I've been fully erasing User Flash via SWD. Then disconnecting that and power-cycling the micro to load the embedded system bootloader via USB HID.

bitkicker · ‎2025-09-19

I've replicated the issue on another board and attempted to use the Serial COM Port to the embedded bootloader which fails:

 $ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 043: ID 0483:df11 STMicroelectronics STM Device in DFU Mode
Bus 001 Device 042: ID 0403:6001 Future Technology Devices International, Ltd FT232 Serial (UART) IC
Bus 001 Device 037: ID 1366:1020 SEGGER J-Link Pro
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 $ STM32_Programmer_CLI -vb 2 -c port=/dev/ttyUSB0 -ob displ
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.17.0                  
      -------------------------------------------------------------------

Serial Port /dev/ttyUSB0 is successfully opened.
Port configuration: parity = even, baudrate = 115200, data-bit = 8,
                     stop-bit = 1.0, flow-control = off

Timeout error occured while waiting for acknowledgement.
No response from target received

Retrying UART init connection...

Timeout error occured while waiting for acknowledgement.
Error: Activating device: KO. Please, verify the boot mode configuration and check the serial port configuration. Reset your device then try again...