Skip to main content
B
bitkicker
Visitor II
September 15, 2025
Solved

Can't set Option Bytes over USB DFU to STM32G0 System Bootloader

  • September 15, 2025
  • 4 replies
  • 900 views

Hi,

Trying to set Option Bytes over USB with DFU protocol to STM32G0C1VET6's embedded System Bootloader results in a LIBUSB Pipe Error.


Steps to reproduce with details captured further below:

  1. Fully erase user flash using STM32CubeProgrammer connected to target via SWD through J-Link.  This erases the user flash (512KB at 0x08000000).  Option Bytes are at defaults (128-bytes @ 0x1FFF7800).  OTP is at default (1K @ 0x1FFF7000).
  2. Remove J-Link USB connection.
  3. Power-cycle target.
  4. Enumerate target's USB (D+ is PA12, D- is PA11) to host.  Since flash is empty micro enters embedded bootloader regardless of the state of BOOT0 pin.
  5. Host sees USB DFU device.
    1. `lsusb -vvv` shows DFU device with 3 interface descriptors:
      1. alt 0 is: @Internal Flash /0x08000000/256*02Kg
      2. alt 1 is: @Internal Flash /0x08000000/256*02Kg
      3. alt 2 is: @Internal Flash /0x08000000/256*02Kg
    2. `dfu-util -l` shows DFU device with 3 interface descriptors:
      1. alt=0, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
      2. alt=1, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
      3. alt=2, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
    3. STM32CubeProgrammer connects but I can't find a copy of the interface description.
    4. STM32_Programmer_CLI connects but I can't find a copy of the interface description.
  6. Write Option Byte SEC_SIZE to 1
    1. Not actually sure how to do this in `dfu-util` yet so I do a read of SEC_SIZE instead.
    2. In STM32CubeProgrammer set OB->SEC_SIZE field to 1 and click Apply.
    3. For CLI execute `STM32_Programmer_CLI -c port=usb1 -ob SEC_SIZE=0x1`
  7. Regardless of which client used the request times out showing a LIBUSB Pipe Error.  If instead I program any user flash memory using any client it is successful.

 

I suspect the problem is with the interface descriptors advertised by the embedded System Bootloader.  Both `dfu-util -l` and `lsusb -vvv` show the same 512KB 0x0800000 User Flash block for all 3 alt settings.  Comparing my output to other micros suggest alt=0 should be internal flash, alt=1 should be Option Bytes (@ 0x1FFF7800) and alt=2 should be OTP (@ 0x1FFF7000).  Per rm0444 page 61.  This means it looks like the embedded system bootloader only allows the writing of its main user flash since that's the only address range advertised in the interface descriptors and NOT any Option Bytes or OTP.

 

Is it possible to write Option Bytes and OTP over USB DFU to this micro?

 

Thanks!

 

$ dfu-util -l
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=2, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=1, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=6, cfg=1, intf=0, path="1-1", alt=0, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"

 

$ lsusb -vvv

Bus 001 Device 006: ID 0483:df11 STMicroelectronics STM Device in DFU Mode
Device Descriptor:
 bLength 18
 bDescriptorType 1
 bcdUSB 2.00
 bDeviceClass 0 
 bDeviceSubClass 0 
 bDeviceProtocol 0 
 bMaxPacketSize0 64
 idVendor 0x0483 STMicroelectronics
 idProduct 0xdf11 STM Device in DFU Mode
 bcdDevice 2.00
 iManufacturer 1 STMicroelectronics
 iProduct 2 DFU in FS Mode
 iSerial 3 <REDACTED>
 bNumConfigurations 1
 Configuration Descriptor:
 bLength 9
 bDescriptorType 2
 wTotalLength 0x002d
 bNumInterfaces 1
 bConfigurationValue 1
 iConfiguration 2 DFU in FS Mode
 bmAttributes 0xc0
 Self Powered
 MaxPower 100mA
 Interface Descriptor:
 bLength 9
 bDescriptorType 4
 bInterfaceNumber 0
 bAlternateSetting 0
 bNumEndpoints 0
 bInterfaceClass 254 Application Specific Interface
 bInterfaceSubClass 1 Device Firmware Update
 bInterfaceProtocol 2 
 iInterface 6 @Internal Flash /0x08000000/256*02Kg
 Interface Descriptor:
 bLength 9
 bDescriptorType 4
 bInterfaceNumber 0
 bAlternateSetting 1
 bNumEndpoints 0
 bInterfaceClass 254 Application Specific Interface
 bInterfaceSubClass 1 Device Firmware Update
 bInterfaceProtocol 2 
 iInterface 7 @Internal Flash /0x08000000/256*02Kg
 Interface Descriptor:
 bLength 9
 bDescriptorType 4
 bInterfaceNumber 0
 bAlternateSetting 2
 bNumEndpoints 0
 bInterfaceClass 254 Application Specific Interface
 bInterfaceSubClass 1 Device Firmware Update
 bInterfaceProtocol 2 
 iInterface 8 @Internal Flash /0x08000000/256*02Kg
 Device Firmware Upgrade Interface Descriptor:
 bLength 9
 bDescriptorType 33
 bmAttributes 11
 Will Detach
 Manifestation Intolerant
 Upload Supported
 Download Supported
 wDetachTimeout 255 milliseconds
 wTransferSize 1024 bytes
 bcdDFUVersion 1.1a
can't get device qualifier: Resource temporarily unavailable
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0001
 Self Powered

 

For dfu-util try reading SEC_SIZE Option Byte bank:

 $ dfu-util -d 0483:df11 -a 1 -s 0x1fff7870 -U option_bytes.bin -Z 4
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #1 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 1024
DfuSe interface name: "Internal Flash "
dfu-util: Page at 0x1fff7870 is not readable
 $

 

STM32CubeProgrammer

15:07:53:868 : USB speed : Full Speed (12MBit/s)
15:07:53:868 : Manuf. ID : STMicroelectronics
15:07:53:868 : Product ID : DFU in FS Mode
15:07:53:868 : SN : <REDACTED>
15:07:53:868 : DFU protocol: 1.1
15:07:53:868 : Board : --
15:07:53:868 : Device ID : 0x0467
15:07:53:868 : setting the address pointer to address: 0x08000000
15:07:53:869 : setting the address pointer to address: 0x08000000
15:07:53:869 : setting the address pointer to address: 0x1fff7800
15:07:53:869 : receiving packet nbr: 0
15:07:53:869 : sending an abort request
15:07:53:869 : UpLoading data
15:07:53:870 : sending an abort request
15:07:53:870 : setting the address pointer to address: 0x1fff7800
15:07:53:870 : receiving packet nbr: 0
15:07:53:870 : sending an abort request
15:07:53:870 : UpLoading data
15:07:53:870 : sending an abort request
15:07:53:871 : setting the address pointer to address: 0x1fff75e0
15:07:53:871 : receiving packet nbr: 0
15:07:53:871 : sending an abort request
15:07:53:871 : UpLoading data
15:07:53:871 : Database: Config 1 is active.
15:07:53:871 : sending an abort request
15:07:53:871 : setting the address pointer to address: 0x08000000
15:07:54:013 : setting the address pointer to address: 0x08000000
15:07:54:014 : UPLOADING OPTION BYTES DATA ...
15:07:54:014 : Bank : 0x00
15:07:54:014 : Address : 0x1fff7800
15:07:54:014 : Size : 68 Bytes
15:07:54:014 : setting the address pointer to address: 0x1fff7800
15:07:54:014 : receiving packet nbr: 0
15:07:54:014 : sending an abort request
15:07:54:015 : UpLoading data
15:07:54:015 : Bank : 0x01
15:07:54:015 : Address : 0x1fff7870
15:07:54:015 : Size : 4 Bytes
15:07:54:015 : sending an abort request
15:07:54:015 : setting the address pointer to address: 0x1fff7870
15:07:54:016 : receiving packet nbr: 0
15:07:54:016 : sending an abort request
15:07:54:016 : UpLoading data
15:07:54:016 : UPLOADING ...
15:07:54:016 : Size : 1024 Bytes
15:07:54:016 : Address : 0x8000000
15:07:54:016 : Read progress:
15:07:54:017 : sending an abort request
15:07:54:017 : setting the address pointer to address: 0x08000000
15:07:54:017 : receiving packet nbr: 0
15:07:54:036 : sending an abort request
15:07:54:037 : UpLoading data
15:07:54:037 : Data read successfully
15:07:54:037 : Time elapsed during the read operation is: 00:00:00.007
15:08:10:086 : Option byte command : -ob SEC_SIZE=0x1 
15:08:10:089 : qCmd : -ob SEC_SIZE=0x1 
15:08:10:089 : PROGRAMMING OPTION BYTES AREA ...
15:08:10:090 : sending an abort request
15:08:10:090 : setting the address pointer to address: 0x1fff7800
15:08:10:090 : receiving packet nbr: 0
15:08:10:091 : sending an abort request
15:08:10:092 : UpLoading data
15:08:10:093 : sending an abort request
15:08:10:093 : setting the address pointer to address: 0x1fff7800
15:08:10:094 : receiving packet nbr: 0
15:08:10:094 : sending an abort request
15:08:10:095 : UpLoading data
15:08:10:096 : sending an abort request
15:08:10:097 : setting the address pointer to address: 0x1fff75e0
15:08:10:098 : receiving packet nbr: 0
15:08:10:098 : sending an abort request
15:08:10:099 : UpLoading data
15:08:10:100 : Database: Config 1 is active.
15:08:10:100 : Bank : 0x01
15:08:10:100 : Address : 0x1fff7870
15:08:10:100 : Size : 4 Bytes
15:08:10:102 : sending an abort request
15:08:10:103 : setting the address pointer to address: 0x1fff7870
15:08:10:103 : sending packet nbr: 0
15:08:10:103 : downloading data
15:08:10:136 : libusb get status error [-9] : LIBUSB_ERROR_PIPE 
15:08:10:136 : An error occured while downloading data
15:08:10:136 : libusb get status error [-9] : LIBUSB_ERROR_PIPE 
15:08:10:136 : Reconnecting...
15:08:10:136 : Reconnecting...
15:08:20:134 : Unable to reconnect the target device: time out expired
15:08:20:134 : Uunable to reconnect the target device: time out expired
15:08:20:134 : Error: Downloading Option Bytes Data failed
15:08:20:139 : UPLOADING OPTION BYTES DATA ...
15:08:20:139 : Bank : 0x00
15:08:20:139 : Address : 0x1fff7800
15:08:20:139 : Size : 68 Bytes
15:08:20:140 : Error: Uploading Option Bytes bank: 0 failed
15:08:20:148 : Database: Config 6 is active.
15:08:20:148 : Time elapsed during option Bytes configuration: 00:00:10.047
15:08:20:272 : Warning: Connection to device 0x467 is lost
15:08:20:305 : Disconnected from device.

 

$ STM32_Programmer_CLI -vb 2 -c port=usb1 -ob SEC_SIZE=0x10
 -------------------------------------------------------------------
 STM32CubeProgrammer v2.17.0 
 -------------------------------------------------------------------



USB speed : Full Speed (12MBit/s)
Manuf. ID : STMicroelectronics
Product ID : DFU in FS Mode
SN : <REDACTED>
DFU protocol: 1.1
Board : --
Device ID : 0x0467
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.
sending an abort request
setting the address pointer to address: 0x08000000
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.
Device name : STM32G0B0xx/B1xx/C1xx
Flash size : 512 KBytes (default)
Device type : MCU
Revision ID : -- 
Device CPU : Cortex-M0+
sending an abort request
setting the address pointer to address: 0x08000000

UPLOADING OPTION BYTES DATA ...

 Bank : 0x00
 Address : 0x1fff7800
 Size : 68 Bytes

setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data


 Bank : 0x01
 Address : 0x1fff7870
 Size : 4 Bytes

sending an abort request
setting the address pointer to address: 0x1fff7870
receiving packet nbr: 0
sending an abort request
UpLoading data



PROGRAMMING OPTION BYTES AREA ...
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff7800
receiving packet nbr: 0
sending an abort request
UpLoading data
sending an abort request
setting the address pointer to address: 0x1fff75e0
receiving packet nbr: 0
sending an abort request
UpLoading data
Database: Config 1 is active.

 Bank : 0x01
 Address : 0x1fff7870
 Size : 4 Bytes

sending an abort request
setting the address pointer to address: 0x1fff7870
sending packet nbr: 0
downloading data
libusb get status error [-9] : LIBUSB_ERROR_PIPE 
An error occured while downloading data
libusb get status error [-9] : LIBUSB_ERROR_PIPE 


Reconnecting...
Reconnecting...


Unable to reconnect the target device: time out expired

Uunable to reconnect the target device: time out expired

Error: Downloading Option Bytes Data failed


UPLOADING OPTION BYTES DATA ...

 Bank : 0x00
 Address : 0x1fff7800
 Size : 68 Bytes


Error: Uploading Option Bytes bank: 0 failed
Database: Config 6 is active.
Time elapsed during option Bytes configuration: 00:00:10.042
 $

 

    This topic has been closed for replies.
    Best answer by bitkicker

    I've successfully set the SEC_SIZE Option Byte on a STM32G0C1E-EV over USB talking to the ST Embedded Bootloader.  The fix was to apply a database patch provided by ST which enabled version 2.20.0 of both the STM32CubeProgrammer (GUI) and STM32_Programmer_CLI (CLI) tools to work.  I'm unsure if this allows full Option Byte and OTP access but it did allow SEC_SIZE to be written.  I suspect ST will apply the database patch in a future STM32CubeProgrammer update.

    4 replies

    F
    FBL
    Technical Moderator
    September 17, 2025

    Hi @bitkicker 

    Before proceeding further, could you please confirm a couple of points?

    • Have you successfully modified the Option Bytes using another interface such as UART?
    • Are you able to program the user flash via the USB DFU interface without any issues?
    • In summary, is the only limitation that Option Bytes are not accessible through the DFU interface, while everything else functions correctly?
    • Can you check if this bin exceeds the expected size of 10Bytes. 
      option_bytes.bin ​
    B
    bitkickerAuthor
    Visitor II
    September 17, 2025

    Hey @FBL ,

    • Yes, I can set SEC_SIZE via any SWD connection using STM32CubeProgrammer GUI or CLI.  CLI command is:
    STM32_Programmer_CLI -c port=JLINK mode=hotplug -ob SEC_SIZE=0x1​
    • Yes, I can program a binary into flash using either GUI or CLI over either the jlink(SWD) or usb1(USB DFU).
    $ STM32_Programmer_CLI -c port=JLINK -d test.bin 0x08060800
 -------------------------------------------------------------------
 STM32CubeProgrammer v2.17.0 
 -------------------------------------------------------------------

Connecting to J-Link Probe
Device=Cortex-M0
Device ID : 0x467
Voltage : 3.29V
Flash size : 512 KBytes


Memory Programming ...
Opening and parsing file: test.bin
 File : test.bin
 Size : 64.00 B 
 Address : 0x08060800 


Erasing memory corresponding to segment 0:
Erasing internal memory sector 193
Download in Progress:
[==================================================] 100% 

File download complete
Time elapsed during download operation: 00:00:00.066

     

    $ STM32_Programmer_CLI -c port=usb1 -d test.bin 0x08060800
 -------------------------------------------------------------------
 STM32CubeProgrammer v2.17.0 
 -------------------------------------------------------------------



USB speed : Full Speed (12MBit/s)
Manuf. ID : STMicroelectronics
Product ID : DFU in FS Mode
SN : <REDACTED>
DFU protocol: 1.1
Board : --
Device ID : 0x0467
Device name : STM32G0B0xx/B1xx/C1xx
Flash size : 512 KBytes (default)
Device type : MCU
Revision ID : -- 
Device CPU : Cortex-M0+


Memory Programming ...
Opening and parsing file: test.bin
 File : test.bin
 Size : 64.00 B 
 Address : 0x08060800 


Erasing memory corresponding to segment 0:
Erasing internal memory sector 193
erasing sector 0193 @: 0x08060800 done
Download in Progress:
[==================================================] 100% 

File download complete
Time elapsed during download operation: 00:00:00.031
$

     

    • Yes, it appears the only limitation is that Option Bytes and OTP are not accessible through the USB DFU interface, while User Flash writes/reads function correctly.  I suspect this is due to the USB DFU limiting its interface descriptions to the 0x0800000 User Flash as shown below.  I'd expect address ranges for all three User Flash, OTP and Option Bytes to be listed instead of a triple entry of User Flash.
    $ dfu-util -l
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=2, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=1, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
Found DFU: [0483:df11] ver=0200, devnum=21, cfg=1, intf=0, path="1-1", alt=0, name="@Internal Flash /0x08000000/256*02Kg", serial="<REDACTED>"
    •  The command to read the Option Bytes via dfu-util actually failed so file size is 0.  This failure is consistent with USB DFU not allowing Option Byte access.
    $ dfu-util -d 0483:df11 -a 1 -s 0x1fff7870 -U option_bytes.bin -Z 4
dfu-util 0.9

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #1 ...
Determining device status: state = dfuDNLOAD-IDLE, status = 0
aborting previous incomplete transfer
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 1024
DfuSe interface name: "Internal Flash "
dfu-util: Page at 0x1fff7870 is not readable
$ ll option_bytes.bin 
-rw-r--r-- 1 vscode vscode 0 Sep 17 15:18 option_bytes.bin
$

     

    B
    bitkickerAuthor
    Visitor II
    September 18, 2025

    Could how I enter the embedded system bootloader affect the interface description it allows over USB DFU?

     

    My BOOT0 pin is a little difficult to get to.  So I've been fully erasing User Flash via SWD.  Then disconnecting that and power-cycling the micro to load the embedded system bootloader via USB HID.

    B
    bitkickerAuthor
    Visitor II
    September 19, 2025

    I've replicated the issue on another board and attempted to use the Serial COM Port to the embedded bootloader which fails:

     $ lsusb
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 043: ID 0483:df11 STMicroelectronics STM Device in DFU Mode
Bus 001 Device 042: ID 0403:6001 Future Technology Devices International, Ltd FT232 Serial (UART) IC
Bus 001 Device 037: ID 1366:1020 SEGGER J-Link Pro
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 $ STM32_Programmer_CLI -vb 2 -c port=/dev/ttyUSB0 -ob displ
 -------------------------------------------------------------------
 STM32CubeProgrammer v2.17.0 
 -------------------------------------------------------------------

Serial Port /dev/ttyUSB0 is successfully opened.
Port configuration: parity = even, baudrate = 115200, data-bit = 8,
 stop-bit = 1.0, flow-control = off

Timeout error occured while waiting for acknowledgement.
No response from target received

Retrying UART init connection...

Timeout error occured while waiting for acknowledgement.
Error: Activating device: KO. Please, verify the boot mode configuration and check the serial port configuration. Reset your device then try again...
      B
      bitkickerAuthorAnswer
      Visitor II
      October 31, 2025

      I've successfully set the SEC_SIZE Option Byte on a STM32G0C1E-EV over USB talking to the ST Embedded Bootloader.  The fix was to apply a database patch provided by ST which enabled version 2.20.0 of both the STM32CubeProgrammer (GUI) and STM32_Programmer_CLI (CLI) tools to work.  I'm unsure if this allows full Option Byte and OTP access but it did allow SEC_SIZE to be written.  I suspect ST will apply the database patch in a future STM32CubeProgrammer update.

      Terms & ConditionsAccessibility statement