They use IP from synopsis, but <rumor>synopsis refuses to allow their docs to be published so every manufacturer has to read them and regurgitate them into their own docs in their own words</rumor>. In any case official STM docs are incomplete. See their driver source - it accesses undocumented registers and sets undocumented bits in documented regs. Without them the usb core will not start or run.
Your options are to carefully rewrite STM's libs (which are based on real synopsis docs and DO work) or use them as is. Both solutions IMHO leave you subject to STM's EULA and such
this is the #1 issue in stm32
a close #2 is the their so-smart-it-is-useless i2c controller. I know of no project that uses it. Everyone bitbangs i2c master on stm32. The hardware unit is very easy to wedge to a point where only a power cycle unwedges it.
https://github.com/STMicroelectronics/STM32CubeF4/tree/maste...
(I've chosen the version for STM32F4 arbitrarily; if there's something similar in one of their other USB support libraries, feel free to point to that instead.)
More so for Microchip than Atmel --- it's pretty common to find on some of their newer and more complex parts a ton of errata, among which there are some extremely "WTF!?" ones like "feature X does not work at all".
I will say that STM has definitely released better tools that make it much easier to get designs up and running (STM32Cube specifically).
This Rust library is an abstract USB library that can implement CDC serial https://docs.rs/usb-device/0.2.5/usb_device/, and this library connects it to the STM32 USB peripheral https://github.com/stm32-rs/stm32-usbd
Examples here: https://github.com/stm32-rs/stm32-usbd-examples
To put it another way -- the IP protections on the current library are a matter of copyright law, and the protections are on the code itself. The facts of which bits do what -- which are embodied in that code -- are not protected (or protectable!), and can be reused freely.
Though given Oracle's current legal proceedings that might change...