.. _bluepill-bmp-readme: BLACK MAGIC PROBE (BMP) ======================= **Make a BlackMagic Probe (BMP) using a STM32F103** BMP Homepage ------------ https://github.com/blacksphere/blackmagic Why BlackMagic Probe ? ---------------------- The BlackMagic Probe (BMP) is often suggested as an alternative to a SWD programmer/debugger such as found on the STM32 Discovery/Nucleo Boards and the Chinese USB/SWD $5 dongles. After building a BMP and using it to develop an Assembly Language program Blinky on A STM32F051 mcu, I think the BMP is ideal for this task. What you need on the PC ^^^^^^^^^^^^^^^^^^^^^^^ * arm-none-eabi * A USB port, but who doesn't have that ? The BMP ------- * Is an open source project which runs on STM32F1xxx processors such as found on the BluePill Board etc with 128KB Flash. * Can flash and debug STM32, SAM3, TI Stellaris and some NXP processors via SWD and JTAG. * Has inbuilt drivers for many Coetex-M MCU's * Doesn't need OpenOCD * Exposes a UART link (no hardware handshaking) * Expose a TRACESWO link M3/M4/M7 only ? * Exposes a GDB server * Flashes the target using the "load" command. Works with hex or elf files Supported Targets ----------------- https://github.com/blacksphere/blackmagic/wiki/Frequently-Asked-Questions The Black Magic probe currently supports ARMv6-M and ARMv7-M architecture targets, specifically Cortex-M0, Cortex-M3 and Cortex-M4. Any device with these cores should work. If there are issues, it will probably be with Flash Memory controllers. The BMP Sourcecode (Nov 2020) lists support for the following. :: ├── adiv5 ├── cortexa ├── cortexm ├── efm32 ├── kinetis ├── lmi ├── lpc11xx ├── lpc15xx ├── lpc17xx ├── lpc43xx ├── lpc546xx ├── msp432 ├── nrf51 ├── nxpke04 ├── sam3x ├── sam4l ├── samd ├── samx5x ├── stm32f0 ├── stm32f1 ├── stm32f4 ├── stm32h7 ├── stm32l0 ├── stm32l4 Building the BMP binary on Linux-MX ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Install Linux Mx on a PC ~~~~~~~~~~~~~~~~~~~~~~~~ :: https://mxlinux.org/ install it apt-get install build-essential apt-get install gcc-arm-none-eabi apt-get install libnewlib-arm-none-eabi Building the BMP binary ~~~~~~~~~~~~~~~~~~~~~~~ :: git clone https://github.com/blacksphere/blackmagic.git OR https://github.com/UweBonnes/blackmagic.git cd blackmagic :: make -j PROBE_HOST=stlink cp src/blackmagic_dfu.bin ./ truncate --size=8192 blackmagic_dfu.bin cat blackmagic_dfu.bin src/blackmagic.bin > blackmagic_full.bin flash blackmagic/src/blackmagic_full.bin (100088 bytes) to the BMP Board using your usual method. press the reset button on the BMP or reset the power Test your PC sees the BMP ------------------------- You are looking for something like "Product: Black Magic Probe (STLINK), (Firmware v1.7.1-44-g1f7a716)" and a couple of virtual Com ports listed with DMESG. Linux ^^^^^ dmesg :: [265234.434910] usb 2-1.5: new full-speed USB device number 5 using ehci-pci [265234.545735] usb 2-1.5: New USB device found, idVendor=1d50, idProduct=6018, bcdDevice= 1.00 [265234.545739] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [265234.545740] usb 2-1.5: Product: Black Magic Probe (STLINK), (Firmware v1.7.1-44-g1f7a716) [265234.545742] usb 2-1.5: Manufacturer: Black Sphere Technologies [265234.545743] usb 2-1.5: SerialNumber: E2C9A4A8 [265234.655268] cdc_acm 2-1.5:1.0: ttyACM0: USB ACM device [265234.655464] cdc_acm 2-1.5:1.2: ttyACM1: USB ACM device [265234.655667] usbcore: registered new interface driver cdc_acm [265234.655668] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters FreeBSD ^^^^^^^ dmesg :: ugen0.2: at usbus0 umodem0 on uhub5 umodem0: on usbus0 umodem0: data interface 1, has no CM over data, has no break umodem1 on uhub5 umodem1: on usbus0 umodem1: data interface 3, has no CM over data, has no break Connect to the BMP without a MCU Target Attached ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ In a Xterm, and you should see something like this: % arm-none-eabi-gdb :: GNU gdb (GDB) 7.10 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi". Type "show configuration" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: . For help, type "help". Type "apropos word" to search for commands related to "word". Auto-loading of .gdbinit script from current directory is on. Local .gdbinit file was not found. (gdb) target extended-remote /dev/cuaU0 .. note:: use your own device, "/dev/cuaU0" is for my FreeeBSD PC, Linux might be "/dev/ttyACM0" :: Remote debugging using /dev/cuaU0 (gdb) monitor swdp_scan :: Target voltage: 3.04V SW-DP scan failed! (gdb) BMP Pinouts for a Blue Pill ^^^^^^^^^^^^^^^^^^^^^^^^^^^ From /platforms/stlink/platform.h :: /* Hardware definitions... */ #define TDI_PORT GPIOA #define TMS_PORT GPIOB #define TCK_PORT GPIOA #define TDO_PORT GPIOA #define TDI_PIN GPIO7 #define TMS_PIN GPIO14 #define TCK_PIN GPIO5 #define TDO_PIN GPIO6 #define SWDIO_PORT TMS_PORT #define SWCLK_PORT TCK_PORT #define SWDIO_PIN TMS_PIN #define SWCLK_PIN TCK_PIN #define SRST_PORT GPIOB #define SRST_PIN_V1 GPIO1 #define SRST_PIN_V2 GPIO0 #define LED_PORT GPIOA /* Use PC14 for a "dummy" uart led. So we can observere at least with scope*/ #define LED_PORT_UART GPIOC #define LED_UART GPIO14 #define PLATFORM_HAS_TRACESWO 1 #define NUM_TRACE_PACKETS (128) /* This is an 8K buffer */ #define TRACESWO_PROTOCOL 2 /* 1 = Manchester, 2 = NRZ / async */ Jtag/SWD ^^^^^^^^ =========== =========== ================================= Function BMP Notes =========== =========== ================================= GND GND JTMS/SWDIO PB14 JTK/SWCLK PA5 JTDI PA7 JTDO PA6 NRST PB1 "monitor hard_srst" activates UART LED PC14 POWER 3.3V =========== =========== ================================= Serial ^^^^^^ ================= ======== Function BMP RXD (TRACESWO) PA3 TXD PA2 ================= ======== Target Wiring ------------- You can use any supported MCU target but for my testing I used a STM32F051 Cortex-M0 mcu soldered onto a :ref:`headerboard` and a LPC1769 MCU on a LPCXpresso LPC1769 Development Board with the LPC-Link removed. I didn't use the exposed serial as or TRACESWO link. See the picture at https://mecrisp-stellaris-folkdoc.sourceforge.io/bluepill-bmp.html for the STM32F051 wiring. =================== ================= ============== =========== ================== STM32F103 BMP Board Functions STM32F051 pins LPC1769 J4 Wire Colors I used =================== ================= ============== =========== ================== Gnd GND Centre 16 black PA-5 SWCLK 24 6 white PB-14 SWDIO 23 4 grey 3.3V (source) 3.3V 1,5,7 2 red PB-1 NRESET 4 brown LED Anode 32 yellow/red LED Cathode Centre yellow/black =================== ================= ============== =========== ================== Target STM32F051 ---------------- % arm-none-eabi-gdb :: GNU gdb (GDB) 7.10 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi". Type "show configuration" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: . For help, type "help". Type "apropos word" to search for commands related to "word". Auto-loading of .gdbinit script from current directory is on. Local .gdbinit file was not found. (gdb) target extended-remote /dev/cuaU0 :: Remote debugging using /dev/cuaU0 Find SWD Target ^^^^^^^^^^^^^^^ (gdb) monitor swdp_scan :: Target voltage: 2.99V Available Targets: No. Att Driver 1 STM32F05/F030x8 M0 (gdb) **Success, the BMP is working and ready to be used** Flashing ^^^^^^^^ (gdb) attach 1 :: Attaching to Remote target 0x0800002a in ?? () (gdb) file blink.elf :: A program is being debugged already. Are you sure you want to change the file? (y or n) y :: Reading symbols from blink.elf...done. (gdb) (gdb) load :: Loading section .text, size 0x50 lma 0x8000000 Start address 0x8000000, load size 80 Transfer rate: 500 bytes/sec, 80 bytes/write. (gdb) Confirm Flashing ^^^^^^^^^^^^^^^^ (gdb) compare-sections :: Section .text, range 0x8000000 -- 0x8000050: matched. (gdb) Target LPC1769 -------------- This was included as I had a spare board with a LPC1769 but I don'y intend to use it other than to prove that the BMP can work with this chip. To me STM32 is a much, much easier to use and cheaper mcu family than NXP. % arm-none-eabi-gdb :: GNU gdb (GDB) 7.10 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi". Type "show configuration" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: . For help, type "help". Type "apropos word" to search for commands related to "word". Auto-loading of .gdbinit script from current directory is on. Local .gdbinit file was not found. (gdb) target extended-remote /dev/cuaU0 :: Remote debugging using /dev/cuaU0 Find SWD Target ^^^^^^^^^^^^^^^ (gdb) monitor swdp_scan :: Target voltage: 3.19V Please report Designer 0 and Partno 0 and the probed device Available Targets: No. Att Driver 1 LPC17xx M3 (gdb) (gdb) attach 1 :: Attaching to Remote target 0x00000000 in ?? () (gdb) file led-lpc17xx.elf :: A program is being debugged already. Are you sure you want to change the file? (y or n) y y :: Reading symbols from led-lpc17xx.elf...done. (gdb) load :: Loading section .text, size 0x64 lma 0x0 Start address 0x0, load size 100 Transfer rate: 163 bytes/sec, 100 bytes/write .. warning:: There is a caveat with the LPC series of micro-controllers from NXP: these micro-controllers require a checksum in the vector table at the start of the Flash code.The checksum can only be calculated at or after the link stage, but the GNU linker is oblivious of this requirement. Instead, firmware programmers calculate and set the checksum while downloading, and the Black Magic Probe is no exception. The upshot is that compare-sections will now always return a mismatch on the first section, since its contents were changed on the flight while downloading it. To fix compare-sections, the checksum must be set in the vector table in the ELF file after the link phase. It is just a short checksum over a small area of the flash, in order to tell the bootloader that the content of the flash is valid executable code. This is described in the UM v1.8 in chapter 6.4.4.1: "The reserved Cortex-M4 exception vector location 7 (offset 0x001C in the vector table) should contain the 2’s complement of the check-sum of table entries 0 through 6. This causes the checksum of the first 8 table entries to be 0. The boot loader code checksums the first 8 locations in sector 0 of the flash. If the result is 0, then execution control is transferred to the user code." That's it, you only need to look at the first 7 words and apply the correct value to the 8th word. GDB-TUI ------- How to use the BMP with a real world Assembly Language program and the GDB-TUI in circuit debugger. ** UNDER CONSTRUCTION **