BLACK MAGIC PROBE (BMP)¶
Make a BlackMagic Probe (BMP) using a STM32F103
BMP Homepage¶
Why BlackMagic Probe ?¶
The BlackMagic Probe (BMP) is often suggested as an alternative to a SWD programmer/debugger such as found on the STM32 Discovery/Nucleo Boards and the Chinese USB/SWD $5 dongles.
After building a BMP and using it to develop an Assembly Language program Blinky on A STM32F051 mcu, I think the BMP is ideal for this task.
What you need on the PC¶
arm-none-eabi
A USB port, but who doesn’t have that ?
The BMP¶
Is an open source project which runs on STM32F1xxx processors such as found on the BluePill Board etc with 128KB Flash.
Can flash and debug STM32, SAM3, TI Stellaris and some NXP processors via SWD and JTAG.
Has inbuilt drivers for many Coetex-M MCU’s
Doesn’t need OpenOCD
Exposes a UART link (no hardware handshaking)
Expose a TRACESWO link M3/M4/M7 only ?
Exposes a GDB server
Flashes the target using the “load” command. Works with hex or elf files
Supported Targets¶
https://github.com/blacksphere/blackmagic/wiki/Frequently-Asked-Questions
The Black Magic probe currently supports ARMv6-M and ARMv7-M architecture targets, specifically Cortex-M0, Cortex-M3 and Cortex-M4. Any device with these cores should work. If there are issues, it will probably be with Flash Memory controllers.
The BMP Sourcecode (Nov 2020) lists support for the following.
├── adiv5
├── cortexa
├── cortexm
├── efm32
├── kinetis
├── lmi
├── lpc11xx
├── lpc15xx
├── lpc17xx
├── lpc43xx
├── lpc546xx
├── msp432
├── nrf51
├── nxpke04
├── sam3x
├── sam4l
├── samd
├── samx5x
├── stm32f0
├── stm32f1
├── stm32f4
├── stm32h7
├── stm32l0
├── stm32l4
Building the BMP binary on Linux-MX¶
Install Linux Mx on a PC¶
https://mxlinux.org/
install it
apt-get install build-essential
apt-get install gcc-arm-none-eabi
apt-get install libnewlib-arm-none-eabi
Building the BMP binary¶
git clone https://github.com/blacksphere/blackmagic.git
OR
https://github.com/UweBonnes/blackmagic.git
cd blackmagic
make -j PROBE_HOST=stlink
cp src/blackmagic_dfu.bin ./
truncate --size=8192 blackmagic_dfu.bin
cat blackmagic_dfu.bin src/blackmagic.bin > blackmagic_full.bin
flash blackmagic/src/blackmagic_full.bin (100088 bytes) to the BMP Board using your usual method.
press the reset button on the BMP or reset the power
Test your PC sees the BMP¶
You are looking for something like “Product: Black Magic Probe (STLINK), (Firmware v1.7.1-44-g1f7a716)” and a couple of virtual Com ports listed with DMESG.
Linux¶
dmesg
[265234.434910] usb 2-1.5: new full-speed USB device number 5 using ehci-pci
[265234.545735] usb 2-1.5: New USB device found, idVendor=1d50, idProduct=6018, bcdDevice= 1.00
[265234.545739] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[265234.545740] usb 2-1.5: Product: Black Magic Probe (STLINK), (Firmware v1.7.1-44-g1f7a716)
[265234.545742] usb 2-1.5: Manufacturer: Black Sphere Technologies
[265234.545743] usb 2-1.5: SerialNumber: E2C9A4A8
[265234.655268] cdc_acm 2-1.5:1.0: ttyACM0: USB ACM device
[265234.655464] cdc_acm 2-1.5:1.2: ttyACM1: USB ACM device
[265234.655667] usbcore: registered new interface driver cdc_acm
[265234.655668] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
FreeBSD¶
dmesg
ugen0.2: <Black Sphere Technologies Black Magic Probe STLINK, Firmware v1.7.1-44-g1f7a716> at usbus0
umodem0 on uhub5
umodem0: <Black Magic GDB Server> on usbus0
umodem0: data interface 1, has no CM over data, has no break
umodem1 on uhub5
umodem1: <Black Magic UART Port> on usbus0
umodem1: data interface 3, has no CM over data, has no break
Connect to the BMP without a MCU Target Attached¶
In a Xterm, and you should see something like this:
% arm-none-eabi-gdb
GNU gdb (GDB) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Auto-loading of .gdbinit script from current directory is on.
Local .gdbinit file was not found.
(gdb) target extended-remote /dev/cuaU0
Note
use your own device, “/dev/cuaU0” is for my FreeeBSD PC, Linux might be “/dev/ttyACM0”
Remote debugging using /dev/cuaU0
(gdb) monitor swdp_scan
Target voltage: 3.04V
SW-DP scan failed!
(gdb)
BMP Pinouts for a Blue Pill¶
From /platforms/stlink/platform.h
/* Hardware definitions... */
#define TDI_PORT GPIOA
#define TMS_PORT GPIOB
#define TCK_PORT GPIOA
#define TDO_PORT GPIOA
#define TDI_PIN GPIO7
#define TMS_PIN GPIO14
#define TCK_PIN GPIO5
#define TDO_PIN GPIO6
#define SWDIO_PORT TMS_PORT
#define SWCLK_PORT TCK_PORT
#define SWDIO_PIN TMS_PIN
#define SWCLK_PIN TCK_PIN
#define SRST_PORT GPIOB
#define SRST_PIN_V1 GPIO1
#define SRST_PIN_V2 GPIO0
#define LED_PORT GPIOA
/* Use PC14 for a "dummy" uart led. So we can observere at least with scope*/
#define LED_PORT_UART GPIOC
#define LED_UART GPIO14
#define PLATFORM_HAS_TRACESWO 1
#define NUM_TRACE_PACKETS (128) /* This is an 8K buffer */
#define TRACESWO_PROTOCOL 2 /* 1 = Manchester, 2 = NRZ / async */
Jtag/SWD¶
Function |
BMP |
Notes |
|---|---|---|
GND |
GND |
|
JTMS/SWDIO |
PB14 |
|
JTK/SWCLK |
PA5 |
|
JTDI |
PA7 |
|
JTDO |
PA6 |
|
NRST |
PB1 |
“monitor hard_srst” activates |
UART LED |
PC14 |
|
POWER |
3.3V |
Serial¶
Function |
BMP |
RXD (TRACESWO) |
PA3 |
TXD |
PA2 |
Target Wiring¶
You can use any supported MCU target but for my testing I used a STM32F051 Cortex-M0 mcu soldered onto a headerboard and a LPC1769 MCU on a LPCXpresso LPC1769 Development Board with the LPC-Link removed.
I didn’t use the exposed serial as or TRACESWO link.
See the picture at https://mecrisp-stellaris-folkdoc.sourceforge.io/bluepill-bmp.html for the STM32F051 wiring.
STM32F103 BMP Board |
Functions |
STM32F051 pins |
LPC1769 J4 |
Wire Colors I used |
|---|---|---|---|---|
Gnd |
GND |
Centre |
16 |
black |
PA-5 |
SWCLK |
24 |
6 |
white |
PB-14 |
SWDIO |
23 |
4 |
grey |
3.3V (source) |
3.3V |
1,5,7 |
2 |
red |
PB-1 |
NRESET LED Anode LED Cathode |
4 32 Centre |
brown yellow/red yellow/black |
Target STM32F051¶
% arm-none-eabi-gdb
GNU gdb (GDB) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Auto-loading of .gdbinit script from current directory is on.
Local .gdbinit file was not found.
(gdb) target extended-remote /dev/cuaU0
Remote debugging using /dev/cuaU0
Find SWD Target¶
(gdb) monitor swdp_scan
Target voltage: 2.99V
Available Targets:
No. Att Driver
1 STM32F05/F030x8 M0
(gdb)
Success, the BMP is working and ready to be used
Flashing¶
(gdb) attach 1
Attaching to Remote target
0x0800002a in ?? ()
(gdb) file blink.elf
A program is being debugged already.
Are you sure you want to change the file? (y or n)
y
Reading symbols from blink.elf...done.
(gdb)
(gdb) load
Loading section .text, size 0x50 lma 0x8000000
Start address 0x8000000, load size 80
Transfer rate: 500 bytes/sec, 80 bytes/write.
(gdb)
Confirm Flashing¶
(gdb) compare-sections
Section .text, range 0x8000000 -- 0x8000050: matched.
(gdb)
Target LPC1769¶
This was included as I had a spare board with a LPC1769 but I don’y intend to use it other than to prove that the BMP can work with this chip. To me STM32 is a much, much easier to use and cheaper mcu family than NXP.
% arm-none-eabi-gdb
GNU gdb (GDB) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=amd64-portbld-freebsd11.2 --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Auto-loading of .gdbinit script from current directory is on.
Local .gdbinit file was not found.
(gdb) target extended-remote /dev/cuaU0
Remote debugging using /dev/cuaU0
Find SWD Target¶
(gdb) monitor swdp_scan
Target voltage: 3.19V
Please report Designer 0 and Partno 0 and the probed device
Available Targets:
No. Att Driver
1 LPC17xx M3
(gdb)
(gdb) attach 1
Attaching to Remote target
0x00000000 in ?? ()
(gdb) file led-lpc17xx.elf
A program is being debugged already.
Are you sure you want to change the file? (y or n) y
y
Reading symbols from led-lpc17xx.elf...done.
(gdb) load
Loading section .text, size 0x64 lma 0x0
Start address 0x0, load size 100
Transfer rate: 163 bytes/sec, 100 bytes/write
Warning
There is a caveat with the LPC series of micro-controllers from NXP: these micro-controllers require a checksum in the vector table at the start of the Flash code.The checksum can only be calculated at or after the link stage, but the GNU linker is oblivious of this requirement. Instead, firmware programmers calculate and set the checksum while downloading, and the Black Magic Probe is no exception. The upshot is that compare-sections will now always return a mismatch on the first section, since its contents were changed on the flight while downloading it. To fix compare-sections, the checksum must be set in the vector table in the ELF file after the link phase.
It is just a short checksum over a small area of the flash, in order to tell the bootloader that the content of the flash is valid executable code. This is described in the UM v1.8 in chapter 6.4.4.1:
“The reserved Cortex-M4 exception vector location 7 (offset 0x001C in the vector table) should contain the 2’s complement of the check-sum of table entries 0 through 6. This causes the checksum of the first 8 table entries to be 0. The boot loader code checksums the first 8 locations in sector 0 of the flash. If the result is 0, then execution control is transferred to the user code.”
That’s it, you only need to look at the first 7 words and apply the correct value to the 8th word.
GDB-TUI¶
How to use the BMP with a real world Assembly Language program and the GDB-TUI in circuit debugger.
** UNDER CONSTRUCTION **
