Spark Logic

Black Magic Probe on an stm32f103c8

Rick Kimball Sat May 16, 2015 1:08 am

11/07/2017 – I attached a binary that can be loaded onto your blue pill in this post: viewtopic.php?f=37&t=2801

12/3/2016 – You can now contribute to developers of the Black Magic Probe project (which isn’t me) using paypal. Find and click the paypal contribute button here: https://github.com/blacksphere/blackmagic

12/8/2016 – Instead of using this port of Black Magic Probe, it is a lot easier to just compile the PROBE_HOST=stlink and load that onto your bluepill. The bluepill hardware is the same as the stlink v1/v2 hardware. Just follow the steps from the Black Magic Probe software for building and installing the BMP stlink platform. The advantage being, you will get the latest BMP version and you will be able to update future versions just using the USB cable on the bluepill with a program called usb-util. The posts in this thread can be thought of as an interesting read on my journey from bluepill newbie to a somewhat proficient users of it.

The Black Magic Probe is a modern, in-application programmer and debugging software for embedded microprocessors. It allows you to see what is going on ‘inside’ an application running on an embedded microprocessor while it executes. It is able to control and examine the state of the target microprocessor using a JTAG or SWD (Serial Wire debugging) port and on-chip debug logic provided by the microprocessor. The probe connects to a host computer using a standard USB interface. The user is able to control exactly what happens using the GNU source level debugging software, GDB. Read more about it here: https://github.com/blacksphere/blackmagic/wiki

However, the stm32duino crowd here will find the open source Black Magic firmware more appealing than the hardware. The Black Magic Probe firmware can be loaded onto the low cost stm32c8t6 boards you find on eBay. You can then use that clone board with BMP firmware to take the place of an ST-Link programmer. Once the BMP firmware is loaded on a clone board, it provides the ability to upload to the flash of another target board. It does this using a gdb server built into the BMP firmware. This allows for hardware debugging using just arm-none-eabi-gdb without any host server code.

I started with the latest github version of the Black Magic Probe software and added platform support for the stm32f103c8t6 boards you find on ebay. I call it the ‘jc66_coreboard’ platform, as that is the label printed on the silk screen. Any board with the same pin outs should work (See Red Pill Blue Pill post for more info about the hardware). The new platform is based mostly on the already existing stlink platform source with changes to support the different hardware pin outs and features.

The ebay “Red Pill” board loaded with the Black Magic Probe firmware acting like a programmer:
Image
by Rick Kimball, on Flickr

Target board (another “Red Pill” board) connections from the “Red Pill” BMP programmer:
Image

I’ve attached a zip file containing the blackmagic.bin file, the blackmagic elf file, and patch file for the source. ( NOTE: I will fork BMP github code and create a branch with the source changes). For now, just download and unpack the zip and then upload the bin or elf file to your jc66_coreboard.

If you want to build the source yourself, do something like the following:
$ git clone https://github.com/blacksphere/blackmagic
Cloning into 'blackmagic'...
remote: Counting objects: 3463, done.
remote: Compressing objects: 100% (2/2), done.
remote: Total 3463 (delta 0), reused 0 (delta 0), pack-reused 3461
Receiving objects: 100% (3463/3463), 1.70 MiB | 0 bytes/s, done.
Resolving deltas: 100% (2331/2331), done.
Checking connectivity... done.
$ cd blackmagic
$ unzip ../bmp_jc66_coreboard.zip
Archive: ../bmp_jc66_coreboard.zip
inflating: blackmagic
inflating: blackmagic.bin
inflating: bmp_jc66_coreboard.patch
$ patch -p1 <bmp_jc66_coreboard.patch
patching file src/Makefile
patching file src/command.c
patching file src/platforms/common/cdcacm.c
patching file src/platforms/jc66_coreboard/Makefile.inc
patching file src/platforms/jc66_coreboard/Readme
patching file src/platforms/jc66_coreboard/jc66_coreboard.png
patching file src/platforms/jc66_coreboard/platform.c
patching file src/platforms/jc66_coreboard/platform.h
$ make
$ cd src
$ make install # assuming it go OK, you will have to change the path for the st-write utility to match your system

Replies

RogerClark Sun May 17, 2015 11:05 am

Rick,

I’ve tried to install the BMP binary on 2 different C8 boards

This one didnt work, I just get unknown device on USB

Image

However I have a feeling the board either has a defective USB connection or it doesn’t have a pull up resistor etc and will only work on USB with special firmware

The other C8 board, was fine (its the same board you have)

On Windows I had to download and install the drivers from here http://www.blacksphere.co.nz/downloads/ … 130819.zip

What does seem a bit odd, is that the drivers 2 years old http://www.blacksphere.co.nz/downloads/

I guess they have no need to update them, but I suspect that they may not work on Windows 10 without us re-packaging them (but its hard to know quite what Windows 10 will end up doing until its released)

I guess it doesnt really matter, but has BlackSphere given up selling the BMP ? There isnt a link to where you an buy it from, on their website. Well there is some text but no hyperlink

Is there any documentation about what GPIO pins on the flashed board need to be connected to the CLOCK and SDIO pins on the SWD connector ?

Do you know how the UART works, is this just a method to print debug messages

e.g. I found this code,

http://electronics.stackexchange.com/qu … d-using-gd

Is this the sort of UART functionality it provides ?

Thanks

Roger

ahull Sun May 17, 2015 12:23 pm

I wonder if it would be possible to flash the BMP firmware on one of http://www.ebay.co.uk/itm/181736138353? … 26_rdc%3D1these.

Since I now have two of these ST-Link V2 clones it should be possible to use one to probe the other. They are also scarily cheap. If I get a chance I’ll try and reverse engineer the board and see if I can A) copy off the existing firmware, and B) figure out if we have enough pins etc to re-purpose it as a Black Magic Probe.

Rick Kimball Sun May 17, 2015 12:29 pm

RogerClark wrote:
This one didnt work, I just get unknown device on USB

Rick Kimball Sun May 17, 2015 12:49 pm

I really haven’t documented all the features. There are some other modifications in there if you look at the code.

I included support for reading the target boards VCC voltage. I found a patch on blackmagic mailing list
http://sourceforge.net/p/blackmagicdebu … /33693983/. I slightly modified it to fit the hardware on this board. To use this feature you need to do some things:

o Add a voltage divider and diode on pin PA0.
Use 4k7 resistors and connect to your TARGET VCC (On the c8 board it is broken out with the SWD pins)

pa0_diode_circuit.png
pa0_diode_circuit.png (5.17 KiB) Viewed 28618 times

ahull Sun May 17, 2015 1:30 pm

ahull wrote:I wonder if it would be possible to flash the BMP firmware on one of http://www.ebay.co.uk/itm/181736138353? … 26_rdc%3D1these.

Since I now have two of these ST-Link V2 clones it should be possible to use one to probe the other. They are also scarily cheap. If I get a chance I’ll try and reverse engineer the board and see if I can A) copy off the existing firmware, and B) figure out if we have enough pins etc to re-purpose it as a Black Magic Probe.

victor_pv Sun May 17, 2015 3:18 pm

Rick, is there a way to use BMP and GDB on windows with the Arduino IDE? I have never used either, so I am getting a bit lost at what is needed.
If you could point me to some directions I can read and try to figure it out.

thanks.

Rick Kimball Sun May 17, 2015 4:14 pm

[EDIT] .. see the next post for a possible answer[/EDIT]

victor_pv wrote:Rick, is there a way to use BMP and GDB on windows with the Arduino IDE? I have never used either, so I am getting a bit lost at what is needed. If you could point me to some directions I can read and try to figure it out. thanks.

Rick Kimball Sun May 17, 2015 5:18 pm

I went ahead and modified the platform.txt to do the upload via arm-none-eabi-gdb.

Here is what it looks like when you have verbose upload turned on with the Arduino IDE on linux:

makerlabme_gdb.png
makerlabme_gdb.png (82.85 KiB) Viewed 28603 times

RogerClark Sun May 17, 2015 9:28 pm

Rick

I think that code should work on Windows, but for greater compatibility for anyone on IDE 1.6.1 or earlier I think the path to GDB needs to be changed to the same path that is defined at the top of platform.txt, and then allow the rewrite-keys to handle changing it if necessary

With my other C8 board.
It could just be the board is defective.

Re: connections

After I posted, I managed to find a schematic of a derivative of the BMP called the Cricket Probe, and I can see that the BMP uses serial port 1 to connect to the target, as well as the SWD connection.

I will have a go at using the same model of F103C8 board that you use, and connect to my ZET board.

@ahull

Re: flashing an STLink.

I noticed in the GitHub code that there is a target of STlink, rather than the target of STM32 which I think rick may be using.

I was debating whether to reflash my STLink as a BMP, as I read the article you linked to and then tracked down the Stlink binary it referenced, on a Russian website.

However my stlink board only has the SWD pins broken out to a connector, so connecting a USB to serial to it, and pulling boot 0 high, in order to flash it, would be difficult.

In the longer term I may however reflash by F4 Discover stlink as its a pain needing a separate USB to serial for comms, I.e the Discovery stlink firmware doesn’t come with the virtual serial like the Nucleo firmware does :-(

Rick Kimball Sun May 17, 2015 9:34 pm

RogerClark wrote:Rick
After I posted, I managed to find a schematic of a derivative of the BMP called the Cricket Probe, and I can see that the BMP uses serial port 1 to connect to the target, as well as the SWD connection.

Rick Kimball Sun May 17, 2015 10:07 pm

So after playing with this for a while. I realized that I needed to make a few modifications to the gdb commands I’m running with the -ex arguments. This seems to make it somewhat more reliable. I ended up putting shell sleep x in a couple of places, and yes I realize this is going to be problem with windows. I also read memory after erasing and after loading to force gdb to wait until it is done with any pending memory operations. After the file is loaded, I actually set a breakpoint on main and force it to reset and rerun the firmware. This is so the user doesn’t have to press the reset button when it is done loading. Here is what I have right now:

tools.sloadhost.upload.pattern="{path}{cmd}" -b 38400 -ex "set debug remote 0" -ex "set confirm off" -ex "set height 0" -ex "target extended-remote {serial.port}" -ex "mon swd" -ex "shell sleep 2" -ex "echo \nattach...\n" -ex "attach 1" -ex "shell sleep 2" -ex "x/wx 0x8000004" -ex "monitor erase_mass" -ex "x/wx 0x8000004" -ex "load" -ex "x/i *0x8000004" -ex "break main" -ex "run" -ex "echo \n\n\n{build.project_name}.elf uploaded!\n" -ex "quit" "{build.path}/{build.project_name}.elf"

Rick Kimball Mon May 18, 2015 12:32 am

OK, I think I figured out some of the issues. GDB will work in async mode and return immediately unless you turn that feature off. This seems to work and I was able to get rid of all the shell sleep instructions:

tools.sloadhost.upload.pattern="{path}{cmd}" -b 38400 -ex "set debug remote 0" -ex "set remotetimeout 10" -ex "set confirm off" -ex "set target-async off" -ex "set height 0" -ex "target extended-remote {serial.port}" -ex "mon swd" -ex "attach 1" -ex "x/wx 0x8000004" -ex "monitor erase_mass" -ex "echo address value should be 0xffffffff after erase\n" -ex "x/wx 0x8000004" -ex "file {build.path}/{build.project_name}.elf" -ex "load" -ex "x/i *0x8000004" -ex "break main" -ex "run" -ex "echo \n\n\n{build.project_name}.elf uploaded!\n" -ex "quit"

RogerClark Mon May 18, 2015 12:39 am

Rick,

Thanks.

Work is a bit busy for me at the moment, but I’ll give it a try this evening (my time)

Cheers

Roger

Rick Kimball Mon May 18, 2015 8:40 pm

[Edit] I deleted the attachment here .. first post contains full versions of modified board.txt and platform.txt files[/EDIT]

This patch will add a BMP uploader feature to the generic stm32f103c boards. Apply it to the latest stm32duino source code. Someone with windows and OS/X might want to try this and see if it works.

$ # kill any running arduino sessions
$ cd Arduino_STM32
$ unzip bmp_upload.patch.zip
$ patch -p1 <bmp_upload.patch
$ # restart arduino

-rick

ahull Mon May 18, 2015 9:10 pm

@Rick. On my Linux box..

Patch seems to be safe, and appears to do what you describe.

IDE still compiles code, but since I have no BMP to play with (yet…. give me time)… it fails with the following message..
COM1: No such file or directory.
"monitor" command not supported by this target.
Don't know how to attach. Try "help target".
Cannot access memory at address 0x8000004
"monitor" command not supported by this target.
Cannot access memory at address 0x8000004
You can't do that when your target is `exec'
The program is not being run.
Don't know how to run. Try "help target".
The program is not being run.

RogerClark Mon May 18, 2015 9:29 pm

@ahull

Do you have a spare F103C8 board, if so you just flash Ricks binary into it.

I flashed by spare board and it enumerates fine on windows, but I’ve been a bit preoccupied trying to unify the bootloader that victor made for generic boards with the existing bootloader, and I’ve also been trying to get DDD working on windows ( see my post in the general discussion thread)

I’m happy to add upload to BMP as an option on all generic boards, as I see this as a low risk change, as its just adding new features and should not disturb the old ones.

I must admit I’m surprised about how few people are interested in In Circuit debugging, but it could be just a catch 22 situation at the moment, with both the lack of easily available hardware and software, and no windows GUI.

ahull Mon May 18, 2015 9:32 pm

@Roger – if I get some spare time I was planning on trying to build/flash to a generic “ST-Link V2” clone, since I now have a couple of these to play with (and probably break :D ). Spare time is the missing ingredient at the moment.

RogerClark Tue May 19, 2015 10:22 am

Rick and @ahull

FYI. Just as a matter of interest, I flashed Ricks previous bin to my F103ZET board, and it enumerates fine as a BMP !

I don’t intend to use it as a BMP, but I accidentally flashed a HTML page to it, (I must remember right clicking and saving links to files in github does not save the bin file !!!)
So rather than leaving complete junk code in the board, I immediately flashed what I had to hand which was BMP !

I’ve been flat out with work recently and have had very little free time, so have not had time to wire up my C8 as a BMP yet, but I will hopefully have some time at the weekend

RogerClark Tue May 19, 2015 11:20 am

Rick,

I’m not sure why, but when I tried to apply your patch, I couldn’t get MinGW patch to patch the file

Basically it rejected the patch and didnt modify either file, it just spat our some .rej and also some orig files instead

But as it was a really small patch I’ve applied it my hand and I will push to the repo…

However I’m not sure it works on Windows.

I get these messages when I ran it



GNU gdb (GNU Tools for ARM Embedded Processors) 7.6.0.20140228-cvs
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type “show copying”
and “show warranty” for details.
This GDB was configured as “–host=i686-w64-mingw32 –target=arm-none-eabi”.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
0x8000004: 0x8000004 expect 0xffffffff after erase
COM3: No such file or directory.
“monitor” command not supported by this target.
Don’t know how to attach. Try “help target”.
Cannot access memory at address 0x8000004
“monitor” command not supported by this target.
Cannot access memory at address 0x8000004
C:UsersrclarkAppDataLocalTempbuild7632203454613856955.tmp/usb_test.cpp.elf: No such file or directory.
No executable file specified.
Use the “file” or “exec-file” command.
Cannot access memory at address 0x8000004
The program is not being run.
No symbol table is loaded. Use the “file” command.
Don’t know how to run. Try “help target”.
The program is not being run.
0x8000004: Starting program:

usb_test.cpp.elf uploaded!

I’m going to write a window batch file to handle this on windows, I suspect it would be best to do the same on Linux, as its far easier to do stuff in a script than in one line in platform.txt

Rick Kimball Tue May 19, 2015 11:31 am

[EDIT] I updated this to version 1 –
o modified command line args in platform.txt (boards.txt did not change)
o removed windows batch file usage
o tested successfully on both windows and linux, (nice if someone could try on OS/X
[/EDIT]

full boards.txt and platform.txt as a zip
(4.99 KiB) Downloaded 82 times

Sign in to reply