Black Magic Probe (BMP) on ST-Link v2 clones

I've been playing around lately with MicroPython lately, initially the port to the ESP8266 WiFi module. I then noticed that the original target for MicroPython was the pyboard, an STM32F407 based board. There was a variation that someone had ported to a generic Chinese STM32F407 board, which I happen to have had around.. so of course I couldn't resist loading on the board and playing with it.

The board I had didn't even have the header populated; just a bare board. Usually when using the STM32F103 based boards (like for my Fluke Multimeter Project, I'd just use the bootloader on the one of the built-in UART devices, and the stm32loader.py python script to load the image. Here, I thought I'd use the Serial Wire Debug (SWD) connector which allows low level debugging of the CPU. This is usually used with a debugger (like gdb) at the other end, along with some software and hardware to connect to the debugging interface.

A common debugger for these devices is called ST-Link which is connected to the host over USB, and then has a few signals (SWDIO, SWCLK) that connect the target device to control the debugging interface in the CPU. This ST-Link functionality is sometime embedded on an evaluation board, along with the target, or as a standalone device. There are many inexpensive/cheap “clones” that implement the USB protocol in a small USB “dongle”.

They look similar to this:.

You'd use some software, like st-util which talks to the ST-Link USB device, and exposes a network server that then the gdb debugger would connect to, and then program flash in the target, stop, start, single-step, examine memory, etc. The gdb debugger has a standard protocol it uses to talk to remote “targets” that it's debugging, and the st-util program exposes this protocol for gdb, and then implements those commands by using the SWD debugging interface to manipulate the target device.

This all works pretty well. You just start-up this “translator” process in another window somewhere, and just connect to it.

Then came this really interesting bit of work called the Black Magic Probe which is a USB device that on the one end implements the SWD debugging protocol (just like ST-Link does). However, on the USB interface, it appears as two “standard” USB serial ports. One of the USB serial ports directly implements the gdb debugging protocol commands! So now, you simply tell gdb to use this serial device to connect to the target for debugging, and you don't need to start up another process running around in the background.

What's really rather novel is that the Black Magic Probe debugger itself is implemented in an STM32F1xx series CPU. And people have ported this open source project to other hardware based on that CPU. And it turns out that the ST-Link debugger is also based on an STM32F101 CPU.. And if you pry open that hardware, you can unlock the flash and reprogram it to be a Black Magic Probe debugger instead of an ST-Link debugger! Cool!

This all is very nicely documented at http://embdev.net/articles/STM_Discovery_as_Black_Magic_Probe which steps through the process.

The reason for this blog posting is to capture some of the detail related to the different hardware versions of these clone ST-Link V2 debuggers. While they look the same externally, the board layouts are slightly different. As part of this process, you actually use *another* ST-Link SWD device to reprogram your ST-Link clone. The SWD signals for doing this are not exposed externally, nor are they marked. You can guess what pads are involved, but the order of the signals varies a bit.

You have to slide off the aluminum cover, back over the USB connector. It's just a friction fit, happily, so no glue to deal with. Once you've done this, you'll see something like this (front and back views):

Or perhaps you'll see something like this:

I've marked the signals as I've discovered them from other web sites, or tracing out the connection for the second version. Hopefully these might be useful to you. There's at least another variation out there, so this is only a hint; you'll want to confirm without doubt that you have the +5v and GND power connections correct at least.

If you look carefully, you can likely identify power and ground connections on those 4 pads based on how the traces are connected to the power signals coming from the USB connector. And then its a matter of distinguishing between the SWDIO and SWCLK signals. One hint is that the SWCLK signal runs to a pin near the corner of the STM32F101 chip.

  Connecting to those pads is a little tricky. Probably during manufacturing, they used some spring-loaded “pogo pins” on the production line. You can probably solder tiny wires to the SWDIO and SWCLK signals and supply +5v and GND power on the large connector. I ended up using some small HP IC “grabber” probes, usually used with my logic analyzer to connect to those signals from another ST-Link debugger.

I ended up just powering it from the large connector, as this second probe that I did seemed to be having difficulty with all 4 grabber probes in use.

And success! Well, mostly. The Black Magic Probe debugger also implements the second USB serial device which is intended to be used as TTL serial connection to some serial port on the target that you're debugging. So talk to it's debugging (like using and FTDI USB serial adapter), and/or debug with SWD and GDB at the same time. Unfortunately, the ST-Link clones don't bring out the other signals for the serial port, so that other capability goes to waste. On the other hand, the ST-Link clones are only around $6.00 from eBay, so I supposed I'll get over it.

Now that the ST-Link clones have been converted to Black Magic Probe devices, further updates can be done over the USB interface by using the USB DFU mechanism. You can do that by an incantation like this:

dfu-util -a 0 -s 0x08002000 -D blackmagic.bin

which installs the new firmware in the flash of the CPU starting at address 0x08002000. Easier now than connecting those tiny grabber probes!