Differences

This shows you the differences between two versions of the page.

--- project:arm_debugging:start [2019/12/20 19:20] – [Reflashing BMP back STLink] v2 vs v2.1 abyssal
+++ project:arm_debugging:start [2021/06/05 19:29] (current) – [Example: Unbricking (restoring) Proxmark bootloader] Flash bootloader and fullimage from same build abyssal
@@ Line 303: / Line 303: @@
 This is happening mostly on cheap clones of proxmark3 Easy.
+To debug Proxmark on newer OpenOCD >= 0.10.0, you may set fast memory access and fast DCC downloads:
+<code>
+openocd -c "adapter_khz 4000" -f interface/jlink.cfg -c "gdb_memory_map disable" -f target/at91sam7x256.cfg -c "init; arm7_9 fast_memory_access enable; arm7_9 dcc_downloads enable"
+</code>
+Seems that flashing bootloader may not be enough, flash bootloader.elf and fullimage.elf from the same build in a single session (e.g. use ''file'' command in gdb), since mixing different branches may still result in bricked proxmark. Some bootloaders can't load fullimages built from other branches.
 ===== J-link connected to Proxmark =====
 {{ :project:proxmark-jlink.jpg?800 | }}
+===== SystemView for J-link - visualization of interrupts or other functions =====
+There is an instrumentation possible with changes to code to show how your functions and interrupts behave - [[https://wiki.segger.com/Use_SystemView_without_RTOS | sample code]]
+Here is an example showing "tail chaining" of interrupts where interrupts are behind one another, and also "late arriving", where Systick interrupts USB interrupt (marked as IST #93 starting at position 2195):
+{{:project:arm_debugging:systemview_20200318_113539.png?800|}}
+If you add extra functions, it may measure your functions as well:
+{{:project:arm_debugging:systemview_20200318_100652.png?800|}}
+As a side note, ST-link on STM32 discovery boards can be reflashed to JLink (works only on discovery boards, not on separate ST-links).
+===== ARM ETM trace - recording executed instructions =====
+ARM processors (Cortex M1+ and others) have built-in a nifty feature that you can record all instructions executed. This requires quite costly hardware (expect 2000 EUR price - JTrace, Lauterbach and uLink), but it can be handy in debugging DMA and interrupts.
+An example ETM trace:
+{{:project:arm_debugging:ozone_error_shutdown_highlighted.png?800|}}
+===== ARM ITM trace - recording samples of executed instructions, interrupts =====
+You can get code profile like this with ITM (screenshow from ''orbtop''):
+{{:project:arm_debugging:orbtop_trezor_lots_of_segwit_inputs.png|}}
+To get this working, [[https://github.com/hiviah/ITM-howto-JLink-STLink|follow this howto]]. It shows steps to be used with JLink/JTrace or STLink to get it moving.
 ====== Flyswatter connected to Proxmark ======
@@ Line 510: / Line 542: @@
 <code>
-PROBE_HOST=stlink ST_BOOTLOADER=1
+make PROBE_HOST=stlink ST_BOOTLOADER=1
 </code>
@@ Line 595: / Line 627: @@
 //B.t.w,BMP with git can now run some things from the command line, when PC-hosted, e.g. "blackmagic_hosted file.bin" will erase and flash file.bin at 0x08000000 . PC-hosted is not fast, maybe [[https://github.com/blacksphere/blackmagic/issues/570 | #570]] can improve by using high level commands.//
+==== Cheap Chinese STLink v2 clones ====
+Some of them can be reflashed to BMP, some can't (stlink-tool reports error). There are more versions, so the pinout on the outside and also on the board depends on the specific clone type.
+An example how to [[http://blog.linuxbits.io/2016/02/15/cheap-chinese-st-link-v-2-programmer-converted-to-black-magic-probe-debugger/ | use one cheap clone to flash other]]. The cloned STLink is STM32F1 and it has [[http://blog.linuxbits.io/wp-content/uploads/2016/02/P1160474_clipped2.jpg | SWD pins routed out on the board]]
+Original STLink (flashed with BMP with ST bootloader) using to program BMP on the cheap clone (haven't yet figure out how to restore ST bootloader, since I don't have the executable image containing the bootloader):
+{{:project:arm_debugging:stlink_clone_bmp.png|}}
+==== BMP PC-hosted with BMP HW target ====
+For BMP built with ''PROBE_HOST=pc-hosted'' you can connect to an external physical BMP with:
+<code>
+./src/blackmagic_hosted -s /dev/ttyACM0
+</code>
+It will create port 2000 listening for GDB connection and you can use the classic BMP commands like scan and attach:
+<code>
+>>> target extended-remote :2000
+Remote debugging using :2000
+>>> monitor swdp_scan
+Target voltage: unknown
+Available Targets:
+No. Att Driver
+      STM32F1 medium density M3/M4
+>>> attach 1
+Attaching to program: blackmagic-stlink-v2/src/blackmagic, Remote target
+x0800effc in st_usbfs_ep_read_packet (dev=<optimized out>, addr=<optimized out>, buf=<optimized out>, len=<optimized out>) at ../common/st_usbfs_core.c:230
+			USB_SET_EP_RX_STAT(addr, USB_EP_RX_STAT_VALID);
+</code>
+==== BMP PC-hosted with unmodified STLink v2 target (requires firmware >= V2J32xx) ====
+Upgrade STLink fw first with the STLinkUpgrade tool mentioned before.
+With this firmware you can use external unmodified STLink with BMP (''PROBE_HOST=pc-stlinkv2''):
+<code>
+./src/blackmagic_stlinkv2
+</code>
+It will create port 2000 listening for GDB connection and you can use the classic BMP commands like scan and attach:
+<code>
+>>> target extended-remote :2000
+Remote debugging using :2000
+>>> monitor swdp_scan
+Target voltage: unknown
+Available Targets:
+No. Att Driver
+      STM32F1 medium density M3/M4
+>>> attach 1
+Attaching to program: blackmagic-stlink-v2/src/blackmagic, Remote target
+x0800effc in st_usbfs_ep_read_packet (dev=<optimized out>, addr=<optimized out>, buf=<optimized out>, len=<optimized out>) at ../common/st_usbfs_core.c:230
+			USB_SET_EP_RX_STAT(addr, USB_EP_RX_STAT_VALID);
+</code>
 ===== Other useful tools that are specific to STM32 chips  =====