This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MSP430F6659: BSL password

Other Parts Discussed in Thread: MSP430F6659

Nice to meet you.

We are developing a product with TI MSP430F6659 MCU.

And we use the USB BSL to do the F/W (user application) upgrade.

According to the Application Report (SLAA452C), USB Field Firmware Updates on MSP430 MCUs, Chapter 3.4 BSL Password, it said:

>> The password consists of the device’s memory contents at addresses 0xFFE0 to 0xFFFF that exist

>> at the time of BSL access. This range is a subset of the vector table.

1) Is the BSL password generated by the IAR Embedded Workbench?

2) What are the procedures to generate the BSL Password?

Thank you.

  • Hi Hank,

    IAR will be putting things in the addresses 0xFFE0 to 0xFFFF because this contains part of the vector table for your part. For example, 0xFFFE will always have a value being put into it because this is the address where the RESET vector is stored, so the value stored at 0xFFFE will be the address where the MSP430 jumps to after a reset.

    So, you can either find the password by simply generating a TI-txt file from your IAR code and looking at the addresses 0xFFE0 to 0xFFFF: . When you build your password is basically being determined by where your ISRs have been placed in the final code image, so as your code changes during development your password can also change - something to be aware of.

    You could theoretically fill unused interrupt vector locations with whatever values you'd like to define as part of your password, but if code accidentally jumped to one of these vectors it would then jump off to this address and you may not know what is stored there, so this is not really the "correct" way to do it.

    If you really wanted to explicitly define your own password instead of having the linker basically choose it for you, and do it the correct safe way it would mean manipulating your code and linker file to put ISRs at different addresses for any interrupts (or unused interrupts) that have vectors in this 0xFFE0-0xFFFE area, because these are the values that are going to make up the password. You would want to go to your lnk430F6659.xcl linker file in your IAR install, make a copy of it to save the original for later use before modification. Then modify your version of it - specifically, see the line 194

    -Z(CODE)CSTART,ISR_CODE,CODE16=8000-FF7F

    This line of code is basically telling the linker that it must place the C-startup, ISR code and small code model code in the lower Flash from 0x8000-0xFF7F.As an example, lets say you wanted to make the last several bytes of your password be "00 C0 00 B0 00 A0 00 80" where 00 80 is just defined by your code starting at 0x8000 the beginning of flash.  You could alter this line 194 of the linker file to instead be:

    //-Z(CODE)CSTART,ISR_CODE,CODE16=8000-FF7F
    -Z(CODE)CSTART,ISR_CODE,CODE16=8000-A000,A003-AFFF,B003-BFFF,C003-FF7F
    //my changes
    -Z(CODE)UNMI_SEG=B000-B003
    -Z(CODE)SYSNMI_SEG=A000-A003
    -Z(CODE)COMP_B_SEG=C000-C003

    As you can see, this declares some segments for a UNMI, SYSNMI, and COMP_B ISR (You'll see that these ISRs are the three at the end of the vector table right before the reset vector which will be 0x8000 in this case for start of code). Now in your C code, you can make dummy ISRs for these and place them in these segments:

    #pragma location="SYSNMI_SEG"
    #pragma vector=SYSNMI_VECTOR
    __interrupt void SYSNMI_ISR(void)
    {
    	while(1); //trap
    }
    
    #pragma location="UNMI_SEG"
    #pragma vector=UNMI_VECTOR
    __interrupt void UNMI_ISR(void)
    {
    	while(1); //trap
    }
    
    #pragma location="COMP_B_SEG"
    #pragma vector=COMP_B_VECTOR
    __interrupt void COMP_B_ISR(void)
    {
    	while(1); //trap
    }

    Now the linker will place this ISR code at the addresses 0xA000, 0xB000, and 0xC000 so this is what ended up in our BSL password. You could do whatever addresses you like for placing your ISRs to define your password as long as: 1) they are below 0xFF80, and 2) you leave enough room in the segments that you define for the ISR. These were short because they are just trap ISRs, but if you had a real ISR you would need to leave more room. You can use the .map file (Options > Linker > List > Generate Linker Listing) to see how long any ISRs you currently have are taking up. Also note your BSL password doesn't contain all of your interrupt table, so you really would only need to do this for the ISRs corresponding to interrupt vectors from 0xFFE0 up.

    If you build, you should be able to see this at the end of the TI-txt file that is generated:

    @A000
    FF 3F 03 43 
    @B000
    FF 3F 03 43 
    @C000
    FF 3F 03 43 
    @FFF8
    00 C0 00 B0 00 A0 00 80 
    q

    Does this help explain?

    Regards,

    Katie

  • Another alternative -- this one sounds complicated, but actually quit simple to implement and far more safe and flexible to use.

    Change the BSL code so that it checks the password against a different block of Flash memory (instead of part of the Interrupt/Reset Vectors). Also change the Linker Command to allow your application code to put any constants in that block of Flash.

    For the change in BSL code, you only need to change one word of the existing BSL code.
  • ... continue

    For the change in BSL code, you only need to change one word of the existing BSL code.
    Search the image of the existing BSL code for the sequence 0x403? 0xFFE0 (where ? is any nibble). Chances are, there is one and only one occurrence of that 2-word sequence in the entire BSL code image. Change the second word 0xFFE0 to a different word address, and that is the only change needed.

    In this scheme, the password still consists of 16 words. But they are not confined to word addresses (can be any word between 0x0000 and 0xFFFF, even or odd, big or small). And they have no side effects of misdirecting interrupts.
  • Thanks for your kind help.

    Now, we understand it in more details.

    Have a nice day.

**Attention** This is a public forum