This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MSP430F5659: BSL-Scripter corrupting reset vector with certain binary files

Part Number: MSP430F5659
Other Parts Discussed in Thread: UNIFLASH

I am using the BSL-Scripter with the provided example scripts to write a new firmware in the MSP430F5659 via USB.

I have firmwares that work without any issue, and other ones that don't. For the ones that don't, the program simply does not start after the flash. After some digging, I noticed that the reset vector (address 0xFFFE) gets corrupted with value 0x0200 instead of the expected 0x0283. I was able to confirm it using Uniflash and exporting the whole memory. See image above showing the difference between the input file and the export from Uniflash. 

image.png

Every other bytes of the export is an exact match with the input file - only that one 0x00 byte is wrong.

I can flash that exact same program with CCS, as well as MSPFlasher, without any issue (via JTAG though, not USB).

I've provided a zip file containing: (fyi these files do not contain any proprietary information)

  • Input_GOOD.txt
    • A firmware example (TI-TXT format) that works perfectly fine with BSL-Scripter and the provided example scripts.
  • Input_BAD.txt
    • A firmware example (TI-TXT format) that causes the issue while using the exact same BSL-Scripter scripts. As mentionned, if flashed via JTAG (CCS or MSPFlasher), it works correctly.
  • EXPORT_Input_GOOD.txt
    • The exported memory I get from Uniflash directly after flashing Input_GOOD.txt using BSL-Scripter
  • EXPORT_Input_BAD.txt
    • The exported memory I get from Uniflash directly after flashing Input_BAD.txt using BSL-Scripter
  • EXPORT_Input_BAD_Flashed_From_JTAG.txt
    • The exported memory I get from Uniflash directly after flashing Input_BAD.txt using JTAG. It is an exact match with the Input_BAD.txt file. The program runs fine after flashing.
  • Folder BSL-Scripter
    • All the files used by BSL-Scripter (pretty much just the stock 5xx_USB example provided by TI)

Note: Both Input_GOOD and Input_BAD are from the same codebase, just with slighly different parts of code. The difference is not related to flash memory or anything. The codebase do not ever play with flash. Anyway from my understanding the code never runs anyway because the reset vector is wrong.

I tried modifying the Input_BAD firmware file to be one continuous block starting at @8000 up to 'q' (end of firmware) instead of having different sections @8000, @ffc6, etc. It did not solve the issue.

I also tried adding a @10000 section in order to force a new section just after the corrupted reset vector (@fffe), it did not solve the issue either.

 

Am I missing something obvious? Thanks in advance.

ZIP File:
debug_BSL_Scripter.zip 

  • Hi,

    It sounds like the fact that every other byte is a perfect match, and that the code flashes flawlessly over JTAG using CCS or MSPFlash, this would point directly to a known, subtle quirk in how the TI BSL-Scripter handles specific Intel Hex (.hex) or TI-TXT (.txt) file formatting structures. The bootloader (BSL) is not corrupted on purpose. Instead, BSL-Scripter is dropping exactly one data payload byte due to a packet alignment or parser mismatch at the very end of your binary, which shifts the final written byte (0x83) out of its expected boundary, leaving behind the default 0x00 in the higher byte of the reset vector. A couple of things that you can try:

    1. Fix Missing Odd-Byte Padding in Your Compiler Output --> Open your CCS project properties, navigate to Build > MSP430 Hex Utility > General Options, and ensure that Fill flash holes or Even-byte alignment padding options are enabled. Alternatively, ensure your linker command file aligns all final flash sections to a 2-byte boundary using the align(2) directive
    2. Verify Line-Ending Formatting in the Script File --> The USB BSL interface on the MSP430F5659 acts as a strict packet-based parser. If the failing firmware generates a .hex or .txt file where the very last line containing the reset vector (@FFFE or the hex EOF record) lacks a trailing Carriage Return/Line Feed (CRLF), BSL-Scripter will fail to transmit the final block chunk correctly.
    3. Switch Output Generation Formats --> If you are passing an Intel Hex (.hex) file to BSL-Scripter, the tool must internally convert those records into address-payload blocks. For many developers, the conversion loop inside BSL-Scripter can stumble depending on how your specific compiler packages the upper-memory addresses. Change your CCS Hex Utility configuration to generate a raw TI-TXT (.txt) file instead of Intel Hex. The TI-TXT format maps cleaner into the raw memory chunks that the BSL expects, eliminating parser translation drops

    -Brian

  • This would seem to ignore the information provided. It isn't an odd byte or lack of CRLF, and it sure looks like TI-TXT to me.

    From the input files:

    Good:

    @ffd8
    1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 00 80 
    1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 
    1E 83 96 82 1E 83 02 83 4A 14 C9 0E C7 0D C6 0C 
    4F 49 5F 0E 40 18 5A 4F D4 87 07 93 02 24 D6 03

    Bad:

    @ffd8
    1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 00 80 
    1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 1E 83 
    1E 83 96 82 1E 83 02 83 4A 14 C9 0E C7 0D C6 0C 
    4F 49 5F 0E 40 18 5A 4F 50 85 07 93 02 24 D6 03 

  • Thanks Brian for your reply!
    Sorry my post is misleading, I mentioned the format to be "TI-HEX", but that does not exist. It is in fact a TI-TXT format that is being used for all files, as per your suggestion.

  • Hi,

    I have reached out to our software team for additional support. This issue doesn't appear to be trivial and may take some time to find the root cause and a solution. Can you provide us with the setup you are using with the BSL-scripter (programmer and operating system)?

    Best Regards,
    Brian

  • The BSL-Scripter program should produce a log file. Examining the log, especially around the parts where it is writing to/near the reset vector might be helpful.

    The source code is available but the authors are of the new school which thinks comments are over-rated so figuring out what it is doing hat way is a chore.

**Attention** This is a public forum