This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MSP432 Getting BSL and Flash Mailbox back?

Other Parts Discussed in Thread: UNIFLASH

Hello,

I'm playing with the new MSP432 Launchpad, and want to implement a Boot Override Flash Mailbox configuration to use the hardware invoked TI BSL. But when trying to read the contents of the Boot Override Flash Mailbox, I'm getting a lot of 0xFFFFFFFF's instead of the Mailbox Start 0x0116ACF6 for example. In the Datasheet is described, that this area is not protected. So possibly it has been deleted sometime. My first question is, if it has been designed for 'self-reconsturction', i.e. writing the Mailbox Start content on my own etc.? 

Besides, I'm sure, that the BSL is erased either. Is there a possibility to get the the original BSL back into Flash? 

And last but not least, I'm missing the preprocessor defines for the Boot Override Flash Mailbox in msp432p401r.h. I think there should be added something like it has been done for the TLV: 

typedef struct {
	__IO uint32_t rMB_START;
	__IO uint32_t rCMD;
	__IO uint32_t rFAC_RESET_ACK;
	__IO uint32_t rRESERVED0;
	__IO uint32_t rJTAG_SWD_LOCK_SECEN;
	__IO uint32_t rJTAG_SWD_LOCK_AES_INIT_VECT_0;
	__IO uint32_t rJTAG_SWD_LOCK_AES_INIT_VEC_1;
	__IO uint32_t rJTAG_SWD_LOCK_AES_INIT_VEC_2;
	__IO uint32_t rJTAG_SWD_LOCK_AES_INIT_VEC_3;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_0;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_1;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_2;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_3;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_4;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_5;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_6;
	__IO uint32_t rJTAG_SWD_LOCK_AES_SECKEYS_7;
	__IO uint32_t rJTAG_SWD_LOCK_UNENC_PWD_0;
	__IO uint32_t rJTAG_SWD_LOCK_UNENC_PWD_1;
	__IO uint32_t rJTAG_SWD_LOCK_UNENC_PWD_2;
	__IO uint32_t rJTAG_SWD_LOCK_UNENC_PWD_3;
	__IO uint32_t rJTAG_SWD_LOCK_PARAMS_ACK;
	__IO uint32_t rRESERVED1;
	__IO uint32_t rRESERVED2;
	__IO uint32_t rSEC_ZONE0_SECEN;
	__IO uint32_t rSEC_ZONE0_START_ADDR;
	__IO uint32_t rSEC_ZONE0_LENGTH;
	__IO uint32_t rSEC_ZONE0_AESINIT_VECT_0;
	__IO uint32_t rSEC_ZONE0_AESINIT_VECT_1;
	__IO uint32_t rSEC_ZONE0_AESINIT_VECT_2;
	__IO uint32_t rSEC_ZONE0_AESINIT_VECT_3;
	__IO uint32_t rSEC_ZONE0_SECKEYS_0;
	__IO uint32_t rSEC_ZONE0_SECKEYS_1;
	__IO uint32_t rSEC_ZONE0_SECKEYS_2;
	__IO uint32_t rSEC_ZONE0_SECKEYS_3;
	__IO uint32_t rSEC_ZONE0_SECKEYS_4;
	__IO uint32_t rSEC_ZONE0_SECKEYS_5;
	__IO uint32_t rSEC_ZONE0_SECKEYS_6;
	__IO uint32_t rSEC_ZONE0_SECKEYS_7;
	__IO uint32_t rSEC_ZONE0_UNENC_PWD_0;
	__IO uint32_t rSEC_ZONE0_UNENC_PWD_1;
	__IO uint32_t rSEC_ZONE0_UNENC_PWD_2;
	__IO uint32_t rSEC_ZONE0_UNENC_PWD_3;
	__IO uint32_t rSEC_ZONE0_ENCUPDATE_EN;
	__IO uint32_t rSEC_ZONE0_DATA_EN;
	__IO uint32_t rSEC_ZONE0_PARAMS_ACK;
	__IO uint32_t rRESERVED3;
	__IO uint32_t rRESERVED4;
	__IO uint32_t rSEC_ZONE1_SECEN;
	__IO uint32_t rSEC_ZONE1_START_ADDR;
	__IO uint32_t rSEC_ZONE1_LENGTH;
	__IO uint32_t rSEC_ZONE1_AESINIT_VECT_0;
	__IO uint32_t rSEC_ZONE1_AESINIT_VECT_1;
	__IO uint32_t rSEC_ZONE1_AESINIT_VECT_2;
	__IO uint32_t rSEC_ZONE1_AESINIT_VECT_3;
	__IO uint32_t rSEC_ZONE1_SECKEYS_0;
	__IO uint32_t rSEC_ZONE1_SECKEYS_1;
	__IO uint32_t rSEC_ZONE1_SECKEYS_2;
	__IO uint32_t rSEC_ZONE1_SECKEYS_3;
	__IO uint32_t rSEC_ZONE1_SECKEYS_4;
	__IO uint32_t rSEC_ZONE1_SECKEYS_5;
	__IO uint32_t rSEC_ZONE1_SECKEYS_6;
	__IO uint32_t rSEC_ZONE1_SECKEYS_7;
	__IO uint32_t rSEC_ZONE1_UNENC_PWD_0;
	__IO uint32_t rSEC_ZONE1_UNENC_PWD_1;
	__IO uint32_t rSEC_ZONE1_UNENC_PWD_2;
	__IO uint32_t rSEC_ZONE1_UNENC_PWD_3;
	__IO uint32_t rSEC_ZONE1_ENCUPDATE_EN;
	__IO uint32_t rSEC_ZONE1_DATA_EN;
	__IO uint32_t rSEC_ZONE1_PARAMS_ACK;
	__IO uint32_t rRESERVED5;
	__IO uint32_t rRESERVED6;
	__IO uint32_t rSEC_ZONE2_SECEN;
	__IO uint32_t rSEC_ZONE2_START_ADDR;
	__IO uint32_t rSEC_ZONE2_LENGTH;
	__IO uint32_t rSEC_ZONE2_AESINIT_VECT_0;
	__IO uint32_t rSEC_ZONE2_AESINIT_VECT_1;
	__IO uint32_t rSEC_ZONE2_AESINIT_VECT_2;
	__IO uint32_t rSEC_ZONE2_AESINIT_VECT_3;
	__IO uint32_t rSEC_ZONE2_SECKEYS_0;
	__IO uint32_t rSEC_ZONE2_SECKEYS_1;
	__IO uint32_t rSEC_ZONE2_SECKEYS_2;
	__IO uint32_t rSEC_ZONE2_SECKEYS_3;
	__IO uint32_t rSEC_ZONE2_SECKEYS_4;
	__IO uint32_t rSEC_ZONE2_SECKEYS_5;
	__IO uint32_t rSEC_ZONE2_SECKEYS_6;
	__IO uint32_t rSEC_ZONE2_SECKEYS_7;
	__IO uint32_t rSEC_ZONE2_UNENC_PWD_0;
	__IO uint32_t rSEC_ZONE2_UNENC_PWD_1;
	__IO uint32_t rSEC_ZONE2_UNENC_PWD_2;
	__IO uint32_t rSEC_ZONE2_UNENC_PWD_3;
	__IO uint32_t rSEC_ZONE2_ENCUPDATE_EN;
	__IO uint32_t rSEC_ZONE2_DATA_EN;
	__IO uint32_t rSEC_ZONE2_PARAMS_ACK;
	__IO uint32_t rRESERVED7;
	__IO uint32_t rRESERVED8;
	__IO uint32_t rSEC_ZONE3_SECEN;
	__IO uint32_t rSEC_ZONE3_START_ADDR;
	__IO uint32_t rSEC_ZONE3_LENGTH;
	__IO uint32_t rSEC_ZONE3_AESINIT_VECT_0;
	__IO uint32_t rSEC_ZONE3_AESINIT_VECT_1;
	__IO uint32_t rSEC_ZONE3_AESINIT_VECT_2;
	__IO uint32_t rSEC_ZONE3_AESINIT_VECT_3;
	__IO uint32_t rSEC_ZONE3_SECKEYS_0;
	__IO uint32_t rSEC_ZONE3_SECKEYS_1;
	__IO uint32_t rSEC_ZONE3_SECKEYS_2;
	__IO uint32_t rSEC_ZONE3_SECKEYS_3;
	__IO uint32_t rSEC_ZONE3_SECKEYS_4;
	__IO uint32_t rSEC_ZONE3_SECKEYS_5;
	__IO uint32_t rSEC_ZONE3_SECKEYS_6;
	__IO uint32_t rSEC_ZONE3_SECKEYS_7;
	__IO uint32_t rSEC_ZONE3_UNENC_PWD_0;
	__IO uint32_t rSEC_ZONE3_UNENC_PWD_1;
	__IO uint32_t rSEC_ZONE3_UNENC_PWD_2;
	__IO uint32_t rSEC_ZONE3_UNENC_PWD_3;
	__IO uint32_t rSEC_ZONE3_ENCUPDATE_EN;
	__IO uint32_t rSEC_ZONE3_DATA_EN;
	__IO uint32_t rSEC_ZONE3_PARAMS_ACK;
	__IO uint32_t rRESERVED9;
	__IO uint32_t rRESERVED10;
	__IO uint32_t rBSL_ENABLE;
	__IO uint32_t rBSL_START_ADDRESS;
	__IO uint32_t rBSL_HARDWARE_INVOKE;
	__IO uint32_t rRESERVED11;
	__IO uint32_t rRESERVED12;
	__IO uint32_t rBSL_PARAMS_ACK;
	__IO uint32_t rJTAG_SWD_LOCK_ENCPAYLOADADR;
	__IO uint32_t rJTAG_SWD_LOCK_ENCPAYLOADLEN;
	__IO uint32_t rJTAG_SWD_LOCK_DST_ADDR;
	__IO uint32_t rJTAG_SWD_LOCK_ENC_UPDATE_ACK;
	__IO uint32_t rRESERVED13;
	__IO uint32_t rSEC_ZONE0_PAYLOADADDR;
	__IO uint32_t rSEC_ZONE0_PAYLOADLEN;
	__IO uint32_t rSEC_ZONE0_UPDATE_ACK;
	__IO uint32_t rRESERVED14;
	__IO uint32_t rSEC_ZONE1_PAYLOADADDR;
	__IO uint32_t rSEC_ZONE1_PAYLOADLEN;
	__IO uint32_t rSEC_ZONE1_UPDATE_ACK;
	__IO uint32_t rRESERVED15;
	__IO uint32_t rSEC_ZONE2_PAYLOADADDR;
	__IO uint32_t rSEC_ZONE2_PAYLOADLEN;
	__IO uint32_t rSEC_ZONE2_UPDATE_ACK;
	__IO uint32_t rRESERVED16;
	__IO uint32_t rSEC_ZONE3_PAYLOADADDR;
	__IO uint32_t rSEC_ZONE3_PAYLOADLEN;
	__IO uint32_t rSEC_ZONE3_UPDATE_ACK;
	__IO uint32_t rRESERVED17;
	__IO uint32_t rMB_END;
} BootOverrideFlashMailbox_Type;

#define FLMAILBOX_BASE 		(0x00200000)
#define FLMAILBOX 			((BootOverrideFlashMailbox_Type *) FLMAILBOX_BASE)

  • After finding another thread in this forum, I have noticed, that the Source Code for the BSL must be available somewhere. I did not find something like that before, because it is not linked from the MSP432 page. But with further investigation, I found the source code and binaries

    Compiling is also not possible for me, as it has been said in the other thread, i linked in above.

    But based on the information there I thought with Rev. 1.0 of the Launchpad, BSL flashing should be possible. It is not for me.

    When choosing 'Load Program' in CCS Debug View, the following is printed to Console: 

    CORTEX_M4_0: Writing Flash @ Address 0x00000000 of Length 0x00000144
    CORTEX_M4_0: Flash Programmer: Erasing main memory
    CORTEX_M4_0: Flash Programmer: Writing 324 bytes to flash memory 0x00000000 
    CORTEX_M4_0: Writing Flash @ Address 0x00202000 of Length 0x00000004
    CORTEX_M4_0: Flash Programmer: Writing 4 bytes to flash memory 0x00202000 
    CORTEX_M4_0: Flash Programmer: Verify error. Writing to Flash failed!
    CORTEX_M4_0: Writing Flash @ Address 0x00202010 of Length 0x00001858
    CORTEX_M4_0: Flash Programmer: Writing 6232 bytes to flash memory 0x00202010 
    CORTEX_M4_0: Flash Programmer: Verify error. Writing to Flash failed!
    CORTEX_M4_0: Flash Programmer: Verify error. Writing to Flash failed!
    CORTEX_M4_0: Writing Flash @ Address 0x00203880 of Length 0x000001e8
    CORTEX_M4_0: Flash Programmer: Writing 488 bytes to flash memory 0x00203880 
    CORTEX_M4_0: Flash Programmer: Verify error. Writing to Flash failed!

    So my question is, if I'm doing something wrong, or it is not possible yet. 

    Thanks in advance.

  • Hi,

    There seem to be some problems with CCS downloading to BSL area.

    I also tried using UniFlash with the same results.

    However, I tried with IAR and it worked OK. 

    I shows the steps in the attached document:

    Downloading BSL.docx

    I realize that this is not the best solution and we need to fix it in CCS, so I'll work with the tools team to fix it.

    Regards,

    Luis R

  • Hey Luis,

    after following your steps, I was able to flash the BSL and a first check of the memory view seems to be fine. Thanks!

    But what is about the Flash Mailbox section? Does it make sense to write for example the start byte by myself

    and hope that the BSL will start after correct self-setting of the memory? 

    Thanks in advance and regards

  • Hi,

    I don't think it makes sense to start an example from scratch but have you looked at AppNote SLAA659? www.ti.com/.../slaa659
    The associated examples are available here: www.ti.com/.../slaa659

    Regards,
    Luis R
  • Hello Luis,

    thanks for pointing me to the source code examples. I only took a look at AppNote SLAA659, but I was not aware of the source code - if I remember correctly there is no link in the AppNote, so maybe it could be improved for future?! 
    But I’m sorry to say that it does not work for me. I want to use the bsl_config example from the .zip-Folder. 
    First of all, I added a pullup-resistor to S1 on LaunchPad-PCB, because I think it is not possible to use internal pullup-resistors for BSL hardware invocation.
    Next I configured BSL hardware invocation section in msp432_flashmailbox.c correctly and flashed it. Using a simple 'BSL Scripter‘-script
    MODE P4xx UART 9600 COM4
    VERBOSE
    TX_BSL_VERSION_32
    i can see the synchronization (0xFF from BSL scripter and 0x00 ack from BSL) on my oscilloscope sometimes - not reproducible, but sometimes. But for the version command, I never get any answer (command 0x80 0x01 0x00 0x19 0xE8 0x62 verified on scope). 
    Any idea?
    After rereading your Word document I noticed that my .txt-File from MSP432BSL_1_00_00_00 seems to be exactly the same as your memory browser view in CCS, which was a kind of wrong. At least first 32 bytes matches. So i guess you have compiled your own version of BSL and getting other binaries hence. As I said before the currently available source code could not be compiled due to several compiler errors. Can you provide your probably modified version of BSL? I could add some debug outputs then and try to figure out, whats wrong. 
    Thanks and regards
  • Hi,

    Oh, that screenshots just shows an image that I downloaded to overwrite the default BSL.

    However, I tried re-downloading the default BSL (BSL_0000.0002.0003.0102.0003.txt) and I think I was able to replicate your same problem when using BSL Scripter 2.01.

    I then tried BSL Scripter 2.00 and it worked fine with the following script:

    MODE P4xx UART COM36

    MASS_ERASE

    RX_PASSWORD_32

    TX_BSL_VERSION_32

    Can you try it on your side? 

    https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/166/BSLDEMO_5F00_V2.exe

    - Are you sure you are forcing BSL properly? Can you download a sample application such as an LED toggle and then force BSL using the switch and reset? The application shouldn't run after reset

    - I already told the tools team about this issue with Scripter 2.01 and they will investigate the root cause

    - I also asked them about updating the CCS project, so that it builds on the latest CCS

    - And I also sent your feedback about adding a link to the SW in SLAA659

    Regards,

    Luis R

  • Hey Luis,

    first of all, thank you very much for your extensive help! 

    But back to topic: I'm sure, that Hardware Invocation of the BSL is not doing what I expect. I have to take a closer look when I got some time for it. (I have rechecked my Mailbox settings and get an ACK (0xACE) for the BSL Hardware Invocation area in the flash memory (inspected with CCS). But pressing the button or not during reset has no influence on the starting of my own firmware. Changed it for tests to light up RGB LED instead of small red one, because I think BSL uses it (?), but everytime the RGB LED is on...)

    Because I had no fast idea of fixing the BSL Hardware Invocation problem, I have used Software Invocation for now. And yes, you are right. When using BSLScripter 2.00 I get: 

    But when using BSLScripter 2.01 I get:

    I also captured, what is the difference between both on the UART interface. BSLScripter 2.00:

    And BSLScripter 2.01:

    Seems to be a timing problem for me, because the data send by BSLScripter is the same, but there is no resynchronisation answer by the BSL itself.

    Thank you very much again for taking account of all my questions, and best regards!

  • Hi,

     Using BSL Scripter v2.01, Could you please change the speed to 19200??

      

    Also at the same time, I was able to re-build and test the BSL project using CCS v6.1.0.

    As example I changed the Vendor to 0xDAAD. If you are still interested you can find the project here:

    https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/166/MSP432BSL_5F00_1_5F00_00_5F00_00_5F00_00_5F00_Exp.7z

      Best regards,

        David

  • I'm closing this thread due to lack of activity, but feel free to let us know if you have further questions

    Regards,
    Luis R
  • Dear Luis,

    Please help me understand entering the BSL on the MSP432. I've had success on other micros such the FR5969 and F5438A but on the ARM version I'm following SLAU622 "BSL User's Guide" page 16 (Figure 6).

    I'm using the Launch pad and I press the RSTn (switch S3 and thereby grounding it) pulling P1.0 High, then releasing RSTn switch. The Launchpad should go into BSL but does not. This is all per Figure 6 diagram.

    I am using BSL scripter tool (bsl-scripter-windows.exe) version:
    -------------------------------
    BSL Scripter 3.1.0.0
    PC software for BSL programming
    2016-May-30 21:49:41

    ...and sending

    MODE P4xx UART 9600 COM4
    VERBOSE
    TX_BSL_VERSION_32

    in my script file. The BSL scripter tool times out and does not seem to work. Can I get the Launchpad to go into BSL mode doing what I'm doing? Is Figure 6 on page 16 of SLAU622 manual correct?

    Thanks.
    -Jim
  • Hi Jim,

     By default the hardware-based BSL invocation is not enabled. To enable it please take a look a this thread (you will have to enable it using the flash mailbox) e2e.ti.com/.../1779629

    Jim Patten said:
    Can I get the Launchpad to go into BSL mode doing what I'm doing?

    Yes, but your flash will need to be erased, please take a look at section 4.3 BSL Invocation (SLAU622). The easiest way to erase your flash is thru the Factory Reset as described in http://www.ti.com/lit/pdf/slau575 chapter 8.

    Hopefully this helps.

     David

**Attention** This is a public forum