This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

MID on MSP430F6659

Other Parts Discussed in Thread: MSP430F6659, MSP430F5358, MSP430F5359, MSP430F5658, MSP430F5659, MSP430F6458, MSP430F6459, MSP430F6658

Hi,


anybody used successfully the MID (memory integrity device) on an MSP430F6659 Rev A?

On my MSP430 dumping address 0x6c00 shows "0x3fff" which actually does not indicate an MID...

Also MSPWare is a little bit vague, also documentation and headers.

Is MID yet not fully implemented?


Hardy

  • Hello Hardy,

    the MID peripheral is fully implemented. please see the MID section in the User Guide for its function and use. Sections 8.5 and 8.6 in particular describe how to use the MID.

    MSP430F5xxx/6xxx User Guide;
    www.ti.com/lit/slau208

    Regards,
    JH

  • Which of the other MSP430s have MID? Is there a way to search for them without looking at each DataSheet individually?
  • Hi JH,

    believe me, I've read those sections of the user manual several times. Did not help.
    Actual problem is, that memory at 0x6c00 reads "0x3fff 0x3fff ...". So there is no MID entry table or whatsoever.

    Is it possible that I switched off MID by incident? If yes, how to reenable?

    Thanks Hardy


    PS: info at 0x1a00 shows:
    06 06 9A 34 2B 81 10 10 08 0A B8 A5 09 51 16 00 15 00 F8 FE 11 10 FA 7F FF FF 5C 08 B1 09 46 06 46 07 09 05 D7 05 12 06 16 80 58 80 CF 7F 02 7E 08 8A 0C 86 0E 2A 12 30 36 A8 38 AC 40 9A 8F 33 30 00 28 00 23 00 09 00 0F 00 05 00 FC 00 FA 10 41 02 30 02 39 01
    3C 00 3D 00 44 00 40 01 48 02 42 02 43 01 A0 01 10 04 51 02 52 02 53 02 54 02 55 0A 5F 02 62 04 61 04 67 04 61 08 6A 02 6B 02 85 04 4A 0C 90 04 90 04 90 0C D0 08 C0 14 A8 04 98 10 B1 A8 64 65 40 90 91 D0 60 61 98 46 62 63 50 92 93 51 B0 68 C0 66 67 52 53 94
    95 00 FF FF FF FF FF FF FF FF 20 01 00 A5 2E 01 00 11 10 01 E2 96 1C 01 00 26 10 01 1C 96 1C 01 9C B0 10 01 A0 96 12 01 22 14 14 01 9A F8 10 01 02 96 12 01 25 48 14 01 33 22 18 01 00 00 94 01 3B FF 58 01 00 5A 82 01 03 00 B6 1A C3 3C C3 3C 31 01 BF CA

  • I have to admit, that my MSP430F6659 are samples sent to me by our TI representative for nothing. So I don't complain ;-)

    Nevertheless: should MID work for all revisions of the 6659? Any way to turn off MID completely (and thus revealing 0x3fff...)?

    H.
  • Hardy,

    The Memory Integrity Detection (MID) peripheral does not prevent reading of different addresses. It is there to ensure a higher reliability of flash content by the addition of a parity generator and check. In order to use the MID, one must use the ROM APIs outlined in the User Guide within an application. The MID is disabled by default after power-up of the device. Please see user guide section 8.6 for more information on how to use the MID peripheral.

    On a separate note, a read of "0x3fff" in memory means you are reading Vacant Memory space or you are reading a section of the memory map that you are not allowed to read (such as peripheral addresses) .

    Old Cow Yellow,

    Unfortunately, as you know, TI's component comparison tool for MSP430 is not the most robust tool and does not include less prolific peripherals such as the MID. From my understanding, this module was created for the MSP430F6659 family of parts and only appears in its iterations. These are listed in its datasheet as to be: MSP430F665x, MSP430F645x, MSP430F565x, and MSP430F535x devices.

    Regards,
    JH
  • JH,

    Thank you for answering my question.

    I do not have any chip with MID and I am curious about what HardyGriech was asking. After I read later messages in this thread, now I have a hunch.

    I think both you and the User's Guide did not make a clear distinction between read and fetch when that distinction is needed. For example:

    Jace H said:
    On a separate note, a read of "0x3fff" in memory means you are reading Vacant Memory space or you are reading a section of the memory map that you are not allowed to read (such as peripheral addresses) .

    The last part inside the parenthesis is not exactly correct. You are allowed to read peripheral registers (subject to password protection). But when you fetch from peripheral registers, PC is loaded with 0x3FFF instead.

    I suspect that the MID ROM behaves in an opposite way. That is, you are allowed to fetch instructions from it. But when you read from it, you get 0x3FFF instead.

    --OCY

  • JH,

    you are trying to tell me, that I cannot dump (i.e. read) the memory at 0x6c00, while instruction fetch should work - right?

    Where in slau208 is such behavior described? 1.11.1 says, that reads from vacant memory results in 0x3fff while fetching from such location will give either a "JMP $" or a PUC. Nowhere I can see the case "vacant for reading but valid for fetching"...

    Stupid question comes to mind: how to assure that the MID actually exists? Is it somewhere in the TLV? Unfortunately the current MSPWare does not know about something like TLV_PID_MID. Reading memory from 0x6c00..0x6fff results in 0x3fff so it is not possible to check a magic MID word.

    Hmm... reading 8.6 shows that there are two magic words: 0x2843 at _MidStart+0x00 and 0x80xy at _MidStart+0x02... how to access those values if reading returns 0x3fff!?

    More questions:

    • where is MdiInit() mentioned in slau208? (perhaps a typo...)
    • what for is CSECKEY in the header file?
    • how to disable BUS NMIs? BUSIFG is mentioned in the docs, but BUSIE not...
    • what are the following TLV_PIDs (taken from TLV contained in 6659): 0x43, 0xd0, 0xfa?

    In the end, I'm not absolutely sure, if the (or my) MSP430F6659 contains an MID. And I don't like this feeling of uncertainty. At least for my application.

    Hardy

    @OCY: feature check for existence of MID on the headers (if one could trust them!?) reveals the following:

    $ grep -l _MidStart *
    msp430f5358.h
    msp430f5359.h
    msp430f5658.h
    msp430f5659.h
    msp430f6458.h
    msp430f6459.h
    msp430f6658.h
    msp430f6659.h

  • OCY,

    You are correct that it is not completely clear when the word "read" was used. Perhaps the better phrasing would be that the MSP returns the JUMP opcode when accessing a portion of memory one does not have permission to do so. Regardless if that access is a read or fetch or possibly write.

    Hardy,

    Let me assure you all MSP430F6659s have a MID. It will not show up within the peripheral map file for it is not a traditional peripheral for it is part of the memory system. Also, the MID does not provide direct register access to the user, so there are no peripheral registers to map to. The MID can only be used given the API functions programmed into ROM as described in section 8.6 of the user guide. Your IDE of choice is already setup to take these API calls and properly interpret them to be used in the device.

    There is no MIDInit function. The ROM API MidEnable() initializes and enables the MID. As discussed before, this must be done every time the device is powered on or a BOR occurs in order to use the MID. This is due to the fact that the MID is disabled upon power down of the device.

    I am unsure of what CSECKEY is for and it can only be found in that header. It is not needed for the use of the ROM APIs for the MID.

    BUS NMI stands for BUS Non-Maskable Interrupt, as such it cannot be turned off or "masked".

    To see the Device Descriptor Table (TLV Structure) in its entirety for the MSP430F6659 , please see table 72 in the user guide. for general tag descriptor values please see table 1-4 in the user guide.

    If you are having trouble using the MID, MSPWare provides three excellent examples that show how to use the APIs associated with the MID.
    msp430f665x_mid_01.c displays how to enable the MID for the full portion of memory.
    msp430f665x_mid_02.c displays how to enable the MID for a specific section of memory.
    msp430f665x_mid_03.c displays how to enable the MID in a specific section of memory and how to detect an error in that portion of memory by injecting said error.

    Regards,
    JH
  • JH,

    thanks for your detailed explanation and help. I've understood completely, that there are no user registers to control the MID. Also that there are some API calls defined in the header file which have to be used.

    Concerning the BUSNMI/BUSIE/BUSIFG... believe me that I'm aware what NMI means and I always have thought that TIs definition of NMI is a little bit... astonishing... let's read chapter 1.3.1 of slau208: "The NMI sources are enabled by individual interrupt enable bits"... ooops... non maskable??? So one could expect a BUSIE/BUSIFG, couldn't one?

    Nevertheless let me state that I'm still a little bit irritated that I'm not able to dump the memory at location 0x6c00. So I have to do an API call into the fog and trust that it will _return_ with proper side effects. I think that the user manual should be updated to clarify this.

    In the end I will not use MID because of several reasons:
    - I'm still not trusting the MID operation. Perhaps better documentation will change that
    - MID only shows errors from which one can not recover. How about an ECC?
    - the code of my application is already "protected" by a CRC, so the MID actually gives no new information
    - marginal reads seem to be the better solution for my application because it (should) indicate flash fault conditions before they actually happen

    And BTW: marginal reads are also a field which is not described in a way that it is "ready to use": no MSPWare examples, no application notes (AFAIS). But it's a nice feature deserving some more attention. Especially if your device is used in "hot" areas where data retention of the flash goes down to a few years (slaa392). (I guess almost nobody continues reading further than "data retention min 100 years..." (at 25°C... what does that mean!?!?!?))

    Anyway, many thanks for your support and patience!

    Hardy
  • HardyGriech said:
    Nevertheless let me state that I'm still a little bit irritated that I'm not able to dump the memory at location 0x6c00. So I have to do an API call into the fog and trust that it will _return_ with proper side effects. I think that the user manual should be updated to clarify this.

    Using CCS 6.1.1.00022 with MSP430 Emulators 6.2.1.0 with a MSP430F6659, if I attempt to use the Memory Browser or Disassembly views to look at the MID ROM from 0x6c00-0x6fff I just get the value 0x3FFF displayed.

    The following code was run in the MSP430F6659 to copy the MID ROM area to a copy in RAM:

    #include <msp430.h>				
    
    #define MID_ROM_SIZE_WORDS 512
    int MID_rom_copy[MID_ROM_SIZE_WORDS];
    
    int main(void) {
    	const int *mid_rom = (int *) 0x6c00;
    	int mid_index;
    	WDTCTL = WDTPW | WDTHOLD;		// Stop watchdog timer
    
    	for (mid_index = 0; mid_index < MID_ROM_SIZE_WORDS; mid_index++)
    	{
    	    MID_rom_copy[mid_index] = mid_rom[mid_index];
    	}
    
    	for(;;) {
    	}
    	
    	return 0;
    }
    

    After this code was run, the MID_rom_copy RAM copy of the MID ROM could be inspected with the Disassembly or Memory Browser views and displayed non-0x3FFF values which look sensible. Therefore, the program running in the MSP430F6659 can read from the MID ROM.

    Suspect there is a "feature" in the MSP430 emulator code / logic which is blocking read access to the MID ROM, will try and investigate.

  • Chester Gillon said:
    Suspect there is a "feature" in the MSP430 emulator code / logic which is blocking read access to the MID ROM, will try and investigate.

    Looking at the slac460n source code, for MSP430.dll v3.5.1.1, shows that for each device there is a table which gives the address ranges which the MSP430 emulator is allowed to access. In the CCS debugger any attempt to read from a memory area which the MSP430.dll doesn't consider as valid is presumably reported to the CCS debugger as 0x3fff.

    In the slac460n source file MSPDebugStack_OS_Package\DLL430_v3\src\Ti\Dll430\TemplateDeviceDb\MSP430F56_66xx.cpp the MSP430F565_665x structure didn't contain an entry for the MIB boot ROM in at the address range 0x6c00..0x6fff.

    As an experiment modified the slac460n source by adding the following to MSPDebugStack_OS_Package\DLL430_v3\src\Ti\Dll430\TemplateDeviceDb\MSP430F5xxx.h :

    		typedef MemoryInfo<
    			MemoryArea::BOOT, RomType, Mapped, Protectable, Bits16Type,
    			Size<0x400>, Offset<0x6C00>, SegmentSize<0x1>, BankSize<0>, Banks<1>,
    			NoMask, MemoryCreator<BootcodeRomAccess>
    		> MSP430F5xxx_MibRomMemoryInfo;
    

    And in MSPDebugStack_OS_Package\DLL430_v3\src\Ti\Dll430\TemplateDeviceDb\MSP430F56_66xx.cpp added a reference to MSP430F5xxx_MibRomMemoryInfo in the MSP430F565_665x structure:

    struct MSP430F565_665x : Device<
    							description,
    							DefaultBits20Type,
    							regular,
    							MSP430F5xxx_Match<versionId>,
    							LargeEemMode,
    							MSP430F5xxx_DefaultVoltageTestVpp,
    							ClockInfo,
    							FunctionMappingXv2,
    							FuncletMappingXv2WordMode,
    							MemoryList<std::tuple<
    								MSP430Fx65x_MainFlashMemory<nrBanks>,
    								MSP430F5xxx_InfoFlashMemoryInfo,
    								MSP430F5xxx_BootFlashMemoryInfo,
    								MSP430F5xxx_BootCodeMemoryInfo,
    								MSP430F5xxx_MibRomMemoryInfo,
    								UsbTypeRamInfo,
    								UsbTypeSystemRamInfo< Size<0x4000>, Banks<1> >,
    								MSP430F5xxx_SystemRam2Info< Ram2OffsetType, Ram2SizeType >,
    								MSP430F5xxx_peripherl16lbitMemoryInfo,
    								MSP430F5xxx_CPUMemoryInfo,
    								MSP430F5xxx_EEMMemoryInfo
    							> >, //until C++0x, the space between the brackets is important
    							MSP430F5xxx_Features,
    							MSP430F5xxx_ExtFeatures
    						> {};
    

    With these changes, re-compiling the MSP430.dll used by CCS 6.1.1 then allowed the Disassembly and Memory Browser views to display the contents of the MIB ROM in a MSP430F6659:

    Therefore, can the MSP Debug Stack be updated to formally include the MIB ROM in the memory ranges of the devices which support MIB?

  • Chester and Hardy,

    Wow! I never fully trusted debuggers and often suspected that they generate some of the "bugs" and never "de-bugger" any bug. You guys found another incidence.

    If I had a MSP430F6659, I would have used "cmp #0x3FFF,&6C00" etc. to verify Hardy's findings. I stay away form c compilers and use assembler for the same reason that I avoid debuggers. I know I am begin silly.

    Obviously, debuggers and compilers are very convenient and works perfectly most of the time in most situations. Less obviously, assemblers can and generate "bugs" too.
  • Chester,

    I can tell you, you are my hero! This answers all of my questions (concerning this issue of course ;-))!

    And I was stuck that the simple trick to copy ROM to RAM never came to my mind.

    My way of "verification" was to dump memory at 0x6c00 with mspdebug... which again uses msp430.dll :-( ;-)

    Many thanks for your thinking around the corner

    Hardy

**Attention** This is a public forum