Texas Instruments MSPM0 User manual

User’s Guide
MSPM0 Bootloader
ABSTRACT
The MSPM0 Bootloader (also known as BSL) provides a method to program and verify the device memory
(Flash and RAM) through a standard serial interface (UART or I2C).
Table of Contents
1 Overview of BSL Features..................................................................................................................................................... 2
2 Terminology.............................................................................................................................................................................3
3 BSL Architecture.....................................................................................................................................................................4
3.1 Design................................................................................................................................................................................ 4
3.2 BSL Invocation................................................................................................................................................................... 5
3.3 Memory.............................................................................................................................................................................. 6
3.4 BSL Configuration.............................................................................................................................................................. 7
3.5 BSL Status......................................................................................................................................................................... 8
4 Bootloader Protocol............................................................................................................................................................... 9
4.1 Packet Format....................................................................................................................................................................9
4.2 UART and I2C BSL Protocol..............................................................................................................................................9
4.3 Bootloader Core Commands............................................................................................................................................10
4.4 BSL Core Response........................................................................................................................................................ 18
4.5 Bootloader Security..........................................................................................................................................................20
5 Sample Program Flow with Bootloader..............................................................................................................................22
6 Secondary Bootloader..........................................................................................................................................................24
6.1 Secondary Bootloader Example.......................................................................................................................................24
7 Interface Plug-in....................................................................................................................................................................26
7.1 Implementation.................................................................................................................................................................26
7.2 Flash Plug-in Type........................................................................................................................................................... 28
7.3 Overriding an Existing Interface....................................................................................................................................... 29
8 References............................................................................................................................................................................ 31
9 Revision History................................................................................................................................................................... 31
Trademarks
All trademarks are the property of their respective owners.
www.ti.com Table of Contents
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 1
Copyright © 2023 Texas Instruments Incorporated

1 Overview of BSL Features
The bootstrap loader (BSL) provides a method to program or verify the device memory through a standard
UART or I2C serial interface.
Key features of the BSL that are accessible through the serial interface include:
• Programming and erase of flash memory
• Can return a 32-bit CRC of a code or data region (1KB minimum region size) to verify programming
• Can enable code or data read-out (disabled by default)
• Can return a firmware version number via a pointer to the main flash
• Can specify a hardware invoke GPIO
• Access is always protected with a 256-bit password
• Configurable security alert handling for resisting brute force attacks
• Can add a new interface as flash plug-in
• Can use custom bootloader
Overview of BSL Features www.ti.com
2MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

2 Terminology
Bootloader (BSL) - Boot routine used to load data to the device memory
Bootcode (BCR) - Startup Routine that runs after BOOTRST, to configure the device for executing application
BCR configuration - Configuration structure that contains all user configurable parameters for Bootcode, which
resides in Non-main flash memory
BSL configuration - Configuration structure that contains all user configurable parameters for Bootloader, which
resides in Non-main flash memory
www.ti.com Terminology
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 3
Copyright © 2023 Texas Instruments Incorporated

3 BSL Architecture
3.1 Design
The bootloader will be invoked by bootcode when a valid bootloader invocation condition is detected. It will be
invoked only if the bootloader is enabled in the BSL mode field of the BCR configuration.
Once the bootloader is started, it first executes the "Init" phase where the initial checks of the BSL configuration
is done and the device is configured for bootloader operations.
Next the bootloader enters "Interface Autodetection" phase. In this phase the BSL configures all the available
BSL ROM interfaces and the flash plug-in interface , if registered . The BSL then polls for the data through all
the interfaces one by one. When a valid connection packet is received in one of the interfaces, that interface will
be considered as active interface for further communication and all other interfaces will be disabled. Interface
discovery is done for 10 seconds, if no interface has been detected, the device is put in STANDBY mode.
Next the BSL enters "Command reception" phase. In this phase BSL will be waiting in an infinite loop for
commands from the host. When a valid command is received, the command is processed and the response from
the BSL core is sent back to the host. Then it goes back to the loop and waits for the next command and so on.
If the 'Start Application' command is received, the bootloader will trigger a system reset, after which the bootcode
is executed and the application is invoked. This phase also has a timeout of 10 seconds. If there is no valid
command received, bootloader is locked and it enters Sleep mode.
Figure 3-1. BSL Architecture
3.1.1 Timeout Feature
Bootloader will time out when no activity is detected and enters low-power mode to save power.
This has been implemented at the following two phases.
1. Interface autodetection
BSL Architecture www.ti.com
4MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

2. Command reception
3.1.1.1 Interface Autodetection
In Interface detection phase, if there is no valid connection command received for 10 seconds over any interface,
the bootloader enters STANDBY mode.
POR is required to get out of this state and use Bootloader by creating the BSL invocation condition again.
3.1.1.2 Command Reception
In command reception phase, if no valid command is received for 10 seconds, the bootloader will enter SLEEP
mode. To wake up the device from SLEEP mode, a data transaction should happen on the active interface.
Bootloader will be locked before entering Sleep mode to reduce attack surface. Hence after waking up from the
low power mode, Bootloader needs to be unlocked again by sending the 256 bit BSL Password (See Unlock
Bootloader command ).
Note
Bootloader user LFCLK for the timeout check. If application configures the external clock as the
source for LFCLK, the same will be used by BSL, when invoked through Application BSL request
3.2 BSL Invocation
Bootloader shall be invoked only by the boot code, when any of the BSL invocation conditions is met and if
Bootloader is enabled in BCR configuration TRM.
When Fast boot mode is enabled in BCR configuration, bootloader can be invoked only by Debug mailbox
command and Application request. Other checks are skipped to save execution time.
3.2.1 Blank Device
Bootcode detects the blank device by checking the erase state of the Stack pointer (0x00000000) and reset
vector (0x00000004) address. When both the flash memory addresses are found to be blank, then Bootloader
will be invoked.
3.2.2 Application Request
To invoke the bootloader from an application, set the RESETLEVEL as BOOTLOADERENTRY and trigger reset
through the RESETCMD register. This sequence causes a system reset, and the bootcode is executed and the
bootloader is invoked.
Because a system reset is issued, all the peripheral configurations are reset while exiting the application.
3.2.3 GPIO Based Invocation
GPIO used for BSL invocation can be configured in the BSL Configuration TRM in Non-main memory.
Fresh devices will have the TI programmed default pin detail in BSL configuration.
GPIO pin based invocation can be disabled in the BCR configuration. It is enabled by default.
GPIO should be asserted before the POR, and the state should be maintained for at-least T_start ms after POR.
Then the GPIO pin state can be de-asserted.
www.ti.com BSL Architecture
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 5
Copyright © 2023 Texas Instruments Incorporated

Figure 3-2. Invocation From GPIO
* - GPIO pin to be used as 'BSL Invoke' and 'Expected Pin Level' can be configured in BSL configuration
** - T_start refers to the Cold boot startup time, specified in the device specific data sheet
Note
If pin based BSL invocation is enabled, the configured GPIO pin should be either pulled high or low. It
should not be left floating, which could cause unexpected BSL execution.
3.2.4 Debug Mailbox Command
When debug interface is available, Bootloader invocation command can be sent through the Debug Subsystem
Mailbox (DSSM).
For more details on the DSSM command usage, please refer to MSPM0x_Technical_Reference_Manual DSSM
commands section.
3.2.5 Others
3.2.5.1 Pre-Boot Application Verification
In the BCR configuration, if application CRC verification is enabled TRM, the bootcode verifies the CRC for the
given application memory range. If the CRC is incorrect, the bootloader is invoked. In this case the bootloader is
invoked only if enabled. Otherwise the bootcode logs a catastrophic error and causes boot failure.
3.3 Memory
3.3.1 SRAM Memory Usage
The SRAM Memory layout explains the memory used for bootloader's operation.
• Data and Stack section - Used by BSL for it's operation. While exiting the bootloader, these sections of the
SRAM are cleared.
• Variable Buffer Space - Buffer space used for storing the data packets received /sent during the BSL
communication
The SRAM memory allowed for read and write access by the host is BSL Buffer Start Address to [SRAM end
address - 0x120], where SRAM end address is determined by the SRAM memory available in each device.
Since the same SRAM space is shared with variable buffer space, it has chances of getting overwritten during
an SRAM write/read operation.
BSL Architecture www.ti.com
6MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

Figure 3-3. SRAM Usage
A - SRAM Start Address (0x20000000)
B- 'BSL Buffer Start Address' known from the 'Get Device Info' command response, when no Flash plug-in
interface is registered
C- 'BSL Buffer Start Address' known from the 'Get Device Info' command response. It will be same as 'B' when
no Flash plug-in interface is registered
D- BSL Buffer End Address ='BSL Buffer Start Address' + (2 * 'BSL Max Buffer size'), where BSL Buffer Start
Address and BSL Max Buffer Size can be known from 'Get Device Info' command response
E- Start address of the stack allocation (E - 0x120). It will be same as 'D' when the 'BSL Max Buffer size' is less
than 0xFFFF
F- End address of the SRAM memory available in the device. Refer to device specific data sheet to know this.
Section B- C :
• Data section that will be allocated for Flash Plug-in operation, when registered in BSL configuration
Section C- D:
• Buffer space used to store data packets
• Maximum size is (2 * 0xFFFF)
Section C-E:
• Available memory for SRAM read and write operation through BSL commands
3.4 BSL Configuration
BSL configuration in Non-main Flash memory allows certain parameters used by BSL to be customized by the
user.
To know more about the available configurations, refer MSPM0 Technical Reference Manual - Configuration
Memory section .
www.ti.com BSL Architecture
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 7
Copyright © 2023 Texas Instruments Incorporated

3.5 BSL Status
BSL status gives the details about any error occurred during the execution, that resulted in unresponsive BSL.
This 32-bit status information is stored in a specific SRAM address (0x200000C0), and can be read through the
debugger, if the debug-access is enabled in the BCR configuration.
Table 3-1. Interpretation of BSL Status
Byte 4 Byte 3 Byte 2 Byte 1
Reserved HW Error HW Error details SW Error
SW Error
Error Description
0x01 BSL Configuration CRC Error
HW Error
Error Description HW Error Details
0x07 NMI exception NMIIDX - NMI Interrupt Index register data
BSL Architecture www.ti.com
8MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

4 Bootloader Protocol
4.1 Packet Format
The BSL data packet has a layered structure. The BSL core command contains the actual command data to be
processed by the BSL. In addition to the standard BSL commands, there can be wrapper data before and after
each core command known as the peripheral interface code (PI Code). This wrapper data is information that is
specific to the peripheral and protocol being used, and it contains information that allows for correct transmission
of the BSL core command. Taken together, the wrapper and core command constitute a BSL data packet
PI Code BSL Core Data PI Code
4.2 UART and I2C BSL Protocol
The data packets of the UART and I2C BSL protocol have the following structure.
• Header byte indicates the protocol used and the packet type (command or response packet).
• Length field contains the size of the BSL Core Data in bytes.
• BSL core data, contains the Command / Response ID and Address, data as needed by the command
• CRC32 field contains the CRC calculated for the data in BSL core data
PI Code BSL Core Data PI Code
Header (1 byte) Length (2 byte) BSL Core Command/Response CRC32 (4 byte)
Based on the Core data field, the data packet is classified as either Command packet or response packet.
Command packet is the first packet which is transmitted to the BSL. The second packet is the Response packet
which is received from the BSL. Response packet contains two components BSL acknowledgment and BSL
Core response. In these two, Acknowledgment is received from BSL for every command packet sent. But the
BSL core response is not received for every command.
Figure 4-1. BSL Protocol
4.2.1 BSL Acknowledgment
The peripheral interface section of the BSL software parses the wrapper section of the BSL data packet. If there
are errors with the data transmission, an error message is sent immediately. An ACK is sent after all data has
been successfully received and does not mean that the command has been correctly executed (or even that the
command was valid) but, rather, that the data packet was formatted correctly and passed on to the BSL core
software for interpretation.
The BSL protocol dictates that every BSL data packet sent is responded to with a single byte acknowledgment
in addition to any BSL data packets that are sent. Table lists the acknowledgment responses from the BSL.
If an acknowledgment byte other than ACK is sent, the BSL does not send any BSL data packets. The host
programmer must check the acknowledgment error and retry transmission.
Data Meaning
0x00 BSL_ACK (Packet received successfully)
0x51 BSL_ERROR_HEADER_INCORRECT
0x52 BSL_ERROR_CHECKSUM_INCORRECT
0x53 BSL_ERROR_PACKET_SIZE_ZERO
0x54 BSL_ERROR_PACKET_SIZE_TOO_BIG
0x55 BSL_ERROR_UNKNOWN_ERROR
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 9
Copyright © 2023 Texas Instruments Incorporated

Data Meaning
0x56 BSL_ERROR_UNKNOWN_BAUD_RATE
4.2.2 Peripheral Configuration
4.2.2.1 UART
UART is enabled with following configuration:
• UART0 is used
• Baud rate 9600 bps by default. It can be updated by Change Baud Rate command
• Data width: 8 bit
• Stop bits: 1
• No parity
• Pins used for RXD and TXD are taken from the BSL configuration
4.2.2.2 I2C
The I2C interface in the BSL can act as the I2C target. The host acts as a controller and drives the
communication.
• I2C0 is used
• The I2C target address is 0x48, by default. It can be configured in BSL Configuration
• External pullup is needed for SCL and SDA lines
• Pins used for SDA and SCL are taken from the BSL configuration
Note
• The BSL does not validate the details of the pins configured in the non-main for the UART and I2C
interfaces. The BSL expects the pin configuration to be correct.
• Do not use the same pins for both UART and I2C.
4.2.2.3 CRC
CRC for the data must be calculated with:
• CRC32-ISO3309 polynomial
• Bit reversed configuration
• Initial seed - 0xFFFFFFFF
4.3 Bootloader Core Commands
BSL Command Protected CMD Start Address Data (Bytes) BSL Core response
CMD Connection No 0x12 - - No
CMD Unlock
Bootloader No 0x21 - D1…D32 (Password) Yes
CMD Flash Range
Erase Yes 0x23 A1...A4 A1...A4 (End address) Yes
CMD Mass Erase Yes 0x15 - - Yes
CMD Program Data Yes 0x20 A1...A4 D1…Dn, Yes
CMD Program Data
Fast Yes 0x24 A1...A4 D1…Dn, No
CMD Memory Read
back Yes 0x29 A1...A4 L1...L4 Yes
CMD Factory Reset Yes 0x30 - D1...D16 (Password) Yes
CMD Get Device
Info No 0x19 - - Yes
CMD Standalone
Verification Yes 0x26 A1...A4 L1...L4 Yes
CMD Start application No 0x40 - - No
Bootloader Protocol www.ti.com
10 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

BSL Command Protected CMD Start Address Data (Bytes) BSL Core response
CMD Change Baud
rate No 0x52 - D1 (Baud rate ID) No
Abbreviations:
A1...A4
Address bytes, where A1 is the least significant byte
D1...Dn
Data bytes, where 'n' is limited by the BSL Max buffer size
L1...L4
Data Length bytes, where C1 is the least significant byte
4.3.1 Connection
Structure
Header Length CMD CRC32
0x80 0x01 0x00 0x12 C1 C2 C3 C4
Description
Connection command is the first command used to establish the connection between the Host and the Target
through a specific interface (UART or I2C).
Protected
No
Command Returns
Only BSL Acknowledgment
Example
Host: 80 01 00 12 3A 61 44 DE
BSL: 00
4.3.2 Get Device Info
Structure
Header Length CMD CRC32
0x80 0x01 0x00 0x19 C1 C2 C3 C4
Description
The command is used to get the version information and buffer size available for data transaction.
Protected
No
Command Returns
BSL Acknowledgment and BSL core response with device information. See Device info for more details.
Example
Host: 80 01 00 19 B2 B8 96 49
BSL:00 08 19 00 31 00 01 00 01 00 00 00 00 01 00 C0 06 60 01 00 20 01 00 00 00 01 00 00 00 49 61 57 8C
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 11
Copyright © 2023 Texas Instruments Incorporated

4.3.3 Unlock Bootloader
Structure
Header Length CMD Data CRC32
0x80 0x21 0x00 0x21 D1...D32 C1 C2 C3 C4
Description
The command is used to unlock the bootloader. Only after bootloader unlock, all the protected commands listed
in Section 4.3 are processed by the BSL.
If the host sends an incorrect password, the BSL sends the error response, then device enters sleep mode for
2 seconds. During this 2-second window, no command is received or processed. After 2 seconds, the host can
send the next password. If an incorrect password is sent 3 times, a security alert action is taken. The security
alert action is configurable in the BSL configuration. See Section 4.5.1.1 for more details.
Protected
No
Data
32 byte BSL password stored in the BSL configuration memory. Fresh device would have the default value all
0xFF.
Command Returns
BSL Acknowledgment and BSL core response with Message about the Status of operation. See section BSL
Core Message for more details.
Example
Host: 80 21 00 21 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF 02 AA F0 3D
BSL: 00 08 02 00 3B 00 38 02 94 82
4.3.4 Program Data
Structure
Header Length CMD Address Data CRC32
0x80 L1 L2 0x20 A1...A4 D1...Dn C1 C2 C3 C4
Description
The program command is used to write the data D1 through Dn in the memory address starting from A1...A4.
This command performs the blocking write. Once the programming is done a Message response is sent to Host.
Programming is allowed to Main flash (application memory), Non-main Flash (configuration memory) and SRAM
memory. For details on the absolute address range please refer to the device specific data sheet.
Flash memory should be erased by the Host before programming. See Flash range erase, Mass erase for more
details on erasing the Main flash region. Non-main flash can only be erased by the Factory reset command.
Due to the Flash controller characteristic, the start address and Length of the data should be 8 byte aligned for
flash programming.
Note
SRAM memory is not fully accessible by the Host. See Section 3.3.1 for more details.
Protected
Yes
Bootloader Protocol www.ti.com
12 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

Address
Start address of the memory region to be programmed. A1...A4, where A1 is the Least Significant Byte of the 32
bit address.
Data
Data bytes to be written in the specified address. Maximum size of the data that can be sent is limited by the
Buffer size of the device. Buffer size is known from Get Device Info command .
Command Returns
BSL Acknowledgment and BSL core response with Message about the Status of the operation. See section
Section 4.4.1 for more details.
Example
Host: 80 0D 00 20 00 00 00 00 00 00 00 04 00 00 00 08 7A DC AE B8
BSL: 00 08 02 00 3B 00 38 02 94 82
4.3.5 Program Data Fast
Structure
Header Length CMD Address Data CRC32
0x80 L1 L2 0x24 A1...A4 D1...Dn C1 C2 C3 C4
Description
The Program Data Fast command is identical to the Program Data command , except that this command
performs the non-blocking write, to speed up the programming process. To this command BSL will not send the
BSL core message response to indicate if the programming was successful.
Protected
Yes
Address
Start address of the memory region to be programmed. A1...A4, where A1 is the least significant byte of the 32
bit address.
Data
Data bytes to be written in the specified address. Maximum size of the data that can be sent is limited by the
Buffer size of the device. Buffer size is known from Get Device Info command .
Command Returns
BSL Acknowledgment.
Example
Host: 80 0D 00 24 00 01 00 00 01 02 03 04 05 06 07 08 72 10 2A 18
BSL: 00
4.3.6 Readback Data
Structure
Header Length CMD Address Data CRC32
0x80 0x09 0x00 0x29 A1...A4 L1...L4 C1 C2 C3 C4
Description
This command is used to readout the data starting from address A1...A4.
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 13
Copyright © 2023 Texas Instruments Incorporated

Readout should be enabled in the BSL configuration, to readout the data using this command. It is disabled by
default in the BSL configuration.
Data readout is allowed for Main flash (application memory), Non-main Flash (configuration memory) and SRAM
memory.
Note
SRAM memory is not fully accessible by the Host. See SRAM memory usage for more details.
Protected
Yes
Address
Start address of the memory region to be read back. A1...A4, where A1 is the least significant byte of the 32 bit
address.
Data
Size of the data to be read in bytes, L1...L4, where L1 is the least significant byte. Maximum size of the data that
can be read is limited by the Buffer size of the device. Buffer size is known from Get Device Info command.
Command Returns
BSL Acknowledgment and BSL core response with requested data, if the readback command is valid. See
Section 4.4.3 for more details.
If the readback command, had invalid address / length or if the readout was disabled, the corresponding error
will be sent as the Message Response following the BSL acknowledgment.
Example
Host: 80 09 00 29 00 0C 00 00 08 00 00 00 32 9D B0 35
BSL: 00 08 09 00 30 FF FF FF FF FF FF FF FF F6 2B A1 73
4.3.7 Flash Range Erase
Structure
Header Length CMD Address Data CRC32
0x80 0x09 0x00 0x23 A1...A4(Star
t Address)
A1...A4(End
Address) C1 C2 C3 C4
Description
The Flash range erase command is used to erase the specified flash memory region. Flash is erased sector
wise (1 KB), erasing lesser size is not possible.
When the Start and End address reside in different flash sectors, the BSL erases all the flash sectors in between
the Start and End address, including sectors that contains these addresses.
This command can be used to erase only the Main Flash memory. Non-main erase is not possible.
End address should never be less than Start address.
Protected
Yes
Address
Start address of the memory region to be erased. A1...A4, where A1 is the Least Significant Byte of the 32 bit
address.
Data
Bootloader Protocol www.ti.com
14 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

End address of the memory region to be erased. A1...A4, where A1 is the Least Significant Byte of the 32 bit
address.
Command Returns
BSL Acknowledgment and BSL core response with Message about the Status of the operation. See section
Section 4.4.1 for more details.
Example
Host: 80 09 00 23 00 01 00 00 FF 03 00 00 2B E6 BE D8
BSL: 00 08 02 00 3B 00 38 02 94 82
4.3.8 Mass Erase
Structure
Header Length CMD CRC32
0x80 0x01 0x00 0x15 C1 C2 C3 C4
Description
The mass erase command erases the complete Main Flash memory (application memory) available in the
device.
The Mass erase configuration in BCR configuration memory doesn't affect this BSL command.
When a flash region is static write protected in BCR configuration memory, the region can't be erased.
Protected
Yes
Command Returns
BSL Acknowledgment and BSL core response with Message about the Status of the operation. See Section
4.4.1 for more details.
Example
Host: 80 01 00 15 99 F4 20 40\
BSL: 00 08 02 00 3B 00 38 02 94 82
4.3.9 Factory Reset
Structure
Header Length CMD Data CRC32
0x80 L1 L2 0x30 D1...D16 C1 C2 C3 C4
Description
The factory reset command erases the complete Main Flash (application) memory and Non-main flash
(configuration) memory.
Processing this command, is impacted by the factory reset configuration in the BCR configuration memory.
Factory reset is
• Allowed without password, if 'Enabled'
• Allowed with password, if 'Enabled with Password'
• Not allowed, if 'Disabled'
When a flash region is static write protected in BCR configuration memory, the region can't be erased .
Protected
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 15
Copyright © 2023 Texas Instruments Incorporated

Yes
Data
16 byte factory reset password stored in the BCR configuration memory. The default password is all 0xFF.
Password is required only when Factory reset is "Enabled with Password" in BCR configuration.
Command Returns
BSL Acknowledgment and BSL core response with Message about the Status of the operation. See Section
4.4.1 for more details.
CAUTION
After doing the factory reset, until the Non-main configuration has been restored, the system is
highly vulnerable to a potential lockout situation in which it is impossible to get access to the device
again.
Example
Host: 80 01 00 30 DE 20 24 0B
BSL: 00 08 02 00 3B 00 38 02 94 82
4.3.10 Standalone Verification
Structure
Header Length RSP Data CRC32
0x08 0x05 0x00 0x32 D1...D4 C1 C2 C3 C4
Description
This command is used to verify the CRC of the data stored at the given memory range. This enables faster
verification of the programmed data. It requires the data size to be minimum 1kB.
CRC verification is allowed for Main flash (application memory), Non-main Flash (configuration memory) and
SRAM memory.
Note
SRAM memory is not fully accessible by the Host. Refer Section 3.3.1 for more details.
Protected
Yes
Address
Start address of the memory region to be verified. A1...A4, where A1 is the least significant byte of the 32 bit
address.
Data
Size of the data to be verified in bytes, L1...L4, where L1 is the least significant byte. 1kB <= size <= 64 KB.
Command Returns
BSL Acknowledgment and BSL core response with CRC value calculated for the requested memory region.
Refer Section 4.4.5for more details.
If the verification command, had invalid address / length, the corresponding error will be sent as the Message
Response following the BSL acknowledgment. Refer Section 4.4.1.
Example
Host: 80 09 00 26 00 00 00 20 00 04 00 00 A0 97 D5 2E
Bootloader Protocol www.ti.com
16 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

BSL: 00 08 02 00 3B 05 B7 F6 FE F2
4.3.11 Start Application
Structure
Header Length CMD CRC32
0x80 0x01 0x00 0x40 C1 C2 C3 C4
Description
Start application command, issues a system reset, which causes Bootloader exit, rerun of Bootcode, which in
turn starts the application.
Protected
No
Command Returns
BSL Acknowledgment
Example
Host:80 01 00 40 E2 51 21 5B
BSL:00
4.3.12 Change Baud Rate
Structure
Header Length CMD Data CRC32
0x80 0x02 0x00 0x52 D1 C1 C2 C3 C4
Description
The command can be used to change the baud rate of the UART interface. The new baud rate will take effect
after sending out the BSL acknowledgment for this packet.
The default baud rate of the BSL UART is 9600 bps.
Note
After updating the baud rate, if a wrong BSL password is sent with the Unlock Bootloader command,
the baud rate settings will be reverted to default value. Further communication should happen in the
default baud rate.
Protected
No
Data
D1 Baud rate as specified in the table.
ID Baud Rate (bps)
1 4800
2 9600
3 19200
4 38400
5 57600
6 115200
7 1000000
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 17
Copyright © 2023 Texas Instruments Incorporated

ID Baud Rate (bps)
8 2000000
9 3000000
Command Returns
BSL Acknowledgment
4.4 BSL Core Response
BSL Response RSP Data
Memory read back 0x30 D1…Dn
Get Device Info 0x31 D1…D24
Standalone verification 0x32 D1…D4
Message 0x3B MSG
Detailed Error 0x3A D1..D3
Abbreviations:
MSG
A byte containing a response from the BSL core describing the result of the requested action. This can either be
an error code or an acknowledgment of a successful operation. In cases where the BSL is required to respond
with data (for example, memory, version, CRC, or buffer size), no successful operation reply occurs, and the
BSL core immediately sends the data.
D1..Dn
Data bytes, where 'n' is limited by the BSL maximum buffer size
4.4.1 BSL Core Message
Structure
Header Length RSP Data CRC32
0x08 0x02 0x00 0x3B MSG C1 C2 C3 C4
Description
For some commands, BSL sends the message response to the host, which indicates the status of the processed
command. The table lists all the possible messages from the BSL.
MSG Meaning Possible Cause(1)
0x00 Operation Successful
0x01 BSL Locked error
The BSL is not yet unlocked with Bootloader unlock password
command or After BSL unlock, a timeout would have occurred in
the command reception phase
0x02 BSL password error Incorrect password has been sent to unlock bootloader.
0x03 Multiple BSL password error. Security Alert
action is taken. Incorrect password has been sent to unlock bootloader 3 times.
0x04 Unknown Command The command given to the BSL was not recognized as valid
command
0x05 Invalid memory range The given memory range is invalid.
0x06 Invalid command The command given to the BSL is a known command but it is invalid
at that time instant and cannot be processed.
0x07 Factory reset disabled Factory reset is disabled in the BCR configuration
0x08 Factory reset password error
Incorrect or no password has been sent with factory reset command,
when the BCR configuration has factory reset 'Enabled with
password'
Bootloader Protocol www.ti.com
18 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

MSG Meaning Possible Cause(1)
0x09 Read out error Memory read out be disabled in BCR configuration
0x0A Invalid address or length alignment Start address or data length for the flash programming is not 8-byte
aligned
0x0B Invalid length for standalone verification Data size sent for standalone verification is less than 1KB
(1) Possible causes listed here, are not the only reason for the status or error. It only lists the probable software reasons for the error, that
can be corrected by the host.
4.4.2 Detailed Error
Structure
Header Length RSP Data CRC32
0x08 0x02 0x00 0x3A D1..D3 C1 C2 C3 C4
Description
D1 - Error Type
D3,D2 - Error Details
Possible Values
Error type Error Details
Value Description Value Description
0xF0 Flash Error 0xXX Contains FLASHCTL.STATCMD
register value
4.4.3 Memory Readback
Structure
Header Length RSP Data CRC32
0x08 L1 L2 0x30 D1...Dn C1 C2 C3 C4
Description
The command returns the requested data in response to the Readback command
Data
Data D1..Dn where 'n' is limited by the BSL maximum buffer size.
4.4.4 Device Info
Structure
Header Length RSP Data CRC32
0x08 0x19 0x00 0x31 D1...D24 C1 C2 C3 C4
Description
The command returns the version information and BSL buffer size in response to the Get Identity Command
Data
Identity Byte Data Byte
Command Interpreter version [D02-D01]
Build ID [D04- D03]
Application version [D08-D05]
Active Plug-in interface version [D10-D09]
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 19
Copyright © 2023 Texas Instruments Incorporated

Identity Byte Data Byte
BSL Max buffer size [D12-D11]
BSL Buffer Start address [D16-D13]
BCR Configuration ID [D20-D17]
BSL Configuration ID [D24- D21]
Application version:
32 bit application version is taken from the address specified in BSL configuration
BSL Buffer size:
RAM data buffer size available to store the BSL data packets that are sent/received.
Example
Host: 80 01 00 19 B2 B8 96 49
BSL: 00 08 19 00 31 00 01 00 01 00 00 00 00 01 00 C0 06 60 01 00 20 01 00 00 00 01 00 00 00 49 61 57 8C
In the above given response,
Command Interpreter version - 0x0100
Build ID - 0x0100
Application version - 0x00000000
Active Plug-in interface version - 0x0001
BSL Max buffer size - 0x06C0
BSL Buffer Start address - 0x20000160
BCR Config ID - 0x00000001
BSL Config ID - 0x00000001
4.4.5 Standalone Verification
Structure
Header Length RSP Data CRC32
0x08 0x05 0x00 0x32 D1...D4 C1 C2 C3 C4
Description
The command returns the CRC value in response to the standalone verification command
Data
32 bit CRC value calculated for the requested memory region. D1...D4, where D1 is the least significant byte of
the CRC32.
4.5 Bootloader Security
4.5.1 Password Protected Commands
All the commands that can access the data in the memory directly or indirectly, are password protected. The
password is configurable in the BSL configuration in Non-main memory.
When an incorrect password is sent, device will sleep for next 2 seconds and does not accept any command
during this period to make brute force attacks harder. When incorrect password is sent for 3 times, Security alert
action is taken by the BSL.
4.5.1.1 Security Alert
A security alert can be configured to any of the following three modes, in the BSL configuration.
Bootloader Protocol www.ti.com
20 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated