Texas Instruments MSPM0 User manual

User’s Guide
MSPM0 Bootloader
ABSTRACT
The MSPM0 Bootloader (also known as BSL) provides a method to program and verify the device memory
(Flash and RAM) through a standard serial interface (UART or I2C).
Table of Contents
1 Overview of BSL Features..................................................................................................................................................... 2
2 Terminology.............................................................................................................................................................................3
3 BSL Architecture.....................................................................................................................................................................4
3.1 Design................................................................................................................................................................................ 4
3.2 BSL Invocation................................................................................................................................................................... 5
3.3 Memory.............................................................................................................................................................................. 6
3.4 BSL Configuration.............................................................................................................................................................. 7
3.5 BSL Status......................................................................................................................................................................... 8
4 Bootloader Protocol............................................................................................................................................................... 9
4.1 Packet Format....................................................................................................................................................................9
4.2 UART and I2C BSL Protocol..............................................................................................................................................9
4.3 Bootloader Core Commands............................................................................................................................................10
4.4 BSL Core Response........................................................................................................................................................ 18
4.5 Bootloader Security..........................................................................................................................................................20
5 Sample Program Flow with Bootloader..............................................................................................................................22
6 Secondary Bootloader..........................................................................................................................................................24
6.1 Secondary Bootloader Example.......................................................................................................................................24
7 Interface Plug-in....................................................................................................................................................................26
7.1 Implementation.................................................................................................................................................................26
7.2 Flash Plug-in Type........................................................................................................................................................... 28
7.3 Overriding an Existing Interface....................................................................................................................................... 29
8 References............................................................................................................................................................................ 31
9 Revision History................................................................................................................................................................... 31
Trademarks
All trademarks are the property of their respective owners.
www.ti.com Table of Contents
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 1
Copyright © 2023 Texas Instruments Incorporated

1 Overview of BSL Features
The bootstrap loader (BSL) provides a method to program or verify the device memory through a standard
UART or I2C serial interface.
Key features of the BSL that are accessible through the serial interface include:
• Programming and erase of flash memory
• Can return a 32-bit CRC of a code or data region (1KB minimum region size) to verify programming
• Can enable code or data read-out (disabled by default)
• Can return a firmware version number via a pointer to the main flash
• Can specify a hardware invoke GPIO
• Access is always protected with a 256-bit password
• Configurable security alert handling for resisting brute force attacks
• Can add a new interface as flash plug-in
• Can use custom bootloader
Overview of BSL Features www.ti.com
2MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

2 Terminology
Bootloader (BSL) - Boot routine used to load data to the device memory
Bootcode (BCR) - Startup Routine that runs after BOOTRST, to configure the device for executing application
BCR configuration - Configuration structure that contains all user configurable parameters for Bootcode, which
resides in Non-main flash memory
BSL configuration - Configuration structure that contains all user configurable parameters for Bootloader, which
resides in Non-main flash memory
www.ti.com Terminology
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 3
Copyright © 2023 Texas Instruments Incorporated

3 BSL Architecture
3.1 Design
The bootloader will be invoked by bootcode when a valid bootloader invocation condition is detected. It will be
invoked only if the bootloader is enabled in the BSL mode field of the BCR configuration.
Once the bootloader is started, it first executes the "Init" phase where the initial checks of the BSL configuration
is done and the device is configured for bootloader operations.
Next the bootloader enters "Interface Autodetection" phase. In this phase the BSL configures all the available
BSL ROM interfaces and the flash plug-in interface , if registered . The BSL then polls for the data through all
the interfaces one by one. When a valid connection packet is received in one of the interfaces, that interface will
be considered as active interface for further communication and all other interfaces will be disabled. Interface
discovery is done for 10 seconds, if no interface has been detected, the device is put in STANDBY mode.
Next the BSL enters "Command reception" phase. In this phase BSL will be waiting in an infinite loop for
commands from the host. When a valid command is received, the command is processed and the response from
the BSL core is sent back to the host. Then it goes back to the loop and waits for the next command and so on.
If the 'Start Application' command is received, the bootloader will trigger a system reset, after which the bootcode
is executed and the application is invoked. This phase also has a timeout of 10 seconds. If there is no valid
command received, bootloader is locked and it enters Sleep mode.
Figure 3-1. BSL Architecture
3.1.1 Timeout Feature
Bootloader will time out when no activity is detected and enters low-power mode to save power.
This has been implemented at the following two phases.
1. Interface autodetection
BSL Architecture www.ti.com
4MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

2. Command reception
3.1.1.1 Interface Autodetection
In Interface detection phase, if there is no valid connection command received for 10 seconds over any interface,
the bootloader enters STANDBY mode.
POR is required to get out of this state and use Bootloader by creating the BSL invocation condition again.
3.1.1.2 Command Reception
In command reception phase, if no valid command is received for 10 seconds, the bootloader will enter SLEEP
mode. To wake up the device from SLEEP mode, a data transaction should happen on the active interface.
Bootloader will be locked before entering Sleep mode to reduce attack surface. Hence after waking up from the
low power mode, Bootloader needs to be unlocked again by sending the 256 bit BSL Password (See Unlock
Bootloader command ).
Note
Bootloader user LFCLK for the timeout check. If application configures the external clock as the
source for LFCLK, the same will be used by BSL, when invoked through Application BSL request
3.2 BSL Invocation
Bootloader shall be invoked only by the boot code, when any of the BSL invocation conditions is met and if
Bootloader is enabled in BCR configuration TRM.
When Fast boot mode is enabled in BCR configuration, bootloader can be invoked only by Debug mailbox
command and Application request. Other checks are skipped to save execution time.
3.2.1 Blank Device
Bootcode detects the blank device by checking the erase state of the Stack pointer (0x00000000) and reset
vector (0x00000004) address. When both the flash memory addresses are found to be blank, then Bootloader
will be invoked.
3.2.2 Application Request
To invoke the bootloader from an application, set the RESETLEVEL as BOOTLOADERENTRY and trigger reset
through the RESETCMD register. This sequence causes a system reset, and the bootcode is executed and the
bootloader is invoked.
Because a system reset is issued, all the peripheral configurations are reset while exiting the application.
3.2.3 GPIO Based Invocation
GPIO used for BSL invocation can be configured in the BSL Configuration TRM in Non-main memory.
Fresh devices will have the TI programmed default pin detail in BSL configuration.
GPIO pin based invocation can be disabled in the BCR configuration. It is enabled by default.
GPIO should be asserted before the POR, and the state should be maintained for at-least T_start ms after POR.
Then the GPIO pin state can be de-asserted.
www.ti.com BSL Architecture
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 5
Copyright © 2023 Texas Instruments Incorporated

Figure 3-2. Invocation From GPIO
* - GPIO pin to be used as 'BSL Invoke' and 'Expected Pin Level' can be configured in BSL configuration
** - T_start refers to the Cold boot startup time, specified in the device specific data sheet
Note
If pin based BSL invocation is enabled, the configured GPIO pin should be either pulled high or low. It
should not be left floating, which could cause unexpected BSL execution.
3.2.4 Debug Mailbox Command
When debug interface is available, Bootloader invocation command can be sent through the Debug Subsystem
Mailbox (DSSM).
For more details on the DSSM command usage, please refer to MSPM0x_Technical_Reference_Manual DSSM
commands section.
3.2.5 Others
3.2.5.1 Pre-Boot Application Verification
In the BCR configuration, if application CRC verification is enabled TRM, the bootcode verifies the CRC for the
given application memory range. If the CRC is incorrect, the bootloader is invoked. In this case the bootloader is
invoked only if enabled. Otherwise the bootcode logs a catastrophic error and causes boot failure.
3.3 Memory
3.3.1 SRAM Memory Usage
The SRAM Memory layout explains the memory used for bootloader's operation.
• Data and Stack section - Used by BSL for it's operation. While exiting the bootloader, these sections of the
SRAM are cleared.
• Variable Buffer Space - Buffer space used for storing the data packets received /sent during the BSL
communication
The SRAM memory allowed for read and write access by the host is BSL Buffer Start Address to [SRAM end
address - 0x120], where SRAM end address is determined by the SRAM memory available in each device.
Since the same SRAM space is shared with variable buffer space, it has chances of getting overwritten during
an SRAM write/read operation.
BSL Architecture www.ti.com
6MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

Figure 3-3. SRAM Usage
A - SRAM Start Address (0x20000000)
B- 'BSL Buffer Start Address' known from the 'Get Device Info' command response, when no Flash plug-in
interface is registered
C- 'BSL Buffer Start Address' known from the 'Get Device Info' command response. It will be same as 'B' when
no Flash plug-in interface is registered
D- BSL Buffer End Address ='BSL Buffer Start Address' + (2 * 'BSL Max Buffer size'), where BSL Buffer Start
Address and BSL Max Buffer Size can be known from 'Get Device Info' command response
E- Start address of the stack allocation (E - 0x120). It will be same as 'D' when the 'BSL Max Buffer size' is less
than 0xFFFF
F- End address of the SRAM memory available in the device. Refer to device specific data sheet to know this.
Section B- C :
• Data section that will be allocated for Flash Plug-in operation, when registered in BSL configuration
Section C- D:
• Buffer space used to store data packets
• Maximum size is (2 * 0xFFFF)
Section C-E:
• Available memory for SRAM read and write operation through BSL commands
3.4 BSL Configuration
BSL configuration in Non-main Flash memory allows certain parameters used by BSL to be customized by the
user.
To know more about the available configurations, refer MSPM0 Technical Reference Manual - Configuration
Memory section .
www.ti.com BSL Architecture
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 7
Copyright © 2023 Texas Instruments Incorporated

3.5 BSL Status
BSL status gives the details about any error occurred during the execution, that resulted in unresponsive BSL.
This 32-bit status information is stored in a specific SRAM address (0x200000C0), and can be read through the
debugger, if the debug-access is enabled in the BCR configuration.
Table 3-1. Interpretation of BSL Status
Byte 4 Byte 3 Byte 2 Byte 1
Reserved HW Error HW Error details SW Error
SW Error
Error Description
0x01 BSL Configuration CRC Error
HW Error
Error Description HW Error Details
0x07 NMI exception NMIIDX - NMI Interrupt Index register data
BSL Architecture www.ti.com
8MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated

4 Bootloader Protocol
4.1 Packet Format
The BSL data packet has a layered structure. The BSL core command contains the actual command data to be
processed by the BSL. In addition to the standard BSL commands, there can be wrapper data before and after
each core command known as the peripheral interface code (PI Code). This wrapper data is information that is
specific to the peripheral and protocol being used, and it contains information that allows for correct transmission
of the BSL core command. Taken together, the wrapper and core command constitute a BSL data packet
PI Code BSL Core Data PI Code
4.2 UART and I2C BSL Protocol
The data packets of the UART and I2C BSL protocol have the following structure.
• Header byte indicates the protocol used and the packet type (command or response packet).
• Length field contains the size of the BSL Core Data in bytes.
• BSL core data, contains the Command / Response ID and Address, data as needed by the command
• CRC32 field contains the CRC calculated for the data in BSL core data
PI Code BSL Core Data PI Code
Header (1 byte) Length (2 byte) BSL Core Command/Response CRC32 (4 byte)
Based on the Core data field, the data packet is classified as either Command packet or response packet.
Command packet is the first packet which is transmitted to the BSL. The second packet is the Response packet
which is received from the BSL. Response packet contains two components BSL acknowledgment and BSL
Core response. In these two, Acknowledgment is received from BSL for every command packet sent. But the
BSL core response is not received for every command.
Figure 4-1. BSL Protocol
4.2.1 BSL Acknowledgment
The peripheral interface section of the BSL software parses the wrapper section of the BSL data packet. If there
are errors with the data transmission, an error message is sent immediately. An ACK is sent after all data has
been successfully received and does not mean that the command has been correctly executed (or even that the
command was valid) but, rather, that the data packet was formatted correctly and passed on to the BSL core
software for interpretation.
The BSL protocol dictates that every BSL data packet sent is responded to with a single byte acknowledgment
in addition to any BSL data packets that are sent. Table lists the acknowledgment responses from the BSL.
If an acknowledgment byte other than ACK is sent, the BSL does not send any BSL data packets. The host
programmer must check the acknowledgment error and retry transmission.
Data Meaning
0x00 BSL_ACK (Packet received successfully)
0x51 BSL_ERROR_HEADER_INCORRECT
0x52 BSL_ERROR_CHECKSUM_INCORRECT
0x53 BSL_ERROR_PACKET_SIZE_ZERO
0x54 BSL_ERROR_PACKET_SIZE_TOO_BIG
0x55 BSL_ERROR_UNKNOWN_ERROR
www.ti.com Bootloader Protocol
SLAU887 – FEBRUARY 2023
Submit Document Feedback
MSPM0 Bootloader 9
Copyright © 2023 Texas Instruments Incorporated

Data Meaning
0x56 BSL_ERROR_UNKNOWN_BAUD_RATE
4.2.2 Peripheral Configuration
4.2.2.1 UART
UART is enabled with following configuration:
• UART0 is used
• Baud rate 9600 bps by default. It can be updated by Change Baud Rate command
• Data width: 8 bit
• Stop bits: 1
• No parity
• Pins used for RXD and TXD are taken from the BSL configuration
4.2.2.2 I2C
The I2C interface in the BSL can act as the I2C target. The host acts as a controller and drives the
communication.
• I2C0 is used
• The I2C target address is 0x48, by default. It can be configured in BSL Configuration
• External pullup is needed for SCL and SDA lines
• Pins used for SDA and SCL are taken from the BSL configuration
Note
• The BSL does not validate the details of the pins configured in the non-main for the UART and I2C
interfaces. The BSL expects the pin configuration to be correct.
• Do not use the same pins for both UART and I2C.
4.2.2.3 CRC
CRC for the data must be calculated with:
• CRC32-ISO3309 polynomial
• Bit reversed configuration
• Initial seed - 0xFFFFFFFF
4.3 Bootloader Core Commands
BSL Command Protected CMD Start Address Data (Bytes) BSL Core response
CMD Connection No 0x12 - - No
CMD Unlock
Bootloader No 0x21 - D1…D32 (Password) Yes
CMD Flash Range
Erase Yes 0x23 A1...A4 A1...A4 (End address) Yes
CMD Mass Erase Yes 0x15 - - Yes
CMD Program Data Yes 0x20 A1...A4 D1…Dn, Yes
CMD Program Data
Fast Yes 0x24 A1...A4 D1…Dn, No
CMD Memory Read
back Yes 0x29 A1...A4 L1...L4 Yes
CMD Factory Reset Yes 0x30 - D1...D16 (Password) Yes
CMD Get Device
Info No 0x19 - - Yes
CMD Standalone
Verification Yes 0x26 A1...A4 L1...L4 Yes
CMD Start application No 0x40 - - No
Bootloader Protocol www.ti.com
10 MSPM0 Bootloader SLAU887 – FEBRUARY 2023
Submit Document Feedback
Copyright © 2023 Texas Instruments Incorporated