MSP Download Method

Whether it is simulation or burning program, MSP430 can generally be done through: JTAG, SBW, BSL interface.

1. JTAG uses boundary scan technology. There is a logic interface inside the 430 for JTAG use. There are several registers inside that are connected to the 430 internal data address bus, so all resources of the 430 can be accessed, including the full address

FLASH, RAM and various registers. It can be used to emulate and program 430. The main connection lines are TMS, TCK, TDI, TDO. 430 also needs two more lines RST and TEST to start the JTAG command sequence.

2. SBW is SPY-BI-WIRE, which can be referred to as two-wire JTAG. It mainly includes SBWTCK (connected to the 7-pin TCK of the JTAG interface) and SBWTDIO (connected to the 1-pin TDO/TDI of the JTAG interface). This interface is mainly used for 2 series microcontrollers with less than 28 pins, because the JTAG of microcontrollers with less than 28 pins is generally multiplexed with the IO port. In order to leave more IO resources for users, the SBW interface is introduced. SBW can access all the internal resources of 430 just like JTAG.

Note: Currently, the MSP430F5XX series also has an SBW interface, and the principle is the same as the SBW of the 2 series.

3. BSL is a piece of code that TI pre-fixes into the MCU when the 430 is shipped. This code is not readable or writable by users. It is somewhat similar to the bootloader of DSP, but it is obviously different from the bootloader. BSL can only be used to access the FLASH inside the MCU, and cannot access other resources, so it can only be used as a programmer interface. BSL communicates with the programmer through the UART protocol. The programmer can send different communication commands to perform different operations on the MCU's memory. This method can be called a BSL interface.

The startup of BSL code is somewhat special. Generally, the PC pointer points to the FFFE reset vector when the 430 reset is started. However, a special startup method can be used to make the MCU point to the program solidified inside the BSL when it is started. This special startup method is generally generated by a slightly more complex startup logic of the RST pin and the TEST (or TCK) pin. After the BSL is started, the MCU can be read and written through the pre-defined UART protocol commands.

4. General MCUs have code encryption functions. How does 430 achieve this? External access to the internal code of 430 can only be done through the three methods mentioned above. If these three methods are blocked, won’t the 430 program be safe? So we introduce

The fuse bit only exists in the JTAG and SBW interface logic. When the fuse is burned (physical damage and irreversible), the access to JTAG and SBW will be prohibited, and only BSL can access it. The access to the MCU through BSL requires a 32-byte password, which is the interrupt vector table of the user code. Now some domestic decryption manufacturers claim that they can decrypt 430. The principle is to connect the fuse bit through the slicing and peeling method, and then read the target code through the JTAG or SBW interface. There is no report of BSL being cracked.

The emulator models generally support JTAG and SBW interfaces. According to the connection method with the host, they are divided into UIF (USB interface, supports JTAG and SBW), PIF (parallel port, only supports JTAG), EZ430 (only supports SBW mode, currently does not support F5XX series)