diff --git a/sim/testsuite/sim/msp430/testutils.inc b/sim/testsuite/sim/msp430/testutils.inc
index 6c540b1..1ddef23 100644
--- a/sim/testsuite/sim/msp430/testutils.inc
+++ b/sim/testsuite/sim/msp430/testutils.inc
@@ -9,13 +9,43 @@
 	.global __pass
 	.type __pass, function
 __pass:
-	write 1, _passmsg, 5
+	# Note - we cannot just invoke:
+	#
+	#  write 1, _passmsg, 5
+	#
+	# here because _passmsg contains the run-time (VMA) address of
+	# the pass string (probably 0x500) not the load-time (LMA)
+	# address (probably 0x804c).  Normally using the VMA address
+	# would be the correct thing to do - *if* there was some start
+	# up code which copied data from LMA to VMA.  But we have no
+	# start up code, so the data still resides at the LMA
+	# address.  Hence we use __romdatastart instead.
+	#
+	# Note - we are cheating because the address that we pass to
+	# "write" should actually be:
+	#
+	#    __romdatastart + (_passmsg - __datastart)
+	#
+	# but the assembler cannot cope with this expression.  So we
+	# cheat and use the fact that we know that _passmsg is the
+	# first string in the .data section and so (_passmsg -
+	# __datastart) evaluates to zero.
+
+	write 1, __romdatastart, 5
 	exit 0
 
 	.global __fail
 	.type __fail, function
 __fail:
-	write 1, _failmsg, 5
+	# Note - see above.
+	#
+	#   write 1, _failmsg, 5
+	#
+	# This time we use the fact that _passmsg is aligned to a
+	# 16 byte boundary to work out that (_failmsg - __datastart)
+	# evaluates to 0x10.
+
+	write 1, __romdatastart + 0x10, 5
 	exit 1
 
 	.data