SLAU367P October 2012 – April 2020 MSP430FR5041 , MSP430FR5043 , MSP430FR50431 , MSP430FR5847 , MSP430FR58471 , MSP430FR5848 , MSP430FR5849 , MSP430FR5857 , MSP430FR5858 , MSP430FR5859 , MSP430FR5867 , MSP430FR58671 , MSP430FR5868 , MSP430FR5869 , MSP430FR5870 , MSP430FR5872 , MSP430FR58721 , MSP430FR5887 , MSP430FR5888 , MSP430FR5889 , MSP430FR58891 , MSP430FR5922 , MSP430FR59221 , MSP430FR5947 , MSP430FR59471 , MSP430FR5948 , MSP430FR5949 , MSP430FR5957 , MSP430FR5958 , MSP430FR5959 , MSP430FR5962 , MSP430FR5964 , MSP430FR5967 , MSP430FR5968 , MSP430FR5969 , MSP430FR5969-SP , MSP430FR59691 , MSP430FR5970 , MSP430FR5972 , MSP430FR59721 , MSP430FR5986 , MSP430FR5987 , MSP430FR5988 , MSP430FR5989 , MSP430FR5989-EP , MSP430FR59891 , MSP430FR5992 , MSP430FR5994 , MSP430FR59941 , MSP430FR6005 , MSP430FR6007 , MSP430FR6035 , MSP430FR6037 , MSP430FR60371 , MSP430FR6041 , MSP430FR6043 , MSP430FR60431 , MSP430FR6045 , MSP430FR6047 , MSP430FR60471 , MSP430FR6820 , MSP430FR6822 , MSP430FR68221 , MSP430FR6870 , MSP430FR6872 , MSP430FR68721 , MSP430FR6877 , MSP430FR6879 , MSP430FR68791 , MSP430FR6887 , MSP430FR6888 , MSP430FR6889 , MSP430FR68891 , MSP430FR6920 , MSP430FR6922 , MSP430FR69221 , MSP430FR6927 , MSP430FR69271 , MSP430FR6928 , MSP430FR6970 , MSP430FR6972 , MSP430FR69721 , MSP430FR6977 , MSP430FR6979 , MSP430FR69791 , MSP430FR6987 , MSP430FR6988 , MSP430FR6989 , MSP430FR69891
A device can also be locked by writing 0AAAAh to JTAG Signature 1 and writing JTAG Signature 2 with any value except 05555h. In this case, JTAG and SBW interfaces grant access to a limited JTAG command set that restricts accessibility into the device as in Section 1.13.1, but an additional mechanism is available that can unlock the device with a user-defined password. In this case, JTAG Signature 2 represents a user-defined length in words of the user defined password. For example, a password length of four words would require writing 0004h to JTAG Signature 2. The starting location of the password is fixed at location 0FF88h. As an example, for a password of length 4, the password memory locations would reside at 0FF88h, 0FF8Ah, 0FF8Ch, and 0FF8Eh.
The password is not checked after each BOR; it is checked only if a specific signature is present in the JTAG incoming mailbox. If the JTAG incoming mailbox contains 0A55Ah and 01E1Eh in JMBIN0 and JMBIN1, respectively, the device is expecting a password to be applied. The entered password is compared to the password that is stored in the device password memory locations. If they match, the device unlocks the JTAG and SBW to the complete JTAG command set until the next BOR event occurs.
NOTE
Memory locations 0FF80h through 0FFFFh may also be used for interrupt vector address locations (see the device-specific data sheet). Therefore, if using the password mechanism for JTAG and SBW lock, which uses address locations 0FF88h and higher, these locations may also have interrupt vector addresses assigned to them. Therefore, the same values assigned for any interrupt vector addresses must also be used as password values.
NOTE
Signatures that have been entered do not take effect until the next BOR event has occurred, at which time the signatures are checked. For example, entering a correct password that grants entry into the device followed by an incorrect password without a BOR sequence may still grant access to the device.