topic Re: MPC5746R JTAG PASSWORD in MPC5xxx

MPC5746R JTAG PASSWORD

liushiquan — Tue, 26 Aug 2025 05:47:53 GMT

Issue 1:

I lock Jtag by function void debug_lock() as bellow, then how can I unlock the jtag by any other function?

Issue 2:

Lauterbach can attach MPC5746R by sys.option.KEYCODE，but can not program flash, could anyone give me a example？

void debug_lock()

{

/*************************/

/* PROGRAM PASSWORDS */

/*************************/

/* Program JTAG password */

flash_program(0x00400120, JTAG_PASSWORD_0, JTAG_PASSWORD_1);

flash_program(0x00400128, JTAG_PASSWORD_2, JTAG_PASSWORD_3);

flash_program(0x00400130, JTAG_PASSWORD_4, JTAG_PASSWORD_5);

flash_program(0x00400138, JTAG_PASSWORD_6, JTAG_PASSWORD_7);

/* Program PASS Group 0 password */

flash_program(0x00400140, PASSWORD_PG0_0, PASSWORD_PG0_1);

flash_program(0x00400148, PASSWORD_PG0_2, PASSWORD_PG0_3);

flash_program(0x00400150, PASSWORD_PG0_4, PASSWORD_PG0_5);

flash_program(0x00400158, PASSWORD_PG0_6, PASSWORD_PG0_7);

/* Program PASS Group 1 password */

flash_program(0x00400160, PASSWORD_PG1_0, PASSWORD_PG1_1);

flash_program(0x00400168, PASSWORD_PG1_2, PASSWORD_PG1_3);

flash_program(0x00400170, PASSWORD_PG1_4, PASSWORD_PG1_5);

flash_program(0x00400178, PASSWORD_PG1_6, PASSWORD_PG1_7);

/* Program PASS Group 2 password */

flash_program(0x00400180, PASSWORD_PG2_0, PASSWORD_PG2_1);

flash_program(0x00400188, PASSWORD_PG2_2, PASSWORD_PG2_3);

flash_program(0x00400190, PASSWORD_PG2_4, PASSWORD_PG2_5);

flash_program(0x00400198, PASSWORD_PG2_6, PASSWORD_PG2_7);

/* Program PASS Group 3 password */

flash_program(0x004001A0, PASSWORD_PG3_0, PASSWORD_PG3_1);

flash_program(0x004001A8, PASSWORD_PG3_2, PASSWORD_PG3_3);

flash_program(0x004001B0, PASSWORD_PG3_4, PASSWORD_PG3_5);

flash_program(0x004001B8, PASSWORD_PG3_6, PASSWORD_PG3_7);

/*************************/

/* PROGRAM PASS DCFs */

/*************************/

/* Password Group 0 - program locks */

DCF_program(0x00000000, 0x00100100); /* LOCK0_PG0 */

DCF_program(0x00000000, 0x00100104); /* LOCK1_PG0 */

DCF_program(0x00000000, 0x00100108); /* LOCK2_PG0 */

DCF_program(0x40000000, 0x0010010C); /* LOCK3_PG0 [DBL=1] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100110); /* LOCK0_PG1 */

DCF_program(0x00000000, 0x00100114); /* LOCK1_PG1 */

DCF_program(0x00000000, 0x00100118); /* LOCK2_PG1 */

DCF_program(0x00000000, 0x0010011C); /* LOCK3_PG1, [DBL=0] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100120); /* LOCK0_PG2 */

DCF_program(0x00000000, 0x00100124); /* LOCK1_PG2 */

DCF_program(0x00000000, 0x00100128); /* LOCK2_PG2 */

DCF_program(0x00000000, 0x0010012C); /* LOCK3_PG2, [DBL=0] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100130); /* LOCK0_PG3 */

DCF_program(0x00000000, 0x00100134); /* LOCK1_PG3 */

DCF_program(0x00000000, 0x00100138); /* LOCK2_PG3 */

DCF_program(0x00000000, 0x0010013C); /* LOCK3_PG3, [DBL=0] */

/**************************/

/* Program Censorship DCF */

/**************************/

DCF_program(0x00000000, 0x001000B0); /* Censorship enabled for != 0x55AA */

/*************************/

/* PROGRAM LIFE CYCLE */

/*************************/

/* Advance Life Cycle from Customer Delivery to OEM Production */

flash_program(0x00400218, 0x55AA50AF, 0x55AA50AF);/* Invalidate CustomerDel*/

flash_program(0x00400220, 0x55AA50AF, 0x55AA50AF);/* Validate OEMProduction*/

}

Re: MPC5746R JTAG PASSWORD

petervlna — Tue, 26 Aug 2025 10:17:37 GMT

Hello,

Issue 1:

I lock Jtag by function void debug_lock() as bellow, then how can I unlock the jtag by any other function?

Not sure what is debug_lock(); But to uncensor the device you will simply add DCF record for 0x55AA to censorship DCF.

Issue 2:

Lauterbach can attach MPC5746R by sys.option.KEYCODE，but can not program flash, could anyone give me a example？

hmm, this is strange. Are you performing the reset in your programming script? Some devices had issue with loosing the key when reset was performed.

Try this script. I have removed reset from it.

Further refer to the PASS AN to see how censorship works. It is same for this device.

https://www.nxp.com/docs/en/application-note/AN12092.pdf

Best regards,

Peter

Re: MPC5746R JTAG PASSWORD

liushiquan — Fri, 29 Aug 2025 08:17:00 GMT

run this script, Lauterbach shows "FLASH erase error"

and function void debug_lock():

void debug_lock()

{

/*************************/

/* PROGRAM PASSWORDS */

/*************************/

/* Program JTAG password */

flash_program(0x00400120, JTAG_PASSWORD_0, JTAG_PASSWORD_1);

flash_program(0x00400128, JTAG_PASSWORD_2, JTAG_PASSWORD_3);

flash_program(0x00400130, JTAG_PASSWORD_4, JTAG_PASSWORD_5);

flash_program(0x00400138, JTAG_PASSWORD_6, JTAG_PASSWORD_7);

/* Program PASS Group 0 password */

flash_program(0x00400140, PASSWORD_PG0_0, PASSWORD_PG0_1);

flash_program(0x00400148, PASSWORD_PG0_2, PASSWORD_PG0_3);

flash_program(0x00400150, PASSWORD_PG0_4, PASSWORD_PG0_5);

flash_program(0x00400158, PASSWORD_PG0_6, PASSWORD_PG0_7);

/* Program PASS Group 1 password */

flash_program(0x00400160, PASSWORD_PG1_0, PASSWORD_PG1_1);

flash_program(0x00400168, PASSWORD_PG1_2, PASSWORD_PG1_3);

flash_program(0x00400170, PASSWORD_PG1_4, PASSWORD_PG1_5);

flash_program(0x00400178, PASSWORD_PG1_6, PASSWORD_PG1_7);

/* Program PASS Group 2 password */

flash_program(0x00400180, PASSWORD_PG2_0, PASSWORD_PG2_1);

flash_program(0x00400188, PASSWORD_PG2_2, PASSWORD_PG2_3);

flash_program(0x00400190, PASSWORD_PG2_4, PASSWORD_PG2_5);

flash_program(0x00400198, PASSWORD_PG2_6, PASSWORD_PG2_7);

/* Program PASS Group 3 password */

flash_program(0x004001A0, PASSWORD_PG3_0, PASSWORD_PG3_1);

flash_program(0x004001A8, PASSWORD_PG3_2, PASSWORD_PG3_3);

flash_program(0x004001B0, PASSWORD_PG3_4, PASSWORD_PG3_5);

flash_program(0x004001B8, PASSWORD_PG3_6, PASSWORD_PG3_7);

/*************************/

/* PROGRAM PASS DCFs */

/*************************/

/* Password Group 0 - program locks */

DCF_program(0x00000000, 0x00100100); /* LOCK0_PG0 */

DCF_program(0x00000000, 0x00100104); /* LOCK1_PG0 */

DCF_program(0x00000000, 0x00100108); /* LOCK2_PG0 */

DCF_program(0x40000000, 0x0010010C); /* LOCK3_PG0 [DBL=1] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100110); /* LOCK0_PG1 */

DCF_program(0x00000000, 0x00100114); /* LOCK1_PG1 */

DCF_program(0x00000000, 0x00100118); /* LOCK2_PG1 */

DCF_program(0x00000000, 0x0010011C); /* LOCK3_PG1, [DBL=0] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100120); /* LOCK0_PG2 */

DCF_program(0x00000000, 0x00100124); /* LOCK1_PG2 */

DCF_program(0x00000000, 0x00100128); /* LOCK2_PG2 */

DCF_program(0x00000000, 0x0010012C); /* LOCK3_PG2, [DBL=0] */

/* Password Group 1 - program locks */

DCF_program(0x00000000, 0x00100130); /* LOCK0_PG3 */

DCF_program(0x00000000, 0x00100134); /* LOCK1_PG3 */

DCF_program(0x00000000, 0x00100138); /* LOCK2_PG3 */

DCF_program(0x00000000, 0x0010013C); /* LOCK3_PG3, [DBL=0] */

/**************************/

/* Program Censorship DCF */

/**************************/

DCF_program(0x00000000, 0x001000B0); /* Censorship enabled for != 0x55AA */

/*************************/

/* PROGRAM LIFE CYCLE */

/*************************/

/* Advance Life Cycle from Customer Delivery to OEM Production */

flash_program(0x00400218, 0x55AA50AF, 0x55AA50AF);/* Invalidate CustomerDel*/

flash_program(0x00400220, 0x55AA50AF, 0x55AA50AF);/* Validate OEMProduction*/

}

Re: MPC5746R JTAG PASSWORD

petervlna — Mon, 01 Sep 2025 06:29:59 GMT

Hello,

Your script is not able to start erase. This is usually because of incorrect flash initialization for debugger.

Check your flash.list to see if the blocks are correctly initialized and if they are not protected for writes.

You can also use the script embedded in Lauterbach for device erase. You will fin dit in the TAB drop down menu MPC5xxx.

But generally in case of issues with third party tool usage we recommend to contact Lauterbach support.

Attached is mine simple script for flash erase of MPC5746R device.

Best regards,

Peter