LS1043a Unlock JTAG Password

[thehk]

Hello Folks, i want to enter my jtag password into my LS1043ardb demo board, however i have no acces to the CodeWarrior IDE and CodeWarrior TAP, i have a custom probe. In my custom board i have access to both instruction register and data register, but i dont know which address is the address that i can reach to the entering password insrtuction. I mean IDCODE, BYPASS, PASSWORD, etc. instructions. Can you provide this information. 

Thank you

LS1043A-RDB 

[yipingwang]

Please refer to page 41 “Secure Debug” in the following document.

https://community.nxp.com/t5/Layerscape-Knowledge-Base/Secure-boot-Fuse-Provisioning-Secure-debug/ta...

[thehk]

FirstIy, thank you for your answer, i already check that document, in the floowing it shows how can you solve the jtag password, by using codewarrior TAP and CodeWarrior IDE as following
"

(bin) 38 % display ccs::get_config_chain

Chain Position 0: LS1043A

Chain Position 1: DAP

Chain Position 2: SAP2

(bin) 40 % display ccs::read_reg 0 sdcr 1 8

   sdcr=0xC0C0C0C0 D0D0D0D0

(bin) 44 % ccs::write_reg 0 sdrr 8 {0xf1f1f1f1 0xa5a5a5a5}

(bin) 46 % ccs::config_chain { ls1043a dap sap2}

(bin) 47 % display ccs::get_config_chain

Chain Position 0: LS1043A

Chain Position 1: CoreSight ATB Funnel

Chain Position 2: CoreSight ATB Funnel

Chain Position 3: CoreSight TMC

Chain Position 4: CoreSight TMC

Chain Position 5: CoreSight ATB Funnel

Chain Position 6: CoreSight STM

Chain Position 7: CoreSight TMC

Chain Position 8: CoreSight ATB Funnel

… …

"

it firtsly read the sdcr register, how can i read this register by using custom probe. I guess i need NXP jtag documentation that tells the ofset of the this register can you share it?

[yipingwang]

Please refer to https://developer.arm.com/documentation/100442/0100/register-descriptions/aarch32-system-registers/s...

sdcr Offset 0x0001_0000_0000_0000 (SCSR)

sdrr Offset 0x0001_0000_0000_0008 (SCSR)

[thehk]

Thank you for your response,
as long as you see from my previous answer
"(bin) 40 % display ccs::read_reg 0 sdcr 1 8

sdcr=0xC0C0C0C0 D0D0D0D0

(bin) 44 % ccs::write_reg 0 sdrr 8 {0xf1f1f1f1 0xa5a5a5a5}"
it selects the device 0 which means ls1043a itself not DAP, when i want to reach core register i know that i should select DAP but in this presentation, it seems like it is not reaching the core register. It is using Chain Position 0: LS1043A, furthermore it use 8 bit instruction ARM ADI V5 DAP is accepting 4 bit instruction. Moreover, the document(arm cortex a55) that you share with me is mentioning about "secure debug control register" but i guess i need "secure debug challenge register". Thank you

[yipingwang]

Secure Debug Challenge Register (SDCR)
Offset 0x0001_0000_0000_0000 (SCSR) Access: Read only

Secure Debug Response Register (SDRR)
Offset 0x0001_0000_0000_0008 (SCSR) Access: Write only