I'm diving into JTAG basics right now. Never did that before, but now that I've retired from oil and gas, it's about time I did, and sharpen up my 30 years of aged electronics hardware skills. Just started KiCAD two months ago... The plug-in board that I'm progressing is now at rev 4, it now got JTAG 10 pins header ports and I think I can even do a JTAG USB adapter with the FT232R chip that I had in it already for the serial port over USB. IF all goes well, then with this board plugged in, we can read and write any pin on the XPC860 CPU on the main board, and also read, erase, write the full flash ROMs (so including the boot loader that a firmware update by floppies does not I think).
To keep james_s from shooting: it has isolated JTAG, so we're unlikley going to damage hardware. But yes, once we erase the ROMs and fail to reprogram, yes, then of course...
See
on what we'd possibly open up if this JTAG backdoor with a JTAG connector, possibly with the USB-JTAG dongle on the same Tektronix TDS3000 rearside panel plug-in board already!
Still looking for the JTAG BSDL file for the MCP860. Used to be a download from Freescale according to the MPC860UM manual. It states "
45.7 Freescale MPC860 BSDL Description
The most current revision of the BSDL file for the MPC860 PowerQUICC is available at the Freescale web site (www.freescale.com)." But that was 20 years ago... Have asked on he NXP community forum, but no replies yet. Anyone has that BSDL file maybe?
Have put my hopes on
http://www.topjtag.com/. 1 of my 20 'for free' trial days has lapsed... Would be great if that works (then no need to push/pull 100 pins connector pins from yet another STM32 or so, because the XPC860 will do that over JTAG? Is OpenOCD a better shot? What about Intellitech? Did order a "Altera Mini Usb Blaster avec Câble pour CPLD FPGA NIOS JTAG Altera Programmeur" as it looks like there's FT2232 and FT232 incompatibilities that might bite... Takes another 1 or 2 weeks before I have it...
Only thing that's a bit of a stumbling block now: there is no JTAG TMS pin on the 100 pins connector. Only TDI, TCK, TDO, HRST, SRST. It seems that TMS is hard wired to VDDL on the scope main board, right under the BGA, impossible to cut that track unless you'd de-solder the 357 BGA pins. So TMS hard wired to +3V3. What does that mean? Just that I cannot debug, but still can do flash and NVRAM and RAM read/writes? That would be good enough for me for now but is that what it is?