Help Reading Flash JTAG Port

[falcom]

I have  a fairly expensive circuit board from a thermal imager. It is a processor board that worked until recently and then suddenly stopped.
It is several thousand $ and a long wait for the manufacturer to replace it.
 I have another working circuit board that has the wrong software/firmware installed.

I want to copy the software /firmware from the non working board and program the working board with it.

The board has a JTAG port and I can read the Xilinx XCR3032XL CPLD using Platform USB Cable and the check sum matches the one printed on the CPLD. The  CPLDs on both boards have matching check sums.  I cannot go any further. (I don't know how)
I am new enough to JTAG to not fully understand it.

The board has:
 NEC VR4131 microprocessor ,
 Intel 28F128J3  Strata flash memory,
Xilinx XCR3032XL ,     
and a Micron MT48LC4M16A2 SDR SDRAM dram.

How should I proceed?

..
If programming is not feasible how about desoldering the BGA chips and soldering them to the working board???

[falcom]

BUMP

[cruff]

Have you searched for a tool that can program the 28F128J3 chip via JTAG? I would expect many tools to be able to read out the contents of the chip for verification.

[falcom]

That's where I am stuck. My web searches have come up empty. is this something the Platform USB cable can do?

[rstofer]

Have you read the datasheet for the flash?  Among other things, it features code read protection.
If I were building a product, I would absolutely enable protection before I shipped it.

[falcom]

The device is supposedly open architecture. 

[cruff]

It appears that flash ROM does not have a JTAG interface, so you can't use a JTAG probe/software to read out the bits directly.

Is the flash attached directly to the CPU or is it attached via the CPLD? You would either need software running on the CPU to give you the bits, to reprogram the CPLD to do that or use some JTAG software to drive the pins on the CPLD to access the ROM and to return the resulting bits. Is the schematic of the device available?

[falcom]

I do not have the schematic for the device and it is not supported by the manufacturer.
I think the flash is connected to the microprocessor.

 Can I run the processor via JTAG?

[Bassman59]

I have  a fairly expensive circuit board from a thermal imager. It is a processor board that worked until recently and then suddenly stopped.
It is several thousand $ and a long wait for the manufacturer to replace it.
 I have another working circuit board that has the wrong software/firmware installed.

I want to copy the software /firmware from the non working board and program the working board with it.

Why do you think the firmware has suddenly gone toes up?

[cruff]

Can I run the processor via JTAG?

It depends if the processor has a JTAG interface and if you can tell it to execute code from some memory locations you can load with code via JTAG. It may have an alternative boot mode that would let you download code via another I/O interface. You'll need to read the relevant datasheet.

[falcom]

I had an extra scrap board so I removed the processor so i could access the pins. There is a JTAG interface. It has a 10 pin Hirose connector wired to processor pins.
Power
Ground
JTMS
JTRST
JTCK

BKTGIO#
JTDI/RMODE# (JTDI: Input When JTRST# is inactive this becomes the JTAG data input signal.)
DDIN/GPIO34
DDOUT/DBUS32/GPIO32
I will see what a boundary scan shows.

[abyrvalg]

Try OpenOCD configured for MIPS64 on that CPU port.

[falcom]

I am afraid that OpenCD is way above my skill level.
I would gladly pay someone to read and program this flash if I was confident of their success.

[amiq]

You could give TopJtag Flash Programmer a try.