I'm trying to read the flash memory of a microcontroller MPC5606B from Motorola. I saw his pins and saw that it uses jtag to perform debug, so I'm trying to use it JTAG interface to read its flash content.
I read the MPC's flash content using a tool (UPA) and a PC, however, I want to do it by my own, using my own embedded hardware without the PC's tool. I read about JTAG standard( JTAG_IEEE-Std-1149.1-2001 ), and some videos and explanations on the internet. I read about TAP controller state diagram and read about some instructions too.
In order to better understand the JTAG reading, I Used the PC's tool to read the MCP's flash and an osciloscope to see how the communication is performed, however, the communication has almost 10s of duration. So, I filled the entire flash with zeros and read the memory, in this way, I was able identify the reading of memory using the osciloscope. However, although I can identify the reading of memory using the osciloscope, I can't determine yet the exact sequence of commands to perform the reading. The time of reading is too big, almost 10s.
So, before to go more deep, I would like to know if there is some kind of protection to access the flash memory. I tried to understand the beginning of the communication, I can identify the progress in the TAP controller's state machine, but I was not able to understand what this steps means and why it is done. So, I would like to know:
1) Can I determine if the communication has some kind of protection ? I really need to know it before to go further in the task because I need to know the task's complexity level before to go more deep
2) Although I read about the JTAG standard and the TAP controller state machine, I was not able to say what sequence of comands I need to read the flahs content.
Abaixo está a leitura do flash do MPC5606B realizada pela ferramenta com o auxílio do PC. The image is composed of a sequence of images. The first is the image of the communication in full, the second is the beginning of the communication, there is an arrow indicating where it was withdrawn.
This was my interpretation until now
1.1 - (TMS = 1) Test-Logic-Resset
1.2 - (CLK wide pulse) I do not know why.
1.3 - (8 pulses of CLK, TMS = 1)
Since TMS did not came out to 1 I understand that it did not quit Test-logic-Reset
1.4 - (TMS = 0, 1 pulse clock) enters Run-Test-Idle
2.1 - (TMS = 1, 2 clock pulses) Goes to the "Select IR-Scan" state
2.2 - (TMS = 0, 2 pulses of clock) Go to the state "Shif-IR"
2.3 - (TMS = 0, 4 clock pulses) Remains in "Shift-IR"
TDI: 1000 TDO: 1000 2.4 - (TMS = 1, 1 clock pulse) Goes to the "Exit1-IR"
2.5 - (TMS = 1, 1 clock pulse) Goes to the status "Update-IR"
2.6 - (TMS = 0, 1 clock pulse) Goes to the "Run-Test-Idle"
3.1 - (TMS = 1, 1 clock pulse) goes to the "Select DR-Scan" state
3.2 - (TMS = 0, 2 clock pulses) Go to the status "Shif-DR"
3.3 - (TMS = 0, 31 clock pulses) Go to the "Shif-DR" state
The 32 clock cycles are equivalent to 4 bytes:
TDI: 0x00 0x00 0x00 0x00 TDO: 0xB8 0x0C 0x27 0x54 (10111000 00001100 00100111 01010100)
3.4 - (TMS = 1, 1 clock pulse) Goes to the "Exit1-DR"
3.5 - (TMS = 1, 1 clock pulse) Goes to the status "Update-DR"
3.6 - (TMS = 0, 1 clock pulse) Goes to the "Run-Test-Idle"