Electronic – How to use RPI 2 to debug RPI model B via JTAG with OpenOCD

I have a RPI 2 that I want to use for programming and debugging a RPI model B over JTAG for a bare metal project. Right now I'm having trouble to get the two boards to even talk to each other over JTAG.

I set up the model B target according to http://sysprogs.com/VisualKernel/tutorials/raspberry/jtagsetup/ and ran their program to enable the JTAG pins on the header. They also provide a raspberry.cfg target file to use on that site.

I also built OpenOCD 0.9.0 from source on the RPI 2 host to ssh into it and use it as a JTAG interface. I uncommented the line in interface/raspberrypi2-native.cfg that specifies the JTAG pins for openocd to use.
I then connected the RPI2 JTAG pins in interface/raspberrypi2-native.cfg to the pins set to JTAG mode on the Model B by the sysprogs.com program with jumper wires like this:

TCK: Pin 22 (Model B) -> Pin 23 (RPI2)
TMS: Pin 13 (Model B) -> Pin 22 (RPI2)
TDI: Pin 7 (Model B) -> Pin 19 (RPI2)
TDO: Pin 19 (Model B) -> Pin 21 (RPI2)
GND: Pin 20 (Model B) -> Pin 20 (RPI2)

I started openocd with $openocd -f interface/raspberrypi2-native.cfg -f target/raspberry.cfg, However I got the response:

Open On-Chip Debugger 0.10.0-dev-00329-gf19ac83 (2016-07-31-05:57)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: tck = 11, tms = 25, tdi = 10, tdo = 9
BCM2835 GPIO nums: swclk = 25, swdio = 24
BCM2835 GPIO config: srst = 18
srst_only separate srst_gates_jtag srst_push_pull connect_deassert_srst
adapter speed: 1000 kHz
none separate
raspi.arm
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG and SWD modes enabled
Info : clock speed 1001 kHz
Error: JTAG scan chain interrogation failed: all ones
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway…
Error: raspi.arm: IR capture error; saw 0x1f not 0x01
Warn : Bypassing JTAG setup events due to errors
Error: 'arm11 target' JTAG error SCREG OUT 0x1f
Error: unexpected ARM11 ID code

I've been messing around with the target and interface .cfg and triple checking the wiring to find out why it throws errors, but I haven't been successful yet. I briefly tried getting the RPI2 to connect to a STM32F3 Discovery board I had laying around, to see if I could determine that openocd was working on the RPI2 and the error was the Model B's fault, but that didn't work either (I got syntax errors in the ST-LinkV2 cfgs that came with OpenOCD, so I gave up because it seemed like another can of worms). I'm not sure what else to try to get JTAG to start up and connect properly. Does anyone know what I'm doing wrong?

For completeness, here's the interface/raspberrypi2-native.cfg, which I have been fiddling with to try to get it working. The original version comes with OpenOCD.

#
# Config for using Raspberry Pi's expansion header
#
# This is best used with a fast enough buffer but also
# is suitable for direct connection if the target voltage
# matches RPi's 3.3V and the cable is short enough.
#
# Do not forget the GND connection, pin 6 of the expansion header.
#

interface bcm2835gpio

# needed for oocd to jtag a rpi 1 model b, but breaks stm32f3 discovery support
#adapter_khz 1000
#transport select jtag 

bcm2835gpio_peripheral_base 0x3F000000

# Transition delay calculation: SPEED_COEFF/khz - SPEED_OFFSET
# These depend on system clock, calibrated for stock 700MHz
# bcm2835gpio_speed SPEED_COEFF SPEED_OFFSET
bcm2835gpio_speed_coeffs 146203 36

# Each of the JTAG lines need a gpio number set: tck tms tdi tdo
# Header pin numbers: 23 22 19 21
bcm2835gpio_jtag_nums 11 25 10 9

# or if you have both connected,
# reset_config trst_and_srst srst_push_pull

# Each of the SWD lines need a gpio number set: swclk swdio
# Header pin numbers: 22 18
bcm2835gpio_swd_nums 25 24

# If you define trst or srst, use appropriate reset_config
# Header pin numbers: TRST - 26, SRST - 18

# bcm2835gpio_trst_num 7
# reset_config trst_only

bcm2835gpio_srst_num 18
reset_config srst_only srst_push_pull

# or if you have both connected,
# reset_config trst_and_srst srst_push_pull

And here's the target/raspberry.cfg for the model B target device, provided by sysprogs.com; it hasn't been modified IIRC:

# Broadcom 2835 on Raspberry Pi

telnet_port 4444

gdb_port 5555

#tcl_port 0
adapter_khz 1000
transport select jtag

if { [info exists CHIPNAME] } {
    set  _CHIPNAME $CHIPNAME
} else {
    set  _CHIPNAME raspi
}
    reset_config none

if { [info exists CPU_TAPID ] } {
    set _CPU_TAPID $CPU_TAPID
    } else {
        set _CPU_TAPID 0x07b7617F
    }

    jtag newtap $_CHIPNAME arm -irlen 5 -expected-id $_CPU_TAPID

            set _TARGETNAME $_CHIPNAME.arm

    target create $_TARGETNAME arm11 -chain-position $_TARGETNAME