Good thinking @edsut. the U3 (Segger) chip is optional; you can bypass it by not connecting the U5 (micro-USB) and instead supplying power to J7 (barrel connector). Your JTAG signals are available on J1 (10-pin, 2x5, might not be populated) in the standard fashion. I recommend OpenOCD with an Olimex or similar FT(2)232-based device, or even bitbang from a Raspberry PI.
Don’t confuse the doubletap bootloader (DTB) in the FLASH area (0x2000 0000) with the flash recovery mechanism (FRM) library in the OTP area (0x2 000). The former is optional and helpful but not necessary for system recovery. Early versions of DTB made their final jump to user code at 0x2040 0000, while later versions of DTB made their final jump to user code at 0x2001 0000. If you erase your FLASH, or otherwise replace your DTB, you’ll want your code to start at the base, 0x2000 0000, which is where the FRM makes its final jump.
See illustration above.
It is the FRM, not the DTB, which might “lock the processor”. What makes this processor lock recoverable is a bit subtle. The FRM holds persistent state of its power-on retry counter in the always-on backup1 register of the Power Management Unit (PMU) block. It’s value is preserved even when you reset or power-cycle your board. However, if you power-off your board long enough, the PMU registers are reset to their default state – and, thus, the FRM begins anew and does not lock the processor in its tight loop anymore.
Look at R32 and C22 on Sheet 2 your HiFive1B Schematic. That’s about a 106mS time constant, for the 150K Ohm and 10 uF components installed. If you leave the board unplugged for a few seconds (or momentarily bridge C22 with a tweezer or needle-nosed pliers) you’ll be back in business after even the most hideous code mistake – such as accidentally disabling the master clock (which I’ve done many times, by accident and on purpose).
Since the FRM programs the PMU_OUT_0 to pulse low only for about 400 uS upon reset, pressing the reset button might not be sufficient to disable U8 and power-off the board long enough to reset the state of PMU register backup1. On HiFive1-RevB the RT9080 has somewhat lower input current on its EN pin, and you might get lucky with enough reset button presses; on LoFive-R1 the SPX3819M5 is not as good, and it’s EN pin draws enough power to make the voltage drop through that 150K resistor significant–the board never resets, and needs either tweezer across the 10 uF or to be unplugged for awhile.
In short, don’t worry about erasing your entire FLASH and putting your desired code from scratch at 0x2000 0000. You’ll never brick your board, I promise.
PS–if you really want to simplify things and bypass that FRM entirely, you can re-program the OTP at its 0x2 1ff0 location, by changing that fence 0,0 instruction as noted in the Application Notes of the FE310-G002 Datasheet to be an unconditional j 0x2000 0000. I have not tried this, and probably never will. It is possible to brick the chip(*) if something goes wrong during the OTP Programming Procedure outlined in Chapter 6. You might, thus, want to experiment on a very small and inexpensive board, first.
(*) Actually, you’ll never brick the chip, even in case of unfortunate OTP programming failure, because you can always use JTAG with reset and halt, attach gdb, and single-step around a corrupted OTP program; for example, manually jumping from 0x1004 (the power-up reset point), over the MASK ROM and OTP areas, directly to 0x2000 0000 which is the start of external user-programmable FLASH or other memory on the SPI interface. The chip remains fully functional and never bricked; however, you’d have to use JTAG and gdb every time you reset or power-up–it could still be used as a bench test device for prototype and development work.