Add support for tunneled JTAG access to RISC-V targets

[craigjb]

Change

This change adds TunneledJtagDtm in architecture::riscv::dtm::jtag_dtm that allows access to a RISC-V target through a JTAG tunnel with a configurable instruction and data register width. Additionally, this change adds attached_tunneled and attach_auto in RiscvInterfaceBuilder to allow Session to use a tunnel if configured on the Target.

The JTAG tunnel is configurable in YAML for a variant like this:

  # config for Xilinx BSCANE2
  jtag:
    riscv_tunnel:
      ir_id: 0x23
      ir_width: 6

I've tested it with a VexRiscv soft-core running on a Xilinx XC7A200T using a Digilent HS3 probe.

Background

It's common to use a JTAG tunnel to access RISC-V soft-cores running on FPGAs. A tunnel allows using the same cable for configuring the FPGA and debug access to the soft-core within. The simple protocol was originally created by SiFive, but is now used by many (including VexRiscv).

OpenOCD supports tunneled JTAG access to RISC-V with the riscv use_bscan_tunnel command (docs on this page).

A tunneled scan looks like this:

1. Scan configured instruction (RiscvJtagTunnel::ir_id)
2. Scan data register with:
   1. Select IR (0) or DR (1): 1 bit
   2. Width of tunneled scan: 7 bits
   3. Tunneled scan bits: width + 1 bits
   4. Set tunnel to idle: 3 zero bits

[bugadani]

Thank you