How do I read the status register of a Virtex 5 in a JTAG chain?

I'm working on an XUPV5-LX110T and I'm trying to read the status register over JTAG. I'm getting incorrect data, but I can't see why. I seem to be getting all zeros.

I suspect it has to do with the order of the JTAG chain, but I'm not sure how I should adjust the order of the commands I send.

I know the TMS pits will change the state of all the devices on the chain, but how do you shift in data to the FPGA when it's the last device on the chain?

I've actually worked on this same device. If I'm correct, when you look at the JTAG chain in iMPACT, you should see 5 devices: two PROMs, a SystemAce, and a CPLD, followed by the Virtex 5 as the final item on the chain. Like this:

PROM -> PROM -> SysAce -> CPLD -> Virtex5

In order to read the status register successfully, you will need to understand how the TAP Controller works:

_{(source: fpga4fun.com)}

Like you said, the TMS signals are connected to all the devices on the JTAG chain. That is, if you're in the Test-Logic-Reset state and send in 0 1 1 0 0, all devices will now be in the Shift-DR state.

Next, you will want to know the size of all of the Instruction Registers of the devices on your JTAG chain. In this case, the two PROMs have IR size of 16 bits. The SysAce and CPLD have IR size of 8-bits. You want to know these sizes so that you know how much data to shift down the chain. The Virtex 5 has an IR size of 10-bits.

The final trick to working with JTAG is noting that when sending in commands, they are transmitted on TDI LSB-first. But, shifting data into the DR is MSB first. Make sure to check which way is which in the Virtex 5 Configuration Guide

With these pieces of information, you can read the status register like this pseudocode:

unsigned int read_status_register {
  reset JTAG to Test-Logic-Reset by sending five 1s on TMS

  go into Shift-IR state

  // The order of this depends on your JTAG chain
  Send CONFIG_IN on TDI (these 10 bits will eventuall get pushed to the Virtex 5's IR)

  Send eight 1's to put the CPLD in BYPASS

  Send eight 1's to put the SysAce in BYPASS

  Send sixteen 1s to put the next PROM in bypass

  Send fifteen 1s to put the last PROM in bypass

  // As described in the configuration guide
  Send the last 1 on TDI while transitioning from Shift-IR to the Exit state

  Transition back to Test-Logic-Reset

  Transition to Shift-DR

  Shift in the command sequence (sync word, noop, read_status, noop, noop)

  Shift in 3 bits to push the command sequence past the other devices on the chain

  Shift in 1 more bit while transitioning to exit

  Transition to Shift-IR

  Shift in CONFIG_OUT

  Shift in 1's to put all devices in BYPASS like we did above

  Transition to Shift-DR

  Shift out 32-bits and save the data coming from TDO

  // Note that we can stop here because the FPGA is the last device
  // on the chain. Otherwise, you may need to shift in a couple of bits
  // to push the data past other devices on the chain

}

As you can see, it's basically all about making the right state transitions, and knowing the order to send things. Good luck!