JTAG debug mechanism

Hi,

I know this question is off topic, but I can't find a better place to ask.  I will be grateful if anyone can give me a hint or direct me to a reference.

As we know PowerPC use JTAG to debug CPU, which implements a Boundary-Scan mechanism.  It can manipulate any input/output signals of the CPU by a serial shift/scan process.  But my question is how it can read/write the core registers and system memory as implemented by most JTAG emulators.

Thanks,
Leo

** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/