I've been tinkering around with Supermodel and studying the disassembly of games to try and understand how JTAG is supposed to work on Model 3, and I think I've finally got at least a rough idea.
Right now Supermodel is emulating just one JTAG device with crazy long instruction and data registers; 46 bits and 197 bits respectively. But the real Model 3 video board consists of many JTAG-compatible devices daisy-chained to one another; namely, the individual ASICs (Mercury, Venus, Earth, etc.). By running the video RAM tests and seeing what popped up in the JTAG instruction register, I was able to ascertain that each ASIC has a 5-bit instruction register. For example, the combined IR code 0x3e8fffffffff translates to binary as 11111 01000 11111 11111 1111 11111 11111 111111111111 - sending 11111 (the BYPASS instruction) to each of the ASICs except for Mercury, which receives 01000 (not sure what this does just yet). In fact, the combined IR code 0x06318fc63fff translates to binary as 00011 00011 00011 00011 1111 00011 00011 111111111111 - sending 00011 (which must be the optional IDCODE instruction) to all of the ASICs.
But then we're left with sixteen bits unaccounted for: four between Earth and Mars, and twelve at the end. These are always set to 1 except when running a boundary scan. Well, I was able to find this document on the Mitsubishi 3D-RAM and it turns out the 3D-RAM units are also JTAG-compatible; mystery solved! Indeed, the combined IR to start a boundary scan is 0xa2205021444, or 00101 00010 00100 00001 0100 00001 00001 0100 0100 0100 - sending 0100 to each of the 3D-RAM units, which is the SAMPLE/PRELOAD instruction.
So the proper way to emulate JTAG on the Model 3 would be create an array of 10 JTAG device objects, with the TDO of each one feeding into the TDI of the next:
Jupiter -> Mercury -> Venus -> Earth -> 3D-RAM -> Mars -> Mars -> 3D-RAM -> 3D-RAM -> 3D-RAM
If we wanted to emulate the Step 2.x video board, we add more objects to the chain for a total of 17:
Jupiter -> Mercury -> Venus -> Earth -> 3D-RAM -> Mars -> Mars -> 3D-RAM -> 3D-RAM -> 3D-RAM -> Earth -> 3D-RAM -> Mars -> Mars -> 3D-RAM -> 3D-RAM -> 3D-RAM
I've started work on implementing such a system but I probably won't have that much time to work on it until the weekend.
P.S. Sega Rally 2 and Star Wars Trilogy Arcade fail to boot because they attempt to write data to a specific ASIC via JTAG and then read it back to make sure it worked. Because the games never receive back the value they just wrote, they just end up spinning in a loop forever, hence the need for patches to get the games to boot. If we emulate the proper JTAG daisy-chain system, it should be pretty easy to get both games working with no patches at all.