HardICE‎ > ‎Reference‎ > ‎Intel‎ > ‎


On multi-core processors, there are multiple JTAG controllers on each CPU package. There is one JTAG controller for one core. Hyperthreaded cores use one JTAG controller; different TAP commands are used to access each hyperthreaded thread on one core. One JTAG controller is also dedicated for the Uncore in the Nehalem and Sandy Bridge CPUs. One JTAG controller is dedicated for the Intel HD iGPU on the CPU package. The author suspects that the JTAG controllers are daisy-chained together.

Intel CPUs are not the only chips to have JTAG functionality. Intel chipsets also have debug capabilities that are very different from Probe Mode. Early chipsets only have XOR trees that allow a tester to see if the chipset is soldered properly. However, later generations of chipsets allow the engineer to issue PCI requests through the JTAG port using the JCONF or CSCFG TAP instructions. More advanced chipsets (especially of the server variety) feature a "debug bus", which pipes internal data out through debug pins on the chipset. This debug bus varies for each chipset and is called by different names, such as "RAM Trace", "TNB Debug Bus", "Node Observation Architecture", as well as "XMB Trace". These buses often run at the speed of the FSB.

Newer Intel chipsets feature multiple JTAG controllers on one chipset. Each JTAG controller controls a specific part of the chipset. For instance, one JTAG controller controls the audio processor, while another controls the RAM controller, while another controls the embedded AMT ARC processor. To access each JTAG controller, a SEL TAP command is sent to the master JTAG controller, which then links the correct chain onto the TDI and TDO pins of the chipset. Each chain may contain more than one JTAG controller, so the BYPASS TAP command can be used on unneeded controllers. Chipsets which support QPI feature Intel IBIST capability, which allows engineers to program QPI link testers embedded within the chipset itself. Similarly, the Uncore of Nehalem and Sandy Bridge server processors feature QPI link testers. These IBIST/QPI link testers can be configured via PCI registers. These PCI registers can be accessed via the JTAG port. It is unknown if these PCI registers are accessible from x86 code running on the CPU, so perhaps JTAG is the only way to access these IBIST registers.