Based on my related question on Info Sec SE I want to know if I could track all changes to register state (and perhaps memory too) on multiple cores of an x86-64 CPU.
Some of my research so far suggested the max bandwidth of JTAG on any given system is only as fast as the slowest component can support because of the way it's daisy-chained. That source suggested the max might be around 100MHz or as low as 10MHz (hopefully I heard MHz, not Hz). I'm really not sure about any of it yet, maybe this is a rabbit hole I shouldn't be going down.
So for an x86 CPU / mobo can the dedicated debug port for JTAG allow me to monitor the states of all cores on an x86 machine, even one at a time? In other words, is there enough bandwidth to record the state changes of every core via JTAG with the physical debug port, constantly?
If not the state changes, perhaps the machine instructions executed would fit within the bandwidth?
My thinking / knowledge so far:
I'm approaching this from a malware analysis angle and want to know if JTAG is at all viable as a mechanism to observe the activity of cores on the x86 CPU.
To show my line of thinking trying to solve this so far, don't laugh but here's my math:
Electrical engineering is a new realm for me to dive into, so I don't currently know what 100MHz on one bus translates to in terms of KB/s, but perhaps I can compare frequencies of something like RAM to get a rough comparison, which would be:
25,600 MB/s for 3200MHz == 8MB/s for 1Mhz, or 80MB/s for 10Mhz (Which I've seen cited as a low-end frequency for the JTAG busses to run at).
I don't know if the listed RAM frequency is per-bus (in which case I'm miles off) or total combined frequency of all busses.
If I'm not wrong so far, and we have a 3GHz/s CPU to record state changes for operating at full capacity, let's say we're writing (and hoping to monitor via JTAG) one 64-bit register value per cycle, and we have 3,000,000,000 cycles per second, so:
64 x 3M = 24MB/s required to record that.
So with my perhaps horribly naïve math, 24MB/s fits within 10Mhz (80MB/s)
But could my math really be correct? It must not, since if RAM can send 25,600 MB/s, the CPU must be able to write much more than that per second to the registers.