5
\$\begingroup\$

Here is a core i7 cpu

i7

It has some contact pads on the top side, some grouped in 4 or 6 and two big groups. Is there a pinout of these pads? Where are the JTAG connection pins?

\$\endgroup\$
  • 7
    \$\begingroup\$ That's a pretty hardcore part! [Was that a pun? If so, it was intended.] \$\endgroup\$ – tyblu Jan 2 '11 at 12:24
11
\$\begingroup\$

Your question can be easily answered with a continuity tester (which most voltmeters have). The below pinout is for an i3-540 (LGA1156). I connected one voltmeter probe to the jtag pad on the underside of the processor. Then I swept the other voltmeter probe across the top side of the processor until the voltmeter registered a continuity.

TOP SIDE OF PROCESSOR:

| 1 |    2 |   3 |   4 |   5 |   6 |    7 |   8 |   9 |  10 |     11 |  12 | 13 |
|   |AL31* |BPM4 |BPM1 |BPM0 |     |AL31* |TDO  |TRST |PRDY |TAPPWRGD|AL31 |    |
|   |      |BPM6 |BPM7 |AL31 |     |TCK   |TDI  |PREQ |     |        |     |    |
|   |      |BPM5 |BPM3 |BPM2 |TMS  |      |     |     |     |        |     |    |

*Connected to BLCK_ITP# (useless since shorted) AL31 refers to Vss

CPU IS UPSIDE DOWN (ie Intel Made in Malaysia and S/n Upside down)

I will be interested if you could find the pinout for the i7 or perhaps we could reverse engineer the Intel JTAG protocol.

\$\endgroup\$
13
\$\begingroup\$

TAP is on the bottom side. AH10 TCK, AJ9 TDI, AJ10 TDO, AG10 TMS, AH9 TRST#

TCK I TCK (Test Clock) provides the clock input for the processor Test Bus (also known
as the Test Access Port).

TDI I TDI (Test Data In) transfers serial test data into the processor. TDI provides the
serial input needed for JTAG specification support.

TDO O TDO (Test Data Out) transfers serial test data out of the processor. TDO
provides the serial output needed for JTAG specification support.

TESTLOW I TESTLOW must be connected to ground through a resistor for proper processor
operation.

TMS I TMS (Test Mode Select) is a JTAG specification support signal used by debug
tools.

TRST# I TRST# (Test Reset) resets the Test Access Port (TAP) logic. TRST# must be
driven low during power on Reset.

UPDATE: here are some adapters for i7: http://www.asset-intertech.com/products_interposers.htm

Intel® Core™ i7 processors and the Intel® Xeon® processor 5500 series use LGA1366 sockets, similar in design to the LGA775/771 sockets. However, the high speeds of these processors mean that the use of an interposer between the socket and the CPU could interfere with signal integrity. Intel has therefore provided pads on the top side of the CPU, which mirror the required signals. To access these top-side pads, ASSET has developed a top-side probe.

The LGA1366 top-side probe consists of a PCB with a ring connector attached below it that contains small, spring-loaded probe tips. These tips make contact with the CPU's top-side pads, allowing the debug port signals to be broken out onto a flexible cable, which terminates in a small PCB carrying a Intel®-specified XDP header. The standard socket load mechanism is used above the probe's PCB to depress the CPU into its socket. The heatsink and fan are mounted onto a heatsink location plate supplied with the probe.

\$\endgroup\$
  • \$\begingroup\$ according to 320834.pdf, pointed by Thomas O, thanks! \$\endgroup\$ – osgx Jan 2 '11 at 19:00
  • \$\begingroup\$ and here are some adapters for using JTAG on some older intel chips. arium.com/products/9/JTAG-Adapters-and-Interposers.html \$\endgroup\$ – osgx Jan 3 '11 at 15:41
  • \$\begingroup\$ i7 pass-thru adapter for using a jtag here asset-intertech.com/products_interposers.htm \$\endgroup\$ – osgx Mar 22 '11 at 22:34
  • 1
    \$\begingroup\$ if this is an answer that actually helps you, why would you accept an answer that did not answer your question? \$\endgroup\$ – Kortuk May 9 '11 at 6:48
7
\$\begingroup\$

Why do you want to do this? Do you know you need to provide this chip with about 1.1V @ 10 amps (up to 145 amps at full load) for it to even work, and that all signals have to be at this same level?

Likely, the pins are not documented. Here is the datasheet. The pins don't seem to be documented in that datasheet, and it's likely they are for factory specific testing (i.e. testing maximum operating frequency so they can bin chips into the various speed grades.)

\$\endgroup\$
  • 4
    \$\begingroup\$ Modern processors can eat 145A? Wow. \$\endgroup\$ – Robert Atkins Jan 2 '11 at 15:45
  • 6
    \$\begingroup\$ Holy crap, I wouldn't have believed that myself, but there it is on page 23 of the linked datasheet (I_cc). \$\endgroup\$ – vicatcu Jan 2 '11 at 17:07
  • \$\begingroup\$ I think that this pins are very visible, so some hardware hacker could try to reverse engineer this pins, or just do some measurement of them. \$\endgroup\$ – osgx Jan 6 '11 at 0:08
  • \$\begingroup\$ @vicatcu Pretty mindblowing. That's why the components around the CPU VRM don't mess around. Also, don't forget the other components, like the PLL, and QPI. \$\endgroup\$ – Thomas O Jan 6 '11 at 0:14
  • 5
    \$\begingroup\$ Intel used to make a test jig called a "slammer" that fit in a CPU socket and operated as a programmable load to verify power supply performance in worst-case scenarios. Specifically because it's so hard to meet those specs. 1mOhm at 145A is more than 10% voltage offset at 1.1V and would dissipate 20 watts! \$\endgroup\$ – Ben Jackson Mar 22 '11 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.