JTAG, or Joint Test Action Group, is a standard for debugging. Many modern motherboards, both on mobile devices and on desktops and workstations have JTAG ports. They allow a CPU to be controlled like a puppet, primarily for debugging. I have heard conflicting information about the use of JTAG. On the one hand, I've heard that the JTAG ports have to be inserted, then the CPU reset for it to work. Is this true, or can JTAG be used while the system is powered on and running? If it can be used while the system is running, what mitigations are there to prevent it from being used as an attack vector to hijack a running system? I am specifically curious about the use of JTAG on modern server motherboards sporting Intel CPUs, not so much on mobile phones. I do know that you have to sign an NDA to access to tools required to use their JTAG port, but hopefully this question is not covered by such restrictions.
In other words, does JTAG support hotplugging to control a CPU like PCIe, or is it more like PCI where you have to plug it in and reboot the system with it inserted for debugging (and attacks) to work?