coreboot has multiple stages that run one after the other. If you don't have UART output you can't be sure how far coreboot gets before it hangs, so you'll want to check all of them and see which ones contain the addresses you get from your JTAG. Disassemble /build/cbfs/fallback/bootblock.debug, romstage.debug and ramstage.debug to see which one applies. (These binaries get stripped and packed into coreboot.rom by the build process, but it's easier to just disassemble them from the /build directory than to try to pry them out of a finished image again.)