I've been trying to find the JTAG pins on the E3 again (with limited success). I'm pretty sure I've found TDI and TDO and I can probably find nTRST (if it's connected) but finding TCK and TMS is proving more difficult.
TDI and TDO appear as 2 of the 8 pads labeled R40 (see http://mcallow.pwp.blueyonder.co.uk/e3/img_1986.jpg). I found these by using a multimeter to test connectivity between the board pads and the CPU pins. This is possible with TDI, TDO and possibly nTRST because they appear at the edge of the CPU BGA (i.e. U17, U16 and U15) and I was able to poke a very thin piece of wire between the CPU and the board to make contact to those pins, one at a time.
But TMS and TCK are not at the edge of the BGA, so the same method can't be used to find them. It would seem sensible to assume that they appear as more of the 8 pads labeled R40, but I've found that 3 appear to be connected to Vss, 1 to Vdd and the other 2 are connected together!
So, I've been looking on the web at how other people find JTAG pins and it seems that one way is to remove the CPU with a heat gun and then trace the PCB that way (at least that's the way it was found for the NSLU2). So, this brings me to the topic of my post: Does anyone have a broken E3 that they could remove the CPU from and trace the board? I know it seems like a brutal approach, but It's probably the most reliable unless anyone else has any better ideas?
Matt