Matt Callow wrote:
But TMS and TCK are not at the edge of the BGA, so the same method can't be used to find them. It would seem sensible to assume that they appear as more of the 8 pads labeled R40, but I've found that 3 appear to be connected to Vss, 1 to Vdd and the other 2 are connected together!
Ah, but notice that R40 isn't an 8-pin connector, it's an unpopulated 8-pin, 4-way resistor pack. I guess it's there to provide the necessary pull-ups and pull-downs on the JTAG pins, hence the reason that the pads on the left hand side are connected to the power rails.
I'd hazard a guess that the JTAG "TAP" port, if it exists, is somewhere else on the board. A viable approach to finding it might be to look for candidate connectors/pads and check for continuity with the TDI and TDO pins on R40 you already know. Chances are, if you find such a "connector", it'll have the remaining JTAG pins on it too and it might then just be a case of trial and error with suitable JTAG hardware...