[E3-hacking] JTAG/Anyone got a broken E3?

[Matt Callow]

I've been trying to find the JTAG pins on the E3 again (with limited 
success).  I'm pretty sure I've found TDI and TDO and I can probably 
find nTRST (if it's connected) but finding TCK and TMS is proving more 
difficult.

TDI and TDO appear as 2 of the 8 pads labeled R40 (see 
http://mcallow.pwp.blueyonder.co.uk/e3/img_1986.jpg).
I found these by using a multimeter to test connectivity between the 
board pads and the CPU  pins. This is possible with TDI, TDO and 
possibly nTRST because they appear at the edge of the CPU BGA (i.e. U17, 
U16 and U15) and I was able to poke a very thin piece of wire between 
the CPU and the board to make contact to those pins, one at a time.

But TMS and TCK are not at the edge of the BGA, so the same method can't 
be used to find them. It would seem sensible to assume that they appear 
as more of the 8 pads labeled R40, but I've found that 3 appear to be 
connected to Vss, 1 to Vdd and the other 2 are connected together!

So, I've been looking on the web at how other people find JTAG pins and 
it seems that one way is to remove the CPU with a heat gun and then 
trace the PCB that way (at least that's the way it was found for the 
NSLU2). So, this brings me to the topic of my post: Does anyone have a 
broken E3 that they could remove the CPU from and trace the board?
I know it seems like a brutal approach, but It's probably the most 
reliable unless anyone else has any better ideas?

Matt