target being used as an example for the EmbeddedAnalysisWorkshop2011.
This box is supported at least partially by OpenWRT. This might make it easy to "cheat" on this target but regardless it still makes for a nice illustration as the TI DSP is not documented, supports JTAG as well as the FPGA and the FLASH is a TSOP chip that we can desocket for dumping.
- TI AR7 family TNETD7200ZDW DSP MIPS32 TI info (de) - supposedly no datasheet. However, the OpenWRT group has good documentation and appear to have somehow confirmed EJTAG though I have not seen a footprint. They suggest that it is similar to some OMAP DSP's so perhaps a footprint was gandered from these. Usefull:  
- Xilinx Spartan3 XC32400 144pin full datasheet
- NOR FLASH Macronix MX 29LV640MTTC-90G 2.7-3.6v (datasheet). Can be parallel dumped.
- 4 pin unpopulated throughole header next to TI.
- 28 pin unpopulated pads on bottom of board.
- 5 pads on bottom edge near power and antenna.
Interesting markings and observations
- 4 pads with solder on bottom of board. At least one of those is connected to Xilinx JTAG. The other 3 pads with solder show up near the TI CPU. Show in the images is the Xilinx JTAG trace with both top and bottom layers overlaid, Just the trace with the bottom layer so that the pad with solder is clearer, the 3 other pads with solder found in the bottom of the PCB near the TI CPU.
For a more verbose overview see 
- Examine layout to determine if Xilinx provides usefull debug or dump access of flash (since JTAG access would come quick). Judging from exposed traces alone it potentially does connect to the FLASH.
- If Xilinx and TI JTAG are chained it might not be hard to map.
- TI supports RS232, worth mapping/finding
- TSOP Flash can be dumped
- Might be worthwhile documenting electrical characteristics of DSP to rebuild footprint map
- Other areas?