More on JTAG:
http://en.wikipedia.org/wiki/JTAG
More on Philips USB chip said to be in iLiad:
http://jp.semiconductors.philips.com...ISP1362-04.pdf
The Philips USB chip has the three test pins... but the above PDF doesn't document how to open up any support the chip might have for USB debug access. iRex may have a hacked Travel Hub that allows yanking a pin to enable/disable JTAG access. This kind of hack allows for easier diagnostics of returned defective units, which is why this kind of support gets my money as it allows all units to be JTAG'd for repair, not just "development" units.