Have finally done the pinout of most (the bigger ones) of the testpoints available to us from the syscon on my CECHH02 (DIA-001). There appears to be serial and JTAG available for me to play with. Also of interesting note are the DIAG_MODE and BACKUP_MODE pins.
SYSCON Pinouts | defyboy's ramblings
These pinouts were done on a dead DIA-001 board, Does anyone have access to one and the required hardware to interface serial/jtag?