Look what I found lurking in the datasheet (design guide)...

26.4.4.3 Data-Specific Registers
Data-specific registers are used for software debugging and to initialize  
the processor instruction
cache. For more information, refer to these subsections in Chapter 26,  
?Software Debug,? of the
Intel® PXA27x Processor Family Developer?s Manual:
? Section 26.5.2, ?Debug Control and Status Register (DCSR)?
? Section 26.4.6.1.1, ?SEL_DCSR JTAG Command and Register?
? Section 26.4.6.3.1 ?LDIC JTAG Data Register?
? Section 26.4.6.1.2, ?DBG_TX JTAG Command and Register?
? Section 26.4.6.1.4, ?DBG_RX Data Register?
26.4.4.4 Flash Data Register
The flash data register is a subset of the boundary-scan register. This  
subset of cells pertinent to
flash programming facilitates shorter programming times using JTAG. The  
output signals and pins
required for external flash programming are ordered from TDI to TDO as:

TDO ? MA<25:0> ? MD<31:0>
nSDCAS ? nWE
nOE ? nCS0
SDCLK0 ? DQM<3:0>
RDnWR ? MA<25:0>_nSDCAS_RDnWR_
DQM<1:0>_output_enable
DQM<3:2>_output_enable ? MD<15:0>_output_enable
MD<31:16>_output_enable ? nWE_output_enable
nOE_nCS0_output_enable ? SDCLK0_output_enable ? TDI

Which makes it look like jflash can run an order of magnitude or two  
faster, and possibly deserves a much-needed rewrite.
How's progress, chaps?

Steve