User Tools

Site Tools


JTAG and the Texas Instruments ACX100/ACX111 Wireless LAN chip

The TI ACX100/ACX111 is an already somewhat outdated 802.11 wireless LAN chipset, which is based on an ARM7TDMI core. There is an open source project which develops a Linux kernel driver.

Chip ACX100 ACX111
TI name TNETW1100 TNETW1130
standard IEEE802.11b+ IEE802.11g+
speed 22Mbps 54Mbps

For a full list of devices see here.

ACX100 JTAG Port

When taking apart a Level1 WBR-2401B router, I noticed that the used ACX100 CardBus-card has a 6-pin header.

ACX100 card with JTAG header

As it turned out by try and error, it is connected to the JTAG pins of the ACX100 chip. Once it was clear that the first 2 pins are GND and VDD (+3.3V), I tried all combinations of the JTAG signals.

Pin 1 2 3 4 5 6


I used OpenOCD to connect to the EmbeddedICE unit of the ARM7TDMI core. Since the ACX1xx contains a pretty standard TI TMS470 ARM7 core, it uses the TMS470 IDCODE:

Info : clock speed 6000 kHz
Info : JTAG tap: acx1xx.cpu tap/device found: 0x3100e02f (mfg: 0x017, part: 0x100e, ver: 0x3)
Info : Embedded ICE version 1
Info : acx1xx.cpu: hardware has 2 breakpoint/watchpoint units

This is the used configuration file for OpenOCD (using the OpenMoko Debug Board) as JTAG interface:

interface ft2232
ft2232_device_desc "Debug Board for Neo1973 A"
ft2232_layout "jtagkey"
ft2232_vid_pid 0x1457 0x5118

reset_config trst_and_srst
jtag_khz 6000

jtag newtap acx1xx cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3100e02f
target create acx1xx.cpu arm7tdmi -chain-position acx1xx.cpu -endian little -variant arm7tdmi
tiacx1xx.txt · Last modified: 2011/01/09 03:21 (external edit)