The TI ACX100/ACX111 is an already somewhat outdated 802.11 wireless LAN chipset, which is based on an ARM7TDMI core. There is an open source project which develops a Linux kernel driver.

For a full list of devices see here.

When taking apart a Level1 WBR-2401B router, I noticed that the used ACX100 CardBus-card has a 6-pin header.

As it turned out by try and error, it is connected to the JTAG pins of the ACX100 chip. Once it was clear that the first 2 pins are GND and VDD (+3.3V), I tried all combinations of the JTAG signals.

I used OpenOCD to connect to the EmbeddedICE unit of the ARM7TDMI core. Since the ACX1xx contains a pretty standard TI TMS470 ARM7 core, it uses the TMS470 IDCODE:

Info : clock speed 6000 kHz
Info : JTAG tap: acx1xx.cpu tap/device found: 0x3100e02f (mfg: 0x017, part: 0x100e, ver: 0x3)
Info : Embedded ICE version 1
Info : acx1xx.cpu: hardware has 2 breakpoint/watchpoint units

This is the used configuration file for OpenOCD (using the OpenMoko Debug Board) as JTAG interface:

acx1xx.cfg

interface ft2232
ft2232_device_desc "Debug Board for Neo1973 A"
ft2232_layout "jtagkey"
ft2232_vid_pid 0x1457 0x5118

reset_config trst_and_srst
jtag_khz 6000

jtag newtap acx1xx cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3100e02f
target create acx1xx.cpu arm7tdmi -chain-position acx1xx.cpu -endian little -variant arm7tdmi