The TI ACX100/ACX111 is an already somewhat outdated 802.11 wireless LAN chipset, which is based on an ARM7TDMI core. There is an open source project which develops a Linux kernel driver.
For a full list of devices see here.
When taking apart a Level1 WBR-2401B router, I noticed that the used ACX100 CardBus-card has a 6-pin header.
As it turned out by try and error, it is connected to the JTAG pins of the ACX100 chip. Once it was clear that the first 2 pins are GND and VDD (+3.3V), I tried all combinations of the JTAG signals.
Info : clock speed 6000 kHz Info : JTAG tap: acx1xx.cpu tap/device found: 0x3100e02f (mfg: 0x017, part: 0x100e, ver: 0x3) Info : Embedded ICE version 1 Info : acx1xx.cpu: hardware has 2 breakpoint/watchpoint units
This is the used configuration file for OpenOCD (using the OpenMoko Debug Board) as JTAG interface:
interface ft2232 ft2232_device_desc "Debug Board for Neo1973 A" ft2232_layout "jtagkey" ft2232_vid_pid 0x1457 0x5118 reset_config trst_and_srst jtag_khz 6000 jtag newtap acx1xx cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3100e02f target create acx1xx.cpu arm7tdmi -chain-position acx1xx.cpu -endian little -variant arm7tdmi