Table of Contents
JTAG and the Texas Instruments ACX100/ACX111 Wireless LAN chip
The TI ACX100/ACX111 is an already somewhat outdated 802.11 wireless LAN chipset, which is based on an ARM7TDMI core. There is an open source project which develops a Linux kernel driver.
| Chip | ACX100 | ACX111 |
|---|---|---|
| TI name | TNETW1100 | TNETW1130 |
| standard | IEEE802.11b+ | IEE802.11g+ |
| speed | 22Mbps | 54Mbps |
For a full list of devices see here.
ACX100 JTAG Port
When taking apart a Level1 WBR-2401B router, I noticed that the used ACX100 CardBus-card has a 6-pin header.
As it turned out by try and error, it is connected to the JTAG pins of the ACX100 chip. Once it was clear that the first 2 pins are GND and VDD (+3.3V), I tried all combinations of the JTAG signals.
| Pin | 1 | 2 | 3 | 4 | 5 | 6 |
|---|---|---|---|---|---|---|
| signal | GND | VDD | TCK | TDI | TDO | TMS |
OpenOCD
I used OpenOCD to connect to the EmbeddedICE unit of the ARM7TDMI core. Since the ACX1xx contains a pretty standard TI TMS470 ARM7 core, it uses the TMS470 IDCODE:
Info : clock speed 6000 kHz Info : JTAG tap: acx1xx.cpu tap/device found: 0x3100e02f (mfg: 0x017, part: 0x100e, ver: 0x3) Info : Embedded ICE version 1 Info : acx1xx.cpu: hardware has 2 breakpoint/watchpoint units
This is the used configuration file for OpenOCD (using the OpenMoko Debug Board) as JTAG interface:
- acx1xx.cfg
interface ft2232 ft2232_device_desc "Debug Board for Neo1973 A" ft2232_layout "jtagkey" ft2232_vid_pid 0x1457 0x5118 reset_config trst_and_srst jtag_khz 6000 jtag newtap acx1xx cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3100e02f target create acx1xx.cpu arm7tdmi -chain-position acx1xx.cpu -endian little -variant arm7tdmi
