steve-m.de wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== JTAG and the Texas Instruments ACX100/ACX111 Wireless LAN chip ======

The TI ACX100/ACX111 is an already somewhat outdated 802.11 wireless LAN chipset, which is based on an ARM7TDMI core.
There is an [[http://acx100.sourceforge.net/|open source project]] which develops a Linux kernel driver.

^ Chip     ^ ACX100        ^ ACX111      ^
| TI name  | [[http://focus.ti.com/general/docs/bcg/bcgprodcontent.tsp?templateId=6116&navigationId=12147&path=templatedata/cm/product/data/acx100|TNETW1100]]| [[http://focus.ti.com/general/docs/bcg/bcgprodcontent.tsp?templateId=6116&navigationId=12246&contentId=4039|TNETW1130]]|
| standard | IEEE802.11b+  | IEE802.11g+ |
| speed    | 22Mbps        | 54Mbps      |

For a full list of devices see [[http://acx100.sourceforge.net/matrix.html|here]].

====== ACX100 JTAG Port ======

When taking apart a Level1 WBR-2401B router, I noticed that the used ACX100 CardBus-card has a 6-pin header.

{{:acx100_jtag.jpg?800|ACX100 card with JTAG header}}

As it turned out by try and error, it is connected to the JTAG pins of the ACX100 chip. Once it was clear that the first 2 pins are GND and VDD (+3.3V), I tried all combinations of the JTAG signals.

^ Pin   ^ 1   ^ 2   ^ 3   ^ 4   ^ 5   ^ 6   ^
|signal | GND | VDD | TCK | TDI | TDO | TMS |

==== OpenOCD ====

I used [[http://openocd.berlios.de/web/|OpenOCD]] to connect to the [[http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0210c/Chdeaegh.html|EmbeddedICE]] unit of the ARM7TDMI core.
Since the ACX1xx contains a pretty standard TI TMS470 ARM7 core, it uses the TMS470 IDCODE:

<code>
Info : clock speed 6000 kHz
Info : JTAG tap: acx1xx.cpu tap/device found: 0x3100e02f (mfg: 0x017, part: 0x100e, ver: 0x3)
Info : Embedded ICE version 1
Info : acx1xx.cpu: hardware has 2 breakpoint/watchpoint units
</code>

This is the used configuration file for OpenOCD (using the [[http://wiki.openmoko.org/wiki/Debug_Board_v3|OpenMoko Debug Board]]) as JTAG interface:

<file - acx1xx.cfg>
interface ft2232
ft2232_device_desc "Debug Board for Neo1973 A"
ft2232_layout "jtagkey"
ft2232_vid_pid 0x1457 0x5118

reset_config trst_and_srst
jtag_khz 6000

jtag newtap acx1xx cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3100e02f
target create acx1xx.cpu arm7tdmi -chain-position acx1xx.cpu -endian little -variant arm7tdmi
</file>