restore tg2521 bootloader, clone AIP-W502U,WRT160NL,E2100L

Post new topic   Reply to topic    DD-WRT Forum Index -> Qualcomm Atheros based Hardware
Author Message
fabriciogcbh
DD-WRT Novice


Joined: 15 Apr 2010
Posts: 5
Location: Brazil

PostPosted: Thu Mar 06, 2025 14:31    Post subject: restore tg2521 bootloader, clone AIP-W502U,WRT160NL,E2100L Reply with quote
Hello everyone,

I have an old ZCOM TG2521 router. A few years ago I installed dd-wrt on it and it worked fine but the USB didn't work. It had been stored for a long time, as I needed a solution for a temporary project, remember this device, but I needed the USB. (It's the only one with USB available that I have).

I updated to the latest version of dd-wrt available and the USB didn't work.

So I thought I would see something parallel to solve the problem.

I found another model with the same processor, NIC, RAM and Flash memory. AIP-W502U, WRT160NL, E2100L.

I connected the serial to the device's board and downloaded as much information as I could.

One mistake I made was not trying to save the Flash before trying to change things.

I tried to download the wrt160nl version via serial, but nothing would make it work. When I restarted the device, the previous dd-wrt for tg2521 would start. I tried several times until I got tired. I entered a memory address incorrectly and ended up burning it over U-Boot (RedBoot) and ended up killing the device. Now the saga begins... After confirming the error and the device not turning on anymore, I removed the memory chip and started burning it manually. End of story: none of the bootloaders I found on the internet or compiled worked on the device. I believe I have the necessary memory addresses to try to restore the device. I compiled several versions of U-Boot and nothing. The original version was 1.0.2.0. I downloaded this version from git, but there is no reference in the code for its processor or board, AP81, AR7100. (old version doesn't have implementation of make menuconfig, and in the version that does have implementation, they removed the board, the oldest is the AP121). I don't understand much about this kernel structure to try to assemble the defconfig for the AP81 (I don't even know if it would be worth the effort for this construction). In the latest version of U-Boot I tried something generic, but without success. I couldn't get U-Boot in docker to make the process easier.

I tried to compile DD-WRT, without success, the old versions require an svn structure, toolchain and some other libs that I couldn't find or couldn't be used in my Debian 11 x64 distribution.

I tried to compile OpenWRT, also without success, but I found a docker that solved the compilation problem, but it didn't have the exact specifications for my device (openwrt doesn't actually have a compilation for the tg2521). This docker had the entire structure ready for the WRT160NL, I managed to compile it. I burned U-Boot onto the flash drive, burned the .bin file, and the device still didn't respond.

I tried to assemble the basic structure in qemu-system-mips with the files I compiled and the ones I copied from the internet, but none of them worked. I managed to get a ready-made compilation from some people, and qemu worked, at least to confirm that it was ok.

After reading a few things about it, it seems to me that I have to assemble a small U-Boot + kernel + memory addressing structure in an image using mkimage to burn this file directly onto the flash drive. There is a lack of documentation and the documentation that does exist is not clear enough for me to understand the process.

I just wanted to try to make the USB work, now I'm trying to get the device back to life, if the USB doesn't have a solution, at least to make the device functional again.

Someone with enough experience in the subject could give me the correct path, or provide me with the bootloader file so I can keep trying something, or a copy of the models listed above for a last attempt. Compatible models: TG2521, Alfa Networks AIP-W502U, Linksys WRT160NL, E2100L.

I tried chat-gpt, gemini, copilot. None of them were able to give me valid instructions to be successful.

Below is the log of the technical information I have about the device.

Code:


 
�ÿ

U-Boot 1.0.2.0 (Mar  6 2008 - 16:17:34)

AP81 (ar7100) U-boot
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
Fetching MAC Address from 0x81fee120
: cfg1 0xf cfg2 0x7114
eth0: 00:60:b3:e0:00:1d
dup 1 speed 100
eth0 up
eth0
Hit any key to stop autoboot:  4  3  2  1  0
## Booting image at bf660000 ...
   Image Name:   DD-WRT v24 Linux Kernel Image
   Created:      2010-08-12   5:29:56 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    1367818 Bytes =  1.3 MB
   Load Address: 80002000
   Entry Point:  802b1000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.24.111 (root@dd-wrt) (gcc version 4.3.3 (GCC) ) #3507 Thu Aug 12 07:23:11 CEST 2010
flash_size passed from bootloader = 8
CPU revision is: 00019374
booting platform Atheros AR9130 rev 1 (0xb4)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists in Zone order.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd  init=/sbin/init
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 128 (order: 7, 512 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29204k/32768k available (2249k kernel code, 3564k reserved, 494k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
gpio_proc: module loaded and /proc/gpio/ created
AR7100 GPIOC major 0
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
IMQ starting with 2 devices...
IMQ driver loaded successfully.
   Hooking IMQ before NAT on PREROUTING.
   Hooking IMQ after NAT on POSTROUTING.
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
AG7100: Length per segment 1536
AG7100: Max segments per packet 1
AG7100: Max tx descriptor count    100
AG7100: Max rx descriptor count    252
AG7100: fifo cfg 3 00780008
AG7100CHH: Mac address for unit 0
AG7100CHH: 00:1d:00:03:7f:0c
AG7100CHH: Mac address for unit 1
AG7100CHH: a2:04:ff:ff:ff:ff
guessed flashsize = 8M
scanning for root partition
ZCom quirk found
ZCom quirk kernel offset 6684672
bootloader size = 50000

found squashfs at 50000
Creating 8 MTD partitions on "ar7100-nor0":
0x00000000-0x00050000 : "RedBoot"
0x00050000-0x007d0000 : "linux"
0x00050000-0x00590000 : "rootfs"
0x00590000-0x007d0000 : "ddwrt"
0x007e0000-0x007f0000 : "nvram"
0x007f0000-0x00800000 : "FIS directory"
0x007f0000-0x00800000 : "board_config"
0x00000000-0x00800000 : "fullflash"
usbmon: debugfs is not available
ar71xx-ehci ar71xx-ehci.0: Atheros AR91xx built-in EHCI controller
ar71xx-ehci ar71xx-ehci.0: new USB bus registered, assigned bus number 1
ar71xx-ehci ar71xx-ehci.0: irq 3, io mem 0x1b000000
ar71xx-ehci ar71xx-ehci.0: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0)
GACT probability on
Mirror/redirect action on
Simple TC action Loaded
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length    128 bytes
PF_RING: ring slots       4096
PF_RING: sample rate      1 [1=no sampling]
PF_RING: capture TX       No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
decode 1f02
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 124k freed
start service
starting Architecture code for ap83
load ATH Ethernet Driver
configure eth0 to 00:19:70:19:4b:69
configure eth1 to 00:19:70:19:4B:6A
ag7100_ring_alloc Allocated 1600 at 0x803c9800
ag7100_ring_alloc Allocated 4032 at 0x810d4000
AG7100: cfg1 0x2f cfg2 0x7014
AG7100: unit 0 phy is up...RMii 100Mbps full duplex
AG7100: pll reg 0x18050014: 0x13000a44  AG7100: CPU PhaseLockLoop      : 0x1050
AG7100: Secondary PhaseLockLoop: 0x1032
AG7100: Ethernet Internal Clock Control: 0x0
AG7100: mii: 0x13
AG7100: cfg1: 0x2f
AG7100: cfg2: 0x7135
AG7100: fcfg_0: 0x1d1f00
AG7100: fcfg_1: 0x7ff0000
AG7100: fcfg_2: 0xfff
AG7100: fcfg_3: 0x780008
AG7100: fcfg_4: 0xffff
AG7100: fcfg_5: 0x7efef
AG7100: done cfg2 0x7135 ifctl 0x10000 miictrl 0x13
AG7100: LAN Rx Hang Detected 1 times!
Writing 4
ag7100_ring_alloc Allocated 1600 at 0x81cd9000
ag7100_ring_alloc Allocated 4032 at 0x81c3e000
AG7100: cfg1 0x3f cfg2 0x7014
AG7100: WAN Rx Hang Detected 1 times!
Writing 6
load ATH 802.11 a/b/g Driver
load ATH 802.11n Driver
ath_mimo_hal: module license 'Proprietary' taints kernel.
ath_mimo_hal: 0.9.17.1 (AR5416, REGOPS_FUNC)
ath_ahb: 0.9.4.5 (Atheros/multi-bss)
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
wlan: 0.8.4.2 (Atheros/multi-bss)
wlan: mac acl policy registered
ath_rate_atheros: Version 2.0.1
Copyright (c) 2001-2004 Atheros Communications, Inc, All Rights Reserved
ar5416CheckEepromDef: Read Magic = 0x0060
EEPROM being read from flash @0xbfff1000
need_swap = False.
Howl Revision ID 0xb4
No MBSSID aggregation support
ar5416InitMacAddr: mac address read failed: ff:ff:ff:ff:ff:ff
dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0
1Mbps 2Mbps 5.5Mbps 11Mbps
1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
wifi0: mac 20.0 phy 10.1 radio 15.0
wifi0: Use hw queue 1 for WME_AC_BE traffic
wifi0: Use hw queue 0 for WME_AC_BK traffic
wifi0: Use hw queue 2 for WME_AC_VI traffic
wifi0: Use hw queue 3 for WME_AC_VO traffic
wifi0: Use hw queue 8 for CAB traffic
wifi0: Use hw queue 9 for beacons
wifi0: Use hw queue 7 for UAPSD
wifi0: Atheros AR9100 WiSoC: mem=0xb80c0000, irq=2
configure wifi0 to 00:19:70:19:4B:69
[USB] checking...
br0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
device br0 entered promiscuous mode
ag7100_ring_free Freeing at 0x803c9800
ag7100_ring_free Freeing at 0x810d4000
ag7100_ring_alloc Allocated 1600 at 0x81cd9800
ag7100_ring_alloc Allocated 4032 at 0x810d4000
AG7100: cfg1 0x2f cfg2 0x7135
AG7100: unit 0 phy is up...RMii 100Mbps full duplex
AG7100: pll reg 0x18050014: 0x13000a44  AG7100: CPU PhaseLockLoop      : 0x1050
AG7100: Secondary PhaseLockLoop: 0x1032
AG7100: Ethernet Internal Clock Control: 0x0
AG7100: mii: 0x13
AG7100: cfg1: 0x2f
AG7100: cfg2: 0x7135
AG7100: fcfg_0: 0x1f1f00
AG7100: fcfg_1: 0x7ff0000
AG7100: fcfg_2: 0xfff
AG7100: fcfg_3: 0x780008
AG7100: fcfg_4: 0xffff
AG7100: fcfg_5: 0x7efef
AG7100: done cfg2 0x7135 ifctl 0x10000 miictrl 0x13
Writing 4
ag7100_ring_free Freeing at 0x81cd9800
ag7100_ring_free Freeing at 0x810d4000
ag7100_ring_alloc Allocated 1600 at 0x81cce800
ag7100_ring_alloc Allocated 4032 at 0x810d4000
AG7100: cfg1 0x2f cfg2 0x7135
AG7100: WAN Rx Hang Detected 1 times!
AG7100: WAN Rx Hang Detected 2 times!
AG7100: unit 0 phy is up...RMii 100Mbps full duplex
AG7100: pll reg 0x18050014: 0x13000a44  AG7100: CPU PhaseLockLoop      : 0x1050
AG7100: Secondary PhaseLockLoop: 0x1032
AG7100: Ethernet Internal Clock Control: 0x0
AG7100: mii: 0x13
AG7100: cfg1: 0x2f
AG7100: cfg2: 0x7135
AG7100: fcfg_0: 0x1f1f00
AG7100: fcfg_1: 0x7ff0000
AG7100: fcfg_2: 0xfff
AG7100: fcfg_3: 0x780008
AG7100: fcfg_4: 0xffff
AG7100: fcfg_5: 0x7efef
AG7100: done cfg2 0x7135 ifctl 0x10000 miictrl 0x13
Writing 4
ag7100_ring_free Freeing at 0x81cd9000
ag7100_ring_free Freeing at 0x81c3e000
ag7100_ring_alloc Allocated 1600 at 0x81d6c000
ag7100_ring_alloc Allocated 4032 at 0x81c3e000
AG7100: cfg1 0x3f cfg2 0x7014
AG7100: WAN Rx Hang Detected 1 times!
Writing 6
device eth0 entered promiscuous mode
sh: ead: not found
sh: can't create /proc/sys/dev/wifi0/pollingmode: nonexistent directory
sh: can't create /proc/sys/dev/wifi0/maxvaps: nonexistent directory

 ath_numswbaperbc = 8(1)adj=76800   
ath0
Invalid command : wdssep
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: port 1(eth0) entering learning state
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
device br0 entered promiscuous mode
Ethernet Channel Bonding Driver: v3.1.3 (June 13, 2007)
bonding: MII link monitoring set to 100 ms
ic->ic_cwm.cw_width :0, ic->ic_cwm.cw_extoffset: 1
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
Key is a RSA key
Wrote key to '/tmp/root/.ssh/ssh_host_rsa_key'
Key is a DSS key
Wrote key to '/tmp/root/.ssh/ssh_host_dss_key'
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
etherip: Ethernet over IPv4 tunneling driver
The Milkfish Router Services
ERROR: Necessary service setting not found: milkfish_username - aborting.
The Milkfish Router Services
Restoring SIP ddsubscriber database from NVRAM...
Empty.
The Milkfish Router Services
Restoring SIP ddaliases database from NVRAM...
Empty.
connect: Network is unreachable
connect: Network is unreachable
connect: Network is unreachable
gethostbyname: Network is unreachable

ar7100> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(reserved)
bootcmd=bootm 0xbf660000
bootdelay=4
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
erase_uboot=erase bf000000 bf03ffff
erase_uboot_env=erase 0xbf040000 0xbf04ffff
erase_cfg=erase 0xbf7d0000 0xbf7dffff
erase_mfg=erase 0xbf7e0000 0xbf7effff
erase_uimg=erase 0xbf660000 0xbf7cffff
erase_rimg=erase 0xbf050000 0xbf65ffff
mfg=tftp 0x82100000 config.bin;run erase_mfg;cp.b 0x82100000 0xbf7e0000 0x10000
rimage=tftp 0x82100000 ap81fus-jffs2;run erase_rimg;cp.b 0x82100000 0xbf050000 $filesize
uimage=tftp 0x82100000 vmlinux.gz.uImage;run erase_uimg;cp.b 0x82100000 0xbf660000 $filesize
upgrade_uboot=tftp 82100000 u-boot.bin;protect off bf000000 bf03ffff;run erase_uboot;cp.b 82100000 bf000000 3ffff;protect on bf000000 bf03ffff;run erase_uboot_env
ethact=eth0
stdin=serial
stdout=serial
stderr=serial
mtdids=nor0=ar7100-nor0
filesize=75e01c
fileaddr=0
ipaddr=192.168.0.35
serverip=192.168.0.36

Environment size: 1086/65532 bytes
ar7100>


ar7100> bdinfo
boot_params = 0x81F77FB0
memstart    = 0x80000000
memsize     = 0x02000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x0002DE00
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     = 192.168.0.35
baudrate    = 115200 bps


ar7100> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(reserved)
bootcmd=bootm 0xbf660000
bootdelay=4
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
erase_uboot=erase bf000000 bf03ffff
erase_uboot_env=erase 0xbf040000 0xbf04ffff
erase_cfg=erase 0xbf7d0000 0xbf7dffff
erase_mfg=erase 0xbf7e0000 0xbf7effff
erase_uimg=erase 0xbf660000 0xbf7cffff
erase_rimg=erase 0xbf050000 0xbf65ffff
mfg=tftp 0x82100000 config.bin;run erase_mfg;cp.b 0x82100000 0xbf7e0000 0x10000
rimage=tftp 0x82100000 ap81fus-jffs2;run erase_rimg;cp.b 0x82100000 0xbf050000 $filesize
uimage=tftp 0x82100000 vmlinux.gz.uImage;run erase_uimg;cp.b 0x82100000 0xbf660000 $filesize
upgrade_uboot=tftp 82100000 u-boot.bin;protect off bf000000 bf03ffff;run erase_uboot;cp.b 82100000 bf000000 3ffff;protect on bf000000 bf03ffff;run erase_uboot_env
ethact=eth0
stdin=serial
stdout=serial
stderr=serial
mtdids=nor0=ar7100-nor0
filesize=75e01c
fileaddr=0
ipaddr=192.168.0.35
serverip=192.168.0.36


Sponsor
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Qualcomm Atheros based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum