Linksys AG241
The Linksys AG241 is an ADSL gateway without wireless acccess point.
Supported Versions
| Version/Model | Launch Date | S/N | OpenWrt Version Supported | Model Specific Notes |
|---|---|---|---|---|
| AG241 v1 |  | - | Supported | - |
| AG241 v2 | | - | Kamikaze 8.09.2 | - |
| Backfire 10.03.1 | LAN switch is not correctly recognized | |||
| Attitude Adjustment 12.09 | LAN switch is not correctly recognized | |||
| AG241 v2b | | - | Supported | - |
NOTE: Actually on Backfire 10.03.1, Attitude Adjustment 12.09 and trunk (r39422) the default network configuration won't work. forum topic
OEM source code available at: http://support.linksys.com/en-eu/gplcodecenter Note: The page goes to a 404.
Hardware Highlights
| SoC | Ram | Flash | Network | USB | Serial | JTag |
|---|---|---|---|---|---|---|
| Texas Instruments TNETD7200ZDW@ 211.97 MHz | 16MiB | 4MiB | 4 x 1 | No | Yes | |
Manufacturer's site: http://support.linksys.com/en-eu/support/gateways/AG241
Installation
- → downloads AG241v1 for AG241 v1, AG241v2 for v2 and AG241v2b for AG241 v2 Annex B
NOTE: When flashing the AG241 v1 (For the AU version at least) you need to change the header in the OpenWrt firmware, with a Hex Editor, to be AG2A NOT AG3A.
Flash Layout
Please check out the article flash.layout. It contains an example and a couple of explanations.
| partition | start | end | Name |
|---|---|---|---|
| mtd0 | 0x900e0000 | 0x903d0000 | mtd0 |
| mtd1 | 0x90020000 | 0x903d0000 | mtd1 |
| mtd2 | 0x90000000 | 0x90020000 | mtd2 |
| mtd3 | 0x903f0000 | 0x90400000 | mtd3 |
| mtd4 | 0x903d0000 | 0x903f0000 | mtd4 |
OEM installation using the TFTP method
Specific values you need
| Bootloader tftp server IPv4 address | 192.168.1.1 |
| Firmware tftp image | Latest OpenWrt release named upgrade_code.bin |
| TFTP Transfer Window | 1 seconds |
| TFTP Window Start | approximately 2 seconds after power on; just after LAN leds lights up all together |
Basic configuration
→ Basic configuration After flashing, proceed with this.
Failsafe mode
Press f and hit Enter when asked during boot. (you will need a Serial console to see it)
Hardware
Info
AG241 v2
| Instruction set | MIPS |
|---|---|
| Vendor | Texas Instruments |
| bootloader | pspboot |
| System-On-Chip | TNETD7200ZDW |
| CPU @Frq | MIPS 4KEc V4.8 @ 211.97 MHz |
| Flash size | 4 MB |
| Flash Chip | mx29lv320ct-b-1.0.pdf |
| RAM size | 16 MB |
| RAM Chip | MIRA P2V28S40BTP |
| switch | Infineon ADM6996LC |
| Modem | xDSL |
| USB | No |
| Serial | Yes |
| JTAG | |
Photos
AG241 v2
Front:
Back:
Opening the case
Note: This will void your warranty!
- Remove two screws under the front rubber feet
- Press the two sides of the router and pull the blue part to release the plastic hooks
Main PCB
Serial
→ port.serial general information about the serial port, serial port cable, etc.
Serial console can be plugged to JP4: connector lacks, it has to be soldered on the board.
Since your router is working at 3.3V (TTL level voltage), you'll need USB to RS232 TTL converter or a level shifter such as a Maxim MAX232 to change the level from 3.3V to your computer level which is usually at 12V.
You cannot plug directly those pins to your pc serial port (or serial adapter): you will certainly fry the serial circuit or even the whole board 
How to connect to the Serial Port of this specific device:
| Pin | Signal |
|---|---|
| 1 | GND |
| 2 | n/a |
| 3 | RxD |
| 4 | TxD |
| 5 | VCC |
The settings for terminal are: 38400 bauds, 8 bits, no parity, 1 stop bit (38400 8N1)
| terminal configuration | |
|---|---|
| Bits per second | 38400 |
| Data bits | 8 |
| Parity | None |
| Stop bits | 1 |
| Flow control | None |
Debricking
You can debrick your device using a TFTP client to upload the firmware image to the router during the booting process (also without a serial console!! → see below)
You will need:
The method is based on pausing the booting process and send the firmware .bin image to the router through tftp: it will receive it, install and reboot.
- Setup your ethernet network adapter with a static/fixed IP address (the router will respond on 192.168.1.1)
- Connect your PC to one of the router's LAN ports
- Start your terminal emulation program and configure it as described in section Serial
- Turn on the router
- When you see the line
Press ESC for monitor...
press ESC key: this will stop the booting process and enter debug mode
- Start your tftp client and connect to the router
- Send the firmware image in binary mode (octet) and named as upgrade_code.bin
This little how to is based on this guide written by Marco Vedovati and released under Creative Commons Attribution-NonCommercial-ShareAlike 2.5
Bootlogs
OEM bootlog
free space start: 0xb0010000 free space end: 0xb0400000 Basic POST completed... Success. Last reset cause: Software reset (memory controller also reset) PSPBoot1.3 rev: 0.22.19.5 CyberTAN rev: 0.22.19 (c) Copyright 2002-2005 Texas Instruments, Inc. All Rights Reserved. FlashType: mac_init(): Find mac [00:18:F8:61:8E:44] in location 0 Find mac [00:18:F8:61:8E:44] in location 0 mac_value: 00:18:F8:61:8E:44 Press ESC for monitor... 321 (psbl) Booting... Launching kernel decompressor. Starting LZMA Uncompression Algorithm. Copyright (C) 2003 Texas Instruments Incorporated; Copyright (C) 1999-2003 Igor Pavlov. Compressed file is LZMA format. Kernel decompressor was successful ... launching kernel. LINUX started... Config serial console: ttyS0,38400 Auto Detection OHIO chip This SOC has MDIX cababilities on chip. WLAN 1350 chip configured. CONFIG_AVALANCHE_VLYNQ_POLARITY_LOW Failed to initialize the vlynq @ 0xa8611800. The error msg: Error in configuring clocks.. CPU revision is: 00018448 Primary instruction cache 16kb, linesize 16 bytes (4 ways) Primary data cache 8kb, linesize 16 bytes (4 ways) Number of TLB entries 16. Linux version 2.4.17_mvl21-malta-mips_fp_le (root@localhost.localdomain) (gcc version 2.95.3 20010315 (release/MontaVista)) #31 Thu Jul 12 20:29:16 CST 2007 Determined physical RAM map: memory: 14000000 @ 00000000 (reserved) memory: 00020000 @ 14000000 (ROM data) memory: 00fe0000 @ 14020000 (usable) On node 0 totalpages: 4096 zone(0): 4096 pages. zone(1): 0 pages. zone(2): 0 pages. Kernel command line: calculating r4koff... 00102c00(1059840) CPU frequency 211.97 MHz Calibrating delay loop... 211.35 BogoMIPS Freeing Adam2 reserved memory [0x14001000,0x0001f000] Memory: 13880k/16384k available (1882k kernel code, 2504k reserved, 139k data, 64k init) Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes) Inode-cache hash table entries: 1024 (order: 1, 8192 bytes) Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes) Page-cache hash table entries: 4096 (order: 2, 16384 bytes) Checking for 'wait' instruction... unavailable. POSIX conformance testing by UNIFIX Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039 TI Optimizations: Allocating TI-Cached Memory Pool. Warning: Number of buffers is not configured.Setting default to 512 Using 512 Buffers for TI-Cached Memory Pool. DEBUG: Using Hybrid Mode. NSP Optimizations: Succesfully allocated TI-Cached Memory Pool. Initializing RT netlink socket Starting kswapd Disabling the Out Of Memory Killer devfs: v1.7 (20011216) Richard Gooch (rgooch@atnf.csiro.au) devfs: boot_options: 0x1 pty: 32 Unix98 ptys configured Serial driver version 5.05c (2001-07-08) with no serial options enabled ttyS00 at 0xa8610e00 (irq = 15) is a 16550A block: 64 slots per queue, batch=16 CPMAC Auto Detect Enabled: detected external PHY and external switch as well.. Error getting CPMAC Configuration params for instance:0 Environment Variable:MACCFG_A not set in bootloader Setting Default configuration params for CPMAC instance:0 Default Asymmetric MTU for eth0 1500 TI CPMAC Linux DDA version 1.8 - CPMAC DDC version 0.2 Cpmac: Installed 1 instances. Cpmac driver is allocating buffer memory at init time. PPP generic driver version 2.4.1 avalanche flash device: 0x400000 at 0x10000000. Amd/Fujitsu Extended Query Table v1.1 at 0x0040 Physically mapped flash: Swapping erase regions for broken CFI table. number of CFI chips: 1 Looking for mtd device :mtd0: Found a mtd0 image (0xe0000), with size (0x2f0000). Looking for mtd device :mtd1: Found a mtd1 image (0x20000), with size (0x3b0000). Looking for mtd device :mtd2: Found a mtd2 image (0x0), with size (0x20000). Looking for mtd device :mtd3: Found a mtd3 image (0x3f0000), with size (0x10000). Looking for mtd device :mtd4: Found a mtd4 image (0x3d0000), with size (0x20000). Creating 5 MTD partitions on "Physically mapped flash": 0x000e0000-0x003d0000 : "mtd0" 0x00020000-0x003d0000 : "mtd1" 0x00000000-0x00020000 : "mtd2" 0x003f0000-0x00400000 : "mtd3" 0x003d0000-0x003f0000 : "mtd4" NET4: Linux TCP/IP 1.0 for NET4.0 IP Protocols: ICMP, UDP, TCP, IGMP IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 1024 bind 1024) IPv4 over IPv4 tunneling driver Default Asymmetric MTU for tunl0 1480 GRE over IPv4 tunneling driver Default Asymmetric MTU for gre0 1476 Linux IP multicast router 0.06 plus PIM-SM klips_info:ipsec_init: KLIPS startup, FreeS/WAN IPSec version: super-freeswan-1.99.8 Default Asymmetric MTU for ipsec0 0 Default Asymmetric MTU for ipsec1 0 Default Asymmetric MTU for ipsec2 0 Default Asymmetric MTU for ipsec3 0 Default Asymmetric MTU for ipsec4 0 klips_info:ipsec_alg_init: KLIPS alg v=0.8.1-0 (EALG_MAX=255, AALG_MAX=15) klips_info:ipsec_alg_init: calling ipsec_alg_static_init() ipsec_1des_init(alg_type=15 alg_id=2 name=1des): ret=0 You should NOT load 1DES support except for testing purposes ! ipsec_null_init(alg_type=15 alg_id=11 name=null): ret=0 ip_conntrack version 2.0 (128 buckets, 1024 max) - 392 bytes per conntrack ip_tables: (c)2000 Netfilter core team netfilter PSD loaded - (c) astaro AG NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. NET4: Ethernet Bridge 008 for NET4.0 Initializing the WAN Bridge. Please set the MAC Address for the WAN Bridge. Set the Environment variable 'wan_br_mac'. MAC Address should be in the following format: xx.xx.xx.xx.xx.xx 802.1Q VLAN Support v1.6 Ben Greear <greearb@candelatech.com> vlan Initialization complete. VFS: Mounted root (squashfs filesystem) readonly. Mounted devfs on /dev Freeing unused kernel memory: 64k freed Firmware Version: 2.01.03 ret = -1 www -> /www mount: Invalid argument Hit enter to continue...killall: httpd: no process killed Configured 19 states now insmod tiatm Using /lib/modules/2.4.17_mvl21-malta-mips_fp_le/kernel/drivers/atm/tiatm.o name=[eth0] lan_ifname=[br0] =====> set br0 hwaddr to eth0 wlconf: No such file or directory Lan Ipaddr: 255.255.255.0 Netmask: 255.255.255.0................ 255.255.255.0 255.255.255.0 .............list .............. antsel: No such file or directory [HTTPD Starting on /www] The boot is UNKNOWN tftp server started tftpd: standalone socket HTTPD start, port 80 dhcpd:auto_search_ip=0,firstsetlanip=1 .............list .............. info, udhcp server (v0.9.8) started log_ipaddr=255 killall: leijun--upnpd-igd ver 0.83 2004-0329: no process killed Now Start syslog.........................!!zebra disabled killall: adslpolling: no process killed IDLE Hit enter to continue...wan def hwaddr 00:18:F8:61:8E:45 polling now ....... upnpd-igd:current select wan connection:0 upnp_content_num_0 = 14 killall: begin_now: no process killed
OpenWrt bootlog
Linux version 2.6.26.8 (agb@arrakis) (gcc version 4.1.2) #1 Wed Dec 2 15:14:35 UTC 2009 console [early0] enabled CPU revision is: 00018448 (MIPS 4KEc) Clocks: Async mode Clocks: Setting DSP clock Clocks: prediv: 1, postdiv: 1, mul: 5 Clocks: base = 25000000, frequency = 125000000, prediv = 1, postdiv = 2, postdiv2 = 1, mul = 10 Clocks: Setting CPU clock Adjusted requested frequency 211000000 to 211968000 Clocks: prediv: 1, postdiv: 1, mul: 6 Clocks: base = 35328000, frequency = 211968000, prediv = 1, postdiv = 1, postdiv2 = -1, mul = 6 Clocks: Setting USB clock Adjusted requested frequency 48000000 to 48076920 Clocks: prediv: 13, postdiv: 1, mul: 5 Clocks: base = 125000000, frequency = 48000000, prediv = 13, postdiv = 1, postdiv2 = -1, mul = 5 TI AR7 (TNETD7200), ID: 0x002b, Revision: 0x10 Determined physical RAM map: memory: 01000000 @ 14000000 (usable) Entering add_active_range(0, 81920, 86016) 0 entries of 256 used Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 81920 -> 86016 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 81920 -> 86016 On node 0 totalpages: 4096 Normal zone: 32 pages used for memmap Normal zone: 0 pages reserved Normal zone: 4064 pages, LIFO batch:0 Movable zone: 0 pages used for memmap Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: init=/etc/preinit rootfstype=squashfs,jffs2, console=ttyS0,38400n8 Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 8kB, 4-way, VIPT, no aliases, linesize 16 bytes PID hash table entries: 64 (order: 6, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 12560k/16384k available (2001k kernel code, 3824k reserved, 417k data, 124k init, 0k highmem) SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Calibrating delay loop... 211.35 BogoMIPS (lpj=1056768) Mount-cache hash table entries: 512 net_namespace: 644 bytes NET: Registered protocol family 16 Switched to high resolution mode on CPU 0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 squashfs: version 3.0 (2006/03/15) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 24 io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x8610e00 (irq = 15) is a TI-AR7 console handover: boot [early0] -> real [ttyS0] Fixed MDIO Bus: probed cpmac-mii: probed cpmac: device eth0 (regs: 08610000, irq: 27, phy: , mac: 00:18:f8:61:8e:44) physmap platform flash device: 00800000 at 10000000 physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank physmap-flash.0: Found an alias at 0x400000 for the chip at 0x0 Amd/Fujitsu Extended Query Table at 0x0040 physmap-flash.0: Swapping erase regions for broken CFI table. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available 4 ar7part partitions found on MTD device physmap-flash.0 Creating 4 MTD partitions on "physmap-flash.0": 0x00000000-0x00010000 : "loader" 0x00010000-0x00020000 : "config" 0x00020000-0x00400000 : "linux" 0x000f0000-0x00400000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=290000, len=170000 0x00290000-0x00400000 : "rootfs_data" ar7_wdt: disabling watchdog timer ar7_wdt: timer margin 59 seconds (prescale 65535, change 57180, freq 62500000) Registered led device: status vlynq0: regs 0x08611800, irq 29, mem 0x04000000 TCP vegas registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 124k freed Please be patient, while OpenWrt loads ... Algorithmics/MIPS FPU Emulator v1.5 mini_fo: using base directory: / mini_fo: using storage directory: /tmp/root br-lan: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature. device eth0 entered promiscuous mode br-lan: port 1(eth0) entering learning state br-lan: topology change detected, propagating br-lan: port 1(eth0) entering forwarding state PHY: 0:1f - Link is Down NET: Registered protocol family 8 NET: Registered protocol family 20 PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (1024 buckets, 4096 max) acx: this driver is still EXPERIMENTAL acx: reading README file and/or Craig's HOWTO is recommended, visit http://acx100.sf.net in case of further questions/discussion acx: compiled to use 32bit I/O access. I/O timing issues might occur, such as non-working firmware upload. Report them acx: running on a little-endian CPU acx: PCI/VLYNQ module v0.3.37 initialized, waiting for cards to probe... Not using the 00000009 VLYNQ device's driver for VLYNQ device: 00000000 Not using the 00000029 VLYNQ device's driver for VLYNQ device: 00000000 registered device TI Avalanche SAR Ohio250(7200/7100A2) detected requesting firmware image "ar0700xx.bin" firmware: requesting ar0700xx.bin avsar firmware released tn7dsl_set_modulation : Setting mode to 0x1 Creating new root folder avalanche in the proc for the driver stats Texas Instruments ATM driver: version:[7.03.01.00] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0 jffs2_build_filesystem(): unlocking the mtd device... done. jffs2_build_filesystem(): erasing all blocks after the end marker... done. mini_fo: using base directory: / mini_fo: using storage directory: /jffs ar7_wdt: enabling watchdog timer