Zyxel NWA1100-N support?

It is possible to add the Zyxel NWA1100-N support?

From https://www.dslreports.com/forum/r30273458-ZyXEL-NWA1100-N-Firmware-Recovery

U-Boot 1.1.4 (Jan 11 2011 - 18:46:16)

PB93 (ar7241 - Virian) U-boot
#### TAP VALUE 1 = 0x2, 2 = 0x2 [0x75555155: 0x55777577]
64 MB
id read 0x100000ff
flash size 8MB, sector count = 128
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
eth0: 00:03:7f:09:0b:ad
ATHRF1E: Port 0, Negotiation timeout

Does anybody know parameters for three below U-Boot commands?

# Get an image from tftpserver
ar7240> tftp

# Erase flash memory
ar7240> erase

# Write the image to flash memory

More details about memory mapping in NWA1100-N

ar7240> bdinfo
boot_params = 0x83F6BFB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x9F000000
flashsize   = 0x00800000
flashoffset = 0x00038984
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     =
baudrate    = 115200 bps
Booting AR7240(Python)...
Linux version 2.6.31--LSDK- (leon@leon-Inspiron-620) (gcc version 4.3.3 (GCC) ) #1 Thu Nov 20 10:25:09 CST 2014
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:02
arg 3: rootfstype=jffs2
arg 4: init=/sbin/init
arg 5: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom)
arg 6: mem=64M
# Get an image from tftpserver
ar7240> tftpboot 0x81000000 firmware.img
works OK

I am still wondering about flash erase first address (do not want to erase U-Boot or Linux image)

Erase flash memory

I guess that it can be
erase 0x9f020000 +0x58C8F9

Firmware 1.00(UJG.4)C0.img
size 5818617 bytes

Write the image to flash memory

cp.b 0x81000000 0x9f020000 0x58C8F9

arg 5 ( Flash Partition table ) passed to Linux kernel in more readable form

ar7240> mtdparts

device nor0 , # parts = 7
 #: name                        size            offset          mask_flags
 0: u-boot                      0x00040000      0x00000000      0
 1: u-boot-env                  0x00010000      0x00040000      0
 2: rootfs                      0x00610000      0x00050000      0
 3: uImage                      0x00170000      0x00660000      0
 4: configure                   0x00010000      0x007d0000      0
 5: mfg                         0x00010000      0x007e0000      0
 6: eeprom                      0x00010000      0x007f0000      0

active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

mtdids  : nor0=ar7240-nor0
mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom)

For my understanding firmware should be located in rootfs partition.
Does someone more familiar with U-Boot can confirm that firmware in this particular case is located in rootfs partition?
Unfortunately I am not familiar with firmware update process and whether any translation is done on the fly or not.

ZyXEL Access Point NWA1100-N connected to PC serial port via external TTL to RS-232 Adapter Arduino.

PC Serial Port Settings:
Speed: 115200
Data bits: 8
Stop bits: 1
Parity: none
Row Control: none
ar7240> help
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
ethreg    - S26 PHY Reg rd/wr  utility
exit    - exit script
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mtdparts- define flash/nand partitions
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
pll [] - Set to change CPU/AHB/DDR speeds
printenv- print environment variables
progmac - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
req      - FLASH,DRAM,GPIOtest
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
sntp    - synchronize RTC via network
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version

ar7240> printenv
bootcmd=bootm 0x9f660000
bootversion=U-Boot 1.1.4
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts                                =ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configur                                e),64k(mfg),64k(eeprom)
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uIm                                age),64k(configure),64k(mfg),64k(eeprom)

Environment size: 628/65532 bytes

ar7240> imls
Image at 9F660000:
   Image Name:   Linux Kernel Image
   Created:      2014-11-20   2:25:29 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    830637 Bytes = 811.2 kB
   Load Address: 80002000
   Entry Point:  801bcd50
   Verifying Checksum ... OK