Ok, I could flash the OpenWRT image. You need to go in the emergency webserver with the serial cable:
U-Boot 1.1.4 (Jun 27 2013 - 17:53:03)
ap135 - Scorpion 1.0
ALPHA U-boot v1.00rc001
DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1f)
Tap values = (0x11, 0x11, 0x11, 0x11)
256 MB
Top of RAM usable for U-Boot at: 90000000
Reserving 248k for U-Boot at: 8ffc0000
Reserving 192k for malloc() at: 8ff90000
Reserving 44 Bytes for Board Info at: 8ff8ffd4
Reserving 36 Bytes for Global Data at: 8ff8ffb0
Reserving 128k for boot params() at: 8ff6ffb0
Stack Pointer at: 8ff6ff98
Now running in RAM - U-Boot at: 8ffc0000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment
*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
s17 phy0 register value 0x00004140
TEST: FINAL REG VAL after TX Calibration - 0x86000000
TEST: FINAL XMII VAL after RX Calibration - 0x96000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00000001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: 00:03:7f:09:0b:ad
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
eth1 up
eth0, eth1
Setting 0x18116290 to 0x4b97a14f
press 'q' to stop autoboot: 0
Emergency web server start...
Trying eth0
dup 1 speed 1000
Press 'q' to quit.
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Post up.htm
Upload file OK!
(ENV) begin addr=0x9f070000,end=0x9ffdffff
Erasing flash...
First 0x7 last 0xfd sector size 0x10000 253
Erased 247 sectors
write addr: 9f070000
write image into flash...OK,dest addr=0x9f070000
after press q to interrupt auto boot the emergency webserver on 192.168.0.50 was present and there I could upload the image. After the last message, that flash was written OK, I did a power cycle, because there was no automatic reboot.
that's the boot log from openwrt on A2
U-Boot 1.1.4 (Jun 27 2013 - 17:53:03)
ap135 - Scorpion 1.0
ALPHA U-boot v1.00rc001
DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1f)
Tap values = (0x11, 0x11, 0x11, 0x11)
256 MB
Top of RAM usable for U-Boot at: 90000000
Reserving 248k for U-Boot at: 8ffc0000
Reserving 192k for malloc() at: 8ff90000
Reserving 44 Bytes for Board Info at: 8ff8ffd4
Reserving 36 Bytes for Global Data at: 8ff8ffb0
Reserving 128k for boot params() at: 8ff6ffb0
Stack Pointer at: 8ff6ff98
Now running in RAM - U-Boot at: 8ffc0000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment
*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
s17 phy0 register value 0x00004140
TEST: FINAL REG VAL after TX Calibration - 0x86000000
TEST: FINAL XMII VAL after RX Calibration - 0x96000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00000001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: 00:03:7f:09:0b:ad
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
eth1 up
eth0, eth1
Setting 0x18116290 to 0x4b97a14f
press 'q' to stop autoboot: 0
## Booting image at 9f070000 ...
Image Name: 7zip Linux Kernel
Created: 1970-01-01 0:00:00 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: -1 Bytes = 4096 MB
Load Address: 80002000
Entry Point: 80002000
Uncompressing Kernel Image with LZMA ...
Check Image ...
Image OK!
OK
No initrd
## Transferring control to Linux (at address 80002000) ...
## Giving linux memsize in bytes, 268435456
Starting kernel ...
[ 0.000000] Linux version 4.9.120 (buildbot@builds-03.infra.lede-project.org) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7102-3f3a2c9) ) #0 Thu Aug 16 07:51:15 2018
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 10000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
[ 0.000000] Kernel command line: board=DAP-2695-A1 mtdparts=spi0.0:256k(bootloader)ro,64k(bdcfg)ro,64k(rgdb)ro,64k(langpack)ro,15360k(firmware),448k(captival)ro,64k(certificate)ro,64k(radiocfg)ro console=ttyS0,115200 rootfstype=squashfs noinitrd
[ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 254944K/262144K available (3363K kernel code, 172K rwdata, 444K rodata, 300K init, 219K bss, 7200K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[ 0.000008] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[ 0.008298] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[ 0.071187] pid_max: default: 32768 minimum: 301
[ 0.076191] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.083239] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.092901] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.103401] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.110869] NET: Registered protocol family 16
[ 0.116822] MIPS: machine is D-Link DAP-2695 rev. A1
[ 0.736266] registering PCI controller with io_map_base unset
[ 0.742477] ar724x-pci ar724x-pci.1: PCIe link is down
[ 0.747964] registering PCI controller with io_map_base unset
[ 0.754080] Can't analyze schedule() prologue at 803a5594
[ 0.768294] PCI host bridge to bus 0000:00
[ 0.772694] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[ 0.780007] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.785941] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.793163] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.801971] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[ 0.809762] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[ 0.817572] PCI host bridge to bus 0000:01
[ 0.821927] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.829261] pci_bus 0000:01: root bus resource [io 0x0001]
[ 0.835187] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
[ 0.842413] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[ 0.850859] pci 0000:00:00.0: using irq 40 for pin 1
[ 0.858856] clocksource: Switched to clocksource MIPS
[ 0.865093] NET: Registered protocol family 2
[ 0.870520] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.877958] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.884777] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.891620] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.897843] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.904735] NET: Registered protocol family 1
[ 0.911659] Crashlog allocated RAM at address 0x3f00000
[ 0.918081] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[ 0.930850] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.937050] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.955072] io scheduler noop registered
[ 0.959279] io scheduler deadline registered (default)
[ 0.965085] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.974019] console [ttyS0] disabled
[ 0.997889] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A
[ 1.007073] console [ttyS0] enabled
[ 1.007073] console [ttyS0] enabled
[ 1.014490] bootconsole [early0] disabled
[ 1.014490] bootconsole [early0] disabled
[ 1.027767] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[ 1.032961] 8 cmdlinepart partitions found on MTD device spi0.0
[ 1.038974] Creating 8 MTD partitions on "spi0.0":
[ 1.043836] 0x000000000000-0x000000040000 : "bootloader"
[ 1.051101] 0x000000040000-0x000000050000 : "bdcfg"
[ 1.057623] 0x000000050000-0x000000060000 : "rgdb"
[ 1.064104] 0x000000060000-0x000000070000 : "langpack"
[ 1.070954] 0x000000070000-0x000000f70000 : "firmware"
[ 1.125014] 2 wrgg-fw partitions found on MTD device firmware
[ 1.130872] 0x000000070000-0x0000001c0000 : "kernel"
[ 1.137038] 0x0000001c0000-0x000000f70000 : "rootfs"
[ 1.143462] mtd: device 6 (rootfs) set to be root filesystem
[ 1.149286] 1 squashfs-split partitions found on MTD device rootfs
[ 1.155566] 0x000000440000-0x000000f70000 : "rootfs_[ 1.903702] libphy: ag71xx_mdio: probed
[ 2.530364] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[ 2.541724] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:RGMII
[ 2.608852] random: fast init done
[ 3.170490] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:SGMII
[ 3.178038] NET: Registered protocol family 10
[ 3.185642] NET: Registered protocol family 17
[ 3.190233] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 3.203478] 8021q: 802.1Q VLAN Support v1.8
[ 3.209241] hctosys: unable to open rtc device (rtc0)
[ 3.220796] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[ 3.229039] Freeing unused kernel memory: 300K
[ 3.233541] This architecture does not have kernel memory protection.
[ 3.924906] init: Console is alive
[ 3.928528] init: - watchdog -
[ 4.900288] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.951635] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.960499] init: - preinit -
[ 6.102977] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 7.170287] eth0: link up (1000Mbps/Full duplex)
[ 7.175107] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 9.347082] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[ 9.372853] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 9.469280] eth0: link down
[ 9.481799] procd: - early -
[ 9.484796] procd: - watchdog -
[ 10.098051] procd: - watchdog -
[ 10.101487] procd: - ubus -
[ 10.214527] random: ubusd: uninitialized urandom read (4 bytes read)
[ 10.243209] random: ubusd: uninitialized urandom read (4 bytes read)
[ 10.250069] random: ubusd: uninitialized urandom read (4 bytes read)
[ 10.257295] procd: - init -
Please press Enter to activate this console.
[ 10.593265] kmodloader: loading kernel modules from /etc/modules.d/*
[ 10.624369] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 10.638548] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[ 10.646709] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[ 10.655792] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 10.667919] nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
[ 10.714375] xt_time: kernel timezone is -0000
[ 10.883324] PPP generic driver version 2.4.2
[ 10.889650] NET: Registered protocol family 24
[ 10.912162] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[ 10.918063] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[ 11.192151] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
[ 11.203031] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 11.369641] firmware ath10k!pre-cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[ 11.378980] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[ 11.389500] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 11.661307] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-6.bin failed with error -2
[ 11.672192] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 11.764014] firmware ath10k!QCA988X!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[ 11.777521] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[ 11.786924] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 1
[ 11.799953] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00033 api 5 features no-p2p,raw-mode,mfp,allows-mesh-bcast crc32 c41417d0
[ 11.897075] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/board-2.bin failed with error -2
[ 11.907708] ath10k_pci 0000:00:00.0: Falling back to user helper
[ 11.979034] firmware ath10k!QCA988X!hw2.0!board-2.bin: firmware_loading_store: map pages failed
[ 12.009348] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[ 13.111566] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[ 13.323066] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=47
[ 13.401825] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 14.701820] urandom_read: 5 callbacks suppressed
[ 14.701826] random: jshn: uninitialized urandom read (4 bytes read)
[ 14.816940] random: jshn: uninitialized urandom read (4 bytes read)
[ 27.304725] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 27.352309] jffs2_build_filesystem(): unlocking the mtd device... [ 27.358409] done.
[ 27.360404] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 27.491167] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 27.532000] br-lan: port 1(eth0.1) entered blocking state
[ 27.537484] br-lan: port 1(eth0.1) entered disabled state
[ 27.543307] device eth0.1 entered promiscuous mode
[ 27.548171] device eth0 entered promiscuous mode
[ 27.658527] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[ 27.719163] eth1: link up (1000Mbps/Full duplex)
[ 28.596154] eth0: link up (1000Mbps/Full duplex)
[ 28.622283] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 28.649106] br-lan: port 1(eth0.1) entered blocking state
[ 28.654593] br-lan: port 1(eth0.1) entered forwarding state
[ 28.720565] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 82.141016] jffs2: notice: (1348) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 118.828890] random: crng init done