Support for Motorola AP650

Has anybody tried to install OpenWrt on Motorla AP650 (4610-EU)?

Thanks for help.

Are you requesting assistance in supporting this device?

If so, you'll need to open up the device:

(Moved to Developers section)

Hi lleachii
I have two pieces of this devices. As I found out the AP650 is designed for specific infrastructures in “controller dependent” mode, but I would like to run them as standalone devices. So I’m looking for possibility to flash OpenWrt on it.
I have already made some research using internet but stuck on complexity of this task :slight_smile:. I can connect serial console via JP1 pinhead on board, I can get into u-boot shell, but not sure what to do next (build image and flash it to device - but how? ...).
I’m new for this kind of hacking and would appreciate for any help. Thanks.

Some pictures and u-boot console output:

back front detail1

BootOS Copyright (c) 2004-2014. All rights reserved.
data bus walking 1's......pass
address bus walking 1's...pass
ram device test...........pass
read config...............w1i1c0
write config..............w1i2c7
booting image2 @ 0xbf070008

U-Boot ( Mar 23 2013 - 20:53:32 )

DRAM:  128 MB
Flash:  8 MB
NAND:  128 MB
In:    serial
Out:   serial
Err:   serial
rtc: mfg_rtc_calibration=-13
Hit any key to stop autoboot:  0
Net:   ag7100_enet_initialize...
phy: bcm54610 oui 0x0050ef, model 0x16, revision 3
phy: link up 10 Mbits/s, full duplex
eth0: 00:04:96:88:8e:f8
eth0 up
lcap> ?
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootx   - boot a redundant kernel/rootfs image
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
date    - get/set/reset date & time
diag    - enter into the diagnostics mode
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
fw      - firmware commands
go      - start application at address 'addr'
gpio    - gpio commands
help    - print command description/usage
i2c     - I2C sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - nand commands
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progfw  - download/program full firmware image (via tftp)
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rtc     - rtc commands
run     - run commands in an environment variable
runmfg  - run in manufacturing mode
rxping  - configure active eth interface to respond to pings
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
wd      - watchdog control
lcap> bdinfo
boot_params = 0x87F8BFB8
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x00800000
flashoffset = 0x00000000
ethaddr     = 00:04:96:88:8E:F8
ip_addr     =
baudrate    = 115200 bps
lcap> flinfo

Bank # 1: 128x64K=8MB, Macronix MX25L6405D (0xc22017)
lcap> iminfo

## Checking Image at 80100000 ...
Unknown image format!
lcap> imls
Legacy Image at BF0E0000:
   Image Name:
   Created:      2014-06-03   3:51:16 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    777551 Bytes = 759.3 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
Legacy Image at BF430000:
   Image Name:
   Created:      2013-03-23  15:26:13 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    936236 Bytes = 914.3 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
lcap> printenv

Environment size: 377/65532 bytes
lcap> version


Well it looks supportable as both the SoC and WLAN card should be supported.

Whats the id on that Broadcom IC?

The Broadcom is BCM54610C1KF86.


Ok,that is a gigabit PHY.
I dont know if its upstream supported.

sorry I even don't know what does upstream mean :slight_smile:

1 Like

In the Linux kernel, but from what I found its supported.

1 Like

Any suggestion what me to do next?

1 Like

Can you get stock firmware binary and GPL?

1 Like

Sorry, I don’t understand. What stock firmware binary and what GPL? For sure the stock firmware image is on the device NAND but what can I do with this binaries?

1 Like

By firmware binary I mean firmware images that are used for upgrading, and by GPL I mean GPL sources that manufacturer has to provide since they are using sotfware under the GPL licence

1 Like

I’m afraid it is not easy to get either binaries nor sources. As I already was looking for different firmware I even haven’t been able to find original Motorola firmware. This AP is controller dependent and upgrade can be official done only via controller of WiNG x firmware. But found some posts about it and the firmware for AP650 could be the part of the latest WiNG 5 firmware. But I don’t understand anything of this :slight_smile:
Is it necessary to get it for building OpenWrt image?

Well without the GPL, firmware binary and the device not much can be done.
Its guessing game then

Was looking for any firmware on internet, but no luck. Found no binaries for this type of AP, but as I already wrote, this AP could be upgraded just from controller. I found binaries for some controller if it can help. But there are no sources on internet.
So is it a waste of time? Better to scrap it?

Well most likely

Ok. Thanks for helping me.


You need a controller to upgrade it. They can be had for very cheap on eBay.

I have a RFS4000 switch (and the firmware for it) with ability to upgrade an AP-650 to WiNG 5.8.
The firmware is embedded into the RFS4K firmware, but it can be downloaded from the WiNG interface (at least in some versions).

OpenWrt is already installed on Motorola AP650, but i can not identify which version.

I have three devices, and all three running openwrt