Hi lleachii
I have two pieces of this devices. As I found out the AP650 is designed for specific infrastructures in “controller dependent” mode, but I would like to run them as standalone devices. So I’m looking for possibility to flash OpenWrt on it.
I have already made some research using internet but stuck on complexity of this task 
. I can connect serial console via JP1 pinhead on board, I can get into u-boot shell, but not sure what to do next (build image and flash it to device - but how? ...).
I’m new for this kind of hacking and would appreciate for any help. Thanks.
Some pictures and u-boot console output:
BootOS Copyright (c) 2004-2014. All rights reserved.
data bus walking 1's......pass
address bus walking 1's...pass
ram device test...........pass
read config...............w1i1c0
write config..............w1i2c7
booting image2 @ 0xbf070008
U-Boot 5.4.2.0-031R ( Mar 23 2013 - 20:53:32 )
DRAM: 128 MB
Flash: 8 MB
NAND: 128 MB
In: serial
Out: serial
Err: serial
rtc: mfg_rtc_calibration=-13
Hit any key to stop autoboot: 0
Net: ag7100_enet_initialize...
phy: bcm54610 oui 0x0050ef, model 0x16, revision 3
phy: link up 10 Mbits/s, full duplex
eth0: 00:04:96:88:8e:f8
eth0 up
eth0
U-Boot 5.4.2.0-031R
lcap> ?
? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootx - boot a redundant kernel/rootfs image
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
date - get/set/reset date & time
diag - enter into the diagnostics mode
echo - echo args to console
erase - erase FLASH memory
flinfo - print FLASH memory information
fw - firmware commands
go - start application at address 'addr'
gpio - gpio commands
help - print command description/usage
i2c - I2C sub-system
iminfo - print header information for application image
imls - list all images found in flash
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - nand commands
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progfw - download/program full firmware image (via tftp)
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
rtc - rtc commands
run - run commands in an environment variable
runmfg - run in manufacturing mode
rxping - configure active eth interface to respond to pings
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
wd - watchdog control
lcap> bdinfo
boot_params = 0x87F8BFB8
memstart = 0x80000000
memsize = 0x08000000
flashstart = 0xBF000000
flashsize = 0x00800000
flashoffset = 0x00000000
ethaddr = 00:04:96:88:8E:F8
ip_addr = 192.168.1.50
baudrate = 115200 bps
lcap> flinfo
Bank # 1: 128x64K=8MB, Macronix MX25L6405D (0xc22017)
lcap> iminfo
## Checking Image at 80100000 ...
Unknown image format!
lcap> imls
Legacy Image at BF0E0000:
Image Name: 2.6.28.9-ws-symbol
Created: 2014-06-03 3:51:16 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 777551 Bytes = 759.3 kB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Legacy Image at BF430000:
Image Name: 2.6.28.9-ws-symbol
Created: 2013-03-23 15:26:13 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 936236 Bytes = 914.3 kB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
lcap> printenv
bootcmd=bootx
bootdelay=1
baudrate=115200
ipaddr=192.168.1.50
serverip=192.168.1.100
gatewayip=192.168.1.1
netmask=255.255.255.0
mfg_hardware_type=lcap
ethact=eth0
mfg_rtc_calibration=-13
ethaddr=00:04:96:88:8E:F8
mfg_serial_number=1331D-40455
mfg_date=2013/08/07
mfg_country_code=EU
mfg_hardware_model=AP4610-EU
mfg_hardware_version=D
stdin=serial
stdout=serial
stderr=serial
Environment size: 377/65532 bytes
lcap> version
U-Boot 5.4.2.0-031R