Can you please give us the image that you used to successfully flash these AP-650s?
Hello,
can you please post the image, i have a lot of ap-650 and i can´t find it anywhere
Hello,
is there a chance to flash AP650 with Openwrt?
I bought 27 of them not knowing that they need a Controller.
Seems you can interact with the serial console.
If you do, you should be able to TFTP any image.
I have found the right Pinout:
From bottom up: GND, TX, RX 115200 N81 
Could someone please explane me which Image i can take?
Assuming you have the same SoC as in the pictures in this thread, try something with AR7161, there are a couple of those available.
Set up a TFTP server based on the printenv settings in uboot, then try the bootp/tftpboot of an initramfs image.
Don't forget to document everything.
Looks lika a good start, but you'll need to compile your own initramfs. If you do, include support for the LAN chip in the process.
It seems that there is already OpenWrt installed:
## Booting kernel from Legacy Image at bf0e0000 ...
Image Name: MIPS OpenWrt Linux-2.6.28.9
Created: 2011-12-16 5:03:40 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 832026 Bytes = 812.5 kB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Linux version 2.6.28.9 (spin@zin52debwing03) (gcc version 4.1.2) #1 Fri Dec 16 10:33:34 IST 2011
console [early0] enabled
CPU revision is: 00019374 (MIPS 24Kc)
Atheros AR7161 rev 2, CPU:680.000 MHz, AHB:170.000 MHz, DDR:340.000 MHz
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 32512
Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd init=/etc/preinit root=/dev/mtdblock1 mem=128M
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000c00
Readback ErrCtl register=00000c00
PID hash table entries: 512 (order: 9, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 126848k/131072k available (1755k kernel code, 4068k reserved, 567k data, 128k init, 0k highmem)
SLUB: Genslabs=6, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992)
Mount-cache hash table entries: 512
net_namespace: 428 bytes
NET: Registered protocol family 16
MIPS: machine is Motorola LCAP
registering PCI controller with io_map_base unset
pci 0000:00:00.0: PME# supported from D0 D1 D2 D3hot
pci 0000:00:00.0: PME# disabled
pci 0000:00:11.0: PME# supported from D0 D3hot
pci 0000:00:11.0: PME# disabled
pci 0000:00:12.0: PME# supported from D0 D3hot
pci 0000:00:12.0: PME# disabled
PCI: mapping irq 48 to pin1@0000:00:11.0
PCI: mapping irq 49 to pin1@0000:00:12.0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY) B) 2001-2006 Red Hat, Inc.
msgmni has been set to 248
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
console handover: boot [early0] -> real [ttyS0]
ag71xx_mdio: probed
eth0: Atheros AG71xx at 0xb9000000, irq 4
Atheros AR71xx SPI Controller driver version 0.2.4
MT29F1G01AAADDH4 SNAND, model number 02, size 128 MB, PS 1
plat_nand: Using default values for partition table
Creating 6 MTD partitions on "wiosnand":
0x00000000-0x08000000 : "all_nand"
0x00000000-0x02980000 : "rootfs1"
0x02980000-0x05300000 : "rootfs2"
0x05300000-0x05a00000 : "var2"
0x05a00000-0x06400000 : "etc2"
0x06400000-0x08000000 : "rootfs_data"
m25p80 spi0.0: mx25l64 (8192 Kbytes)
Creating 9 MTD partitions on "spi0.0":
0x00000000-0x00800000 : "all_nor"
0x00000000-0x00010000 : "bootstrap"
0x00010000-0x00070000 : "boot1"
0x00070000-0x000d0000 : "boot2"
0x000d0000-0x000e0000 : "config"
0x000e0000-0x00430000 : "linux1"
0x00430000-0x00780000 : "linux2"
0x00780000-0x007f0000 : "panic"
0x007f0000-0x00800000 : "bootconfig"
i2c-gpio i2c-gpio.0: using pins 2 (SDA) and 1 (SCL)
Atheros AR71xx hardware watchdog driver version 0.1.0
TCP vegas registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing unused kernel memory: 128k freed
Please be patient, while OpenWrt loads ...
Algorithmics/MIPS FPU Emulator v1.5
- preinit -
Press CTRL-C for failsafe
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /jffs
- init -
Please press Enter to activate this console. JFFS2 notice: (351) check_node_data: wrong data CRC in data node at 0x011b70ec: read 0x40f65f8b, calculated 0xc0707d58.
JFFS2 notice: (351) check_node_data: wrong data CRC in data node at 0x00bfc0e4: read 0x32c335e3, calculated 0xd1a93106.
JFFS2 notice: (351) check_node_data: wrong data CRC in data node at 0x00f80000: read 0x85b79263, calculated 0x1ca593c7.
eth0: link up (100Mbps/Full duplex)
Registered led device: wlan24
Registered led device: wlan5
gpio-buttons driver version 0.1.1
dataplane: module license 'Proprietary. Copyright (c) 2006-2008 Symbol Technologies. Copyright (c) 2008 Motorola Inc. All Rights Reserved.' taints kernel.
dataplane loaded at 87001000
NUM_TIMEOUT_TABLES 3
NUM_TIMEOUT_BUCKETS_PER_TABLE 32
MAX_TIMEOUT 32768 (9.1 h)
NUM_SHORT_TIMEOUT_TABLES 2
NUM_SHORT_TIMEOUT_BUCKETS_PER_TABLE 32
MAX_SHORT_TIMEOUT 1024 (10 s)
HZ=100
reliable msg credits 1/thread^2
normal data thread msg credits 2/thread^2
normal ctrl thread msg credits 64/thread^2
bulk msg credits 4/thread^2
max bulk msgs 2/thread
NUM_PACKETS 6144
packet buffer size 1804
packet buffer headroom 72
packet buffer size without headroom 1732
sizeof(struct packet)=212
PACKET_INVALIDATE_STARTING_OFFSET 96
packets located at c030c000-c045c000
NUM_FDB_ENTRIES 32768
FDB_ENTRIES_PER_BUCKET 16
NUM_FDB_BUCKETS 2048
FDB_DEFAULT_ENTRY_MAX_AGE_SEC 300
sizeof(FDB_Entry) 32 (using 32)
NUM_PORTS 6
NUM_MCAST_PORTS 6
MCAST_PORT_MASK_UNIT 16
8192 route table entries
16384 route tree nodes
1024 next-hop gateways
sizeof(ARP_Entry) 32 (using 32)
NUM_ARP_ENTRIES 16384
NUM_ARP_TABLE_BUCKETS 4096
ARP_ENTRY_MAX_AGE_MSEC 600000
ARP_AGING_INTERVAL_MSEC 585
NUM_ARP_TABLE_BUCKETS_AGED_PER_PASS 4
ARP_RETRY_INTERVAL_MSEC 10
NUM_ARP_TABLE_BUCKETS_RETRIED_PER_PASS 40
r_mem_init 137216
radio mem start:c0576000, len=137216
radio block size:128, num blocks=1072
found device:[0:17:0]
vid:0x168c, devid:0x0027, irq:48
PCI: Enabling device 0000:00:11.0 (0000 -> 0002)
rfdrvr: resource start = 0x10000000, len=65536, flags=0x20200, 4000
rfdrvr: ioremap PCI memory region
rfdrvr: ioremap PCI memory region
rfdrvr: remapped phymem 0x10000000 to location: 0xb0000000
cache line size is 32 bytes
IOREMAP Addr: 0xb0000000
Address: 0xb0007044, Status****: 0x11
radiopci:testing....
radiopci:testing...5r
rle32 rtc_status = 2000000
radiopci:testing...6r
readl rtc_status = 2
found device:[0:18:0]
vid:0x168c, devid:0x0027, irq:49
PCI: Enabling device 0000:00:12.0 (0000 -> 0002)
rfdrvr: resource start = 0x10010000, len=65536, flags=0x20200, 4000
rfdrvr: ioremap PCI memory region
rfdrvr: ioremap PCI memory region
rfdrvr: remapped phymem 0x10010000 to location: 0xb0010000
cache line size is 32 bytes
IOREMAP Addr: 0xb0010000
Address: 0xb0017044, Status****: 0x11
radiopci:testing....
radiopci:testing...5r
rle32 rtc_status = 2000000
radiopci:testing...6r
readl rtc_status = 2
0]init_rdrvr
0]allocated 5632 ath tx buf descriptors 1081344 192
0]init_rdrvr successful, radio mac:[00-04-96-8A-CB-50]
1]init_rdrvr
1]allocated 5632 ath tx buf descriptors 1081344 192
1]init_rdrvr successful, radio mac:[00-04-96-8A-CA-B0]
rhaldbg: initialized
sizeof(wlan) 1032 * MAX_WLANS 32 = 32KB
sizeof(wlan_cfg) 844
sizeof(wlan_stats) 176
sizeof(wlan_slow_stats) 296
sizeof(ap) 32 * MAX_APS 1 = 0KB
sizeof(ap_cfg) 12
sizeof(ap_stats) 0
sizeof(radio) 6848 * MAX_RADIOS 2 = 13KB
sizeof(radio_cfg) 868
sizeof(radio_stats) 696
sizeof(radio_slow_stats) 408
sizeof(mu) 1416 * MAX_MUS 512 = 708KB
sizeof(mu_cfg) 48
sizeof(mu_stats) 872
sizeof(mu_slow_stats) 320
sizeof(wlan_name2id) 2080
NUM_[MUHASH]_BUCKETS 128 w/ 8 MUs per BUCKET
sizeof(the_config) = 1362920
offsetof(debug_level) = 0
offsetof(switch_mac) = 4
offsetof(router) = 104
offsetof(host) = 136
offsetof(l3acl) = 156
offsetof(dot11) = 168
offsetof(stp_forwarding_ports) = 184
offsetof(trunks) = 248
offsetof(ext_ports) = 248
offsetof(ports) = 260
offsetof(vlans) = 452
offsetof(infs) = 98756
sizeof(Port_Config) = 32
sizeof(External_Port_Config) = 12
sizeof(Vlan_Config) = 24
sizeof(Interface_Config) = 292
sizeof(Lacp_Config) = 4
device eth0 entered promiscuous mode
dataplane enabled
bigmem used: 3MB
BusyBox v1.11.3 (2011-12-16 10:24:10 IST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
I am desperate, none of the procedures I have found work. Can anyone help me? Which image and how do I get it installed?
Depends on which procedures you've found, doesn't it?
And we already knew it was running openwrt, it's posted earlier in the thread.
The Image i try to flash:
openwrt-15.05-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade
mtd -r write /tmp/Image.bin firmware
Could not open mtd device: firmware
Can't open device for writing!
opkg update
Downloading http://downloads.openwrt.org/snapshots/ar71xx/packages/Packages.gz
wget: bad address 'downloads.openwrt.org'
Collected errors:
* opkg_download: ERROR: Command failed with return value 1: `wget --passive-ftp -P /tmp/opkg-rRJTdE http://downloads.openwrt.org/snapshots/ar71xx/packages/Packages.gz'
sysupgrade -v /tmp/Image.bin
Firmware upgrade is not implemented for this platform.
Unfortunately, I have no idea how to compile my own image.
And yes, it is the same Model
If you're prepared to flash a sysupgrade, send it over tftp instead.
sysupgrade does not work
Firmware upgrade is not implemented for this platform.
The image transfer was not the Problem.
The Question is how to flash the Image.
Is it the right image?
openwrt-15.05-ar71xx-generic-tl-wr1043nd-v1-squashfs-sysupgrade.bin
I have 27 of this devices, i hope there is a Chance to get them to work.
There isn't, if you don't actually read what people write.
- I have the same SoC as in the Pictures
- I also tried to flash over TFTP but always the same Message (Firmware upgrade is not implemented for this platform.)
I though the firmware upgrade not implemented was an sysupgrade error?
I tried tftpboot from Recovery Console:
lcap> tftpboot
*** Warning: no boot file name; using '3201A8C0.img'
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.50
Filename '3201A8C0.img'.
Load address: 0x80100000
Loading: ###########################################################
done
Bytes transferred = 3407876 (340004 hex)
but nothing else happens
I can use this commands:
lcap> help
? - alias for 'help'
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootx - boot a redundant kernel/rootfs image
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
date - get/set/reset date & time
echo - echo args to console
erase - erase FLASH memory
flinfo - print FLASH memory information
fw - firmware commands
go - start application at address 'addr'
gpio - gpio commands
help - print command description/usage
i2c - I2C sub-system
iminfo - print header information for application image
imls - list all images found in flash
imxtract- extract a part of a multi-image
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mtest - simple RAM read/write test
mw - memory write (fill)
nand - nand commands
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progfw - download/program full firmware image (via tftp)
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
rtc - rtc commands
run - run commands in an environment variable
runmfg - run in manufacturing mode
rxping - configure active eth interface to respond to pings
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
wd - watchdog control
bootp:
lcap> bootp
BOOTP broadcast 1
*** Warning: no boot file name; using '6501A8C0.img'
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.101
Filename '6501A8C0.img'.
Load address: 0x80100000
Loading: #################################################################
#################################################################
#####################################
done
Bytes transferred = 3407876 (340004 hex)
ok,
I'm no uboot expert, but after the image DLed try bootm 0x80100000, or whatever the load address is during initial transfer.
this should however fail, since you don't have an initramfs image.
progfw might be way forward to write the image to the flash using TFTP.