TP-Link AP200 V1
OpenWrt support
Not supported officially. Experimental firmware available
Supporting activities
luaxlab is working on support.
The device original firmware is based on very outdated OpenWRT with Linux 3.3.8.
If you have any questions, reach out via the linked forum thread.
Bug reports may be reported via GitHub Issues.
Source Code: GitHub
OpenWRT Forum Thread: TP-Link AP200
Status
What works:
- Kernel Boots
- LEDs
- Ethernet
- Wireless (2.4GHz and 5GHz)
- Grabbing wireless calibration data and MAC from ART.
Limited support:
- Buttons: Reset works. LED toggle and WPS push do not.
Experimental firmware
There is an experimental firmware available!
Version 0.1
Built February 14th 22:23:23 2026 UTC
Based on most recent OpenWRT Snapshot
Available on GitHub
Hardware highlights
| CPU | Ram | Flash | Network | WLAN | Serial |
|---|---|---|---|---|---|
| QCA9563-AL3A @ 775MHz | 64 MiB | 8 MiB | 1x 10/100/1000 | bgn/ac | PCB Header |
Installation
Installing OpenWrt
Upgrade from original firmware
Using the factory image, upgrade is possible from within the original firmware.
- Open the web interface of the AP.
- Go to
Settings > System Tools > UpgradeFirmware - Click
Browseand select the obtainedfactoryimage, pressUpgrade - Wait for the process to complete.
You will likely not be redirected automatically due to browser caching. Go from /webpages/ to /cgi-bin/luci
in that case.
Note that the AP might be assigned a new IP by the DHCP server and as such, the adress might change.
Specific configuration
Network interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| eth0 | Lan Port | DHCP |
| br-lan | Bridge | |
| phy1-ap0 | Wireless 2.4GHz | Disabled |
| phy0-ap0 | Wireless 5GHz | Disabled |
Hardware
Info
| Architecture | MIPS 74Kc |
|---|---|
| Vendor | Qualcomm |
| Bootloader | U-Boot 1.1.4 |
| System-On-Chip | Qualcomm Atheros QCA956X rev 0 |
| CPU/Speed | 775 MHz |
| Flash-Chip | GigaDevice 25Q64CSIG |
| Flash size | 8 MiB |
| RAM | 64 MiB |
| Wireless | Integrated 2.4GHz 802.11bgn Qualcomm Atheros QCA9887 5Ghz 802.11a/ac |
| Ethernet | 10/100/1000MBits |
| Switch | Qualcomm Atheros QCA8033 |
| USB | None, possible hardware-mod |
| Serial | Yes |
| JTAG | No |
Flash Layout
partition fs-uboot base 0x00000 size 0x10000
partition default-mac base 0x10000 size 0x00200
partition pin base 0x10200 size 0x00200
partition device-id base 0x10400 size 0x00100
partition product-info base 0x10500 size 0x0fb00
partition os-image base 0x20000 size 0x120000
partition file-system base 0x140000 size 0x670000
partition soft-version base 0x7b0000 size 0x01000
partition support-list base 0x7b1000 size 0x04000
partition partition-table base 0x7b5000 size 0x0b000
partition profile base 0x7c0000 size 0x08000
partition default-config base 0x7c8000 size 0x08000
partition user-config base 0x7d0000 size 0x10000
partition log base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000
Photos
Opening the case
Research has to be conducted on how to open the case without damage.
There are exactly four screws found on the bottom side, covered by rubber feet.
The top of the case is held in place by plastic clips. Using rough force, it can be removed granting access to the PCB. This however breaks some of the plastic clips. Take this into account.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
To get access to the serial interface, some mild soldering is requiered.
Open the case and find the unpopulated 1×4 2.54 pitch header near the buttons. Solder a header or similar.
Use a 3V USB to TTL converter or similar.
The pins are, starting from the indicator arrow: RX, TX, GND, 3.3V
| U-Boot | 120000, 8N1, 3.3V |
|---|---|
| Linux Kernel | 115200, 8N1, 3.3V |
Bootlogs
OEM bootlog
Note that >>>>>>>>>> TEXT <<<<<<<<<< are comments to help understand what action had to be performed
U-Boot 1.1.4 (Aug 3 2016 - 17:26:14) ap152 - Dragonfly 1.0 DRAM: 64 MB Top of RAM usable for U-Boot at: 84000000 Reserving 120k for U-Boot at: 83fe0000 Reserving 8256k for malloc() at: 837d0000 Reserving 44 Bytes for Board Info at: 837cffd4 Reserving 36 Bytes for Global Data at: 837cffb0 Reserving 128k for boot params() at: 837affb0 Stack Pointer at: 837aff98 Now running in RAM - U-Boot at: 83fe0000 Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17 flash size 8MB, sector count = 128 Flash: 8 MB Using default environment In: serial Out: serial Err: serial Net: ath_gmac_enet_initialize... No valid address in Flash. Using fixed address ath_gmac_enet_initialize: reset mask:c02200 athr_mgmt_init ::done Dragonfly ----> S17 PHY * phy_hw_cfg 10. Max resets limit reached exiting... athr_gmac_sgmii_setup SGMII done : cfg1 0x80000000 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad eth0 up eth0 Setting 0x181162c0 to 0x40802100 Autobooting in 1 seconds ## Booting image at 9f020000 ... Image Name: MIPS OpenWrt Linux-3.3.8 Created: 2016-11-10 6:14:24 UTC Image Type: MIPS Linux Multi-File Image (lzma compressed) Data Size: 1064766 Bytes = 1 MB Load Address: 80060000 Entry Point: 80060000 Contents: Image 0: 1064758 Bytes = 1 MB Verifying Checksum at 0x9f020040 ...OK Uncompressing Multi-File Image ... OK No initrd ## Transferring control to Linux (at address 80060000) ... ## Giving linux memsize in bytes, 67108864 Starting kernel ... [ 0.000000] Linux version 3.3.8 (tplink@tplink) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Wed Jul 27 10:10:49 CST 2016 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00019750 (MIPS 74Kc) [ 0.000000] SoC: Qualcomm Atheros QCA956X rev 0 [ 0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] User-defined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00004000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00004000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: console=ttyS0,115200 board=AP152 rootfstype=squashfs init=/etc/preinit mtdparts=spi0.0:128k(u-boot),1152k(uImage),6592k(rootfs),64k@0x7f0000(ART) mem=64M rootfstype=squashfs,jffs2 noinitrd [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 61328k/65536k available (2273k kernel code, 4208k reserved, 558k data, 180k init, 0k highmem) [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS:83 [ 0.000000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216) [ 0.060000] pid_max: default: 32768 minimum: 301 [ 0.060000] Mount-cache hash table entries: 512 [ 0.070000] NET: Registered protocol family 16 [ 0.070000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79 [ 0.080000] MIPS: machine is Qualcomm Atheros AP152 reference board [ 0.590000] Max resets limit reached exiting... [ 0.600000] registering PCI controller with io_map_base unset [ 0.810000] bio: create slab <bio-0> at 0 [ 0.810000] PCI host bridge to bus 0000:00 [ 0.820000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff] [ 0.820000] pci_bus 0000:00: root bus resource [io 0x0001] [ 0.830000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit] [ 0.830000] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref] [ 0.840000] pci 0000:00:00.0: using irq 40 for pin 1 [ 0.840000] Switching to clocksource MIPS [ 0.850000] NET: Registered protocol family 2 [ 0.850000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.850000] TCP established hash table entries: 2048 (order: 2, 16384 bytes) [ 0.860000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes) [ 0.860000] TCP: Hash tables configured (established 2048 bind 2048) [ 0.870000] TCP reno registered [ 0.870000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.880000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.880000] NET: Registered protocol family 1 [ 0.900000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.900000] msgmni has been set to 119 [ 0.910000] io scheduler noop registered [ 0.910000] io scheduler deadline registered (default) [ 0.920000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.940000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A >>>>>>>>>> FROM HERE ON 115200 8N1 <<<<<<<<<< [ 0.950000] console [ttyS0] enabled, bootconsole disabled [ 0.960000] m25p80 spi0.0: found gd25q128c, expected m25p80 [ 0.970000] m25p80 spi0.0: gd25q128c (16384 Kbytes) [ 0.970000] 4 cmdlinepart partitions found on MTD device spi0.0 [ 0.980000] Creating 4 MTD partitions on "spi0.0": [ 0.980000] 0x000000000000-0x000000020000 : "u-boot" [ 0.990000] 0x000000020000-0x000000140000 : "uImage" [ 1.000000] 0x000000140000-0x0000007b0000 : "rootfs" [ 1.000000] mtd: partition "rootfs" set to be root filesystem [ 1.010000] 0x0000007f0000-0x000000800000 : "ART" [ 1.010000] flash_chrdev : flash_chrdev_init [ 1.030000] ag71xx_mdio: probed [ 1.030000] eth0: Atheros AG71xx at 0xb9000000, irq 4 [ 1.590000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd074, driver=Qualcomm Atheros AR8033 PHY] [ 1.600000] TCP cubic registered [ 1.600000] NET: Registered protocol family 17 [ 1.610000] Bridge firewalling registered [ 1.610000] 8021q: 802.1Q VLAN Support v1.8 [ 1.610000] ### of_selftest(): No testcase data in device tree; not running tests [ 1.630000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 1.640000] Freeing unused kernel memory: 180k freed [ 3.190000] [ag71xx_hw_start:554]ag71xx_hw_start - preinit - - regular preinit - jffs2 not ready yet; using ramdisk - init - [ 3.580000] [ag71xx_rings_cleanup:348]ag71xx_rings_cleanup [ 4.270000] liblog: module license 'unspecified' taints kernel. [ 4.270000] Disabling lock debugging due to kernel taint [ 4.620000] NET: Registered protocol family 10 [ 4.730000] SCSI subsystem initialized [ 4.870000] Button Hotplug driver version 0.4.1 [ 4.900000] PPP generic driver version 2.4.2 [ 4.920000] tun: Universal TUN/TAP device driver, 1.6 [ 4.930000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 4.960000] PPP MPPE Compression module registered [ 5.040000] L2TP core driver, V2.0 [ 5.050000] L2TP netlink interface [ 5.110000] IPv6 over IPv4 tunneling driver [ 5.130000] GRE over IPv4 demultiplexor driver [ 5.140000] GRE over IPv4 tunneling driver [ 5.210000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 5.350000] NET: Registered protocol family 24 [ 5.420000] nf_conntrack version 0.5.0 (961 buckets, 3844 max) [ 5.690000] PPPoL2TP kernel driver, V2.0 [ 5.700000] PPTP driver version 0.8.5 [ 6.030000] xt_time: kernel timezone is -0000 [ 6.390000] nf_conntrack_rtsp v0.6.21 loading [ 6.400000] nf_nat_rtsp v0.6.21 loading [ 6.470000] Netfilter messages via NETLINK v0.30. [ 6.490000] ctnetlink v0.93: registering with nfnetlink. [ 6.580000] fuse init (API version 7.18) reloadconfig() begin: reloadconfig() end: reload_profile() begin: reload_profile() end: Please press Enter to activate this console. GMT+08:00 Sat Aug 20 00:00:00 GMT 2016 [ 10.090000] [ag71xx_hw_start:554]ag71xx_hw_start [ 10.100000] ADDRCONF(NETDEV_UP): eth0: link is not ready /etc/rc.common: line 98: /sbin/switch_bind_mac: not found [ 10.670000] [ag71xx_hw_start:554]ag71xx_hw_start [ 10.670000] eth0: link up (1000Mbps/Full duplex) [ 10.780000] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Loading defaults Loading synflood protection Adding custom chains Loading zones Loading forwardings Loading rules Loading redirects Loading includes Optimizing conntrack Loading interfaces Loading tpcmd loading access_control loading basic_security [ 16.060000] ADDRCONF(NETDEV_UP): lo: link is not ready [ 16.090000] device eth0 entered promiscuous mode [ 16.090000] br-lan: port 1(eth0) entered forwarding state [ 16.100000] br-lan: port 1(eth0) entered forwarding state cur_sysmode: ap is_ap: ap start udhcpc dhcp.script deconfig conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied. loading administration management fw unload_local_mgnt dhcp.script bound [ 29.050000] ****Address of trace_timer :8327a2d0 [ 29.280000] ath_hal: 0.9.17.1 (AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D) [ 29.450000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved [ 29.500000] ath_dfs: Version 2.0.0 [ 29.500000] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved [ 29.680000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved [ 30.830000] __ath_attach: Set global_scn[0] [ 30.840000] Enterprise mode: 0x03bda000 [ 30.850000] Restoring Cal data from DRAM [ 30.850000] Green-AP : Green-AP : Attached [ 30.850000] [ 30.860000] ath_get_caps[6147] rx chainmask mismatch actual 3 sc_chainmak 0 [ 30.870000] ath_get_caps[6122] tx chainmask mismatch actual 3 sc_chainmak 0 [ 30.880000] ath_attach_dfs[12621] dfsdomain 1 [ 30.900000] wifi0: Atheros 956X: mem=0xb8100000, irq=47 [ 30.910000] ath_pci: 10.2.3.31 (Atheros/multi-bss) [ 30.910000] ath_pci_probe [ 30.920000] PCI device id is 0050 :0050 [ 30.920000] ath_pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit] [ 30.930000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) [ 30.940000] ath_pci 0000:00:00.0: ath DEBUG: sc=0x8201b800 [ 30.940000] [ 30.940000] ol_ath_pci_configure : num_desired MSI set to 0 [ 30.950000] [ 30.950000] Using PCI Legacy Interrupt [ 31.960000] CE_per_engine_handler_adjust, base=8201b800 offset=57400 [ 31.960000] CE_per_engine_handler_adjust, base=8201b800 offset=57800 [ 31.980000] __ol_ath_attach: ath_attach TODO [ 31.980000] __ol_ath_attach: dev name wifi1 [ 31.990000] ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko) [ 32.000000] OL_ACBKMinfree : 0 [ 32.000000] OL_ACBEMinfree : 0 [ 32.010000] OL_ACVIMinfree : 0 [ 32.010000] OL_ACVOMinfree : 0 [ 32.010000] ol_ath_attach() BMI inited. [ 32.020000] ol_ath_attach() BMI Get Target Info. [ 32.020000] ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016d [ 32.030000] NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0 [ 32.030000] ol_ath_attach() configure Target . [ 32.040000] Cal location [0]: 00004000 [ 32.040000] qc98xx_verify_checksum: flash checksum passed: 0xbab0 [ 32.050000] ol_transfer_bin_file 2155: Download Flash data len 2116 [ 32.060000] Swift firmware download [ 32.060000] ol_transfer_bin_file 2085: Download Firmware data len 224308 [ 33.020000] ol_ath_attach() Download FW. [ 33.020000] ol_ath_attach() HT Create . [ 33.030000] ol_ath_attach() HIF Claim. [ 33.030000] ol_ath_attach() BMI Done. [ 33.040000] ol_ath_attach() WMI attached. wmi_handle 820f0000 [ 33.040000] +HWT [ 33.040000] SOC_RESET_CONTROL_ADDRESS : 800 [ 33.050000] CPU_INTR_ADDRESS = [2000000] [ 33.050000] SOC_GLOBAL_RESET_ADDRESS = [0] [ 33.060000] Rx_Filter : [0] [ 33.060000] CE_per_engine_handler_adjust, base=8201b800 offset=57400 [ 33.070000] CE_per_engine_handler_adjust, base=8201b800 offset=57800 [ 33.070000] CE_per_engine_handler_adjust, base=8201b800 offset=57c00 [ 33.080000] CE_per_engine_handler_adjust, base=8201b800 offset=58000 [ 33.090000] CE_per_engine_handler_adjust, base=8201b800 offset=58400 [ 33.090000] CE_per_engine_handler_adjust, base=8201b800 offset=58800 [ 33.100000] CE_recv_buf_enqueue 655 Populate last entry 512 for CE 5 [ 33.110000] CE_recv_buf_enqueue 664 CE 5 wi 511 dest_ptr 0x22f5c20 nbytes 0 recv_ctxt 0x822ecc00 [ 33.120000] -HWT [ 33.120000] HTC Service:0x0300 ep:1 TX flow control disabled [ 33.130000] CE_pkt_dl_len_set CE 4 Pkt download length 64 [ 33.140000] ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from 81f30000 [ 33.140000] HTC Service:0x0100 ep:2 TX flow control disabled [ 33.150000] wmi_service_ready_event_rx: WMI UNIFIED SERVICE READY event [ 33.160000] num_rf_chain : 00000001 [ 33.160000] ht_cap_info: : 0000085b [ 33.170000] vht_cap_info : 338001b2 [ 33.170000] vht_supp_mcs : 0000fffe [ 33.170000] LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256 [ 33.180000] idx 0 req 1 num_units 0 num_unit_info 2 unit size 408 actual units 145 [ 33.190000] chunk 0 len 59160 requested ,ptr 0x1f40000 [ 33.200000] FIRMWARE:P 145 V 16 T 443 [ 33.200000] [ 33.210000] wmi_ready_event_rx: WMI UNIFIED READY event [ 33.210000] ol_ath_connect_htc() WMI is ready [ 33.220000] ol_ath_set_host_app_area TODO [ 33.220000] target uses HTT version 2.1; host uses 2.1 [ 33.230000] ol_ath_attach() connect HTC. [ 33.240000] bypasswmi : 0 [ 33.240000] ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0. [ 33.250000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150 [ 33.260000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0 [ 33.270000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0 [ 33.270000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0 [ 33.280000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150 [ 33.290000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080 [ 33.290000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080 [ 33.300000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080 [ 33.310000] Add VHT80 channel: 5210 [ 33.310000] Add VHT80 channel: 5290 [ 33.320000] Add VHT80 channel: 5530 [ 33.320000] Add VHT80 channel: 5610 [ 33.320000] Add VHT80 channel: 5690 [ 33.330000] Add VHT80 channel: 5775 [ 33.330000] Skipping VHT80 channel 5825 [ 33.340000] ol_ath_phyerr_attach: called [ 33.340000] OL Resmgr Init-ed [ 33.340000] Green-AP : Green-AP : Attached [ 33.340000] [ 33.350000] Green-AP : Attached [ 33.350000] ol_if_dfs_setup: called [ 33.360000] ol_if_dfs_attach: called; ptr=81f55974, radar_info=833d7b78 [ 33.360000] ol_ath_rtt_meas_report_attach: called [ 33.370000] ol_ath_attach() UMAC attach . [ 33.370000] ol_if_dfs_configure: called [ 33.380000] ol_if_dfs_configure: FCC domain [ 33.380000] ol_if_dfs_disable: called [ 33.390000] ol_ath_attach: Calling ol_if_dfs_configure [ 33.390000] __ol_ath_attach: init tx/rx TODO [ 33.400000] __ol_ath_attach: hard_header_len reservation 58 [ 33.520000] Initializing Pktlogs for 11ac reup interface cur_sysmode:ap [ 34.040000] [wifi1] FWLOG: [37701] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 ) [ 34.050000] [wifi1] FWLOG: [37701] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 ) [ 34.060000] [wifi1] FWLOG: [37701] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 ) [ 34.070000] [wifi1] FWLOG: [37701] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 ) [ 34.070000] [wifi1] FWLOG: [37706] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 ) [ 34.080000] [wifi1] FWLOG: [37706] WHAL_ERROR_RESET_PM ( ) [ 34.090000] [wifi1] FWLOG: [37900] ANI Enable: 1 [ 37.900000] ath_attach_dfs[12621] dfsdomain 1 [ 38.160000] VAP device ath0 created osifp: (831bfb80) os_if: (81818000) [ 38.200000] Set freq vap stop send + 81818000 [ 38.210000] Set freq vap stop send -81818000 [ 38.340000] Set wait done --81818000 [ 38.410000] WARNING: Fragmentation with HT mode NOT ALLOWED!! [ 38.430000] Set freq vap stop send + 81818000 [ 38.430000] Set freq vap stop send -81818000 [ 38.570000] Set wait done --81818000 [ 39.280000] [ 39.280000] DES SSID SET= [ 39.310000] [ 39.310000] DES SSID SET=REDACTED @@@@@@@@@@wpa-psk2/aes [ 40.600000] ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 [ 40.620000] DEVICE IS DOWN ifname=ath0 [ 40.620000] DEVICE IS DOWN ifname=ath0 [ 41.890000] tp_domain: ap mode [ 42.480000] [ol_ath_iw_setcountry][1452] *p=44, *(p+1)=45 [ 42.490000] isCountryCodeValid: EEPROM regdomain 0x0 [ 42.490000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2) flags 0x2150 [ 42.500000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4) flags 0xa0 [ 42.510000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x8) flags 0xc0 [ 42.510000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x20) flags 0xd0 [ 42.520000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x40) flags 0x150 [ 42.530000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x800) flags 0x10080 [ 42.540000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x2000) flags 0x20080 [ 42.540000] ol_regdmn_init_channels: !avail mode 0x1f9001 (0x4000) flags 0x40080 [ 42.550000] Add VHT80 channel: 5210 [ 42.550000] Add VHT80 channel: 5290 [ 42.560000] Add VHT80 channel: 5530 [ 42.560000] Add VHT80 channel: 5610 [ 42.720000] ath_ioctl: SIOC80211IFCREATE CALLED [ 42.720000] wmi_unified_vdev_create_send: ID = 0 VAP Addr = 50:c7:bf:6d:83:fb: [ 42.730000] Setting dscp for vap id: 0 [ 42.740000] VAP device ath1 created osifp: (83bc7b80) os_if: (8184c000) [ 42.800000] Set freq vap stop send + 8184c000 [ 42.810000] OL vap_stop + [ 42.810000] wmi_unified_vdev_stop_send for vap 0 (820f0000) [ 42.820000] OL vap_stop - [ 42.820000] STOPPED EVENT for vap 0 (820f0000) [ 42.820000] Set freq vap stop send -8184c000 [ 42.960000] Set wait done --8184c000 [ 42.970000] Set freq vap stop send + 8184c000 [ 42.980000] OL vap_stop + [ 42.980000] wmi_unified_vdev_stop_send for vap 0 (820f0000) [ 42.990000] OL vap_stop - [ 42.990000] STOPPED EVENT for vap 0 (820f0000) [ 43.000000] Set freq vap stop send -8184c000 [ 43.130000] Set wait done --8184c000 [ 43.180000] WARNING: Fragmentation with HT mode NOT ALLOWED!! [ 43.200000] Set freq vap stop send + 8184c000 [ 43.210000] OL vap_stop + [ 43.210000] wmi_unified_vdev_stop_send for vap 0 (820f0000) [ 43.220000] OL vap_stop - [ 43.220000] STOPPED EVENT for vap 0 (820f0000) [ 43.220000] Set freq vap stop send -8184c000 [ 43.360000] Set wait done --8184c000 [ 43.420000] ol_ath_desc_alloc_and_mark_for_mcast_clone: VAP Mcast to Unicast buffer allocated: 400 [ 43.430000] ol_ath_vap_set_param: VAP param is now supported param:66 value:2 [ 43.520000] [ 43.520000] DES SSID SET= [ 43.530000] [ 43.530000] DES SSID SET=REDACTED @@@@@@@@@@wpa-psk2/aes [ 43.950000] ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 [ 43.950000] DEVICE IS DOWN ifname=ath1 [ 43.960000] DEVICE IS DOWN ifname=ath1 [ 44.600000] device ath0 entered promiscuous mode [ 44.790000] br-lan: port 2(ath0) entered forwarding state [ 44.790000] br-lan: port 2(ath0) entered forwarding state [ 44.800000] ar9300_override_ini 3402 ETSI [ 44.810000] 8021q: adding VLAN 0 to HW filter on device ath0 [ 44.830000] device ath1 entered promiscuous mode [ 44.850000] OL vap_stop + [ 44.850000] wmi_unified_vdev_stop_send for vap 0 (820f0000) [ 44.860000] OL vap_stop - [ 44.860000] STOPPED EVENT for vap 0 (820f0000) [ 45.000000] wmi_unified_scan_start_send for vap 0 (820f0000) [ 45.000000] br-lan: port 3(ath1) entered forwarding state [ 45.010000] br-lan: port 3(ath1) entered forwarding state [ 45.010000] 8021q: adding VLAN 0 to HW filter on device ath1 [ 45.040000] [wifi1] FWLOG: [48845] WAL_DBGID_SECURITY_ENCR_EN ( ) [ 45.050000] [wifi1] FWLOG: [48845] WAL_DBGID_SECURITY_MCAST_KEY_SET ( 0x1 ) [ 46.200000] OL vap_start + [ 46.210000] wmi_unified_vdev_start_send for vap 0 (820f0000) [ 46.210000] OL vap_start - [ 46.220000] ol_vdev_start_resp_ev for vap 0 (820f0000) [ 46.220000] ol_ath_vap_join: join operation is only for STA/IBSS mode [ 46.230000] ol_ath_wmm_update: [ 46.230000] wmi_unified_vdev_up_send for vap 0 (820f0000) [ 46.240000] Notification to UMAC VAP layer [ 47.540000] ar9300_override_ini 3402 ETSI [ 47.570000] mlme_create_infra_bss : Overriding HT40 channel with HT20 channel [ 47.590000] ar9300_override_ini 3402 ETSI [ 47.600000] ar9300_override_ini 3402 ETSI snmpd start... enable off. [ 51.850000] ar9300_override_ini 3402 ETSI [ 55.860000] ar9300_override_ini 3402 ETSI [ 59.870000] ar9300_override_ini 3402 ETSI [ 63.880000] ar9300_override_ini 3402 ETSI >>>>>>>>>> PRESS ENTER <<<<<<<<<< BusyBox v1.19.4 (2016-10-27 10:15:18 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. MM NM MMMMMMM M M $MMMMM MMMMM MMMMMMMMMMM MMM MMM MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM' MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM MMMMMM MMMMN M MMMMMMMMM MMMM MMMM MMMM M MMMMMMM M M M --------------------------------------------------------------- For those about to rock... (%C, %R) --------------------------------------------------------------- root@AP200:/#
OpenWrt bootlog
[ 0.000000] Linux version 6.12.69 (#####) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r33027-708dcca80a) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 Sat Feb 14 22:23:23 2026 [ 0.000000] printk: legacy bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc) [ 0.000000] MIPS: machine is TP-Link AP200 [ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff] [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2 [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16384 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1. [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 775.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns [ 0.000001] sched_clock: 32 bits at 388MHz, resolution 2ns, wraps every 5541893118ns [ 0.008280] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216) [ 0.074799] pid_max: default: 32768 minimum: 301 [ 0.086897] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.094627] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.111617] Memory: 56940K/65536K available (4766K kernel code, 538K rwdata, 764K rodata, 1220K init, 197K bss, 8140K reserved, 0K cma-reserved) [ 0.129029] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.139465] futex hash table entries: 256 (order: 0, 3072 bytes, linear) [ 0.150848] pinctrl core: initialized pinctrl subsystem [ 0.158836] NET: Registered PF_NETLINK/PF_ROUTE protocol family [ 0.179245] clocksource: Switched to clocksource MIPS [ 0.194595] NET: Registered PF_INET protocol family [ 0.200065] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.208527] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.217525] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear) [ 0.225726] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.233830] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear) [ 0.241315] TCP: Hash tables configured (established 1024 bind 1024) [ 0.248175] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.255145] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.263232] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 0.269294] PCI: CLS 0 bytes, default 32 [ 0.276381] workingset: timestamp_bits=30 max_order=14 bucket_order=0 [ 0.283653] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.289849] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.305665] pinctrl-single 1804002c.pinmux: 544 pins, size 68 [ 0.314946] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.322986] printk: legacy console [ttyS0] disabled [ 0.328828] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A [ 0.338108] printk: legacy console [ttyS0] enabled [ 0.348511] printk: legacy bootconsole [early0] disabled [ 0.374195] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.381167] Creating 4 MTD partitions on "spi0.0": [ 0.386141] 0x000000000000-0x000000010000 : "u-boot" [ 0.393715] 0x000000010000-0x000000020000 : "info" [ 0.400602] 0x000000020000-0x0000007f0000 : "firmware" [ 0.407761] 2 uimage-fw partitions found on MTD device firmware [ 0.413980] Creating 2 MTD partitions on "firmware": [ 0.419122] 0x000000000000-0x0000001e0000 : "kernel" [ 0.425661] 0x0000001e0000-0x0000007d0000 : "rootfs" [ 0.432209] mtd: setting mtd4 (rootfs) as root device [ 0.437559] 1 squashfs-split partitions found on MTD device rootfs [ 0.444010] 0x00000061b000-0x0000007d0000 : "rootfs_data" [ 0.451000] 0x0000007f0000-0x000000800000 : "art" [ 1.470038] ag71xx-legacy 19000000.eth: connected to PHY at mdio.0:04 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033] [ 1.482342] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii [ 1.491630] NET: Registered PF_INET6 protocol family [ 1.501944] Segment Routing with IPv6 [ 1.505852] In-situ OAM (IOAM) with IPv6 [ 1.510169] NET: Registered PF_PACKET protocol family [ 1.515432] 8021q: 802.1Q VLAN Support v1.8 [ 1.536799] PCI host bridge to bus 0000:00 [ 1.541111] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff] [ 1.548229] pci_bus 0000:00: root bus resource [io 0x0000] [ 1.554007] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.562289] pci 0000:00:00.0: [168c:0050] type 00 class 0x028000 PCIe Endpoint [ 1.569824] pci 0000:00:00.0: BAR 0 [mem 0x00000000-0x001fffff 64bit] [ 1.576533] pci 0000:00:00.0: ROM [mem 0x00000000-0x0000ffff pref] [ 1.583028] pci 0000:00:00.0: supports D1 [ 1.587179] pci 0000:00:00.0: PME# supported from D0 D1 D3hot [ 1.594481] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 1.601395] pci 0000:00:00.0: BAR 0 [mem 0x12000000-0x121fffff 64bit]: assigned [ 1.608980] pci 0000:00:00.0: ROM [mem 0x12200000-0x1220ffff pref]: assigned [ 1.623648] clk: Disabling unused clocks [ 1.637392] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 1.651307] Freeing unused kernel image (initmem) memory: 1220K [ 1.657442] This architecture does not have kernel memory protection. [ 1.664129] Run /sbin/init as init process [ 1.668363] with arguments: [ 1.668370] /sbin/init [ 1.668377] with environment: [ 1.668384] HOME=/ [ 1.668391] TERM=linux [ 2.282328] init: Console is alive [ 2.286308] init: - watchdog - [ 3.502804] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 3.542918] gpio_button_hotplug: loading out-of-tree module taints kernel. [ 3.554090] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 3.572202] init: - preinit - [ 7.059279] random: crng init done [ 11.961329] eth0: link up (1000Mbps/Full duplex) [ 12.032562] mount_root: no usable overlay filesystem found, using tmpfs overlay [ 12.044125] urandom-seed: Seed file not found (/etc/urandom.seed) [ 12.104099] eth0: link down [ 12.121713] procd: - early - [ 12.125015] procd: - watchdog - [ 12.707646] procd: - watchdog - [ 12.735221] procd: - ubus - [ 12.739933] procd: failed adding instance cgroup for ubus: No error information [ 12.794970] procd: - init - [ 13.771631] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.612673] zram: Added device: zram0 [ 14.635864] i2c_dev: i2c /dev entries driver [ 14.657863] Loading modules backported from Linux version v6.18.7-0-g5dfbc5357 [ 14.665399] Backport generated by backports.git c8a37ce [ 15.305456] PPP generic driver version 2.4.2 [ 15.330428] NET: Registered PF_PPPOX protocol family [ 15.430363] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002) [ 15.437029] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0 [ 15.669847] urngd: v1.0.2 started. [ 16.530799] ath10k_pci 0000:00:00.0: qca9887 hw1.0 target 0x4100016d chip_id 0x004000ff sub 0000:0000 [ 16.540401] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0 [ 16.551407] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00047 api 5 features no-p2p,ignore-otp,skip-clock-init,mfp,allows-mesh-bcast crc32 62f7565f [ 16.861998] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 546cca0d [ 18.234746] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal nvmem max-sta 128 raw 0 hwcrypto 1 [ 18.341011] ath: EEPROM regdomain: 0x0 [ 18.341044] ath: EEPROM indicates default country code should be used [ 18.341054] ath: doing EEPROM country->regdmn map search [ 18.341070] ath: country maps to regdmn code: 0x3a [ 18.341080] ath: Country alpha2 being used: US [ 18.341090] ath: Regpair used: 0x3a [ 18.467381] ath: EEPROM regdomain: 0x0 [ 18.467414] ath: EEPROM indicates default country code should be used [ 18.467424] ath: doing EEPROM country->regdmn map search [ 18.467441] ath: country maps to regdmn code: 0x3a [ 18.467451] ath: Country alpha2 being used: US [ 18.467461] ath: Regpair used: 0x3a [ 18.478266] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht' [ 18.479388] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0x8ceba6bf, irq=2 [ 18.500523] kmodloader: done loading kernel modules from /etc/modules.d/* [ 43.240502] br-lan: port 1(eth0) entered blocking state [ 43.245943] br-lan: port 1(eth0) entered disabled state [ 43.251455] ag71xx-legacy 19000000.eth eth0: entered allmulticast mode [ 43.258506] ag71xx-legacy 19000000.eth eth0: entered promiscuous mode [ 46.361262] eth0: link up (1000Mbps/Full duplex) [ 46.366126] br-lan: port 1(eth0) entered blocking state [ 46.371598] br-lan: port 1(eth0) entered forwarding state [ 48.130864] jffs2_scan_eraseblock(): End of filesystem marker found at 0x5000 [ 48.138348] jffs2_build_filesystem(): unlocking the mtd device... [ 48.138369] done. [ 48.146787] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 67.859842] done. [ 67.869613] jffs2: notice: (2078) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 68.072497] overlayfs: upper fs does not support tmpfile.
Trivia
The AP200 (AC750) has a sister model called AP300 (AC1200). Despite the naming and optical similarities, the AP300 is powered by Broadcom SoC and networking hardware. Therefore, the AP300 is not compatible with the AP200's software stack.





