Aerohive HiveAP 120 Wireless Access Point

Research Links

• Aerohive Without Manager  Archived version
• https://community.aerohive.com/aerohive/topics/configuring-2-ssids-on-separate-vlans-using-cli
• Aerohive deployment guide pdf
• Aerohive deployment guide v2 pdf
• Aerohive Command Line Interface Guide   Local version
• Aerohive HiveAP 330
• Aerohive HiveAP Initial (Guided) Configuration​  – gives an idea of what to imitate if you are using CLI instead of their online tool
• Inside AP120 Hardware
• List of router firmware projects
• Aerohive HiveAP 170
• AeroHive Quick Start 100 series

Purchasing Links

• Ebay: 48 volt poe

Aerohive AP120 Chipset Information

• AR7161 Atheros wireless network processor
• WikiDevi: List of router / access points with AR7161
• AR7100: A Scalable Network Processor Family  – full datasheet for 7100 family including 7161 with block diagram that includes the AR9160
• AR7100_datasheet
• DNMA-92 MiniPCI WiFi Card Specifications – has 9220 chip
• Unex DNMA-92 – has a link to drivers on page
• unex.com.tw: DNMA-92
• Flash Memory FL128 128-Mbit, 3.0 V Flash Memory

   _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|      

          |__| W I R E L E S S   F R E E D O M

 

OpenWrt is described as a Linux distribution for embedded devices.Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows you to customize the device through the use of packages to suit any application. For developer, OpenWrt is the framework to build an application without having to build a complete firmware around it; for users this means the ability for full customization, to use the device in ways never envisioned.

  The big chip next to the ethernet ports is a VSC7385 – SparX-G5™ – 5-port Integrated Gigabit Ethernet Switch

PB44 Notes

• Atheros PB44 – Reference design for the AR7161 – has dual slots for dual band operation.  Suggests high similarity with Aerohive 120 board.  See image below.    They have instructions how to install OpenWRT on this.
• LEDE Project: PB44  –  The LEDE Project (“Linux Embedded Development Environment”) is a Linux operating system based on OpenWrt. It is a complete replacement for the vendor-supplied firmware of a wide range of wireless routers and non-network devices. See the Table of Hardware for supported devices. For more information about LEDE Project organization, see the About LEDE pages.
• CONFIG_ATH79_MACH_PB44: Atheros PB44 reference board
• linux/arch/mips/ath79/Kconfig
• PB44 Flash Memory DataSheet:  S25FL064P
• Cypress Semi: S25FL064P
• VSC7385 – SparX-G5™ – 5-port Integrated Gigabit Ethernet Switch – DataSheet #1
• VSC7385 – SparX-G5™ – 5-port Integrated Gigabit Ethernet Switch – DataSheet #2

 

Photos inside AeroHive 120

 

Flashing Firmware Onto Aerohive Ap 120

Flashing Research Links

• Copy Router Firmware in Flash Memory using a TFTP Tool
• AeroHive support portal – they have a 30 day free trial 
• Local: Firmware-Upgrade-Using-Online-Tool-With-Some-CLI-Talk     
• Original Location: Firmware-Upgrade-Using-Online-Tool-With-Some-CLI-Talk
• Local: How-Flash-AP-121-with-TFTP   
• Original Location: How to Flash AP 121 with TFTP

OpenWRT

• OpenWRT: Adding new device support  – GPL license violation form letter is on this page
• OpenWRT: Adding new platform support

Building DD-WRT

• DD-WRT: Supported Devices
• DD-WRT: Development
• SVN.DD-WRT
• DD-WRT:Forums
• DD-WRT: Router Support Detection — this is the process by which you submit your device on the forums for possible support.
• MIPS assembler on Linux
• All toolchains are now in one package:   wget ftp://ftp.dd-wrt.com/toolchains/toolchains.tar.xz 

DD-WRT Forum Submission Data

• DD-WRT Forum: AeroHive 120 (no version shown) – New Model Support
• AR7161 Atheros wireless network processor
• Flash Memory FL128 128-Mbit, 3.0 V Flash Memory
• P3S12D40ETP  32 X 16M – G5 400MHz DDR Mira
• AT97SC3203 – Crypto controller on the antenna board – System OverView   –  Trusted Platform Module (TPM)
• DD-WRT Forum: AeroHive 120 (no version shown) – New Model Support

TPM Module Notes

• Aerohive: TPM function article  
• 
• Atmel TPM I2C/SPI Development Kit – AT97SC3205P-SDK2 

 

Images submitted to DD WRT Forum

JTAG Pinout – J2

• JTAG_ENABLE      J2-14  
• TDI                        J2-3    
• TDO                      J2-5    
• TMS                      J2-7       
• TCK                      J2-9     
• TRST_L                 J2-1     

UART PinOut J1 – AR7100 has a single Tx/Rx UART port with 16550 equivalent debug / console

• UART_SOUT    JP1-5
• UART_SIN       JP1-3
• Ground            JP1-6

Flash Memory – Original FirmWare

• U91 – Orange Dot Chip – From Top of Board 
• U94 – Green Dot Chip – From Bottom of Board

Entering U-Boot at power up

• Connect console cable using the pinout for the UART shown above
• Open Putty and select serial and the com port corresponding to your link
• Power up the unit
• When the space bar 4 second count down notice comes up hit the space bar as instructed to stop the normal boot sequence.
• When prompted for the password enter:  aerohive
• If the password is correct for your unit prompt will come up as   boot>