User Tools

Site Tools


toh:aruba:aruba_ap-105

Aruba AP-105

The Aruba AP-105 is a small Atheros based AP that has 2x wireless chips for 2.4GHz and 5GHz operation. It is a PoE AP that normally requires the use of a wireless controller device. Surprisingly, this device packs a 16MiB SPI flash chip as well as 128MiB of RAM.

Generic Router

Supported Versions

Hardware Highlights

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
AP-105Atheros AR716168016128Atheros AR9223, Atheros AR9220b/g/na/n-1--

Installation

Installing U-Boot

Note that the stock bootloader on this device does not allow for unsigned kernels to boot, so replacing the bootloader is required for OpenWRT support on this device. Sadly at this time the only way to do this is via directly writing to the SPI Flash. The custom U-Boot for this device can be downloaded from https://github.com/chunkeey/u-boot-ap105/releases and extracted from the latest release .tar.gz file.

It is HIGHLY recommend that before doing anything, you take a full backup of the SPI Flash.

To flash the SPI NOR, a 16 pin Test Clip is recommended. One such example is the Pomona Electronics 5252. Note you will need to manually wire up said test clip to a flashing tool or device, such as a Raspberry Pi.

Generic Process

If you are not using flashrom, then you will need to do the following with whatever tool you are using:

  1. Create a full dump of the SPI Flash, and store it in a safe place
  2. Erase and Clear 0x0-0x3ffff on the SPI Flash
  3. Flash U-Boot to 0x0
  4. Proceed to the OpenWRT Install Procedure

Flashrom Process

If you prefer to have a walkthrough guide of doing this with flashrom, please follow the below steps:

Note that the below install steps assumes a few things:

  • That you are using flashrom to read/write to the SPI flash
  • That your SPI reader is a linux SPI Dev (ex, a Raspberry Pi wired to the SPI Flash)

1. Create a full dump of the SPI Flash, and store it in a safe place

flashrom -r AP105-stock-SPI-dump.rom -p linux_spi:dev=/dev/spidev0.0 -c MX25L12835F/MX25L12845E/MX25L12865E

2. Create a copy of your SPI Flash dump for us to modify

cp ./stock-dump.rom ./custom-dump.rom

3. Erase the stock bootloader from the start of the image

dd if=/dev/zero bs=256K count=1 | tr "\000" "\377" | dd of=custom-dump.rom conv=notrunc

4. Apply u-Boot to the image

dd if=u-boot.bin of=custom-dump.rom conv=notrunc

5. Flash the new modified image back to the device

flashrom -w custom-dump.rom -p linux_spi:dev=/dev/spidev0.0 -c MX25L12835F/MX25L12845E/MX25L12865E

Installing OpenWrt

Note that installing OpenWRT requires that you have installed the custom U-Boot first.

  1. Wire up the Aruba AP-105 to an Ethernet port on your computer, and set that port to a static IP of 192.168.1.101
  2. Start a TFTP server on your computer, and in your tftp root copy your OpenWRT sysupgrade.bin file to firmware.bin
  3. Power on the AP-105, and hold the reset button on the back. Continue to hold it until you see both wireless LEDs blink red.
  4. At this point, the AP will download and install OpenWRT. Watch the console to confirm OpenWRT has been flashed then reboot. If you do not have console access, wait 5 minutes before power cycling the device.
  5. You should now have OpenWRT installed on the device!

Failsafe mode

Thanks to the custom U-Boot, the reset button can be used to tftpload a new firmware to the device at anytime. To do so, set your computer to a static IP of 192.168.1.101 and wire it directly to the access point. While the access point powers on, hold the reset button until you see the WLAN LEDs both flash red. At this point, U-Boot will attempt to tftpload a file named firmware.bin and flash it to the device. This can be useful for recovering a corrupt upgrade/install.

Reverting to the Stock Firmware

As long as you have a full SPI Flash backup available, you can install it back to your device at anytime through U-Boot. To do this, setup your local computer with a Static IP of 192.168.1.101 and a tftpserver. Next, place a copy of your SPI backup in the root of your tftp server and rename it ap-105-stock.bin. Now power on your AP-105 and with a console cable, interrupt boot to access the u-boot shell. Once here, run the following command to revert back to the Stock Firmware:

run loadStock; reset;

Specific configuration

Network interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN 192.168.1.1/24
wl0 WiFi Disabled
wl1 WiFi Disabled

Note that to configure this device as an AP, you will want to configure br-lan to be either static, or a DHCP client. You may also want to consider using a VLAN for WAN connectivity if you plan to run NAT/DHCP.

Buttons

hardware.button on howto use and configure the hardware button(s).

The Aruba AP-105 has the following buttons:

BUTTON OpenWRT Event U-Boot Event
Reset Reboot/Reset Config Flash firmware.bin from TFTP server at 192.168.1.101

Hardware

Info

Architecture MIPS
Vendor Aruba
Bootloader Custom U-Boot
System-On-Chip Atheros AR7161-8C1A
CPU/Speed 680 MHz
Flash-Chip MXIC MX25L12845EMI-10G
Flash size 16 MiB
RAM 128MiB - 2x Etron Technology EM6AB160TSA-5G
Wireless Atheros AR9220-AC1A, Atheros AR9223-AC1A
Ethernet Atheros AR8021-BL1E 10/100/1000 PoE
USB No
Serial Yes
JTAG Not populated

Flash Layout

Aruba AP-105 Flash Layout
Layer0 raw NOR flash memory chip (MXIC MX25L12845EMI-10G spi0.0) 16384 KiB
Layer1 mtd0 u-boot 256 KiB mtd1 firmware 16000 KiB mtd5 hwinfo 64 KiB mtd6 u-boot-env 64 KiB
Layer2 mtd2 kernel 1600 KiB mtd3 rootfs 14400 KiB
mountpoint /
filesystem OverlayFS
Layer3 mtd4 rootfs_data 11136 KiB
Size in KiB 128 KiB 1600 KiB 3264 KiB 11136 KiB 64 KiB 64 KiB
Name u-boot kernel rootfs_data hwinfo u-boot-env
mountpoint none none /rom /overlay none none
filesystem none none SquashFS JFFS2 none none

Photos

Opening the case

To Open the AP-105, just remove the 4x T6 screws from the back and the case splits in two.

Serial

port.serial general information about the serial port, serial port cable, etc.

Note that the AP-105 has a Cisco Console Cable style Console port on the back of the device. To use, just connect a Cisco console cable and use the configuration mentioned below.

Serial connection parameters for Aruba AP-105 9600, 8N1

Bootlogs

OEM bootlog

APBoot 1.2.4.4 (build 26618) Built: 2011-01-07 at 13:42:04 Model: AP-10x CPU: AR7161 revision: A2 Clock: 680 MHz, DDR clock: 340 MHz, Bus clock: 170 MHz DRAM: 128 MB POST1: passed Copy: done Flash: 16 MB PCI: scanning bus 0 ... dev fn venID devID class rev MBAR0 MBAR1 MBAR2 MBAR3 00 00 168c 0029 00002 01 10000000 00000000 00000000 00000000 01 00 168c 0029 00002 01 10010000 00000000 00000000 00000000 Net: eth0 Radio: ar922x#0, ar922x#1 Hit <Enter> to stop autoboot: 0 Checking image @ 0xbf100000 Invalid image format version: 0xffffffff Checking image @ 0xbf800000 Image is signed; verifying checksum... passed Signer Cert OK Policy Cert OK RSA signature verified. ELF file is 32 bit Loading .text @ 0x80e00000 (5034552 bytes) Loading .data @ 0x812cd240 (32 bytes) Clearing .bss @ 0x812cd260 (16 bytes) ## Starting application at 0x80e00000 ... Uncompressing............................................... Aruba Networks ArubaOS Version 6.5.3.3 (build 61785 / label #61785) Built by p4build@chios on 2017-10-06 at 03:44:12 PDT (gcc version 4.3.3) CPU Rev: aa 71x CPU Flash variant: default Cache parity protection disabled Using 340.000 MHz high precision timer. cycles_per_jiffy=680000 Memory: 121344k/131072k available (1720k kernel code, 9656k reserved, 791k data, 4252k init, 0k highmem) available. detected lzma initramfs initramfs: LZMA lc=3,lp=0,pb=2,dictSize=8388608,origSize=20537344 LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com> .......................................................................................................................................................................................................................................................................................................................... AR7100 GPIOC major 0 wdt: registered with refresh Enabling Watchdog Talisker RSSI LED initialization Creating 1 MTD partitions on "ar7100-nor0": 0x00000000-0x01000000 : "flash" i2c /dev entries driver i2c-talisker: using default base 0x18040000 AD7416 driver probing for devices on AR7100 I2C .<6>lo: Disabled Privacy Extensions IPv6 over IPv4 tunneling driver Starting Kernel SHA1 KAT ...Completed Kernel SHA1 KAT Starting Kernel HMAC-SHA1 KAT ...Completed Kernel HMAC-SHA1 KAT Starting Kernel DES KAT ...Completed Kernel DES KAT Starting Kernel AES KAT ...Completed Kernel AES KAT Starting Kernel AESGCM KAT ...Completed Kernel AESGCM KAT Domain Name: arubanetworks.com No panic info available apfcutil: sector CACHE: Cache uninitialized apfcutil: sector FAT: Cache uninitialized Testing TPM... Passed apfcutil: sector RAP: Cache uninitialized apfcutil -c RAP: Uninitialized. Initializing......... apfcutil: sector MESH Prov: Cache uninitialized ag7100_mod: module license 'unspecified' taints kernel. AG7100: Length per segment 512 AG7100: Max segments per packet 4 AG7100: Max tx descriptor count 400 AG7100: Max rx descriptor count 252 AG7100: fifo cfg 3 018001ff AG7100CHH: Mac address for unit 0 AG7100CHH: d8:c7:c8:c9:6d:2a AG7100: cfg1 0xf cfg2 0x7014 ATHRF1: Port 0, Neg Success ATHRF1: unit 0 phy addr 0 ATHRF1: reg0 3100 AP xml model 39, num_radios 2 (jiffies 13187) apType 39 hw_opmode 0 radio 0: band 1 ant 0 max_ssid 8 radio 1: band 0 ant 0 max_ssid 8 init_asap_mod: installation:0 firewall cpu: core-0 Starting watchdog process... Getting an IP address... ag7100_ring_alloc Allocated 4800 at 0x81238000 ag7100_ring_alloc Allocated 3024 at 0x87b82000 AG7100: cfg1 0xf cfg2 0x7014 ATHRF1: Port 0, Neg Success ATHRF1: unit 0 phy addr 0 ATHRF1: reg0 3100 AG7100: unit 0 phy is up...RGMii 1000Mbps full duplex AG7100: pll reg 0x18050010: 0x110000 AG7100: cfg_1: 0x1ff0000 AG7100: cfg_2: 0x3ff AG7100: cfg_3: 0x18001ff AG7100: cfg_4: 0xffff AG7100: cfg_5: 0xfffef AG7100: done cfg2 0x7215 ifctl 0x0 miictrl 0x22 Writing 4 10.27.XXX.XXX 255.255.255.0 10.27.XXX.XXX Running ADP...


OpenWrt bootlog

U-Boot 1.1.4-g87c722ab (May 11 2019 - 01:56:21) AP-10x (ar7100) U-boot 0.0.1 DRAM: 128 MB Flash: 16 MB In: serial Out: serial Err: serial Net: ag7100_enet_initialize... ATHRF1E: Port 0, Neg Success ATHRF1E: unit 0 phy addr 0 ATHRF1E: reg0 1000 eth0: d8:c7:c8:c9:6d:33 eth0 up eth0 RESET is un-pushed Hit any key to stop autoboot: 0 ## Booting image at bf040000 ... Image Name: MIPS OpenWrt Linux-4.14.114 Created: 2019-05-05 17:56:03 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1616848 Bytes = 1.5 MB Load Address: 80060000 Entry Point: 80060000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 4.14.114 (riptide_wave@Not-A-Desktop) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9933+1-1325e74e0c)) #0 Sun May 5 17:56:03 2019 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc) [ 0.000000] MIPS: machine is Aruba AP-105 [ 0.000000] SoC: Atheros AR7161 rev 2 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: console=ttyS0,9600 rootfstype=squashfs,jffs2 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 123184K/131072K available (3783K kernel code, 145K rwdata, 912K rodata, 1232K init, 204K bss, 7888K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 51 [ 0.000000] CPU clock: 680.000 MHz [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5621354254 ns [ 0.000008] sched_clock: 32 bits at 340MHz, resolution 2ns, wraps every 6316128254ns [ 0.092798] Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992) [ 0.227845] pid_max: default: 32768 minimum: 301 [ 0.283302] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.362456] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.450269] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.567973] futex hash table entries: 256 (order: -1, 3072 bytes) [ 0.640973] pinctrl core: initialized pinctrl subsystem [ 0.704215] NET: Registered protocol family 16 [ 1.061835] PCI host bridge /ahb/apb/pcie-controller@17010000 ranges: [ 1.139001] MEM 0x0000000010000000..0x0000000016ffffff [ 1.201548] IO 0x0000000000000000..0x0000000000000000 [ 1.277198] PCI host bridge to bus 0000:00 [ 1.326199] pci_bus 0000:00: root bus resource [mem 0x10000000-0x16ffffff] [ 1.408487] pci_bus 0000:00: root bus resource [io 0x0000] [ 1.475212] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 1.556510] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.651914] pci 0000:00:11.0: BAR 0: assigned [mem 0x10000000-0x1000ffff] [ 1.733190] pci 0000:00:12.0: BAR 0: assigned [mem 0x10010000-0x1001ffff] [ 1.816655] clocksource: Switched to clocksource MIPS [ 1.877972] NET: Registered protocol family 2 [ 1.930790] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 2.014160] TCP bind hash table entries: 1024 (order: 0, 4096 bytes) [ 2.090213] TCP: Hash tables configured (established 1024 bind 1024) [ 2.166431] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 2.236281] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 2.311509] NET: Registered protocol family 1 [ 2.366062] Crashlog allocated RAM at address 0x3f00000 [ 2.429691] workingset: timestamp_bits=30 max_order=15 bucket_order=0 [ 2.510792] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 2.580620] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 2.704330] io scheduler noop registered [ 2.751236] io scheduler deadline registered (default) [ 2.813522] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 2.890162] console [ttyS0] disabled [ 2.933020] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 10, base_baud = 10625000) is a 16550A [ 3.038208] console [ttyS0] enabled [ 3.038208] console [ttyS0] enabled [ 3.121642] bootconsole [early0] disabled [ 3.121642] bootconsole [early0] disabled [ 3.222170] m25p80 spi0.0: mx25l12805d (16384 Kbytes) [ 3.282802] 4 fixed-partitions partitions found on MTD device spi0.0 [ 3.358881] Creating 4 MTD partitions on "spi0.0": [ 3.416295] 0x000000000000-0x000000040000 : "u-boot" [ 3.476482] 0x000000040000-0x000000fe0000 : "firmware" [ 3.540244] 2 uimage-fw partitions found on MTD device firmware [ 3.611160] Creating 2 MTD partitions on "firmware": [ 3.670617] 0x000000000000-0x000000190000 : "kernel" [ 3.730770] 0x000000190000-0x000000fa0000 : "rootfs" [ 3.790822] mtd: device 3 (rootfs) set to be root filesystem [ 3.858742] 1 squashfs-split partitions found on MTD device rootfs [ 3.932758] 0x0000004c0000-0x000000fa0000 : "rootfs_data" [ 3.998058] 0x000000fe0000-0x000000ff0000 : "hwinfo" [ 4.058229] 0x000000ff0000-0x000001000000 : "u-boot-env" [ 4.123344] libphy: Fixed MDIO Bus: probed [ 4.508363] libphy: ag71xx_mdio: probed [ 4.555618] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:00 [uid=004dd04e, driver=Generic PHY] [ 4.666754] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii [ 4.742593] NET: Registered protocol family 10 [ 4.799630] Segment Routing with IPv6 [ 4.843592] NET: Registered protocol family 17 [ 4.896857] 8021q: 802.1Q VLAN Support v1.8 [ 4.953793] VFS: Mounted root (squashfs filesystem) readonly on device 31:3. [ 5.041994] Freeing unused kernel memory: 1232K [ 5.096237] This architecture does not have kernel memory protection. [ 5.883482] init: Console is alive [ 5.924459] init: - watchdog - [ 6.346695] random: fast init done [ 6.755406] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 6.906145] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 7.003108] init: - preinit - [ 7.958064] random: jshn: uninitialized urandom read (4 bytes read) [ 8.224865] random: jshn: uninitialized urandom read (4 bytes read) [ 8.329578] random: jshn: uninitialized urandom read (4 bytes read) [ 8.565138] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 9.657155] eth0: link up (1000Mbps/Full duplex) [ 9.714347] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 11.962819] jffs2: notice: (420) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (0 unchecked, 2 orphan) and 2 of xref (2 dead, 0 orphan) found. [ 12.148600] mount_root: switching to jffs2 overlay [ 12.229308] overlayfs: upper fs does not support tmpfile. [ 12.299555] urandom-seed: Seeding with /etc/urandom.seed [ 12.514931] eth0: link down [ 12.559458] procd: - early - [ 12.594130] procd: - watchdog - [ 13.233163] procd: - watchdog - [ 13.271551] procd: - ubus - [ 13.374255] urandom_read: 5 callbacks suppressed [ 13.374262] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.567400] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.645889] procd: - init - Please press Enter to activate this console. [ 13.981682] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.063702] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 14.134779] i2c /dev entries driver [ 14.179988] i2c-gpio i2c: using pins 5 (SDA) and 4 (SCL) [ 14.248545] Loading modules backported from Linux version v4.19.32-0-g3a2156c839c7 [ 14.339339] Backport generated by backports.git v4.19.32-1-0-g1c4f7569 [ 14.420181] ip_tables: (C) 2000-2006 Netfilter Core Team [ 14.491154] nf_conntrack version 0.5.0 (2048 buckets, 8192 max) [ 14.611908] xt_time: kernel timezone is -0000 [ 14.709015] PPP generic driver version 2.4.2 [ 14.762369] NET: Registered protocol family 24 [ 14.844724] PCI: Enabling device 0000:00:11.0 (0000 -> 0002) [ 15.718650] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xb0000000, irq=14 [ 15.798160] PCI: Enabling device 0000:00:12.0 (0000 -> 0002) [ 16.674394] ieee80211 phy1: Atheros AR9280 Rev:2 mem=0xb0010000, irq=15 [ 17.469743] kmodloader: done loading kernel modules from /etc/modules.d/* BusyBox v1.30.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r9933+1-1325e74e0c ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/# [ 27.915939] br-lan: port 1(eth0) entered blocking state [ 27.978624] br-lan: port 1(eth0) entered disabled state [ 28.041447] device eth0 entered promiscuous mode [ 28.304808] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 32.057156] eth0: link up (1000Mbps/Full duplex) [ 32.112683] br-lan: port 1(eth0) entered blocking state [ 32.175287] br-lan: port 1(eth0) entered forwarding state [ 32.241928] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 132.546705] random: crng init done root@OpenWrt:/#


Notes

While the device does have an i2c TPM, there is currently no mainline linux driver for this specific model. (Atmel AT97SC3203S TPM)

Tags

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
toh/aruba/aruba_ap-105.txt · Last modified: 2019/08/10 22:40 by tmomas