Adding OpenWrt support for Apple Airport Extreme & Time Capsule ( Kirkwood )

For Developers
1

Hi there,
I'm looking if is there any way to port openwrt to the apple kirkwood based devices (apple A1408 & A1409, A1354 & A1355) ..
It's using a netbsd 4 os and an ssh root access is easily available.
The hardware side is :
kirkwood Marvell CPU 88F6281 1.2Ghz
Flash : 16 MB ( Macronix MX25L12845EMI-10G)
RAM : 128 MB ( Hynix H5PS1G83EFR) (256 on Time Machine version)
Ethernet chip : Marvell 88E6350R (up to 7 ports)
4 gigabits port, 1 USB 2.0, 1 mini PCIe and of course 1 SATA port on the Time Machine version
It comes with a (BCM4331) Broadcom BCM94331 PCIEDUAL with 4 antenna
12v 1.8A for the A1408 & A1409, and a Marvell 88W8366 for the A1354 & 1355
Could you confirm me the way to follow ?
I guess the first step would be to build a new u-boot and use existing kirkwood target to build something ?
it really sounds as attractive hardware and the wifi could be easily updated to something newer. The device is largely spread worldwide and as apple dropped his support for these devices, it could get the interest of a lot of owner and could avoid the coming waste due to the disaffection of thousand of these devices..
any advises, clues or help would be very much appreciated ! :smiley:

ed.

cpucnt0 at mv_socbus0 unit -1 **** counter 0 event = 6
 **** counter 1 event = 2
 **** counter 2 event = 1
 **** counter 3 event = 2
mv_mgitool() was matched.
mgitool0 at mv_socbus0 unit -1mvcesa0 at mv_socbus0 unit -1mvCesaInit: sessions=640, queue=32, pSram=0xf0000000
mv_sata_integ0 at mv_socbus0 unit -1
found SATA device 6281 revision 3
mv_sata_integ0: interrupting at 21
 channel 0 request q phy addr 1cc2000
 channel 0 response q phy addr 1cc3000
 channel 1 request q phy addr 1cc4000
 channel 1 response q phy addr 1cc5000
scsibus0 at mv_sata_integ0 channel 0: 15 targets, 1 lun per target
scsibus1 at mv_sata_integ0 channel 1: 15 targets, 1 lun per target
applgpio0 at mv_socbus0 unit -1GPIO_interrupt_pin_ex: flipping pin 49.
GPIO_interrupt_pin_ex: flipping pin 11.
 (board-revision=0)
mv_pcibus0 at mainbus0
mv_pcibus_attach()
PEX0 interface detected Link X1
mv_pcibus0: configuring PCI interface 0
pci0 at mv_pcibus0 bus 0
pci0: i/o space, memory space enabled
ppb0 at pci0 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled
ppb1 at pci1 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled
bwl0 at pci2 dev 0 function 0wlan: mac acl policy registered
bwl0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
bwl0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl0: 11ng MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps

bwl0: interrupting at pci0int09
ppb2 at pci1 dev 2 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled
bwl1 at pci3 dev 0 function 0bwl1: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl1: 11na MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps

bwl1: interrupting at pci0int09
obio0 at mainbus0
com0 at obio0 addr 0xf1012000 irq 33: ns16550a, working fifo
com0: console
com1 at obio0 addr 0xf1012100 irq 34: ns16550a, working fifo
nandflash0 at obio0 addr 0xfa000000-0xfa0fffffflashattach: no device found
stdflash0 at obio0 addr 0xf4000000-0xf4ffffff: onboard SPI NOR flash
FLASH look for .... 0) ef/4018/20/2018
FLASH look for .... 1) ef/4018/c2/2017
FLASH look for .... 2) ef/4018/c2/2018
FLASH look for .... 3) ef/4018/c2/2013
FLASH look for .... 4) ef/4018/ef/4018
FLASH look for .... 5) ef/4018/1/2018
FLASH SUPPORTED.... ef/4018/4/0
flash0 at stdflash0 00200000-00900000, untranslated, read/write
flash1 at stdflash0 00900000-01000000, untranslated, read/write
flash2 at stdflash0 000c0000-00200000, translated, read/write
flash3 at stdflash0 00080000-000c0000, untranslated, read/write
flash4 at stdflash0 00000000-00080000, untranslated, read/write
clock: hz=100 stathz=0 profhz=0, mvTclk=200000000
md0: internal 10240 KB image area
IPsec: Initialized Security Association Processing.
scsibus0: waiting 2 seconds for devices to settle...
scsibus1: waiting 2 seconds for devices to settle...
ehci0: bus-powered device addr 2 (config 1) power 200 mA. Available power 500 mA (non-root)
umass0 at uhub0 port 1 configuration 1 interface 0
umass0: Dane-Elec z-PEN, rev 2.00/1.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus2 at umass0: 2 targets, 1 lun per target
sd0 at scsibus2 target 0 lun 0: <DaneElec, z-PEN, 5.00> disk removable
sd0: 1967 MB, 7868 cyl, 16 head, 32 sec, 512 bytes/sect x 4028416 sectors
sd0: GPT GUID: e1c598c1-24af-4774-a598-151379677b5b
dk0 at sd0: 81d9aa3b-7a31-4169-93ae-491e29111f2d
dk0: 3766192 512-byte sectors at 40, type: hfs
boot device: <unknown>
root on md0a dumps on md0b
root file system type: ffs
WARNING: clock gained 341 days
WARNING: CHECK AND RESET THE DATE!
mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
mgi_init: ifp=0xc237603c, sc=0xc2376000
mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
3 Likes
2

Check if the current u-boot support booting one of the generic Kirkwood images

1 Like
3

The tools which allow to enable the sshd seems to also handle a firmware flash, do you mean i should just try to use the script with a kirkwood openwrt build and cross my fingers ? :astonished:
I will try to find the closest device from the supported kirkwood list, just hope it will just work or reject the flash.. because i don't know if the airport utility software (win, mac, ios) which normally operates the up/downgrade will be helpful if something going wrong.. (I will start try to get a copy of the stock firmware before testing that). Thanks for the suggestion.

4

No, dont try the current firmware upgrade flash tool yet. Keep it as is until you can create a full backup.

Do you have a serial console cable connected?

Send a picture of the board

From a serial console if you can stop the current u-boot. Try boot the other similar device images. Your issue will then be to get ethernet and wifi support working.

5

Refer to this other forum about the other Kirkwood supported devices

https://forum.doozan.com › read
Web results
Linux Kernel 5.6.5 Kirkwood package and Debian rootfs - Doozan forum

There your will find notes on running Debian and Openwrt on Kirkwood

6

It seems that there's no serial port mapped on the board, it should have an unpopulated jtag but after 1 hours of new research, I'm unable to find the source of this information (that I'm pretty sure to saw last days), here's the picture from ifixit which offer a much more better quality than mine.. https://d3nevzfk7ii3be.cloudfront.net/igi/uqNIyvvCegoZLFZI.full

7

we need to find the serial console port, what on the other side of the board ?

8

I dont see it on back of the board also?

Front

Back

But this person post on Twitter Serial Console ?
https://mobile.twitter.com/0x56/status/606633497676021760strong text

9

Here a wiki for the devices
http://www.theairportwiki.com/index.php?title=Main_Page

1 Like
10

It looks like the device on his post is the last generation of airport express, not extreme..
i found the jtag headers under the mini pci card on the 1st generation of airport extreme but there's nothing under the mini pcie of the 5th generation discussed here. Could it be possible to use the 2 jtag headers present on the dual mini pcie card??
i already checked the airport wiki, but didn't found the needed details (that's why i started ask here if someone has idea how to proceed)
Here's the python code to use acp to enable sshd, flash or setting up things (could it be uses to send setenv to the embedded u-boot?)


The added work to use previous tool to add scripts to execute at the netbsd boot

11

I'm not sure the jtag port/s on the pci wifi will help since they likely interface to the wifi Broadcom chip not the Kirkwood.

Refer to this Aruba AP-105 wiki procedure I used to replace u-boot by reading/injecting and writing using a Raspberry Pi with a Pomona clip

https://openwrt.org/toh/aruba/aruba_ap-105

This might be a possible way to read the flash provided it well supported by flashrom utility

1 Like
12

Looking at the picture of the board, J2003 and J0905 look suspicious. This page https://sites.google.com/site/lapastenague/a-deconstruction-of-routers-and-modems/apple-time-capsule-repair/new-issue-with-a1355-gen-3-tc has picture of soldered UART pins on different board version. As this is the same SoC, very likely J0905 pad is what You're looking for.

1 Like
13

Yes, it could be the j0905, i was suspecting the j2003 to be the unpopulated sata port. I will look the link you provided, sounds interesting !

14

BTW it's always good to look at FCC photos when looking for UART/JTAG, it could be that for certification the engineering sample was used. Very often one can see some connectors used for debugging or resistors soldered which enable serial output, which are not present on final boards. It seem that is also the case with this board https://fccid.io/BCGA1408/Internal-Photos/Int-1484083.

2 Likes
15

I'm waiting to receive a new usb serial adapter and i will try to solder required wires to get a serial access :slight_smile:
So if i can do that, next steps are :
1 - stop the u-boot through the serial
2 - set u-boot env ip
3 - set u-boot tftp boot server ip
4 - try to make the device boot with a "cousin" kirkwood openwrt build hosted by the tftp server
Do I forget something ?

16

I never knew it used kirkwood SoC. Good to know.
BTW have you checked its bootloader is indeed U-Boot? A1392 has CFE bootloader for example.

17

1 - stop the u-boot through the serial

Yes, if it's U-Boot, it could be CFE as @mans0n mentioned. Given that Apple doesn't like GPL, it might be the later. Even before that, dump stock boot log, try to poke at sysfs and procfs from stock OS. And before doing anything, make a backup of whole flash.

2 - set u-boot env ip

Before trying to boot something, dump environment variables, check available commands.

3 - set u-boot tftp boot server ip
4 - try to make the device boot with a "cousin" kirkwood openwrt build hosted by the tftp server

Yes, that would be initramfs image of something like Linksys Audi/Viper (EA3500/EA4500).

Good luck.

18

Any luck on this?

19

You tagged wrong person. The owner of the device is topic starter, not me. I offered only some pointers how to proceed and I don't own or even been near such device.

20

Hello All, sorry, I received the soldering iron and the small cables two days before start a new work, and then we moved house, since that, all my stuff is still the moving box in the garage and I didn't manage to get the quiet and necessary time to solder required wire on the serial unpopulated port..
but from the linked report below, it's seems that this device is using a cfe:
http://embeddedideation.com/2014/03/dissecting-the-airport-express/
Does having a CFE means it is a no way project ?