Adding OpenWrt support for Apple Airport Extreme & Time Capsule ( Kirkwood )

That's an Airport Express not an Airport Extreme. Two different devices. The Airport Express is using an Atheros MIPS SoC while the Airport Extreme (those that I have access to) all use Marvell ARM SoC (either Orion or Kirkwood depending on generation).

Here is the console log from a A1408 using pins 11 and 13 of J0905. The connector looks like a 20 pin 0.5mm FPC so it would be cleanest to solder a connector on and use a FFC to connect to a breakout board to get the JTAG too. I used 0.10mm enamel wire.

Looks like EDK EFI bootloader.

PEX0 interface detected Link X4
Error: Image at 00003DD4000 start failed: Not Found
Local Build: root@twilight.apple.com Thu Jan 26 03:24:02 PST 2012
BDS: Console Started!!!!
*USBEHCI(1) (HS USB) controller is enabled
UiString Ebl
EDK Boot Loader (EBL) prototype. Built at 03:25:18 on Jan 26 2012
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN 'AS IS' BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
Please send feedback to dev@ebl.tianocore.org
Hit any key to break. You have   0 seconds
USBEHCI: stopping EHCI
USBEHCI: Stopped USB Controller.

>> NetBSD/MVORION Gzip Boot, Revision 1.2
>> (root@dusk.apple.com, Fri May  6 17:36:14 PDT 2016)
>> RAM 0x0 - 0x7ffffff, heap at 0x140000
>> Load address: 0x200000, Image address 0x2005da8
Uncompressing image...done.
Jumping to image @ 0x200000...
ABMarvell
------------------------------------------------------
Apple AirPort NetBSD port for Marvell Orion SoC, Version KW-2.1.2-LRO
------------------------------------------------------

NetBSD/mvbarm (Feroceon) booting ...
command line =
kernsize=0xf00000 0xc1100000/0xc0200000)
kernsize new=0xf04000
initarm: Configuring system ...
physmemory: 32768 pages at 0x00000000 -> 0x07ffffff
 physical_freestart = 01100000
Allocating page tables
physical_start = 0x00000000, physical_end = 0x08000000
Allocating page tables
freestart = 0x01100000, free pages = 32768 (0x00008000)
IRQ stack: p0x0110e000 v0xc110e000
ABT stack: p0x0110f000 v0xc110f000
UND stack: p0x01110000 v0xc1110000
SVC stack: p0x01111000 v0xc1111000
Creating L1 page table at 0x01100000
Linking vector page L2 at 0xffc00000
Linking static kernel L2 at 0xc0000000
Linking static kernel L2 at 0xc0400000
Linking static kernel L2 at 0xc0800000
Linking static kernel L2 at 0xc0c00000
Linking static kernel L2 at 0xc1000000
Linking managed kernel L2 at 0xc2000000
Linking managed kernel L2 at 0xc2400000
Linking managed kernel L2 at 0xc2800000
Linking managed kernel L2 at 0xc2c00000
Linking managed kernel L2 at 0xc3000000
Linking managed kernel L2 at 0xc3400000
Linking managed kernel L2 at 0xc3800000
Linking managed kernel L2 at 0xc3c00000
Mapping kernel static code/data
Mapping kernel->text 3624960/0x375000
pmap_map_chunk: pa=0x200000 va=0xc0200000 size=0x375000 resid=0x375000 prot=0x3 cache=1
SSSLLLLLLLPPPPP
Mapping kernel->total-textsize (data) 12103680/0xb8b000
pmap_map_chunk: pa=0x575000 va=0xc0575000 size=0xb8b000 resid=0xb8b000 prot=0x3 cache=1
PPPPPPPPPPPLLLLLLLLSSSSSSSSSSS
Constructing L2 page tables
Constructing L2 page tables-stack pages
Constructing L2 page tables-IRQ
pmap_map_chunk: pa=0x110e000 va=0xc110e000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-ABT
pmap_map_chunk: pa=0x110f000 va=0xc110f000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-UND
pmap_map_chunk: pa=0x1110000 va=0xc1110000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-UPages
pmap_map_chunk: pa=0x1111000 va=0xc1111000 size=0x2000 resid=0x2000 prot=0x3 cache=1
PP
Constructing L2 page tables-L1Table
pmap_map_chunk: pa=0x1100000 va=0xc1100000 size=0x4000 resid=0x4000 prot=0x3 cache=2
PPPP
Constructing L2 page tables-KernelPT
pmap_map_chunk: pa=0x1115000 va=0xc1115000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1116000 va=0xc1116000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1117000 va=0xc1117000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1118000 va=0xc1118000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1119000 va=0xc1119000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1104000 va=0xc1104000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1105000 va=0xc1105000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1106000 va=0xc1106000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1107000 va=0xc1107000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1108000 va=0xc1108000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1109000 va=0xc1109000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110a000 va=0xc110a000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110b000 va=0xc110b000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110c000 va=0xc110c000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
Constructing L2 page tables-vector page (HIGH-0xffff0000)
Constructing L2 page tables-static registers
devmap: f1000000 -> f10fffff @ f1000000
pmap_map_chunk: pa=0xf1000000 va=0xf1000000 size=0x100000 resid=0x100000 prot=0x3 cache=0
S
devmap: f2000000 -> f20fffff @ f2000000
pmap_map_chunk: pa=0xf2000000 va=0xf2000000 size=0x100000 resid=0x100000 prot=0x3 cache=0
S
devmap: fa000000 -> fa1fffff @ fa000000
pmap_map_chunk: pa=0xfa000000 va=0xfa000000 size=0x200000 resid=0x200000 prot=0x3 cache=0
SS
devmap: f4000000 -> f4ffffff @ f4000000
pmap_map_chunk: pa=0xf4000000 va=0xf4000000 size=0x1000000 resid=0x1000000 prot=0x3 cache=0
SSSSSSSSSSSSSSSS
devmap: f0000000 -> f01fffff @ f0000000
pmap_map_chunk: pa=0xf0000000 va=0xf0000000 size=0x200000 resid=0x200000 prot=0x3 cache=0
SS
freestart = 0x01100000, free_pages = 28416 (0x6f00)
physical_freestart = 0x0111a000,
switching to new L1 page table @0x1100000...done!
bootstrap done.
init subsystems: stacks vectors undefined page pmap irq done.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 4.0_STABLE #0: Fri May  6 17:32:23 PDT 2016
        root@dusk.apple.com:/SourceCache/K10BUpdateROM/AirPortFW-76700.5/Embedded/Firmware/NetBSD/Targets/K10B/release/obj/build.kernel-target.conf
total memory = 128 MB
avail memory = 108 MB
mainbus0 (root)
cpu0 at mainbus0: ARM926E-S rev 1 (ARM9E-S core) []
cpu0: DC enabled IC enabled WB enabled EABT
cpu0: 16KB/32B 4-way Instruction cache
cpu0: 16KB/32B 4-way write-back Data cache
cpu0: L2 cache enabled in write-through mode
mv_socbus0 at mainbus0 board name : Apple K10A
ehci0 at mv_socbus0 unit -1ehci_mv_attach: sc = 0xc225d000, sc->sc.ioh=0xf1050100
ehci0: interrupting
ehci0: EHCI version 1.0
usb0 at ehci0: USB revision 2.0, available bus power 500 mA
uhub0 at usb0
uhub0: MARVELL EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
ehci0: self-powered device addr 1 (config 1) power 0 mA. Available power 500 mA (root)
uhub0: 1 port with 1 removable, self powered
mgi0 at mv_socbus0 unit -1mgi_attach: ma=0xc1112d28, sc_dmat=0xc228c3cc, parent=0xc228c000, self=0xc22cf000, unit=0
calling , ifmedia_add
RX TCP LRO Initialized
amdio0 at mgi0: Management Data Interface
mgi1 at mv_socbus0 unit -1mgi_attach: ma=0xc1112d28, sc_dmat=0xc228c3cc, parent=0xc228c000, self=0xc2376000, unit=1
calling , ifmedia_add
RX TCP LRO Initialized
 not configured
mvtwsi0 at mv_socbus0 unit -1: Two Wire Serial Interface
iic0 at mvtwsi0: I2C bus
islrtc0 at iic0 addr 0x6f: ISL1208 Real-time Clock/NVRAM
mvdma() was matched.
mvxor0 at mv_socbus0 unit -1mv_cpucnt() was matched.
cpucnt0 at mv_socbus0 unit -1 **** counter 0 event = 6
 **** counter 1 event = 2
 **** counter 2 event = 1
 **** counter 3 event = 2
mv_mgitool() was matched.
mgitool0 at mv_socbus0 unit -1mvcesa0 at mv_socbus0 unit -1mvCesaInit: sessions=640, queue=32, pSram=0xf0000000
mv_sata_integ0 at mv_socbus0 unit -1
found SATA device 6281 revision 3
mv_sata_integ0: interrupting at 21
 channel 0 request q phy addr 1cc2000
 channel 0 response q phy addr 1cc3000
 channel 1 request q phy addr 1cc4000
 channel 1 response q phy addr 1cc5000
scsibus0 at mv_sata_integ0 channel 0: 15 targets, 1 lun per target
scsibus1 at mv_sata_integ0 channel 1: 15 targets, 1 lun per target
applgpio0 at mv_socbus0 unit -1GPIO_interrupt_pin_ex: flipping pin 49.
GPIO_interrupt_pin_ex: flipping pin 11.
 (board-revision=0)
mv_pcibus0 at mainbus0
mv_pcibus_attach()
PEX0 interface detected Link X1
mv_pcibus0: configuring PCI interface 0
pci0 at mv_pcibus0 bus 0
pci0: i/o space, memory space enabled
ppb0 at pci0 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled
ppb1 at pci1 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled
bwl0 at pci2 dev 0 function 0wlan: mac acl policy registered
bwl0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
bwl0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl0: 11ng MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps

bwl0: interrupting at pci0int09
ppb2 at pci1 dev 2 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled
bwl1 at pci3 dev 0 function 0bwl1: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl1: 11na MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps

bwl1: interrupting at pci0int09
obio0 at mainbus0
com0 at obio0 addr 0xf1012000 irq 33: ns16550a, working fifo
com0: console
com1 at obio0 addr 0xf1012100 irq 34: ns16550a, working fifo
nandflash0 at obio0 addr 0xfa000000-0xfa0fffffflashattach: no device found
stdflash0 at obio0 addr 0xf4000000-0xf4ffffff: onboard SPI NOR flash
FLASH look for .... 0) ef/4018/20/2018
FLASH look for .... 1) ef/4018/c2/2017
FLASH look for .... 2) ef/4018/c2/2018
FLASH look for .... 3) ef/4018/c2/2013
FLASH look for .... 4) ef/4018/ef/4018
FLASH look for .... 5) ef/4018/1/2018
FLASH SUPPORTED.... ef/4018/4/0
flash0 at stdflash0 00200000-00900000, untranslated, read/write
flash1 at stdflash0 00900000-01000000, untranslated, read/write
flash2 at stdflash0 000c0000-00200000, translated, read/write
flash3 at stdflash0 00080000-000c0000, untranslated, read/write
flash4 at stdflash0 00000000-00080000, untranslated, read/write
clock: hz=100 stathz=0 profhz=0, mvTclk=200000000
md0: internal 10240 KB image area
IPsec: Initialized Security Association Processing.
scsibus0: waiting 2 seconds for devices to settle...
scsibus1: waiting 2 seconds for devices to settle...
boot device: <unknown>
root on md0a dumps on md0b
root file system type: ffs
WARNING: clock gained 1618 days
WARNING: CHECK AND RESET THE DATE!
Sun Oct 11 06:16:49 GMT 2020
Starting file system checks:
fsck_ffs: ioctl (DIOCGWEDGEINFO): Inappropriate ioctl for device
/dev/rmd0a: file system is clean; not checking
Setting tty flags.
Setting sysctl variables:
kern.defcorename: %n.core -> /tmp/%n.core
kern.logsigexit: 0 -> 1
sysctl: /etc/sysctl.conf#5: second level name 'lines' in 'ddb.lines' is invalid
net.inet6.tcp6.mss_ifmtu: 0 -> 1
Starting network.
/etc/rc: WARNING: $hostname not set.
IPv6 mode: host
Configuring network interfaces:.
Adding interface aliases:
Building databases...
install: not found
install: not found
Setting securelevel: kern.securelevel: 0 -> 1
checking /dev/flash2a ...
** /dev/rflash2a
** Last Mounted on /mnt/Flash
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cyl groups
5 files, 79 used, 2162 free (10 frags, 269 blocks, 0.4% fragmentation)

MARK FILE SYSTEM CLEAN? yes


***** FILE SYSTEM MARKED CLEAN *****

***** FILE SYSTEM WAS MODIFIED *****
Mounting all filesystems...
Starting acpd.
Starting inetd.
Starting cron.
Sun Oct 11 06:16:53 GMT 2020

Apple AirPort Firmware
Copyright (C) 2005-2012 Apple Inc. All rights reserved.
console on Amnesiac
Last login: Sat Oct 10 23:16:55 2020 on tty01
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

Terminal type is vt100.
# mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
mgi_init: ifp=0xc237603c, sc=0xc2376000

# mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
Oct 10 23:17:06 mDNSResponder: mDNSResponder mDNSResponder-397.32 (May  6 2016 17:34:46) starting

# ls -R
.editrc   .ssh      bin       etc       libdata   mnt       tmp       var
.profile  Volumes   dev       lib       libexec   sbin      usr

./.ssh:
authorized_keys

./Volumes:

./bin:
[          date       echo       ln         mv         rmdir      sync
cat        dd         expr       ls         ps         sh         test
chmod      df         hostname   mkdir      pwd        sleep
cp         domainname kill       mknod      rm         stty

./dev:
MAKEDEV      dk45         ld7f         rccd9f       rld3f        rsd9c
amdio0       dk46         ld7g         rccd9g       rld3g        rsd9d
applgpio0    dk47         ld7h         rccd9h       rld3h        rsd9e
bpf          dk48         ld8a         rdk0         rld4a        rsd9f
bpf0         dk49         ld8b         rdk1         rld4b        rsd9g
ccd0a        dk5          ld8c         rdk10        rld4c        rsd9h
ccd0b        dk6          ld8d         rdk11        rld4d        scsibus0
ccd0c        dk7          ld8e         rdk12        rld4e        scsibus1
ccd0d        dk8          ld8f         rdk13        rld4f        scsibus2
ccd0e        dk9          ld8g         rdk14        rld4g        sd0a
ccd0f        dmoverio     ld8h         rdk15        rld4h        sd0b
ccd0g        drum         ld9a         rdk16        rld5a        sd0c
ccd0h        drvctl       ld9b         rdk17        rld5b        sd0d
ccd10a       dty00        ld9c         rdk18        rld5c        sd0e
ccd10b       dty01        ld9d         rdk19        rld5d        sd0f
ccd10c       flash0a      ld9e         rdk2         rld5e        sd0g
ccd10d       flash0b      ld9f         rdk20        rld5f        sd0h
ccd10e       flash0c      ld9g         rdk21        rld5g        sd10a
ccd10f       flash0d      ld9h         rdk22        rld5h        sd10b
ccd10g       flash0e      md0a         rdk23        rld6a        sd10c
ccd10h       flash0f      md0c         rdk24        rld6b        sd10d
ccd11a       flash0g      mem          rdk25        rld6c        sd10e
ccd11b       flash0h      null         rdk26        rld6d        sd10f
ccd11c       flash1a      pci0         rdk27        rld6e        sd10g
ccd11d       flash1b      pci1         rdk28        rld6f        sd10h
ccd11e       flash1c      pci2         rdk29        rld6g        sd11a
ccd11f       flash1d      pci3         rdk3         rld6h        sd11b
ccd11g       flash1e      pci4         rdk30        rld7a        sd11c
ccd11h       flash1f      pci5         rdk31        rld7b        sd11d
ccd12a       flash1g      pci6         rdk32        rld7c        sd11e
ccd12b       flash1h      pci7         rdk33        rld7d        sd11f
ccd12c       flash2a      pf           rdk34        rld7e        sd11g
ccd12d       flash2b      power        rdk35        rld7f        sd11h
ccd12e       flash2c      ptyp0        rdk36        rld7g        sd12a
ccd12f       flash2d      ptyp1        rdk37        rld7h        sd12b
ccd12g       flash2e      ptyp2        rdk38        rld8a        sd12c
ccd12h       flash2f      ptyp3        rdk39        rld8b        sd12d
ccd13a       flash2g      ptyp4        rdk4         rld8c        sd12e
ccd13b       flash2h      ptyp5        rdk40        rld8d        sd12f
ccd13c       flash3a      ptyp6        rdk41        rld8e        sd12g
ccd13d       flash3b      ptyp7        rdk42        rld8f        sd12h
ccd13e       flash3c      ptyp8        rdk43        rld8g        sd13a
ccd13f       flash3d      ptyp9        rdk44        rld8h        sd13b
ccd13g       flash3e      ptypa        rdk45        rld9a        sd13c
ccd13h       flash3f      ptypb        rdk46        rld9b        sd13d
ccd14a       flash3g      ptypc        rdk47        rld9c        sd13e
ccd14b       flash3h      ptypd        rdk48        rld9d        sd13f
ccd14c       flash4a      ptype        rdk49        rld9e        sd13g
ccd14d       flash4b      ptypf        rdk5         rld9f        sd13h
ccd14e       flash4c      random       rdk6         rld9g        sd14a
ccd14f       flash4d      rccd0a       rdk7         rld9h        sd14b
ccd14g       flash4e      rccd0b       rdk8         rmd0a        sd14c
ccd14h       flash4f      rccd0c       rdk9         rmd0c        sd14d
ccd15a       flash4g      rccd0d       rflash0.raw  rsd0a        sd14e
ccd15b       flash4h      rccd0e       rflash0a     rsd0b        sd14f
ccd15c       iic0         rccd0f       rflash0b     rsd0c        sd14g
ccd15d       ipauth       rccd0g       rflash0c     rsd0d        sd14h
ccd15e       ipl          rccd0h       rflash0d     rsd0e        sd15a
ccd15f       iplookup     rccd10a      rflash0e     rsd0f        sd15b
ccd15g       ipnat        rccd10b      rflash0f     rsd0g        sd15c
ccd15h       ipscan       rccd10c      rflash0g     rsd0h        sd15d
ccd1a        ipstate      rccd10d      rflash0h     rsd10a       sd15e
ccd1b        ipsync       rccd10e      rflash1.raw  rsd10b       sd15f
ccd1c        klog         rccd10f      rflash1a     rsd10c       sd15g
ccd1d        kmem         rccd10g      rflash1b     rsd10d       sd15h
ccd1e        ksyms        rccd10h      rflash1c     rsd10e       sd1a
ccd1f        ld0a         rccd11a      rflash1d     rsd10f       sd1b
ccd1g        ld0b         rccd11b      rflash1e     rsd10g       sd1c
ccd1h        ld0c         rccd11c      rflash1f     rsd10h       sd1d
ccd2a        ld0d         rccd11d      rflash1g     rsd11a       sd1e
ccd2b        ld0e         rccd11e      rflash1h     rsd11b       sd1f
ccd2c        ld0f         rccd11f      rflash2.raw  rsd11c       sd1g
ccd2d        ld0g         rccd11g      rflash2a     rsd11d       sd1h
ccd2e        ld0h         rccd11h      rflash2b     rsd11e       sd2a
ccd2f        ld10a        rccd12a      rflash2c     rsd11f       sd2b
ccd2g        ld10b        rccd12b      rflash2d     rsd11g       sd2c
ccd2h        ld10c        rccd12c      rflash2e     rsd11h       sd2d
ccd3a        ld10d        rccd12d      rflash2f     rsd12a       sd2e
ccd3b        ld10e        rccd12e      rflash2g     rsd12b       sd2f
ccd3c        ld10f        rccd12f      rflash2h     rsd12c       sd2g
ccd3d        ld10g        rccd12g      rflash3.raw  rsd12d       sd2h
ccd3e        ld10h        rccd12h      rflash3a     rsd12e       sd3a
ccd3f        ld11a        rccd13a      rflash3b     rsd12f       sd3b
ccd3g        ld11b        rccd13b      rflash3c     rsd12g       sd3c
ccd3h        ld11c        rccd13c      rflash3d     rsd12h       sd3d
ccd4a        ld11d        rccd13d      rflash3e     rsd13a       sd3e
ccd4b        ld11e        rccd13e      rflash3f     rsd13b       sd3f
ccd4c        ld11f        rccd13f      rflash3g     rsd13c       sd3g
ccd4d        ld11g        rccd13g      rflash3h     rsd13d       sd3h
ccd4e        ld11h        rccd13h      rflash4.raw  rsd13e       sd4a
ccd4f        ld12a        rccd14a      rflash4a     rsd13f       sd4b
ccd4g        ld12b        rccd14b      rflash4b     rsd13g       sd4c
ccd4h        ld12c        rccd14c      rflash4c     rsd13h       sd4d
ccd5a        ld12d        rccd14d      rflash4d     rsd14a       sd4e
ccd5b        ld12e        rccd14e      rflash4e     rsd14b       sd4f
ccd5c        ld12f        rccd14f      rflash4f     rsd14c       sd4g
ccd5d        ld12g        rccd14g      rflash4g     rsd14d       sd4h
ccd5e        ld12h        rccd14h      rflash4h     rsd14e       sd5a
ccd5f        ld13a        rccd15a      rld0a        rsd14f       sd5b
ccd5g        ld13b        rccd15b      rld0b        rsd14g       sd5c
ccd5h        ld13c        rccd15c      rld0c        rsd14h       sd5d
ccd6a        ld13d        rccd15d      rld0d        rsd15a       sd5e
ccd6b        ld13e        rccd15e      rld0e        rsd15b       sd5f
ccd6c        ld13f        rccd15f      rld0f        rsd15c       sd5g
ccd6d        ld13g        rccd15g      rld0g        rsd15d       sd5h
ccd6e        ld13h        rccd15h      rld0h        rsd15e       sd6a
ccd6f        ld14a        rccd1a       rld10a       rsd15f       sd6b
ccd6g        ld14b        rccd1b       rld10b       rsd15g       sd6c
ccd6h        ld14c        rccd1c       rld10c       rsd15h       sd6d
ccd7a        ld14d        rccd1d       rld10d       rsd1a        sd6e
ccd7b        ld14e        rccd1e       rld10e       rsd1b        sd6f
ccd7c        ld14f        rccd1f       rld10f       rsd1c        sd6g
ccd7d        ld14g        rccd1g       rld10g       rsd1d        sd6h
ccd7e        ld14h        rccd1h       rld10h       rsd1e        sd7a
ccd7f        ld15a        rccd2a       rld11a       rsd1f        sd7b
ccd7g        ld15b        rccd2b       rld11b       rsd1g        sd7c
ccd7h        ld15c        rccd2c       rld11c       rsd1h        sd7d
ccd8a        ld15d        rccd2d       rld11d       rsd2a        sd7e
ccd8b        ld15e        rccd2e       rld11e       rsd2b        sd7f
ccd8c        ld15f        rccd2f       rld11f       rsd2c        sd7g
ccd8d        ld15g        rccd2g       rld11g       rsd2d        sd7h
ccd8e        ld15h        rccd2h       rld11h       rsd2e        sd8a
ccd8f        ld1a         rccd3a       rld12a       rsd2f        sd8b
ccd8g        ld1b         rccd3b       rld12b       rsd2g        sd8c
ccd8h        ld1c         rccd3c       rld12c       rsd2h        sd8d
ccd9a        ld1d         rccd3d       rld12d       rsd3a        sd8e
ccd9b        ld1e         rccd3e       rld12e       rsd3b        sd8f
ccd9c        ld1f         rccd3f       rld12f       rsd3c        sd8g
ccd9d        ld1g         rccd3g       rld12g       rsd3d        sd8h
ccd9e        ld1h         rccd3h       rld12h       rsd3e        sd9a
ccd9f        ld2a         rccd4a       rld13a       rsd3f        sd9b
ccd9g        ld2b         rccd4b       rld13b       rsd3g        sd9c
ccd9h        ld2c         rccd4c       rld13c       rsd3h        sd9d
console      ld2d         rccd4d       rld13d       rsd4a        sd9e
constty      ld2e         rccd4e       rld13e       rsd4b        sd9f
dk0          ld2f         rccd4f       rld13f       rsd4c        sd9g
dk1          ld2g         rccd4g       rld13g       rsd4d        sd9h
dk10         ld2h         rccd4h       rld13h       rsd4e        stderr
dk11         ld3a         rccd5a       rld14a       rsd4f        stdin
dk12         ld3b         rccd5b       rld14b       rsd4g        stdout
dk13         ld3c         rccd5c       rld14c       rsd4h        sysmon
dk14         ld3d         rccd5d       rld14d       rsd5a        tty
dk15         ld3e         rccd5e       rld14e       rsd5b        tty00
dk16         ld3f         rccd5f       rld14f       rsd5c        tty01
dk17         ld3g         rccd5g       rld14g       rsd5d        ttyp0
dk18         ld3h         rccd5h       rld14h       rsd5e        ttyp1
dk19         ld4a         rccd6a       rld15a       rsd5f        ttyp2
dk2          ld4b         rccd6b       rld15b       rsd5g        ttyp3
dk20         ld4c         rccd6c       rld15c       rsd5h        ttyp4
dk21         ld4d         rccd6d       rld15d       rsd6a        ttyp5
dk22         ld4e         rccd6e       rld15e       rsd6b        ttyp6
dk23         ld4f         rccd6f       rld15f       rsd6c        ttyp7
dk24         ld4g         rccd6g       rld15g       rsd6d        ttyp8
dk25         ld4h         rccd6h       rld15h       rsd6e        ttyp9
dk26         ld5a         rccd7a       rld1a        rsd6f        ttypa
dk27         ld5b         rccd7b       rld1b        rsd6g        ttypb
dk28         ld5c         rccd7c       rld1c        rsd6h        ttypc
dk29         ld5d         rccd7d       rld1d        rsd7a        ttypd
dk3          ld5e         rccd7e       rld1e        rsd7b        ttype
dk30         ld5f         rccd7f       rld1f        rsd7c        ttypf
dk31         ld5g         rccd7g       rld1g        rsd7d        ulpn0
dk32         ld5h         rccd7h       rld1h        rsd7e        ulpn1
dk33         ld6a         rccd8a       rld2a        rsd7f        ulpn2
dk34         ld6b         rccd8b       rld2b        rsd7g        ulpn3
dk35         ld6c         rccd8c       rld2c        rsd7h        ulpt0
dk36         ld6d         rccd8d       rld2d        rsd8a        ulpt1
dk37         ld6e         rccd8e       rld2e        rsd8b        ulpt2
dk38         ld6f         rccd8f       rld2f        rsd8c        ulpt3
dk39         ld6g         rccd8g       rld2g        rsd8d        urandom
dk4          ld6h         rccd8h       rld2h        rsd8e        usb
dk40         ld7a         rccd9a       rld3a        rsd8f        usb0
dk41         ld7b         rccd9b       rld3b        rsd8g        watchdog
dk42         ld7c         rccd9c       rld3c        rsd8h        zero
dk43         ld7d         rccd9d       rld3d        rsd9a
dk44         ld7e         rccd9e       rld3e        rsd9b

./etc:
APImage.png               hostap_wlan1.time_acc     racoon
afpservervols.cfg         hostap_wlan1.wpa_psk      rc
cifs                      hosts                     rc.conf
crontab                   inetd.conf                rc.d
defaults                  issue                     rc.shutdown
dhclient-enter-hooks      localtime                 rc.subr
dhclient-exit-hooks       master.passwd             resolv.conf
dns                       mdnsd.conf                rpc
flash2.disktab            netconfig                 rtsol-enter-hooks
fstab                     newsyslog.conf            rtsol-exit-hooks
gettytab                  nsswitch.conf             services
group                     openssl                   spwd.db
hostap_wlan0.conf         pam.conf                  ssh
hostap_wlan0.eap_user     passwd                    sysctl.conf
hostap_wlan0.time_acc     pf.os                     syslog.conf
hostap_wlan0.wpa_psk      ppp                       ttys
hostap_wlan1.conf         protocols                 usermgmt.conf
hostap_wlan1.eap_user     pwd.db

./etc/cifs:
cm_cfg.txt cs_cfg.txt

./etc/defaults:
pf.boot.conf rc.conf

./etc/dns:
manual-nameservers

./etc/openssl:

./etc/ppp:
ipv4-dn ipv4-up

./etc/racoon:
racoon.conf  remote

./etc/racoon/remote:
anonymous.conf

./etc/rc.d:
DAEMON          cron            inetd           mountcritremote sysdb
LOGIN           dhclient        ipfilter        network         ttys
NETWORKING      dhcpd           ipnat           root
NULL            downinterfaces  ipsec           securelevel
SERVERS         flash           mountall        svscan
acpd            fsck            mountcritlocal  sysctl

./etc/ssh:

./lib:
security

./lib/security:

./libdata:
firmware

./libdata/firmware:
mwl

./libdata/firmware/mwl:

./libexec:

./mnt:
Flash  Memory swap

./mnt/Flash:
ACPData.bin     ACPData.bin.1   ACPData.bin.2   ACPData.bin.3

./mnt/Memory:

./mnt/swap:

./sbin:
ACPd                flashctl            mount_ffs           rtsol
acp-update-network  fsck                mount_hfs           rtsol-script
afpserver           fsck_ffs            mount_mfs           rtsold
brconfig            fsck_hfs            mount_msdos         scsictl
bwl                 fsck_msdos          newfs               setkey
ccdconfig           gpt                 newfs_hfs           shutdown
dhclient            halt                pfctl               snmpd
dhclient-script     hostapd             pflogd              sntpd
diskd               i2cctl              ping                sysctl
disklabel           iCloudd             ping6               ttyflags
dmesg               ifconfig            poweroff            twiddle-gpio
dns-update-script   init                printd              umount
drvctl              link_local          rcorder             wcifsfs
esconfig            mDNSResponder       reboot              wcifsnd
ether-port          mount               route               wpa_supplicant

./tmp:
ACPIPC       ACPdLogFifo

./usr:
bin     lib     libexec local   sbin    share

./usr/bin:
acp        du         iperf      more       pkill      tail       uname
chgrp      env        less       newsyslog  sed        top        wall
curl       false      logger     nohup      ssh        true
defaults   fstat      login      openssl    ssh-keygen tset

./usr/libexec:
ftp-proxy getty

./usr/local:
share

./usr/local/share:
curl

./usr/local/share/curl:
curl-ca-bundle.crt

./usr/sbin:
arp       dhcpd     esctl     pppoectl  rtspproxy svc       user
chown     dnscache  ifwatchd  pwd_mkdb  six4d     svok      useradd
cron      envdir    inetd     racoon    sshd      svscan    userdel
dev_mkdb  envstat   natpmpd   rtadvd    supervise tcpdump   walldns

./usr/share:
misc

./usr/share/misc:
termcap

./var:
chroot cron   db     dns    log    run    sv     tmp

./var/chroot:
sshd

./var/chroot/sshd:

./var/cron:
tabs

./var/cron/tabs:

./var/db:

./var/dns:

./var/log:
ACPd.log            hostap_wlan0.log    lpd-errs            wtmpx
authlog             hostap_wlan1.log    messages            xferlog
cron                lastlogx            usrLog

./var/run:
ACPd.pid        dev.db          log             printd.pid      utmp
cron.pid        inetd.pid       mDNSResponder   racoon          utmpx

./var/run/racoon:

./var/sv:
dnscache  walldns

./var/sv/dnscache:
down      env       log       root      run       seed      supervise

./var/sv/dnscache/env:
CACHESIZE    FORWARDONLY  GID          IPSEND       ROOT         UID

./var/sv/dnscache/log:
run       supervise

./var/sv/dnscache/log/supervise:
control lock    ok      status

./var/sv/dnscache/root:
ip      servers

./var/sv/dnscache/root/ip:
127  fe80

./var/sv/dnscache/root/servers:

./var/sv/dnscache/supervise:
control lock    ok      status

./var/sv/walldns:
down      env       log       root      run       supervise

./var/sv/walldns/env:
GID  IP   ROOT UID

./var/sv/walldns/log:
run       supervise

./var/sv/walldns/log/supervise:
control lock    ok      status

./var/sv/walldns/root:

./var/sv/walldns/supervise:
control lock    ok      status

./var/tmp:

And if you break into the bootloader, you have these commands available:

EDK Boot Loader commands (help command for more info):
 airboot filelocation loadaddress; load file to given address and jump to that location.
                                                                                        airboot [primary | secondary] ; immediately execute primary or secondary image.
 bcm [r|w] page register [length|data]; talk to the broadcom switch chip
 bootx [-k kernel][-d devtree][-r ramdisk][-b args] boot Darwin.
 break; Generate debugging breakpoint
 connect[d]; Connect all EFI devices. d means disconnect
 cp file1 file2; copy file
 device; Show information about boot devices
 devtree [devtreenode] [-d devtree] [-e] [-v] [-p]
 diff file1 file2; compare files
 dir dirdev [*match]; directory listing of dirdev. opt match a substring
 diskio [r|w] offset [length [dataptr]]; do a DiskIO read or write
 exit; Exit EBL
 flash file offset; read 'file' and write it into flash at 'offset'
 go dev:path loadaddress entrypoint args; load to given address and jump in
 help [cmd]; Help on cmd or a list of all commands if cmd is ommited
 hexdump filename ; dump a file as hex bytes
 hob; dump HOBs
 ip ; print current ip address
                                 [r]; request DHCP address
                                                             [s] ipaddr; set static IP address
 ir register [new-value]; (32bit) internal register read/write (ex: ir 40000)
 loadfv devname; Load PI FV from device
 md [Addr] [Len] [1|2|4]; Memory Dump from Addr Len bytes
 memmap; dump EFI memory map
 mfill Addr Data [1|2|4] [count]; Write [count] copies of Data starting at Addr.  Specify width if desired.
 page [on|off]]; toggle promting on command output larger than screen
 pause [sec]; Pause for sec[10] seconds.
 pci [bus] [dev] [func]; Dump PCI
 phyacc [r|w] page register [length|data]; talk to the switch chip
                                                                       phyacc u  ;Up the switch chip
                                                                                                         phyacc d  ;Down the switch chip
 reset [type]; Reset system. type = [warm] [shutdown] default is cold reset
 setvar var=data [nv]; Write static variable (add nv for non-volatile storage)
 sleep [sec]; Sleep for sec[10] seconds.
 spi ; recv length
                        send data_out
                                           xfer data_out
                                                              config baud
 start path; EFI Boot Device:filepath. fs1:\EFI\BOOT.EFI
 twsi [r|w] slaveaddress register [length|data]; Communicate using TWSI.
 var ; Read static variables
K10A>

Now that you have serial access it would be interesting if you could determine whether or not kwboot is enabled. Find a u-boot image for a device with similar SOC and see if you can kwboot the image..

kwboot did not work directly (it would just sit at Sending boot message. Please reboot the target... the whole time.)

However, I did see the chip sending ^U repeatedly (@115200, I didn't verify on the scope that is what is was sending though) after some time.

The chip did not boot normally if I powered it up while trying to kwboot. It seems that you can send some characters to get it to stop sending the ^U and continue booting. ^U is NAK of Xmodem protocol though.

1 Like

Hi,

is there any progress? :wink:

2 Likes

Here is kwbimage.cfg modified with the values from the original Apple firmware: https://gist.github.com/halmartin/35dfdc8d07d937e2206ca1d901f910d7

I don't have any output from the UART though, so probably the MPP configuration I copied from the sheevaplug is not correct for this board.

Note that I am testing by directly flashing to SPI, I didn't try kwboot since people here have said it doesn't work.

2 Likes

any progress?

kwbimage.cfg modified with values from the original Apple firmware for the AirPort Time Capsule (A1409):

Same caveats as the AirPort Extreme A1408 (no UART output, haven't tried kwboot)

2 Likes

Any progress on this? I recently recieved one of these devices and would like to use openwrt on it one day.

I would like to make a relevant point particular for those devices: There is still demand and People are willing to pay good money for them, even though they are aged hardware. Occasionally Apple even still releases firmware security fixes.

I would check, if you can sell it on eBay.
And for that money, you can get a lot more suitable devices for OpenWRT with a non-Broadcom Wifi and likely even more RAM these days. And I think the Apple routers never had WPA3 Support in the Wifi drivers.
Of course mPCI and SATA seem tempting assets on first sight. But considering the progress in this thread, how long will it take, before you can make good use of it?

I understand, though for my use case the Airport Extreme would be fine actually, since I am planning to use just the Ethernet and USB, not the Wifi. I'm also planning on using it to replace a weaker device currently on OpenWrt, once supported.

Not just SATA, but 12V SATA for 3.5" drives in a case nice enough that the wife doesn't mind.

The options for a tiny router with 2.5" SATA drive with internal power are few, and even worse when considering something that looks decent enough to fit in a living room.

should be:

The options for a tiny router with 3.5" SATA drive with internal power are few, and even worse when considering something that looks decent enough to fit in a living room.

There are several options for a 2.5" drive, but much less storage available in the 2.5" form.