That's an Airport Express not an Airport Extreme. Two different devices. The Airport Express is using an Atheros MIPS SoC while the Airport Extreme (those that I have access to) all use Marvell ARM SoC (either Orion or Kirkwood depending on generation).
Here is the console log from a A1408 using pins 11 and 13 of J0905. The connector looks like a 20 pin 0.5mm FPC so it would be cleanest to solder a connector on and use a FFC to connect to a breakout board to get the JTAG too. I used 0.10mm enamel wire.
Looks like EDK EFI bootloader.
PEX0 interface detected Link X4
Error: Image at 00003DD4000 start failed: Not Found
Local Build: root@twilight.apple.com Thu Jan 26 03:24:02 PST 2012
BDS: Console Started!!!!
*USBEHCI(1) (HS USB) controller is enabled
UiString Ebl
EDK Boot Loader (EBL) prototype. Built at 03:25:18 on Jan 26 2012
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN 'AS IS' BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
Please send feedback to dev@ebl.tianocore.org
Hit any key to break. You have 0 seconds
USBEHCI: stopping EHCI
USBEHCI: Stopped USB Controller.
>> NetBSD/MVORION Gzip Boot, Revision 1.2
>> (root@dusk.apple.com, Fri May 6 17:36:14 PDT 2016)
>> RAM 0x0 - 0x7ffffff, heap at 0x140000
>> Load address: 0x200000, Image address 0x2005da8
Uncompressing image...done.
Jumping to image @ 0x200000...
ABMarvell
------------------------------------------------------
Apple AirPort NetBSD port for Marvell Orion SoC, Version KW-2.1.2-LRO
------------------------------------------------------
NetBSD/mvbarm (Feroceon) booting ...
command line =
kernsize=0xf00000 0xc1100000/0xc0200000)
kernsize new=0xf04000
initarm: Configuring system ...
physmemory: 32768 pages at 0x00000000 -> 0x07ffffff
physical_freestart = 01100000
Allocating page tables
physical_start = 0x00000000, physical_end = 0x08000000
Allocating page tables
freestart = 0x01100000, free pages = 32768 (0x00008000)
IRQ stack: p0x0110e000 v0xc110e000
ABT stack: p0x0110f000 v0xc110f000
UND stack: p0x01110000 v0xc1110000
SVC stack: p0x01111000 v0xc1111000
Creating L1 page table at 0x01100000
Linking vector page L2 at 0xffc00000
Linking static kernel L2 at 0xc0000000
Linking static kernel L2 at 0xc0400000
Linking static kernel L2 at 0xc0800000
Linking static kernel L2 at 0xc0c00000
Linking static kernel L2 at 0xc1000000
Linking managed kernel L2 at 0xc2000000
Linking managed kernel L2 at 0xc2400000
Linking managed kernel L2 at 0xc2800000
Linking managed kernel L2 at 0xc2c00000
Linking managed kernel L2 at 0xc3000000
Linking managed kernel L2 at 0xc3400000
Linking managed kernel L2 at 0xc3800000
Linking managed kernel L2 at 0xc3c00000
Mapping kernel static code/data
Mapping kernel->text 3624960/0x375000
pmap_map_chunk: pa=0x200000 va=0xc0200000 size=0x375000 resid=0x375000 prot=0x3 cache=1
SSSLLLLLLLPPPPP
Mapping kernel->total-textsize (data) 12103680/0xb8b000
pmap_map_chunk: pa=0x575000 va=0xc0575000 size=0xb8b000 resid=0xb8b000 prot=0x3 cache=1
PPPPPPPPPPPLLLLLLLLSSSSSSSSSSS
Constructing L2 page tables
Constructing L2 page tables-stack pages
Constructing L2 page tables-IRQ
pmap_map_chunk: pa=0x110e000 va=0xc110e000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-ABT
pmap_map_chunk: pa=0x110f000 va=0xc110f000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-UND
pmap_map_chunk: pa=0x1110000 va=0xc1110000 size=0x1000 resid=0x1000 prot=0x3 cache=1
P
Constructing L2 page tables-UPages
pmap_map_chunk: pa=0x1111000 va=0xc1111000 size=0x2000 resid=0x2000 prot=0x3 cache=1
PP
Constructing L2 page tables-L1Table
pmap_map_chunk: pa=0x1100000 va=0xc1100000 size=0x4000 resid=0x4000 prot=0x3 cache=2
PPPP
Constructing L2 page tables-KernelPT
pmap_map_chunk: pa=0x1115000 va=0xc1115000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1116000 va=0xc1116000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1117000 va=0xc1117000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1118000 va=0xc1118000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1119000 va=0xc1119000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1104000 va=0xc1104000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1105000 va=0xc1105000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1106000 va=0xc1106000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1107000 va=0xc1107000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1108000 va=0xc1108000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x1109000 va=0xc1109000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110a000 va=0xc110a000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110b000 va=0xc110b000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
pmap_map_chunk: pa=0x110c000 va=0xc110c000 size=0x1000 resid=0x1000 prot=0x3 cache=2
P
Constructing L2 page tables-vector page (HIGH-0xffff0000)
Constructing L2 page tables-static registers
devmap: f1000000 -> f10fffff @ f1000000
pmap_map_chunk: pa=0xf1000000 va=0xf1000000 size=0x100000 resid=0x100000 prot=0x3 cache=0
S
devmap: f2000000 -> f20fffff @ f2000000
pmap_map_chunk: pa=0xf2000000 va=0xf2000000 size=0x100000 resid=0x100000 prot=0x3 cache=0
S
devmap: fa000000 -> fa1fffff @ fa000000
pmap_map_chunk: pa=0xfa000000 va=0xfa000000 size=0x200000 resid=0x200000 prot=0x3 cache=0
SS
devmap: f4000000 -> f4ffffff @ f4000000
pmap_map_chunk: pa=0xf4000000 va=0xf4000000 size=0x1000000 resid=0x1000000 prot=0x3 cache=0
SSSSSSSSSSSSSSSS
devmap: f0000000 -> f01fffff @ f0000000
pmap_map_chunk: pa=0xf0000000 va=0xf0000000 size=0x200000 resid=0x200000 prot=0x3 cache=0
SS
freestart = 0x01100000, free_pages = 28416 (0x6f00)
physical_freestart = 0x0111a000,
switching to new L1 page table @0x1100000...done!
bootstrap done.
init subsystems: stacks vectors undefined page pmap irq done.
CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size 1MB
INTER_REGS ....base f1000000, size 1MB
NFLASH_CS ....base fa000000, size 2MB
SPI_CS ....base f4000000, size 16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size 2MB
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
NetBSD 4.0_STABLE #0: Fri May 6 17:32:23 PDT 2016
root@dusk.apple.com:/SourceCache/K10BUpdateROM/AirPortFW-76700.5/Embedded/Firmware/NetBSD/Targets/K10B/release/obj/build.kernel-target.conf
total memory = 128 MB
avail memory = 108 MB
mainbus0 (root)
cpu0 at mainbus0: ARM926E-S rev 1 (ARM9E-S core) []
cpu0: DC enabled IC enabled WB enabled EABT
cpu0: 16KB/32B 4-way Instruction cache
cpu0: 16KB/32B 4-way write-back Data cache
cpu0: L2 cache enabled in write-through mode
mv_socbus0 at mainbus0 board name : Apple K10A
ehci0 at mv_socbus0 unit -1ehci_mv_attach: sc = 0xc225d000, sc->sc.ioh=0xf1050100
ehci0: interrupting
ehci0: EHCI version 1.0
usb0 at ehci0: USB revision 2.0, available bus power 500 mA
uhub0 at usb0
uhub0: MARVELL EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
ehci0: self-powered device addr 1 (config 1) power 0 mA. Available power 500 mA (root)
uhub0: 1 port with 1 removable, self powered
mgi0 at mv_socbus0 unit -1mgi_attach: ma=0xc1112d28, sc_dmat=0xc228c3cc, parent=0xc228c000, self=0xc22cf000, unit=0
calling , ifmedia_add
RX TCP LRO Initialized
amdio0 at mgi0: Management Data Interface
mgi1 at mv_socbus0 unit -1mgi_attach: ma=0xc1112d28, sc_dmat=0xc228c3cc, parent=0xc228c000, self=0xc2376000, unit=1
calling , ifmedia_add
RX TCP LRO Initialized
not configured
mvtwsi0 at mv_socbus0 unit -1: Two Wire Serial Interface
iic0 at mvtwsi0: I2C bus
islrtc0 at iic0 addr 0x6f: ISL1208 Real-time Clock/NVRAM
mvdma() was matched.
mvxor0 at mv_socbus0 unit -1mv_cpucnt() was matched.
cpucnt0 at mv_socbus0 unit -1 **** counter 0 event = 6
**** counter 1 event = 2
**** counter 2 event = 1
**** counter 3 event = 2
mv_mgitool() was matched.
mgitool0 at mv_socbus0 unit -1mvcesa0 at mv_socbus0 unit -1mvCesaInit: sessions=640, queue=32, pSram=0xf0000000
mv_sata_integ0 at mv_socbus0 unit -1
found SATA device 6281 revision 3
mv_sata_integ0: interrupting at 21
channel 0 request q phy addr 1cc2000
channel 0 response q phy addr 1cc3000
channel 1 request q phy addr 1cc4000
channel 1 response q phy addr 1cc5000
scsibus0 at mv_sata_integ0 channel 0: 15 targets, 1 lun per target
scsibus1 at mv_sata_integ0 channel 1: 15 targets, 1 lun per target
applgpio0 at mv_socbus0 unit -1GPIO_interrupt_pin_ex: flipping pin 49.
GPIO_interrupt_pin_ex: flipping pin 11.
(board-revision=0)
mv_pcibus0 at mainbus0
mv_pcibus_attach()
PEX0 interface detected Link X1
mv_pcibus0: configuring PCI interface 0
pci0 at mv_pcibus0 bus 0
pci0: i/o space, memory space enabled
ppb0 at pci0 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled
ppb1 at pci1 dev 1 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled
bwl0 at pci2 dev 0 function 0wlan: mac acl policy registered
bwl0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
bwl0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl0: 11ng MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps
bwl0: interrupting at pci0int09
ppb2 at pci1 dev 2 function 0: vendor 0x12d8 product 0x0303 (rev. 0x03)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled
bwl1 at pci3 dev 0 function 0bwl1: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
bwl1: 11na MCS: 15Mbps 30Mbps 45Mbps 60Mbps 90Mbps 120Mbps 135Mbps 150Mbps 30Mbps 60Mbps 90Mbps 120Mbps 180Mbps 240Mbps 270Mbps 300Mbps 45Mbps 90Mbps 135Mbps 180Mbps 270Mbps 360Mbps 405Mbps 450Mbps
bwl1: interrupting at pci0int09
obio0 at mainbus0
com0 at obio0 addr 0xf1012000 irq 33: ns16550a, working fifo
com0: console
com1 at obio0 addr 0xf1012100 irq 34: ns16550a, working fifo
nandflash0 at obio0 addr 0xfa000000-0xfa0fffffflashattach: no device found
stdflash0 at obio0 addr 0xf4000000-0xf4ffffff: onboard SPI NOR flash
FLASH look for .... 0) ef/4018/20/2018
FLASH look for .... 1) ef/4018/c2/2017
FLASH look for .... 2) ef/4018/c2/2018
FLASH look for .... 3) ef/4018/c2/2013
FLASH look for .... 4) ef/4018/ef/4018
FLASH look for .... 5) ef/4018/1/2018
FLASH SUPPORTED.... ef/4018/4/0
flash0 at stdflash0 00200000-00900000, untranslated, read/write
flash1 at stdflash0 00900000-01000000, untranslated, read/write
flash2 at stdflash0 000c0000-00200000, translated, read/write
flash3 at stdflash0 00080000-000c0000, untranslated, read/write
flash4 at stdflash0 00000000-00080000, untranslated, read/write
clock: hz=100 stathz=0 profhz=0, mvTclk=200000000
md0: internal 10240 KB image area
IPsec: Initialized Security Association Processing.
scsibus0: waiting 2 seconds for devices to settle...
scsibus1: waiting 2 seconds for devices to settle...
boot device: <unknown>
root on md0a dumps on md0b
root file system type: ffs
WARNING: clock gained 1618 days
WARNING: CHECK AND RESET THE DATE!
Sun Oct 11 06:16:49 GMT 2020
Starting file system checks:
fsck_ffs: ioctl (DIOCGWEDGEINFO): Inappropriate ioctl for device
/dev/rmd0a: file system is clean; not checking
Setting tty flags.
Setting sysctl variables:
kern.defcorename: %n.core -> /tmp/%n.core
kern.logsigexit: 0 -> 1
sysctl: /etc/sysctl.conf#5: second level name 'lines' in 'ddb.lines' is invalid
net.inet6.tcp6.mss_ifmtu: 0 -> 1
Starting network.
/etc/rc: WARNING: $hostname not set.
IPv6 mode: host
Configuring network interfaces:.
Adding interface aliases:
Building databases...
install: not found
install: not found
Setting securelevel: kern.securelevel: 0 -> 1
checking /dev/flash2a ...
** /dev/rflash2a
** Last Mounted on /mnt/Flash
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3 - Check Connectivity
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cyl groups
5 files, 79 used, 2162 free (10 frags, 269 blocks, 0.4% fragmentation)
MARK FILE SYSTEM CLEAN? yes
***** FILE SYSTEM MARKED CLEAN *****
***** FILE SYSTEM WAS MODIFIED *****
Mounting all filesystems...
Starting acpd.
Starting inetd.
Starting cron.
Sun Oct 11 06:16:53 GMT 2020
Apple AirPort Firmware
Copyright (C) 2005-2012 Apple Inc. All rights reserved.
console on Amnesiac
Last login: Sat Oct 10 23:16:55 2020 on tty01
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
2006, 2007
The NetBSD Foundation, Inc. All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
Terminal type is vt100.
# mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
mgi_init: ifp=0xc237603c, sc=0xc2376000
# mgi_init: ifp=0xc22cf03c, sc=0xc22cf000
Oct 10 23:17:06 mDNSResponder: mDNSResponder mDNSResponder-397.32 (May 6 2016 17:34:46) starting
# ls -R
.editrc .ssh bin etc libdata mnt tmp var
.profile Volumes dev lib libexec sbin usr
./.ssh:
authorized_keys
./Volumes:
./bin:
[ date echo ln mv rmdir sync
cat dd expr ls ps sh test
chmod df hostname mkdir pwd sleep
cp domainname kill mknod rm stty
./dev:
MAKEDEV dk45 ld7f rccd9f rld3f rsd9c
amdio0 dk46 ld7g rccd9g rld3g rsd9d
applgpio0 dk47 ld7h rccd9h rld3h rsd9e
bpf dk48 ld8a rdk0 rld4a rsd9f
bpf0 dk49 ld8b rdk1 rld4b rsd9g
ccd0a dk5 ld8c rdk10 rld4c rsd9h
ccd0b dk6 ld8d rdk11 rld4d scsibus0
ccd0c dk7 ld8e rdk12 rld4e scsibus1
ccd0d dk8 ld8f rdk13 rld4f scsibus2
ccd0e dk9 ld8g rdk14 rld4g sd0a
ccd0f dmoverio ld8h rdk15 rld4h sd0b
ccd0g drum ld9a rdk16 rld5a sd0c
ccd0h drvctl ld9b rdk17 rld5b sd0d
ccd10a dty00 ld9c rdk18 rld5c sd0e
ccd10b dty01 ld9d rdk19 rld5d sd0f
ccd10c flash0a ld9e rdk2 rld5e sd0g
ccd10d flash0b ld9f rdk20 rld5f sd0h
ccd10e flash0c ld9g rdk21 rld5g sd10a
ccd10f flash0d ld9h rdk22 rld5h sd10b
ccd10g flash0e md0a rdk23 rld6a sd10c
ccd10h flash0f md0c rdk24 rld6b sd10d
ccd11a flash0g mem rdk25 rld6c sd10e
ccd11b flash0h null rdk26 rld6d sd10f
ccd11c flash1a pci0 rdk27 rld6e sd10g
ccd11d flash1b pci1 rdk28 rld6f sd10h
ccd11e flash1c pci2 rdk29 rld6g sd11a
ccd11f flash1d pci3 rdk3 rld6h sd11b
ccd11g flash1e pci4 rdk30 rld7a sd11c
ccd11h flash1f pci5 rdk31 rld7b sd11d
ccd12a flash1g pci6 rdk32 rld7c sd11e
ccd12b flash1h pci7 rdk33 rld7d sd11f
ccd12c flash2a pf rdk34 rld7e sd11g
ccd12d flash2b power rdk35 rld7f sd11h
ccd12e flash2c ptyp0 rdk36 rld7g sd12a
ccd12f flash2d ptyp1 rdk37 rld7h sd12b
ccd12g flash2e ptyp2 rdk38 rld8a sd12c
ccd12h flash2f ptyp3 rdk39 rld8b sd12d
ccd13a flash2g ptyp4 rdk4 rld8c sd12e
ccd13b flash2h ptyp5 rdk40 rld8d sd12f
ccd13c flash3a ptyp6 rdk41 rld8e sd12g
ccd13d flash3b ptyp7 rdk42 rld8f sd12h
ccd13e flash3c ptyp8 rdk43 rld8g sd13a
ccd13f flash3d ptyp9 rdk44 rld8h sd13b
ccd13g flash3e ptypa rdk45 rld9a sd13c
ccd13h flash3f ptypb rdk46 rld9b sd13d
ccd14a flash3g ptypc rdk47 rld9c sd13e
ccd14b flash3h ptypd rdk48 rld9d sd13f
ccd14c flash4a ptype rdk49 rld9e sd13g
ccd14d flash4b ptypf rdk5 rld9f sd13h
ccd14e flash4c random rdk6 rld9g sd14a
ccd14f flash4d rccd0a rdk7 rld9h sd14b
ccd14g flash4e rccd0b rdk8 rmd0a sd14c
ccd14h flash4f rccd0c rdk9 rmd0c sd14d
ccd15a flash4g rccd0d rflash0.raw rsd0a sd14e
ccd15b flash4h rccd0e rflash0a rsd0b sd14f
ccd15c iic0 rccd0f rflash0b rsd0c sd14g
ccd15d ipauth rccd0g rflash0c rsd0d sd14h
ccd15e ipl rccd0h rflash0d rsd0e sd15a
ccd15f iplookup rccd10a rflash0e rsd0f sd15b
ccd15g ipnat rccd10b rflash0f rsd0g sd15c
ccd15h ipscan rccd10c rflash0g rsd0h sd15d
ccd1a ipstate rccd10d rflash0h rsd10a sd15e
ccd1b ipsync rccd10e rflash1.raw rsd10b sd15f
ccd1c klog rccd10f rflash1a rsd10c sd15g
ccd1d kmem rccd10g rflash1b rsd10d sd15h
ccd1e ksyms rccd10h rflash1c rsd10e sd1a
ccd1f ld0a rccd11a rflash1d rsd10f sd1b
ccd1g ld0b rccd11b rflash1e rsd10g sd1c
ccd1h ld0c rccd11c rflash1f rsd10h sd1d
ccd2a ld0d rccd11d rflash1g rsd11a sd1e
ccd2b ld0e rccd11e rflash1h rsd11b sd1f
ccd2c ld0f rccd11f rflash2.raw rsd11c sd1g
ccd2d ld0g rccd11g rflash2a rsd11d sd1h
ccd2e ld0h rccd11h rflash2b rsd11e sd2a
ccd2f ld10a rccd12a rflash2c rsd11f sd2b
ccd2g ld10b rccd12b rflash2d rsd11g sd2c
ccd2h ld10c rccd12c rflash2e rsd11h sd2d
ccd3a ld10d rccd12d rflash2f rsd12a sd2e
ccd3b ld10e rccd12e rflash2g rsd12b sd2f
ccd3c ld10f rccd12f rflash2h rsd12c sd2g
ccd3d ld10g rccd12g rflash3.raw rsd12d sd2h
ccd3e ld10h rccd12h rflash3a rsd12e sd3a
ccd3f ld11a rccd13a rflash3b rsd12f sd3b
ccd3g ld11b rccd13b rflash3c rsd12g sd3c
ccd3h ld11c rccd13c rflash3d rsd12h sd3d
ccd4a ld11d rccd13d rflash3e rsd13a sd3e
ccd4b ld11e rccd13e rflash3f rsd13b sd3f
ccd4c ld11f rccd13f rflash3g rsd13c sd3g
ccd4d ld11g rccd13g rflash3h rsd13d sd3h
ccd4e ld11h rccd13h rflash4.raw rsd13e sd4a
ccd4f ld12a rccd14a rflash4a rsd13f sd4b
ccd4g ld12b rccd14b rflash4b rsd13g sd4c
ccd4h ld12c rccd14c rflash4c rsd13h sd4d
ccd5a ld12d rccd14d rflash4d rsd14a sd4e
ccd5b ld12e rccd14e rflash4e rsd14b sd4f
ccd5c ld12f rccd14f rflash4f rsd14c sd4g
ccd5d ld12g rccd14g rflash4g rsd14d sd4h
ccd5e ld12h rccd14h rflash4h rsd14e sd5a
ccd5f ld13a rccd15a rld0a rsd14f sd5b
ccd5g ld13b rccd15b rld0b rsd14g sd5c
ccd5h ld13c rccd15c rld0c rsd14h sd5d
ccd6a ld13d rccd15d rld0d rsd15a sd5e
ccd6b ld13e rccd15e rld0e rsd15b sd5f
ccd6c ld13f rccd15f rld0f rsd15c sd5g
ccd6d ld13g rccd15g rld0g rsd15d sd5h
ccd6e ld13h rccd15h rld0h rsd15e sd6a
ccd6f ld14a rccd1a rld10a rsd15f sd6b
ccd6g ld14b rccd1b rld10b rsd15g sd6c
ccd6h ld14c rccd1c rld10c rsd15h sd6d
ccd7a ld14d rccd1d rld10d rsd1a sd6e
ccd7b ld14e rccd1e rld10e rsd1b sd6f
ccd7c ld14f rccd1f rld10f rsd1c sd6g
ccd7d ld14g rccd1g rld10g rsd1d sd6h
ccd7e ld14h rccd1h rld10h rsd1e sd7a
ccd7f ld15a rccd2a rld11a rsd1f sd7b
ccd7g ld15b rccd2b rld11b rsd1g sd7c
ccd7h ld15c rccd2c rld11c rsd1h sd7d
ccd8a ld15d rccd2d rld11d rsd2a sd7e
ccd8b ld15e rccd2e rld11e rsd2b sd7f
ccd8c ld15f rccd2f rld11f rsd2c sd7g
ccd8d ld15g rccd2g rld11g rsd2d sd7h
ccd8e ld15h rccd2h rld11h rsd2e sd8a
ccd8f ld1a rccd3a rld12a rsd2f sd8b
ccd8g ld1b rccd3b rld12b rsd2g sd8c
ccd8h ld1c rccd3c rld12c rsd2h sd8d
ccd9a ld1d rccd3d rld12d rsd3a sd8e
ccd9b ld1e rccd3e rld12e rsd3b sd8f
ccd9c ld1f rccd3f rld12f rsd3c sd8g
ccd9d ld1g rccd3g rld12g rsd3d sd8h
ccd9e ld1h rccd3h rld12h rsd3e sd9a
ccd9f ld2a rccd4a rld13a rsd3f sd9b
ccd9g ld2b rccd4b rld13b rsd3g sd9c
ccd9h ld2c rccd4c rld13c rsd3h sd9d
console ld2d rccd4d rld13d rsd4a sd9e
constty ld2e rccd4e rld13e rsd4b sd9f
dk0 ld2f rccd4f rld13f rsd4c sd9g
dk1 ld2g rccd4g rld13g rsd4d sd9h
dk10 ld2h rccd4h rld13h rsd4e stderr
dk11 ld3a rccd5a rld14a rsd4f stdin
dk12 ld3b rccd5b rld14b rsd4g stdout
dk13 ld3c rccd5c rld14c rsd4h sysmon
dk14 ld3d rccd5d rld14d rsd5a tty
dk15 ld3e rccd5e rld14e rsd5b tty00
dk16 ld3f rccd5f rld14f rsd5c tty01
dk17 ld3g rccd5g rld14g rsd5d ttyp0
dk18 ld3h rccd5h rld14h rsd5e ttyp1
dk19 ld4a rccd6a rld15a rsd5f ttyp2
dk2 ld4b rccd6b rld15b rsd5g ttyp3
dk20 ld4c rccd6c rld15c rsd5h ttyp4
dk21 ld4d rccd6d rld15d rsd6a ttyp5
dk22 ld4e rccd6e rld15e rsd6b ttyp6
dk23 ld4f rccd6f rld15f rsd6c ttyp7
dk24 ld4g rccd6g rld15g rsd6d ttyp8
dk25 ld4h rccd6h rld15h rsd6e ttyp9
dk26 ld5a rccd7a rld1a rsd6f ttypa
dk27 ld5b rccd7b rld1b rsd6g ttypb
dk28 ld5c rccd7c rld1c rsd6h ttypc
dk29 ld5d rccd7d rld1d rsd7a ttypd
dk3 ld5e rccd7e rld1e rsd7b ttype
dk30 ld5f rccd7f rld1f rsd7c ttypf
dk31 ld5g rccd7g rld1g rsd7d ulpn0
dk32 ld5h rccd7h rld1h rsd7e ulpn1
dk33 ld6a rccd8a rld2a rsd7f ulpn2
dk34 ld6b rccd8b rld2b rsd7g ulpn3
dk35 ld6c rccd8c rld2c rsd7h ulpt0
dk36 ld6d rccd8d rld2d rsd8a ulpt1
dk37 ld6e rccd8e rld2e rsd8b ulpt2
dk38 ld6f rccd8f rld2f rsd8c ulpt3
dk39 ld6g rccd8g rld2g rsd8d urandom
dk4 ld6h rccd8h rld2h rsd8e usb
dk40 ld7a rccd9a rld3a rsd8f usb0
dk41 ld7b rccd9b rld3b rsd8g watchdog
dk42 ld7c rccd9c rld3c rsd8h zero
dk43 ld7d rccd9d rld3d rsd9a
dk44 ld7e rccd9e rld3e rsd9b
./etc:
APImage.png hostap_wlan1.time_acc racoon
afpservervols.cfg hostap_wlan1.wpa_psk rc
cifs hosts rc.conf
crontab inetd.conf rc.d
defaults issue rc.shutdown
dhclient-enter-hooks localtime rc.subr
dhclient-exit-hooks master.passwd resolv.conf
dns mdnsd.conf rpc
flash2.disktab netconfig rtsol-enter-hooks
fstab newsyslog.conf rtsol-exit-hooks
gettytab nsswitch.conf services
group openssl spwd.db
hostap_wlan0.conf pam.conf ssh
hostap_wlan0.eap_user passwd sysctl.conf
hostap_wlan0.time_acc pf.os syslog.conf
hostap_wlan0.wpa_psk ppp ttys
hostap_wlan1.conf protocols usermgmt.conf
hostap_wlan1.eap_user pwd.db
./etc/cifs:
cm_cfg.txt cs_cfg.txt
./etc/defaults:
pf.boot.conf rc.conf
./etc/dns:
manual-nameservers
./etc/openssl:
./etc/ppp:
ipv4-dn ipv4-up
./etc/racoon:
racoon.conf remote
./etc/racoon/remote:
anonymous.conf
./etc/rc.d:
DAEMON cron inetd mountcritremote sysdb
LOGIN dhclient ipfilter network ttys
NETWORKING dhcpd ipnat root
NULL downinterfaces ipsec securelevel
SERVERS flash mountall svscan
acpd fsck mountcritlocal sysctl
./etc/ssh:
./lib:
security
./lib/security:
./libdata:
firmware
./libdata/firmware:
mwl
./libdata/firmware/mwl:
./libexec:
./mnt:
Flash Memory swap
./mnt/Flash:
ACPData.bin ACPData.bin.1 ACPData.bin.2 ACPData.bin.3
./mnt/Memory:
./mnt/swap:
./sbin:
ACPd flashctl mount_ffs rtsol
acp-update-network fsck mount_hfs rtsol-script
afpserver fsck_ffs mount_mfs rtsold
brconfig fsck_hfs mount_msdos scsictl
bwl fsck_msdos newfs setkey
ccdconfig gpt newfs_hfs shutdown
dhclient halt pfctl snmpd
dhclient-script hostapd pflogd sntpd
diskd i2cctl ping sysctl
disklabel iCloudd ping6 ttyflags
dmesg ifconfig poweroff twiddle-gpio
dns-update-script init printd umount
drvctl link_local rcorder wcifsfs
esconfig mDNSResponder reboot wcifsnd
ether-port mount route wpa_supplicant
./tmp:
ACPIPC ACPdLogFifo
./usr:
bin lib libexec local sbin share
./usr/bin:
acp du iperf more pkill tail uname
chgrp env less newsyslog sed top wall
curl false logger nohup ssh true
defaults fstat login openssl ssh-keygen tset
./usr/libexec:
ftp-proxy getty
./usr/local:
share
./usr/local/share:
curl
./usr/local/share/curl:
curl-ca-bundle.crt
./usr/sbin:
arp dhcpd esctl pppoectl rtspproxy svc user
chown dnscache ifwatchd pwd_mkdb six4d svok useradd
cron envdir inetd racoon sshd svscan userdel
dev_mkdb envstat natpmpd rtadvd supervise tcpdump walldns
./usr/share:
misc
./usr/share/misc:
termcap
./var:
chroot cron db dns log run sv tmp
./var/chroot:
sshd
./var/chroot/sshd:
./var/cron:
tabs
./var/cron/tabs:
./var/db:
./var/dns:
./var/log:
ACPd.log hostap_wlan0.log lpd-errs wtmpx
authlog hostap_wlan1.log messages xferlog
cron lastlogx usrLog
./var/run:
ACPd.pid dev.db log printd.pid utmp
cron.pid inetd.pid mDNSResponder racoon utmpx
./var/run/racoon:
./var/sv:
dnscache walldns
./var/sv/dnscache:
down env log root run seed supervise
./var/sv/dnscache/env:
CACHESIZE FORWARDONLY GID IPSEND ROOT UID
./var/sv/dnscache/log:
run supervise
./var/sv/dnscache/log/supervise:
control lock ok status
./var/sv/dnscache/root:
ip servers
./var/sv/dnscache/root/ip:
127 fe80
./var/sv/dnscache/root/servers:
./var/sv/dnscache/supervise:
control lock ok status
./var/sv/walldns:
down env log root run supervise
./var/sv/walldns/env:
GID IP ROOT UID
./var/sv/walldns/log:
run supervise
./var/sv/walldns/log/supervise:
control lock ok status
./var/sv/walldns/root:
./var/sv/walldns/supervise:
control lock ok status
./var/tmp:
And if you break into the bootloader, you have these commands available:
EDK Boot Loader commands (help command for more info):
airboot filelocation loadaddress; load file to given address and jump to that location.
airboot [primary | secondary] ; immediately execute primary or secondary image.
bcm [r|w] page register [length|data]; talk to the broadcom switch chip
bootx [-k kernel][-d devtree][-r ramdisk][-b args] boot Darwin.
break; Generate debugging breakpoint
connect[d]; Connect all EFI devices. d means disconnect
cp file1 file2; copy file
device; Show information about boot devices
devtree [devtreenode] [-d devtree] [-e] [-v] [-p]
diff file1 file2; compare files
dir dirdev [*match]; directory listing of dirdev. opt match a substring
diskio [r|w] offset [length [dataptr]]; do a DiskIO read or write
exit; Exit EBL
flash file offset; read 'file' and write it into flash at 'offset'
go dev:path loadaddress entrypoint args; load to given address and jump in
help [cmd]; Help on cmd or a list of all commands if cmd is ommited
hexdump filename ; dump a file as hex bytes
hob; dump HOBs
ip ; print current ip address
[r]; request DHCP address
[s] ipaddr; set static IP address
ir register [new-value]; (32bit) internal register read/write (ex: ir 40000)
loadfv devname; Load PI FV from device
md [Addr] [Len] [1|2|4]; Memory Dump from Addr Len bytes
memmap; dump EFI memory map
mfill Addr Data [1|2|4] [count]; Write [count] copies of Data starting at Addr. Specify width if desired.
page [on|off]]; toggle promting on command output larger than screen
pause [sec]; Pause for sec[10] seconds.
pci [bus] [dev] [func]; Dump PCI
phyacc [r|w] page register [length|data]; talk to the switch chip
phyacc u ;Up the switch chip
phyacc d ;Down the switch chip
reset [type]; Reset system. type = [warm] [shutdown] default is cold reset
setvar var=data [nv]; Write static variable (add nv for non-volatile storage)
sleep [sec]; Sleep for sec[10] seconds.
spi ; recv length
send data_out
xfer data_out
config baud
start path; EFI Boot Device:filepath. fs1:\EFI\BOOT.EFI
twsi [r|w] slaveaddress register [length|data]; Communicate using TWSI.
var ; Read static variables
K10A>
Now that you have serial access it would be interesting if you could determine whether or not kwboot is enabled. Find a u-boot image for a device with similar SOC and see if you can kwboot the image..
kwboot did not work directly (it would just sit at Sending boot message. Please reboot the target... the whole time.)
However, I did see the chip sending ^U repeatedly (@115200, I didn't verify on the scope that is what is was sending though) after some time.
The chip did not boot normally if I powered it up while trying to kwboot. It seems that you can send some characters to get it to stop sending the ^U and continue booting. ^U is NAK of Xmodem protocol though.
Hi,
is there any progress?
Here is kwbimage.cfg
modified with the values from the original Apple firmware: https://gist.github.com/halmartin/35dfdc8d07d937e2206ca1d901f910d7
I don't have any output from the UART though, so probably the MPP configuration I copied from the sheevaplug is not correct for this board.
Note that I am testing by directly flashing to SPI, I didn't try kwboot
since people here have said it doesn't work.
any progress?
kwbimage.cfg
modified with values from the original Apple firmware for the AirPort Time Capsule (A1409):
Same caveats as the AirPort Extreme A1408 (no UART output, haven't tried kwboot
)
Any progress on this? I recently recieved one of these devices and would like to use openwrt on it one day.
I would like to make a relevant point particular for those devices: There is still demand and People are willing to pay good money for them, even though they are aged hardware. Occasionally Apple even still releases firmware security fixes.
I would check, if you can sell it on eBay.
And for that money, you can get a lot more suitable devices for OpenWRT with a non-Broadcom Wifi and likely even more RAM these days. And I think the Apple routers never had WPA3 Support in the Wifi drivers.
Of course mPCI and SATA seem tempting assets on first sight. But considering the progress in this thread, how long will it take, before you can make good use of it?
I understand, though for my use case the Airport Extreme would be fine actually, since I am planning to use just the Ethernet and USB, not the Wifi. I'm also planning on using it to replace a weaker device currently on OpenWrt, once supported.
Not just SATA, but 12V SATA for 3.5" drives in a case nice enough that the wife doesn't mind.
The options for a tiny router with 2.5" SATA drive with internal power are few, and even worse when considering something that looks decent enough to fit in a living room.
should be:
The options for a tiny router with 3.5" SATA drive with internal power are few, and even worse when considering something that looks decent enough to fit in a living room.
There are several options for a 2.5" drive, but much less storage available in the 2.5" form.