Adding support for Comfast CF-E313AC v2

I'm working on porting OpenWrt to the Comfast CF-E313AC v2, which is superficially similar but internally different from the CF-E313AC. Posting here to solicit tips, pointers, criticism, etc on my first port and to document this device.

Hardware:

  • Atheros QCA9563-AL3A 800MHz
  • 128MB RAM (Nanya NT5TU64M16HG-AC)
  • 16MB SPI NOR (MXIC MX25L12833F M2I-10G)
  • QCA9886 2x2 5GHz 802.11ac
  • QCA8337-AL3C 1GbE Ethernet switch
  • RS706C watchdog
  • 4 RSSI LEDs
  • 1 WAN LED
  • 1 LAN LED
  • 1 WLAN LED
  • 1 always-on power LED
  • Serial UART solder pads and unpopulated pins

Two options tested for installation:

  1. Use the stock firmware's update page
  2. Use the uboot firmware flashing webui:
    a. Hold the reset button during boot
    b. When the lights start flashing, continue holding for 8 seconds
    c. Give your computer an IP address like 192.168.1.10
    d. Open your browser to http://192.168.1.1
    e. Use the form to select and upload your sysupgrade firmware file

TFTP flashing at boot is supported from 192.168.1.10.

The uboot console seemed to have keymap issues, so was not really tested.

Serial interface settings:
uboot output: 128000,8n1
linux: 115200,8n1
uboot console: 57600,7n1?

Photos:







Boot Logs:

uboot:

U-Boot 1.1.4-ga1cd7d4b-dirty (Jun  9 2018 - 13:05:32)

ap152 - Dragonfly 1.0DRAM:  
sri
ath_ddr_initial_config(283): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment

ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 22:22:22:22:22:22
eth0 up

Setting 0x181162c0 to 0x28502100
eth0 link down
FAIL
Using eth0 device
Tx Timed out
Tx Timed out
ping failed;
Hit any key to stop autoboot:  1  0 
## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.44
   Created:      2024-12-05   6:26:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1243756 Bytes =  1.2 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

Stock:

[    0.000000] Linux version 3.10.44 (mrbao@ubuntu) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #1 Wed Dec 4 22:25:31 PST 2024
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9561 ver 1 rev 0
[    0.000000] Clocks: CPU:800.000MHz, DDR:650.000MHz, AHB:266.666MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=COMFAST-CF-A5 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(art)ro,1536k(kernel),14400k(rootfs),64k(configs),64k(nvram)ro,15936k@0x50000(firmware) rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 125464k/131072k available (2683k kernel code, 5608k reserved, 783k data, 244k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] NET: Registered protocol family 16
[    0.070000] MIPS: machine is COMFAST CF-A5
[    0.300000] registering PCI controller with io_map_base unset
[    0.310000] bio: create slab <bio-0> at 0
[    0.320000] usbcore: registered new interface driver usbfs
[    0.320000] usbcore: registered new interface driver hub
[    0.330000] usbcore: registered new device driver usb
[    0.330000] PCI host bridge to bus 0000:00
[    0.330000] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.340000] pci_bus 0000:00: root bus resource [io  0x0001]
[    0.340000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.350000] pci 0000:00:00.0: invalid calibration data
[    0.350000] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.360000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.360000] Switching to clocksource MIPS
[    0.370000] NET: Registered protocol family 2
[    0.370000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.370000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.380000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.380000] TCP: reno registered
[    0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.390000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.400000] NET: Registered protocol family 1
[    0.410000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.420000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.430000] msgmni has been set to 245
[    0.430000] io scheduler noop registered
[    0.440000] io scheduler deadline registered (default)
[    0.440000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.470000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.490000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.500000] m25p80 spi0.0: found mx25l12805d, expected m25p80
[    0.500000] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.510000] 7 cmdlinepart partitions found on MTD device spi0.0
[    0.510000] Creating 7 MTD partitions on "spi0.0":
[    0.520000] 0x000000000000-0x000000040000 : "u-boot"
[    0.530000] 0x000000040000-0x000000050000 : "art"
[    0.530000] 0x000000050000-0x0000001d0000 : "kernel"
[    0.540000] 0x0000001d0000-0x000000fe0000 : "rootfs"
[    0.540000] mtd: device 3 (rootfs) set to be root filesystem
[    0.550000] 1 squashfs-split partitions found on MTD device rootfs
[    0.560000] 0x0000007d0000-0x000000fe0000 : "rootfs_data"
[    0.560000] 0x000000fe0000-0x000000ff0000 : "configs"
[    0.570000] 0x000000ff0000-0x000001000000 : "nvram"
[    0.570000] 0x000000050000-0x000000fe0000 : "firmware"
[    0.590000] switch0: Atheros AR8337 rev. 2 switch registered on ag71xx-mdio.0
[    0.670000] libphy: ag71xx_mdio: probed
[    0.680000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.230000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.240000] PPP generic driver version 2.4.2
[    1.250000] PPP BSD Compression module registered
[    1.250000] PPP Deflate Compression module registered
[    1.260000] PPP MPPE Compression module registered
[    1.260000] NET: Registered protocol family 24
[    1.270000] PPTP driver version 0.8.5
[    1.270000] usbcore: registered new interface driver cdc_ether
[    1.280000] usbcore: registered new interface driver rndis_host
[    1.280000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.290000] ehci-pci: EHCI PCI platform driver
[    1.290000] ehci-platform: EHCI generic platform driver
[    1.300000] usbcore: registered new interface driver cdc_acm
[    1.300000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[    1.310000] usbcore: registered new interface driver usbserial
[    1.320000] usbcore: registered new interface driver usbserial_generic
[    1.330000] usbserial: USB Serial support registered for generic
[    1.330000] usbcore: registered new interface driver usb_debug
[    1.340000] usbserial: USB Serial support registered for debug
[    1.340000] usbcore: registered new interface driver option
[    1.350000] usbserial: USB Serial support registered for GSM modem (1-port)
[    1.360000] gre: GRE over IPv4 demultiplexor driver
[    1.360000] TCP: cubic registered
[    1.370000] NET: Registered protocol family 17
[    1.370000] Bridge firewalling registered
[    1.370000] l2tp_core: L2TP core driver, V2.0
[    1.380000] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[    1.380000] 8021q: 802.1Q VLAN Support v1.8
[    1.390000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    1.400000] Freeing unused kernel memory: 244K (803c3000 - 80400000)
[    2.310000] init: Console is alive
[    2.320000] init: - watchdog -
[    3.320000] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.240000] eth0: link up (1000Mbps/Full duplex)
[    6.780000] jffs2: notice: (446) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2 of xdatum (2 unchecked, 0 orphan) and 55 of xref (0 dead, 43 orphan) found.
[    6.790000] mount_root: switching to jffs2 overlay
529+0 records in
529+0 records out
377+0 records in
377+0 records out
[    7.100000] eth0: link down
[    7.110000] procd: - early -
[    7.110000] procd: - watchdog -
[    7.810000] procd: - ubus -
[    8.830000] procd: - init -
Please press Enter to activate this console.
[   10.440000] natsemi dp8381x driver, version 2.1, Sept 11, 2006
[   10.440000]   originally by Donald Becker <becker@scyld.com>
[   10.440000]   2.4.x kernel port by Jeff Garzik, Tjeerd Mulder
[   10.470000] ip_gre: GRE over IPv4 tunneling driver
[   10.480000] i2c /dev entries driver
[   10.500000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   10.510000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   10.640000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   10.650000] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   11.530000] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   11.540000] ath10k_pci 0000:00:00.0: kconfig debug 1 debugfs 0 tracing 1 dfs 1 testmode 1
[   11.560000] ath10k_pci 0000:00:00.0: firmware ver 10.4-3.5.3-00053 api 5 features no-p2p,mfp,peer-flow-ctrl,allows-mesh-bcast crc32 a9603656
[   11.920000] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id 0:0 crc32 5f6d65e7
[   13.720000] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal otp max-sta 512 raw 0 hwcrypto 1
[   13.810000] can't open that file
[   13.810000] can't open that filecan't open that file[   13.830000] u32 classifier
[   13.830000]     input device check on
[   13.830000]     Actions configured
[   13.850000] Mirror/redirect action on
[   13.870000] nf_conntrack version 0.5.0 (1964 buckets, 7856 max)
[   13.900000] Ebtables v2.0 registered
[   13.900000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.920000] mac80211_hwsim: Unknown symbol ieee80211_iterate_active_interfaces (err 0)
[   13.990000] Netfilter messages via NETLINK v0.30.
[   14.020000] xt_time: kernel timezone is -0000
[   14.030000] mac80211_hwsim: Unknown symbol ieee80211_iterate_active_interfaces (err 0)
[   14.050000] ctnetlink v0.93: registering with nfnetlink.
[   14.060000] mac80211_hwsim: Unknown symbol ieee80211_iterate_active_interfaces (err 0)
[   14.080000] mac80211_hwsim: Unknown symbol ieee80211_iterate_active_interfaces (err 0)
[   21.520000] device eth0.1 entered promiscuous mode
[   21.520000] device eth0 entered promiscuous mode
[   21.580000] device eth0.2 entered promiscuous mode

[   23.420000] eth0: link up (1000Mbps/Full duplex)
[   23.420000] br-lan: port 1(eth0.1) entered forwarding state
[   23.430000] br-lan: port 1(eth0.1) entered forwarding state
[   23.430000] br-wan: port 1(eth0.2) entered forwarding state
[   23.440000] br-wan: port 1(eth0.2) entered forwarding state
[   25.430000] br-lan: port 1(eth0.1) entered forwarding state
[   25.430000] Atheros AR8216/AR8236/AR8316 ag71xx-mdio.0:00: Port 2 is up
[   25.440000] br-wan: port 1(eth0.2) entered forwarding state
configs:do check configs
[   29.200000] device wlan0 entered promiscuous mode

COMFAST login: root
Password: 


BusyBox v1.26.2 () built-in shell (ash)

root@COMFAST:~# 

dmesg from openwrt build:

[    0.000000] Linux version 6.6.92 (vscode@6ac8c2f34603) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r29342+4-6b1d0ce88c) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 Wed May 28 07:02:40 2025
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is COMFAST CF-E313AC v2
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 119788K/131072K available (6412K kernel code, 600K rwdata, 1476K rodata, 1232K init, 222K bss, 11284K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 388MHz, resolution 2ns, wraps every 5541893118ns
[    0.008290] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074798] pid_max: default: 32768 minimum: 301
[    0.089038] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.096774] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.113262] RCU Tasks Trace: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[    0.126685] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.137107] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.146778] pinctrl core: initialized pinctrl subsystem
[    0.155349] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.163430] OF: /ahb/eth@19000000: #nvmem-cell-cells = 1 found 0
[    0.170416] /ahb/apb: Fixed dependency cycle(s) with /ahb/apb/interrupt-controller@18060010
[    0.191600] clocksource: Switched to clocksource MIPS
[    0.207081] NET: Registered PF_INET protocol family
[    0.212488] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.220899] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.229874] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.238059] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.246155] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.253629] TCP: Hash tables configured (established 1024 bind 1024)
[    0.260990] MPTCP token hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.268917] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.275854] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.283905] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.289919] PCI: CLS 0 bytes, default 32
[    0.298572] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.306822] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.313019] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.329633] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.336989] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.344804] printk: console [ttyS0] disabled
[    0.349858] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.359125] printk: console [ttyS0] enabled
[    0.368201] printk: bootconsole [early0] disabled
[    0.396080] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.401532] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.408181] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.415049] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.422136] Creating 5 MTD partitions on "spi0.0":
[    0.427102] 0x000000000000-0x000000040000 : "u-boot"
[    0.435306] 0x000000040000-0x000000050000 : "art"
[    0.442413] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.449548] 0x000000fe0000-0x000000ff0000 : "configs"
[    0.457116] 0x000000ff0000-0x000001000000 : "nvram"
[    0.464180] 0x000000050000-0x000000fe0000 : "firmware"
[    0.471587] 2 uimage-fw partitions found on MTD device firmware
[    0.477770] Creating 2 MTD partitions on "firmware":
[    0.482914] 0x000000000000-0x000000290000 : "kernel"
[    0.489977] 0x000000290000-0x000000f90000 : "rootfs"
[    0.497024] mtd: setting mtd6 (rootfs) as root device
[    0.502366] 1 squashfs-split partitions found on MTD device rootfs
[    0.508756] 0x0000007f0000-0x000000f90000 : "rootfs_data"
[    0.528122] OF: /ahb/eth@19000000: #nvmem-cell-cells = 1 found 0
[    0.534410] ag71xx-legacy b9000000.eth: invalid MAC address, using random address
[    1.226149] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    1.883327] ag71xx-legacy b9000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.895343] eth0: Atheros AG71xx at 0xc0049000, irq 4, mode: mii
[    1.901994] i2c_dev: i2c /dev entries driver
[    1.909429] NET: Registered PF_INET6 protocol family
[    1.925832] Segment Routing with IPv6
[    1.929705] In-situ OAM (IOAM) with IPv6
[    1.933980] NET: Registered PF_PACKET protocol family
[    1.939252] 8021q: 802.1Q VLAN Support v1.8
[    1.960052] PCI host bridge to bus 0000:00
[    1.964358] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    1.971469] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.977242] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.985480] pci 0000:00:00.0: [168c:0056] type 00 class 0x028000
[    1.991736] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.998874] pci 0000:00:00.0: PME# supported from D0 D3hot
[    2.005630] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.012536] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.038125] clk: Disabling unused clocks
[    2.049199] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    2.063138] Freeing unused kernel image (initmem) memory: 1232K
[    2.069268] This architecture does not have kernel memory protection.
[    2.075947] Run /sbin/init as init process
[    2.080180]   with arguments:
[    2.080184]     /sbin/init
[    2.080189]   with environment:
[    2.080193]     HOME=/
[    2.080198]     TERM=linux
[    2.703548] init: Console is alive
[    2.707446] init: - watchdog -
[    4.039689] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.077700] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    4.095300] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.113378] init: - preinit -
[    7.861628] random: crng init done
[    9.436098] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is up
[    9.444544] eth0: link up (1000Mbps/Full duplex)
[   13.732294] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[   13.752392] urandom-seed: Seed file not found (/etc/urandom.seed)
[   13.869256] eth0: link down
[   13.887189] procd: - early -
[   13.890481] procd: - watchdog -
[   14.530289] procd: - watchdog -
[   14.555157] procd: - ubus -
[   14.675245] procd: - init -
[   16.014444] kmodloader: loading kernel modules from /etc/modules.d/*
[   17.314829] natsemi dp8381x driver, version 2.1, Sept 11, 2006
                 originally by Donald Becker <becker@scyld.com>
                 2.4.x kernel port by Jeff Garzik, Tjeerd Mulder
[   17.456715] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   17.464510] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   17.554956] urngd: v1.0.2 started.
[   18.146052] PPP generic driver version 2.4.2
[   18.162859] NET: Registered PF_PPPOX protocol family
[   18.275535] ath10k 6.14 driver, optimized for CT firmware, probing pci device: 0x56.
[   18.342554] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   18.349361] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   21.464666] ath10k_pci 0000:00:00.0: qca9888 hw2.0 target 0x01000000 chip_id 0x00000000 sub 0000:0000
[   21.474266] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   21.488740] ath10k_pci 0000:00:00.0: firmware ver 10.4b-ct-9888-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 59e741e7
[   21.841495] ath10k_pci 0000:00:00.0: board_file api 2 bmi_id 0:16 crc32 5968d47d
[   23.610851] ath10k_pci 0000:00:00.0: 10.4 wmi init: vdevs: 16  peers: 48  tid: 96
[   23.618656] ath10k_pci 0000:00:00.0: msdu-desc: 2500  skid: 32
[   23.669931] ath10k_pci 0000:00:00.0: wmi print 'P 48/48 V 16 K 144 PH 176 T 186  msdu-desc: 2500  sw-crypt: 0 ct-sta: 0'
[   23.681244] ath10k_pci 0000:00:00.0: wmi print 'free: 114572 iram: 12644 sram: 29508'
[   23.869144] ath10k_pci 0000:00:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal pre-cal-nvmem max-sta 32 raw 0 hwcrypto 1
[   24.015311] ath: EEPROM regdomain: 0x0
[   24.015336] ath: EEPROM indicates default country code should be used
[   24.015342] ath: doing EEPROM country->regdmn map search
[   24.015356] ath: country maps to regdmn code: 0x3a
[   24.015363] ath: Country alpha2 being used: US
[   24.015370] ath: Regpair used: 0x3a
[   24.113745] kmodloader: done loading kernel modules from /etc/modules.d/*
[   71.614855] eth0: link up (1000Mbps/Full duplex)
[   71.620884] br-lan: port 1(eth0) entered blocking state
[   71.626379] br-lan: port 1(eth0) entered disabled state
[   71.631832] ag71xx-legacy b9000000.eth eth0: entered allmulticast mode
[   71.638821] ag71xx-legacy b9000000.eth eth0: entered promiscuous mode
[   71.692319] br-lan: port 1(eth0) entered blocking state
[   71.697745] br-lan: port 1(eth0) entered forwarding state
[   73.856451] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   73.891732] jffs2_build_filesystem(): unlocking the mtd device... 
[   73.891780] done.
[   73.900150] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[  108.680822] done.
[  108.690583] jffs2: notice: (2408) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  108.885867] overlayfs: upper fs does not support tmpfile.
[12217.791869] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is down
[12220.911572] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is up
[12261.471897] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is down
[14150.111505] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is up
[14169.871865] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is down
[14207.311503] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 1 is up

One thing I haven't yet been able to get working is the integrated QCA8337-AL3C switch. The stock firmware does this in 02_network:

        ucidef_set_interfaces_lan_wan "eth0.1" "eth0.2"
        ucidef_add_switch "switch0" "1" "1"
        ucidef_add_switch_vlan "switch0" "1" "0t 2"
        ucidef_add_switch_vlan "switch0" "2" "0t 1"

but when I try what seems like it should be the modern equivalent:

		ucidef_add_switch "switch0" \
			"0@eth0" "1:wan" "2:lan"

or

		ucidef_add_switch "switch0" \
			"0@eth0" "1:wan:2" "2:lan:1"

I get tagged traffic coming out the ports. I'll try a few more permutations, but any pointers would be welcome.

In bootlog:

so check that both SoC mac and external swicth qca8337 port 0 are configured in sgmii mode.
And show your current dts-file.

Current DTS:

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "qca956x.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>

/ {
	compatible = "comfast,cf-e313ac-v2", "comfast,cf-a5", "qca,qca9563";
	model = "COMFAST CF-E313AC v2";

	aliases {
		serial0 = &uart;
		led-boot = &led_rssihigh;
		led-failsafe = &led_rssihigh;
		led-upgrade = &led_rssihigh;
		label-mac-device = &eth0;
	};

	memory@0 {
		device_type = "memory";
		reg = <0x0 0x08000000>;
	};

	leds {
		compatible = "gpio-leds";
		pinctrl-names = "default";

		wlan {
			function = LED_FUNCTION_WLAN;
			color = <LED_COLOR_ID_GREEN>;
			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
			linux,default-trigger = "phy1tpt";
		};

		lan {
			function = LED_FUNCTION_LAN;
			color = <LED_COLOR_ID_GREEN>;
			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
		};

		wan {
			function = LED_FUNCTION_WAN;
			color = <LED_COLOR_ID_GREEN>;
			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
		};

		rssilow {
			label = "red:rssilow";
			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
		};

		rssimediumlow {
			label = "red:rssimediumlow";
			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
		};

		rssimediumhigh {
			label = "green:rssimediumhigh";
			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
		};

		led_rssihigh: rssihigh {
			label = "green:rssihigh";
			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
		};
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
			debounce-interval = <60>;
		};
	};

	watchdog {
		compatible = "linux,wdt-gpio";

		gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
		hw_algo = "toggle";
		hw_margin_ms = <1000>;
		always-running;
	};
};

&spi {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor", "mxicy,mx25l12805d";
		reg = <0>;
		spi-max-frequency = <50000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x000000 0x040000>;
				read-only;
			};

			partition@40000 {
				label = "art";
				reg = <0x040000 0x010000>;
				read-only;

				nvmem-layout {
					compatible = "fixed-layout";
					#address-cells = <1>;
					#size-cells = <1>;

					macaddr_art_0: macaddr@0 {
						/* LAN / label MAC Address */
						compatible = "mac-base";
						reg = <0x0 0x6>;
						#nvmem-cell-cells = <1>;
					};

					macaddr_art_6: macaddr@6 {
						reg = <0x6 0x6>;
					};

					serialnumber: serial@100 {
						compatible = "linux,serial";
						reg = <0x100 0x100>;
					};

					macaddr_art_1002: macaddr@1002 {
						/* WAN MAC address */
						reg = <0x1002 0x6>;
					};

					precal_art_5000: pre-calibration@5000 {
						reg = <0x5000 0x2f20>;
					};
				};
			};

			partition@7e0000 {
				label = "configs";
				reg = <0xfe0000 0x010000>;
				read-only;
			};

			partition@ff0000 {
				label = "nvram";
				reg = <0xff0000 0x010000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x050000 0xf90000>;
			};
		};
	};
};

&mdio0 {
	status = "okay";

	phy0: ethernet-phy@0 {
		reg = <0>;

		qca,ar8327-initvals = <
			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
			0x7c 0x0000007e /* PORT0_STATUS */
		>;
	};
};

&eth0 {
	status = "okay";

	reg = <0xb9000000 0x200>;

	phy-handle = <&phy0>;

	nvmem-cells = <&macaddr_art_0>;
	nvmem-cell-names = "mac-address";

	gmac-config {
		device = <&gmac>;
	};
};

&pcie {
	status = "okay";

	wifi@0,0 {
		compatible = "qcom,ath10k";
		reg = <0 0 0 0 0>;
		nvmem-cells = <&precal_art_5000>, <&macaddr_art_6>;
		nvmem-cell-names = "pre-calibration", "mac-address";
	};
};

&wdt {
	status = "disabled";
};

I feel like I should be configuring the switch in here, but I looked at other devices like the Linksys SPNMX56 and it wasn't clear to me how to map something like that to this device.

Of course, the current behaviour makes sense if the qca8337 is operating in dumb switch mode because I haven't configured it.

I'm not familiar enough with at79 but you need add something like:

	phy-mode = "sgmii";
	fixed-link {
	      speed = <1000>;
	      full-duplex;
	};

to eth0 and phy0 nodes in dts-file (for mac-to-mac connection phy-mode and speed must be set explicitly).
I'm not sure that qca8337 driver set phy-mode correctly. In last case you have to set sgmii mode and speed with qca,ar8327-initvals. See qca8337 specs for regs and values.