Anyone working on a build for Amplifi HD router?

I have a spare one lying around and would love to help if I can.

I got my amplifi open and found a writeup on how to access the J11 serial connectors. Going to try to gain access to the bootloader

Link to the writeup. https://github.com/alexanderhenne/AFi-R

Judging from the posted bootlog, this looks pretty standard ath79 + ath10k, 128MiB RAM + 32MiB flash.

Well except for controlling the lcd on the front. But that is an afterthought I think.

1 Like

I got bootloader access to the router via the serial connectors in the above linked post.

I'm not sure where to go here. am I to assume that since the chips you already mentioned above are supported that I should be able to update config files and compile?

Did you have any joy with getting any further with this?

I have one too. But is it hard to get access to the board? Any glue or clips etc?

I'm trying to create an image for the Amplifi Router HD. So far I'm able to boot with bootm if the image is below 5.8Mb.

But I need help, and I have a question regarding the partitions.
When I boot from bootm I see this:

[    0.470938] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[    0.476329] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.483010] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.489900] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.496988] Creating 7 MTD partitions on "spi0.0":
[    0.501977] 0x000000000000-0x000000060000 : "u-boot"
[    0.551669] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.559042] 0x000000070000-0x000000b70000 : "firmware"
[    0.565558] 2 uimage-fw partitions found on MTD device firmware
[    0.571736] Creating 2 MTD partitions on "firmware":
[    0.576866] 0x000000000000-0x000000150000 : "kernel"
[    0.584374] 0x000000150000-0x000000b00000 : "rootfs"
[    0.590465] mtd: setting mtd4 (rootfs) as root device
[    0.596595] 1 squashfs-split partitions found on MTD device rootfs
[    0.603060] 0x000000ac0000-0x000000b00000 : "rootfs_data"
[    0.610451] 0x000000b70000-0x000000c30000 : "cfg"
[    0.616332] 0x000000c30000-0x000000fe0000 : "recovery"
[    0.624198] 0x000000fe0000-0x000000ff0000 : "prst"
[    0.630298] 0x000000ff0000-0x000001000000 : "art"
[    0.637755] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions

If we have a look at OEM boot

[    0.604084] m25p80 spi0.0: found mx25l25635e, expected m25p80
[    0.610358] m25p80 spi0.0: mx25l25635e (32768 Kbytes)
[    0.615622] afi_part: Parsing AmpliFi partitions
[    0.620437] afi_part: bs1: 5AFEB007 B5B5B5B5 valid active
[    0.626022] afi_part: bs2: 5AFEB007 FFFFFFFF valid inactive
[    0.631778] afi_part: First firmware is active
[    0.636367] 12 afi partitions found on MTD device spi0.0
[    0.641859] Creating 12 MTD partitions on "spi0.0":
[    0.646902] 0x000000000000-0x000000060000 : "u-boot"
[    0.652769] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.658886] 0x000000fe0000-0x000000ff0000 : "prst"
[    0.664507] 0x000000ff0000-0x000001000000 : "eeprom"
[    0.670228] 0x000000b70000-0x000000c30000 : "cfg"
[    0.675760] 0x000000c30000-0x000000fe0000 : "recovery"
[    0.681756] 0x000000070000-0x000000b70000 : "firmware"
[    0.725059] 2 uimage-fw partitions found on MTD device firmware
[    0.731206] 0x000000070000-0x0000001c0000 : "kernel"
[    0.736978] 0x0000001c0000-0x000000b70000 : "rootfs"
[    0.742763] mtd: device 8 (rootfs) set to be root filesystem
[    0.748689] 1 squashfs-split partitions found on MTD device rootfs
[    0.755115] 0x000000b30000-0x000000b70000 : "rootfs_data"
[    0.761390] 0x000001420000-0x000001f20000 : "fw_inactive"
[    0.767586] 0x000001000000-0x000001010000 : "bs1"
[    0.773145] 0x000001010000-0x000001020000 : "bs2"
[    0.778639] 0x000001020000-0x000001420000 : "stats"
[    0.784386] 0x000001f20000-0x000002000000 : "reserved"

In my DTS I have defined

&spi {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x000000 0x060000>;
				read-only;
			};

			partition@60000 {
				label = "u-boot-env";
				reg = <0x060000 0x010000>;
				read-only;
			};

			partition@70000 {
				label = "firmware";
				reg = <0x070000 0xb00000>;
				compatible = "denx,uimage";
			};

			partition@b70000 {
				label = "cfg";
				reg = <0xb70000 0x0c0000>;
				read-only;
			};

			partition@c30000 {
				label = "recovery";
				reg = <0xc30000 0x3b0000>;
				read-only;
			};

			partition@fe0000 {
				label = "prst";
				reg = <0xfe0000 0x010000>;
				read-only;
			};

			art: partition@ff0000 {
				label = "art";
				reg = <0xff0000 0x010000>;
				read-only;

				nvmem-layout {
					compatible = "fixed-layout";
					#address-cells = <1>;
					#size-cells = <1>;

					macaddr_art_0: macaddr@0 {
						reg = <0x0 0x6>;
					};

					cal_art_5000: calibration@5000 {
						reg = <0x5000 0x844>;
					};
				};
			};
		};
	};
};

From u-boot

ath> mtdparts

device nor0 <ath-nor0>, # parts = 7
 #: name                        size            offset          mask_flags
 0: u-boot                      0x00060000      0x00000000      0
 1: u-boot-env                  0x00010000      0x00060000      0
 2: firmware                    0x00b00000      0x00070000      0
 3: cfg                         0x000c0000      0x00b70000      0
 4: recovery                    0x003b0000      0x00c30000      0
 5: prst                        0x00010000      0x00fe0000      0
 6: EEPROM                      0x00010000      0x00ff0000      0

active partition: nor0,0 - (u-boot) 0x00060000 @ 0x00000000

defaults:
mtdids  : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),11264k(firmware),768k(cfg),3776k(recovery),64k(prst),64k(EEPROM)

Thanks in advance :slight_smile:

Edit: Maybe my firmware-utils config is wrong? https://github.com/skramstad/firmware-utils/commit/b769aa92636c3ae46689b7b1d288d9580d84e5c2

Hello again. I'm testing DSA, however I'm not sure what I'm doing wrong since the bootlog says Generic PHY. The Amplifi HD got a qca8327.

Openwrt with swconfig (bootlog)

[    0.806617] switch0: Atheros AR8327 rev. 4 switch registered on ag71xx-mdio.0
[    1.455789] libphy: ag71xx_mdio: probed
[    2.042449] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[    2.054018] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:sgmii

It does not detect the uid=004dd034

Snapshot with 6.1.82

[    1.375969] ag71xx 19000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.385885] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.700493] qca8k mdio.0:00: configuring for fixed/sgmii link mode
[    1.710921] qca8k mdio.0:00 wan (uninitialized): PHY [qca8k-0.0:00] driver [Generic PHY] (irq=POLL)
[    1.722748] qca8k mdio.0:00 lan1 (uninitialized): PHY [qca8k-0.0:01] driver [Generic PHY] (irq=POLL)
[    1.734101] qca8k mdio.0:00 lan3 (uninitialized): PHY [qca8k-0.0:02] driver [Generic PHY] (irq=POLL)
[    1.745457] qca8k mdio.0:00 lan2 (uninitialized): PHY [qca8k-0.0:03] driver [Generic PHY] (irq=POLL)
[    1.756848] qca8k mdio.0:00 lan4 (uninitialized): PHY [qca8k-0.0:04] driver [Generic PHY] (irq=POLL)
[    1.775826] device eth0 entered promiscuous mode
[    1.780692] DSA: tree 0 setup
[    1.784054] qca8k mdio.0:00: Link is Up - 1Gbps/Full - flow control off

Another thing is that it takes a long time to load the interfaces on boot. Restarting the network service is slow too.

After a short time the lan ports becomes unresponsive for a few seconds, then back again.
It's worse on network traffic vs no traffic. Tried to disable GRO with ethtool but made no difference.

@Ansuel Do you happen to know if there's any working DSA qca8327 dts config/devices I can have a look at to compare.

This is what I've got from stock with swconfig

pll-data = <0x03000101 0x00000101 0x00001919>;

SGMII_CONFIG: 0x000004aa
MR_AN_CONTROL: 0x00000140
PLL (ETH_SGMII): 0x03000101

 		qca,ar8327-initvals = <
+			0x04 0x00000080 /* AR8327_REG_PAD0_MODE */
+			0x08 0x00000000 /* PORT5 PAD MODE CTRL */
+			0x0c 0x00000000 /* PORT6 PAD MODE CTRL */
+			0x10 0x602613a0 /* AR8327_REG_POWER_ON_STRAP */
+			0x50 0xcc35cc35 /* AR8327_REG_LED_CTRL0 */
+			0x54 0xca35ca35 /* AR8327_REG_LED_CTRL1 */
+			0x58 0xc935c935 /* AR8327_REG_LED_CTRL2 */
+			0x5c 0x03ffff00 /* AR8327_REG_LED_CTRL3 */
+			0x7c 0x0000007e /* AR8327_REG_PORT_STATUS(0) */
+			0x94 0x00001080 /* AR8327_REG_PORT_STATUS(6) */

Thanks in advance.

Edit:
Got it to identify at boot.

CONFIG_QCA83XX_PHY=y (was missing)
[    0.665044] ar8xxx: qca8k switch found. skipping legacy drivers.
[    0.678146] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.386004] ag71xx 19000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.395920] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.713386] qca8k mdio.0:00: configuring for fixed/sgmii link mode
[    1.723553] qca8k mdio.0:00: Link is Up - 1Gbps/Full - flow control off
[    1.803552] qca8k mdio.0:00 wan (uninitialized): PHY [qca8k-0.0:00] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[    1.893560] qca8k mdio.0:00 lan1 (uninitialized): PHY [qca8k-0.0:01] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[    1.983569] qca8k mdio.0:00 lan3 (uninitialized): PHY [qca8k-0.0:02] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[    2.073568] qca8k mdio.0:00 lan2 (uninitialized): PHY [qca8k-0.0:03] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[    2.163570] qca8k mdio.0:00 lan4 (uninitialized): PHY [qca8k-0.0:04] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[    2.180947] device eth0 entered promiscuous mode
[    2.185820] DSA: tree 0 setup

I did try to set compatible = "qca,qca8337"; but then I got

[    1.354108] qca8k mdio.0:00: Switch id detected 12 but expected 13

Edit 2:
Up and running with DSA. Was stable under testing, but need to test it for a longer time.

One thing I can't figure out is why I'm missing the RX queue for all the ports.

root@OpenWrt:~# cat /sys/class/net/lan1/queues/tx-0/

Edit 3:
Some simple iperf3 tests. Stock vs OpenWrt DSA.

Note: Amplifi is the iperf3 server on both. (iperf3 is enabled by default on stock image).

Amplifi image 3.7.1

# iperf3-darwin -c amplifi.lan
[ ID] Interval           Transfer     Bitrate         Retr
[  7]   0.00-10.00  sec   279 MBytes   234 Mbits/sec    0             sender
[  7]   0.00-10.00  sec   279 MBytes   234 Mbits/sec                  receiver

# iperf3-darwin -c amplifi.lan -R
[ ID] Interval           Transfer     Bitrate         Retr
[  7]   0.00-10.06  sec   131 MBytes   109 Mbits/sec    0             sender
[  7]   0.00-10.00  sec   130 MBytes   109 Mbits/sec                  receiver

# iperf3-darwin -c amplifi.lan --bidir
[ ID][Role] Interval           Transfer     Bitrate         Retr
[  7][TX-C]   0.00-10.00  sec  12.6 MBytes  10.6 Mbits/sec    0             sender
[  7][TX-C]   0.00-10.03  sec  12.1 MBytes  10.1 Mbits/sec                  receiver
[  9][RX-C]   0.00-10.00  sec   122 MBytes   103 Mbits/sec    0             sender
[  9][RX-C]   0.00-10.03  sec   122 MBytes   102 Mbits/sec                  receiver

OpenWrt DSA

# iperf3-darwin -c 192.168.1.1
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   492 MBytes   413 Mbits/sec    0             sender
[  5]   0.00-10.00  sec   491 MBytes   412 Mbits/sec                  receiver

# iperf3-darwin -c 192.168.1.1 -R
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   269 MBytes   226 Mbits/sec    0             sender
[  5]   0.00-10.00  sec   269 MBytes   226 Mbits/sec                  receiver

# iperf3-darwin -c 192.168.1.1 --bidir
[ ID][Role] Interval           Transfer     Bitrate         Retr
[  5][TX-C]   0.00-10.00  sec   238 MBytes   200 Mbits/sec    0             sender
[  5][TX-C]   0.00-10.01  sec   238 MBytes   200 Mbits/sec                  receiver
[  7][RX-C]   0.00-10.00  sec   137 MBytes   115 Mbits/sec    0             sender
[  7][RX-C]   0.00-10.01  sec   137 MBytes   115 Mbits/sec                  receiver

Edit 2023-04-17:
Pushed a commit for amplifi router hd support. But I'm not sure the best way to flash.
The amplifi does not have /proc/ubnthal/.uf so I can't do any magic. I get that can't write to kernel thing.
I see no fwupdate.real either.

Maybe my last option would be using u-boot?

When it comes to DSA, it fails after 20-30 minutes and only 3 of 5 ports "works". So for now my config is swconfig. This is similar to what other have experienced.

Edit: 2024-04-18

So I got passed the sign check in /sbin/uh-fw-tool (thanks to the github link posted earlier), I had to copy uh-fw-tool to /tmp/uh-fw-tool-patched and:

echo -en '\x00' | dd of=/tmp/uh-fw-tool-patched conv=notrunc bs=1 count=1 seek=$((0x18f3))

But now the interesting part that I can't get my head around. I did

/tmp/uh-fw-tool-patched -f /tmp/openwrt-ath79-generic-ubnt_amplifi-router-hd-squashfs-factory.bin

I get this message in reply:

'rootfs' has incorrect image part size: 00A00000, MTD part size: 009b0000

I've compared cat /proc/mtd and cat /proc/partitions and I can't see any differences between stock and initramfs-kernel image.

This is my patch for mkfwimage.c

+	{
+		.name = "AFi-R-HD",
+		.fw_layout = {
+			.kern_start	=	0x9f070000,
+			.kern_entry	=	0x80060000,
+			.firmware_max_length=	0x00b00000,
+		},
+		.sign = true,
+	},

Anyone with some hints, please do share. I'm stuck for now.
Thanks!

1 Like