I have a spare one lying around and would love to help if I can.
I got my amplifi open and found a writeup on how to access the J11 serial connectors. Going to try to gain access to the bootloader
Link to the writeup. https://github.com/alexanderhenne/AFi-R
Judging from the posted bootlog, this looks pretty standard ath79 + ath10k, 128MiB RAM + 32MiB flash.
Well except for controlling the lcd on the front. But that is an afterthought I think.
1 Like
I got bootloader access to the router via the serial connectors in the above linked post.
I'm not sure where to go here. am I to assume that since the chips you already mentioned above are supported that I should be able to update config files and compile?
Did you have any joy with getting any further with this?
I have one too. But is it hard to get access to the board? Any glue or clips etc?
I'm trying to create an image for the Amplifi Router HD. So far I'm able to boot with bootm if the image is below 5.8Mb.
But I need help, and I have a question regarding the partitions.
When I boot from bootm I see this:
[ 0.470938] spi-nor spi0.0: mx25l25635e (32768 Kbytes)
[ 0.476329] 7 fixed-partitions partitions found on MTD device spi0.0
[ 0.483010] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.489900] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.496988] Creating 7 MTD partitions on "spi0.0":
[ 0.501977] 0x000000000000-0x000000060000 : "u-boot"
[ 0.551669] 0x000000060000-0x000000070000 : "u-boot-env"
[ 0.559042] 0x000000070000-0x000000b70000 : "firmware"
[ 0.565558] 2 uimage-fw partitions found on MTD device firmware
[ 0.571736] Creating 2 MTD partitions on "firmware":
[ 0.576866] 0x000000000000-0x000000150000 : "kernel"
[ 0.584374] 0x000000150000-0x000000b00000 : "rootfs"
[ 0.590465] mtd: setting mtd4 (rootfs) as root device
[ 0.596595] 1 squashfs-split partitions found on MTD device rootfs
[ 0.603060] 0x000000ac0000-0x000000b00000 : "rootfs_data"
[ 0.610451] 0x000000b70000-0x000000c30000 : "cfg"
[ 0.616332] 0x000000c30000-0x000000fe0000 : "recovery"
[ 0.624198] 0x000000fe0000-0x000000ff0000 : "prst"
[ 0.630298] 0x000000ff0000-0x000001000000 : "art"
[ 0.637755] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
If we have a look at OEM boot
[ 0.604084] m25p80 spi0.0: found mx25l25635e, expected m25p80
[ 0.610358] m25p80 spi0.0: mx25l25635e (32768 Kbytes)
[ 0.615622] afi_part: Parsing AmpliFi partitions
[ 0.620437] afi_part: bs1: 5AFEB007 B5B5B5B5 valid active
[ 0.626022] afi_part: bs2: 5AFEB007 FFFFFFFF valid inactive
[ 0.631778] afi_part: First firmware is active
[ 0.636367] 12 afi partitions found on MTD device spi0.0
[ 0.641859] Creating 12 MTD partitions on "spi0.0":
[ 0.646902] 0x000000000000-0x000000060000 : "u-boot"
[ 0.652769] 0x000000060000-0x000000070000 : "u-boot-env"
[ 0.658886] 0x000000fe0000-0x000000ff0000 : "prst"
[ 0.664507] 0x000000ff0000-0x000001000000 : "eeprom"
[ 0.670228] 0x000000b70000-0x000000c30000 : "cfg"
[ 0.675760] 0x000000c30000-0x000000fe0000 : "recovery"
[ 0.681756] 0x000000070000-0x000000b70000 : "firmware"
[ 0.725059] 2 uimage-fw partitions found on MTD device firmware
[ 0.731206] 0x000000070000-0x0000001c0000 : "kernel"
[ 0.736978] 0x0000001c0000-0x000000b70000 : "rootfs"
[ 0.742763] mtd: device 8 (rootfs) set to be root filesystem
[ 0.748689] 1 squashfs-split partitions found on MTD device rootfs
[ 0.755115] 0x000000b30000-0x000000b70000 : "rootfs_data"
[ 0.761390] 0x000001420000-0x000001f20000 : "fw_inactive"
[ 0.767586] 0x000001000000-0x000001010000 : "bs1"
[ 0.773145] 0x000001010000-0x000001020000 : "bs2"
[ 0.778639] 0x000001020000-0x000001420000 : "stats"
[ 0.784386] 0x000001f20000-0x000002000000 : "reserved"
In my DTS I have defined
&spi {
status = "okay";
flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <25000000>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "u-boot";
reg = <0x000000 0x060000>;
read-only;
};
partition@60000 {
label = "u-boot-env";
reg = <0x060000 0x010000>;
read-only;
};
partition@70000 {
label = "firmware";
reg = <0x070000 0xb00000>;
compatible = "denx,uimage";
};
partition@b70000 {
label = "cfg";
reg = <0xb70000 0x0c0000>;
read-only;
};
partition@c30000 {
label = "recovery";
reg = <0xc30000 0x3b0000>;
read-only;
};
partition@fe0000 {
label = "prst";
reg = <0xfe0000 0x010000>;
read-only;
};
art: partition@ff0000 {
label = "art";
reg = <0xff0000 0x010000>;
read-only;
nvmem-layout {
compatible = "fixed-layout";
#address-cells = <1>;
#size-cells = <1>;
macaddr_art_0: macaddr@0 {
reg = <0x0 0x6>;
};
cal_art_5000: calibration@5000 {
reg = <0x5000 0x844>;
};
};
};
};
};
};
From u-boot
ath> mtdparts
device nor0 <ath-nor0>, # parts = 7
#: name size offset mask_flags
0: u-boot 0x00060000 0x00000000 0
1: u-boot-env 0x00010000 0x00060000 0
2: firmware 0x00b00000 0x00070000 0
3: cfg 0x000c0000 0x00b70000 0
4: recovery 0x003b0000 0x00c30000 0
5: prst 0x00010000 0x00fe0000 0
6: EEPROM 0x00010000 0x00ff0000 0
active partition: nor0,0 - (u-boot) 0x00060000 @ 0x00000000
defaults:
mtdids : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),11264k(firmware),768k(cfg),3776k(recovery),64k(prst),64k(EEPROM)
Thanks in advance 
Edit: Maybe my firmware-utils config is wrong? https://github.com/skramstad/firmware-utils/commit/b769aa92636c3ae46689b7b1d288d9580d84e5c2
Hello again. I'm testing DSA, however I'm not sure what I'm doing wrong since the bootlog says Generic PHY. The Amplifi HD got a qca8327.
Openwrt with swconfig (bootlog)
[ 0.806617] switch0: Atheros AR8327 rev. 4 switch registered on ag71xx-mdio.0
[ 1.455789] libphy: ag71xx_mdio: probed
[ 2.042449] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[ 2.054018] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:sgmii
It does not detect the uid=004dd034
Snapshot with 6.1.82
[ 1.375969] ag71xx 19000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[ 1.385885] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[ 1.700493] qca8k mdio.0:00: configuring for fixed/sgmii link mode
[ 1.710921] qca8k mdio.0:00 wan (uninitialized): PHY [qca8k-0.0:00] driver [Generic PHY] (irq=POLL)
[ 1.722748] qca8k mdio.0:00 lan1 (uninitialized): PHY [qca8k-0.0:01] driver [Generic PHY] (irq=POLL)
[ 1.734101] qca8k mdio.0:00 lan3 (uninitialized): PHY [qca8k-0.0:02] driver [Generic PHY] (irq=POLL)
[ 1.745457] qca8k mdio.0:00 lan2 (uninitialized): PHY [qca8k-0.0:03] driver [Generic PHY] (irq=POLL)
[ 1.756848] qca8k mdio.0:00 lan4 (uninitialized): PHY [qca8k-0.0:04] driver [Generic PHY] (irq=POLL)
[ 1.775826] device eth0 entered promiscuous mode
[ 1.780692] DSA: tree 0 setup
[ 1.784054] qca8k mdio.0:00: Link is Up - 1Gbps/Full - flow control off
Another thing is that it takes a long time to load the interfaces on boot. Restarting the network service is slow too.
After a short time the lan ports becomes unresponsive for a few seconds, then back again.
It's worse on network traffic vs no traffic. Tried to disable GRO with ethtool but made no difference.
@Ansuel Do you happen to know if there's any working DSA qca8327 dts config/devices I can have a look at to compare.
This is what I've got from stock with swconfig
pll-data = <0x03000101 0x00000101 0x00001919>;
SGMII_CONFIG: 0x000004aa
MR_AN_CONTROL: 0x00000140
PLL (ETH_SGMII): 0x03000101
qca,ar8327-initvals = <
+ 0x04 0x00000080 /* AR8327_REG_PAD0_MODE */
+ 0x08 0x00000000 /* PORT5 PAD MODE CTRL */
+ 0x0c 0x00000000 /* PORT6 PAD MODE CTRL */
+ 0x10 0x602613a0 /* AR8327_REG_POWER_ON_STRAP */
+ 0x50 0xcc35cc35 /* AR8327_REG_LED_CTRL0 */
+ 0x54 0xca35ca35 /* AR8327_REG_LED_CTRL1 */
+ 0x58 0xc935c935 /* AR8327_REG_LED_CTRL2 */
+ 0x5c 0x03ffff00 /* AR8327_REG_LED_CTRL3 */
+ 0x7c 0x0000007e /* AR8327_REG_PORT_STATUS(0) */
+ 0x94 0x00001080 /* AR8327_REG_PORT_STATUS(6) */
Thanks in advance.
Edit:
Got it to identify at boot.
CONFIG_QCA83XX_PHY=y (was missing)
[ 0.665044] ar8xxx: qca8k switch found. skipping legacy drivers.
[ 0.678146] ag71xx 19000000.eth: invalid MAC address, using random address
[ 1.386004] ag71xx 19000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[ 1.395920] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[ 1.713386] qca8k mdio.0:00: configuring for fixed/sgmii link mode
[ 1.723553] qca8k mdio.0:00: Link is Up - 1Gbps/Full - flow control off
[ 1.803552] qca8k mdio.0:00 wan (uninitialized): PHY [qca8k-0.0:00] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[ 1.893560] qca8k mdio.0:00 lan1 (uninitialized): PHY [qca8k-0.0:01] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[ 1.983569] qca8k mdio.0:00 lan3 (uninitialized): PHY [qca8k-0.0:02] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[ 2.073568] qca8k mdio.0:00 lan2 (uninitialized): PHY [qca8k-0.0:03] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[ 2.163570] qca8k mdio.0:00 lan4 (uninitialized): PHY [qca8k-0.0:04] driver [Qualcomm Atheros 8327-B internal PHY] (irq=POLL)
[ 2.180947] device eth0 entered promiscuous mode
[ 2.185820] DSA: tree 0 setup
I did try to set compatible = "qca,qca8337"; but then I got
[ 1.354108] qca8k mdio.0:00: Switch id detected 12 but expected 13
Edit 2:
Up and running with DSA. Was stable under testing, but need to test it for a longer time.
One thing I can't figure out is why I'm missing the RX queue for all the ports.
root@OpenWrt:~# cat /sys/class/net/lan1/queues/tx-0/
Edit 3:
Some simple iperf3 tests. Stock vs OpenWrt DSA.
Note: Amplifi is the iperf3 server on both. (iperf3 is enabled by default on stock image).
Amplifi image 3.7.1
# iperf3-darwin -c amplifi.lan
[ ID] Interval Transfer Bitrate Retr
[ 7] 0.00-10.00 sec 279 MBytes 234 Mbits/sec 0 sender
[ 7] 0.00-10.00 sec 279 MBytes 234 Mbits/sec receiver
# iperf3-darwin -c amplifi.lan -R
[ ID] Interval Transfer Bitrate Retr
[ 7] 0.00-10.06 sec 131 MBytes 109 Mbits/sec 0 sender
[ 7] 0.00-10.00 sec 130 MBytes 109 Mbits/sec receiver
# iperf3-darwin -c amplifi.lan --bidir
[ ID][Role] Interval Transfer Bitrate Retr
[ 7][TX-C] 0.00-10.00 sec 12.6 MBytes 10.6 Mbits/sec 0 sender
[ 7][TX-C] 0.00-10.03 sec 12.1 MBytes 10.1 Mbits/sec receiver
[ 9][RX-C] 0.00-10.00 sec 122 MBytes 103 Mbits/sec 0 sender
[ 9][RX-C] 0.00-10.03 sec 122 MBytes 102 Mbits/sec receiver
OpenWrt DSA
# iperf3-darwin -c 192.168.1.1
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 492 MBytes 413 Mbits/sec 0 sender
[ 5] 0.00-10.00 sec 491 MBytes 412 Mbits/sec receiver
# iperf3-darwin -c 192.168.1.1 -R
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 269 MBytes 226 Mbits/sec 0 sender
[ 5] 0.00-10.00 sec 269 MBytes 226 Mbits/sec receiver
# iperf3-darwin -c 192.168.1.1 --bidir
[ ID][Role] Interval Transfer Bitrate Retr
[ 5][TX-C] 0.00-10.00 sec 238 MBytes 200 Mbits/sec 0 sender
[ 5][TX-C] 0.00-10.01 sec 238 MBytes 200 Mbits/sec receiver
[ 7][RX-C] 0.00-10.00 sec 137 MBytes 115 Mbits/sec 0 sender
[ 7][RX-C] 0.00-10.01 sec 137 MBytes 115 Mbits/sec receiver
Edit 2023-04-17:
Pushed a commit for amplifi router hd support. But I'm not sure the best way to flash.
The amplifi does not have /proc/ubnthal/.uf so I can't do any magic. I get that can't write to kernel thing.
I see no fwupdate.real either.
Maybe my last option would be using u-boot?
When it comes to DSA, it fails after 20-30 minutes and only 3 of 5 ports "works". So for now my config is swconfig. This is similar to what other have experienced.
Edit: 2024-04-18
So I got passed the sign check in /sbin/uh-fw-tool (thanks to the github link posted earlier), I had to copy uh-fw-tool to /tmp/uh-fw-tool-patched and:
echo -en '\x00' | dd of=/tmp/uh-fw-tool-patched conv=notrunc bs=1 count=1 seek=$((0x18f3))
But now the interesting part that I can't get my head around. I did
/tmp/uh-fw-tool-patched -f /tmp/openwrt-ath79-generic-ubnt_amplifi-router-hd-squashfs-factory.bin
I get this message in reply:
'rootfs' has incorrect image part size: 00A00000, MTD part size: 009b0000
I've compared cat /proc/mtd and cat /proc/partitions and I can't see any differences between stock and initramfs-kernel image.
This is my patch for mkfwimage.c
+ {
+ .name = "AFi-R-HD",
+ .fw_layout = {
+ .kern_start = 0x9f070000,
+ .kern_entry = 0x80060000,
+ .firmware_max_length= 0x00b00000,
+ },
+ .sign = true,
+ },
Anyone with some hints, please do share. I'm stuck for now.
Thanks!
1 Like
I managed to get your forked version to build and run, but I'm only seeing the one ethernet interface - did you do any config that wasn't in your second commit?
Hmm. I don’t believe so. Been a while. But are you trying DSA?