Hi, I think i bricked my AR300M. I flashed the new Uboot via web console but the switch still did not work. So as alzhao described I cleaned all env parameters (all means all, i cleaned ipaddr, dlf, blf, everything).
Now even the Unbrick method via 192.168.1.1 doesn’t work anymore. The device still seems to be alive, though, the LEDs still blink at startup. But even via UART I only get unreadable letters, no matter what baud rate I choose.
Hi to all.
I also flashed the latest U-Boot from https://github.com/gl-inet/gl-uboot-source-for–ar300m to my AR300M (using prebuilt in bin / MD5 2d34d88fd33fa9128afc1d51269ee9c7).
U-Boot 1.1.4-g36de7573 (May 26 2017 - 14:42:18)
Then erased all environment vars using
erase 0x9f040000 +0x10000
reset
both
run bootcmd
and
run blf
boot correctly into NAND and NOR firmware respectively.
But during normal startup / reset I always get the following error:
Device 0 bad blocks:
07fc0000
07fe0000
Found ART,Checking calibration status...
Device have calibrated,Checking device test status...
Device haven't tested. Please test device in calibration firmware...
Booting image at: 0x9Fed0000
## Booting image at 9fed0000 ...
Bad Magic Number
Any help is appreciated!
Thanks Martin
Can you make sure the nand firmware is a valid firmware with .img in the file name?
Hi alzhao
I tried different NAND firmwares with .img filename. Currently I am using http://download.gl-inet.com.s3.amazonaws.com/firmware/ar300m/nand/tor/openwrt-ar300m-nand-tor-2.264.img (MD5: 5079e0bae08676b0280f5bbda18c2308.
Running run bootcmd from the U-Boot console correctly boots into the NAND firmware!
Thank you and best regards
Martin
I resolved marking the device as tested executing the following commands in the u-boot console:
# prepare in memroy
cp.b 0x9fff0000 0x81000000 0xffff
mw 0x81000050 0x646f6e65 # done
mw 0x81000060 0x7365636f # seco
# write to flash
protect off bank 1
cp.b 0x81000050 0x9fff0050 4 # done
cp.b 0x81000060 0x9fff0060 4 # seco
protect on bank 1
Now I am happy with my cool AR300M booting to NAND and/or NOR using the switch 
I updated the uboot from here: uboot-for-qca95xx/bin at master · gl-inet/uboot-for-qca95xx · GitHub
It shows its version as U-Boot 1.1.4-g36de7573 (May 26 2017 - 14:42:18)
I had the same problem as @m.vgunten and needed to mark the unit as tested for it to boot up by default. The commands listed worked. Thanks
I also have the problem that boot_dev does not work with the switch with the case on. As noted by @vigans the switch has three positions and without the case on I can put the switch into the right position to boot NOR.
Am I reading correctly that @mkroes erased all the uboot variables and that fixed the switch to work with boot_dev and the case on?
I am reluctant to try this without confirmation. Wouldn’t I have to re-input all the uboot environment settings for uboot to boot the firmware again?
Hi nopro404
Regarding the three switch position: my simple hack was using a file to have all three switch positions working 
And when erasing all the uboot variables the defaults will be set on next boot (you can have a look at the source code GitHub - gl-inet/uboot-for-qca95xx: ar300m uboot source - src/include/configs/board953x.h).
Regards Martin
Very good, thanks for the clarification.
Great to know. Did this help you in some way? Did you just run:
setenv variableName
For each variable and then saveenv to commit?
For each variable and then saveenv to commit?
No, no setenv/saveenv after erasing, just reboot to u-boot … envvars will then be set to defaults!
Well, I want to add that the new Uboot is way better than the NAND only version shipped with my AR300M. No MTU issues - uploading the firmware is now flawless on Windows. This is the way it should have been on release. If any current AR300M user has this old Uboot, I would highly suggest not testing unknown images on your device without upgrading Uboot to this version.
I did not even solder the board. I paid $1 at the local electronics shop for the UART and 3 female to male breadboard cables and just placed the pins in the provided holes on the board. Worked fine.
How can I do this without going to u-boot console?
What does it actually do?
What are this addresses?
Or can I at least enable netconsole in this u-boot?
EDIT: Not needed anymore, I’ve bought USB-TTL converter and did it from u-boot console.
Does anyone have a copy of the fixed uboot? The attachement on alzhao*s post seems to be gone and the bin from github still is wrong.
Here? Where? There is no attachment and no link, and as others have mentioned - the file on github is old. It does not support NAND flashing from TFTP (no “nlf” command defined per documentation in https://docs.gl-inet.com/en/2/hardware/ar300m/ ) and the mode switch is not usable without physical case modifications.
The post is old so links was lost.
But I just verified this issue. There is a problem and pls allow some time to find out. So do not need to change uboot at this point.
Pls try this one.
I’ll give it a try this weekend, I won’t be able to test this tonight.
Thanks!
Also - webfailsafe enforces a 16MB limit for all uploads, even NAND despite that being a 128MB flash chip.
This one finally works Dont forget to set set fw_setenv boot_dev on !
So this is another bug!
Sorry for necroposting, but that comment should be marked as the solution!
Thanks for sharing!
Here are the serial output how it looks like when executing the commands:
U-Boot 1.1.4-gf8f77125-dirty (Sat Aug 14 08:53:11 UTC 2021)
ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x8, 0x26)
Tap values = (0x17, 0x17, 0x17, 0x17)
128 MB
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Power up PLL with outdiv = 0 then switch to 3
ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc.
MFR:200,DID:177
====== NAND Parameters ======
sc = 0x87ff62e0 page = 0x800 block = 0x20000
Setting 0x181162c0 to 0x78f1a100
Hit 'gl' to stop autoboot: 0
ath>
ath> cp.b 0x9fff0000 0x81000000 0xffff
ath> mw 0x81000050 0x646f6e65
ath> mw 0x81000060 0x7365636f
ath> protect off bank 1
Un-Protect Flash Bank # 1
ath> cp.b 0x81000050 0x9fff0050 4
Copy to Flash... write addr: ff0050
done
ath> cp.b 0x81000060 0x9fff0060 4
Copy to Flash... write addr: ff0060
done
ath> protect on bank 1
Protect Flash Bank # 1
ath>