Briked GL-AR300M-ext

gp2k3 · 2021-04-25T10:58:58.502Z

hello guys,
something went wrong when I tried to upgrade the firmware directly from the webinterface, when the device has restarted it got briked.
I have done the ubi debrik procedure, I can access the upgrade page but nothing happens when i upgrade the firmware at restart the device continue in briked status.
so I soldered 3 pins on the serial port and this is the upgrade log when i tried to flash the latest firmware available “openwrt-ar300m-3.201-0402.img”.

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:  
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x8, 0x24)
Tap values = (0x16, 0x16, 0x16, 0x16)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x9fff0006
ath_gmac_enet_initialize: reset mask:c02200 
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:11:23:c6
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
MFR:200,DID:177
====== NAND Parameters ======
sc = 0x87ff7250 page = 0x800 block = 0x20000
Setting 0x181162c0 to 0x58b1a100
Press reset button for at least:
- 5 sec. to run web failsafe mode
Reset button is pressed for:  5 

Button was pressed for 5 sec...
HTTP server is starting for firmware update...

Trying eth0
eth0 link down
FAIL
Trying eth1
enet1 port0 up
dup 1 speed 1000
HTTP server is starting at IP: 192.168.1.1
HTTP server is ready!

Request for----: /
we are here 1 
open file: /index.html--finished reading file---
Request for----: /style.css
we are here 2 
open file: /style.css--finished reading file---
Data will be downloaded at 0x80800000 in RAM
Upload file size: 15991110 bytes
Loading: ####################...
         ...#######################

open file: /flashing.html
stop eth interface!!
HTTP upload is done! Upgrading...


****************************
*    FIRMWARE UPGRADING    *
* DO NOT POWER OFF DEVICE! *
****************************

Executing: nand erase 0 0xF40146; nand write 0x80800000 0 0xF40146


NAND erase: device 0 offset 0x0, size 0xf40146 
OK

NAND write: device 0 offset 0x0, size 15991110 ...  15991110 bytes written: OK
HTTP ugrade is done! Rebooting...



U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:  
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x8, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x9fff0006
ath_gmac_enet_initialize: reset mask:c02200 
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:11:23:c6
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
MFR:200,DID:177
====== NAND Parameters ======
sc = 0x87ff7250 page = 0x800 block = 0x20000
Setting 0x181162c0 to 0x58b1a100
Hit 'gl' to stop autoboot: -1 
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash... 
First 0x4 last 0x4 sector size 0x10000
   4
Erased 1 sectors
Writing to Flash... write addr: 40000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1
Warning: Bootlimit (3) exceeded. bootm nor flash.

Device 0 bad blocks:
  07fe0000
Found ART,Checking calibration status...
Device have calibrated,Checking device test status...
Device have tested,Checking MAC address...
Device have MAC address,Checking device flash status...
Device have nor and nand flash,Booting standard firmware from nor flash...
Booting image at: 0x9F050000
Trying eth0
eth0 link down
FAIL
Trying eth1
enet1 port0 up
dup 1 speed 1000
Using eth1 device
host 192.168.1.2 is alive
Trying eth0
eth0 link down
FAIL
Trying eth1
Using eth1 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-gl-ar300m.bin'.
Load address: 0x80060000
Loading: *
Device 0 bad blocks:
  07fe0000
Trying eth0
eth0 link down
FAIL
Trying eth1
Using eth1 device
host 192.168.1.2 is alive
ok
Trying eth0
eth0 link down
FAIL
Trying eth1
Using eth1 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-gl-ar300m.img'.
Load address: 0x81000000
Loading: ## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-4.9.120
   Created:      2020-05-23   4:32:16 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1642231 Bytes =  1.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.9.120 (cc@cc-ubuntu1604) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7258-5eb055306f) ) #0 Thu Aug 16 07:51:15 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=GL-AR300M console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(reserved),64k(art)ro;spi0.1:2048k(kernel),-(ubi) rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 124164K/131072K available (3816K kernel code, 163K rwdata, 900K rodata, 232K init, 219K bss, 6908K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:650.000MHz, DDR:597.216MHz, AHB:216.666MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008240] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.071107] pid_max: default: 32768 minimum: 301
[    0.076080] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.083065] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093182] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103567] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111182] NET: Registered protocol family 16
[    0.117312] MIPS: machine is GL.iNet GL-AR300M
[    0.602340] ar724x-pci ar724x-pci.0: PCIe link is down
[    0.607798] registering PCI controller with io_map_base unset
[    0.630314] usbcore: registered new interface driver usbfs
[    0.636169] usbcore: registered new interface driver hub
[    0.641884] usbcore: registered new device driver usb
[    0.647478] PCI host bridge to bus 0000:00
[    0.651798] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.659078] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.664956] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.672108] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.683883] clocksource: Switched to clocksource MIPS
[    0.690231] NET: Registered protocol family 2
[    0.695761] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.703116] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.709867] TCP: Hash tables configured (established 1024 bind 1024)
[    0.716683] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.722845] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.729718] NET: Registered protocol family 1
[    0.737026] Crashlog allocated RAM at address 0x3f00000
[    0.743583] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.757265] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.763407] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.783099] io scheduler noop registered
[    0.787285] io scheduler deadline registered (default)
[    0.793081] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.802279] console [ttyS0] disabled
[    0.826191] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.835293] console [ttyS0] enabled
[    0.835293] console [ttyS0] enabled
[    0.842836] bootconsole [early0] disabled
[    0.842836] bootconsole [early0] disabled
[    0.857244] m25p80 spi0.0: found w25q128, expected m25p80
[    0.872137] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.877046] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.883156] Creating 4 MTD partitions on "spi0.0":
[    0.888128] 0x000000000000-0x000000040000 : "u-boot"
[    0.895176] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.902578] 0x000000050000-0x000000ff0000 : "reserved"
[    0.909861] 0x000000ff0000-0x000001000000 : "art"
[    0.917173] spi-nand: Giga SPI NAND was found.
[    0.921780] spi-nand: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.930050] 2 cmdlinepart partitions found on MTD device spi0.1
[    0.936201] Creating 2 MTD partitions on "spi0.1":
[    0.941155] 0x000000000000-0x000000200000 : "kernel"
[    0.951456] 0x000000200000-0x000008000000 : "ubi"
[    1.380973] found bad block 7fe0000
[    1.385292] libphy: Fixed MDIO Bus: probed
[    1.404321] libphy: ag71xx_mdio: probed
[    2.036473] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    2.046591] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.593877] random: fast init done
[    2.676421] ag71xx-mdio.1: Found an AR934X built-in switch
[    2.729712] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    2.736238] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.742983] ehci-pci: EHCI PCI platform driver
[    2.747776] usbcore: registered new interface driver usbtest
[    2.753679] usbcore: registered new interface driver usb_ehset_test
[    2.760234] usbcore: registered new interface driver lvs
[    2.767336] NET: Registered protocol family 10
[    2.776620] NET: Registered protocol family 17
[    2.781263] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.794781] 8021q: 802.1Q VLAN Support v1.8
[    2.804555] UBI: auto-attach mtd5
[    2.808012] ubi0: attaching mtd5
[    3.261045] ubi0 error: ubi_attach: bad image sequence number 1301290083 in PEB 107, expected 1204215557
[    3.270855] Erase counter header dump:
[    3.274733] 	magic          0x55424923
[    3.278601] 	version        1
[    3.281657] 	ec             1
[    3.284723] 	vid_hdr_offset 2048
[    3.288054] 	data_offset    4096
[    3.291379] 	image_seq      1301290083
[    3.295260] 	hdr_crc        0x6666e7e7
[    3.299129] erase counter header hexdump:
[    3.303332] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd5, error -22
[    3.310677] UBI error: cannot attach mtd5
[    3.314860] hctosys: unable to open rtc device (rtc0)
[    3.320472] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    3.328255] Please append a correct "root=" boot option; here are the available partitions:
[    3.336890] 1f00             256 mtdblock0 [    3.341027]  (driver?)
[    3.343470] 1f01              64 mtdblock1 [    3.347613]  (driver?)
[    3.350055] 1f02           16000 mtdblock2 [    3.354199]  (driver?)
[    3.356640] 1f03              64 mtdblock3 [    3.360775]  (driver?)
[    3.363217] 1f04            2048 mtdblock4 [    3.367361]  (driver?)
[    3.369803] 1f05          129024 mtdblock5 [    3.373947]  (driver?)
[    3.376388] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    3.385998] Rebooting in 1 seconds..


U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:

what can I do?

Henry_Bruns · 2021-04-25T14:39:40.738Z

gp2k3:

openwrt-ar300m-3.201-0402.img

I was doing on ar300m onetime this week too.

Update to openwrt-ar300m-3.201-0402, didnt work by me too. Doing in two stepps was working:

reset to factory
update by hand to oldest of newer firmware one, can be 3.109 or so on ???
after than updated by hand to openwrt-ar300m-3.201-0402
A it can be this version have a DNS leak, so it can be its better to use 3.103; 3.104 or 3.105 or so on

It can be I was useing allways the .tar version.

Happi · 2021-04-25T19:04:49.941Z

Henry_Bruns:

it can be this version have a DNS leak

You keep posting about this DNS leak but I don’t see it and also don’t understand your English well enough explaining where.

Henry_Bruns · 2021-04-25T19:12:51.165Z

Happi:

You keep posting about this DNS leak but I don’t see it and also don’t understand your English well enough explaining where.

Getting DNS answers from next local DNS server near your home city and not near the endpoint of your used VPN… I call this DNS leak. Not all GL firmware versions doing this. It can be GL should test a little bit. I am not a full-time GL stuff and I dond hold GL shares, so I am testing only a little bit for fun …

gp2k3 · 2021-04-27T12:28:03.560Z

I can’t do factory reset, the device reboot because kernel panic.

Henry_Bruns · 2021-04-27T18:40:15.924Z

It can bee they are ways to update the firmware by ssh, USB, GPO, Uboot and by replacing the flash chip too. A I dont have experience about this. If I remember right, I have read already on gl or on subseven or like this site, how to do this by uboot (what ever this are).

gp2k3 · 2021-05-19T09:02:58.318Z

I have some news about it, as read in other topics when something goes wrong with the update of the nand this also corrupts the nor and due to the “Bootlimit (3) exceeded” the device goes into loop as the nor is also corrupt.
I partially solved flashing the nor .bin firmware and the device starts correctly, but when I go to flash the nand file .img inevitably the device goes in “Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block (0, 0)
[3.269921] Rebooting in 1 seconds …”
and it also corrupts the nor.
how can I flash the nand correctly?

alzhao · 2021-05-19T12:54:21.405Z

Maybe nand flash is damaged

gp2k3 · 2021-05-24T10:42:48.767Z

ok thank you, then I will try to send back to seller is still under warranty