GL-AR300M Unable to flash NAND

misujr · 2020-10-08T03:32:22.068Z

I have a similar poblem with the one described in this thread so I hope someone who had it can help me as I have tried lots of variants with no success by now.

What happend :
Yesterday 07.10.2020 I have updated my GL-AR300M16-ext to the latest software version available thru the admin GUI . I forgot the exact version number as I was in a rush … It was a 3.1XX and my router was on a 3.0XX .
After the update the router remained with the two green led’s ON but after 30min it still did not come back to life ( expose WI-FI AP)
What I have tried :

Uboot ( connect the eth cable to LAN and a Laptop network card with static IP 192.168.1.2, press reset, connect power, wait for the 5 red flashes , then both green led’s are on)
a. I have tried this under Win 10, PopOS, Ubuntu 20.4
I have flashed using Uboot all the firmwares from here GL.iNet download center that had a .img extension but with no success.
today I have found this topic so I have tried to flash the Uboot
After flashing the Uboot sometimes the router is looking for a TFTP server and I have created one on linux with the correct filename and a .bin file but even with the firewall down on my laptop the router is not grabbing the file.
I am a bit confused as I initially just wanted to use the router and performed the update provided thru the normal update channel and not a custom firmware.
I have some logs from the UART port and I will paste them here :
[18542.13h.02m.31s.157] Tap values = (0x16, 0x16, 0x16, 0x16)
[18542.13h.02m.31s.163] 128 MB
[18542.13h.02m.31s.302] Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
[18542.13h.02m.31s.302] flash size 16MB, sector count = 256
[18542.13h.02m.31s.307] *** Warning - bad CRC, using default environment
[18542.13h.02m.31s.307]
[18542.13h.02m.31s.315] Power up PLL with outdiv = 0 then switch to 3
[18542.13h.02m.31s.558] *** Warning *** : PCIe WLAN Module not found !!!
[18542.13h.02m.31s.564] ath_gmac_enet_initialize…
[18542.13h.02m.31s.775] No valid address in Flash. Using fixed address
[18542.13h.02m.31s.775] Fetching MAC Address from 0x9fff0006
[18542.13h.02m.31s.775] ath_gmac_enet_initialize: reset mask:c02200
[18542.13h.02m.31s.988] Honey Bee ---->S27 PHY*
[18542.13h.02m.31s.993] S27 reg init
[18542.13h.02m.31s.993] : cfg1 0x800c0000 cfg2 0x7114
[18542.13h.02m.32s.095] eth0: 00:03:7f:09:0b:ad
[18542.13h.02m.35s.099] eth0 up
[18542.13h.02m.35s.099] Honey Bee ----> MAC 1 S27 PHY *
[18542.13h.02m.35s.103] S27 reg init
[18542.13h.02m.35s.103] ATHRS27: resetting s27
[18542.13h.02m.35s.205] ATHRS27: s27 reset done
[18542.13h.02m.35s.208] : cfg1 0x800c0000 cfg2 0x7214
[18542.13h.02m.35s.310] eth1: 00:03:7f:11:23:c6
[18542.13h.02m.36s.330] eth1 up
[18542.13h.02m.36s.330] eth0, eth1
[18542.13h.02m.36s.330] Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc.
[18542.13h.02m.36s.330] ath_spi_nand_ecc: Couldn’t enable internal ECC
[18542.13h.02m.36s.330] Setting 0x181162c0 to 0x7cf9a100
[18542.13h.02m.36s.330] Hit ‘gl’ to stop autoboot: -1
[18542.13h.02m.39s.352] Protect off 9F040000 … 9F04FFFF
[18542.13h.02m.39s.352] Un-Protecting sectors 4…4 in bank 1
[18542.13h.02m.39s.352] Un-Protected 1 sectors
[18542.13h.02m.39s.352] Erasing Flash…Erasing flash…
[18542.13h.02m.39s.352] First 0x4 last 0x4 sector size 0x10000
[18542.13h.02m.39s.3 4
[18542.13h.02m.39s.352] Erased 1 sectors
[18542.13h.02m.39s.352] Writing to Flash… write addr: 40000
[18542.13h.02m.39s.409] done
[18542.13h.02m.39s.409] Protecting sectors 4…4 in bank 1
[18542.13h.02m.39s.409] Protected 1 sectors
[18542.13h.02m.39s.409] Un-Protect Flash Bank # 1
[18542.13h.02m.39s.432]
[18542.13h.02m.39s.432] no devices available
[18542.13h.02m.39s.432] Found ART,Checking calibration status…
[18542.13h.02m.39s.432] Device have calibrated,Checking device test status…
[18542.13h.02m.39s.432] Device have tested,Checking MAC address…
[18542.13h.02m.39s.432] Device have MAC address,Checking device flash status…
[18542.13h.02m.39s.432] Device only have nor flash,Booting standard firmware from nor flash…
[18542.13h.02m.39s.438] Booting image at: 0x9F050000
[18542.13h.02m.39s.441] Trying eth0
[18542.13h.02m.39s.441] eth0 link down
[18542.13h.02m.39s.441] FAIL
[18542.13h.02m.39s.445] Trying eth1
[18542.13h.02m.39s.445] enet1 port0 up
[18542.13h.02m.39s.448] dup 1 speed 1000
[18542.13h.02m.40s.449] Using eth1 device
[18542.13h.02m.40s.478] host 192.168.1.2 is alive
[18542.13h.02m.40s.482] Trying eth0
[18542.13h.02m.40s.482] eth0 link down
[18542.13h.02m.40s.482] FAIL
[18542.13h.02m.40s.485] Trying eth1
[18542.13h.02m.41s.499] Using eth1 device
[18542.13h.02m.41s.499] TFTP from server 192.168.1.2; our IP address is 192.168.1.1
[18542.13h.02m.41s.499] Filename ‘openwrt-gl-ar300m.bin’.
[18542.13h.02m.41s.499] Load address: 0x80060000
[18542.13h.02m.41s.499] Loading: *
[18542.13h.02m.43s.508] no devices available
[18542.13h.02m.43s.508] ## Booting image at 9f050000 …
[18542.13h.02m.43s.508] Bad Magic Number
[18542.13h.02m.43s.508]
[18542.13h.02m.43s.508] ** Device 0 not available
[18542.13h.02m.43s.508] ath>

While flashing Uboot and after
�@��Request for----: /uboot.html
we are here 2
open file: /uboot.html–finished reading file—
Request for----: /style.css
we are here 2
open file: /style.css–finished reading file—
Data will be downloaded at 0x80800000 in RAM
Upgrade type: U-Boot
Upload file size: 214112 bytes
Loading: #######################################
#######################################
#######################################
#######################################
#######################################
#######################################
################

open file: /flashing.html
stop eth interface!!
HTTP upload is done! Upgrading…

```
U-BOOT UPGRADING     *
```
DO NOT POWER OFF DEVICE! *

Executing: erase 0x9F000000 +0x50000; cp.b 0x80800000 0x9F000000 0x40000

Erasing flash…
First 0x0 last 0x4 sector size 0x10000
4
Erased 5 sectors
Copy to Flash… write addr: 0
done
HTTP ugrade is done! Rebooting…

�

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x9, 0x23)
Tap values = (0x16, 0x16, 0x16, 0x16)
128 MB
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
*** Warning - bad CRC, using default environment

Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize…
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x9fff0006
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:11:23:c6
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc.
ath_spi_nand_ecc: Couldn’t enable internal ECC
Setting 0x181162c0 to 0x7cf9a100
Hit ‘gl’ to stop autoboot: -1
Protect off 9F040000 … 9F04FFFF
Un-Protecting sectors 4…4 in bank 1
Un-Protected 1 sectors
Erasing Flash…Erasing flash…
First 0x4 last 0x4 sector size 0x10000
4
Erased 1 sectors
Writing to Flash… write addr: 40000
done
Protecting sectors 4…4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1

no devices available
Found ART,Checking calibration status…
Device have calibrated,Checking device test status…
Device have tested,Checking MAC address…
Device have MAC address,Checking device flash status…
Device only have nor flash,Booting standard firmware from nor flash…
Booting image at: 0x9F050000
Trying eth0
eth0 link down
FAIL
Trying eth1
enet1 port0 up
dup 1 speed 1000
Using eth1 device
host 192.168.1.2 is alive
Trying eth0
eth0 link down
FAIL
Trying eth1
Using eth1 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename ‘openwrt-gl-ar300m.bin’.
Load address: 0x80060000
Loading: *
no devices available

Booting image at 9f050000 …

Bad Magic Number

** Device 0 not available
ath> �

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0x8, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
4 MB

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)
��

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0x8, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
4 MB
�

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x9, 0x23)
Tap values = (0x16, 0x16, 0x16, 0x16)
128 MB
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
*** Warning - bad CRC, using default environment

Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize…
No valid address in Flash. Using fixed address
Fetching MAC Address from 0x9fff0006
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
�

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0x8, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
4 MB

Now all what it says on UART if I just plug it to power is
ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0x8, 0x23)
Tap values = (0x15, 0x15, 0x15, 0x15)
4 MB

Are there any suggestions of what I can try to fix it ?

BR,
Misujr

alzhao · 2020-10-09T06:53:04.406Z

misujr:

I have flashed using Uboot all the firmwares from here https://dl.gl-inet.com/firmware/ar300m/nand/v1/ that had a .img extension but with no success.

today I have found this topic so I have tried to flash the Uboot

After flashing the Uboot sometimes the router is looking for a TFTP server and I have created one on linux with the correct filename and a .bin file but even with the firewall down on my laptop the router is not grabbing the file.
I am a bit confused as I initially just wanted to use the router and performed the update provided thru the normal update channel and not a custom firmware.

You are using the wrong firmware. You need to use 3.104.bin from https://dl.gl-inet.com/firmware/ar300m/v1/
Your router is not Nand version so you cannot flash img.
Now you should open uboot web panel and upload .bin

misujr · 2020-10-09T08:07:37.912Z

Thank you fo rthe response @alzhao .
Now sadly all what I get from the router is the power led. The Red led does not flash anymore when I try to power in uboot mode and the power draw of the router is ~184-~190mA .
Any chance to fix it or should I bin it and order a new one ? A bit sad though as this one has less than a year .

BR,
Misujr

alzhao · 2020-10-09T09:08:01.316Z

As you have UART can you pls send UART output?

misujr · 2020-10-09T09:23:00.082Z

Absolutely :
just connect power :
U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

connect power with the button pressed :

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

BR,
Misujr

alzhao · 2020-10-09T09:25:22.529Z

Seems uboot does not boot anymore. Which uboot did you use?

misujr · 2020-10-09T09:30:18.165Z

The one from here : uboot-for-qca95xx/bin at master · gl-inet/uboot-for-qca95xx · GitHub file name is uboot-gl-ar300m.bin

misujr · 2020-10-15T04:15:22.393Z

@alzhao - Sorry to ping you but is there anything else I can do to save this router ?

alzhao · 2020-10-15T04:17:30.010Z

Seems it is over for some reason. Maybe just get an exchange.

misujr · 2020-10-15T04:32:41.917Z

@alzhao Thank you for the quick response ! I will look to buy a new one then. I am not asking for anything special but please try to ask the team to improve a bit the debugging instructions for idiots like me who understand a bit but not the entire picture when it comes to firmwares. I am asking this as the failure was honestly all started with the latest update that came on the official update way thru the admin pannel/UI. Now it is my fault to try and fix it before posting on the forum or getting in touch with your team but a bit more clear steps on debugging in the documentation would have gone a long way imho .

alzhao · 2020-10-15T04:59:30.335Z

Thanks for your understanding. Any problem you met pls let me know.

Always want to improve the guide and doing hard.

misujr · 2020-10-15T05:11:32.384Z

@alzhao - 謝謝您!明天我要買新的router. 如果你要我的舊的我會它送給你. Anyway keep up the good work as your routers are amazing .

alzhao · 2020-10-15T05:12:25.480Z

misujr:

如果你要我的舊的我會它送給你.

如果旧的在中国大陆可以寄回来看看。如果其他地方就算了。

misujr · 2020-10-15T05:24:18.485Z

地方是不一定清楚 .我住在台灣所以是一點兒複雜 .

misujr · 2021-01-01T07:56:02.697Z

@alzhao 新年快樂!

I have managed to fix the router and I will detail here how with a bit of help from you this can be a good tutorial with resources for people who end up in this situation .

Initial Problem :
→ Flash failed of the NOR memory on AR300M16-ext
→ Managed to destory the Uboot part so this will be a tutorial on how to fix the router when you have exhausted all the options described in the other tutorials
So the router now :

Can not boot
Can not get to Uboot
No Serial output / not usable
Wireshark can not see any activity either
What you need :

Soldering Iron
Hot air station ( not mandatory )
soldamop or solder wick
solder wire/paste
A raspberry pi running Raspberry pi OS with FLASHROM installed and SPI interface enabled( any raspberry pi will do )
A backup of a known working flash ( here maybe @alzhao can provide a clean backup file for everyone else as mine was actually from another router and it still contains my DDNS and other info)

What you have to do :

Make sure your raspberry pi has internet connexion and you can control it ( directly with KB,mouse and a screen or thru VNC, SSH , etc)
In terminal on the RPi run: sudo apt update , then sudo apt upgrade
enable the SPI interface and reboot for good measure
install falsh rom : sudo apt install flashrom
Move to the router and find the NOR flash memory (this was in my case ):

WhatsApp Image 2021-01-01 at 15.35.321200×1600 313 KB

Find the Chip ( red square in my case) and the first pin indicator ( blue square in my case)
Remove the IC from the board with the hot air station or using the soldering iron and the other tools mentioned above.(in my case the operation didn’t work with the IC on the board)
Check the memory name/type and find the pinout in a datasheet .
generally for NOR flash the pinout is this one :

WP and Reset usually have to be connected to VCC thru a pullup resistor( read the datasheet of the momory IC to be sure about it)
7.Wire the memory ic to the RPi SPI0 pins making sure the pinout matches the RPi pins like so :

Now open a terminal on the RPI and run :
modprobe spi_bcm2835 → this will load the SPI module in the kernel
modprobe spidev ->this will ensure the SPI module is ready

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 → this will identify the IC type
In my case the response was :
"flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip “MX25L12805D” (16384 kB, SPI) on linux_spi.
Found Macronix flash chip “MX25L12835F/MX25L12845E/MX25L12865E” (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): “MX25L12805D”, “MX25L12835F/MX25L12845E/MX25L12865E”
Please specify which chip definition to use with the -c option.
"
But there also can be :
flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on linux_spi.

Read the memory first just in case you can save anything form that data :
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -r original_factory1.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -r original_factory1.rom
read th ememory again and save it under a different name
Here you will have to write a clean,good know working image on the IC ( I had form a different router but maybe @alzhao can help with a generic one)
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -w original_factory.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -w original_factory.rom
wait as this will likely take 30-40 minutes as first it reads the flash then it will erase it, the it will write the data and finally it will verify the data.
Once all is done you now unplug the wires used from the raspberry pi GPIO side and can disconnect the memory IC from the wires that connect it to the raspberry pi .
Solder the IC back to the router and power it up.
If all went well then your router will work and all will be just fine except it will be an identical clone of the one you took the image from .

The NOR flash memory IC’s can be purachsed from the market easily and a raspberry pi is a tool most of tinkerers/developers will have around so the job is not very but rather takes some time .

@alzhao - Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?
I could find probably myself by poking in the shell but I would love to know where to go to do it correctly for sure and not leave other loose ends that would give me errors and head ache
I am happy with what I got out if by now but would be cool to get it back on 100% functionality !

BR,
misujr

misujr · 2021-01-01T10:15:29.769Z

I guess I have found where the factory_DDNS , mac , serial number and model are stored, but would love a confirmation and a pointer if this is the only place or I have to change somewhere else .

glrouter_options783×552 11 KB

Johnex · 2021-01-01T12:46:40.867Z

You could have skipped the de-soldering of the chip if you used an IC Clip like this one and programmer:

amazon.com

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB...

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB Programmer CH341A Module BIOS/24/25/93, 24 25 Series EEPROM Flash BIOS W/ Software & Driver : Industrial & Scientific

You can see a guide i posted on another forum on modifying the memory of a clamp meter:

eevblog.com

A look at the Uni-T UT210E - Page 20

It also reduces the complexity, just a dropdown to select the memory type, from the silkscreen on the chip itself, no mucking around with linux commands and setting up the raspberry pi.

misujr · 2021-01-01T14:57:46.944Z

Thank you for the link on your guide on how to use the CH341A programmer, I hope it will be of use for others too .
I had the SOP8 clip on the way to me to avoid the soldering part but still I had no clue about the CH341A software and also I had all the other tools to go down the linux route so for the impatient in me it was just natural to jump if I had an option .
Anyway got the CH341A on order now also to enrich my toolkit .

alzhao · 2021-01-02T12:57:03.432Z

misujr:

Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?

Did you restore the whole flash from another working flash, then you may mess up the radio data and mac address.

The correct way is to send an email to our support, attaching the bottom sticker and we could send you the data backup.

misujr · 2021-01-02T13:09:19.444Z

I actually did restore the full flash from a another working flash as I didn’t know any better .
It was more of trial to see if I can revive the router .

I will send an email now to support as I had no idea that you guys store the data backup .

Thank you very much for the support .

BR,
misujr