GL-AR300M Unable to flash NAND

alzhao · 2020-10-09T06:53:04.406Z

misujr:

I have flashed using Uboot all the firmwares from here https://dl.gl-inet.com/firmware/ar300m/nand/v1/ that had a .img extension but with no success.

today I have found this topic so I have tried to flash the Uboot

After flashing the Uboot sometimes the router is looking for a TFTP server and I have created one on linux with the correct filename and a .bin file but even with the firewall down on my laptop the router is not grabbing the file.
I am a bit confused as I initially just wanted to use the router and performed the update provided thru the normal update channel and not a custom firmware.

You are using the wrong firmware. You need to use 3.104.bin from https://dl.gl-inet.com/firmware/ar300m/v1/
Your router is not Nand version so you cannot flash img.
Now you should open uboot web panel and upload .bin

misujr · 2020-10-09T08:07:37.912Z

Thank you fo rthe response @alzhao .
Now sadly all what I get from the router is the power led. The Red led does not flash anymore when I try to power in uboot mode and the power draw of the router is ~184-~190mA .
Any chance to fix it or should I bin it and order a new one ? A bit sad though as this one has less than a year .

BR,
Misujr

alzhao · 2020-10-09T09:08:01.316Z

As you have UART can you pls send UART output?

misujr · 2020-10-09T09:23:00.082Z

Absolutely :
just connect power :
U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

connect power with the button pressed :

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

BR,
Misujr

alzhao · 2020-10-09T09:25:22.529Z

Seems uboot does not boot anymore. Which uboot did you use?

misujr · 2020-10-09T09:30:18.165Z

The one from here : uboot-for-qca95xx/bin at master · gl-inet/uboot-for-qca95xx · GitHub file name is uboot-gl-ar300m.bin

misujr · 2020-10-15T04:15:22.393Z

@alzhao - Sorry to ping you but is there anything else I can do to save this router ?

alzhao · 2020-10-15T04:17:30.010Z

Seems it is over for some reason. Maybe just get an exchange.

misujr · 2020-10-15T04:32:41.917Z

@alzhao Thank you for the quick response ! I will look to buy a new one then. I am not asking for anything special but please try to ask the team to improve a bit the debugging instructions for idiots like me who understand a bit but not the entire picture when it comes to firmwares. I am asking this as the failure was honestly all started with the latest update that came on the official update way thru the admin pannel/UI. Now it is my fault to try and fix it before posting on the forum or getting in touch with your team but a bit more clear steps on debugging in the documentation would have gone a long way imho .

alzhao · 2020-10-15T04:59:30.335Z

Thanks for your understanding. Any problem you met pls let me know.

Always want to improve the guide and doing hard.

misujr · 2020-10-15T05:11:32.384Z

@alzhao - 謝謝您!明天我要買新的router. 如果你要我的舊的我會它送給你. Anyway keep up the good work as your routers are amazing .

alzhao · 2020-10-15T05:12:25.480Z

misujr:

如果你要我的舊的我會它送給你.

如果旧的在中国大陆可以寄回来看看。如果其他地方就算了。

misujr · 2020-10-15T05:24:18.485Z

地方是不一定清楚 .我住在台灣所以是一點兒複雜 .

misujr · 2021-01-01T07:56:02.697Z

@alzhao 新年快樂!

I have managed to fix the router and I will detail here how with a bit of help from you this can be a good tutorial with resources for people who end up in this situation .

Initial Problem :
→ Flash failed of the NOR memory on AR300M16-ext
→ Managed to destory the Uboot part so this will be a tutorial on how to fix the router when you have exhausted all the options described in the other tutorials
So the router now :

Can not boot
Can not get to Uboot
No Serial output / not usable
Wireshark can not see any activity either
What you need :

Soldering Iron
Hot air station ( not mandatory )
soldamop or solder wick
solder wire/paste
A raspberry pi running Raspberry pi OS with FLASHROM installed and SPI interface enabled( any raspberry pi will do )
A backup of a known working flash ( here maybe @alzhao can provide a clean backup file for everyone else as mine was actually from another router and it still contains my DDNS and other info)

What you have to do :

Make sure your raspberry pi has internet connexion and you can control it ( directly with KB,mouse and a screen or thru VNC, SSH , etc)
In terminal on the RPi run: sudo apt update , then sudo apt upgrade
enable the SPI interface and reboot for good measure
install falsh rom : sudo apt install flashrom
Move to the router and find the NOR flash memory (this was in my case ):

WhatsApp Image 2021-01-01 at 15.35.321200×1600 313 KB

Find the Chip ( red square in my case) and the first pin indicator ( blue square in my case)
Remove the IC from the board with the hot air station or using the soldering iron and the other tools mentioned above.(in my case the operation didn’t work with the IC on the board)
Check the memory name/type and find the pinout in a datasheet .
generally for NOR flash the pinout is this one :

WP and Reset usually have to be connected to VCC thru a pullup resistor( read the datasheet of the momory IC to be sure about it)
7.Wire the memory ic to the RPi SPI0 pins making sure the pinout matches the RPi pins like so :

Now open a terminal on the RPI and run :
modprobe spi_bcm2835 → this will load the SPI module in the kernel
modprobe spidev ->this will ensure the SPI module is ready

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 → this will identify the IC type
In my case the response was :
"flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip “MX25L12805D” (16384 kB, SPI) on linux_spi.
Found Macronix flash chip “MX25L12835F/MX25L12845E/MX25L12865E” (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): “MX25L12805D”, “MX25L12835F/MX25L12845E/MX25L12865E”
Please specify which chip definition to use with the -c option.
"
But there also can be :
flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on linux_spi.

Read the memory first just in case you can save anything form that data :
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -r original_factory1.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -r original_factory1.rom
read th ememory again and save it under a different name
Here you will have to write a clean,good know working image on the IC ( I had form a different router but maybe @alzhao can help with a generic one)
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -w original_factory.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -w original_factory.rom
wait as this will likely take 30-40 minutes as first it reads the flash then it will erase it, the it will write the data and finally it will verify the data.
Once all is done you now unplug the wires used from the raspberry pi GPIO side and can disconnect the memory IC from the wires that connect it to the raspberry pi .
Solder the IC back to the router and power it up.
If all went well then your router will work and all will be just fine except it will be an identical clone of the one you took the image from .

The NOR flash memory IC’s can be purachsed from the market easily and a raspberry pi is a tool most of tinkerers/developers will have around so the job is not very but rather takes some time .

@alzhao - Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?
I could find probably myself by poking in the shell but I would love to know where to go to do it correctly for sure and not leave other loose ends that would give me errors and head ache
I am happy with what I got out if by now but would be cool to get it back on 100% functionality !

BR,
misujr

misujr · 2021-01-01T10:15:29.769Z

I guess I have found where the factory_DDNS , mac , serial number and model are stored, but would love a confirmation and a pointer if this is the only place or I have to change somewhere else .

glrouter_options783×552 11 KB

Johnex · 2021-01-01T12:46:40.867Z

You could have skipped the de-soldering of the chip if you used an IC Clip like this one and programmer:

amazon.com

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB...

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB Programmer CH341A Module BIOS/24/25/93, 24 25 Series EEPROM Flash BIOS W/ Software & Driver : Industrial & Scientific

You can see a guide i posted on another forum on modifying the memory of a clamp meter:

eevblog.com

A look at the Uni-T UT210E - Page 20

It also reduces the complexity, just a dropdown to select the memory type, from the silkscreen on the chip itself, no mucking around with linux commands and setting up the raspberry pi.

misujr · 2021-01-01T14:57:46.944Z

Thank you for the link on your guide on how to use the CH341A programmer, I hope it will be of use for others too .
I had the SOP8 clip on the way to me to avoid the soldering part but still I had no clue about the CH341A software and also I had all the other tools to go down the linux route so for the impatient in me it was just natural to jump if I had an option .
Anyway got the CH341A on order now also to enrich my toolkit .

alzhao · 2021-01-02T12:57:03.432Z

misujr:

Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?

Did you restore the whole flash from another working flash, then you may mess up the radio data and mac address.

The correct way is to send an email to our support, attaching the bottom sticker and we could send you the data backup.

misujr · 2021-01-02T13:09:19.444Z

I actually did restore the full flash from a another working flash as I didn’t know any better .
It was more of trial to see if I can revive the router .

I will send an email now to support as I had no idea that you guys store the data backup .

Thank you very much for the support .

BR,
misujr

misujr · 2021-01-04T12:15:34.574Z

I got the art backup from the support and I have flashed it thru 192.168.1.1/art.html /.
I have waited 30min for the router to reset but it never reset/restart after flashing the art.
I have unplugged it and replugged it to power but only the red led comes on and nothing happens .
I can still get to 192.168.1.1/art.html and I also can get to 192.168.1.1/uboot.html
What should I do next ?
Should I flash the NOR image again thru UBOOT?
L.E.: flashed the correct image thru 192.168.1.1 firmware update but the router didn’t recover yet.
I am going to restore the NOR flash IC using the procedure form the longer post above just to have a working state device until I get more info from @alzhao or other fellow members .
What I have noticed is after I have updated the art and the firmware as detailed above, the IC content map seems to be different compared to the backup that I have from a working router.
The working router backup is for router firmware V2 while what I have read form the IC with updated firmware was on router firmware V3 .
Here is were I have noticed that squashfs and JFFS2 are at differrent addesses :
Left is V2 and Right is V3

Capture1223×598 350 KB

BR,
Misujr