GL-AR300M Unable to flash NAND

Technical Support for Routers
33

@alzhao 新年快樂!

I have managed to fix the router and I will detail here how with a bit of help from you this can be a good tutorial with resources for people who end up in this situation .

Initial Problem :
→ Flash failed of the NOR memory on AR300M16-ext
→ Managed to destory the Uboot part so this will be a tutorial on how to fix the router when you have exhausted all the options described in the other tutorials
So the router now :

  1. Can not boot
  2. Can not get to Uboot
  3. No Serial output / not usable
  4. Wireshark can not see any activity either
    What you need :
  • Soldering Iron
  • Hot air station ( not mandatory )
  • soldamop or solder wick
  • solder wire/paste
  • A raspberry pi running Raspberry pi OS with FLASHROM installed and SPI interface enabled( any raspberry pi will do )
  • A backup of a known working flash ( here maybe @alzhao can provide a clean backup file for everyone else as mine was actually from another router and it still contains my DDNS and other info)

What you have to do :

  1. Make sure your raspberry pi has internet connexion and you can control it ( directly with KB,mouse and a screen or thru VNC, SSH , etc)
  2. In terminal on the RPi run: sudo apt update , then sudo apt upgrade
  3. enable the SPI interface and reboot for good measure
  4. install falsh rom : sudo apt install flashrom
    Move to the router and find the NOR flash memory (this was in my case ):
    WhatsApp Image 2021-01-01 at 15.35.32
    WhatsApp Image 2021-01-01 at 15.35.321200×1600 313 KB

    Find the Chip ( red square in my case) and the first pin indicator ( blue square in my case)
  5. Remove the IC from the board with the hot air station or using the soldering iron and the other tools mentioned above.(in my case the operation didn’t work with the IC on the board)
  6. Check the memory name/type and find the pinout in a datasheet .
    generally for NOR flash the pinout is this one :
    sop8 nor
  • WP and Reset usually have to be connected to VCC thru a pullup resistor( read the datasheet of the momory IC to be sure about it)
    7.Wire the memory ic to the RPi SPI0 pins making sure the pinout matches the RPi pins like so :
    rpi pinout
  1. Now open a terminal on the RPI and run :
    modprobe spi_bcm2835 → this will load the SPI module in the kernel
    modprobe spidev ->this will ensure the SPI module is ready

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 → this will identify the IC type
In my case the response was :
"flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip “MX25L12805D” (16384 kB, SPI) on linux_spi.
Found Macronix flash chip “MX25L12835F/MX25L12845E/MX25L12865E” (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): “MX25L12805D”, “MX25L12835F/MX25L12845E/MX25L12865E”
Please specify which chip definition to use with the -c option.
"
But there also can be :
flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on linux_spi.

  1. Read the memory first just in case you can save anything form that data :
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -r original_factory1.rom
    or
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -r original_factory1.rom
  2. read th ememory again and save it under a different name
  3. Here you will have to write a clean,good know working image on the IC ( I had form a different router but maybe @alzhao can help with a generic one)
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -w original_factory.rom
    or
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -w original_factory.rom
  4. wait as this will likely take 30-40 minutes as first it reads the flash then it will erase it, the it will write the data and finally it will verify the data.
  5. Once all is done you now unplug the wires used from the raspberry pi GPIO side and can disconnect the memory IC from the wires that connect it to the raspberry pi .
  6. Solder the IC back to the router and power it up.
  7. If all went well then your router will work and all will be just fine except it will be an identical clone of the one you took the image from .

The NOR flash memory IC’s can be purachsed from the market easily and a raspberry pi is a tool most of tinkerers/developers will have around so the job is not very but rather takes some time .

@alzhao - Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ? :smiley:
I could find probably myself by poking in the shell but I would love to know where to go to do it correctly for sure and not leave other loose ends that would give me errors and head ache :smiley:
I am happy with what I got out if by now but would be cool to get it back on 100% functionality !

BR,
misujr

1 Like