GL-AR300M Unable to flash NAND

alzhao · 2020-10-09T09:25:22.529Z

Seems uboot does not boot anymore. Which uboot did you use?

misujr · 2020-10-09T09:30:18.165Z

The one from here : uboot-for-qca95xx/bin at master · gl-inet/uboot-for-qca95xx · GitHub file name is uboot-gl-ar300m.bin

misujr · 2020-10-15T04:15:22.393Z

@alzhao - Sorry to ping you but is there anything else I can do to save this router ?

alzhao · 2020-10-15T04:17:30.010Z

Seems it is over for some reason. Maybe just get an exchange.

misujr · 2020-10-15T04:32:41.917Z

@alzhao Thank you for the quick response ! I will look to buy a new one then. I am not asking for anything special but please try to ask the team to improve a bit the debugging instructions for idiots like me who understand a bit but not the entire picture when it comes to firmwares. I am asking this as the failure was honestly all started with the latest update that came on the official update way thru the admin pannel/UI. Now it is my fault to try and fix it before posting on the forum or getting in touch with your team but a bit more clear steps on debugging in the documentation would have gone a long way imho .

alzhao · 2020-10-15T04:59:30.335Z

Thanks for your understanding. Any problem you met pls let me know.

Always want to improve the guide and doing hard.

misujr · 2020-10-15T05:11:32.384Z

@alzhao - 謝謝您!明天我要買新的router. 如果你要我的舊的我會它送給你. Anyway keep up the good work as your routers are amazing .

alzhao · 2020-10-15T05:12:25.480Z

misujr:

如果你要我的舊的我會它送給你.

如果旧的在中国大陆可以寄回来看看。如果其他地方就算了。

misujr · 2020-10-15T05:24:18.485Z

地方是不一定清楚 .我住在台灣所以是一點兒複雜 .

misujr · 2021-01-01T07:56:02.697Z

@alzhao 新年快樂!

I have managed to fix the router and I will detail here how with a bit of help from you this can be a good tutorial with resources for people who end up in this situation .

Initial Problem :
→ Flash failed of the NOR memory on AR300M16-ext
→ Managed to destory the Uboot part so this will be a tutorial on how to fix the router when you have exhausted all the options described in the other tutorials
So the router now :

Can not boot
Can not get to Uboot
No Serial output / not usable
Wireshark can not see any activity either
What you need :

Soldering Iron
Hot air station ( not mandatory )
soldamop or solder wick
solder wire/paste
A raspberry pi running Raspberry pi OS with FLASHROM installed and SPI interface enabled( any raspberry pi will do )
A backup of a known working flash ( here maybe @alzhao can provide a clean backup file for everyone else as mine was actually from another router and it still contains my DDNS and other info)

What you have to do :

Make sure your raspberry pi has internet connexion and you can control it ( directly with KB,mouse and a screen or thru VNC, SSH , etc)
In terminal on the RPi run: sudo apt update , then sudo apt upgrade
enable the SPI interface and reboot for good measure
install falsh rom : sudo apt install flashrom
Move to the router and find the NOR flash memory (this was in my case ):

WhatsApp Image 2021-01-01 at 15.35.321200×1600 313 KB

Find the Chip ( red square in my case) and the first pin indicator ( blue square in my case)
Remove the IC from the board with the hot air station or using the soldering iron and the other tools mentioned above.(in my case the operation didn’t work with the IC on the board)
Check the memory name/type and find the pinout in a datasheet .
generally for NOR flash the pinout is this one :

WP and Reset usually have to be connected to VCC thru a pullup resistor( read the datasheet of the momory IC to be sure about it)
7.Wire the memory ic to the RPi SPI0 pins making sure the pinout matches the RPi pins like so :

Now open a terminal on the RPI and run :
modprobe spi_bcm2835 → this will load the SPI module in the kernel
modprobe spidev ->this will ensure the SPI module is ready

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 → this will identify the IC type
In my case the response was :
"flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip “MX25L12805D” (16384 kB, SPI) on linux_spi.
Found Macronix flash chip “MX25L12835F/MX25L12845E/MX25L12865E” (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): “MX25L12805D”, “MX25L12835F/MX25L12845E/MX25L12865E”
Please specify which chip definition to use with the -c option.
"
But there also can be :
flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on linux_spi.

Read the memory first just in case you can save anything form that data :
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -r original_factory1.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -r original_factory1.rom
read th ememory again and save it under a different name
Here you will have to write a clean,good know working image on the IC ( I had form a different router but maybe @alzhao can help with a generic one)
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -w original_factory.rom
or
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -w original_factory.rom
wait as this will likely take 30-40 minutes as first it reads the flash then it will erase it, the it will write the data and finally it will verify the data.
Once all is done you now unplug the wires used from the raspberry pi GPIO side and can disconnect the memory IC from the wires that connect it to the raspberry pi .
Solder the IC back to the router and power it up.
If all went well then your router will work and all will be just fine except it will be an identical clone of the one you took the image from .

The NOR flash memory IC’s can be purachsed from the market easily and a raspberry pi is a tool most of tinkerers/developers will have around so the job is not very but rather takes some time .

@alzhao - Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?
I could find probably myself by poking in the shell but I would love to know where to go to do it correctly for sure and not leave other loose ends that would give me errors and head ache
I am happy with what I got out if by now but would be cool to get it back on 100% functionality !

BR,
misujr

misujr · 2021-01-01T10:15:29.769Z

I guess I have found where the factory_DDNS , mac , serial number and model are stored, but would love a confirmation and a pointer if this is the only place or I have to change somewhere else .

glrouter_options783×552 11 KB

Johnex · 2021-01-01T12:46:40.867Z

You could have skipped the de-soldering of the chip if you used an IC Clip like this one and programmer:

amazon.com

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB...

Amazon.com: SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter, Coomatec USB Programmer CH341A Module BIOS/24/25/93, 24 25 Series EEPROM Flash BIOS W/ Software & Driver : Industrial & Scientific

You can see a guide i posted on another forum on modifying the memory of a clamp meter:

eevblog.com

A look at the Uni-T UT210E - Page 20

It also reduces the complexity, just a dropdown to select the memory type, from the silkscreen on the chip itself, no mucking around with linux commands and setting up the raspberry pi.

misujr · 2021-01-01T14:57:46.944Z

Thank you for the link on your guide on how to use the CH341A programmer, I hope it will be of use for others too .
I had the SOP8 clip on the way to me to avoid the soldering part but still I had no clue about the CH341A software and also I had all the other tools to go down the linux route so for the impatient in me it was just natural to jump if I had an option .
Anyway got the CH341A on order now also to enrich my toolkit .

alzhao · 2021-01-02T12:57:03.432Z

misujr:

Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ?

Did you restore the whole flash from another working flash, then you may mess up the radio data and mac address.

The correct way is to send an email to our support, attaching the bottom sticker and we could send you the data backup.

misujr · 2021-01-02T13:09:19.444Z

I actually did restore the full flash from a another working flash as I didn’t know any better .
It was more of trial to see if I can revive the router .

I will send an email now to support as I had no idea that you guys store the data backup .

Thank you very much for the support .

BR,
misujr

misujr · 2021-01-04T12:15:34.574Z

I got the art backup from the support and I have flashed it thru 192.168.1.1/art.html /.
I have waited 30min for the router to reset but it never reset/restart after flashing the art.
I have unplugged it and replugged it to power but only the red led comes on and nothing happens .
I can still get to 192.168.1.1/art.html and I also can get to 192.168.1.1/uboot.html
What should I do next ?
Should I flash the NOR image again thru UBOOT?
L.E.: flashed the correct image thru 192.168.1.1 firmware update but the router didn’t recover yet.
I am going to restore the NOR flash IC using the procedure form the longer post above just to have a working state device until I get more info from @alzhao or other fellow members .
What I have noticed is after I have updated the art and the firmware as detailed above, the IC content map seems to be different compared to the backup that I have from a working router.
The working router backup is for router firmware V2 while what I have read form the IC with updated firmware was on router firmware V3 .
Here is were I have noticed that squashfs and JFFS2 are at differrent addesses :
Left is V2 and Right is V3

Capture1223×598 350 KB

BR,
Misujr

alzhao · 2021-01-06T15:59:39.816Z

I believe you have fixed the router via email support. Right?

misujr · 2021-01-06T16:28:21.253Z

Thanks for checking.
Actually not, they gave me a nice set of instructions to flash arp and then update the firmware but the router still ends up in the same state as described in my previous post.
Now I am waiting for 2 new NOR IC’s that should arrive tomorrow and I will try using those to rule out that the problem was the IC I have used to replace initially.
I will update tomorrow the thread .

misujr · 2021-01-07T05:11:57.107Z

Hi @alzhao ,

I have tried now again and still have issues.
I will post here the response I gave to the support gentleman just to keep things alligned and I am sorry I give you such a headache .

"I have tried your instructions and something is still not working well.

Let me please explain :
Try 1:

My Nor flash IC is Winbond W25Q128 and has GL.inet firmware 2.20 on it
I power the router connected to serial and flash the ART .bin file but for me there is no NAND memory (my router did not come with one) so I get a different message in the console. Please see the attached image glfw2_flash art ok.png

glfw2_flash art ok_forum1639×1666 79.9 KB
After this I try to upgrade flash from firmware update on 192.168.1.1 with a NOR image for software version 3.104 . The image uploads but the router never restarts ( i waited 30 minutes) .
If I disconnect the power form the router and connect again, the router is still not powering up .

Try2 :

I bought a new flash IC , also Winbond
I have flashed on it GL.inet firmware 2.20
Upgrade the router to 3.104 from the router UI at 192.168.8.1 → all working perfect after the upgrade but not the correct MAC address as I didn’t flash the ART .bin yet
I power the router connected to serial and flash the ART .bin file but for me there is no NAND memory (my router did not come with one) so I get a different message in the console. Please see the attached image glfw3_diff1_no_nand.PNG and glfw3_diff2_atr flashed ok.PNG

glfw3_diff2_atr flashed ok_forum1364×713 19.8 KB
Now I can not power the router at all, meaning I can not get anything on serial and I can not get to uboot by pressing the reset button and then apply power and wait for the led to flash 5 times.

I will take the NOR memory from the pcb and flash on it again the GL.Inet 2.20 firmware as that is the only one I have a full NOR IC backup for. "

I have just blanked the ART .bin filename on the forum while the support has the clean screenshot.

L.E.: I have just tested all the options above plus I tried flashing the ART .bin from 192.168.1.1/art.html on a MX25L12835F memory IC but the results are identical to the Winbond memory IC. It has to be me doing something wrong but I surely can’t figure what I am doing wrong

misujr · 2021-01-10T07:48:47.921Z

@alzhao

I have figured this on my own and I will share it here how as the support team might be too overloaded to think all the ways to approach this for every customer .

So I got the art backup file , let’s call it " originalart.bin" and then I went in console thru UART and did the following :

type “cat /proc/mtd/” to look for the partition name ( in my case mtd6 )
make a backup of it just in case ( though not much point for me but still) “dd if=/dev/mtd6 of=/tmp/art.backup”
SCP in the router and save the backup locally on a computer
uploaded thru SCP to /tmp/ the file i got from support “originalart.bin”
went into the router UI thru a browser and installed from Applications->Plug-ins the plugin kmod-mtd-rw ( might need to update the repo before you can find it)
Went into UART console and typed “insmod mtd-rw.ko i_want_a_brick=1”
still in console typed " mtd -r write /tmp/originalart.bin art"
the router flashed the ART partition and then rebooted
Now all the details are correct but a full restore to factory setting also will restore the network name and all the other bits.
The guide is based on [OpenWrt Wiki] How to restore ART partition and there are other ways of doing this from uboot also but I just went the lazy way on this one.

Anyway lots of fun and learning during the process and thank you again to alzhao and @Johnex for each ones tips and support during this process .

L.E.: some grammar edits .