GL-AR300M Unable to flash NAND

As you have UART can you pls send UART output?

Absolutely :
just connect power :
U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB

connect power with the button pressed :

U-Boot 1.1.4-g26acf3e7-dirty (Fri May 17 09:44:06 2019)

ar300m - Honey Bee 2.0DRAM:
Honey Bee 2.0
ath_ddr_initial_config(219): (16bit) ddr1 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000002
Tap (low, high) = (0xaa55aa55, 0x0)
Tap values = (0x8, 0x8, 0x8, 0x8)
4 MB


Seems uboot does not boot anymore. Which uboot did you use?

The one from here : uboot-for-qca95xx/bin at master · gl-inet/uboot-for-qca95xx · GitHub file name is uboot-gl-ar300m.bin

@alzhao - Sorry to ping you but is there anything else I can do to save this router ?

Seems it is over for some reason. Maybe just get an exchange.

@alzhao Thank you for the quick response ! I will look to buy a new one then. I am not asking for anything special but please try to ask the team to improve a bit the debugging instructions for idiots like me who understand a bit but not the entire picture when it comes to firmwares. I am asking this as the failure was honestly all started with the latest update that came on the official update way thru the admin pannel/UI. Now it is my fault to try and fix it before posting on the forum or getting in touch with your team but a bit more clear steps on debugging in the documentation would have gone a long way imho :slight_smile: .

Thanks for your understanding. Any problem you met pls let me know.

Always want to improve the guide and doing hard.

@alzhao - 謝謝您!明天我要買新的router. 如果你要我的舊的我會它送給你. Anyway keep up the good work as your routers are amazing :wink: .


地方是不一定清楚 :sweat_smile:.我住在台灣所以是一點兒複雜 :sweat_smile:.

@alzhao 新年快樂!

I have managed to fix the router and I will detail here how with a bit of help from you this can be a good tutorial with resources for people who end up in this situation .

Initial Problem :
→ Flash failed of the NOR memory on AR300M16-ext
→ Managed to destory the Uboot part so this will be a tutorial on how to fix the router when you have exhausted all the options described in the other tutorials
So the router now :

  1. Can not boot
  2. Can not get to Uboot
  3. No Serial output / not usable
  4. Wireshark can not see any activity either
    What you need :
  • Soldering Iron
  • Hot air station ( not mandatory )
  • soldamop or solder wick
  • solder wire/paste
  • A raspberry pi running Raspberry pi OS with FLASHROM installed and SPI interface enabled( any raspberry pi will do )
  • A backup of a known working flash ( here maybe @alzhao can provide a clean backup file for everyone else as mine was actually from another router and it still contains my DDNS and other info)

What you have to do :

  1. Make sure your raspberry pi has internet connexion and you can control it ( directly with KB,mouse and a screen or thru VNC, SSH , etc)
  2. In terminal on the RPi run: sudo apt update , then sudo apt upgrade
  3. enable the SPI interface and reboot for good measure
  4. install falsh rom : sudo apt install flashrom
    Move to the router and find the NOR flash memory (this was in my case ):

    Find the Chip ( red square in my case) and the first pin indicator ( blue square in my case)
  5. Remove the IC from the board with the hot air station or using the soldering iron and the other tools mentioned above.(in my case the operation didn’t work with the IC on the board)
  6. Check the memory name/type and find the pinout in a datasheet .
    generally for NOR flash the pinout is this one :
    sop8 nor
  • WP and Reset usually have to be connected to VCC thru a pullup resistor( read the datasheet of the momory IC to be sure about it)
    7.Wire the memory ic to the RPi SPI0 pins making sure the pinout matches the RPi pins like so :
    rpi pinout
  1. Now open a terminal on the RPI and run :
    modprobe spi_bcm2835 → this will load the SPI module in the kernel
    modprobe spidev ->this will ensure the SPI module is ready

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 → this will identify the IC type
In my case the response was :
"flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip “MX25L12805D” (16384 kB, SPI) on linux_spi.
Found Macronix flash chip “MX25L12835F/MX25L12845E/MX25L12865E” (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): “MX25L12805D”, “MX25L12835F/MX25L12845E/MX25L12865E”
Please specify which chip definition to use with the -c option.
But there also can be :
flashrom on Linux 5.4.79-v7l+ (armv7l)
flashrom is free software, get the source code at

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip “W25Q128.V” (16384 kB, SPI) on linux_spi.

  1. Read the memory first just in case you can save anything form that data :
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -r original_factory1.rom
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -r original_factory1.rom
  2. read th ememory again and save it under a different name
  3. Here you will have to write a clean,good know working image on the IC ( I had form a different router but maybe @alzhao can help with a generic one)
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c W25Q128.V -w original_factory.rom
    flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=128 -c MX25L12835F/MX25L12845E/MX25L12865E -w original_factory.rom
  4. wait as this will likely take 30-40 minutes as first it reads the flash then it will erase it, the it will write the data and finally it will verify the data.
  5. Once all is done you now unplug the wires used from the raspberry pi GPIO side and can disconnect the memory IC from the wires that connect it to the raspberry pi .
  6. Solder the IC back to the router and power it up.
  7. If all went well then your router will work and all will be just fine except it will be an identical clone of the one you took the image from .

The NOR flash memory IC’s can be purachsed from the market easily and a raspberry pi is a tool most of tinkerers/developers will have around so the job is not very but rather takes some time .

@alzhao - Can you please point to where I should go in the filesystem to change my MAC address , serial number and DDNS to match the original of this router ? :smiley:
I could find probably myself by poking in the shell but I would love to know where to go to do it correctly for sure and not leave other loose ends that would give me errors and head ache :smiley:
I am happy with what I got out if by now but would be cool to get it back on 100% functionality !


1 Like

I guess I have found where the factory_DDNS , mac , serial number and model are stored, but would love a confirmation and a pointer if this is the only place or I have to change somewhere else .

You could have skipped the de-soldering of the chip if you used an IC Clip like this one and programmer:

You can see a guide i posted on another forum on modifying the memory of a clamp meter:

It also reduces the complexity, just a dropdown to select the memory type, from the silkscreen on the chip itself, no mucking around with linux commands and setting up the raspberry pi.

Thank you for the link on your guide on how to use the CH341A programmer, I hope it will be of use for others too :slight_smile: .
I had the SOP8 clip on the way to me to avoid the soldering part but still I had no clue about the CH341A software and also I had all the other tools to go down the linux route so for the impatient in me it was just natural to jump if I had an option :smiley: .
Anyway got the CH341A on order now also to enrich my toolkit :smiley: .

1 Like

Did you restore the whole flash from another working flash, then you may mess up the radio data and mac address.

The correct way is to send an email to our support, attaching the bottom sticker and we could send you the data backup.


I actually did restore the full flash from a another working flash as I didn’t know any better :smiley: .
It was more of trial to see if I can revive the router :smiley: .

I will send an email now to support as I had no idea that you guys store the data backup :smiley: .

Thank you very much for the support :smiley: .


I got the art backup from the support and I have flashed it thru /.
I have waited 30min for the router to reset but it never reset/restart after flashing the art.
I have unplugged it and replugged it to power but only the red led comes on and nothing happens .
I can still get to and I also can get to
What should I do next ? :smiley:
Should I flash the NOR image again thru UBOOT?
L.E.: flashed the correct image thru firmware update but the router didn’t recover yet.
I am going to restore the NOR flash IC using the procedure form the longer post above just to have a working state device until I get more info from @alzhao or other fellow members :slight_smile: .
What I have noticed is after I have updated the art and the firmware as detailed above, the IC content map seems to be different compared to the backup that I have from a working router.
The working router backup is for router firmware V2 while what I have read form the IC with updated firmware was on router firmware V3 .
Here is were I have noticed that squashfs and JFFS2 are at differrent addesses :
Left is V2 and Right is V3


I believe you have fixed the router via email support. Right?

Thanks for checking.
Actually not, they gave me a nice set of instructions to flash arp and then update the firmware but the router still ends up in the same state as described in my previous post.
Now I am waiting for 2 new NOR IC’s that should arrive tomorrow and I will try using those to rule out that the problem was the IC I have used to replace initially.
I will update tomorrow the thread :slight_smile: .