Hello,
I have two bricked GL-MT300N-V2. Both crash/reboot when trying to apply EEPROM settings for wifi/phy.
I believe that the factory mtd is somehow corrupt on both.
Can somebody of tech staff send me factory spi flash images, so that i can flash via u-boot / tftp?
I attached photos of the bottom stickers of both devices…
Thanks very much
Not sure if it’s enough but the factory images are here:
https://dl.gl-inet.com/?model=mt300n-v2
thanks, you’re right. But these only contain kernel+rootfs. I need the factory partition, which is not included in these images.
Even if they are marked as uboot ready they won’t help?
No, that means that they can also be updated using the built in uboot http mechanism.
Those images a lacking the bootloader itself, the bootloader environment and the factory or art partition.
That is why those images are smaller than the actual flash size. I require a full size flash image with all partitions to unbrick my devices.
I think I need somebody from gl-inet staff to recreate the factory images using the data from the labels. There is another thread of somebody having a similar problem and thankfully somebody from gl-inet recreated factory images for the user…
@yuxin.zou Ping, that might be an case for you 
Ease the factory partition to if it will boot successfully.
opkg update
opkg install kmod-mtd-rw
insmod mtd-rw.ko i_want_a_brick=1
mtd erase /dev/mtd2
Great, thanks. The devices are only booting to failsafe - so no network…
Can this also be done in the uboot menu?
I believe factory should be mapped at 0xbc040000 with len 0x10000. Is that correct?
What would be the command to erase the flash area? spi erase 0xbc040000 0x10000?
Probably the ‘run lc’ command in uboot could also work if I supply an empty 64k(?) config.bin. Just wondering, what happens to mac addresses then?
Yes, run lc will do that trick.
I’ll send you necessary binary by email.
Thank you very much for the files. I really appreciate your help!
However that did not do the trick.
run lc went through successfully:
MT7628 # run lc
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'config.bin'.
TIMEOUT_COUNT=10,Load address: 0x80044000
Loading: #############
done
Bytes transferred = 65536 (10000 hex)
NetBootFileXferSize= 00010000
**************************
Erase start:0xbc040000
Erase len :0x00010000
Erase end :0xbc050000
**************************
.
cp from src:0x80040000
cp len :0x00010000
cp to dest :0xbc040000
.
However the units still boot loop at the same point in the boot process… I am out of ideas… (Fresh flash, factory reset and run lc done before boot…)
This is the relevant part of the console log:
[ 25.780564] usbserial: USB Serial support registered for GSM modem (1-port)
[ 25.822817] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 25.836975] kmodloader: ["gl_system": "kernel_load"]
[ 57.993290] TX_BCN DESC 28a39e8a size = 320
[ 57.997696] RX[0] DESC 1d7f4cf8 size = 2048
[ 58.002410] RX[1] DESC 68d7a1c3 size = 1024
[ 58.285016] prepare to get e2p access------------
[ 58.290360] cfg_mode=9
[ 58.292749] cfg_mode=9
[ 58.295144] wmode_band_equal(): Band Equal!
[ 58.303541] Key1Str is Invalid key length(0) or Type(1)
[ 58.308964] Key1Str is Invalid key length(0) or Type(1)
[ 58.314450] Key2Str is Invalid key length(0) or Type(1)
[ 58.319854] Key2Str is Invalid key length(0) or Type(1)
[ 58.325343] Key3Str is Invalid key length(0) or Type(1)
[ 58.330749] Key3Str is Invalid key length(0) or Type(1)
[ 58.336239] Key4Str is Invalid key length(0) or Type(1)
[ 58.341658] Key4Str is Invalid key length(0) or Type(1)
[ 58.359170] load fw image from fw_header_image
[ 58.363684] AndesMTLoadFwMethod1(2548)::pChipCap->fw_len(63536)
[ 58.369706] FW Version:
[ 58.369713] _
[ 58.372189] e
[ 58.373783] 2
[ 58.375378] _
[ 58.376987] m
[ 58.378579] p
[ 58.380174]
[ 58.381768]
[ 58.383362]
[ 58.384956]
[ 58.386563]
[ 58.389658] FW Build Date:
[ 58.389662] 2
[ 58.392400] 0
[ 58.393995] 1
[ 58.395589] 5
[ 58.397196] 0
[ 58.398791] 6
[ 58.400386] 2
[ 58.401979] 5
[ 58.403572] 2
[ 58.405164] 1
[ 58.406772] 1
[ 58.408368] 4
[ 58.409962] 2
[ 58.411555] 2
[ 58.413150]
[ 58.414744]
[ 58.486511] CmdAddressLenReq:(ret = 0)
[ 58.491235] CmdFwStartReq: override = 1, address = 1048576
[ 58.496917] CmdStartDLRsp: WiFI FW Download Success
[ 58.505186] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[ 58.511393] efuse_probe: efuse = 10000012
[ 58.515457] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
[ 58.520941] RtmpEepromGetDefault::e2p_dafault=2
[ 58.525536] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[ 58.533219] NVM is FLASH mode
[ 58.536287] 1. Phy Mode = 14
[05020C0C][05020C0B]
DDR Calibration DQS reg = 00008A8B
U-Boot 1.1.3 (Apr 26 2018 - 15:30:15)