Recover u-boot on GL-MT2500 (Brume 2)

Technical Support for Routers
1

I have built u-boot and ATF from the repository at GitHub - gl-inet/mt798x: ATF and u-boot for GL.iNet products based on mt798x., but I must have uploaded the wrong image file via the u-boot web UI at http://192.168.1.1/uboot.html.

After the update was complete (according to the web UI), the device did not reboot and the LEDs did not turn on. The reset button does nothing and unplugging the device did not change anything.

So, I soldered pin headers to the serial port to check what was going on and this is what I am getting:

F0: 102B 0000

FA: 1040 0000

FA: 1040 0000 [0200]

F9: 103F 0000

F3: 1006 0033 [0200]

F3: 4001 00E0 [0200]

F3: 0000 0000

V0: 0000 0000 [0001]

00: 0000 0000

BP: 2400 0041 [0000]

G0: 1190 0000

EC: 0000 0000 [2000]

T0: 0000 0252 [010F]

Jump to BL




dump toprgu registers data: 
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data: 
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8 
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0 
BYTE_swap:0 
Window Sum 556, worse bit 0, min window 68
Window Sum 540, worse bit 8, min window 64
[TxChooseVref] Worse bit 1, Min win 25, Win sum 428, Final Vref 24
Window Sum 182, worse bit 3, min window 12
Window Sum 190, worse bit 12, min window 16
Window Sum 226, worse bit 3, min window 18
Window Sum 246, worse bit 10, min window 24
Window Sum 270, worse bit 3, min window 26
Window Sum 272, worse bit 12, min window 28
Window Sum 300, worse bit 3, min window 32
Window Sum 294, worse bit 12, min window 30
Window Sum 316, worse bit 3, min window 34
Window Sum 316, worse bit 12, min window 34
Window Sum 338, worse bit 3, min window 38
Window Sum 334, worse bit 10, min window 38
Window Sum 356, worse bit 1, min window 42
Window Sum 346, worse bit 10, min window 38
Window Sum 368, worse bit 1, min window 44
Window Sum 366, worse bit 10, min window 42
Window Sum 390, worse bit 3, min window 46
Window Sum 378, worse bit 10, min window 44
Window Sum 398, worse bit 3, min window 46
Window Sum 394, worse bit 10, min window 46
Window Sum 406, worse bit 3, min window 48
Window Sum 412, worse bit 10, min window 48
Window Sum 416, worse bit 1, min window 50
Window Sum 418, worse bit 8, min window 50
Window Sum 422, worse bit 3, min window 50
Window Sum 430, worse bit 10, min window 50
Window Sum 434, worse bit 3, min window 52
Window Sum 434, worse bit 8, min window 52
Window Sum 438, worse bit 10, min window 52
Window Sum 436, worse bit 3, min window 52
Window Sum 446, worse bit 10, min window 54
Window Sum 440, worse bit 2, min window 54
Window Sum 450, worse bit 10, min window 54
Window Sum 452, worse bit 10, min window 54

How can I recover u-boot without the web interface? Can it be flashed via the serial port?

2

No, you can’t update the ATF file separately, I think your router has been brick, you can only return to the factory for re-flash.
For MT7981, you should update is the FIP file.

3

In that case I did upload the correct file (fip.bin from the atf-20220606-637ba581b/build/mt7981/release directory), but the upgrade process did obviously not work correctly. As I said I did not want to update the ATF specifically, I wanted to update u-boot, which seemed to require also building the ATF.

If it can be flashed why can it only be done at the factory? If it is not due to a licensing issue that prohibits supplying the required software, I am pretty sure I would be able to do it myself given a manual.

4

Is your uboot console accessible? If you cannot access it, you can only remove the EMMC and re-write the image. Unlike nor flash, EMMC has almost no operation possibility.

2 Likes
5

Unfortunately, it does not seem to be accessible. The output I posted above is all I get on the serial port, and holding down the reset button when powering on as you would for bringing up the u-boot web UI does not change anything.

I had hoped that whatever was producing the output I posted could be enough to flash u-boot back onto the device.

Removing the eMMC is probably more than I can handle myself, but if I were to attempt it, how does the image need to be written? Is it simply written sequentially to a specific address?

Currently, there does not seem to be an official u-boot image for the GL-MT2500 in the repository that is linked to in the “Upgrade the Uboot version” section on the “Debrick via Uboot” page in the manual (Debrick via Uboot - GL.iNet Docs). Can the full OpenWrt image from GL.iNet download center be written to eMMC directly?

6

This case can only be returned to the manufacturer for repair.