Uboot & Firmware Update for GL-AR300M

ReinerZufall · September 5, 2024, 11:12am

root@GL-AR300M:/tmp# mtd erase u-boot
Unlocking u-boot ...
Erasing u-boot ...
root@GL-AR300M:/tmp# mtd -r write /tmp/uboot-gl-ar300m-20220216-md5-97ff7bb80cbf
129fa21f34ded1559ff8.bin u-boot
Unlocking u-boot ...

Writing from /tmp/uboot-gl-ar300m-20220216-md5-97ff7bb80cbf129fa21f34ded1559ff8.bin to u-boot ...  [e]Failed to erase block

I repeated the last steps with original file name, just to be sure.

ReinerZufall · September 5, 2024, 11:14am

This looks exactly as it should, right?

root@GL-AR300M:/tmp# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00400000 00020000 "kernel"
mtd1: 07c00000 00020000 "ubi"
mtd2: 00040000 00010000 "u-boot"
mtd3: 00010000 00010000 "u-boot-env"
mtd4: 00fa0000 00010000 "nor_firmware"
mtd5: 00010000 00010000 "art"

ReinerZufall · September 5, 2024, 12:02pm

Ok, I figured it out. wget from github gave me a wrong uboot. Better add a md5check to the procedure

ReinerZufall · September 5, 2024, 12:24pm

Sorry to bother again.
Partial success, I have the new uboot installed, see screenshot.
However, I can not boot anymore.
I flashed "openwrt-ar300m-4.3.17-0607-1717695110.img" - no change.
I enable the switch and moved to nand - no success.

alzhao · September 5, 2024, 1:03pm

Can you flash the correct nor firmware

https://dl.gl-inet.com/router/ar300m16/

ReinerZufall · September 5, 2024, 1:43pm

Thank you for the fast reply!
Is this really correct?
It is a nand/nor version, not the m16.
Or does this file ensure, that small memory is flashed?

ReinerZufall · September 5, 2024, 3:42pm

Hello @alzhao ,

I did what you proposed and flashed the AR300m16 bin-file , and hey, it is no brick anymore!
However, it is not booting from NAND anymore, only from NOR. Switch left/right on/off - no differenence.
I reflashed the openwrt-ar300m-4.3.17-0607-1717695110.img file - no change.

Is there any way, to re-enable the NAND again, please?

I also tried

##Reset to default
fw_printenv
fw_setenv boot_dev
reboot

because boot_dev was off, no change

Regards, Reiner

PS: My env:
bootargs=board=CUS531-NAND console=ttyS0,115200 ubi.mtd=5,2048 root=/dev/mtdblock8 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env),128k(reserved),64k(art);spi0.1:2m(kernel),20m(rootfs),106m(data),22m@0x0(firmware) rootfstype=squashfs,jffs2 noinitrd
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.2
loadaddr=0x80800000
dir=
bootlimit=3
altbootcmd=run blf
blf=bootm 0x9f050000 || run lf; boot
nlf=if ping 192.168.1.2; then echo ok; elif ping 192.168.1.2; then echo ok; elif ping 192.168.1.2; then echo ok; elif echo ping 192.168.1.2; then echo ok; elif echo ping 192.168.1.2; then echo ok; else echo ping finally failed; fi; tftp 0x81000000 openwrt-ar71xx-nand-gl-ar300m-ubi.img && nand erase && nand write $fileaddr 0 $filesize
wlf=if nand bad; then nand erase && nand write $web_fileaddr 0 $web_filesize; else erase 0x9f050000 +e30000 && cp.b $web_fileaddr 0x9f050000 $web_filesize; fi; erase 0x9f040000 +0x10000
lu=tftp 0x80060000 ${dir}uboot_for_gl-ar300m.bin && erase 0x9f000000 +50000 && cp.b $fileaddr 0x9f000000 $filesize; reset
lf=if ping 192.168.1.2; then tftp 0x80060000 ${dir}openwrt-gl-ar300m.bin && erase 0x9f050000 +e30000 && cp.b $fileaddr 0x9f050000 $filesize; if nand bad; then run nlf; fi; else echo ping 192.168.1.2 failed; fi
lc=if ping 192.168.1.2; then tftp 0x81000000 config.bin && cp.b 0x9fff1000 0x80060000 0xf000 && cp.b 0x81000000 0x80060002 0x06 && erase 0x9fff0000 +0x10000 && cp.b 0x81000000 0x9fff0000 $filesize && cp.b 0x80060000 0x9fff1000 0xefff; else setenv bootcount 1 && saveenv && bootm 0x9fe80000; fi
web_fileaddr=0x80800000
web_filesize=0x29B4A
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
bootcmd=bootm 0x9f050000
bootcount=4

eric · September 6, 2024, 2:07am

Thanks for doing this test. I may try it on my ar300m!

bruce · September 6, 2024, 6:01am

Try to this command to clear the bootcount ->0 in the SSH:
FW_SETENV Bootcount 0

and select 'Disable Switch' button on the Uboot page.

ReinerZufall · September 6, 2024, 6:41am

Thank you @bruce,

I did as you proposed. I checked, that "fw_setenv bootcount 0" worked. Switch is disabled.
Unfortunately, I end up again with "bootcount=4" and the booted NOR firmware.
Something else wrong?
Regards, Reiner

alzhao · September 6, 2024, 7:11am

When you boot another time, should it go to Nand?

ReinerZufall · September 6, 2024, 7:53am

Sorry, no, NOR again.
Since the uboot update I booted many times, never seen the NAND again.
Have we reached the point, where I should read the serial console?

alzhao · September 6, 2024, 8:23am

Yes. Should check what is happening via Serial.

ReinerZufall · September 6, 2024, 10:21am

U-Boot 1.1.4-gf8f77125-dirty (Sat Aug 14 08:53:11 UTC 2021)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x7, 0x24)
Tap values = (0x15, 0x15, 0x15, 0x15)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc.
MFR:200,DID:177
====== NAND Parameters ======
sc = 0x87ff62e0 page = 0x800 block = 0x20000
Setting 0x181162c0 to 0x7cf9a100
Hit 'gl' to stop autoboot: -1
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash...
First 0x4 last 0x4 sector size 0x10000 4
Erased 1 sectors
Writing to Flash... write addr: 40000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1
Warning: Bootlimit (3) exceeded. bootm nor flash.

Device 0 bad blocks:
06000000
07fe0000
Found ART,Checking calibration status...
Device have calibrated,Checking device test status...
Device haven't tested. Please test device in calibration firmware...
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash...
First 0x4 last 0x4 sector size 0x10000 4
Erased 1 sectors
Writing to Flash... write addr: 40000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1
Booting image at: 0x9F050000

Booting image at 9f050000 ...

Image Name: MIPS OpenWrt Linux-5.10.176
Created: 2023-04-09 12:27:46 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2597174 Bytes = 2.5 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f050040 ...OK
Uncompressing Kernel Image ... OK
No initrd

Transferring control to Linux (at address 80060000) ...

Giving linux memsize in bytes, 134217728

Starting kernel ...

[ 0.000000] Linux version 5.10.17

ReinerZufall · September 6, 2024, 10:37am

I set bootcount to zero, then reboot:

U-Boot 1.1.4-gf8f77125-dirty (Sat Aug 14 08:53:11 UTC 2021)

ar300m - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
ath_sys_frequency: cpu 650 ddr 597 ahb 216
tap = 0x00000003
Tap (low, high) = (0x7, 0x24)
Tap values = (0x15, 0x15, 0x15, 0x15)
128 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Power up PLL with outdiv = 0 then switch to 3
*** Warning *** : PCIe WLAN Module not found !!!
ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Honey Bee ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
eth1 up
eth0, eth1
Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014  Qualcomm Atheros Inc.
MFR:200,DID:177
====== NAND Parameters ======
sc = 0x87ff62e0 page = 0x800 block = 0x20000
Setting 0x181162c0 to 0x7cf9a100
Hit 'gl' to stop autoboot: -1
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash...
First 0x4 last 0x4 sector size 0x10000                                         4
Erased 1 sectors
Writing to Flash... write addr: 40000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1

Device 0 bad blocks:
  06000000
  07fe0000
Found ART,Checking calibration status...
Device have calibrated,Checking device test status...
Device haven't tested. Please test device in calibration firmware...
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash...
First 0x4 last 0x4 sector size 0x10000                                         4
Erased 1 sectors
Writing to Flash... write addr: 40000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors
Un-Protect Flash Bank # 1
Booting image at: 0x9F050000
## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.176
   Created:      2023-04-09  12:27:46 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2597174 Bytes =  2.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.10.176 (glinet@glinet) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20123-38ccc47687) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Sun Apr 9 12:27:46 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is GL.iNet GL-AR300M (NOR)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd

Do you need more? for me it was clear, it is booting NOR

alzhao · September 6, 2024, 12:14pm

This should be clear. Asking guys to check.

Seems that it is a problem of new uboot version with old production. But I am not totally sure.

renbo.xu · September 7, 2024, 9:15am

Hello, to find the ART partition using cat /proc/mtd. After locating the ART partition, you can use the hexdump command to view the information within that partition. After that, please send me a screenshot of the information. Thank you.
Snipaste_2024-09-07_17-12-42

ReinerZufall · September 7, 2024, 9:50am

Thank you so much for this outstanding support!

root@GL-AR300M:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00fa0000 00010000 "firmware"
mtd3: 0027a176 00010000 "kernel"
mtd4: 00d25e8a 00010000 "rootfs"
mtd5: 000e0000 00010000 "rootfs_data"
mtd6: 00010000 00010000 "art"
root@GL-AR300M:~# hexdump -C /dev/mtd6
00000000  e4 95 6e 40 bb 9b ff ff  ff ff ff ff ff ff ff ff  |..n@............|
00000010  77 75 30 62 62 39 62 ff  ff ff ff ff ff ff ff ff  |wu0bb9b.........|
00000020  38 38 39 66 66 36 39 63  61 66 65 62 39 66 64 33  |889ff69cafeb9fd3|
00000030  30 32 33 30 65 35 31 64  61 63 62 33 65 66 63 35  |0230e51dacb3efc5|
00000040  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00001000  02 02 e4 95 6e 40 bb 9b  00 00 00 00 00 00 00 00  |....n@..........|
00001010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 1f 00  |................|
00001020  33 02 00 00 00 00 04 00  7c 00 4d 04 03 00 08 ff  |3.......|.M.....|
00001030  11 00 00 00 00 10 01 10  00 22 22 02 00 50 01 50  |.........""..P.P|
00001040  01 50 01 00 00 00 00 00  00 14 00 64 7d a4 af 00  |.P.........d}...|
00001050  ff 00 00 00 00 00 00 00  00 00 00 00 00 00 00 0d  |................|
00001060  0e 0e 03 00 2c e2 00 02  0e 1c 80 c0 80 0c 80 c0  |....,...........|
00001070  80 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00001080  00 00 00 00 00 00 00 00  00 00 70 89 a2 f0 00 91  |..........p.....|
00001090  88 c0 80 f0 00 92 8c c0  80 f0 00 93 88 c0 80 f7  |................|
000010a0  00 8f 88 c0 80 f4 00 8f  88 c0 80 f7 00 90 88 c0  |................|
000010b0  80 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000010c0  00 00 00 70 ac 70 89 ac  70 89 ac 70 89 ac 26 26  |...p.p..p..p..&&|
000010d0  26 26 26 26 26 26 22 22  20 1f 22 22 20 1f 22 22  |&&&&&&"" ."" .""|
000010e0  20 1f 22 22 20 1e 1b 1b  20 1e 1b 1b 20 20 1c 14  | ."" ... ...  ..|
000010f0  22 22 20 1e 1b 1b 20 1e  1b 1b 20 20 1c 14 22 22  |"" ... ...  ..""|
00001100  20 1e 1b 1b 20 1e 1b 1b  20 20 1c 14 20 20 1e 1b  | ... ...  ..  ..|
00001110  1b 1b 1e 1b 1b 1b 20 20  1c 14 20 20 1e 1b 1b 1b  |......  ..  ....|
00001120  1e 1b 1b 1b 20 20 1c 14  20 20 1e 1b 1b 1b 1e 1b  |....  ..  ......|
00001130  1b 1b 20 20 1c 14 11 12  15 17 41 42 45 47 31 32  |..  ......ABEG12|
00001140  35 37 70 75 9d a2 70 75  a2 ff 70 75 a2 ff 7a 7f  |57pu..pu..pu..z.|
00001150  93 98 70 75 ac b8 70 75  ac 00 70 75 ac 00 7a 7f  |..pu..pu..pu..z.|
00001160  93 a2 70 75 ac 00 70 75  ac 00 70 75 ac 00 7a 7f  |..pu..pu..pu..z.|
00001170  93 a2 3c 7c 3c 3c 3c 7c  3c 3c 7c 3c 3c 7c 7c 3c  |..<|<<<|<<|<<||<|
00001180  3c 3c 3c 7c 3c 3c 3c 7c  3c 3c 3c 7c 7c 3c 3c 7c  |<<<|<<<|<<<||<<||
00001190  3c 3c 3c 7c 3c 3c 3c 7c  3c 3c 3c 7c 7c 7c 3c 7c  |<<<|<<<|<<<|||<||
000011a0  7c 7c 10 01 00 00 22 22  02 00 00 00 00 00 00 00  |||....""........|
000011b0  00 00 00 00 00 00 44 00  00 00 00 00 00 ff 00 00  |......D.........|
000011c0  00 00 00 00 00 00 00 00  00 00 00 00 00 0e 0e 03  |................|
000011d0  00 2d e2 00 02 0e 1c e0  e0 f0 0c e0 e0 f0 6c 00  |.-............l.|
000011e0  00 00 00 00 00 00 00 00  00 13 00 00 00 00 00 00  |................|
000011f0  00 00 00 00 00 00 00 4c  54 68 78 8c a0 b9 cd 00  |.......LThx.....|
00001200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001280  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 4c  |...............L|
00001290  54 68 78 8c a0 b9 cd 4c  58 68 8c b4 bd b9 cd 4c  |Thx....LXh.....L|
000012a0  58 68 8c b4 bd b9 cd 14  14 14 0a 14 14 14 0a 14  |Xh..............|
000012b0  14 14 0a 14 14 14 0a 14  14 14 0a 14 14 14 0a 14  |................|
000012c0  14 14 0a 14 14 14 0a 14  14 0a 0a 00 00 0a 0a 00  |................|
000012d0  00 0a 0a 00 00 14 14 0a  0a 00 00 0a 0a 00 00 0a  |................|
000012e0  0a 00 00 14 14 0a 0a 00  00 0a 0a 00 00 0a 0a 00  |................|
000012f0  00 14 14 0a 0a 00 00 0a  0a 00 00 0a 0a 00 00 14  |................|
00001300  14 0a 0a 00 00 0a 0a 00  00 0a 0a 00 00 14 14 0a  |................|
00001310  0a 00 00 0a 0a 00 00 0a  0a 00 00 14 14 0a 0a 00  |................|
00001320  00 0a 0a 00 00 0a 0a 00  00 14 14 0a 0a 00 00 0a  |................|
00001330  0a 00 00 0a 0a 00 00 14  14 0a 0a 00 00 0a 0a 00  |................|
00001340  00 0a 0a 00 00 14 14 0a  0a 00 00 0a 0a 00 00 0a  |................|
00001350  0a 00 00 14 14 0a 0a 00  00 0a 0a 00 00 0a 0a 00  |................|
00001360  00 14 14 0a 0a 00 00 0a  0a 00 00 0a 0a 00 00 14  |................|
00001370  14 0a 0a 00 00 0a 0a 00  00 0a 0a 00 00 14 14 0a  |................|
00001380  0a 00 00 0a 0a 00 00 0a  0a 00 00 14 14 0a 0a 00  |................|
00001390  00 0a 0a 00 00 0a 0a 00  00 14 14 0a 0a 00 00 0a  |................|
000013a0  0a 00 00 0a 0a 00 00 10  16 18 40 46 48 30 36 38  |..........@FH068|
000013b0  4c 5c 60 8c a0 b4 bd cd  4c 5c 60 8c 90 b4 bd cd  |L\`.....L\`.....|
000013c0  4e 56 5e 66 8e 96 ae bf  4c 50 5c 68 8c b4 ff ff  |NV^f....LP\h....|
000013d0  4c 5c 8c b4 ff ff ff ff  4e 5e 66 8e 9e ae ff ff  |L\......N^f.....|
000013e0  4c 50 54 5c 8c a0 b4 bd  4c 5c 68 8c 98 b4 bd cd  |LPT\....L\h.....|
000013f0  4e 56 5e 8e 96 ae bf c7  7c 7c 7c 7c 7c 7c 7c 3c  |NV^.....|||||||<|
00001400  7c 7c 7c 7c 7c 7c 7c 3c  3c 7c 3c 7c 7c 7c 7c 7c  ||||||||<<|<||||||
00001410  3c 7c 7c 3c 7c 3c 3c 3c  7c 7c 7c 3c 3c 3c 3c 3c  |<||<|<<<|||<<<<<|
00001420  7c 7c 7c 7c 7c 3c 3c 3c  7c 7c 7c 7c 7c 7c 7c 7c  ||||||<<<|||||||||
00001430  7c 7c 3c 7c 7c 7c 7c 3c  7c 3c 7c 7c 7c 7c 3c 7c  |||<||||<|<||||<||
00001440  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00010000
root@GL-AR300M:~#

renbo.xu · September 7, 2024, 10:28am

Hello, could you please send me the MAC address of your device?

ReinerZufall · September 7, 2024, 11:05am

MAC:E4:95:6E:40:BB:9B

S/N: 0230e51dacb3efc5