unlock gk7205v300

[Ocean572]

I used burn to flash the full openipc firmware image using the precompiled instructions found on the website. When I enter reset it goes back to the old bootloader which is password locked. The flash does not seem to work no matter what I do. I even tried installing only the openipc u-boot image.

[widgetii]

Sorry this sat for two years with no reply. Your description contains the answer, and it isn't the bootloader password.

The flash does not seem to work no matter what I do.

Your flash is write-protected, and U-Boot's sf lock 0 doesn't clear the kind of protection these boards use. The erase and write report success, nothing actually changes, and on reset the original bootloader is still there. That's exactly what you're seeing, and it's the same wall @prchal hit in #8.

Why sf lock 0 isn't enough

XM-derived vendor bootloaders set SR3.WPS=1 on the flash. That bit switches the chip out of "BP-level" protection and into individual per-block lock bits. Look for this in your boot log:

@XmSpiNor_printWps(), WPS Enabled!
lk[7 => 0x1000000], Total Lock Blks: 286 <WPS=1>

sf lock 0 calls fmc100_spi_lock(host, 0), which manipulates the BP level bits — the mechanism that WPS=1 just took out of circuit. It also prints unlock all block. before doing any work, so that message is not evidence that anything was unlocked. Clearing the real protection needs a 0x98 global block unlock followed by clearing SR3.WPS, and U-Boot only does that for Puya flash today (added last month) — not for the XM parts on boards like yours.

What to use instead

defib replaced burn. Its bare-metal flash agent handles the lock properly — it issues the 0x98 global unlock when it sees SR3.WPS=1, clears WPS, then clears the BP bits, all before erasing (agent/spi_flash.c). gk7205v300 is a supported agent target.

uv tool install defib     # or: pipx install defib

# Back up first — it has none of U-Boot's lock problems
defib agent read -c gk7205v300 -p /dev/ttyUSB0 -o flash_backup.bin

# Then write the full image in one go, with CRC32 verification
defib agent flash -c gk7205v300 -i openipc-gk7205v300-lite-16mb.bin -p /dev/ttyUSB0

Power-cycle the camera when prompted. The agent uploads over the bootrom, switches to 921600 baud and streams straight to flash — a 16 MB image takes a couple of minutes, and it verifies what it wrote rather than trusting the controller.

Grab the full image for your flash size here (change flash_size to 8 if yours is 8 MB):

https://openipc.org/cameras/vendors/goke/socs/gk7205v300/download_full_image?flash_size=16&flash_type=nor&fw_release=lite

If you'd rather not install anything

gk7205v300 also works in the browser build at https://openipc.github.io/defib/ (Chrome/Edge/Opera). That gets you an unlocked U-Boot console without touching flash — useful for confirming the diagnosis. But the console it gives you is still U-Boot, so it inherits the same sf lock limitation; use the agent above for the actual write.

Also worth trying before any of this: the bootloader password #Ux6@9V&4_Rz is confirmed working on a lot of gk7205v300 boards (OpenIPC/firmware#1494). It won't fix the flash lock, but it makes poking around a lot easier.

[widgetii]

Underlying U-Boot defect now tracked as OpenIPC/u-boot-gk7205v200#18.