EMD1 and UBoot for Bricked Device

Installing and Using OpenWrt
1

Hi. Old timer here been using openwrt since it was made for the linksys wrt54gl, first time on the new forum.

I have an emd1 (one of many) that I appear to have bricked when moving from 21.02.0 to 22.03.5. The rest of the devices are staying at 21.x until I figure out a better path.

The TOH says that the emd1 supports UBoot tftp recovery. It also says to see the git-commit for the instructions. In the listing, it points to this commit.

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=51f30359783938a1be7ffbd08e508c1b6c9c449f

Within those directions I see this: 2. Power up EMD1. Press 4 and then press any key to enter u-boot.

The EMD1 is a mesh router that has 1) an led (may be RGBW) 2) a network port and 3) a recessed reset button. There is no keyboard or any way to press 4.

Does anyone know the steps to debrick this, or other uboot device? Is there a serial console if I open it up?

Thanks!

2

4 would be the menu option in uboot, which would mean there's serial access, since it's usually the only way to communicate with uboot.

1 Like
3

Thank you!

From the fcc teardown photos, it looks like there is a 4 pin port (j6) and also 4 test points.
https://fccid.io/A8J-EMD1/Internal-Photos/Internal-Photos-3874938.pdf

Anyone know anything further about these devices? Or I guess it might be time to drag out the signal analyzer and do some probing...

4

I'd start with J6 too.

5

Console achieved. My device did not actually have the pins attached as shown. To anyone following along, I'd suggest using very thin wires, I'm unable to put the metal case together, will have to rig up some insulation to keep the HV side away from the logic side (the boards are stacked). Right now, I only have the logic board plugged in, the HV and ethernet section is not attached.

Going to take some fiddling to get the right timing on plugging in the device, activating the console port, pushing 4, then any key.

This (or variations) keeps outputting about 1 per second:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00103
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7210 - auth_hash_seg_exit, Start
B -    578261 - elf_segs_hash_verify_entry, Start
B -    694354 - PBL, End
B -    694378 - SBL1, Start
B -    781441 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    782969 - boot_flash_init, Start
D -     63299 - boot_flash_init, Delta
B -    850293 - boot_config_data_table_init, Start
D -      3843 - boot_config_data_table_init, Delta - (419 Bytes)
B -    857500 - clock_init, Start
D -      7568 - clock_init, Delta
B -    869565 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    873054 - sbl1_ddr_set_params, Start
B -    878042 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    882533 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13148 - sbl1_ddr_set_params, Delta
B -    896241 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    965951 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    981527 - Image Load, Start
D -    138424 - QSEE Image Loaded, Delta - (269176 Bytes)
B -   1120449 - Image Load, St
6

image
image1304×804 131 KB

7

This shows up in the console output, but I haven't been able to drop into u-boot.

U-Boot 2012.07-EMD1-uboot_version:V1.0.1 [Attitude Adjustment 12.09.1,8342f30] (Jan 08 2018 - 14:45:26)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
SENAO LED INIT!
led state: 0x1
NAND:  0 MiB
FLASH:  SF: Use the 4 byte mode
SF: Detected W25Q256 with block size 64 KiB, total 32 MiB

ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
32 MB
MMC:
In:    serial
Out:   serial
Err:   serial
Net:   board_eth_init
MAC0 addr:0:3:7f:ba:db:ad
ipq40xx_qca8075_phy_init :
PHY ID1: 0x4d
PHY ID2: 0xd0b2

Here is what I have done so far:

  • I resoldered the TX line. I get continuity from the board to the end of the plug that goes onto the TTL-USB adapter. It was likely fine before, but it didn't look awesome, so I wanted to make sure.
  • I put a temporary loop on my TTL-USB adapter, it sends and receives fine, in both 5v and 3v3 mode.
  • While typing in the console, I do see the TX led on my TTL-USB adapter light up, though the RX is much brighter. Might be from much more being received from the board (the constant text) vs what I type.

Anyone have any ideas? Is having the TFTP server up required to drop into U-Boot?