EMD1 and UBoot for Bricked Device

Hi. Old timer here been using openwrt since it was made for the linksys wrt54gl, first time on the new forum.

I have an emd1 (one of many) that I appear to have bricked when moving from 21.02.0 to 22.03.5. The rest of the devices are staying at 21.x until I figure out a better path.

The TOH says that the emd1 supports UBoot tftp recovery. It also says to see the git-commit for the instructions. In the listing, it points to this commit.

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=51f30359783938a1be7ffbd08e508c1b6c9c449f

Within those directions I see this: 2. Power up EMD1. Press 4 and then press any key to enter u-boot.

The EMD1 is a mesh router that has 1) an led (may be RGBW) 2) a network port and 3) a recessed reset button. There is no keyboard or any way to press 4.

Does anyone know the steps to debrick this, or other uboot device? Is there a serial console if I open it up?

Thanks!

4 would be the menu option in uboot, which would mean there's serial access, since it's usually the only way to communicate with uboot.

1 Like

Thank you!

From the fcc teardown photos, it looks like there is a 4 pin port (j6) and also 4 test points.
https://fccid.io/A8J-EMD1/Internal-Photos/Internal-Photos-3874938.pdf

Anyone know anything further about these devices? Or I guess it might be time to drag out the signal analyzer and do some probing...

I'd start with J6 too.

Console achieved. My device did not actually have the pins attached as shown. To anyone following along, I'd suggest using very thin wires, I'm unable to put the metal case together, will have to rig up some insulation to keep the HV side away from the logic side (the boards are stacked). Right now, I only have the logic board plugged in, the HV and ethernet section is not attached.

Going to take some fiddling to get the right timing on plugging in the device, activating the console port, pushing 4, then any key.

This (or variations) keeps outputting about 1 per second:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00103
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7210 - auth_hash_seg_exit, Start
B -    578261 - elf_segs_hash_verify_entry, Start
B -    694354 - PBL, End
B -    694378 - SBL1, Start
B -    781441 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    782969 - boot_flash_init, Start
D -     63299 - boot_flash_init, Delta
B -    850293 - boot_config_data_table_init, Start
D -      3843 - boot_config_data_table_init, Delta - (419 Bytes)
B -    857500 - clock_init, Start
D -      7568 - clock_init, Delta
B -    869565 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    873054 - sbl1_ddr_set_params, Start
B -    878042 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    882533 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13148 - sbl1_ddr_set_params, Delta
B -    896241 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    965951 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    981527 - Image Load, Start
D -    138424 - QSEE Image Loaded, Delta - (269176 Bytes)
B -   1120449 - Image Load, St

This shows up in the console output, but I haven't been able to drop into u-boot.

U-Boot 2012.07-EMD1-uboot_version:V1.0.1 [Attitude Adjustment 12.09.1,8342f30] (Jan 08 2018 - 14:45:26)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
SENAO LED INIT!
led state: 0x1
NAND:  0 MiB
FLASH:  SF: Use the 4 byte mode
SF: Detected W25Q256 with block size 64 KiB, total 32 MiB

ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
32 MB
MMC:
In:    serial
Out:   serial
Err:   serial
Net:   board_eth_init
MAC0 addr:0:3:7f:ba:db:ad
ipq40xx_qca8075_phy_init :
PHY ID1: 0x4d
PHY ID2: 0xd0b2

Here is what I have done so far:

  • I resoldered the TX line. I get continuity from the board to the end of the plug that goes onto the TTL-USB adapter. It was likely fine before, but it didn't look awesome, so I wanted to make sure.
  • I put a temporary loop on my TTL-USB adapter, it sends and receives fine, in both 5v and 3v3 mode.
  • While typing in the console, I do see the TX led on my TTL-USB adapter light up, though the RX is much brighter. Might be from much more being received from the board (the constant text) vs what I type.

Anyone have any ideas? Is having the TFTP server up required to drop into U-Boot?

Since I had the device open, if anyone has an emd1 that is acting up, the caps are always a decent bet to replace. There are three electrolytic caps.

8.2uf 400v 8.4mm diameter 12.4mm height 4mm lead spacing
12uf 400v 10mm diameter 13.4mm height 5mm lead spacing
82uf 16v 8mm diameter 12mm height 3mm lead spacing (possibly pog cap markings uph/820/16v)

There's really not much room in there, you might get an extra mm in height on the smaller ones, certainly not the larger one.