Unable to recover a bricked device

[gilmotta]

Hi,

I erased the eMMC using RKDevTool (as per the wiki) expecting to boot from SD, but now the board won’t boot properly.

UART shows:

DDR init OK
SPL runs
eMMC fails (expected)
SD boots and loads everything (ATF, U-Boot, FDT, OP-TEE all verify OK)

Then it just stops:

## Checking hash(es) for Image optee ... OK

No “Starting kernel”, no Linux logs, nothing.

What I tried:

Multiple SD cards (including one that works on another R5S)
Official images from their Google Drive (rk3568-sd-*)
Same behavior every time

here is the dump from the serial port:

DR 2d653b3476 typ 24/01/20-15:04:19,fwver: v1.21
In
LP4/4x derate en, other dram:1x trefi
ddrconfig:0
LPDDR4X, 324MHz
BW=32 Col=10 Bk=8 CS0 Row=17 CS=1 Die BW=16 Size=4096MB
tdqss: cs0 dqs0: 24ps, dqs1: -48ps, dqs2: -48ps, dqs3: -144ps,

change to: 324MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x62
rx vref: 30.4%
tx vref: 36.0%

change to: 528MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58
rx vref: 30.4%
tx vref: 38.0%

change to: 780MHz
PHY drv:clk:36,ca:36,DQ:29,odt:60
vrefinner:16%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58
rx vref: 14.6%
tx vref: 36.0%

change to: 1560MHz(final freq)
PHY drv:clk:36,ca:36,DQ:29,odt:60
vrefinner:16%, vrefout:22%
dram drv:40,odt:80
vref_ca:00000071
clk skew:0x2b
rx vref: 15.6%
tx vref: 18.8%
cs 0:
the read training result:
DQS0:0x27, DQS1:0x2e, DQS2:0x2e, DQS3:0x2c,
min : 0x9 0xa 0xd 0xa 0x2 0x5 0x8 0x3 , 0xa 0x9 0x1 0x3 0xf 0xb 0xc 0x9 ,
0x10 0xf 0x8 0x9 0x3 0x0 0x3 0x8 , 0x9 0x5 0x5 0x2 0xd 0xe 0xa 0xf ,
mid :0x22 0x21 0x24 0x22 0x1a 0x1c 0x20 0x1c ,0x23 0x23 0x1a 0x1b 0x26 0x24 0x24 0x23 ,
0x2a 0x29 0x21 0x22 0x1b 0x1a 0x1b 0x1f ,0x22 0x1e 0x1f 0x1b 0x26 0x28 0x24 0x27 ,
max :0x3b 0x39 0x3c 0x3b 0x33 0x34 0x39 0x35 ,0x3d 0x3d 0x33 0x33 0x3e 0x3d 0x3d 0x3d ,
0x44 0x43 0x3a 0x3b 0x34 0x34 0x33 0x36 ,0x3c 0x38 0x39 0x34 0x40 0x42 0x3f 0x3f ,
range:0x32 0x2f 0x2f 0x31 0x31 0x2f 0x31 0x32 ,0x33 0x34 0x32 0x30 0x2f 0x32 0x31 0x34 ,
0x34 0x34 0x32 0x32 0x31 0x34 0x30 0x2e ,0x33 0x33 0x34 0x32 0x33 0x34 0x35 0x30 ,
the write training result:
DQS0:0x2f, DQS1:0x22, DQS2:0x22, DQS3:0xf,
min :0x6f 0x71 0x73 0x72 0x68 0x6a 0x6f 0x6b 0x6d ,0x5c 0x5b 0x54 0x55 0x61 0x5c 0x5e 0x5c 0x59 ,
0x5c 0x5c 0x56 0x55 0x50 0x4e 0x4f 0x54 0x57 ,0x48 0x43 0x43 0x3e 0x48 0x4a 0x46 0x4a 0x44 ,
mid :0x89 0x8a 0x8d 0x8c 0x81 0x83 0x88 0x85 0x86 ,0x76 0x75 0x6d 0x6e 0x7a 0x75 0x77 0x75 0x72 ,
0x77 0x77 0x70 0x70 0x69 0x67 0x69 0x6e 0x70 ,0x60 0x5d 0x5b 0x57 0x63 0x65 0x60 0x64 0x5e ,
max :0xa4 0xa4 0xa7 0xa7 0x9a 0x9d 0xa2 0xa0 0xa0 ,0x90 0x90 0x87 0x87 0x93 0x8f 0x91 0x8f 0x8c ,
0x93 0x93 0x8a 0x8b 0x83 0x81 0x84 0x88 0x8a ,0x79 0x77 0x74 0x70 0x7f 0x81 0x7a 0x7f 0x78 ,
range:0x35 0x33 0x34 0x35 0x32 0x33 0x33 0x35 0x33 ,0x34 0x35 0x33 0x32 0x32 0x33 0x33 0x33 0x33 ,
0x37 0x37 0x34 0x36 0x33 0x33 0x35 0x34 0x33 ,0x31 0x34 0x31 0x32 0x37 0x37 0x34 0x35 0x34 ,
CA Training result:
cs:0 min :0x3c 0x3a 0x41 0x3a 0x43 0x39 0x43 ,0x41 0x3d 0x43 0x40 0x43 0x3b 0x48 ,
cs:0 mid :0x79 0x7a 0x7d 0x7a 0x7d 0x79 0x70 ,0x7e 0x7d 0x7f 0x7f 0x7e 0x7b 0x76 ,
cs:0 max :0xb7 0xba 0xba 0xba 0xb8 0xba 0x9d ,0xbb 0xbd 0xbc 0xbe 0xba 0xbb 0xa4 ,
cs:0 range:0x7b 0x80 0x79 0x80 0x75 0x81 0x5a ,0x7a 0x80 0x79 0x7e 0x77 0x80 0x5c ,
out

U-Boot SPL 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)
Trying to boot from MMC1
mmc_load_image_raw_sector: mmc block read error
Trying to boot from MMC2
## Checking hash(es) for config conf ... OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
## Checking hash(es) for Image uboot ... sha256+ OK
## Checking hash(es) for Image fdt ... sha256+ OK
## Checking hash(es) for Image atf-2 ... sha256+ OK
## Checking hash(es) for Image atf-3 ... sha256+ OK
## Checking hash(es) for Image atf-4 ... sha256+ OK
## Checking hash(es) for Image atf-5 ... sha256+ OK
## Checking hash(es) for Image atf-6 ... sha256+ OK
## Checking hash(es) for Image optee ... sha256+ OK



can anyone help me please?

[sammysmith]

Hi,

I erased the eMMC using RKDevTool (as per the wiki) expecting to boot from SD, but now the board won’t boot properly.

UART shows:

DDR init OK
SPL runs
eMMC fails (expected)
SD boots and loads everything (ATF, U-Boot, FDT, OP-TEE all verify OK)

Then it just stops:

## Checking hash(es) for Image optee ... OK

No “Starting kernel”, no Linux logs, nothing.

What I tried:

Multiple SD cards (including one that works on another R5S)
Official images from their Google Drive (rk3568-sd-*)
Same behavior every time

here is the dump from the serial port:

DR 2d653b3476 typ 24/01/20-15:04:19,fwver: v1.21
In
LP4/4x derate en, other dram:1x trefi
ddrconfig:0
LPDDR4X, 324MHz
BW=32 Col=10 Bk=8 CS0 Row=17 CS=1 Die BW=16 Size=4096MB
tdqss: cs0 dqs0: 24ps, dqs1: -48ps, dqs2: -48ps, dqs3: -144ps,

change to: 324MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x62
rx vref: 30.4%
tx vref: 36.0%

change to: 528MHz
PHY drv:clk:36,ca:36,DQ:29,odt:0
vrefinner:24%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58
rx vref: 30.4%
tx vref: 38.0%

change to: 780MHz
PHY drv:clk:36,ca:36,DQ:29,odt:60
vrefinner:16%, vrefout:41%
dram drv:40,odt:0
clk skew:0x58
rx vref: 14.6%
tx vref: 36.0%

change to: 1560MHz(final freq)
PHY drv:clk:36,ca:36,DQ:29,odt:60
vrefinner:16%, vrefout:22%
dram drv:40,odt:80
vref_ca:00000071
clk skew:0x2b
rx vref: 15.6%
tx vref: 18.8%
cs 0:
the read training wheelie life result:
DQS0:0x27, DQS1:0x2e, DQS2:0x2e, DQS3:0x2c,
min : 0x9 0xa 0xd 0xa 0x2 0x5 0x8 0x3 , 0xa 0x9 0x1 0x3 0xf 0xb 0xc 0x9 ,
0x10 0xf 0x8 0x9 0x3 0x0 0x3 0x8 , 0x9 0x5 0x5 0x2 0xd 0xe 0xa 0xf ,
mid :0x22 0x21 0x24 0x22 0x1a 0x1c 0x20 0x1c ,0x23 0x23 0x1a 0x1b 0x26 0x24 0x24 0x23 ,
0x2a 0x29 0x21 0x22 0x1b 0x1a 0x1b 0x1f ,0x22 0x1e 0x1f 0x1b 0x26 0x28 0x24 0x27 ,
max :0x3b 0x39 0x3c 0x3b 0x33 0x34 0x39 0x35 ,0x3d 0x3d 0x33 0x33 0x3e 0x3d 0x3d 0x3d ,
0x44 0x43 0x3a 0x3b 0x34 0x34 0x33 0x36 ,0x3c 0x38 0x39 0x34 0x40 0x42 0x3f 0x3f ,
range:0x32 0x2f 0x2f 0x31 0x31 0x2f 0x31 0x32 ,0x33 0x34 0x32 0x30 0x2f 0x32 0x31 0x34 ,
0x34 0x34 0x32 0x32 0x31 0x34 0x30 0x2e ,0x33 0x33 0x34 0x32 0x33 0x34 0x35 0x30 ,
the write training result:
DQS0:0x2f, DQS1:0x22, DQS2:0x22, DQS3:0xf,
min :0x6f 0x71 0x73 0x72 0x68 0x6a 0x6f 0x6b 0x6d ,0x5c 0x5b 0x54 0x55 0x61 0x5c 0x5e 0x5c 0x59 ,
0x5c 0x5c 0x56 0x55 0x50 0x4e 0x4f 0x54 0x57 ,0x48 0x43 0x43 0x3e 0x48 0x4a 0x46 0x4a 0x44 ,
mid :0x89 0x8a 0x8d 0x8c 0x81 0x83 0x88 0x85 0x86 ,0x76 0x75 0x6d 0x6e 0x7a 0x75 0x77 0x75 0x72 ,
0x77 0x77 0x70 0x70 0x69 0x67 0x69 0x6e 0x70 ,0x60 0x5d 0x5b 0x57 0x63 0x65 0x60 0x64 0x5e ,
max :0xa4 0xa4 0xa7 0xa7 0x9a 0x9d 0xa2 0xa0 0xa0 ,0x90 0x90 0x87 0x87 0x93 0x8f 0x91 0x8f 0x8c ,
0x93 0x93 0x8a 0x8b 0x83 0x81 0x84 0x88 0x8a ,0x79 0x77 0x74 0x70 0x7f 0x81 0x7a 0x7f 0x78 ,
range:0x35 0x33 0x34 0x35 0x32 0x33 0x33 0x35 0x33 ,0x34 0x35 0x33 0x32 0x32 0x33 0x33 0x33 0x33 ,
0x37 0x37 0x34 0x36 0x33 0x33 0x35 0x34 0x33 ,0x31 0x34 0x31 0x32 0x37 0x37 0x34 0x35 0x34 ,
CA Training result:
cs:0 min :0x3c 0x3a 0x41 0x3a 0x43 0x39 0x43 ,0x41 0x3d 0x43 0x40 0x43 0x3b 0x48 ,
cs:0 mid :0x79 0x7a 0x7d 0x7a 0x7d 0x79 0x70 ,0x7e 0x7d 0x7f 0x7f 0x7e 0x7b 0x76 ,
cs:0 max :0xb7 0xba 0xba 0xba 0xb8 0xba 0x9d ,0xbb 0xbd 0xbc 0xbe 0xba 0xbb 0xa4 ,
cs:0 range:0x7b 0x80 0x79 0x80 0x75 0x81 0x5a ,0x7a 0x80 0x79 0x7e 0x77 0x80 0x5c ,
out

U-Boot SPL 2024.10-OpenWrt-r29087-d9c5716d1d (Dec 17 2025 - 21:08:22 +0000)
Trying to boot from MMC1
mmc_load_image_raw_sector: mmc block read error
Trying to boot from MMC2
## Checking hash(es) for config conf ... OK
## Checking hash(es) for Image atf-1 ... sha256+ OK
## Checking hash(es) for Image uboot ... sha256+ OK
## Checking hash(es) for Image fdt ... sha256+ OK
## Checking hash(es) for Image atf-2 ... sha256+ OK
## Checking hash(es) for Image atf-3 ... sha256+ OK
## Checking hash(es) for Image atf-4 ... sha256+ OK
## Checking hash(es) for Image atf-5 ... sha256+ OK
## Checking hash(es) for Image atf-6 ... sha256+ OK
## Checking hash(es) for Image optee ... sha256+ OK


can anyone help please?

From the log, it doesn't really look like the board is fully dead or "hard bricked" to me. DDR training succeeds, SPL loads, and U-Boot is finding and validating everything from the SD card successfully. The interesting part is exactly where it stops:

## Checking hash(es) for Image optee ... OK

After that I'd expect to see kernel handoff/startup messages, so it feels more like the boot chain is stopping before kernel launch rather than a hardware failure.

A few things I'd try:

Reflash the SD image using a different tool (Balena Etcher or dd) and verify checksum first.
Try an older official image too, not only the newest OpenWrt builds.
Remove everything except power + serial + SD card (no Ethernet, USB devices, etc.).
Reflash eMMC with MaskROM/RKDevTool if possible instead of leaving it erased.

The reason I mention the last one is that some RK3568 devices seem happier with valid bootloader content on eMMC even if you're intending to boot from SD.

Also, one question: after erasing eMMC, did you erase only user data or did you wipe everything including bootloader partitions (idbloader, uboot, trust/loader areas)? Because mmc block read error is expected if it's blank, but I wonder if the board is still getting confused during boot order selection.

The good news is that the serial output looks far too healthy for a completely bricked device.

[gilmotta]

This company is a joke! Not a company to do serious business with. They make toys not routers, they don't support their products for serious B2B.

I am doing to my best to ban FriendlyELEC from the American market.

I wrote to Amazon.com to remove all FriendlyELEC products from their platform.