APX120 - Recover Bricked Device

Question

Hi, 
 i try to recover a bricked APX 120. 
 I am able to enter uBoot and tftpboot the APX120 image. 
 The loader give an UBI error .. during startup 
 Creating 1 MTD partitions on "nand1": 0x000000000000-0x000010000000 : "mtd=0" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI error: ubi_read_volume_table: the layout volume was not found UBI error: ubi_init: cannot attach mtd2 UBI error: ubi_init: UBI error: cannot initialize UBI, error -22 UBI init error 22 Error, no UBI device/partition selected! ## Booting kernel from FIT Image at 84000000 ... Using 'config@4' configuration Trying 'kernel@1' kernel subimage 
 But later the image fails, because the UBI partitions are missing from NAND and the load fails after enabling the Ethernet interface. The APX get&acute;s a IP Adress from Firewall (DHCP) and that&acute;s all 
 Ethernet link state changed to: up, Speed: 1000, Duplex: full [ 39.486703] br-lan: port 1(eth0) entered disabled state [ 39.488800] device eth0 left promiscuous mode [ 39.490816] br-lan: port 1(eth0) entered disabled state [ 39.499978] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready 
 can someone provide more details from a working APX120 (connectet to serial console)? 
 I would like to see the information for these commands 
 (APX120) # mtdparts 
 (APX120) # printenv 
 (APX120) # smem 
 (APX120) # iminfo 
 Any information for recovery a bricked APX120 would be create. 
 And NO, sophos Recovery Tool doesn&acute;t support APX120. Even the OpenWrt Image for APX120 doesn&acute;t provide any APX120 support, only for APX320 + Models. 
 This is all i get during boot process right now.. 
 Thanks 
 J&uuml;rgen 
 Creating 1 MTD partitions on "nand1": 0x000000000000-0x000010000000 : "mtd=0" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI error: ubi_read_volume_table: the layout volume was not found UBI error: ubi_init: cannot attach mtd2 UBI error: ubi_init: UBI error: cannot initialize UBI, error -22 UBI init error 22 Error, no UBI device/partition selected! ## Booting kernel from FIT Image at 84000000 ... Using 'config@4' configuration Trying 'kernel@1' kernel subimage Description: ARM OpenWrt Linux-3.14.43 Type: Kernel Image Compression: uncompressed Data Start: 0x840000e4 Data Size: 16839844 Bytes = 16.1 MiB Architecture: ARM OS: Linux Load Address: 0x80208000 Entry Point: 0x80208000 node name: signature@1 Sign algo: sha256,rsa4096 Sign value: 954d3e7a803e78d8fa7b20a67644d3a5d753a9768039b12e41e29c577278a884df625fe280e475e3afcec98ea3188ebf635068b902091c7e9da3f30366a0c8dc63c793966840037cd88810fd8eea0fe5bddf1b1faafdeb3f9ace2fe5301edf0f87f7e8e1c95791a4e25040c414b30e99941c61bb6f8ad06ffb2d7dc6cd9fdef4467009e4a853a0ec731051cebb65eff0fb89659bc1d6cd16bb19ce0c59d7d1824759129dc48da4c78aca7c3adec8c4b51559aefd4f97fd631ac08ba19a84c5a36c9fcf6c4571b4122549be7725a13d4f3a17b20fcecb9207d123cc4cc07cc79f5f55a599dc6c98fd39d8ef4ef17ee1ba731f400fc91d5eb17865718746e0d365b67a789fb346f718846da98ba58dafb0061b4fd562b5bea179861e88cad326371d69f1993664a0d8fcb5605b8071e270d749afe56dc4675e6b5ee194c60884fe786c515ebc93ff5740b7894240d36a394621b3143f879addcc392f5881afe07a4814a4b52a4522e73b844ea3dfddc52707e3d51ea72f62b127c6cd42526b7f6751036923d305d1514cdebcddefe479c526697e493cb57081e35eb3d6ac974658db771a489b35f51877a8b75f75d521e988a41b3213145ee0cd626929eba5572d09019d573ad35a22195434f3a99d2d2b302a8fc43ac0267f1c47481c5ab38e2793b47f2099cba06a840aa91227400f4e7bb0afcbc7695c807ec2b0c9b50d2f31 Verifying Hash Integrity ... sha256+ OK ## Flattened Device Tree from FIT Image at 84000000 Using 'config@4' configuration Trying 'fdt@4' FDT blob subimage Description: ARM OpenWrt Sophos-APX device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x85024dc8 Data Size: 33944 Bytes = 33.1 KiB Architecture: ARM node name: signature@1 Sign algo: sha256,rsa4096 Sign value: b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f Verifying Hash Integrity ... sha256+ OK Booting using the fdt blob at 0x85024dc8 Loading Kernel Image ... OK OK Loading Device Tree to 87064000, end 8706f497 ... OK eth1 MAC Address from ART is not valid Using machid 0x8010100 from environment 
 Starting kernel ... 
 [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 3.14.43 (bamboo@ip-10-104-116-41) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #3 SMP PREEMPT Wed Mar 23 09:08:31 UTC 2022 [ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] Machine model: Sophos APX120 [ 0.000000] Reserved memory: failed to reserve memory for node 'rsvd1@87000000': base 0x87000000, size 5 MiB [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] PERCPU: Embedded 7 pages/cpu @cfdcb000 s8000 r8192 d12480 u32768 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 62208 [ 0.000000] Kernel command line: mtdparts=spi0.1:0x8000000(rootfs) ubi.mtd=rootfs OLD_IMAGE_BOOTED clk_ignore_unused [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Memory: 231412K/250880K available (3972K kernel code, 309K rwdata, 1064K rodata, 11091K init, 522K bss, 19468K reserved) [ 0.000000] Virtual kernel memory layout: [ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB) [ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB) [ 0.000000] vmalloc : 0xd0800000 - 0xff000000 ( 744 MB) [ 0.000000] lowmem : 0xc0000000 - 0xd0000000 ( 256 MB) [ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB) [ 0.000000] .text : 0xc0208000 - 0xc06f327c (5037 kB) [ 0.000000] .init : 0xc06f4000 - 0xc11c8f40 (11092 kB) [ 0.000000] .data : 0xc11ca000 - 0xc12174a4 ( 310 kB) [ 0.000000] .bss : 0xc12174a4 - 0xc1299d50 ( 523 kB) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] NR_IRQS:16 nr_irqs:16 16 [ 0.000000] Architected cp15 timer(s) running at 48.00MHz (virt). [ 0.000009] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 2863311552512ns [ 0.000018] Switching to timer-based delay loop [ 0.000216] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000) [ 0.000233] pid_max: default: 32768 minimum: 301 [ 0.000489] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000503] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.010705] CPU: Testing write buffer coherency: ok [ 0.011058] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.011131] Setting up static identity map for 0x802132d0 - 0x80213304 [ 0.090581] CPU1: Booted secondary processor [ 0.090624] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001 [ 0.110552] CPU2: Booted secondary processor [ 0.110588] CPU2: thread -1, cpu 2, socket 0, mpidr 80000002 [ 0.130591] CPU3: Booted secondary processor [ 0.130625] CPU3: thread -1, cpu 3, socket 0, mpidr 80000003 [ 0.130761] Brought up 4 CPUs [ 0.130801] SMP: Total of 4 processors activated (384.00 BogoMIPS). [ 0.130809] CPU: All CPU(s) started in SVC mode. [ 0.141018] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 [ 0.141411] pinctrl core: initialized pinctrl subsystem [ 0.141839] regulator-dummy: no parameters [ 0.142512] NET: Registered protocol family 16 [ 0.144053] DMA: preallocated 2048 KiB pool for atomic coherent allocations [ 0.144612] cpuidle: using governor ladder [ 0.144625] cpuidle: using governor menu [ 0.152685] [ 0.152685] Version Rollback Feature Disabled [ 0.155778] i2c-msm-v2 78b7000.i2c: probing driver i2c-msm-v2 [ 0.157198] sps:sps is ready. [ 0.162243] bio: create slab <bio-0> at 0 [ 0.163900] SCSI subsystem initialized [ 0.164270] msm_bus_fabric_init_driver [ 0.164430] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100 [ 0.164448] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100 [ 0.164467] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1 [ 0.164509] msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100 [ 0.164524] msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100 [ 0.164540] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1 [ 0.190584] Bluetooth: Core ver 2.18 [ 0.190656] NET: Registered protocol family 31 [ 0.190668] Bluetooth: HCI device and connection manager initialized [ 0.190687] Bluetooth: HCI socket layer initialized [ 0.190703] Bluetooth: L2CAP socket layer initialized [ 0.190743] Bluetooth: SCO socket layer initialized [ 0.191066] Switched to clocksource arch_sys_counter [ 0.192791] NET: Registered protocol family 2 [ 0.194026] TCP established hash table entries: 2048 (order: 1, 8192 bytes) [ 0.194073] TCP bind hash table entries: 2048 (order: 2, 16384 bytes) [ 0.194122] TCP: Hash tables configured (established 2048 bind 2048) [ 0.194179] TCP: reno registered [ 0.194195] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.194229] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.194583] NET: Registered protocol family 1 [ 10.054220] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 10.061650] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 10.061681] msgmni has been set to 451 [ 10.063978] Key type asymmetric registered [ 10.063993] Asymmetric key parser 'x509' registered [ 10.064027] io scheduler noop registered [ 10.064039] io scheduler deadline registered (default) [ 10.064769] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7 [ 10.064852] tcsr 1953000.ess_tcsr: setting ess interface select = 0 [ 10.064928] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000 [ 10.064986] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222 [ 10.065703] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 10.066610] msm_serial 78af000.serial: msm_serial: detected port #0 [ 10.066663] msm_serial 78af000.serial: uartclk = 1843200 [ 10.066714] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 139, base_baud = 115200) is a MSM [ 10.066776] msm_serial: console setup on port #0 [ 10.624482] console [ttyMSM0] enabled [ 10.629608] msm_serial: driver initialized [ 10.633066] msm_serial_hsl_init: driver initialized [ 10.637168] msm_serial_hs module loaded [ 10.641943] qca_serial_hs module loaded [ 10.664448] tpm_i2c_atmel 0-0029: Issuing TPM_STARTUP [ 10.806264] sps: BAM device 0x07884000 is not registered yet. [ 10.806305] sps:BAM 0x07884000 is registered. [ 10.812073] sps:BAM 0x07884000 (va:0xd0f40000) enabled: ver:0x19, number of pipes:12 [ 10.815561] m25p80 spi0.0: found mx25l1606e, expected n25q128a11 [ 10.823194] m25p80 spi0.0: mx25l1606e (2048 Kbytes) [ 10.829180] 8 ofpart partitions found on MTD device spi0.0 [ 10.833754] Creating 8 MTD partitions on "spi0.0": [ 10.839296] 0x000000000000-0x000000040000 : "0:SBL1" [ 10.845275] 0x000000040000-0x000000060000 : "0:MIBIB" [ 10.850285] 0x000000060000-0x0000000c0000 : "0:QSEE" [ 10.855190] 0x0000000c0000-0x0000000d0000 : "0:CDT" [ 10.860161] 0x0000000d0000-0x0000000e0000 : "0:DDRPARAMS" [ 10.864813] 0x0000000e0000-0x0000000f0000 : "0:APPSBLENV" [ 10.870360] 0x0000000f0000-0x000000170000 : "0:APPSBL" [ 10.875777] 0x000000170000-0x000000180000 : "0:ART" [ 10.881988] HSI/SSI char device loaded [ 10.884512] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) [ 10.891938] libphy: ipq40xx_mdio: probed [ 10.899036] ipq40xx-mdio 90000.mdio: ipq40xx-mdio driver was registered [ 10.899590] i2c /dev entries driver [ 10.907271] Bluetooth: Virtual HCI driver ver 1.4 [ 10.909447] Bluetooth: HCI UART driver ver 2.2 [ 10.914226] Bluetooth: HCI H4 protocol initialized [ 10.918540] Bluetooth: HCI BCSP protocol initialized [ 10.923331] Bluetooth: HCILL protocol initialized [ 10.928437] Bluetooth: HCI Three-wire UART (H5) protocol initialized [ 10.933696] ipq40xx-pinctrl 1000000.pinctrl: invalid group "gpio3" for function "led3" [ 10.939485] ipq40xx-pinctrl 1000000.pinctrl: invalid group "gpio4" for function "led4" [ 10.952952] nand: device found, Manufacturer ID: 0xef, Chip ID: 0xab [ 10.955090] nand: Winbond W25M02GV 256MiB 3.3V(Dual die) [ 10.961618] nand: 256MiB, SLC, page size: 2048, OOB size: 64 [ 10.966905] Scanning device for bad blocks [ 11.685418] random: nonblocking pool is initialized [ 14.880188] 1 cmdlinepart partitions found on MTD device spi0.1 [ 14.880217] Creating 1 MTD partitions on "spi0.1": [ 14.884946] 0x000000000000-0x000008000000 : "rootfs" [ 14.891045] mtd: device 8 (rootfs) set to be root filesystem [ 14.897077] mtdsplit: no squashfs found in "rootfs" [ 14.900538] mtdsplit: no squashfs found in "spi0.1" [ 14.906011] nf_conntrack version 0.5.0 (3615 buckets, 14460 max) [ 14.910750] TCP: cubic registered [ 14.916897] NET: Registered protocol family 10 [ 14.920888] NET: Registered protocol family 17 [ 14.924020] Bridge firewalling registered [ 14.928359] Bluetooth: RFCOMM TTY layer initialized [ 14.932350] Bluetooth: RFCOMM socket layer initialized [ 14.937018] Bluetooth: RFCOMM ver 1.11 [ 14.942230] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 14.945935] Bluetooth: BNEP filters: protocol multicast [ 14.951431] Bluetooth: BNEP socket layer initialized [ 14.956351] Bluetooth: HIDP (Human Interface Emulation) ver 1.2 [ 14.961587] Bluetooth: HIDP socket layer initialized [ 14.967203] 8021q: 802.1Q VLAN Support v1.8 [ 14.972548] Registering SWP/SWPB emulation handler [ 14.977392] regulator-dummy: disabling [ 14.981677] UBI: attaching mtd8 to ubi0 [ 21.645138] UBI: scanning is finished [ 21.645217] UBI error: ubi_read_volume_table: the layout volume was not found [ 21.648269] UBI error: ubi_attach_mtd_dev: failed to attach mtd8, error -22 [ 21.654952] UBI error: ubi_init: cannot attach mtd8 [ 21.665103] clk: Not disabling unused clocks f[ 21.681627] Freeing unused kernel memory: 11088K (c06f4000 - c11c8000) [ 21.692493] init: failed to symlink /tmp -> /var [ 21.692643] init: Console is alive [ 21.696405] init: - watchdog - [ 22.700134] init: - preinit - Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level f [ 25.758109] procd: - early - [ 25.758269] procd: - watchdog - [ 26.362311] procd: - ubus - [ 27.365455] procd: - init - Please press Enter to activate this console. 
 Warning: Bad CRC, using default environment (none) login: Booting. (Version: 11.0.019-2) Checking The AP model f[ 29.850755] UBIFS error (pid 388): ubifs_mount: cannot open "ubi0:config", error -19 [ 29.871503] UBIFS error (pid 396): ubifs_mount: cannot open "ubi0:config", error -19 [ 29.879524] UBIFS error (pid 399): ubifs_mount: cannot open "ubi0:download", error -19 [ 29.899963] UBIFS error (pid 407): ubifs_mount: cannot open "ubi0:download", error -19 
 Password: [ 30.451657] ess-switch DT exist! [ 30.451705] switchreg_base_addr: 0xc000000 [ 30.453950] switchreg_size: 0x80000 [ 30.457856] switch_access_mode: local bus [ 30.461281] wan bmp:0x20 [ 30.465419] ess-psgmii DT exist! [ 30.468016] mac mode=0 [ 30.471243] current mac mode = 0 [ 30.473396] current dts led_source_num is 0 [ 30.476793] mdio DT exist! [ 30.480691] ssdk_plat_init start [ 30.483702] enable ess clk [ 30.597176] reset ok in probe! [ 30.597733] PHY ID is 0x4dd0b2 [ 30.659187] qca probe malibu phy driver succeeded! [ 32.438084] Dakota Chip version 0x1401 [ 32.439475] qca-ssdk module init succeeded! [ 32.443742] ********************************************************** [ 32.444808] * Driver :NSS GMAC Driver for RTL v(3.72a) [ 32.451440] * Version :1.0 [ 32.456868] * Copyright :Copyright (c) 2013-2016 The Linux Foundation. All rights reserved. [ 32.459826] ********************************************************** [ 32.472651] qca-nss-drv.ko is loaded for symbol link [ 32.475795] edma module_init [ 32.480666] EDMA using MAC@ - using 56:1b:53:2b:33:1d [ 32.573959] nss_macsec init success [ 32.576247] PPP generic driver version 2.4.2 [ 32.577298] NET: Registered protocol family 24 [ 38.502112] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Starting network configuration for ethernet interface over DHCP. [ 38.533571] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 38.534279] device eth0 entered promiscuous mode [ 38.552146] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 38.562475] ess_edma c080000.edma: eth0: GMAC Link is up with phy_speed=1000 [ 38.562557] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready [ 38.569044] br-lan: port 1(eth0) entered forwarding state [ 38.574698] br-lan: port 1(eth0) entered forwarding state [ 38.581315] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready Cloud certificate validation pending. dnsserver entries are missing [ 39.231867] br-lan: port 1(eth0) entered disabled state [ 39.233714] device eth0 left promiscuous mode [ 39.235953] br-lan: port 1(eth0) entered disabled state [ 39.241263] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready

JuergenB · Answer

Thanks for the help from Sophos, the APX120 is fine now. 
 After erasing the NAND rootfs partition, i loaded the current APX.uimage with tftpboot. a few reboots later, the APX registered at XG2100 and XG Home and is a up and running now. 
 The UBI Partition was corrupted 
 UBI error: ubi_read_volume_table: the layout volume was not found UBI error: ubi_init: cannot attach mtd2 UBI error: ubi_init: UBI error: cannot initialize UBI, error -22 
 Another way would be to load a new kernel and enter the shell, here I was able to load the current image. with the upgrade script, the NAND was successfully recovered.