Trying to unbrick my APX120

I have exactly the same error

(APX120) # saveenv
Saving Environment to NAND...
Erasing Nand...
Attempt to erase non page aligned data

This is the system initialization prompts (short U26 pin 8)

U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
@machid : 0x8010100
NAND:  SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00
spi_nand: Id could not be mapped
SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:
*** Warning - readenv() failed, using default environment

In:    serial
Out:   serial
Err:   serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot:  0
No such device
nand - NAND sub-system


(APX120) # printenv
baudrate=115200
bootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait
bootcmd=bootipq
bootdelay=2
fdt_high=0x87000000
flash_type=0
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
ipaddr=192.168.1.11
machid=8010100
stderr=serial
stdin=serial
stdout=serial

Bricked version of system initialization:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7210 - auth_hash_seg_exit, Start
B -    577089 - elf_segs_hash_verify_entry, Start
B -    694418 - PBL, End
B -    694442 - SBL1, Start
B -    785453 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    786898 - boot_flash_init, Start
D -     52811 - boot_flash_init, Delta
B -    843849 - boot_config_data_table_init, Start
D -      3838 - boot_config_data_table_init, Delta - (419 Bytes)
B -    851055 - clock_init, Start
D -      7569 - clock_init, Delta
B -    863098 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B -    866511 - sbl1_ddr_set_params, Start
B -    871608 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    875989 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13174 - sbl1_ddr_set_params, Delta
B -    889728 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    959701 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    975303 - Image Load, Start
D -    152200 - QSEE Image Loaded, Delta - (297752 Bytes)
B -   1127929 - Image Load, Start
D -      1444 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1138329 - Image Load, Start
D -    223905 - APPSBL Image Loaded, Delta - (458523 Bytes)
B -   1362631 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1368853 - SBL1, End
D -    676517 - SBL1, Delta
S - Flash Throughput, 2010 KB/s  (758742 Bytes,  377357 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
@machid : 0x8010100
NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
258 MiB
MMC:
In:    serial
Out:   serial
Err:   serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot:  0
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000010000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI error: ubi_read_volume_table: the layout volume was not found
UBI error: ubi_init: cannot attach mtd2
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
UBI init error 22
Error, no UBI device/partition selected!
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000010000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI error: ubi_read_volume_table: the layout volume was not found
UBI error: ubi_init: cannot attach mtd2
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
UBI init error 22
Error, no UBI device/partition selected!
Wrong Image Format for bootm command
ERROR: can't get kernel image!
resetting ...

You need to retry to break autoboot.
sometimes you need a few attemps.

i prefer to read the nor with in circuit flash.

if you can save the environment you must rebuild all env vars before loading the image file.

I second this. I had to retry it again a few times until I was able to save the environment variables. 

Tried four times, and finally!

But I got this:

Starting kernel ...

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
f
- failsafe -
/etc/preinit: line 1: telnetd: not found
(none) login: Please reboot system when done with failsafe network logins

and then

Starting kernel ...

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
fPlease press Enter to activate this console.

Warning: Bad CRC, using default environment
(none) login: Booting. (Version: 11.0.021-1)
Checking The AP model
Starting network configuration for ethernet interface over DHCP.
Cloud certificate validation pending.
dnsserver entries are missing
[

This model (APX120) really needs more QA!

Tried four times, and finally!

But I got this:

Starting kernel ...

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
f
- failsafe -
/etc/preinit: line 1: telnetd: not found
(none) login: Please reboot system when done with failsafe network logins

and then

Starting kernel ...

Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
fPlease press Enter to activate this console.

Warning: Bad CRC, using default environment
(none) login: Booting. (Version: 11.0.021-1)
Checking The AP model
Starting network configuration for ethernet interface over DHCP.
Cloud certificate validation pending.
dnsserver entries are missing
[

This model (APX120) really needs more QA!

There is no failsafe in the new firmware images.

you need to enter uboot cli and erase the flash, load an old kernel with tftp. Boot into failsafe and update with shell script.

Could you share a link to an old kernel image? I got the image from my XG firewall and it seems to be the latest version.

Thanks!

Use this image https://d2apih4urmzzdu.cloudfront.net/v2.1.1-1/APX.uimage

TFTP boot with this in Uboot, then when it shows the failsafe prompt keep pressing enter until you get root.

Thanks!

Finally get into root.

Hi,

i got two more APX120 with a red LED bug.

tried a few other methods, this one works fine 

1. get into uboot emergency console, change bootdelay, save, reboot
2. enter uboot console, set all env variables, save, reboot, enter uboot
3. erase nand chip, tftpboot old APX.v11.0.019-2.uimage, connect APX120 to a XG 19.5.3
4. boot from memory, APX120 will boot and register with XG 19.5.3, enable APX and wait for final F/W upgrade to 11.0.021-1

No need to get root access

But with 11.0.019-2 i had a root access without any failsafe method.

Hello Juergen, 

Can you tell me where you find APX.v11.0.019-2.uimage? Or if you have it, can you provide link to download?

Hi Juergen,

Managed to find the Image (inside the Pattern Update tar). I could link the APX with the Firewall but after reboot I get an error - Volume kernel not found! and I'm back on the uboot console.

Do you have any suggestion?

Hello Juergen,

Can you post all the env variables that need to be set? I think I made some mistake there...

Hi,

this is the fw_printenv from OpenWRT (root shell from APX120).

setenv BASEMAC 7C:5A:1C:XX:XX:XX
setenv SID P3200XXXXXXXXXX
setenv baudrate 115200
setenv bootargs mtdparts=spi0.1:0x8000000(rootfs) ubi.mtd=rootfs loglevel=1
setenv bootcmd apx_check_reset_button\;run ubiboot\;run ubiboot_backup\;reset
setenv bootdelay 10
setenv ethact eth0
setenv flash_type 0
setenv ipaddr192.168.1.1
setenv machid 8010100
setenv mtddevname rootfs
setenv mtddevnum 0
setenv mtdids nand1=nand1
setenv mtdparts mtdparts=nand1:0x10000000(rootfs)
setenv partition nand1,0
setenv radio0_select_5g 0
setenv serverip 192.168.1.254
setenv stderr serial
setenv stdin serial
setenv stdout serial
setenv store_crashdump setenv crashdump_fix 1
setenv ubiboot ubi part rootfs\;ubi read 0x84000000 image\;bootm 0x84000000#config@4
setenv ubiboot_backup ubi part rootfs\;ubi read 0x84000000 image_backup\;setenv bootargs mtdparts spi0.1:0x8000000(rootfs) ubi.mtd rootfs OLD_IMAGE_BOOTED\;bootm 0x84000000#config@4
setenv wipe_config ubi part rootfs\;ubi remove config\;ubi remove dyn_cfg\;ubi remove dyn_cfg_backup

Thanks!! Managed to fix one APX, now lets try with the second one!