This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Trying to unbrick my APX120

I am using the instructions to unbrick my APX120 from this post, but I have run into issues below:

community.sophos.com/.../unbrick-apx120-break-bootdelay-0-recover-apx120

I can't seem to save the environment variables. When I run the "saveenv"

It says:

Saving Environment to NAND...
Erasing Nand...
Attempt to erase non page aligned data



This thread was automatically locked due to age.
Parents
  • I came across a few APX120 that had a faulty NAND chip, so maybe your APX has faulty one.
    Power cycle your APX and post the uboot log.

    You need to short SO/SIO1 for a fraction of a second in the right moment, the nand will not be available now.
    Try to set the bootdelay to 5s, power cycle the APX and enter uBoot.

  • Hello Juergen, I followed your method to break the boot loop and shorted S0/SI01. Then I could press any button to stopautoboot. At first time I wanted to ping my TFTP Server and had a hang. Second time and now every time I short the nand it hangs at "Net:" what to do now?

    *** Warning - readenv() failed, using default environment

    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Net:

  • Hi,

    Glitching U-Boot (or Other Bootloaders) by Shorting the NAND Flash is tricky and needs exact timing.
    Sometimes you need a good USB-RS232 Adapter.

    So, try a few times.

  • Please read my comment at the end of this topic about the autoboot loop

  • Yes, I need several tries to get the "hit any key to stop autoboot" message. No problem so far.

    it starts to load the default environment and stops loading at "Net" where normally should appear the MAC.

    It worked when I tried the first times but now I have a hang at "Net..." EVERY time. It is frustrating...

    I am using the DSD TECH SH-U09C5 Adapter set on 3.3V. Should not be the problem. As + wire is not connected, that should not play any role. I am using a power supply to power the AP. I already tried with Ethernet Cable connected and disconnected.

    Please read my comment at the end of this topic about the autoboot loop

    I saw your comment thanks. Unfortunately it hangs and wont get to that point where I can enter commands.

  • If you don´t glitch the NAND, where does the log stop/end?

Reply Children
  • If not glitched, it makes its known loop until "ERROR: can't get kernel image! resetting ..."  NAND is beeing initialized without problems..

    I am not at home a this moment. I will collect the detailed console output and post it here.

  • If glichting is not working, use a Pomona SOP8 IC Clip and read the flash with a very low voltage (2.6 - 2.7V) and slow timings.
    This will prevent the cpu from starting.

    Read the flash and change the bootdelay, this will give a uboot env. error, but easier than glitching,

  • Thank you for this advise. I think an IC Clip wont be enough? Will I also need an CH341A Adapter and Software AsProgrammer/NeoProgrammer? Is there a good guide how to edit NAND data using this stuff?

    This is shown when glitching NAND. It stucks at "NEt" and does not continue..

    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1692 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7570 - clock_init, Delta
    B -    862907 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866320 - sbl1_ddr_set_params, Start
    B -    871418 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875800 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889539 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959524 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975143 - Image Load, Start
    D -    152329 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127901 - Image Load, Start
    D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138320 - Image Load, Start
    D -    224145 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362862 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369081 - SBL1, End
    D -    676942 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758830 Bytes,  377719 us)
    S - DDR Frequency, 537 MHz
    
    
    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Jul 07 2022 - 07:50:46)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00
    spi_nand: Id could not be mapped
    SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00
    ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
    0 MiB
    MMC:
    *** Warning - readenv() failed, using default environment
    
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Net:
    

    This is boot loop without glitching

    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000010
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1691 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52832 - boot_flash_init, Delta
    B -    843666 - boot_config_data_table_init, Start
    D -      3836 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850871 - clock_init, Start
    D -      7583 - clock_init, Delta
    B -    862927 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866340 - sbl1_ddr_set_params, Start
    B -    871437 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875819 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13175 - sbl1_ddr_set_params, Delta
    B -    889557 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959577 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975399 - Image Load, Start
    D -    152231 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1128056 - Image Load, Start
    D -      1445 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138461 - Image Load, Start
    D -    224122 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362980 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369212 - SBL1, End
    D -    676967 - SBL1, Delta
    S - Flash Throughput, 2009 KB/s  (758830 Bytes,  377601 us)
    S - DDR Frequency, 537 MHz
    
    
    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Jul 07 2022 - 07:50:46)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    UBI: attached mtd2 to ubi0
    UBI: MTD device name:            "mtd=0"
    UBI: MTD device size:            256 MiB
    UBI: number of good PEBs:        2048
    UBI: number of bad PEBs:         0
    UBI: max. allowed volumes:       128
    UBI: wear-leveling threshold:    4096
    UBI: number of internal volumes: 1
    UBI: number of user volumes:     0
    UBI: available PEBs:             2024
    UBI: total number of reserved PEBs: 24
    UBI: number of PEBs reserved for bad PEB handling: 20
    UBI: max/mean erase counter: 2/1
    Volume image not found!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    UBI: mtd2 is detached from ubi0
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1692 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7585 - clock_init, Delta
    B -    862922 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866335 - sbl1_ddr_set_params, Start
    B -    871432 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875815 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889553 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959515 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975134 - Image Load, Start
    D -    152327 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127888 - Image Load, Start
    D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138305 - Image Load, Start
    B -   1139475 - Boot error ocuured!. Error code: 3039
    
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1692 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7587 - clock_init, Delta
    B -    862924 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866337 - sbl1_ddr_set_params, Start
    B -    871434 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875817 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889555 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959578 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975197 - Image Load, Start
    D -    152329 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127952 - Image Load, Start
    D -      1447 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138372 - Image Load, Start
    D -    224133 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362903 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369124 - SBL1, End
    D -    676985 - SBL1, Delta
    S - Flash Throughput, 2009 KB/s  (758830 Bytes,  377705 us)
    S - DDR Frequency, 537 MHz
    
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1691 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7570 - clock_init, Delta
    B -    862906 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866320 - sbl1_ddr_set_params, Start
    B -    871417 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875799 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889539 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959464 - sbl1_wait_for_ddr_training, Start
    D -        28 - sbl1_wait_for_ddr_training, Delta
    B -    975083 - Image Load, Start
    D -    152336 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127847 - Image Load, Start
    D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138265 - Image Load, Start
    D -    224157 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362821 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369045 - SBL1, End
    D -    676800 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758830 Bytes,  377735 us)
    S - DDR Frequency, 537 MHz
    
    
    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Jul 07 2022 - 07:50:46)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    UBI error: ubi_read_volume_table: the layout volume was not found
    UBI error: ubi_init: cannot attach mtd2
    UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
    UBI init error 22
    Error, no UBI device/partition selected!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1692 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7585 - clock_init, Delta
    B -    862921 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866335 - sbl1_ddr_set_params, Start
    B -    871432 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875815 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889554 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959552 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975172 - Image Load, Start
    D -    152340 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127940 - Image Load, Start
    D -      1447 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138358 - Image Load, Start
    D -    224151 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362907 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369119 - SBL1, End
    D -    676982 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758830 Bytes,  377729 us)
    S - DDR Frequency, 537 MHz
    
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000000
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1692 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52830 - boot_flash_init, Delta
    B -    843664 - boot_config_data_table_init, Start
    D -      3831 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850863 - clock_init, Start
    D -      7585 - clock_init, Delta
    B -    862922 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866334 - sbl1_ddr_set_params, Start
    B -    871431 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875813 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13175 - sbl1_ddr_set_params, Delta
    B -    889551 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959493 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975095 - Image Load, Start
    D -    152204 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1127725 - Image Load, Start
    D -      1442 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138134 - Image Load, Start
    D -    223918 - APPSBL Image Loaded, Delta - (458611 Bytes)
    B -   1362448 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1368672 - SBL1, End
    D -    676426 - SBL1, Delta
    S - Flash Throughput, 2010 KB/s  (758830 Bytes,  377367 us)
    S - DDR Frequency, 537 MHz
    
    
    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Jul 07 2022 - 07:50:46)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    UBI: attached mtd2 to ubi0
    UBI: MTD device name:            "mtd=0"
    UBI: MTD device size:            256 MiB
    UBI: number of good PEBs:        2048
    UBI: number of bad PEBs:         0
    UBI: max. allowed volumes:       128
    UBI: wear-leveling threshold:    4096
    UBI: number of internal volumes: 1
    UBI: number of user volumes:     0
    UBI: available PEBs:             2024
    UBI: total number of reserved PEBs: 24
    UBI: number of PEBs reserved for bad PEB handling: 20
    UBI: max/mean erase counter: 2/1
    Volume image not found!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    UBI: mtd2 is detached from ubi0
    Creating 1 MTD partitions on "nand1":
    0x000000000000-0x000010000000 : "mtd=0"
    UBI: attaching mtd2 to ubi0
    UBI: physical eraseblock size:   131072 bytes (128 KiB)
    UBI: logical eraseblock size:    126976 bytes
    UBI: smallest flash I/O unit:    2048
    UBI: VID header offset:          2048 (aligned 2048)
    UBI: data offset:                4096
    UBI: attached mtd2 to ubi0
    UBI: MTD device name:            "mtd=0"
    UBI: MTD device size:            256 MiB
    UBI: number of good PEBs:        2048
    UBI: number of bad PEBs:         0
    UBI: max. allowed volumes:       128
    UBI: wear-leveling threshold:    4096
    UBI: number of internal volumes: 1
    UBI: number of user volumes:     0
    UBI: available PEBs:             2024
    UBI: total number of reserved PEBs: 24
    UBI: number of PEBs reserved for bad PEB handling: 20
    UBI: max/mean erase counter: 2/1
    Volume image_backup not found!
    Wrong Image Format for bootm command
    ERROR: can't get kernel image!
    resetting ...

  • You need a good programmer, that can read at low voltages and slow speed.
    One you read the chip you can edit the content and change the bootdelay.

    But the environment variables are no longer correct and must be reset.

  • Can you post all the env variables that need to be set? My APX120 would not connect to Sophos Cloud

  • Do you know programmer hardware you can recommend?

  • is use a REVELPROG-IS with a Pomona 5250 Clip

  • env var´s can be found in this thread

  • Hi Juergen. Just found time again to give it a try to read the NAND. I have bought the Revelprog-IS programmer and installed drivers and software. Unfortuantely there is no Config for WINBOND W25M02GV chip. Which config did you use to read the NAND?

  • Ji Donnie,

    you only need to read the NOR Chip (MX25L1605D).
    This one holds the uBoot, you change the bootdelay and write it back.

    uBoot will exit to an emergency cli and you need to set all env variables new.

    And if you are in uboot you can read erase the NAND, load from tftpboot and boot the APX120.

    There is an option to boot from tftp, enter the failsafe OpenWrt and load a new image by wget and write NAND with OpenWrt