I am using the instructions to unbrick my APX120 from this post, but I have run into issues below:
community.sophos.com/.../unbrick-apx120-break-bootdelay-0-recover-apx120
I can't seem to save the environment variables. When I run the "saveenv"
It says:
Saving Environment to NAND... Erasing Nand... Attempt to erase non page aligned data
Hello AaronB ,
Thank you for reaching out to the community, you can not Unbrick APX 120 access point, the only bricked access points you can recover are as following:
Ref: Recover bricked access points using the Sophos Flashing Tool.
I'd suggest log a Create a Technical support case and get the appliance *replaced (RMAed).
*Note: Advance hardware replacement is provided for SD-RED and APX Series Access Points which are managed by XG and XGS Series firewall appliances, if (i) the master firewall appliance is covered by the Enhanced Plus support plan AND (ii) the SD-RED/ APX Series Access Point is not older than 5 years.
REF: Enhanced
Thanks & Regards,
_______________________________________________________________
Vivek Jagad | Team Lead, Technical Support, Global Customer Experience
Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
I came across a few APX120 that had a faulty NAND chip, so maybe your APX has faulty one.
Power cycle your APX and post the uboot log.
You need to short SO/SIO1 for a fraction of a second in the right moment, the nand will not be available now.
Try to set the bootdelay to 5s, power cycle the APX and enter uBoot.
I tried the shorting trick to break uboot again and this time it was able to recognize the nand and save environment variables. But now I am running into a new issue, the APX120 is boot looping after tftpboot, see below. I am TFTP booting the latest APX.uimage (version: 11.0.021-1) from my firewall. When I try to enter failsafe it asks for a login and I can't seem to get root.
U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
@machid : 0x8010100
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
258 MiB
MMC:
In: serial
Out: serial
Err: serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot: 0
Net: MAC0 addr:94:87:c6:be:90:98
PHY ID1: 0x4d
PHY ID2: 0xd0b2
ipq40xx_ess_sw_init done
eth0
(APX120) # nand erase.chip
NAND erase.chip: device 1 whole chip
Erasing at 0xffe0000 -- 100% complete.
OK
(APX120) # tftpboot APX.uimage
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :1000 Full duplex
Using eth0 device
TFTP from server 192.168.1.8; our IP address is 192.168.1.11
Filename 'APX.uimage'.
Load address: 0x84000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###
done
Bytes transferred = 17219613 (106c01d hex)
(APX120) # bootm 0x84000000#config@4
## Booting kernel from FIT Image at 84000000 ...
Using 'config@4' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-3.14.43
Type: Kernel Image
Compression: uncompressed
Data Start: 0x840000e4
Data Size: 16970916 Bytes = 16.2 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: 26de17c082ec7f77a07a4af939b59285f85153f884ef1285e066b8f6b3f8d276c69fbb606123700c1c93b3f628d561ea0d0d02e36814e280aa0db36012a40fb9210b56b9b48b7c6e396b7c54df6b46eb980cb95c7c1d9da59364c152da4f2643e954c8b44df8f50a09958b2c21612724f1d14751c6ae57d46ba913003cf0949de9a2235e80e767546f5568088ae4a65dd4e1acdb4d5f64f29c973bb971ebb2eeaeaa8c553c60dd57b15e64dcf7f0c3a5e170737a5ed074d7b9f44ff475e307634d066939f6fbd932cc72454e443ba79f9232ea37fe50ab8b1d2b152d5833056a1e5cd79aa0000edaad6345d0d9aec7fbad36f6026bfd944b0ae6ed3390dd98460e521739ff6ae0df58190c2fd73fb63a505951218b8922169ba2bd32d1af3c04fbfa8535ee098b0c4d52cf9c6c2e6b43e9796b7dcd4a64d1378126f9bd26393e846ace0aa9c630ca4df7b96807f814a08d352eb2d7d849b3a1bf0c1eb4ba42238f68728b6e9d1a81ecbdf94f90ff5d4097a44aa414e1247b1393a5d6886044d6d3b311d9cbd6f88324d820c5e4dd8fb43c5832f9d21679a5524bcae02eeec14291a6eb290dc41278754a4e3df6de45162b2bf68fe22301aff4ade69d2989855ca1e498aafcbaf1037ebc1bdd2b241f0aace9514e98a8e63d559b8931ac8ecd7b4872f589b3354bea28dcaacf1d76ab05d0ad23be3da0286e9f3ce277ca07a83e
Verifying Hash Integrity ... sha256+ OK
## Flattened Device Tree from FIT Image at 84000000
Using 'config@4' configuration
Trying 'fdt@4' FDT blob subimage
Description: ARM OpenWrt Sophos-APX device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x85044dc8
Data Size: 33944 Bytes = 33.1 KiB
Architecture: ARM
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x85044dc8
Loading Kernel Image ... OK
OK
Loading Device Tree to 86ff4000, end 86fff497 ... OK
eth1 MAC Address from ART is not valid
Using machid 0x8010100 from environment
Starting kernel ...
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Please press Enter to activate this console.
Booting. (Version: 11.0.021-1)
Checking The AP model
Starting network configuration for ethernet interface over DHCP.
Cloud certificate validation pending.
dnsserver entries are missing
[
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 1678 - bootable_media_detect_success, Start
B - 1691 - elf_loader_entry, Start
B - 5068 - auth_hash_seg_entry, Start
B - 7209 - auth_hash_seg_exit, Start
B - 577087 - elf_segs_hash_verify_entry, Start
B - 694221 - PBL, End
B - 694245 - SBL1, Start
B - 785250 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 786695 - boot_flash_init, Start
D - 52832 - boot_flash_init, Delta
B - 843666 - boot_config_data_table_init, Start
D - 3836 - boot_config_data_table_init, Delta - (419 Bytes)
B - 850871 - clock_init, Start
D - 7563 - clock_init, Delta
B - 862908 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B - 866322 - sbl1_ddr_set_params, Start
B - 871420 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 875802 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13176 - sbl1_ddr_set_params, Delta
B - 889541 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 959696 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 975317 - Image Load, Start
D - 152332 - QSEE Image Loaded, Delta - (297752 Bytes)
B - 1128077 - Image Load, Start
D - 1447 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1138488 - Image Load, Start
D - 224121 - APPSBL Image Loaded, Delta - (458523 Bytes)
B - 1363008 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 1369207 - SBL1, End
D - 677070 - SBL1, Delta
S - Flash Throughput, 2008 KB/s (758742 Bytes, 377699 us)
S - DDR Frequency, 537 MHz
I tried firmware 2.3.2-1 and I couldn't get root:
U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
@machid : 0x8010100
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
258 MiB
MMC:
In: serial
Out: serial
Err: serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot: 0
incorrect device type in rootfs
Partition rootfs not found!
Error, no UBI device/partition selected!
## Booting kernel from FIT Image at 84000000 ...
Using 'config@4' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-3.14.43
Type: Kernel Image
Compression: uncompressed
Data Start: 0x840000e4
Data Size: 16758376 Bytes = 16 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: 8e547cdf4044e04a991f68130d577ccca52a04daf21c1b96283aef1940b71c896e19657ad7fbca311b684949c5b2c93528668093908ac50072df5dfcd93e913bb436ed04300bc3966967ac6c90a28e13a4a1acb784929df0e8964d4fe7b0b5c3152af9efd0becd009ae72f50711b032179f53babf152fae39edf723dd8f97455e0ccdc4eb4ae182237fd1204a057e9a0ee8cfef8faac46d12882e226e45e46830a51968c39252eebfebc895407fe5ebceeaf2ee476bf80b2e1689c9174fa5b81a13188519bc7cfd3fa25e80c872ddfe6e31176df17992e945a2a174750c77231718c1c6f7d5aa3cba653de90fbcf7d41870a3610ebd06b883c8af479967da56e2e5aa7642665276557e8efb6b219f094e12a8feb78bd63ce9d51c95e77176318890292e05c9a7d542e20a92af62ff8bcd15ebea62f60bfad16378c833ea477b827351d45c59734c7f4feb113c9c021275c7c822ac1794eae2f982e670b1041a4fc6d8e24d4cbe039d5f538f740f92b39389c5d12057c2e900926173f552fb96a27735276ee65f3ba46099fc13645460a0cdf1720e84a45051c27affd6a221ae629b40713fb42478afdf29c0be628d826ce232436bcc9e30cd35e333acdd886ca45631cebb6e3d80e86be9b272cb361513c061ee4b01d9b3abd5b6936a87b9a3972fdb7a341236e3dd28fd424215590503f50ef9215a7513da007cb7c4b8ec2c7
Verifying Hash Integrity ... sha256+ OK
## Flattened Device Tree from FIT Image at 84000000
Using 'config@4' configuration
Trying 'fdt@4' FDT blob subimage
Description: ARM OpenWrt Sophos-APX device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x850112f8
Data Size: 34822 Bytes = 34 KiB
Architecture: ARM
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: 32c96aa3ece37ac9e39bf7f1b55b31ab4df7ca0a052b8ff2b3baa1a8de2fe1922c457e66e562016d30e08584974637ce4f6784371e921e45df2b81b02f2b5c7867fef603da83b3d02b6ce35cc99c66e0af16782f3adfd5f0c8bd264c11e77c5617049c4b2ce04225342cbad675c79ebac491fb14bc3d58f791c635ebd4031ea584192b16e46864167f47d2304d13b031ca2e75ab5b208aab0b6ce4da15481780db22b9b5a61eb7bbbf291514801982ecf6ca0a1d420dcfc57afa49d8db9f6f8185acf30a100bb7e187fb8a9f39f7b244afe8c9c0da1bf039713aa6d209d130454ca0e7f1ca3007f07417243c6c40092fa79af64c8347641eba5e615ab6c1558299ec25ed36c5a301536bbbf0393baf455c6fb45cc56e855e65fc768228499975cd38a32d2dd2f05eaad1a2fca6dd0333e99265d755d29b311991e8bb26cfb0ff1368eb609c69d6c29f9d82e245fc26d68015a792d3d68451d3732830aa6782d6f376496012f63eec4795c3bfba1a955606fd1c3512cefa499d08bd8f7468946fa448f1005dd3b58eba84d5455b5e9ced317fcb7a5ca2bccbfbe43bd139dfad3f37e8fa8ffdacc49fc105790e100e57b73f3fc87744b07499bfd25d01f84f78de04c8848fc7953625b00bbf946a76f09b4452727d546020eb35fbe6f13afd698c10e479ab3627214ae0c4ba2b07a03b9feb599ada31dc8d112aaf9d125fa41109
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x850112f8
Loading Kernel Image ... OK
OK
Loading Device Tree to 86ff4000, end 86fff805 ... OK
eth1 MAC Address from ART is not valid
Using machid 0x8010100 from environment
Starting kernel ...
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
f
- failsafe -
/etc/preinit: line 1: telnetd: not found
(none) login: Please reboot system when done with failsafe network logins
I tried 11.0.021-1 and when I press enter to activate console it asks for the login and I enter root as username and fail the authentication 3 times, then I get root but the device restarts after a few seconds.
U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
@machid : 0x8010100
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
258 MiB
MMC:
In: serial
Out: serial
Err: serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot: 0
incorrect device type in rootfs
Partition rootfs not found!
Error, no UBI device/partition selected!
## Booting kernel from FIT Image at 84000000 ...
Using 'config@4' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-3.14.43
Type: Kernel Image
Compression: uncompressed
Data Start: 0x840000e4
Data Size: 16970916 Bytes = 16.2 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: 26de17c082ec7f77a07a4af939b59285f85153f884ef1285e066b8f6b3f8d276c69fbb606123700c1c93b3f628d561ea0d0d02e36814e280aa0db36012a40fb9210b56b9b48b7c6e396b7c54df6b46eb980cb95c7c1d9da59364c152da4f2643e954c8b44df8f50a09958b2c21612724f1d14751c6ae57d46ba913003cf0949de9a2235e80e767546f5568088ae4a65dd4e1acdb4d5f64f29c973bb971ebb2eeaeaa8c553c60dd57b15e64dcf7f0c3a5e170737a5ed074d7b9f44ff475e307634d066939f6fbd932cc72454e443ba79f9232ea37fe50ab8b1d2b152d5833056a1e5cd79aa0000edaad6345d0d9aec7fbad36f6026bfd944b0ae6ed3390dd98460e521739ff6ae0df58190c2fd73fb63a505951218b8922169ba2bd32d1af3c04fbfa8535ee098b0c4d52cf9c6c2e6b43e9796b7dcd4a64d1378126f9bd26393e846ace0aa9c630ca4df7b96807f814a08d352eb2d7d849b3a1bf0c1eb4ba42238f68728b6e9d1a81ecbdf94f90ff5d4097a44aa414e1247b1393a5d6886044d6d3b311d9cbd6f88324d820c5e4dd8fb43c5832f9d21679a5524bcae02eeec14291a6eb290dc41278754a4e3df6de45162b2bf68fe22301aff4ade69d2989855ca1e498aafcbaf1037ebc1bdd2b241f0aace9514e98a8e63d559b8931ac8ecd7b4872f589b3354bea28dcaacf1d76ab05d0ad23be3da0286e9f3ce277ca07a83e
Verifying Hash Integrity ... sha256+ OK
## Flattened Device Tree from FIT Image at 84000000
Using 'config@4' configuration
Trying 'fdt@4' FDT blob subimage
Description: ARM OpenWrt Sophos-APX device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x85044dc8
Data Size: 33944 Bytes = 33.1 KiB
Architecture: ARM
node name: signature@1
Sign algo: sha256,rsa4096
Sign value: b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x85044dc8
Loading Kernel Image ... OK
OK
Loading Device Tree to 86ff4000, end 86fff497 ... OK
eth1 MAC Address from ART is not valid
Using machid 0x8010100 from environment
Starting kernel ...
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Please press Enter to activate this console.
Warning: Bad CRC, using default environment
(none) login: root
Password:
Login incorrect
(none) login: root
Password:
Login incorrect
(none) login: root
Password:
Booting. (Version: 11.0.021-1)
Checking The AP model
Login incorrect
Mar 30 10:46:57 login[128]: invalid password for 'root' on 'consPlease press Enter to activate this console.
BusyBox v1.23.2 (2023-03-30 10:36:59 UTC) built-in shell (ash)
FIRMWARE_VERSION: 11.0.021-1
root@(none):/#
root@(none):/# ls
bin download lib proc sbin usr
config etc mnt rom sys var
dev init overlay root tmp www
root@(none):/# cd bin
root@OpenWrt:/bin# ls
add_mesh_iface.sh false ps
add_radio_mapping.sh fgrep pwd
add_ssh_pubkey.sh fsync remove_dcs_schedule.sh
add_time_base_scan.sh grep remove_wifi_ifaces.sh
add_wifi_iface.sh gunzip rm
ap_caps.sh gzip rmdir
apx_packet_capture.sh ipcalc.sh scan_mesh.sh
ash iptables.sh sed
base64 kill sh
board_detect ln sleep
busybox lock sophos_login
cat login start_dropbear.sh
chgrp login.sh stat
chmod ls sync
chown mkdir tar
config_generate mknod touch
cp mktemp true
create_vxlan_tunnel.sh mod_wifi_iface.sh ubus
date mount umount
dcs_schedule.sh mv uname
dd netmsg update_config.sh
df netstat update_image.sh
dmesg nice vi
echo pidof zcat
egrep ping
enable_remote_logging.sh ping6
root@OpenWrt:/bin# [
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 1678 - bootable_media_detect_success, Start
B - 1691 - elf_loader_entry, Start
B - 5068 - auth_hash_seg_entry, Start
B - 7209 - auth_hash_seg_exit, Start
B - 577087 - elf_segs_hash_verify_entry, Start
B - 694221 - PBL, End
B - 694245 - SBL1, Start
B - 785250 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 786695 - boot_flash_init, Start
D - 52832 - boot_flash_init, Delta
B - 843666 - boot_config_data_table_init, Start
D - 3836 - boot_config_data_table_init, Delta - (419 Bytes)
B - 850871 - clock_init, Start
D - 7566 - clock_init, Delta
B - 862910 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B - 866324 - sbl1_ddr_set_params, Start
B - 871421 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 875804 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13176 - sbl1_ddr_set_params, Delta
B - 889543 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 959626 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 975245 - Image Load, Start
D - 152334 - QSEE Image Loaded, Delta - (297752 Bytes)
B - 1128005 - Image Load, Start
D - 1446 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1138416 - Image Load, Start
D - 224120 - APPSBL Image Loaded, Delta - (458523 Bytes)
B - 1362935 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 1369157 - SBL1, End
D - 677020 - SBL1, Delta
S - Flash Throughput, 2008 KB/s (758742 Bytes, 377700 us)
S - DDR Frequency, 537 MHz
Hi,
try with fw image APX.v2.1.1-1.uimage, reboot and enter failsafe.
From here use the official release and update procedure.
(APX120) # nand erase.chip (APX120) # tftpboot APX.v2.1.1-1.uimage (APX120) # bootm 0x84000000#config@4 Starting kernel ... Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level Please press Enter to activate this console. Booting. (Version: v2.1.1-1) Checking The AP model Starting network configuration for ethernet interface over DHCP. dnsserver entries are missing Cloud certificate validation pending. UTM certificate validation pending. dnsserver entries are missing .. .. # press enter ... BusyBox v1.23.2 (2018-11-27 07:01:45 UTC) built-in shell (ash) FIRMWARE_VERSION: v2.1.1-1 root@OpenWrt:/# cd bin root@OpenWrt:/bin# https://d2apih4urmzzdu.cloudfront.net/v2.3.2-1/APX.uimage root@OpenWrt:/bin# update_image.sh APX.uimage # wait a few minutes ...
Thank you with firmware v2.1.1-1 I was able get root access and update the image to 11.0.021-1 and also 2.3.2-1 , but both reboot. I'm not sure if its normal.
Starting kernel ... Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level Please press Enter to activate this console. Booting. (Version: 11.0.021-1) Checking The AP model Starting network configuration for ethernet interface over DHCP. Cloud certificate validation pending. dnsserver entries are missing Ethernet autoconfiguration (bound): IP:192.168.2.100/24, gateway:192.168.2.1, nameservers:192.168.2.1 Ethernet link state changed to: up, Speed: 1000, Duplex: full No Direct-Attach chipsets found. qcawifi disable radio wifi0 qcawifi disable radio wifi1 qcawifi disable radio wifi0 qcawifi disable radio wifi1 qcawifi disable radio wifi0 qcawifi disable radio wifi1 qcawifi disable radio wifi0 qcawifi disable radio wifi1 [cloudclient] Last AP reboot was triggered by: power reset. Ethernet link state changed to: down
I have exactly the same error
(APX120) # saveenv Saving Environment to NAND... Erasing Nand... Attempt to erase non page aligned data
This is the system initialization prompts (short U26 pin 8)
U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09) smem ram ptable found: ver: 1 len: 3 DRAM: 256 MiB @machid : 0x8010100 NAND: SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00 spi_nand: Id could not be mapped SF NAND unsupported id:0:0:0:0SF NAND unsupported id:0:0:0:0SF: Unsupported manufacturer 00 ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0) 0 MiB MMC: *** Warning - readenv() failed, using default environment In: serial Out: serial Err: serial machid: 8010100 flash_type: 0 Hit any key to stop autoboot: 0 No such device nand - NAND sub-system (APX120) # printenv baudrate=115200 bootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait bootcmd=bootipq bootdelay=2 fdt_high=0x87000000 flash_type=0 fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs ipaddr=192.168.1.11 machid=8010100 stderr=serial stdin=serial stdout=serial
Bricked version of system initialization:
Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120 S - IMAGE_VARIANT_STRING=DAABANAZA S - OEM_IMAGE_VERSION_STRING=CRM S - Boot Config, 0x00000021 S - Reset status Config, 0x00000010 S - Core 0 Frequency, 0 MHz B - 261 - PBL, Start B - 1338 - bootable_media_detect_entry, Start B - 1678 - bootable_media_detect_success, Start B - 1692 - elf_loader_entry, Start B - 5068 - auth_hash_seg_entry, Start B - 7210 - auth_hash_seg_exit, Start B - 577089 - elf_segs_hash_verify_entry, Start B - 694418 - PBL, End B - 694442 - SBL1, Start B - 785453 - pm_device_init, Start D - 7 - pm_device_init, Delta B - 786898 - boot_flash_init, Start D - 52811 - boot_flash_init, Delta B - 843849 - boot_config_data_table_init, Start D - 3838 - boot_config_data_table_init, Delta - (419 Bytes) B - 851055 - clock_init, Start D - 7569 - clock_init, Delta B - 863098 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0 B - 866511 - sbl1_ddr_set_params, Start B - 871608 - cpr_init, Start D - 2 - cpr_init, Delta B - 875989 - Pre_DDR_clock_init, Start D - 4 - Pre_DDR_clock_init, Delta D - 13174 - sbl1_ddr_set_params, Delta B - 889728 - pm_driver_init, Start D - 2 - pm_driver_init, Delta B - 959701 - sbl1_wait_for_ddr_training, Start D - 27 - sbl1_wait_for_ddr_training, Delta B - 975303 - Image Load, Start D - 152200 - QSEE Image Loaded, Delta - (297752 Bytes) B - 1127929 - Image Load, Start D - 1444 - SEC Image Loaded, Delta - (2048 Bytes) B - 1138329 - Image Load, Start D - 223905 - APPSBL Image Loaded, Delta - (458523 Bytes) B - 1362631 - QSEE Execution, Start D - 60 - QSEE Execution, Delta B - 1368853 - SBL1, End D - 676517 - SBL1, Delta S - Flash Throughput, 2010 KB/s (758742 Bytes, 377357 us) S - DDR Frequency, 537 MHz U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09) smem ram ptable found: ver: 1 len: 3 DRAM: 256 MiB @machid : 0x8010100 NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21 SF: Detected W25M02GV with page size 2 KiB, total 256 MiB SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000 258 MiB MMC: In: serial Out: serial Err: serial machid: 8010100 flash_type: 0 Hit any key to stop autoboot: 0 Creating 1 MTD partitions on "nand1": 0x000000000000-0x000010000000 : "mtd=0" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI error: ubi_read_volume_table: the layout volume was not found UBI error: ubi_init: cannot attach mtd2 UBI error: ubi_init: UBI error: cannot initialize UBI, error -22 UBI init error 22 Error, no UBI device/partition selected! Wrong Image Format for bootm command ERROR: can't get kernel image! Creating 1 MTD partitions on "nand1": 0x000000000000-0x000010000000 : "mtd=0" UBI: attaching mtd2 to ubi0 UBI: physical eraseblock size: 131072 bytes (128 KiB) UBI: logical eraseblock size: 126976 bytes UBI: smallest flash I/O unit: 2048 UBI: VID header offset: 2048 (aligned 2048) UBI: data offset: 4096 UBI error: ubi_read_volume_table: the layout volume was not found UBI error: ubi_init: cannot attach mtd2 UBI error: ubi_init: UBI error: cannot initialize UBI, error -22 UBI init error 22 Error, no UBI device/partition selected! Wrong Image Format for bootm command ERROR: can't get kernel image! resetting ...
First, thank you very much for the steps!
Secondly,
You need to short SO/SIO1
You mean J1's GND and U26's pin 8?