Re: AIR-AP3802I-E-K9

UPTONKEVERN · ‎07-01-2021

Hi All.

Thanks in advance for any assistance.

I picked up a second hand AIR-AP3802I-E-K9 whos serial number appears on the list of affected AP's that were manufactured Dec 2017 and January 2018 that exhibit unable to connect to wired network, spamming "awaiting IP uplink and gateway" messages in console.

Version 8_5_111_0

I ran a factory reset by holding mode in on boot, then releasing when seconds counter in console reached 20 seconds.
I had plugged in AUX cable and was able to execute ap-type capwap, capwap ap restart, capwap ap ip xxx.xxx.xxx xxx.xxx.xxx.xxx xxx.xxx.xxx dnsl xxx.xxx.xxx.xxx domain (took my details out on this post for security), and managed to set the static IP address.

When running a ip int brief the Wired0 and Wired1 interfaces are both up, protocol up, with IP being assigned to Wired 1 and speed on Wired 0 being n/a. I cannot ICMP.

When checking the interfaces there is receive and transmit packets, however the AP cannot icmp the connected network nor can any of the other network clients ICMP it.

I ran a uboot>> prompt dhcp command and the PoE primary interface does pull a IP address from a MS DHCP server scope and I am able to ping the network.

It seems to me as if the unit will need a IOS recovery, either Cisco Mobility image or Capwap image, however as I bought these units second hand I cannot log a TAC case to understand the recovery process for a AIR-AP3802I-E-K9.
Further, when searching for IOS recovery documents on CISCO there is reference to a 2800/3600/3800 and then it gets vauge and then references 3600 only using ***.mz image and not ap3g3-k9w8-tar.153-3.JPK1.tar that is used for archive recovery.

The challenge here is that the inherent bug that is causing the network issue rules out archive recovery under normal boot and there appears to be no documentation for recovery through uboot. Also, Cisco website does not offer images persay for tftpxx recovery.

Does anyone know or can assist (without a TAC case), how to do a recovery through uboot , dhcp, or other option?
A response would be greatly appreciated.

Leo Laohoo · ‎07-02-2021

Any reason why RMA is not an option?

UPTONKEVERN · ‎07-02-2021

Bought the AP's second hand.

Leo Laohoo · ‎07-02-2021

@UPTONKEVERN wrote:

Bought the AP's second hand.

Try getting the AP RMA-ed. The worst TAC can do is say "no".

UPTONKEVERN · ‎07-03-2021

I will try this route, however, in the interim, does a recovery image exist for CISCO 3801I that I can run from u-boot rcvr command.?? or as with the u-boot documentation a state secret?

Leo Laohoo · ‎07-03-2021

Ask TAC to publish the OS.

UPTONKEVERN · ‎07-04-2021

Or maybe publish the serial restore process through u-boot (loadb, loadx, loady) with the OS ? Just seems rather iniquitous and disingenious to distribut a batch of AP's with firmare that blocks the primary nic interface and then have all this BS with no way out but RAM or TAC TAC AttTAC

Leo Laohoo · ‎07-04-2021

With the introduction of "Cheetah" OS (for the 1800/2800/3800, 4800 & later), Cisco made it more difficult to upload firmware via Console.

What we could try if forcing the AP to boot the other "partition".

Post the boot-up process so we can check which partition the AP boots up to.

UPTONKEVERN · ‎07-05-2021

setenv BOOT part2

saveenv

reset

With this it does change the primary boot partition to part #2, however it sees it as a backup or "fallback" partition and copies the files across seemingly from Partion #1 in the process.
Neither the COS or boot loader actually permit easily copying to these partitions as far as I can see? from COS you also cannot run dir flash: as in the old IOS and show flash in COS does not show the OS image either.
Essentially with the COS versions it leaves Joe Tecchie very little room to manouvre even if they have the LWAP or Mobility images.

Leo Laohoo · ‎07-05-2021

Like I said, Cisco has "designed" Cheetah OS to be very difficult to maintain and I've made it a "policy" (in my workplace) that I/we are not going to waste any time and just RMA the infernal AP.

UPTONKEVERN · ‎07-02-2021

I have the LWAP ap3g3-k9w8-tar.153-3.JPK1.tar file as well and the Mobility AIR-AP3800-K9-ME-8-10-151-0.zip files.
The Current 8.5.111.0 version only has archive download-sw options and there is no network connectivity to use archive for the LWAP file. uboot>> does connect to the network , however archive tool appears to be a no go.
In the past I have recovered using images, is there a image for the 3800I or is there someway I can use either of the two files above to get over this bump?

UPTONKEVERN · ‎07-02-2021

I have through use of extracted files from the LWAP tar file and combined use of u-boot command bootp, tftpboot, bootm and bootd managed to get the image loaded onto the AP, the AP has joined the controller and working. Now that I have a working access point is there any way to export or copy key files over so I can deploy it on the other aironet 3802I's

adrianmihaita · ‎08-17-2023

Hi,

I`m facing the same issue with an AIR-AP2802I-E-K9. It is stuck in U-boot and I cannot do anything. Since you managed to fix the AP would you be kind and share the actuals steps you took?

Thank you!

Leo Laohoo · ‎08-17-2023

How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points

adrianmihaita · ‎08-17-2023

Hi Leo,

Thank you for your reply

u-boot>> setenv mtdids nand0=nand0 && setenv mtdparts mtdparts=nand0:0x40000000@0x0(fs) && ubi part fs
nand0: partitioning exceeds flash size
mtdparts_init: no valid partitions
Error initializing mtdparts!

Let me explain my situation.

I have 3 APs (AIR-AP2802I-E-K9), on one of them I have installed ME (AIR-AP2800-K9-ME-8-10-185-0) and managed to get the virtual WLC up and running. The issue started with the other two because I have made a mistake on tftp config and when I connected the other 2 APs into the switch for a brief moment I saw them on the WLC and I thought they were just updating the os and joining into WLC. They disappeared from the WLC and when I checked with console connection I saw that there is a boot loop.

------------------------------------------------------------------------------------------------------

BootROM - 1.78
Booting from SPI flash, Secure mode
BootROM: RSA Public key verification PASSED
BootROM: CSK block signature verification PASSED
BootROM: Boot header signature verification PASSED
BootROM: Box ID verification PASSED
BootROM: JTAG is disabled

General initialization - Version: 1.0.0
Detected Device ID 6920
Master bootloder version 1.1e
High speed PHY - Version: 2.0
BoardId = 0x21board SerDes lanes topology details:
| Lane # | Speed| Type |
------------------------------|
| 1 | 0 | SGMII1 |
| 2 | 5 | PCIe1 |
| 4 | 5 | PCIe2 |
| 5 | 0 | SGMII2 |
-------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 1: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 2: Link upgraded to Gen2 based on client cpabilities
High speed PHY - Ended Successfully
DDR4 Training Sequence - Ver TIP-0.23.(Sublib 0.8)0
DDR4 Training Sequence - Switching XBAR Window to FastPath Window
DDR4 Training Sequence - Ended Successfully
BootROM: Image checksum verification PASSED
BootROM: Boot image signature verification PASSED

____ _
/ ___|(_) ___ ___ ___
| | | |/ __| / __|/ _ \
| |___ | |\__ \| (__| (_) |
\____||_||___/ \___|\___/
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__|
** LOADER **

U-Boot 2013.01-gad8bd06 (Sep 28 2017 - 17:03:04) SDK version: 2015_T2.0p10

Board: Barbados-2K
SoC: MV88F6920 Rev A1
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1800 [MHz]
L2 @ 900 [MHz]
TClock @ 250 [MHz]
DDR4 @ 900 [MHz]
DDR4 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 1 GiB
NAND: 256 MiB
SF: Detected N25Q32A with page size 64 KiB, total 4 MiB
PCI-e 1 (IF 0 - bus 0) Root Complex Interface, Detected Link X1, GEN 2.0
PCI-e 2 (IF 1 - bus 1) Root Complex Interface, Detected Link X1, GEN 2.0

Map: Code: 0x3feda000:0x3ffae0f4
BSS: 0x3ffefb9c
Stack: 0x3f9c9f20
Heap: 0x3f9ca000:0x3feda000
U-Boot Environment: 0x00100000:0x00110000 (SPI)

Board configuration:
| port | Interface | PHY address |
|--------|------------|--------------|
| egiga1 | SGMII | 0x01 |
| egiga2 | SGMII | 0x00 |
Net: , egiga1, egiga2 [PRIME]
Hit ESC key to stop autoboot: 0
u-boot>> boot
Creating 1 MTD partitions on "nand0":
0x000000200000-0x000010000000 : "mtd=2"
UBI: attaching mtd1 to ubi0
UBIFS: recovery needed
UBIFS: recovery deferred
UBIFS: mounted UBI device 0, volume 0, name "part1"
Loading file 'part1/part.bin' to addr 0x02000000 with size 6386457 (0x00617319)...
Done
SF: Detected N25Q32A with page size 64 KiB, total 4 MiB

Checking image signing.
Image signing verification success, continue to run...
## Booting kernel from Legacy Image at 02000000 ...
Image Name: Barbados Firmware Image
Created: 2023-03-24 20:10:18 UTC
Image Type: ARM Linux Multi-File Image (uncompressed)
Data Size: 6385449 Bytes = 6.1 MiB
Load Address: 00008000
Entry Point: 00008000
Contents:
Image 0: 4204560 Bytes = 4 MiB
Image 1: 2164735 Bytes = 2.1 MiB
Image 2: 16137 Bytes = 15.8 KiB
Verifying Checksum ... OK
## Loading init Ramdisk from multi component Legacy Image at 02000000 ...
## Flattened Device Tree from multi component Image at 02000000
Booting using the fdt at 0x02613060
Loading Multi-File Image ... OK
OK
reserving fdt memory region: addr=0 size=4000
Loading Device Tree to 01ff9000, end 01ffff08 ... OK

Starting Device Tree update ('fdt_skip_update' = no)

Limit DDR size at 3GB due to power of 2 requirement of Address decoding
Updating device tree successful

Starting kernel ...

[01/01/1970 00:00:00.0000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 260096
[01/01/1970 00:00:00.0000] Memory: 1025732K/1048576K available (5743K kernel code, 411K rwdata, 2504K rodata, 359K init, 496K bss, 22844K reserved, 0K highmem)
[01/01/1970 00:00:00.1200] CPU1: Booted secondary processor
[01/01/1970 00:00:01.4700] buginf tty flushing thread started, ttyport=be8c4c00
[01/01/1970 00:00:01.5900] m25p80 spi1.0: found n25q032a, expected n25q032
[01/01/1970 00:00:03.8400] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:05.9300] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:08.0200] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:10.1100] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:12.2000] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:14.2900] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:16.3800] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[01/01/1970 00:00:18.4700] i2c i2c-2: mv64xxx: I2C bus locked, block: 1, time_left: 0
[*01/01/1970 00:00:19.4268] buginf() enabled.
[*01/01/1970 00:00:19.4365] Made it into bootsh: Mar 24 2023 18:53:55 T-7fade086786c3d65a47b1296cf7866385d3f4734-g7fade086-aut
[*01/01/1970 00:00:20.6877] verify signature failed for /bootpart/part1/ramfs_data_cisco.cpio.lzma
[*01/01/1970 00:00:20.6878] bootsh mini ramfs booted /bootpart/part1/ramfs_data_cisco.cpio.lzma
[*01/01/1970 00:00:38.3020] lzma: unexpected EOF
[*01/01/1970 00:00:38.3039] Uncompressing lzma file: /bootpart/part1/ramfs_data_cisco.cpio.lzma: File exists
[*01/01/1970 00:00:38.3040] Fatal error: failed to start the image. Please fall back to alternate partition...
[01/01/1970 00:00:38.6000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[01/01/1970 00:00:38.6000]
[01/01/1970 00:00:38.6000] CPU1: stopping
[01/01/1970 00:00:38.6000] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.33 #1
[01/01/1970 00:00:38.6000] Backtrace:
[01/01/1970 00:00:38.6000] [<80109814>] (dump_backtrace) from [<80109ae0>] (show_stack+0x18/0x1c)
[01/01/1970 00:00:38.6000] r6:00000000 r5:809cf174 r4:00000000 r3:00200040
[01/01/1970 00:00:38.6000] [<80109ac8>] (show_stack) from [<8068d474>] (dump_stack+0x70/0x8c)
[01/01/1970 00:00:38.6000] [<8068d404>] (dump_stack) from [<8010c8f0>] (handle_IPI+0xe0/0x238)
[01/01/1970 00:00:38.6000] r4:00000001 r3:80979a58
[01/01/1970 00:00:38.6000] [<8010c810>] (handle_IPI) from [<801004d4>] (gic_handle_irq+0x58/0x60)
[01/01/1970 00:00:38.6000] r7:bf0adfac r6:80971434 r5:bf0adf78 r4:00000005
[01/01/1970 00:00:38.6000] [<8010047c>] (gic_handle_irq) from [<806944a0>] (__irq_svc+0x40/0x50)
[01/01/1970 00:00:38.6000] Exception stack(0xbf0adf78 to 0xbf0adfc0)
[01/01/1970 00:00:38.6000] df60: bf7e66e0 00000000
[01/01/1970 00:00:38.6000] df80: 0000fe96 801159e0 bf0ac000 bf0ac000 10c03c7d 809cf194 0000406a 414fc091
[01/01/1970 00:00:38.6000] SMP: failed to stop secondary CPUs
[01/01/1970 00:00:38.6000] Rebooting in 5 seconds..
[01/01/1970 00:00:38.6000] dfa0: 00000000 bf0adfcc bf0adfd0 bf0adfc0 80106ef8 80106efc 60000013 ffffffff
[01/01/1970 00:00:38.6000] r6:ffffffff r5:60000013 r4:80106efc r3:80106ef8
[01/01/1970 00:00:38.6000] [<80106ec8>] (arch_cpu_idle) from [<8016093c>] (cpu_startup_entry+0x138/0x1cc)
[01/01/1970 00:00:38.6000] [<80160804>] (cpu_startup_entry) from [<8010c594>] (secondary_start_kernel+0x124/0x144)
[01/01/1970 00:00:38.6000] [<8010c470>] (secondary_start_kernel) from [<00100564>] (0x100564)
[01/01/1970 00:00:38.6000] r4:3f09406a r3:8010054c

---------------------------------------------------------------------------------------------------------

Would it be possible to recover this two APs from this?

I have tried almost everything I could find on internet but nothing seams to work.

Thank you in advance!