Cisco AP9120AXI - Boot looping to u-boot

[m.murad]

I have an AP 9120 that i boot looping seems it can not find the file Part.bin, so wondering if there is a way to recover from it?

Hit ESC key to stop autoboot: 1 MG link 1G 0
Mounting UBI device bootfs
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "mtd=1", size 5 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 23, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19
Load Addr 0x10000000
Mount UBIFS PARTITION part 2 ...
ubifsmount - mount UBIFS volume

Usage:
ubifsmount <volume-name>
- mount 'volume-name' volume
Unable to mount UBIFS PARTITION part 2, read UBI PARTITION ...
Read 2 bytes from volume part to 10000000
Volume part not found!
Unable to load image from UBI PARTITION part 2
Trying alternate partition part1
Mount UBIFS PARTITION part1 ...
Error reading superblock on volume 'ubi0:part1' errno=-19!
ubifsmount - mount UBIFS volume

Usage:
ubifsmount <volume-name>
- mount 'volume-name' volume
Unable to mount UBIFS PARTITION part1, read UBI PARTITION ...
Read 0 bytes from volume part1 to 10000000
Volume part1 not found!
Unable to load image from UBI PARTITION part1
Giving up. Rebooting...
resetting ...

Resetting board...e▒▒▒▒\J▒/▒▒mH▒▒HELO
5.0205HNDRC1a-1.0.38-163.162
CPU0
L1CD
MMUI
MMUA
CODE
ZBBS
MAIN
Boot Strap Register: 0x6fc7b
NVRAM memcfg 0x60607
DDR3-1600 CL11 total 2048MB 4 8bits part[s]

DDR test done successfully
CFE Version: 5
Verifying MASTER U-Boot...
Launching MASTER U-Boot version 0x0050 ...

____ _
/ ___|(_) ___ ___ ___
| | | |/ __| / __|/ _ \
| |___ | |\__ \| (__| (_) |
\____||_||___/ \___|\___/
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__|

U-Boot 2017.09 (Jun 01 2022 - 09:52:21 -0700) Broadcom BCM49408

Board: VANC-i

[marce1000]

                  >...Unable to load image from UBI PARTITION part 2
                  >...Error reading superblock on volume 'ubi0:part1' errno=-19!
 - I have doubts that this AP can (still) be recovered , looks more like a fatal hardware problem and it may need replacement (RMA)
   You could however have a look at : https://community.cisco.com/t5/wireless/cannot-boot-from-usb-with-u-boot/m-p/4289373#M226189

 M.

[m.murad]

Hi thanks for the response. The link you sent links to a page that asks the question how to use the usb to boot however I did not see an answer to the question there? In my search I found an option to select boot mode via tftp but now can't find that document to looking through my history to find it.

[marce1000]

  - The idea is to factory reset the AP and check if it can still  join , with a CAPWAP image retrieved , to a controller , then later on it could be converted to EWC again (if desired) , 

 M.

[m.murad]

Unable to load image from UBI PARTITION part1
Giving up. Rebooting...
resetting ...

Resetting board...e▒▒▒▒\J▒/▒▒mH▒▒HELO
5.0205HNDRC1a-1.0.38-163.162
CPU0

as you can see from the above it does not get far enough to start doing CAPWAP as it can't find the file "part.bin" on either partition.

I have tried this document too and it does not fix the issue

Recover from a Boot Loop Caused by Image Corruption on Wave 2 and 11ax Access Points (CSCvx32806) - Cisco

[Leo Laohoo]

Recover from a Boot Loop Caused by Image Corruption on Wave 2 and 11ax Access Points

(CSCvx32806)

[m.murad]

Hi Thanks for the reply

What this does is delete the partition but there is no instruction on how to put the file back on that partition which in this case is "part.bin". So delete the partition and then with no file or an option to download the file from Cisco and reflash it is not there.

(u-boot)> ubi part fs 
(u-boot)> ubi remove part1  (or part2 if corrupted image is in part2) 
(u-boot)> ubi create part1  (or part2 if corrupted image is in part2) 
(u-boot)> boot

[Leo Laohoo]

---

@m.murad wrote:
What this does is delete the partition but there is no instruction on how to put the file back on that partition which in this case is "part.bin". So delete the partition and then with no file or an option to download the file from Cisco and reflash it is not there.

---

Because there is a recovery image in the AP that is stored in a "read-only" partition of the flash.  

[Rich R]

Have you tried following this?
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9120axi-access-point/217537-repairing-c9120-c9115-access-points-from.html

ps. I've used this process a few times after EWC upgrades have left a 9120 corrupted.

[m.murad · Accepted solution]

So out of two AP9120AXI's I managed to recover 1 whilst the second has corrupt flash so that needs an RMA.
Spent all morning doing a number of things.

1. first tried the cisco document 

Repair C9120/C9115 Access Points from U-boot - Cisco
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9120axi-access-point/217537-repairing-c9120-c9115-access-points-from.html

>>> I set the IPs to my network as follows;

setenv ipaddr 10.1.1.42
setenv netmask 255.255.255.0
setenv serverip 10.1.1.104
setenv gatewayip 10.1.1.1
setenv tftpdir
saveenv

>>> I then ran the below command
u-boot> boardinit bundle-axel-SS-8_10_130_0.img

>>> which did this

Environment size: 630/65532 bytes
u-boot> boardinit bundle-axel-SS-8_10_130_0.img
Download image bundle-axel-SS-8_10_130_0.img...
Using bcm4908_eth-0 device
TFTP from server 10.1.1.104; our IP address is 10.1.1.42
Filename 'bundle-axel-SS-8_10_130_0.img'.
Load address: 0x50114610
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################

#################################################################
#################################################################
#################################################################
###################
1.9 MiB/s
done
Bytes transferred = 147999664 (8d24bb0 hex)
Program PHY firmware? [y/N]: y
Writing PHY firmware to NOR flash...
>>> Backup current PHY firmware image @300000:45000...[Success]
>>> Erase flash blocks ..........[Success]
>>> Write PHY firmware image ...[Success]
[Success]
Program UBIFS image? [y/N]: y
Writing UBIFS to NAND...

NAND erase.part: device 0 offset 0x6c0000, size 0x3f940000
Erasing at 0x3ffc0000 -- 100% complete.
OK

NAND write: device 0 offset 0x6c0000, size 0x8c80000
147324928 bytes written: OK
[Success]
Program bootloaders? [y/N]: n
u-boot>
u-boot>
u-boot>
u-boot>

>>> I then reloaded the AP but this did not fix the issue so back into u-boot and ran the below to change partitions and did the above process again
>>> This command changes the partition to either 1 or 2 and then you can repeat the above and copy the file to both partitions if needed.

chpart nand0,2 << change to part 2
chpart nand0,1 << or change to part 1 depends which part you were last on

u-boot> boardinit bundle-axel-SS-8_10_130_0.img <<< then run again to repeat process

you can then run the below
setenv BOOT part 2 << to change to part 2 for me as was using part 1
saveenv

u-boot> setenv BOOT part 2
u-boot> saveenv
Saving Environment to SPI Flash...
Erasing SPI flash...Writing to SPI flash...done
u-boot>

>>> then boot the AP again but this did not work so the final thing I did was the following
In U-boot mode, use the following command to format the environment:
env default -a (This command resets the environment variables to their default values)

u-boot> env default -a

>>> This command reset to default and after a few reboots the AP came up, job done.

[m.murad]

I noticed one interesting thing which is below >> "Run from flash/host/tftp (f/h/c) : f"
full output below and I could not work out how to set it to boot from TFTP as the it would suggest that is possible if the flash is currupt

u-boot>
u-boot>
u-boot>Platform: 4908
SF: Detected mx25l6405d with page size 256 Bytes, erase size 4 KiB, total 8 MiB
pmc_init:PMC using DQM mode
pmc_patch_4908:7 0 fd4a044e 3540354
Board IP address : 10.1.1.189:ffffff00
Host IP address : 10.1.1.1
Gateway IP address : 10.1.1.1
Run from flash/host/tftp (f/h/c) : f

>>> I also tried the below 2 and the file loaded but then did nothing so something to try another time if I have too much time on my hands
u-boot> BOOTP
u-boot> DHCP