Completely bricked u-boot on PogoPlug v4 Mobile

I've completely bricked u-boot on my PogoPlug v4 Mobile. I was attempting to upgrade it via serial + tftp, but clearly messed it up. Now, I'm getting literally no output from the serial connection, and no LED status (except for the ethernet port which can create a physical link).

I've been doing some searches on this forum as well as more generally on the web, and everything points to trying to use kwboot to recover from a failed flash. However, even this seems to get stuck. Specifically, I get stuck here:

$ sudo kwboot -t -B 115200 /dev/ttyUSB0 -b ~/Downloads/u-boot.kwb 
kwboot version 2024.01
Detected kwbimage v0 with NAND boot signature
Patching image boot signature to UART
Sending boot message. Please reboot the target...|

kwboot is running on an Ubuntu 24.10 machine (bare metal) and I'm connected by a USB-serial adapter at /dev/ttyUSB0. Even when I unplug and reconnect the power on the Pogoplug, nothing changes -- it hangs indefinitely (spinning the cursor after "Please reboot the target...".

Is there any way to recover at this point? If not, no big loss -- got the device for free, but would still love to try.

Thanks!



Edited 1 time(s). Last edit at 05/11/2025 03:37PM by shermbug.

shermbug ,

I'm assuming the Ubuntu box is x86, 64bit. And serial console has worked welll before bricked.

Try using this kwboot binary:

https://forum.doozan.com/read.php?3,27280,27280#msg-27280

Quote

2. I've attached the 2025.01-rc1 kwboot static binary (x86-64) to this post:
kwboot_2025.01-rc1_x86-64.tar.bz2
(kwboot version u-boot version 2025.01-rc1-ge61ea9f2e5d2-dirty)
sha256:
a63e93d76bafa01605dbed5e0d786e689187d3a85b8bcda153847406580e1f8d

After downloaded, you can extract and rename kwboot_2025.01-rc1_x86-64 to just kwboot.

Not sure if it works, nobody has tested this kwboot binary. kwboot has a lot of improvement since 2024.01.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thanks @bodhi! I’ll give it a shot when I have some time, hopefully later today. I’ll report back with my results.

I tried with kwboot_2025.01-rc1_x86-64, but got nothing (same output as before, but with the updated version information) . I don't think this is a problem with the new kwboot binary, but more a sign of how badly I borked the bootloader.

Also, FWIW, I'm using the OpenWrt u-boot.kwb file for this device (from OpenWrt 24.10.1). Is there another uboot file I should be using instead? (again, I think that this is not material to the issue, though, since I'm not getting any response).

My process is:
1) connect serial
2) power on the Pogoplug device
3) issue the kwboot command
4) power-cycle the Pogoplug device when it tells me to reboot the target
5) wait... wait... (waiting for Gadot).

I have also tried starting screen at various points within the first 4 steps and I still see nothing. I have also tried repeatedly hitting escape immediately after power (into the screen terminal window), but that has not changed the behavior.

Does anything seem wrong with my process and/or are there any other things I should be doing/trying?

Try

1. Start kwboot
2. Power up the Pogo Mobile.

and

1. Power up the Pogo Mobile.
2. Start kwboot immediately.

And make sure the serial wires are away from the power cord. Sometime the power interference could cause noise if the wires are not shielded.

> Also, FWIW, I'm using the OpenWrt u-boot.kwb file
> for this device (from OpenWrt 24.10.1). Is there
> another uboot file I should be using instead?
> (again, I think that this is not material to the
> issue, though, since I'm not getting any
> response).

Right! it did not even loaded. If u-boot image is bad, it would still print out transfering progress.

But it's worth a try using the image uboot.2017.07-tld-1.pogo_v4.mtd0.kwb here in my release thread:

https://forum.doozan.com/read.php?3,12381

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Still no luck.I tried with the recommended uboot file and I tried with kwboot started before powering on the device as well as starting kwboot immediately after power-on.

I don't think there are any noise related issues, but I did double check to make sure I didn't have the power cable running close to the serial connection.

Any other ideas (low hanging fruit)? I'm guessing that t would also have nuked any tftp server or client functions and/or other network boot/recovery options... but I can easily try some stuff on that end if you have any relevant info/ideas (like the address of the device and/or the expected sever address, file name to put or get, etc.)?

BTW, thanks again for your assistance even if this is a futile effort!

shermbug,

> Any other ideas (low hanging fruit)? I'm guessing
> that t would also have nuked any tftp server or
> client functions and/or other network
> boot/recovery options...

> but I can easily try some
> stuff on that end if you have any relevant
> info/ideas (like the address of the device and/or
> the expected sever address, file name to put or
> get, etc.)?

Unfortunately I'm not familiar with OpenWrt u-boot, so I can only suggest things to try in general. Let's see if this rings any bell: did you set up netconsole when you tried to upgrade?

If you have tried all, there is still a last resort: connect JTAG. But it will be a lot of work: find the JTAG header on the board, buy a JTAG header and solder it in. And then see here how to run OpenOCD to unbrick:

https://forum.doozan.com/read.php?3,21789

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

> Unfortunately I'm not familiar with OpenWrt
> u-boot, so I can only suggest things to try in
> general.

I'm very familiar with OpenWrt in general... I'm actually an admin on the forum! But I've never worked with uboot/kirkwood devices, and I absolutely messed this up. At this point, it's a screwed up u-boot situation, not specific to OpenWrt.

> Let's see if this rings any bell: did you
> set up netconsole when you tried to
> upgrade?

No, I didn't. But I don't think that it's even booting in any way whatsoever, so it's not going to come up unless it's baked into ROM or some place that is guaranteed to work even when uboot is broken (erased and over-written, but clearly not written with the right code).

> If you have tried all, there is still a last
> resort: connect JTAG. But it will be a lot of
> work: find the JTAG header on the board, buy a
> JTAG header and solder it in. And then see here
> how to run OpenOCD to unbrick:
>
> https://forum.doozan.com/read.php?3,21789

This is cool! I was looking at JTAG programmers and they're too expensive for this project. I would spend like $5 for the experience of recovering this device, but it's not worth the actual price ($20 USD and up). But, I do have a spare Pi lying around and the OpenOCD method sounds intriguing! I'll need to figure out the JTAG pins on the PogoPlug and then I'll to experiment to see if I can get this to work. It may take me a few days to get around to this and to pull everything together, but this is an effort worth trying for the educational value!

Thanks again... I'll report back when I have news and/or questions. (it may be a bit, though).

Maybe a stupid question, have you checked the USB-serial device actually works?

Just a quick status update... (no 'real' news on the recovery effort):

I setup a Pi400 with OpenOCD and I am able to run the binary. I haven't gotten to the point of connecting the hardware, so that will be in another update. This was not straight forward, though.

I was unable to get it to work with the Raspberry Pi OS (didn't record the version, but current as of May 2025).

What didn't work
What follows here is the 'why', but I wouldn't recommend anyone try this method unless they have the time/energy/knowledge to untagle the mess.
- Compilation failed because of the missing jimtcl library, and it couldn't be found in the standard package repo.
- I downloaded the source code and built it, which resolved the initial error, but then I ran into problems with it not finding trig related math functions (not sure why this is even necessary, but it caused the build of OpenOCD to fail).
- I tried to enable the math functions, but couldn't figure out exactly how to do that, so then I found a package that I could install.
- But no dice on the package install -- it ran into other dependencies that looked like it was going to be quite complex to unravel and not worth my time (and possibly also out of my depth for this type of work)..

What did work (at least compile/install/run binary)
I ended up refreshing the SD card with Ubuntu 64-bit for the Pi (using the RPi imager tool). Ubuntu seems to work, but you still need to install a bunch of packages:
- from the standard repo: git, pkg-config, make
- download and install: libjim-dev (link)
Finally everything built and installed. I completed the process through the creation of the raspberrypi123-native.cfg

One potential issue:
---> I am not sure if the E02 pogo.cfg file provided in the tutorial is right, but I don't know where to get the equivalent Pogoplug v4 cfg file.

I executed the binary as described in starting the show in terminal 1 (T1), and it seems to run. I see a bunch of deprecated messages -- not sure if those are currently fatal errors or if they're just warnings currently. Meanwhile, I then got the (very much expected) errors that the JTAG scan failed. But, as I said earlier, I don't have the hardware connected yet. So more to come on that.

The output from this test run:

$ sudo openocd -f pogo.cfg
Open On-Chip Debugger 0.12.0+dev-00994-g744955e5b (2025-05-13-19:41)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter driver' not 'interface'
DEPRECATED! use 'bcm2835gpio peripheral_base' not 'bcm2835gpio_peripheral_base'
DEPRECATED! use 'bcm2835gpio speed_coeffs' not 'bcm2835gpio_speed_coeffs'
DEPRECATED! use 'adapter gpio tck; adapter gpio tms; adapter gpio tdi; adapter gpio tdo' not 'bcm2835gpio_jtag_nums'
DEPRECATED! use 'adapter gpio swclk; adapter gpio swdio' not 'bcm2835gpio_swd_nums'
DEPRECATED! use 'adapter gpio trst' not 'bcm2835gpio_trst_num'
DEPRECATED! use 'adapter speed' not 'adapter_khz'
Warn : DEPRECATED: auto-selecting transport "jtag". Use 'transport select jtag' to suppress this message.
pogo_load_uboot
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 200 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: feroceon.cpu: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Error: unexpected Feroceon EICE version signature
Info : [feroceon.cpu] Examination succeed
Info : [feroceon.cpu] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections

Edited 1 time(s). Last edit at 05/13/2025 05:48PM by shermbug.

Quote
Mijzelf
have you checked the USB-serial device actually works?

Thanks for asking, and not a stupid question....
Yes, it works. I was able to use the UART serial I/O successfully until I killed uboot. I am confident that my problem is not related to the USB serial adapter in this case, though, because I used that to issue the commands that toasted my device.

shermbug Wrote:
-------------------------------------------------------
> Just a quick status update... (no 'real' news on
> the recovery effort):
>
> I setup a Pi400 with OpenOCD and I am able to run
> the binary. I haven't gotten to the point of
> connecting the hardware, so that will be in
> another update. This was not straight forward,
> though.
>
> I was unable to get it to work with the Raspberry
> Pi OS (didn't record the version, but current as
> of May 2025).
>
> What didn't work
> What follows here is the 'why', but I wouldn't
> recommend anyone try this method unless they have
> the time/energy/knowledge to untagle the mess.
> - Compilation failed because of the missing jimtcl
> library, and it couldn't be found in the standard
> package repo.
> - I downloaded the source code and built it, which
> resolved the initial error, but then I ran into
> problems with it not finding trig related math
> functions (not sure why this is even necessary,
> but it caused the build of OpenOCD to fail).
> - I tried to enable the math functions, but
> couldn't figure out exactly how to do that, so
> then I found a package that I could install.
> - But no dice on the package install -- it ran
> into other dependencies that looked like it was
> going to be quite complex to unravel and not worth
> my time (and possibly also out of my depth for
> this type of work)..
>
> What did work (at least compile/install/run
> binary)
> I ended up refreshing the SD card with Ubuntu
> 64-bit for the Pi (using the RPi imager tool).
> Ubuntu seems to work, but you still need to
> install a bunch of packages:
> - from the standard repo: git, pkg-config, make
> - download and install: libjim-dev
> (link)
> Finally everything built and installed. I
> completed the process through the creation of the
> raspberrypi123-native.cfg
>
> One potential issue:
> ---> I am not sure if the E02 pogo.cfg file
> provided in the tutorial is right, but I don't
> know where to get the equivalent Pogoplug v4 cfg
> file.

I will post this cfg file sometime today.

>
> I executed the binary as described in starting the
> show in terminal 1 (T1), and it seems to run. I
> see a bunch of deprecated messages -- not sure if
> those are currently fatal errors or if they're
> just warnings currently. Meanwhile, I then got the
> (very much expected) errors that the JTAG scan
> failed. But, as I said earlier, I don't have the
> hardware connected yet. So more to come on that.
>
> The output from this test run:
>

> $ sudo openocd -f pogo.cfg
> Open On-Chip Debugger 0.12.0+dev-00994-g744955e5b
> (2025-05-13-19:41)
> Licensed under GNU GPL v2
> For bug reports, read
> 	http://openocd.org/doc/doxygen/bugs.html
> DEPRECATED! use 'adapter driver' not 'interface'
> DEPRECATED! use 'bcm2835gpio peripheral_base' not
> 'bcm2835gpio_peripheral_base'
> DEPRECATED! use 'bcm2835gpio speed_coeffs' not
> 'bcm2835gpio_speed_coeffs'
> DEPRECATED! use 'adapter gpio tck; adapter gpio
> tms; adapter gpio tdi; adapter gpio tdo' not
> 'bcm2835gpio_jtag_nums'
> DEPRECATED! use 'adapter gpio swclk; adapter gpio
> swdio' not 'bcm2835gpio_swd_nums'
> DEPRECATED! use 'adapter gpio trst' not
> 'bcm2835gpio_trst_num'
> DEPRECATED! use 'adapter speed' not 'adapter_khz'
> Warn : DEPRECATED: auto-selecting transport
> "jtag". Use 'transport select jtag' to suppress
> this message.
> pogo_load_uboot
> Info : Listening on port 6666 for tcl connections
> Info : Listening on port 4444 for telnet
> connections
> Info : BCM2835 GPIO JTAG/SWD bitbang driver
> Info : clock speed 200 kHz
> Error: JTAG scan chain interrogation failed: all
> zeroes
> Error: Check JTAG interface, timings, target
> power, etc.
> Error: Trying to use configured scan chain
> anyway...
> Error: feroceon.cpu: IR capture error; saw 0x00
> not 0x01
> Warn : Bypassing JTAG setup events due to errors
> Info : Embedded ICE version 0
> Info : feroceon.cpu: hardware has 1
> breakpoint/watchpoint unit
> Error: unexpected Feroceon EICE version signature
> Info : [feroceon.cpu] Examination succeed
> Info : [feroceon.cpu] starting gdb server on 3333
> Info : Listening on port 3333 for gdb connections
>

You should post this in the Pogo E02 JTAG thread. Joerg will help.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

(ignore or delete this post; it was a duplicate of the one below)



Edited 1 time(s). Last edit at 05/14/2025 12:26AM by shermbug.

Quote
bodhi
I will post this cfg file sometime today.

Oh, fantastic! Thanks!! As soon as it's available, I'll load that into my Pi. I still need to setup the JTAG connection (physically), so that might not happen for another day or two or three.

Quote
bodhi
You should post this in the Pogo E02 JTAG thread. Joerg will help.

Will do! Forgive me if I violate any cross-posting rules in the process.

Apologies for the radio silence. A quick update...

I downloaded the cfg file -- thanks Bodhi!!

For some reason I thought that the JTAG pins could also be found on the J17 header as well as test points on the underside of the board. Turns out that JTAG is only available on those test points, and not on a header (I tried tracing it out with my continuity meter).I don't know why I had that impression, but now I know. Anyway, since those TPs are quite small, I realized I would need thinner/lighter bodge wires than I have around right now. So those are on order and should be here soon.

Time for some real updates.... progress, but not fixed yet! I've got the JTAG interface up and running, but I'm unable to write uboot.

Here are the details:

First, it's worth mentioning that I'm using the exact content as described in the first post of the how2 page for /usr/share/openocd/scripts/board/pogo.cfg -- that seems to be a config for the E02, not sure if it is valid for my v4 unit. Since I can't seem to do an anchor-link to directly reference the section of the tutorial, I'll include here the first few lines of that file:

 # Pogoplug E02
 # modification joerg_999 14.03.2016
 # use this pogo.cfg taken from sheevaplug to use with Raspi direct or Buspirate jtag adapter
 # use raspberrypi-native mode 
 # we use the Pins from SPI Interface (violett) 19,21,23,26 and 22, + 20 for GND 
 # see GPIO schematic Raspi Raspi GPIO

 # source [find interface/buspirate.cfg] 
 # source [find interface/sysfsgpio-raspberrypi.cfg] 
 source [find interface/raspberrypi123-native.cfg]
 source [find target/feroceon.cfg]
...

Next, I'm not exactly sure where I am supposed to use the kwbimage.cfg (for the v4) provided by @bodhi. At first, I thought it was a replacement for the above, but that clearly isn't the case because it's a totally different file structure.

---> hints/directions for the above would be much appreciated.


Moving on... I am using the following files:

uboot.2023.04-tld-1.pogo_v4.environment
uboot.2023.04-tld-1.pogo_v4.kwb

They are sym-linked as uboot-env.bin and uboot.kwb respectively.

At this point, I start the openocd process:

peter@pi400:~$ sudo openocd -f pogo_e02.cfg 
Open On-Chip Debugger 0.12.0+dev-00994-g744955e5b (2025-05-13-19:41)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter driver' not 'interface'
DEPRECATED! use 'bcm2835gpio peripheral_base' not 'bcm2835gpio_peripheral_base'
DEPRECATED! use 'bcm2835gpio speed_coeffs' not 'bcm2835gpio_speed_coeffs'
DEPRECATED! use 'adapter gpio tck; adapter gpio tms; adapter gpio tdi; adapter gpio tdo' not 'bcm2835gpio_jtag_nums'
DEPRECATED! use 'adapter gpio swclk; adapter gpio swdio' not 'bcm2835gpio_swd_nums'
DEPRECATED! use 'adapter gpio trst' not 'bcm2835gpio_trst_num'
DEPRECATED! use 'adapter speed' not 'adapter_khz'
Warn : DEPRECATED: auto-selecting transport "jtag". Use 'transport select jtag' to suppress this message.
pogo_load_uboot
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 200 kHz
Info : JTAG tap: feroceon.cpu tap/device found: 0x20a023d3 (mfg: 0x1e9 (Marvell Semiconductors), part: 0x0a02, ver: 0x2)
Info : Embedded ICE version 0
Info : feroceon.cpu: hardware has 1 breakpoint/watchpoint unit
Info : [feroceon.cpu] Examination succeed
Info : [feroceon.cpu] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections

and I can get into the telnet session to run the various commands. There are two notable issues here (I'll call them out after this code block):

$ telnet localhost 4444
Trying ::1...
Connection failed: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> pogo_init                              
DEPRECATED! use 'adapter [de]assert' not 'jtag_reset'
DEPRECATED! use 'adapter [de]assert' not 'jtag_reset'
target halted in Thumb state due to debug-request, current mode: Supervisor
cpsr: 0x400000f3 pc: 0xffff0ba6
MMU: enabled, D-Cache: enabled, I-Cache: enabled
> soft_reset_halt                        
[feroceon.cpu] requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x400000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> nand probe 0                           
NAND flash device 'NAND 128MiB 3.3V 8-bit (Hynix)' found
> nand erase 0 0x0 0xa0000               
erased blocks 0 to 4 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'
> nand write 0 uboot.kwb 0 oob_softecc_kw
timed out while waiting for target halted
error executing hosted NAND write
Unable to write data to NAND device
failed writing file uboot.kwb to NAND flash 0 at offset 0x00000000

First, in the example output, it shows " # erased blocks 0 to 5 on NAND flash device #0 'NAND 128MiB 3.3V 8-bit'", but my output shows just blocks 0 to 4.

Then, obviously if fails to write the uboot.kwb file to the nand.

Thoughts/ideas? am I missing a step or doing something wrong?


Thanks!!



Edited 1 time(s). Last edit at 05/19/2025 12:31PM by shermbug.

shermbug,

Please post in joerg's thread for Pogo E02.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Sure. Thanks. I've copied my previous post over to that thread.