Chromebook Pixel: "The device you inserted does not contain Chrome OS"

[Darrell Kundel]

Using the Chromebook Pixel (2013)

Here is the sequence of events that got me here:

1. lost the ability to boot seabios (ctrl-d didn't work)
2. disabled firmware write protect; removed the screw and  --wp-disable
3. enabled dev mode: "/usr/share/vboot/bin/make_dev_firmware.sh"  (i don't know why, the command sounded good)  after this my hwid="X86 LINK TEST 6638 DEV"
4. "restored" original firmware: "chromeos-firmwareupdate --sb_extract /tmp;flashrom -w /tmp/bios.bin"  (yes i flashed the whole thing, thinking it'd restore "better")
5.  "/usr/share/vboot/bin/set_gbb_flags.sh 0x00" (it complained about the gbb flags on boot so i "fixed" them)

So, yes I played fast and loose with commands I probably should have read more earlier.

My symptoms now are "Chrome OS is missing or damaged"
and when I put in my USB recovery image downloaded from linux_recovery.sh, it says "The device you inserted does not contain Chrome OS"

Can anyone tell me is my only recourse to manually flash the chip directly?  Or is there another way?

I'd like to either restore Chrome OS or install debian.  At the moment, can't boot either.

So, is there a way to make the recovery image happy?  Is it not happy because my hwid is wrong?  It used to be "LINK LAUREL AGZ-K 4513".

Or is there a way to flash and restore the previous bios extracted from the recovery image?

Or is there a way to recover using the Chrome OS firmware using and a dev (Chromium os) image?  (i think i screwed up the original signing mechanism in step 3 above)

Any pointers would help immensely, even if it's just to confirm that I've "bricked" it.

TIA

[Hung-Te Lin]

2015-04-27 4:36 GMT+08:00 Darrell Kundel <darrell...@gmail.com>:

Using the Chromebook Pixel (2013)
Here is the sequence of events that got me here:
1. lost the ability to boot seabios (ctrl-d didn't work)

   Legacy is Ctrl-L, not Ctrl-D.

 

2. disabled firmware write protect; removed the screw and  --wp-disable
3. enabled dev mode: "/usr/share/vboot/bin/make_dev_firmware.sh"  (i don't know why, the command sounded good)  after this my hwid="X86 LINK TEST 6638 DEV"

   Here you changed your firmware keys to developer keys.

 

4. "restored" original firmware: "chromeos-firmwareupdate --sb_extract /tmp;flashrom -w /tmp/bios.bin"  (yes i flashed the whole thing, thinking it'd restore "better")

   Here you reverted all the changes by make_dev_firmware. It's now using the key inside that chromeos-firmwareupdate.

   If that comes from a MP system image, then you're back to MP key.

 

5.  "/usr/share/vboot/bin/set_gbb_flags.sh 0x00" (it complained about the gbb flags on boot so i "fixed" them)

So, yes I played fast and loose with commands I probably should have read more earlier.
My symptoms now are "Chrome OS is missing or damaged"

    Please press TAB and provide the printed recovery_reason.

 

and when I put in my USB recovery image downloaded from linux_recovery.sh, it says "The device you inserted does not contain Chrome OS"

    You need to know what key is installed in your system, and what's the key for the image you've downloaded.

    When you run linux_recovery, did you give it the HWID "LINK LAUREL AGZ-K 4513"?

    That should download a MP-signed firmware.

    Now you need to know what's the key that signed your chromeos-firmwareupdate.

  If you still have the file, try "chromeos-firmwareupdate -V" and it should tell key signer info.

  Otherwise, press TAB in recovery screen and read the gbb.rootkey and gbb.recovery_key.

 

Can anyone tell me is my only recourse to manually flash the chip directly?  Or is there another way?
I'd like to either restore Chrome OS or install debian.  At the moment, can't boot either.
So, is there a way to make the recovery image happy?  Is it not happy because my hwid is wrong?  It used to be "LINK LAUREL AGZ-K 4513".

 

    No. Recovery image only cares about key, not HWID.

    However a broken HWID may confuse AU & recovery image download tool.

 

Or is there a way to flash and restore the previous bios extracted from the recovery image?
Or is there a way to recover using the Chrome OS firmware using and a dev (Chromium os) image?  (i think i screwed up the original signing mechanism in step 3 above)
Any pointers would help immensely, even if it's just to confirm that I've "bricked" it.

TIA

--
--
Chromium OS discuss mailing list: chromium-...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-os-discuss?hl=en

[Darrell]

On Sun, Apr 26, 2015 at 7:13 PM, Hung-Te Lin <hun...@chromium.org> wrote:

2015-04-27 4:36 GMT+08:00 Darrell Kundel <darrell...@gmail.com>:

Using the Chromebook Pixel (2013)
Here is the sequence of events that got me here:
1. lost the ability to boot seabios (ctrl-d didn't work)

   Legacy is Ctrl-L, not Ctrl-D.

​yes, my mistake.  ctrl-d didn't work.  I guess this was because I tried to set the gbb flags before disabling the hardware write protect.
​

 

2. disabled firmware write protect; removed the screw and  --wp-disable
3. enabled dev mode: "/usr/share/vboot/bin/make_dev_firmware.sh"  (i don't know why, the command sounded good)  after this my hwid="X86 LINK TEST 6638 DEV"

   Here you changed your firmware keys to developer keys.

 

4. "restored" original firmware: "chromeos-firmwareupdate --sb_extract /tmp;flashrom -w /tmp/bios.bin"  (yes i flashed the whole thing, thinking it'd restore "better")

   Here you reverted all the changes by make_dev_firmware. It's now using the key inside that chromeos-firmwareupdate.

   If that comes from a MP system image, then you're back to MP key.

 

5.  "/usr/share/vboot/bin/set_gbb_flags.sh 0x00" (it complained about the gbb flags on boot so i "fixed" them)

So, yes I played fast and loose with commands I probably should have read more earlier.
My symptoms now are "Chrome OS is missing or damaged"

    Please press TAB and provide the printed recovery_reason.

​I've attached inline a picture of the screen after hitting tab both before booting and after the recovery media is rejected.

The recovery media was made using the linux_recovery.sh and the Link/Pixel (choice 18) media.  I even tried flashing it to an sd card using this command:
sudo dd bs=4194304 if=chromeos_6680.64.0_link_recovery_stable-channel_mp-v4.bin of=/dev/mmcblk0 conv=sync

same results :(

my recollection is that the source firmware I used to flash was taken from this page although I first just flashed RW_LEGACY and then flashed the whole thing:
http://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices/chromebook-pixel

Legacy Boot Doesn't Work

Sometimes it's possible to break the SeaBIOS install in the flash (sometimes doing innocuous things like tweaking the GBB flags). If you do get into such a situation:

• Check that dev_boot_legacy is set to 1 when you run crossystem
• If it isn't, then see the normal Legacy Boot section above
• if it is, then see below

You can safely reset the copy of SeaBIOS in your flash by running (as root):

# chromeos-firmwareupdate --sb_extract /tmp
# flashrom -w /tmp/bios.bin -i RW_LEGACY

extracting the firmware from there I get the following dump:

pippin ~/linux/chromebook/firmware $ /home/dak/linux/chromebook/mnt/usr/sbin/chromeos-firmwareupdate -V bios.bin

flashrom(8): 2421a7192b8b3b0bb729bbf7f6431b71 */build/link/usr/sbin/flashrom
             ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.16, BuildID[sha1]=b09cb2f5e5a3581faf546b8ad1424f89ecc02279, stripped
             0.9.4  : 93a1c80 : Jan 08 2015 00:37:45 UTC

BIOS image:   d6baccf2dc75265ba44752fee21ed535 */build/link/tmp/portage/chromeos-base/chromeos-firmware-link-0.0.1-r104/work/chromeos-firmware-link-0.0.1/.dist/Link.2695.1.155.tbz2/image-link.bin
BIOS version: Google_Link.2695.1.155
EC image:     ee941566bc9ad7ffb45e93f1d1d57504 */build/link/tmp/portage/chromeos-base/chromeos-firmware-link-0.0.1-r104/work/chromeos-firmware-link-0.0.1/.dist/Link_EC.2695.1.155.tbz2/ec.bin
EC version:   link_v1.2.138-e4a9915

Package Content:
878f76bd3fbdac29b5d148ad5f1ee008 *./dump_fmappippin ~/linux/chromebook/firmware $ /home/dak/linux/chromebook/mnt/usr/sbin/chromeos-firmwareupdate -V bios.bin

flashrom(8): 2421a7192b8b3b0bb729bbf7f6431b71 */build/link/usr/sbin/flashrom
             ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.16, BuildID[sha1]=b09cb2f5e5a3581faf546b8ad1424f89ecc02279, stripped
             0.9.4  : 93a1c80 : Jan 08 2015 00:37:45 UTC

BIOS image:   d6baccf2dc75265ba44752fee21ed535 */build/link/tmp/portage/chromeos-base/chromeos-firmware-link-0.0.1-r104/work/chromeos-firmware-link-0.0.1/.dist/Link.2695.1.155.tbz2/image-link.bin
BIOS version: Google_Link.2695.1.155
EC image:     ee941566bc9ad7ffb45e93f1d1d57504 */build/link/tmp/portage/chromeos-base/chromeos-firmware-link-0.0.1-r104/work/chromeos-firmware-link-0.0.1/.dist/Link_EC.2695.1.155.tbz2/ec.bin
EC version:   link_v1.2.138-e4a9915

Package Content:
878f76bd3fbdac29b5d148ad5f1ee008 *./dump_fmap
2421a7192b8b3b0bb729bbf7f6431b71 *./flashrom
9ff55937100ba9175874a613ffa6d372 *./vpd
fac454da80d94f2a833ce5449a6bf360 *./mosys
12760bbc2e9364bf03d5866c23c8ef76 *./crosfw.sh
43d0a4a559753206ccb30aacce0a74c1 *./updater4.sh
86737f8ceba4c24c0207ee6d724dfa2c *./crossystem
878f76bd3fbdac29b5d148ad5f1ee008 *./gbb_utility
ce255d8a3a4396a5488c53efbdee42f0 *./VERSION.signer
3c3a99346d1ca1273cbcd86c104851ff *./shflags
16a3121ef52f5e5cc5470468d5f86984 *./common.sh
b0ca480cb2981b346f493ebc93a52e8a *./crosutil.sh
87f053fb9a8be2ff999c8ac330b6ca4e *./bios.bin
ee941566bc9ad7ffb45e93f1d1d57504 *./ec.bin

Signed with keyset in /tmp/signer.keydir.Q1TefL/cros/keys/LinkMPKeys-v4 .
2421a7192b8b3b0bb729bbf7f6431b71 *./flashrom
9ff55937100ba9175874a613ffa6d372 *./vpd
fac454da80d94f2a833ce5449a6bf360 *./mosys
12760bbc2e9364bf03d5866c23c8ef76 *./crosfw.sh
43d0a4a559753206ccb30aacce0a74c1 *./updater4.sh
86737f8ceba4c24c0207ee6d724dfa2c *./crossystem
878f76bd3fbdac29b5d148ad5f1ee008 *./gbb_utility
ce255d8a3a4396a5488c53efbdee42f0 *./VERSION.signer
3c3a99346d1ca1273cbcd86c104851ff *./shflags
16a3121ef52f5e5cc5470468d5f86984 *./common.sh
b0ca480cb2981b346f493ebc93a52e8a *./crosutil.sh
87f053fb9a8be2ff999c8ac330b6ca4e *./bios.bin
ee941566bc9ad7ffb45e93f1d1d57504 *./ec.bin

Signed with keyset in /tmp/signer.keydir.Q1TefL/cros/keys/LinkMPKeys-v4 .

Can you tell from the screenshot which keys these are dev or factory?  Is there any recovery image that I can download that the firmware will accept?

​

 

To unsubscribe from this group and stop receiving emails from it, send an email to chromium-os-dis...@chromium.org.

[Xie, William]

Please try Ctrl+U

 

William

[Xie, William]

And you need to enable dev mode first.

 

You seems go to the recovery mode, in recovery mode, you need Google product signed image.

That’s why you see there is no valid image.

 

To install developer self-built image, please try Ctrl+U

Please also make sure boot from usb is enabled.

 

William

[Hung-Te Lin]

According to the screenshots, you've put yourself into a semi-broken state.

The firmware is DEV-signed, not MP-signed, so the downloaded images won't work unless you can enter developer mode (and boot images), or set GBB flags to dev-friendly values (which you just manually wiped)

Seems like you didn't really finished the step of "4. "restored" original firmware: "chromeos-firmwareupdate --sb_extract /tmp;flashrom -w /tmp/bios.bin"  (yes i flashed the whole thing, thinking it'd restore "better")".

The page of "Legacy Boot Doesn't Work" is valid, but it tells to only overwrite the RW legacy section, not whole firmware. (maybe you followed it with the -i and that's why the key was not changed)

So what happened is:

 - You've changed firmware key to DEV by make_dev_firmware.

 - Because you've previously boot system in MP key, the TPM has a key version check (as the screenshot said, RW firmware version rollback detected) that will block you from booting with DEV key.

 - make_dev_firmware was aware of that and set GBB flags for you to override that behavior.

 - Unfortunately, you cleared GBB flags manually by "fixing" that :)

Please try to build a image by yourself (which will be DEV key), boot and insert the usb stick and set GBB flags back to something like 0x39.   

[Darrell]

Thanks much for the quick responses!  At least now I know how I broke it.

It might be a few days till I get a dev environment bootstrapped; but at least it sounds like I may be able to avoid taking out the soldering iron :)

I'll report back here how it goes.

Thanks again!

[Darrell]

Yeah!

I was able to boot the dev image and change the gbb bits and reboot successfully!

Thanks again!

[Darrell]

A couple follow-on questions, if you wouldn't mind indulging me..

My previous hwid used to be "LINK LAUREL AGZ-K 4513", but now it is still "X86 LINK TEST 6638".

What are the ramifications of it being what it is?

How would I change it back to factory?  Would the following work?

mkdir /tmp/firmware;chromeos-firmware --sb_extract /tmp/firmware;cd /tmp/firmware

gbb_utility -s --hwid="LINK LAUREL AGZ-K 4513" bios.bin newbios.bin

flashrom -w newbios.bin

I guess I'm most concerned about screwing up the signing and if changing the hwid screws correct signing of the firmware.

Thanks

[Mike Frysinger]

you should endeavor to restore the HWID to what it was originally.  sometimes we match based on that, although it's uncommon.

-mike

[Sonny Rao]

On Tue, Apr 28, 2015 at 9:04 PM, Darrell <darrell...@gmail.com> wrote:

A couple follow-on questions, if you wouldn't mind indulging me..

My previous hwid used to be "LINK LAUREL AGZ-K 4513", but now it is still "X86 LINK TEST 6638".

What are the ramifications of it being what it is?

If you put ChromeOS back on, you won't get updates if your HWID is "X86 LINK TEST 6638"

[Darrell]

Ok, that's what I suspected. 

Is the following safe to restore it?

mkdir /tmp/firmware;chromeos-firmware --sb_extract /tmp/firmware;cd /tmp/firmware

gbb_utility -s --hwid="LINK LAUREL AGZ-K 4513" bios.bin newbios.bin

flashrom -w newbios.bin

[Sonny Rao]

Yes, you should restore the old HWID.