Issue with installing OpenWrt on a Google Wifi device

Installing and Using OpenWrt
1

Hey guys, I flashed already 3 devices successfully, but the 4th one is still hanging with orange blinking led and when I plug in the stick with factory image it doesn't start to turn off and transfer data...

So I'm actually lost and don't understand why it worked on 3 devices before with the same stick.

If I finish my debug cable can anyone help to debug further?

I got further.

With the "defective" device I got this messages:

coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 verstage startiPhase 4
FMAP: area FW_MAIN_A found @ 402000 (1367808 bytes)
VB2:vb2api_init_hash() HW crypto for hash_alg 2 not supported, using SW
TPM: command 0x14 returned 0x0
TPM: command 0x14 returned 0x0
TPM: Set global lock
TPM: tlcl_write(0x0, 0)
TPM: command 0xcd returned 0x0
Slot A is selected
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 0 size 469b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 romstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'cdt.mbn'
CBFS: Found @ offset bac0 size 1ac
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'ddr.mbn'
CBFS: Found @ offset bcc0 size 7d38
DDR version private build initialized
SDI Entry: 0x860038d
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
CBMEM:
IMD: root @ 8727f000 254 entries.
failed.

And here is the log from working device with openwrt:

coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 verstage startiPhase 4
FMAP: area FW_MAIN_A found @ 402000 (1367808 bytes)
VB2:vb2api_init_hash() HW crypto for hash_alg 2 not supported, using SW
Saving nvdata
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
TPM: command 0x14 returned 0x0
TPM: command 0x14 returned 0x0
TPM: Set global lock
TPM: tlcl_write(0x0, 0)
TPM: command 0xcd returned 0x0
Slot A is selected
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 0 size 469b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 romstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'cdt.mbn'
CBFS: Found @ offset bac0 size 1ac
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'ddr.mbn'
CBFS: Found @ offset bcc0 size 7d38
DDR version private build initialized
SDI Entry: 0x860038d
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
CBMEM:
IMD: root @ 8727f000 254 entries.
IMD: root @ 8727ec00 62 entries.
creating vboot_handoff structure
Reading tristate GPIOs: 0 1 Z = 9 (binary_first base3 number system)
Board ID 9
Copying FW preamble
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'fallback/ramstage'
CBFS: Found @ offset 4700 size 6f3b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 ramstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
FMAP: Found "FMAP" version 1.0 at 300000.
FMAP: base = 0 size = 800000 #areas = 24
FMAP: area RO_VPD found @ 3e0000 (131072 bytes)
FMAP: area RW_VPD found @ 6e0000 (32768 bytes)
FMAP: area RO_VPD found @ 3e0000 (131072 bytes)
FMAP: area RW_VPD found @ 6e0000 (32768 bytes)
Exception handlers installed.
BS: BS_PRE_DEVICE times (us): entry 9 run 14 exit 9
BS: BS_DEV_INIT_CHIPS times (us): entry 9 run 29 exit 9
Enumerating buses...
Show all devs... Before device enumeration.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
Compare with tree...
Root Device: enabled 1
 CPU_CLUSTER: 0: enabled 1
Root Device scanning...
root_dev_scan_bus for Root Device
CPU_CLUSTER: 0 enabled
root_dev_scan_bus for Root Device done
scan_bus: scanning of bus Root Device took 12402 usecs
done
BS: BS_DEV_ENUMERATE times (us): entry 9 run 37312 exit 9
Allocating resources...
Reading resources...
Root Device read_resources bus 0 link: 0
Root Device read_resources bus 0 link: 0 done
Done reading resources.
Show resources in subtree (Root Device)...After reading.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0
  CPU_CLUSTER: 0 resource base 80000000 size 7500000 align 0 gran 0 limit 0 flags e0004200 index 0
  CPU_CLUSTER: 0 resource base 87500000 size b00000 align 0 gran 0 limit 0 flags f0004200 index 1
  CPU_CLUSTER: 0 resource base 88000000 size 18000000 align 0 gran 0 limit 0 flags e0004200 index 2
Setting resources...
Root Device assign_resources, bus 0 link: 0
CPU_CLUSTER: 0 missing set_resources
Root Device assign_resources, bus 0 link: 0
Done setting resources.
Show resources in subtree (Root Device)...After assigning values.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0
  CPU_CLUSTER: 0 resource base 80000000 size 7500000 align 0 gran 0 limit 0 flags e0004200 index 0
  CPU_CLUSTER: 0 resource base 87500000 size b00000 align 0 gran 0 limit 0 flags f0004200 index 1
  CPU_CLUSTER: 0 resource base 88000000 size 18000000 align 0 gran 0 limit 0 flags e0004200 index 2
Done allocating resources.
BS: BS_DEV_RESOURCES times (us): entry 9 run 120305 exit 10
Enabling resources...
done.
BS: BS_DEV_ENABLE times (us): entry 9 run 2987 exit 9
Initializing devices...
Root Device init ...
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'tzbsp_no_xpu.mbn'
CBFS: Found @ offset 13a40 size 9428
Starting TZBSP
Translation table is @ 0a0f0000
Mapping address range [0x00000000:0x00000000) as uncached
Creating new subtable @0a0f4000 for [0x0a000000:0x0a100000)
Mapping address range [0x0a0c0000:0x0a100000) as writeback
Creating new subtable @0a0f4400 for [0x0a800000:0x0a900000)
Mapping address range [0x0a8c0000:0x0a900000) as writeback
Creating new subtable @0a0f4800 for [0x08600000:0x08700000)
Mapping address range [0x08600000:0x08608000) as writeback
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
Setting address range [0xa0000000:0x00000000) as unmapped
Creating new subtable @0a0f4c00 for [0x00000000:0x00100000)
Setting address range [0x00000000:0x00000400) as unmapped
Setting up USB HOST1 controller.
Version = 5533270a
software reset done
USB Host mode reg = 101004
cbmem_add_vpd_calibration_data: added wifi_base64_calibration0 to CBMEM
cbmem_add_vpd_calibration_data: added wifi_base64_calibration1 to CBMEM
Root Device init finished in 532705 usecs
CPU_CLUSTER: 0 init ...
CPU: QCA 40xx
CPU_CLUSTER: 0 init finished in 3790 usecs
Devices initialized
Show all devs... After init.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
BS: BS_DEV_INIT times (us): entry 9 run 556864 exit 2
Finalize devices...
Devices finalized
BS: BS_POST_DEVICE times (us): entry 2 run 3788 exit 1
BS: BS_OS_RESUME_CHECK times (us): entry 2 run 5 exit 2
Writing coreboot table at 0x8724c000
rom_table_end = 0x8724c000
... aligned to 0x87250000
 0. 0000000080000000-000000008724bfff: RAM
 1. 000000008724c000-000000008727ffff: CONFIGURATION TABLES
 2. 0000000087280000-00000000874fffff: RAM
 3. 0000000087500000-0000000087ffffff: RESERVED
 4. 0000000088000000-000000009fffffff: RAM
Reading tristate GPIOs: 0 1 Z = 9 (binary_first base3 number system)
Board ID 9
Passing 5 GPIOs to payload:
            NAME |       PORT | POLARITY |     VALUE
       developer | 0x00000029 |      low |       low
        recovery | 0x00000039 |      low |       low
   write protect | 0x00000035 |      low |       low
           power |  undefined |      low |       low
             lid |  undefined |      low |      high
CBFS: 'VBOOT' located CBFS at [402000:42f240)
Wrote coreboot table at: 8724c000, 0x320 bytes, checksum 59ab
coreboot table: 824 bytes.
IMD ROOT    0. 8727f000 00001000
IMD SMALL   1. 8727e000 00001000
CONSOLE     2. 8725e000 00020000
TIME STAMP  3. 8725d000 00000400
VBOOT       4. 8725c000 00000c0c
VPD         5. 87254000 00007fec
WIFI CLBR   6. 8724e000 00005e94
COREBOOT    7. 8724c000 00002000
IMD small region:
  IMD ROOT    0. 8727ec00 00000400
  VBOOT SEL   1. 8727ebe0 00000008
BS: BS_WRITE_TABLES times (us): entry 2 run 120469 exit 3
CBFS: 'VBOOT' located CBFS at [402000:42f240)
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 1cec0 size 10341
Loading segment from rom address 0x87289428
  code (compression=1)
  New segment dstaddr 0x88104040 memsize 0x1249b70 srcaddr 0x87289460 filesize 0x10309
Loading segment from rom address 0x87289444
  Entry Point 0x88104041
Bounce Buffer at 9ffcf000, 197488 bytes
Loading Segment: addr: 0x0000000088104040 memsz: 0x0000000001249b70 filesz: 0x0000000000010309
lb: [0x00000000872e0000, 0x00000000872f81b8)
Post relocation: addr: 0x0000000088104040 memsz: 0x0000000001249b70 filesz: 0x0000000000010309
using LZMA
[ 0x88104040, 88121470, 0x8934dbb0) <- 87289460
Clearing Segment: addr: 0x0000000088121470 memsz: 0x000000000122c740
dest 88104040, end 8934dbb0, bouncebuffer 9ffcf000
Loaded segments
BS: BS_PAYLOAD_LOAD times (us): entry 2 run 175952 exit 2
Jumping to boot code at 88104041(8724c000)
CPU0: stack: 0a8fc000 - 0a900000, lowest used address 0a8ff5f0, stack used: 2576 bytes


Starting depthcharge on gale...
WARNING: can't convert coreboot GPIOs, 'lid' won't be resampled at runtime!
WARNING: can't convert coreboot GPIOs, 'power' won't be resampled at runtime!
clock_config_mmc : 1
WW_RING: initialized controller found at 0x32
WW_RING: initialized 1 out of 1
The GBB signature is at 0x88004020 and is:  24 47 42 42
Calling VbSelectAndLoadKernel().
TPM: TlclRead(0x1008, 13)
1.2 TPM (chip type slb9645tt device-id 0x1A)
TPM: command 0xcf returned 0x0
TPM: command 0x65 returned 0x0
TPM: RollbackKernelRead 10001
Entering VbBootNormal()
VbTryLoadKernel() start, get_info_flags=0x2
MMC version  = 10000042
clock_config_mmc : 1
clock_config_mmc : 2
Man 000011 Snr 2584915920 Product 004G60 Revision 0.2
VbTryLoadKernel() found 1 disks
VbTryLoadKernel() trying disk 0
GptNextKernelEntry looking at new prio partition 1
GptNextKernelEntry s1 t0 p1
GptNextKernelEntry likes partition 1
Found kernel entry at 34 size 32768
Checking key block signature...
   - sig_size=512, expecting 512 for algorithm 8
In RSAVerify(): Padding check failed!
In RSAVerify(): Hash check failed!
Invalid key block signature.
Verifying key block signature failed.
Marking kernel as invalid.
GptNextKernelEntry looking at new prio partition 1
GptNextKernelEntry s1 t0 p1
GptNextKernelEntry no more kernels
VbTryLoadKernel() LoadKernel() = 65552
VbSetRecoveryRequest(91)
Checking if TPM kernel version needs advancing
VbSelectAndLoadKernel() returning 65552
VbSelectAndLoadKernel returned 65552, Doing a cold reboot.
Exiting depthcharge with code 1 at timestamp: 9878544
�ebooting...

coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 bootblock starting...
Exception handlers installed.
Translation table is @ 0a0f0000
Mapping address range [0x00000000:0x00000000) as uncached
Creating new subtable @0a0f4000 for [0x0a000000:0x0a100000)
Mapping address range [0x0a0c0000:0x0a100000) as writeback
Creating new subtable @0a0f4400 for [0x0a800000:0x0a900000)
Mapping address range [0x0a8c0000:0x0a900000) as writeback
Creating new subtable @0a0f4800 for [0x08600000:0x08700000)
Mapping address range [0x08600000:0x08608000) as writeback
Setting address range [0x80000000:0xa0000000) as unmapped
Setting address range [0x87300000:0x87500000) as unmapped
Setting address range [0xa0000000:0x00000000) as unmapped
Creating new subtable @0a0f4c00 for [0x00000000:0x00100000)
Setting address range [0x00000000:0x00000400) as unmapped
No uber-sbl parameter detected
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
VBOOT: Loading verstage.
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'fallback/verstage'
CBFS: Found @ offset 1cf40 size 987c


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 verstage starting...
Exception handlers installed.
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
FMAP: Found "FMAP" version 1.0 at 300000.
FMAP: base = 0 size = 800000 #areas = 24
FMAP: area RW_NVRAM found @ 6f0000 (65536 bytes)
tis_init: ValidSts bit set(1) in TPM_ACCESS register after 8 ms
1.2 TPM (chip type slb9645tt device-id 0x1A)
TPM: Startup
TPM: command 0x99 returned 0x0
TPM: Asserting physical presence
TPM: command 0x4000000a returned 0x0
TPM: command 0x65 returned 0x0
TPM: flags disable=0, deactivated=0, nvlocked=1
setup_tpm():320: TPM: SetupTPM() succeeded
TPM: tlcl_read(0x1007, 10)
TPM: command 0xcf returned 0x0
Reading tristate GPIOs: 0 1 Z = 9 (binary_first base3 number system)
Board ID 9
WW_RING: initialized 1 out of 1
Phase 1
FMAP: area GBB found @ 301000 (913152 bytes)
VB2:vb2_check_recovery() Recovery reason from previous boot: 0x5b / 0x0
VB2:vb2_check_recovery() We have a recovery request: 0x5b / 0x0
Recovery requested (1009000e)
Saving nvdata
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
TPM: command 0x14 returned 0x0
TPM: command 0x14 returned 0x0
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 80 size 469b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 romstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'cdt.mbn'
CBFS: Found @ offset bb40 size 1ac
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'ddr.mbn'
CBFS: Found @ offset bd40 size 7d38
DDR version private build initialized
SDI Entry: 0x860038d
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
CBMEM:
IMD: root @ 8727f000 254 entries.
IMD: root @ 8727ec00 62 entries.
creating vboot_handoff structure
Reading tristate GPIOs: 0 1 Z = 9 (binary_first base3 number system)
Board ID 9
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'fallback/ramstage'
CBFS: Found @ offset 4780 size 6f3b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 ramstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
FMAP: Found "FMAP" version 1.0 at 300000.
FMAP: base = 0 size = 800000 #areas = 24
FMAP: area RO_VPD found @ 3e0000 (131072 bytes)
FMAP: area RW_VPD found @ 6e0000 (32768 bytes)
FMAP: area RO_VPD found @ 3e0000 (131072 bytes)
FMAP: area RW_VPD found @ 6e0000 (32768 bytes)
Exception handlers installed.
BS: BS_PRE_DEVICE times (us): entry 9 run 15 exit 9
BS: BS_DEV_INIT_CHIPS times (us): entry 9 run 29 exit 9
Enumerating buses...
Show all devs... Before device enumeration.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
Compare with tree...
Root Device: enabled 1
 CPU_CLUSTER: 0: enabled 1
Root Device scanning...
root_dev_scan_bus for Root Device
CPU_CLUSTER: 0 enabled
root_dev_scan_bus for Root Device done
scan_bus: scanning of bus Root Device took 12397 usecs
done
BS: BS_DEV_ENUMERATE times (us): entry 10 run 37281 exit 10
Allocating resources...
Reading resources...
Root Device read_resources bus 0 link: 0
Root Device read_resources bus 0 link: 0 done
Done reading resources.
Show resources in subtree (Root Device)...After reading.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0
  CPU_CLUSTER: 0 resource base 80000000 size 7500000 align 0 gran 0 limit 0 flags e0004200 index 0
  CPU_CLUSTER: 0 resource base 87500000 size b00000 align 0 gran 0 limit 0 flags f0004200 index 1
  CPU_CLUSTER: 0 resource base 88000000 size 18000000 align 0 gran 0 limit 0 flags e0004200 index 2
Setting resources...
Root Device assign_resources, bus 0 link: 0
CPU_CLUSTER: 0 missing set_resources
Root Device assign_resources, bus 0 link: 0
Done setting resources.
Show resources in subtree (Root Device)...After assigning values.
 Root Device child on link 0 CPU_CLUSTER: 0
  CPU_CLUSTER: 0
  CPU_CLUSTER: 0 resource base 80000000 size 7500000 align 0 gran 0 limit 0 flags e0004200 index 0
  CPU_CLUSTER: 0 resource base 87500000 size b00000 align 0 gran 0 limit 0 flags f0004200 index 1
  CPU_CLUSTER: 0 resource base 88000000 size 18000000 align 0 gran 0 limit 0 flags e0004200 index 2
Done allocating resources.
BS: BS_DEV_RESOURCES times (us): entry 9 run 120239 exit 9
Enabling resources...
done.
BS: BS_DEV_ENABLE times (us): entry 9 run 2982 exit 9
Initializing devices...
Root Device init ...
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'tzbsp_no_xpu.mbn'
CBFS: Found @ offset 13ac0 size 9428
Starting TZBSP
Translation table is @ 0a0f0000
Mapping address range [0x00000000:0x00000000) as uncached
Creating new subtable @0a0f4000 for [0x0a000000:0x0a100000)
Mapping address range [0x0a0c0000:0x0a100000) as writeback
Creating new subtable @0a0f4400 for [0x0a800000:0x0a900000)
Mapping address range [0x0a8c0000:0x0a900000) as writeback
Creating new subtable @0a0f4800 for [0x08600000:0x08700000)
Mapping address range [0x08600000:0x08608000) as writeback
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
Setting address range [0xa0000000:0x00000000) as unmapped
Creating new subtable @0a0f4c00 for [0x00000000:0x00100000)
Setting address range [0x00000000:0x00000400) as unmapped
Setting up USB HOST1 controller.
Version = 5533270a
software reset done
USB Host mode reg = 101004
cbmem_add_vpd_calibration_data: added wifi_base64_calibration0 to CBMEM
cbmem_add_vpd_calibration_data: added wifi_base64_calibration1 to CBMEM
Root Device init finished in 537743 usecs
CPU_CLUSTER: 0 init ...
CPU: QCA 40xx
CPU_CLUSTER: 0 init finished in 3792 usecs
Devices initialized
Show all devs... After init.
Root Device: enabled 1
CPU_CLUSTER: 0: enabled 1
BS: BS_DEV_INIT times (us): entry 9 run 561893 exit 3
Finalize devices...
Devices finalized
BS: BS_POST_DEVICE times (us): entry 2 run 3788 exit 2
BS: BS_OS_RESUME_CHECK times (us): entry 2 run 4 exit 1
Writing coreboot table at 0x8724c000
rom_table_end = 0x8724c000
... aligned to 0x87250000
 0. 0000000080000000-000000008724bfff: RAM
 1. 000000008724c000-000000008727ffff: CONFIGURATION TABLES
 2. 0000000087280000-00000000874fffff: RAM
 3. 0000000087500000-0000000087ffffff: RESERVED
 4. 0000000088000000-000000009fffffff: RAM
Reading tristate GPIOs: 0 1 Z = 9 (binary_first base3 number system)
Board ID 9
Passing 5 GPIOs to payload:
            NAME |       PORT | POLARITY |     VALUE
       developer | 0x00000029 |      low |       low
        recovery | 0x00000039 |      low |       low
   write protect | 0x00000035 |      low |       low
           power |  undefined |      low |       low
             lid |  undefined |      low |      high
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
Wrote coreboot table at: 8724c000, 0x320 bytes, checksum 4bfe
coreboot table: 824 bytes.
IMD ROOT    0. 8727f000 00001000
IMD SMALL   1. 8727e000 00001000
CONSOLE     2. 8725e000 00020000
TIME STAMP  3. 8725d000 00000400
VBOOT       4. 8725c000 00000c0c
VPD         5. 87254000 00007fec
WIFI CLBR   6. 8724e000 00005e94
COREBOOT    7. 8724c000 00002000
IMD small region:
  IMD ROOT    0. 8727ec00 00000400
  VBOOT SEL   1. 8727ebe0 00000008
BS: BS_WRITE_TABLES times (us): entry 2 run 124480 exit 2
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'fallback/payload'
CBFS: Found @ offset 26800 size 10341
Loading segment from rom address 0x87289428
  code (compression=1)
  New segment dstaddr 0x88104040 memsize 0x1249b70 srcaddr 0x87289460 filesize 0x10309
Loading segment from rom address 0x87289444
  Entry Point 0x88104041
Bounce Buffer at 9ffcf000, 197488 bytes
Loading Segment: addr: 0x0000000088104040 memsz: 0x0000000001249b70 filesz: 0x0000000000010309
lb: [0x00000000872e0000, 0x00000000872f81b8)
Post relocation: addr: 0x0000000088104040 memsz: 0x0000000001249b70 filesz: 0x0000000000010309
using LZMA
[ 0x88104040, 88121470, 0x8934dbb0) <- 87289460
Clearing Segment: addr: 0x0000000088121470 memsz: 0x000000000122c740
dest 88104040, end 8934dbb0, bouncebuffer 9ffcf000
Loaded segments
BS: BS_PAYLOAD_LOAD times (us): entry 2 run 180512 exit 2
Jumping to boot code at 88104041(8724c000)
CPU0: stack: 0a8fc000 - 0a900000, lowest used address 0a8ff6a0, stack used: 2400 bytes


Starting depthcharge on gale...
WARNING: can't convert coreboot GPIOs, 'lid' won't be resampled at runtime!
WARNING: can't convert coreboot GPIOs, 'power' won't be resampled at runtime!
clock_config_mmc : 1
WW_RING: initialized controller found at 0x32
WW_RING: initialized 1 out of 1
The GBB signature is at 0x88004020 and is:  24 47 42 42
Wipe memory regions:
	[0x00000080000000, 0x00000080208000)
	[0x00000080208200, 0x0000008724c000)
	[0x00000087280000, 0x00000087500000)
	[0x0000008934dbb0, 0x0000009ff00000)
Initializing XHCI USB controller at 0x8a00000.
Calling VbSelectAndLoadKernel().
TPM: TlclRead(0x1008, 13)
1.2 TPM (chip type slb9645tt device-id 0x1A)
TPM: command 0xcf returned 0x0
TPM: command 0x65 returned 0x0
TPM: RollbackKernelRead 10001
VbBootRecovery() start
VbBootRecovery() saving recovery reason (0x5b)
VbSetRecoverySubcode(91)
ww_ring_display_screen: did not find program for screen 520
VbBootRecovery() waiting for manual recovery

Does anyone know how to cope with the the next steps? I guess I need to fix uboot or here it's called coreboot and then reflash OEM

2

@suppenkasper0815 Your problems sound completely unrelated. I'd suggest starting a new thread.

3

Thanks for the splitting.

Can you help to understand what is best for doing next?

I think I need to Flash something via serial. I built a CCD cable to get already the log files

4

How'd you get your device in that shape? Were you running flashrom commands? Have you tried running the factory reset, like described on the wiki?

I've never seen this particular symptom, but it kinda looks like your boot flash (SPI flash) is corrupted, or some other hardware issue. I'd first suggest seeing if factory reset can help you. Although if you can't get the Recovery disk to boot either, then that won't help.

If it really comes to it, it's possible you could reprogram the SPI flash, now that you have a SuzyQable for CCD. That's not a trivial process, but if you want to go for it: for starters, you'll need some of the ChromiumOS tools. See the docs: https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md#using-ccd

You'll need the futility tool from the ChromiumOS SDK, and possibly servod too. See the firmware flashing notes.

You can pull an image.bin from the recovery image (instructions; you have to pull the usr/sbin/chromeos-firmwareupdate file off the USB image).

Good luck. No guarantees anything will help, but maybe I can provide some more details if you really want to try all that and you get stuck.

1 Like
5

I'll try.

I don't know how this device got into that shape.

Do I need windows for chromeostools? Usually I operate my laptop with Ubuntu 20.04.

I would try to reanimate the device.

I tried already every factory restore procedure unsuccessful (unlikely)...

It still comes to the orange blinking point but don't start taking the image of the stick.

If you look into that logfile it makes sense because it stuck somehow during boot process.

I bought the device for 10€ in that condition...

6

Those tools are Linux only, in fact. Ubuntu should be fine.

If you bought it that way, then I'm not sure if it's more likely a software (reflashing) problem or a deeper hardware one. But I guess you can give it a try.

7

OK, I read that article and it seems it's for Ubuntu 18.04 optimized, but do you really think I need all of this stuff to fix coreboot? I think I need a new partition table and a clean boot, from there I should be able to proceed with the rescue method.

Have you any experience with that or idea if it makes sense with a T510 Laptop 8GB RAM?

8

Ubuntu 20.04 should also be totally fine. They list a specific (older) version just to list something, but many distributions should work.

You don't technically need everything that the ChromiumOS SDK is going to give you, but it's not always easy to get just one or two tools. Just getting the SDK and futility and/or servod working should be OK on your laptop. (So, you can probably stop at around the enter the chroot step in the Developer Guide.)

If you want to go out on a limb, you might be able to just get the futility tool working out of here: https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/refs/heads/main
The dependencies aren't very extensive. But I've never tried that approach, so I'm not sure what pitfalls you might hit.

9

Hey,

I am still struggeling with the preconditions. I have pyenv and depot_tools installed (as far I can see). Do I need to create an GIT-Account for the next stepts and are you sure I can stop at the

-Section?

I think after that there is the information about the board which should be "gale" for our device to get to final steps.

If I get

working, what are the next steps in your optionen or how can I recreate the table, because I guess my table is smashed if you check the log files again.

10

I'm pretty sure you can stop there. You don't need to build the "gale" board. You might need to install the two tools, but I think they should already be ready:

sudo emerge hdctools vboot_reference

I'm still guessing at your problem, so no guarantee it works: but you want to grab the recovery image I pointed at before, find the chromeos-firmwareupdate file on it, then follow the instructions to extract your image.bin. Something like:

usr/sbin/chromeos-firmwareupdate --unpack .
## you should now have an image.bin file

## Remove the write-protect screw.
## You may have already done that by now?

## Flash image.bin via CCD:
sudo futility update --ccd -i image.bin
1 Like
11

Hey @bnorris , thanks again for your big support! - Unfortunately I wasn't able to hit the goal so far... There were unfortunately a lot of trouble ongoing in my life. - Anyway...

Would you mind to give me a short "check-list" for the necessary steps in your opinion and maybe the part of the description to follow. - I installed already a few things, but got stuck at some point.

What I guess to do:

  1. Bootloader seems to be still ok
  2. Partition table seems to be broken and I need to start with a working partition table, but without deleting the "ART" or "radio" partition, because usually there are unique data parts on it.
  3. Backup a few things including "ART" partition.
  4. Reflash the Recovery-Image with the USB-Stick

Would love if we could find an instruction for an "unbreakable" Google Wifi device! :wink:

Please be patient with a rookie-developer. :slight_smile:

12

Hey @bnorris ,

could you please help me with getting the "usr/sbin/chromeos-firmwareupdate"-Image.bin?

Can't we extract it from somewhere else? - I somehow get stucked in the part where I need to checkout something in my git-account with the instructions

lex@alex-ThinkPad-T510:~/chromiumos$ git config --global user.name "suppenkapser0815"
alex@alex-ThinkPad-T510:~/chromiumos$ repo init -u https://chromium.googlesource.com/chromiumos/manifest -b stable
repo: reusing existing repo client checkout in /home/alex/chromiumos

Testing colorized output (for 'repo diff', 'repo status'):
  black    red      green    yellow   blue     magenta   cyan     white 
  bold     dim      ul       reverse 
Enable color display in this user account (y/N)? 

repo has been initialized in /home/alex/chromiumos
alex@alex-ThinkPad-T510:~/chromiumos$ repo sync -j4
Updating depot_tools...
depot_tools update failed. Conflict in /home/alex/depot_tools
error: Ihre lokalen Änderungen in den folgenden Dateien würden beim Auschecken
überschrieben werden:
	repo_launcher
Bitte committen oder stashen Sie Ihre Änderungen, bevor Sie Branches
wechseln.
Abbruch
Traceback (most recent call last):
  File "/home/alex/depot_tools/repo", line 58, in <module>
    sys.exit(main(sys.argv[1:]))
  File "/home/alex/depot_tools/repo", line 49, in main
    _UpdateDepotTools()
  File "/home/alex/depot_tools/repo", line 39, in _UpdateDepotTools
    subprocess.run([UPDATE_DEPOT_TOOLS], check=True)
  File "/usr/lib/python3.8/subprocess.py", line 516, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '[PosixPath('/home/alex/depot_tools/update_depot_tools')]' returned non-zero exit status 1.
alex@alex-ThinkPad-T510:~/chromiumos$ git stash push
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
alex@alex-ThinkPad-T510:~/chromiumos$ git stash
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
alex@alex-ThinkPad-T510:~/chromiumos$ git stash apply
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git
alex@alex-ThinkPad-T510:~/chromiumos$ git clean -d -n
fatal: Kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git

It still sounds easy, so I think I "just" need futility and the bin file like you already said...

So can it not be possible to get any mm further with this maniac thing? - If you see again the two diffrent bootlogs you can clearly see that the firt part of "root" is still working, but the second line with "root ... lines" is not working on the defective device.

So I think what happend is that during flashing there was a power cut and the device is stuck beetween OEM and OpenWRT.

Update

I got the following bin file from the device page where you get the link for a factory recovery image. - So maybe we just need "futility".

chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin

New Update

I found out that futility is part of vboot-kernel-utils and can be directly installed by

sudo apt-get install vboot-kernel-utils

So, here is my try:

alex@alex-ThinkPad-T510:~/Downloads$ sudo futility update --ccd -i chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
ERROR: load_firmware_image: Invalid image file (missing FMAP): chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin

I also tried pre-compiled images from here:

pre-compiled images

alex@alex-ThinkPad-T510:~/Downloads$ sudo futility update --ccd -i gale.bin
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
Found FMAP, but major version is 0 instead of 1
ERROR: load_firmware_image: Invalid image file (missing FMAP): gale.bin

Information about futility:

alex@alex-ThinkPad-T510:~/Downloads$ sudo futility 

Usage: futility [options] COMMAND [args...]

This is the unified firmware utility, which will eventually replace
most of the distinct verified boot tools formerly produced by the
vboot_reference package.

When symlinked under the name of one of those previous tools, it should
fully implement the original behavior. It can also be invoked directly
as futility, followed by the original name as the first argument.

Global options:

  --vb1        Use only vboot v1.0 binary formats
  --vb21       Use only vboot v2.1 binary formats
  --debug      Be noisy about what's going on

The following commands are built-in:

  create               Create a keypair from an RSA .pem file
  dump_fmap            Display FMAP contents from a firmware image
  dump_kernel_config   Prints the kernel command line
  gbb                  Manipulate the Google Binary Block (GBB)
  gbb_utility          Legacy name for `gbb` command
  help                 Show a bit of help (you're looking at it)
  load_fmap            Replace the contents of specified FMAP areas
  pcr                  Simulate a TPM PCR extension operation
  show                 Display the content of various binary components
  sign                 Sign / resign various binary components
  update               Update system firmware
  validate_rec_mrc     Validates content of Recovery MRC cache
  vbutil_firmware      Verified boot firmware utility
  vbutil_kernel        Creates, signs, and verifies the kernel partition
  vbutil_key           Wraps RSA keys with vboot headers
  vbutil_keyblock      Creates, signs, and verifies a keyblock
  verify               Verify the signatures of various binary components
  version              Show the futility source revision and build date

Use "futility help COMMAND" for more information.

Some more try by holding the reset-button of the device:

wipeout requested, checking recovery
recovery requested
Phase 1
FMAP: area GBB found @ 301000 (913152 bytes)
VB2:vb2_check_recovery() Recovery reason from previous boot: 0x0 / 0x0
VB2:vb2_check_recovery() Recovery was requested manually
VB2:vb2_check_recovery() We have a recovery request: 0x2 / 0x0
Recovery requested (1009000e)
TPM: command 0x14 returned 0x0
TPM: command 0x14 returned 0x0
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'fallback/romstage'
CBFS: Found @ offset 80 size 469b


coreboot-60d1b1c Mon Jan  9 00:04:49 UTC 2017 romstage starting...
SF: Detected W25Q64 with sector size 0x1000, total 0x800000
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'cdt.mbn'
CBFS: Found @ offset bb40 size 1ac
CBFS @ 20000 size 2e0000
CBFS: 'Master Header Locator' located CBFS at [20000:300000)
CBFS: Locating 'ddr.mbn'
CBFS: Found @ offset bd40 size 7d38
DDR version private build initialized
SDI Entry: 0x860038d
Mapping address range [0x80000000:0xa0000000) as writeback
Mapping address range [0x87300000:0x87500000) as uncached
CBMEM:
IMD: root @ 8727f000 254 entries.
failed.

I gues this error and reson can be found somewhere here source code of updater.c

13

First off, I'm kinda doubting this all will really get you anywhere, but given you want to keep bashing your head on this, I'll humor you:

I think you skipped a step in here. I'll paste what I said:

Particularly, you missed the "find the chromeos-firmwareupdate file" step.

In greater detail, here is what I did, line by line:

# Download the recovery image
wget https://dl.google.com/dl/edgedl/chromeos/recovery/chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin.zip

# Unzip it
unzip chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin.zip

# Set up a loopback device, to get a look at its partitions.
sudo losetup -f -P --show chromeos_9334.41.3_gale_recovery_stable-channel_mp.bin
# This will print out something like "/dev/loop0"; use this output in the next few steps.

# Create a mount-point directory.
mkdir mnt
# Mount the root filesystem partition.
sudo mount -o ro /dev/loop0p3 mnt

# Here's the chromeos-firmwareupdate file.
# It can unpack things to your current directory.
mnt/usr/sbin/chromeos-firmwareupdate --sb_extract .

# Clean things up.
sudo umount mnt
sudo losetup -d /dev/loop0

# Here's your BIOS file. (It's the same as "image.bin".)
ls bios.bin
1 Like
14

did you ever resolve the issue? I have about 70 AC-1304s and I have two that came exactly the same way, just flash orange, wont take the recovery image. I was just curious about the issue, id rather throw them in the trash than beat my head against a wall though, or stick them in grandmas house running factory firmware.