How to resolve a Librem 14 not booting (librem EC firmware crash) [QubesOS]

Hardware
1

This is a summary of a problem I had. I aim to make the purism customer support’s life easier by explaining this issue and its solution here.

TL;DR

Follow these steps at your own risk, I cannot guarantee that your issue is the one I had, too:

  1. disconnect your battery’s cable inside the laptop for a few seconds
  2. open a recovery shell in PureBoot and set the time to UTC:
    date -s 'YYYY-mm-dd HH:MM:SS'
hwclock -w
    Replace 'YYYY-mm-dd HH:MM:SS' with UTC time.
  3. generate a new secret for your Librem key via PureBoot

Explanation

I am running QubesOS 4.0.
Yesterday morning my Librem 14 would not boot. I had powered it off via the GUI button the evening before, nothing unusual. I was using an external display for work (just mentioning in case this is of importance). Loading the battery and attaching / removing the power cord did not change anything. Not even the keyboard LEDs went bright. However my killswitches’ LEDs were in fact working and responding.
At this point I contacted the purism customer support.
I was advised to open my Librem 14’s back and removing the battery’s cable for a couple of seconds, because my laptop could have had a librem EC firmware crash.

The battery cable was the one coming out of the battery (obviously) and consisted out of three black, three red and two other small cables. It was located on the left when having the laptop laying in front of you on its face (With the display hinge facing away from you):

+============+  <- display hinge
|            |
| X[battery] |
+------------+

    (-_-)       <- You

where X signifies the cable’s location.

After having reinserted the cable (carefully to not damage a nearby transistor), I could boot again, however my time was reset.

In PureBoot it was the first of January 1970 (that’s when time started) and in QubesOS I was set back for a few weeks. This could be resolved by running the following in a PureBoot recovery shell:

date -s 'YYYY-mm-dd HH:MM:SS'
hwclock -w

where

  • YYYY is the current year (eg. 2021)
  • mm is the current month (eg. 11)
  • dd is the current day (eg. 05)
  • HH is the current hour (eg. 13)
  • MM is the current minute (eg. 37)
  • SS is the current number of seconds (eg. 01)

The date and time entered needs to be in UTC.

After that my time was correct, but my Librem key could not check the signature anymore. This was to be expected, because a TOTP is a “Time Based One Time Password”. This could be fixed by regenerating the Librem key’s secret via the PureBoot option.

Now everything works again. Thanks to the purism customer support for having lightning fast response times and putting a tremendous effort into helping customers fix their issues.

1 Like
2

I recently had the same problem again, worked just fine again, I just needed to sign all files in /boot, which is not in the TL;DR which can be misleading.