Fairphone 4 bricked by locking bootloader

[BartMans]

I decided to update de FP4 from Android 11 to 12 with the offline method connecting it to my linux pc.
Now it is bricked!
It boots in fastboot. Device state: locked. First time when the fp4 booted to the system I saw: “system currupt”.

What I did before this happened:

• ADB reboot bootloader
• fastboot flashing unlock
  -fastboot flashing unlock_critical
  Then I booted to fastboot: Boot to fastboot
  The FP4 was unlocked.

Then I installed the update following this: offline method

After that, because of all the warnings about security I first let the FP4 boot in the system. Then enabled usb debugging. and booted to fastboot again.

There I followed the howto to lock the FP4 again. unlock/lock bootloader

But unfortunately the FP4 won’t start again. It is locked in fastboot. Device state: locked.
If I try to unlock again:

fastboot flashing unlock  FAILED  (remote: 'Flashing Unlock is not allowed ')
        fastboot: error: Command failed

So I’m stuck here.

Is there any hope? I did already contact support, but did not yet get an answer. I hope someone here knows a solution to get out of this.

fastboot getvar all
(bootloader) parallel-download-flash:yes
(bootloader) hw-revision:10000
(bootloader) unlocked:no
(bootloader) off-mode-charge:0
(bootloader) charger-screen-enabled:0
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:4114
(bootloader) version-baseband:
(bootloader) version-bootloader:
(bootloader) erase-block-size: 0x1000
(bootloader) logical-block-size: 0x1000
(bootloader) variant:SM_ UFS
(bootloader) partition-type:modemst2:raw
(bootloader) partition-size:modemst2: 0x600000
(bootloader) partition-type:modemst1:raw
(bootloader) partition-size:modemst1: 0x600000
(bootloader) partition-type:tunning:raw
(bootloader) partition-size:tunning: 0x600000
(bootloader) partition-type:fsc:raw
(bootloader) partition-size:fsc: 0x20000
(bootloader) partition-type:fsg:raw
(bootloader) partition-size:fsg: 0x280000
(bootloader) partition-type:fpconfig:raw
(bootloader) partition-size:fpconfig: 0x20000
(bootloader) partition-type:fpconfig_persist:raw
(bootloader) partition-size:fpconfig_persist: 0x20000
(bootloader) partition-type:traceability:raw
(bootloader) partition-size:traceability: 0x100000
(bootloader) partition-type:ALIGN_TO_128K_2:raw
(bootloader) partition-size:ALIGN_TO_128K_2: 0x1A000
(bootloader) partition-type:swversion:raw
(bootloader) partition-size:swversion: 0x20000
(bootloader) partition-type:oembin:raw
(bootloader) partition-size:oembin: 0x400000
(bootloader) partition-type:catecontentfv:raw
(bootloader) partition-size:catecontentfv: 0x100000
(bootloader) partition-type:catefv:raw
(bootloader) partition-size:catefv: 0x80000
(bootloader) partition-type:secdata:raw
(bootloader) partition-size:secdata: 0x7000
(bootloader) partition-type:uefivarstore:raw
(bootloader) partition-size:uefivarstore: 0x80000
(bootloader) partition-type:storsec:raw
(bootloader) partition-size:storsec: 0x20000
(bootloader) partition-type:logdump:raw
(bootloader) partition-size:logdump: 0x4000000
(bootloader) partition-type:cateloader:raw
(bootloader) partition-size:cateloader: 0x200000
(bootloader) partition-type:logfs:raw
(bootloader) partition-size:logfs: 0x800000
(bootloader) partition-type:toolsfv:raw
(bootloader) partition-size:toolsfv: 0x100000
(bootloader) partition-type:limits-cdsp:raw
(bootloader) partition-size:limits-cdsp: 0x1000
(bootloader) partition-type:limits:raw
(bootloader) partition-size:limits: 0x1000
(bootloader) partition-type:splash:raw
(bootloader) partition-size:splash: 0x20A4000
(bootloader) partition-type:spunvm:raw
(bootloader) partition-size:spunvm: 0x800000
(bootloader) partition-type:apdp:raw
(bootloader) partition-size:apdp: 0x40000
(bootloader) partition-type:dip:raw
(bootloader) partition-size:dip: 0x100000
(bootloader) partition-type:devinfo:raw
(bootloader) partition-size:devinfo: 0x1000
(bootloader) partition-type:fsgbk_b:raw
(bootloader) partition-size:fsgbk_b: 0x280000
(bootloader) partition-type:core_nhlos_b:raw
(bootloader) partition-size:core_nhlos_b: 0xAA00000
(bootloader) partition-type:uefisecapp_b:raw
(bootloader) partition-size:uefisecapp_b: 0x200000
(bootloader) partition-type:imagefv_b:raw
(bootloader) partition-size:imagefv_b: 0x200000
(bootloader) partition-type:featenabler_b:raw
(bootloader) partition-size:featenabler_b: 0x20000
(bootloader) partition-type:dtbo_b:raw
(bootloader) partition-size:dtbo_b: 0x1800000
(bootloader) partition-type:vbmeta_b:raw
(bootloader) partition-size:vbmeta_b: 0x10000
(bootloader) partition-type:vbmeta_system_b:raw
(bootloader) partition-size:vbmeta_system_b: 0x10000
(bootloader) partition-type:recovery_b:raw
(bootloader) partition-size:recovery_b: 0x6000000
(bootloader) partition-type:qupfw_b:raw
(bootloader) partition-size:qupfw_b: 0x14000
(bootloader) partition-type:devcfg_b:raw
(bootloader) partition-size:devcfg_b: 0x20000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x6000000
(bootloader) partition-type:keymaster_b:raw
(bootloader) partition-size:keymaster_b: 0x80000
(bootloader) partition-type:dsp_b:raw
(bootloader) partition-size:dsp_b: 0x4000000
(bootloader) partition-type:abl_b:raw
(bootloader) partition-size:abl_b: 0x100000
(bootloader) partition-type:mdtp_b:raw
(bootloader) partition-size:mdtp_b: 0x2000000
(bootloader) partition-type:mdtpsecapp_b:raw
(bootloader) partition-size:mdtpsecapp_b: 0x400000
(bootloader) partition-type:bluetooth_b:raw
(bootloader) partition-size:bluetooth_b: 0x200000
(bootloader) partition-type:modem_b:raw
(bootloader) partition-size:modem_b: 0xC300000
(bootloader) partition-type:hyp_b:raw
(bootloader) partition-size:hyp_b: 0x80000
(bootloader) partition-type:multiimgoem_b:raw
(bootloader) partition-size:multiimgoem_b: 0x8000
(bootloader) partition-type:tz_b:raw
(bootloader) partition-size:tz_b: 0x400000
(bootloader) partition-type:aop_b:raw
(bootloader) partition-size:aop_b: 0x80000
(bootloader) partition-type:questdatafv:raw
(bootloader) partition-size:questdatafv: 0x1000000
(bootloader) partition-type:fsgbk_a:raw
(bootloader) partition-size:fsgbk_a: 0x280000
(bootloader) partition-type:featenabler_a:raw
(bootloader) partition-size:featenabler_a: 0x20000
(bootloader) partition-type:core_nhlos_a:raw
(bootloader) partition-size:core_nhlos_a: 0xAA00000
(bootloader) partition-type:uefisecapp_a:raw
(bootloader) partition-size:uefisecapp_a: 0x200000
(bootloader) partition-type:imagefv_a:raw
(bootloader) partition-size:imagefv_a: 0x200000
(bootloader) partition-type:dtbo_a:raw
(bootloader) partition-size:dtbo_a: 0x1800000
(bootloader) partition-type:vbmeta_a:raw
(bootloader) partition-size:vbmeta_a: 0x10000
(bootloader) partition-type:vbmeta_system_a:raw
(bootloader) partition-size:vbmeta_system_a: 0x10000
(bootloader) partition-type:recovery_a:raw
(bootloader) partition-size:recovery_a: 0x6000000
(bootloader) partition-type:qupfw_a:raw
(bootloader) partition-size:qupfw_a: 0x14000
(bootloader) partition-type:devcfg_a:raw
(bootloader) partition-size:devcfg_a: 0x20000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x6000000
(bootloader) partition-type:keymaster_a:raw
(bootloader) partition-size:keymaster_a: 0x80000
(bootloader) partition-type:dsp_a:raw
(bootloader) partition-size:dsp_a: 0x4000000
(bootloader) partition-type:abl_a:raw
(bootloader) partition-size:abl_a: 0x100000
(bootloader) partition-type:mdtp_a:raw
(bootloader) partition-size:mdtp_a: 0x2000000
(bootloader) partition-type:mdtpsecapp_a:raw
(bootloader) partition-size:mdtpsecapp_a: 0x400000
(bootloader) partition-type:bluetooth_a:raw
(bootloader) partition-size:bluetooth_a: 0x200000
(bootloader) partition-type:modem_a:raw
(bootloader) partition-size:modem_a: 0xC300000
(bootloader) partition-type:hyp_a:raw
(bootloader) partition-size:hyp_a: 0x80000
(bootloader) partition-type:multiimgoem_a:raw
(bootloader) partition-size:multiimgoem_a: 0x8000
(bootloader) partition-type:tz_a:raw
(bootloader) partition-size:tz_a: 0x400000
(bootloader) partition-type:aop_a:raw
(bootloader) partition-size:aop_a: 0x80000
(bootloader) partition-type:ALIGN_TO_128K_4:raw
(bootloader) partition-size:ALIGN_TO_128K_4: 0x1A000
(bootloader) partition-type:ddr:raw
(bootloader) partition-size:ddr: 0x100000
(bootloader) partition-type:cdt:raw
(bootloader) partition-size:cdt: 0x20000
(bootloader) partition-type:ALIGN_TO_128K_1:raw
(bootloader) partition-size:ALIGN_TO_128K_1: 0x1A000
(bootloader) partition-type:xbl_config_b:raw
(bootloader) partition-size:xbl_config_b: 0x20000
(bootloader) partition-type:xbl_b:raw
(bootloader) partition-size:xbl_b: 0x380000
(bootloader) partition-type:xbl_config_a:raw
(bootloader) partition-size:xbl_config_a: 0x20000
(bootloader) partition-type:xbl_a:raw
(bootloader) partition-size:xbl_a: 0x380000
(bootloader) partition-type:userdata:f2fs
(bootloader) partition-size:userdata: 0x377E72E000
(bootloader) partition-type:super:raw
(bootloader) partition-size:super: 0x180000000
(bootloader) partition-type:rawdump:raw
(bootloader) partition-size:rawdump: 0x20CCCD000
(bootloader) partition-type:oempersist:raw
(bootloader) partition-size:oempersist: 0xC800000
(bootloader) partition-type:metadata:ext4
(bootloader) partition-size:metadata: 0x1DE0000
(bootloader) partition-type:frp:raw
(bootloader) partition-size:frp: 0x80000
(bootloader) partition-type:keystore:raw
(bootloader) partition-size:keystore: 0x80000
(bootloader) partition-type:misc:raw
(bootloader) partition-size:misc: 0x100000
(bootloader) partition-type:persist:raw
(bootloader) partition-size:persist: 0x2000000
(bootloader) partition-type:ssd:raw
(bootloader) partition-size:ssd: 0x2000
(bootloader) partition-type:ALIGN_TO_128K_3:raw
(bootloader) partition-size:ALIGN_TO_128K_3: 0x18000
(bootloader) has-slot:modem:yes
(bootloader) has-slot:system:no
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:7
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:no
(bootloader) slot-retry-count:a:6
(bootloader) slot-unbootable:a:yes
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2
(bootloader) secure:yes
(bootloader) serialno:fc3df61d
(bootloader) product:FP4
(bootloader) snapshot-update-status:none
(bootloader) is-userspace:no
(bootloader) max-download-size:805306368
(bootloader) kernel:uefi
all: 
Finished. Total time: 0.014s

[Lidwien]

Did you make sure that fastboot flashing get_unlock_ability_ gave 1 beforehand locking the phone?

[const]

It’s a known and common problem for custom ROMs, but in this case, it looks like you weren’t doing anything custom, and were just following official instructions, even to the point of those instructions strongly suggesting that you relock the bootloader.

Fairphone should really put more warnings; they don’t even seem to have the checks mentioned in the thread above.

You’ll likely need to send your phone in physically to have this repaired, as Fairphone refuses to release the software necessary to fix this yourself, likely because of other design defects with the phone that would make releasing that software a security problem. They generally charge some amount for this service, but in this case, it would seem inappropriate considering you were following their instructions.

@Lidwien

Did you make sure that fastboot flashing get_unlock_ability_ gave 1 beforehand locking the phone?

Why would they have done that? It doesn’t appear to be mentioned anywhere in the official instructions from Fairphone, which they were following; it’s only mentioned on these forums, which, it is repeatedly pointed out, are unofficial. Certainly, it would have been better if they had known to run that, but here the fault appears to lie entirely with Fairphone, not the user, for not doing so, and it doesn’t seem right to suggest that they should have made sure of this beforehand.

[Lidwien]

@const

Why would they have done that? It doesn’t appear to be mentioned anywhere in the official instructions from Fairphone, which they were following.

If you check this and you get `fastboot flashing get_unlock_ability_’ 0 then never lock the phone, because it will brick the phone.

I didn’t wrote the instructions, so I don’t know if there is a warning.

[hirnsushi]

@BartMans

Then I installed the update following this: offline method

Those instructions aren’t meant for updates but for installing factory images, you could have just used the OTA update file without ever having to unlock your bootloader.

@BartMans

I first let the FP4 boot in the system.

Never boot the system before locking it, that will reset get_unlock_ability and make it impossible to unlock it again if something goes wrong.

@const

Why would they have done that? It doesn’t appear to be mentioned anywhere in the official instructions from Fairphone, which they were following.

The official instructions are severly lacking and should have been updated long ago, if you follow them there is a good chance to brick the phone. I don’t think anyone touched those pages in almost a year.

[BartMans]

@Lidwien

Did you make sure that fastboot flashing get_unlock_ability_ gave 1 beforehand locking the phone?

No I did not check that, because I was not aware that this was important. I did not see that in the howto. - Optional: Lock your bootloader

[BartMans]

@hirnsushi

Those instructions aren’t meant for updates but for installing factory images, you could have just used the OTA update file without ever having to unlock your bootloader.

I was advised by support. Update OTA was not coming to my phone and this offline update was an option.
From the e-mail:

If that does not work, you could try to manually install the latest version of Fairphone OS on your Fairphone 4 yourself. Back up your data before proceeding.

If you have a different operating system, it will be replaced by Fairphone OS and your data will be lost. To do so follow the support article: Install Fairphone OS on your Fairphone 4 using a computer.

I just wanted to update my FP4 to Android 12. without waiting for the OTA. Never expected this to happen. Never had this kind of trouble with stock/custom roms on my older Samsung S9.

[hirnsushi]

Oooff, that’s an awful recommendation

I’m sorry you are in the situation you are in right now. As I see it the responsibility is absolutely on Fairphone’s side here, why were they thinking you won’t receive the update otherwise, and why would they suggest such a dangerous route in the first place?

Your way forward is to get support to send you shipping instructions as quickly as possible so your phone can get fixed by Cordon.

Maybe we’ll get updated support pages as well at some point, one can dream …

[yvmuell]

did they dare to ask you in which country you live and which provider you use? Def call them to speed things up and def don’t pay a cent for this.

Still I need to say, you should have known its a bad idea for other reasons, as you knew there are reasons you didnt get the A12 upgrade and only the A11 update.

Android 12 has come to the FP4

There were some KPN users who didn’t receive the update yet. Have you received another security update for Android 11? Then the release of Android 12 is definitely delayed for your provider. There are ways to force the update, easiest would be to switch SIM cards and trigger it. I wouldn’t recommend that this time, though. At least in Switzerland, there seem to be problems related to emergency calls and that’s likely a feature you don’t want to miss on your phone if you really need it.

Software update: FP4.FP4K.A.179.20230116

I don’t know how, but suddenly, a second ago, I receive an update FP4K.A.0179 Security level: 5 January 2023! I did send a message to support, this weekend. Not sure if they have had a hand in this.

[BartMans]

I just have to wait for a respons from support then, I’m afraid. Luckily I haven’t sold my old Samsung yet.

@yvmuell

Still I need to say, you should have known its a bad idea for other reasons, as you knew there are reasons you didnt get the A12 upgrade and only the A11 update.

I thought that I did not get this OTA Android 12 update because it was not OTA ready. But I did not see a reason why a full FP4-Android 12 image write would be a problem.
And as far as I understand, this update went ‘fine’, but the relock of the bootloader was the problem here. Or is this relock problem of the bootloader the reason that OTA was not coming through? I do not know how I could know that. I was following the instructions on the support pages.

[hirnsushi]

Oh …

@BartMans

I receive an update FP4K.A.0179 Security level: 5 January 2023!

… you were one of the people who had to stay on Android 11 for now because the provider still hasn’t signed off on the update.

Yeah, support definitely shouldn’t have advised you to do anything manually at all. I haven’t had my hands on the parallel A11 update you got, but I suspect it has a patch level that’s somehow incompatible with the A12 factory images you installed, which triggered rollback protection →

@BartMans

And as far as I understand, this update went ‘fine’, but the relock of the bootloader was the problem here. Or is this relock problem of the bootloader the reason that OTA was not coming through?

You didn’t update your phone, you flashed it back to factory and yes, locking the bootloader enables the safety features mentioned above, you would have been fine if you’d kept it unlocked.
The OTA update wasn’t coming through because you are not supposed to get it yet, it was working as intended.

[BartMans]

Is it normal to wait 11 days now for support to come back to me with a solution? Last thing I heard was:

To help you further with your request, I will need to ask for advice from the relevant department. As soon as we have an update, we will get back to you.

That was 22 of February.

[yvmuell]

yes more or less normal… You can maybe speed up by calling

[BartMans]

Today I finally got an answer fro support that they can fix my Fairphone 4 if I pay 34 euro’s.
They say that I missed a warning:

If you install an OS with an older security patch level than your previous 
OS, Android's roll-back protection might **brick** your device when locking 
the bootloader! Wait until you get a software update with the same or newer 
security patch level before locking the bootloader.

According to support:

The Android 11 software's security patch level is **05.01.23**.
The Android 12 software's security patch level is **05.12.22**.```

But it was absolutely not clear to me that Android 12 has a lower security patch level that Android 11.
I’m very disappointed in Fairphone here!

[yvmuell]

You should not accept this as it was their error to tell you to do it for various reasons. However, you have to talk to support, we cant help you with this.

[BartMans]

we cant help you with this

I know, but I like to hear your opinions in this. To check if I’m not wrong here.

[yvmuell]

No you arent wrong

Fairphone 4 bricked by locking bootloader

Oh … … you were one of the people who had to stay on Android 11 for now because the provider still hasn’t signed off on the update. Yeah, support definitely shouldn’t have advised you to do anything manually at all. I haven’t had my hands on the parallel A11 update you got, but I suspect it has a patch level that’s somehow incompatible with the A12 factory images you installed, which triggered rollback protection → You didn’t update your phone, you flashed it back to factory and yes…

[KurtF]

@BartMans

But it was absolutely not clear to me that Android 12 has a lower security patch level that Android 11.

I’m maybe dense, but “05.01.23” sounds lower to me than “05.12.22”, probably because I’m assuming the “01” and the “12” are higher level than the trailing “23” and “22”. As in version 1.23 vs. version 12.22.
Short version: Definitely not clear!

[yvmuell]

Those are dates not version numbers…

[KurtF]

OMG. I would never had guessed…