I tried with @z3ntu a while ago with just that option enabled and built without android environment, and that made the error disappear.
Are you sure you used the Image.gz-dtb?
3 Likes
I am pretty certain. I tried several things:
- image.gz-dtb (which is the image.gz with dtb’s concatenated)
- image.gz with manually concatenated dtb database created with dtbtool
- image.gz with separate dtb in .img - as created with fastboot with --dtb option
- image.gz with separate dtbo in .img - as created with fastboot with --dtbo option
- the same as 3 and 4 but with dtb database created with dtbtool
and a few combos with both dtb and dtbo in various combos. i never got past the dtb not found, but its possible i somehow missed the one working solution.
Since we didn’t know in which form arima aboot expects the dtb(o) we were looking into the serial uart debug outputs, to get some pointers, but you got it working before I could get a 1.8V uart converter put together
3 Likes
I think it needs one of these Image with CONFIG_BUILD_ARM64_DT_OVERLAY=y 
2 Likes
This with CONFIG_BUILD_ARM64_DT_OVERLAY=y is what you need.
We used a 3.3V UART which worked fine (only connected TX and GND of course)
3 Likes
Hi, my FP3 just arrived here today. Is there anything I should do - that would be of help to the rest of you - before I turn it on, downloading OTAs and so on?
3 Likes
Hi, I let the others reply to your question. But I suggest you to do at least the following:
- Boot without SIM card and without internet conection
- Unlock the bootloader
- Boot into fastboot
- Boot into TWRP without installing it
- Open a shell on your smartphone
- Use
ddin order to backup the following partitions:
- aboot_a
- boot_a
- cmnlib64_a
- cmnlib_a
- devcfg_a
- dsp_a
- dtbo_a
- fsc
- fsg
- keymaster_a
- lksecapp_a
- mdtp_a
- modem_a
- modemst1
- modemst2
- product_a
- rpm_a
- sbl1_a
- system_a
- tz_a
- vbmeta_a
- vendor_a
- DDR
- apdp
- config
- devinfo
- dip
- dpo
- frp
- keystore
- limits
- logdump
- mcfg
- misc
- mota
- msadp
- oem
- persist
- prodinfo
- sec
- splash
- ssd
- syscfg
Doing this should guarantee that as long as you are careful to keep your system untouched in at least one of the two slots (you can experiment on the other), you would have a very hard time bricking your phone irreversibly. And if you are unhappy with some update, you should also be able to actually make a real “factory reset” of the phone.
Probably you don’t actually need to backup as much as that, but I preferred to keep on the safe side.
6 Likes
I second that. We haven’t had a backup of the original firmware of the phone, because by the time TWRP was available everyone had already installed OTA updates.
6 Likes
Hi,
Thanks for the advice! I was able to unlock the bootloader, enable USB debugging (to enable adb), run “adb boot bootloader” (to get to fastboot mode), and download TWRP from Releases · chaosmaster/android_device_fairphone_fp3 · GitHub
But when I tried:
$ fastboot boot twrp-3.3.1-0_k4y0z-20200202-02-fp3.img
downloading ‘boot.img’…
OKAY [ 0.841s]
booting…
FAILED (remote: unlock device to use this command)
finished. total time: 2.063s
Edit: Okay, apparently it worked the second time. It seemed to factory reset itself the first time, but it now booted into TWRP.
As for the version that came with the phone, it lists as 8901.2.A.0110.20200109 - so if you need something older than that, I’m afraid I can’t help you.
3 Likes
Really? I did not install any update, and kept the Fairphone in the box, and I went through all this process of making backups yesterday evening.
Actually, to be completely honest, that is not fully true. When trying to get the URL from one update, the system actually went through the whole download and started updating itself before I noticed it. However, before it finished, I interrupted it and did a factory reset. I could check that the version was kept the same as the original one.
However, now that I could open a shell as root on it by using the TWRP image, I checked the partition images from the a slot and compared them to those of the b slot. Some images were still the same (either the update was not intending to change them or did not had the time to do it), and some were different. I assumed the aborted update was responsible for changing the non-current slot (slot b), and that the current slot (slot a) was the original. I later cloned all images from slot a into slot b (mostly as an exercise), and checked that the phone properly booted also on slot b.
So it is my impression that I still have the original version (from September 2019) on my Fairphone. That said, I found something really weird. In the processes of learning how all of this works, I used TWRP to make backups before I actually went manually with the shell and used dd to make the backups myself of all the partitions (and not just those proposed by TWRP). Later on (but without connecting the phone to the internet or installing anything myself and after a factory reset), when I did the backups manually, I compared the backups from TWRP to those I had done manually. Well, they were all the same, except for modemst1 and modemst2, that are called efs1 and efs2 by TWRP. Any idea why?
4 Likes
The TWRP for FP3 is still work in progress. Best to tell @k4y0z , if there’s a mismatch with one of the partitions, its likely that TWRP has a partition link wrong or something.
1 Like
No, that is not the case. I thought of it, and did a second backup of these partitions with TWRP, and could check that the second time they had the same checksum as my own images from dd. The content on these partitions definitely changed, but I cannot see how nor why. And the incident with the OTA updates happened long before the TWRP image was even available, so that is not either the cause of the mismatch in the contents of the first TWRP backup and my own.
Also the mismatch in the name of the partition is probably due to a mismatch between the name of the partition and the mount point. I think modemsti is mounted on /efsi, and i stands for 1, 2. So TWRP naming convention seems to follow the mount point naming instead of the partition naming.
3 Likes
modemst1, modemst2, fsg and fsc are all backed up when you select “EFS” in backup:
As for the contents changing, TWRP isn’t touching these, so it must have been the OS.
1 Like
Hi all,
Do you still need older firmware binaries?
My phone never had an internet connection & sim card and is still on 8901.2.A.0096.20191001.
1 Like
That would be helpful indeed.
Different topic:
There are more 9853 programmers here: https://github.com/openpst/assets
https://github.com/bkerler/edl and https://github.com/openpst/sahara say that FP3 has no fuselocked PK_HASH
2 Likes
yes, it would be great to have a list of all historic firmwares. the older the better - we can always patch an old firmware to a newer one with any of the delta patches, but going back in time is not possible. So in theory all we need is the oldest firmware ever and all the OTA diff URLs ever issued since 
(That rises an interesting question - do the OTA diff URLS ever expire?)
1 Like
Does that mean we can upload our own community key, re-sign sdl and aboot, as well as community created boot partition and then have the phone locked and fully protected with a non-stock operating system? That’d be cool!
6 Likes
That means that every programmer should get accepted.
We don’t get prog_emmc_firehose_Sdm632_ddr_meiz1.mbn running, though.
1 Like
Theoretically yes, but that’s very risky since the fuses can only be set once.
It does mean though, that sbl1 isn’t verified and it should be possible to load any firehose-programmer in EDL mode (given you find a working one for sdm632)
1 Like
I wrote a little script for installing TWRP and magisk aka rooting:
The output looks like this:
File 'twrp-3.3.1-0_k4y0z-20200202-02-fp3.img' already there; not retrieving.
File 'twrp-installer-3.3.1-0_k4y0z-20200202-02-fp3.zip' already there; not retrieving.
File 'Magisk-v20.3.zip' already there; not retrieving.
downloading 'boot.img'...
OKAY [ 1.139s]
booting...
OKAY [ 7.334s]
finished. total time: 8.473s
Total xfer: 1.06x
Total xfer: 1.45x
Flashed TWRP and Magisk
Rebooting to device...
3 Likes
prog_emmc_firehose_8953_ddr_redmi7.mbn works with FP3.
I only tested printgpt with edl.py so far
1 Like