Yet another (maybe) bricked phone, except I can access recovery

Hello Fairphone forums!

I see there is already a lengthy forum post here, but it seems most people who brick there phones that way can only access the bootloader. I have reason to believe my situation is a little different.

I flashed my phone with CalyxOS (download for Fairphone 4 here). There were some initial hiccups, but eventually I succeeded in booting CalyxOS. The next step was to re-lock the bootloader, but I foolishly forgot to check fastboot flashing get_unlock_ability before fastboot flashing lock. This wouldn’t have been a problem, except… my phone won’t boot. Note, it doesn’t say my device is corrupt or anything, it just restarts forever. Usually I would simply re-flash CalyxOS or the stock FP4 ROM, but for some reason OEM unlocking was disabled when I flashed CalyxOS to the phone, so I cannot do fastboot flashing unlock! :rage:

My phone doesn’t go to the bootloader, it simply starts and immediately reboots, forever. I’ve let it do this for a couple of hours in the hopes it would trigger something, but alas.

I can take out the battery to stop the phone from boot-looping. I can then enter the bootloader with volume down + plug in charging cable, and from there I can enter recovery mode (and fastboot). This gives me some hope, but I lack the experience to unbrick my phone from here.

I tried the Wipe data/factory reset option, no luck.

I tried to use the Apply update from ADB option in recovery (see screenshot below) with this OTA, but I get the error E:Package is for source build FP44 but expected FP4D, followed by Install from ADB completed with status 1. Installation aborted. Of course, I’m still in a boot loop after that.

Recovery allows me to view some logs, however I will have to type them out (and they are long!) so if they sound interesting let me know.

Recovery screenshot (sorry for terrible quality, can’t do any better):


The top text says

Android Recovery
Fairphone/FP4eea/FP4
11/RKQ1.210503.001/FP4D
user/release-keys

Relevant fastboot getvar all:

parallel-download-flash:yes
hw-revision:10000
unlocked:no
off-mode-charge:0
charger-screen-enabled:0
battery-soc-ok:yes
battery-voltage:4298
version-baseband:
version-bootloader:
erase-block-size: 0x1000
logical-block-size: 0x1000
variant:SM_ UFS
...
has-slot:modem:yes
has-slot:system:no
current-slot:b
has-slot:boot:yes
slot-retry-count:b:7
slot-unbootable:b:no
slot-successful:b:yes
slot-retry-count:a:4
slot-unbootable:a:yes
slot-successful:a:yes
slot-count:2
secure:yes
product:FP4
snapshot-update-status:none
is-userspace:no
max-download-size:805306368
kernel:uefi

Is there any chance I can break out of the boot loop?

I’m sorry, but probably not.

You’ll have to contactsupport, even if this could be fixed, better get a place in line now, they can take forever to respond.

Just for context, which FPOS build were you on and which CalyxOS build did you flash to your phone? :thinking:

2 Likes

I think I was on whatever is the latest FPOS as of today, since this guide says in order to get the OEM unlock code, the software had to be updated. I didn’t want to update because I’ve heard it causes issues, but I couldn’t get the OEM unlock code until I updated…

As for the CalyxOS version, I’m not really sure where I would see that… I just flashed whatever was on this page (actual download link here).

Thanks for the quick reply! Is it really that hopeless?

I’m actually a slight bit hopeful in your case, this…

…does sound interesting.

The problem is, you did install an extremely outdated Calxy release with an old patch level over a FPOS release with a newer one. Once you locked the bootloader, you triggered Anti Rollback Protection, which is a security feature meant to stop people from installing older builds with known vulnerabilities.

Now, since you still can access recovery, you might be able to update your Calyx installation to a newer version, which could, in theory, get things working again. But there isn’t a Calyx release matching the newest FPOS patch level yet.
Your previous try installing an OTA update didn’t work, because you used a stock FPOS OTA update, you are running a Calyx recovery, you’ll need a Calyx OTA update.

I’ll look for the link of the latest Calxy OTA update available, maybe you could try that in the meantime.

4 Likes

That’s what I thought as well, but I couldn’t find any CalyxOS OTA updates to try.

If this is the case, how did I boot into CalyxOS at all in the first place?

Thank you so much!

Because most of the security features (AVB, Anti Rollback Protection, etc.) are only activated once you lock the bootloader.

Alright, here’s the link to the latest (3.9.0) full OTA update, try that. If you weren’t on the absolutely latest FPOS version, this might work :crossed_fingers:

2 Likes

Unfortunately, it fails with the following messages:

E:failed to verify whole-file signature
Update package verification took 70.3 s (result 1).
E:Signature verification failed
E:error: 21

Install from ADB completed with status 2.
Installation aborted.

The transfer only gets to 47% before it fails with that. I’ve tried a couple of times now, it always gets to 47%.

From the error message I can assume that things are pretty hopeless now. :sob:

Just in case it’s not completely hopeless, how did you find the link to that OTA update?

Because that part…

… in your first post sounded very intriguing, I checked the naming scheme of the official FPOS factory images, and FP4D does indeed correspond to the latest FPOS release.
So, at the very least, you’ll have to wait for updated Calyx images.

Weird that OTA updates kind of worked before but aren’t working now, did you get that previous error message again at some point? :thinking:

I always get the Package is for source build FP44 but expected FP4D error when I try to use the latest official FPOS OTA update. I always get the Signature verification failed error when I try to use the CalyxOS OTA you provided. That’s why I think this might be hopeless after all. :frowning_face:

The FPOS part isn’t very surprising, since the stock OTA update is meant to get you from FP44 (A.149) to FP4D (A.163), which you already had installed. That’s an incremental (delta) OTA update, not a full one, it’s meant to be used on a specific version.

I find it very curious, that you can’t install the full Calyx OTA, could you check with an incremental OTA update.

I get the same error as for the full OTA, except it fails a lot faster. :sob:

I see. Is it maybe possible, then, to wait for a full FPOS OTA update and try that?

Could one maybe fudge with the signature of the CalyxOS OTA? I noticed that FPOS OTA zips have some funky names (like the latest one is f1c545b77336bcb0cb56adf4ab9d44397577f0a3), while the CalyxOS OTA zips have nice names… could that have anything to do with it?

Well, that’s not great :see_no_evil:

I just tried the full Calyx OTA update and it’s installing just fine for me, no problems with signature verification, just works™.
Could you check your adb --version, the hash md5sum FP4-ota_update-22309000.zip (mine’s c3f0e7467f7cba3661e0ee69b4a397fc) and maybe try different USB ports.

adb --version:

Android Debug Bridge version 1.0.41
Version 33.0.3-8952118

FP4-ota_update-22309000.zip md5 is c3f0e7467f7cba3661e0ee69b4a397fc

I tried switching cables and USB ports, no luck. Always stops at 47% transferred and then fails with the same old error.

I noticed the max-download-size var is set to 0x10000000. Depending on the unit, that could be too small to accept the full OTA update… could that have something to do with the transfer only getting to 47%? Then again, I also get the signature verification error with the smaller, incremental update, so probably not…

It seems that my phone will only accept FPOS OTAs. If I could get my hands on a new full FPOS OTA, could I use that to unbrick the phone?

Hmm, hmm, so it seems you somehow are still running a stock recovery, that’s odd… :thinking:
Since the file and adb version look fine, I’m out of ideas here.

FPOS full OTAs aren’t a thing, sorry.

That’s definitely weird, mines at 805306368 (so 0x30000000) and not in hexadecimal either. But that’s important for fastboot, I don’t think that’s relevant for recovery.

My advice would be, contactsupport.
Hopefully next week there will be a new Calyx release. Since support will take some time to respond, you’ll probably have enough time to try that before they get back to you.
But don’t get your hopes up, it’s not looking good at this point :see_no_evil:

R.I.P.

Mine is also 805306368 when I’m in the bootloader. If I do fastboot getvar all while I’m on this fastbootd screen, I get some different values:

cpu-abi:arm64-v8a
snapshot-update-status:none
super-partition-name:super
is-logical:xbl_config_b:no
is-logical:keymaster_b:no
is-logical:multiimgoem_a:no
is-logical:aop_b:no
is-logical:devcfg_b:no
is-logical:boot_a:no
is-logical:mdtpsecapp_a:no
is-logical:sdc:no
is-logical:modem_a:no
is-logical:tz_b:no
is-logical:qupfw_a:no
is-logical:bluetooth_b:no
is-logical:bluetooth_a:no
is-logical:mdtp_a:no
is-logical:abl_b:no
is-logical:uefisecapp_b:no
is-logical:featenabler_a:no
is-logical:hyp_a:no
is-logical:hyp_b:no
is-logical:qupfw_b:no
is-logical:keymaster_a:no
is-logical:ssd:no
is-logical:featenabler_b:no
is-logical:vbmeta_system_a:no
is-logical:vbmeta_a:no
is-logical:dsp_a:no
is-logical:recovery_b:no
is-logical:tz_a:no
is-logical:xbl_a:no
is-logical:abl_a:no
is-logical:xbl_config_a:no
is-logical:core_nhlos_a:no
is-logical:sda:no
is-logical:aop_a:no
is-logical:xbl_b:no
is-logical:modem_b:no
is-logical:devcfg_a:no
is-logical:userdata:no
is-logical:misc:no
is-logical:sdb:no
is-logical:recovery_a:no
is-logical:uefisecapp_a:no
is-logical:sdd:no
is-logical:sde:no
is-logical:dsp_b:no
is-logical:core_nhlos_b:no
is-logical:imagefv_a:no
is-logical:multiimgoem_b:no
is-logical:mdtp_b:no
is-logical:imagefv_b:no
is-logical:dtbo_a:no
is-logical:mdtpsecapp_b:no
is-logical:metadata:no
is-logical:super:no
is-logical:vbmeta_b:no
is-logical:vbmeta_system_b:no
is-logical:dtbo_b:no
is-logical:boot_b:no
is-logical:odm_a:yes
is-logical:odm_b:yes
is-logical:product_a:yes
is-logical:product_b:yes
is-logical:system_a:yes
is-logical:system_b:yes
is-logical:system_ext_a:yes
is-logical:system_ext_b:yes
is-logical:vendor_a:yes
is-logical:vendor_b:yes
battery-soc-ok:yes
battery-voltage:4375
off-mode-charge:0
treble-enabled:true
is-userspace:yes
partition-size:xbl_config_b:0x20000
partition-size:keymaster_b:0x80000
partition-size:multiimgoem_a:0x8000
partition-size:aop_b:0x80000
partition-size:devcfg_b:0x20000
partition-size:boot_a:0x6000000
partition-size:mdtpsecapp_a:0x400000
partition-size:sdc:0x800000
partition-size:modem_a:0xC300000
partition-size:tz_b:0x400000
partition-size:qupfw_a:0x14000
partition-size:bluetooth_b:0x200000
partition-size:bluetooth_a:0x200000
partition-size:mdtp_a:0x2000000
partition-size:abl_b:0x100000
partition-size:uefisecapp_b:0x200000
partition-size:featenabler_a:0x20000
partition-size:hyp_a:0x80000
partition-size:hyp_b:0x80000
partition-size:qupfw_b:0x14000
partition-size:keymaster_a:0x80000
partition-size:ssd:0x2000
partition-size:featenabler_b:0x20000
partition-size:vbmeta_system_a:0x10000
partition-size:vbmeta_a:0x10000
partition-size:dsp_a:0x4000000
partition-size:recovery_b:0x6000000
partition-size:tz_a:0x400000
partition-size:xbl_a:0x380000
partition-size:abl_a:0x100000
partition-size:xbl_config_a:0x20000
partition-size:core_nhlos_a:0xAA00000
partition-size:sda:0x1D50C00000
partition-size:aop_a:0x80000
partition-size:xbl_b:0x380000
partition-size:modem_b:0xC300000
partition-size:devcfg_a:0x20000
partition-size:userdata:0x19B372E000
partition-size:misc:0x100000
partition-size:sdb:0x800000
partition-size:recovery_a:0x6000000
partition-size:uefisecapp_a:0x200000
partition-size:sdd:0x8000000
partition-size:sde:0x68000000
partition-size:dsp_b:0x4000000
partition-size:core_nhlos_b:0xAA00000
partition-size:imagefv_a:0x200000
partition-size:multiimgoem_b:0x8000
partition-size:mdtp_b:0x2000000
partition-size:imagefv_b:0x200000
partition-size:dtbo_a:0x1800000
partition-size:mdtpsecapp_b:0x400000
partition-size:metadata:0x1DE0000
partition-size:super:0x180000000
partition-size:vbmeta_b:0x10000
partition-size:vbmeta_system_b:0x10000
partition-size:dtbo_b:0x1800000
partition-size:boot_b:0x6000000
partition-size:odm_a:0x115000
partition-size:odm_b:0x0
partition-size:product_a:0x45321000
partition-size:product_b:0x0
partition-size:system_a:0x3582B000
partition-size:system_b:0x0
partition-size:system_ext_a:0xEDC0000
partition-size:system_ext_b:0x0
partition-size:vendor_a:0x1A386000
partition-size:vendor_b:0x0
version-vndk:30
partition-type:xbl_config_b:raw
partition-type:keymaster_b:raw
partition-type:multiimgoem_a:raw
partition-type:aop_b:raw
partition-type:devcfg_b:raw
partition-type:boot_a:raw
partition-type:mdtpsecapp_a:raw
partition-type:sdc:raw
partition-type:modem_a:raw
partition-type:tz_b:raw
partition-type:qupfw_a:raw
partition-type:bluetooth_b:raw
partition-type:bluetooth_a:raw
partition-type:mdtp_a:raw
partition-type:abl_b:raw
partition-type:uefisecapp_b:raw
partition-type:featenabler_a:raw
partition-type:hyp_a:raw
partition-type:hyp_b:raw
partition-type:qupfw_b:raw
partition-type:keymaster_a:raw
partition-type:ssd:raw
partition-type:featenabler_b:raw
partition-type:vbmeta_system_a:raw
partition-type:vbmeta_a:raw
partition-type:dsp_a:raw
partition-type:recovery_b:raw
partition-type:tz_a:raw
partition-type:xbl_a:raw
partition-type:abl_a:raw
partition-type:xbl_config_a:raw
partition-type:core_nhlos_a:raw
partition-type:sda:raw
partition-type:aop_a:raw
partition-type:xbl_b:raw
partition-type:modem_b:raw
partition-type:devcfg_a:raw
partition-type:userdata:raw
partition-type:misc:raw
partition-type:sdb:raw
partition-type:recovery_a:raw
partition-type:uefisecapp_a:raw
partition-type:sdd:raw
partition-type:sde:raw
partition-type:dsp_b:raw
partition-type:core_nhlos_b:raw
partition-type:imagefv_a:raw
partition-type:multiimgoem_b:raw
partition-type:mdtp_b:raw
partition-type:imagefv_b:raw
partition-type:dtbo_a:raw
partition-type:mdtpsecapp_b:raw
partition-type:metadata:raw
partition-type:super:raw
partition-type:vbmeta_b:raw
partition-type:vbmeta_system_b:raw
partition-type:dtbo_b:raw
partition-type:boot_b:raw
partition-type:odm_a:raw
partition-type:odm_b:raw
partition-type:product_a:raw
partition-type:product_b:raw
partition-type:system_a:raw
partition-type:system_b:raw
partition-type:system_ext_a:raw
partition-type:system_ext_b:raw
partition-type:vendor_a:raw
partition-type:vendor_b:raw
has-slot:xbl_config:yes
has-slot:keymaster:yes
has-slot:multiimgoem:yes
has-slot:aop:yes
has-slot:devcfg:yes
has-slot:boot:yes
has-slot:mdtpsecapp:yes
has-slot:sdc:no
has-slot:modem:yes
has-slot:tz:yes
has-slot:qupfw:yes
has-slot:bluetooth:yes
has-slot:mdtp:yes
has-slot:abl:yes
has-slot:uefisecapp:yes
has-slot:featenabler:yes
has-slot:hyp:yes
has-slot:ssd:no
has-slot:vbmeta_system:yes
has-slot:vbmeta:yes
has-slot:dsp:yes
has-slot:recovery:yes
has-slot:xbl:yes
has-slot:core_nhlos:yes
has-slot:sda:no
has-slot:userdata:no
has-slot:misc:no
has-slot:sdb:no
has-slot:sdd:no
has-slot:sde:no
has-slot:imagefv:yes
has-slot:dtbo:yes
has-slot:metadata:no
has-slot:super:no
has-slot:odm:yes
has-slot:product:yes
has-slot:system:yes
has-slot:system_ext:yes
has-slot:vendor:yes
security-patch-level:2022-08-05
vendor-fingerprint:Fairphone/FP4eea/FP4:11/RKQ1.210503.001/FP4D:user/release-keys
hw-revision:0
current-slot:b
product:FP4
version-os:11
first-api-level:30
slot-count:2
max-download-size:0x10000000
version:0.4
version-baseband:
secure:yes
variant:NA
dynamic-partition:true
system-fingerprint:Fairphone/FP4eea/FP4:11/RKQ1.210503.001/FP4D:user/release-keys
version-bootloader:unknown
unlocked:no

Here is a screenshot of the screen I’m talking about:
fastbootd

In fastbootd I have the same value as you for max-download-size.

But this…

…is very confusing, mine’s at 12, as it should be for CalyxOS.

I don’t know what’s going on here, but I suspect that something went wrong during the installation. If I compare your screenshot to my fastbootd, they look different. That could be down to the older Calyx release you installed, or the Calyx one didn’t get flashed :thinking:
Did you unlock / relock the critical partitions, what’s the output of fastboot oem device-info (you need to run that in proper fastboot)?

As always I try to follow your rescue steps with interest and without understanding a lot, so I apologise if my comment is dumb…

My understanding is that the phone is still on FP (AOSP) recovery (its def the same as on my FPOS FP4), so I doubt you can ADB sideload from there any other OS? At least I have never seen anyone who could do this on any Fairphone. So I would say there is no hope​:speak_no_evil::see_no_evil:

1 Like

You are absolutely right, if this is still the stock FPOS recovery, and it increasingly very much looks like it, it won’t let you install anything not signed with Fairphone’s key, just like the Calyx recovery checks for theirs.
A different OS won’t work, but you can install stock FPOS OTA updates through recovery, and since it wasn’t complaining about the key, that might still be a way forward.

Calyx installs some partitions (boot, recovery, super etc.) as a block through fastboot --skip-reboot -w update image-FP4-sq3a.220705.003.a1.zip, my guess is, something went wrong at that point of the installation.

@ffff when you booted your phone, did you notice any CalyxOS logos? :thinking: The first run wizard should be completely Calyx branded and the boot animation is a moving dot changing the screen from black to white.

Now, if it’s still a partial stock FPOS install, maybe this could be fixed with the next OTA, but it’d say it’s equally likely the phone is going to get completely bricked then.
Since the latest update just came out, the next one will still take some time, so the race is on, what’s faster, support response time or the next update… :see_no_evil:

Either way #contactsupport, this will take some time.

fastboot oem device-info:

Verity mode: true
Device unlocked: false
Device critical unlocked: true
Charger screen enabled: false

My understanding as well. :frowning_face:

Something actually did go wrong here. Before that line, the install script does fastboot reboot-bootloader, and when my phone rebooted, my computer stopped detecting the phone! I had to switch USB ports, after which I manually ran the rest of the commands, for which everything went alright. Just in case, I ran the whole script again, and everything was flashed to the phone alright again.

Yes, I got the yin-yang type animated boot splash instead of Fairphone’s.

I can’t think of anything I might’ve done for the recovery image to magically be Fairphone’s instead of Calyx’s, other than invoking the factory reset option in recovery.

Does the Calyx Instructions require to flash recovery to both slots (I think thats what iode requires)? If not I would say changing slots could do the trick, however for sure thats not possible as the bootloader is locked…

3 Likes