Installing Sailfish to Reeder S19 Max Pro S

[maidis]

As soon as I realized that the Reeder S19 Max Pro S and the Jolla C2 are the same hardware, I bought a Reeder S19 Max Pro S.

I enabled developer mode and unlocked the bootloader in the settings.

Since this was not enough, I also did a little work with unisoc-unlock:

GitHub - patrislav1/unisoc-unlock: Python tool to (un)lock a...

adb reboot bootloader
python3 -m unisoc_unlock unlock

Then I successfully completed all the steps described here:

Fastboot flashing of Jolla C2

Fastboot flashing of a Jolla C2 1. Download the latest Sailfish OS release for C2 The C2 release images are currently kept in this repository. Download the C2 zip file from there. Just before Christmas (2024), it is the file Sailfish_OS-Jolla-5.0.0.43-s19mps-1.0.0.30.zip. Unzip the C2 zip file to your Linux computer. The following files should appear: [C2-zip] 2. Update the bootloader If you have already updated your C2 to OS version 5.0.0.43, skip to Chapter 3. The bootloader is up to da…

sudo fastboot flash boot_a hybris-boot.img
sudo fastboot flash boot_b hybris-boot.img
sudo fastboot flash vendor_boot_a vendor_boot.img
sudo fastboot flash vendor_boot_b vendor_boot.img
sudo fastboot flash dtbo_a dtbo.img
sudo fastboot flash dtbo_b dtbo.img
sudo fastboot flash userdata sailfish.img001
sudo fastboot flash super fimage.img001
fastboot reboot

When I reboot the phone I get the error about DTBO and I am stuck in fastboot.

I would like to rewrite files and do other new things, but after the phone is in fastboot I can’t connect it to the computer.

I’m open to any advice to make Sailfish functional on this phone.

Since I live in Turkey, I thought this would be the easiest way to access Sailfish

Here is the image file I used: 5.0.0.43/c2

[fingus]

Jolla C2 is a Reeder S19 Max Pro S

thats the reason for the s in Sailfish_OS-Jolla-5.0.0.43-s19mps-1.0.0.30.zip

The Reeder S19 Max Pro look a bit different like the S19 Max Pro S, so the Hardware is also different i guess and that could be the reason the S-Software don´t work on the non-s-Modell.

[maidis]

My bad. My device is Reeder S19 Max Pro S. I’ll correct the title.

S19 MAX PRO S AÇIK MAVİ | Reedükkan

[fingus]

But it would, of course, be interesting if more Reeder smartphones could support Sailfish OS.

It’s a shame that Reeder is completely unknown in Germany, i like the build-quality.

[affe_null]

You will probably also have to flash lk.bin to the uboot_a and uboot_b partitions since Jolla seems to have modified the bootloader.

If fastboot no longer works for flashing, see Flashing the Jolla C2 - #3 by affe_null

[kan_ibal]

He wrote:

@maidis

Then I successfully completed all the steps described here:
Fastboot flashing of Jolla C2

and flashing lk.bin is one of the steps described above.

[maidis]

Thank you and everyone who responded. I think that was the process step I forgot/overlooked.

Now I cannot access the phone with adb, fastboot or other tools and methods, I cannot send commands or files.

I have no idea how to use it yet, but I am downloading the original ROM file that is said to be for this phone in another forum.

https://www.mediafire.com/file/abhat8rlf18m3kl/gsmturkey.zip/file

As a last resort, I will send the phone to the technical service, but I am still researching to see if I can do something myself. I am still open to all suggestions

[explit]

IMHO: Flashing SailfishOS Image via Fastboot will work only under 2 conditions:

• SailfishOS is already installed on the Phone
• Bootloader is updated to the new Version: It shows FASTBOOT MODE in the upper left corner when started via Fastboot mode.

Flashing SailfishOS Image via Fastboot from Android will in the most cases end with an Error / BootLoop.
Better not try this.

Please correct me, if i am wrong, guys

[MartiMasaKoegx]

A silly question…but from where did you buy this phone? I couldn’t find it e.g. on Amazon.

[davidrasch]

Probably in Turkey, he stated in his first post that he lived there

[maidis]

Yep, I live in İstanbul / Türkiye. It can be easily purchased almost everywhere here.

Today I will try to create a PAC from the archive file I downloaded yesterday which has many IMG files in it. If I succeed, I’ll try get the device working with Android again and try again with the commands mentioned by affe_null which I missed earlier.

If I succeed, great. If not, I will send the device to technical service. I also emailed Reeder to ask if they can provide me a PAC file for this device, but I don’t have much hope that they will.

[affe_null]

The spd_dump command line tool (see the flashing thread I linked above) doesn’t need a PAC file. It can replace Unisoc’s flash tool and lets you flash images to partitions directly. In fact, you will not be able to make a working PAC file without a signed FDL1 image, which is not provided in the gsmturkey archive. The spd_dump tool lets you bypass this.

To restore the partitions you’ve changed, you can just use the following command (assuming you have followed the setup instructions from the flashing thread and the gsmturkey archive is unpacked to images/):

./spd_dump \
    exec_addr 0x65015f08 \
    fdl fdl1-dl.bin 0x65000800 \
    fdl images/uboot_a.bin 0x9efffe00 exec \
    w boot_a images/boot_a.bin \
    w boot_b images/boot_b.bin \
    # ... same for other partitions

To get SailfishOS working, you will probably only need this (instead of the command above) with lk.bin taken from the SailfishOS archive:

./spd_dump \
    exec_addr 0x65015f08 \
    fdl fdl1-dl.bin 0x65000800 \
    fdl lk.bin 0x9efffe00 exec \
    w uboot_a lk.bin \
    w uboot_b lk.bin

Of course it might be that Jolla has modified something else, in which case I can share dumps of some additional partitions from my C2. Since the flashing interface is provided by the boot ROM, it should always be possible to restore the phone even if the bootloader is not working.

[explit]

Very important information @affe_null, thank you for sharing!
As i already wrote, such commands belongs to some kind of Wiki of C2-Knowledge…

[affe_null]

Do you suggest adding this to https://sailfishos.wiki/?

[explit]

I think its a very special knowledge. SailfishOS Wiki is a good place, IMHO.

[maidis]

@affe_null

fdl lk.bin 0x9efffe00 exec

It took me a while to figure out how to do it. I thought I had to enter fastboot mode to do the operations mentioned here, but that’s not the case.

I had to turn on the phone by pressing the volume up button and the power button. This puts the phone in a special mode where it can communicate with the program mentioned here. I’m so happy to finally make some progress after breaking my phone

However, the above parameters either don’t work for me or I didn’t manage to enter them correctly.

spd_dump.exe
branch:main, sha1:86fa3e31bc6ab9bd92eeaf48aa63bbfc7e065485
Successfully connected to port: 4
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
BROM >exec_addr 0x65015f08
custom_exec_no_verify_65015f08.bin does not exist
current exec_addr is 0x0
BROM >fdl fdl1-dl.bin 0x65000800
File does not exist.
BROM >fdl lk.bin 0x9efffe00 exec
unexpected response (0x008a)
timeout reached
Press any key to continue . . .

I’m open to your suggestions for what to do next, because I’m going to go very slowly on my own because I’ve been using iOS for about two years and I’m quite rusty for this kind of work.

I get timeout or sending error for lk.bin part:

spd_dump.exe exec w uboot_a lk.bin w uboot_b lk.bin
branch:main, sha1:86fa3e31bc6ab9bd92eeaf48aa63bbfc7e065485
Successfully connected to port: 5
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
timeout reached
Press any key to continue . . .

spd_dump.exe exec w uboot_a lk.bin w uboot_b lk.bin
branch:main, sha1:86fa3e31bc6ab9bd92eeaf48aa63bbfc7e065485
Successfully connected to port: 5
usb_send failed (0 / 1)

And an unexpected response when I adjusted timeout setting:

spd_dump.exe
branch:main, sha1:86fa3e31bc6ab9bd92eeaf48aa63bbfc7e065485
Successfully connected to port: 5
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
BROM >timeout 10000000000000000000
BROM >fdl lk.bin 0x9efffe00 exec w uboot_a lk.bin w uboot_b lk.bin
unexpected response (0x008a)

[affe_null]

You are invoking the command correctly, but it seems that you have not placed the files you are referring to in the correct folder. Have you unpacked ums9230_universal_unlock.zip?

After a command fails, you usually need to restart the flashing mode by holding the volume up and power keys.

I’ve created a wiki page to collect instructions and other information about flashing: Flashing the Jolla C2 ... | SailfishOS community wiki

[maidis]

I usually read the documents carefully from beginning to end, but I think I missed quite a few things because of my excitement. I didn’t download the archive you mentioned

I had very little time before going to work and I gave it a try right away. I can say that it was a new progress for me

Now I get an error like below:

signature verification of "uboot_a" failed or timeout reached

I hope we can overcome this situation too

By the way, I am not sure if the above is an error message or just an information message. I mean, I don’t know if I was able to write to uboot_a or not because signature verification failed. As a result, the phone still doesn’t turn on in any way and I don’t have a working Sailfish.

[affe_null]

This looks like an error message. I hope the C2 doesn’t use a different signing key…

Using fdl2-dl.bin instead of lk.bin for the fdl2 stage might help with flashing critical bootloader partitions. Note that it has two side effects:

• the volume down key is remapped to reboot the phone until you power it off
• you cannot flash large images with this fdl2-dl due to a watchdog reboot

[maidis]

You’re the best That worked Thank you so much to you and the whole Sailfish community.

./spd_dump exec_addr 0x65015f08 fdl fdl1-dl.bin 0x65000800 fdl fdl2-dl.bin 0x9efffe00 exec w uboot_a fdl2-dl.bin w uboot_b lk.bin
branch:main, sha1:86fa3e31bc6ab9bd92eeaf48aa63bbfc7e065485
Successfully connected to port: 5
CHECK_BAUD bootrom
BSL_REP_VER: "SPRD3\0"
CMD_CONNECT bootrom
current exec_addr is 0x65015f08
SEND fdl1-dl.bin to 0x65000800
SEND custom_exec_no_verify_65015f08.bin to 0x65015f08
EXEC FDL1
CHECK_BAUD FAIL
CHECK_BAUD FDL1
BSL_REP_VER: "Spreadtrum Boot Block version 1.1\0"
CMD_CONNECT FDL1
CHANGE_BAUD FDL1 to 921600
KEEP_CHARGE FDL1
SEND fdl2-dl.bin to 0x9efffe00
FDL2: incompatible partition
EXEC FDL2
DISABLE_TRANSCODE
ENABLE_WRITE_RAW_DATA
Reading Partition List
[=====                                   ] 12.5%
[==========                              ] 25.0%
[===============                         ] 37.5%
[====================                    ] 50.0%
[=========================               ] 62.5%
[==============================          ] 75.0%
[===================================     ] 87.5%
[========================================] 100.0%
Read Part Done: user_partition+0x0, target: 0x8000, read: 0x8000
  0                            splloader     256KB
  1                               prodnv      64MB
  2                             miscdata       1MB
  3                                 misc       1MB
  4                            trustos_a       6MB
  5                            trustos_b       6MB
  6                                sml_a       1MB
  7                                sml_b       1MB
  8                              uboot_a       3MB
  9                              uboot_b       3MB
 10                            uboot_log      16MB
 11                                 logo       8MB
 12                            fbootlogo       8MB
 13                           l_fixnv1_a       2MB
 14                           l_fixnv2_a       2MB
 15                           l_fixnv1_b       2MB
 16                           l_fixnv2_b       2MB
 17                         l_runtimenv1       2MB
 18                         l_runtimenv2       2MB
 19                              persist       2MB
 20                            l_modem_a      25MB
 21                            l_modem_b      25MB
 22                          l_deltanv_a       1MB
 23                          l_deltanv_b       1MB
 24                             l_gdsp_a      10MB
 25                             l_gdsp_b      10MB
 26                             l_ldsp_a      20MB
 27                             l_ldsp_b      20MB
 28                            l_agdsp_a       6MB
 29                            l_agdsp_b       6MB
 30                             pm_sys_a       1MB
 31                             pm_sys_b       1MB
 32                             teecfg_a       1MB
 33                             teecfg_b       1MB
 34                         hypervsior_a      10MB
 35                         hypervsior_b      10MB
 36                               boot_a      64MB
 37                               boot_b      64MB
 38                        vendor_boot_a     100MB
 39                        vendor_boot_b     100MB
 40                          init_boot_a       8MB
 41                          init_boot_b       8MB
 42                                dtb_a       8MB
 43                                dtb_b       8MB
 44                               dtbo_a       8MB
 45                               dtbo_b       8MB
 46                                super    6148MB
 47                                cache      64MB
 48                             blackbox     500MB
 49                             vbmeta_a       1MB
 50                             vbmeta_b       1MB
 51                             metadata      64MB
 52                            sysdumpdb      10MB
 53                      vbmeta_system_a       1MB
 54                      vbmeta_system_b       1MB
 55                      vbmeta_vendor_a       1MB
 56                      vbmeta_vendor_b       1MB
 57                  vbmeta_system_ext_a       1MB
 58                  vbmeta_system_ext_b       1MB
 59                     vbmeta_product_a       1MB
 60                     vbmeta_product_b       1MB
 61                         vbmeta_odm_a       1MB
 62                         vbmeta_odm_b       1MB
 63                         avbmeta_rs_a       1MB
 64                         avbmeta_rs_b       1MB
 65                         common_rs1_a       8MB
 66                         common_rs1_b       8MB
 67                         common_rs2_a      16MB
 68                         common_rs2_b      16MB
 69                               calinv       2MB
 70                             userdata  114523MB
standard gpt table saved to pgpt.bin
skip saving sprd partition list packet
partition list saved to partition_1738258677.xml
Total number of partitions: 70
Storage is ufs
Device is using slot a
file size : 0x1034d8
[========================================] 100.0%
Write Part Done: uboot_a, target: 0x1034d8, written: 0x1034d8
file size : 0xfd9c8
[========================================] 100.0%
Write Part Done: uboot_b, target: 0xfd9c8, written: 0xfd9c8
FDL2 >

PS: I forgot to change the lk.bin at the end to fdl2-dl.bin, but it seems to work this way for now.