[Android Q&A, Help & Troubleshooting] mikilebowski:
Dear Esteemed XDA members,

I have spent literally days of testing and researching to try and unbrick my phone. Friends and family have seen my obsession with trying to fix this, some even offering to buy me a new phone!!!! But this ain't about money - this is about having control of my damn device!!! I'm usually pretty good with trying to solve this kind of stuff, but this time I'm truly stumped (and desperate, and obsessed!). I have come to the conclusion that it's directly related to ARM Trusted Firmware. Here are the details of my "journey" to date... please read it, and if you know how to fix it, please share!!! then I can get my life back!!!! Before I go any further, I am certain that my problem was initially triggered by doing an official update on a rooted phone. So to avoid experiencing the same problem I'm about to describe, it's best to unroot and relock your device before loading new official firmware.

I have a Huawei Honor 4x (Che2-UL00, with Kirin 620 chipset) with an unlocked bootloader. Recently, I tried to manually upgrade from Kitkat (emui3.0) to Lollipop (emui3.1), using the official update.app from huawei's website (image was good - I checked the hash). To load the update.app, I used the official huawei recovery. The progress bar went to roughly 90% and then hung. Upon restarting my phone, it went into rescue mode with the following error: Func NO : 15 (bl31 image) Error NO : 1 (security verify failed).

Interestingly, I looked closely at the fastboot.img files for kitkat Vs lollipop (I got the image files by using HuaweiUpdateExtractor). I noticed that only the lollipop fastboot image contains this error message text. Also, bl31 is related to ARM trusted firmware, for more info search for BL31 (Secure Monitor) on google, or see bl31_main.c in the Trusted Firmware source code. So it seems that the lollipop image is using the full ARM trusted firmware, an extra layer of security which is preventing the (unlocked) bootloader from allowing me to load into recovery. I think this is the core problem, and I think there is a way to solve it but I just don't have a deep enough understanding to get there. Below I'll explain each step I went though and provide some additional diagnostic info:

1. First step was to access recovery mode (Vol UP + power). This failed and resulted in same bl31 error message.

2. Second step was to try and update again using the three-button force update (Vol Up + Vol Down + Power). It vibrates once after a few seconds, and freezes with the logo screen with the red light flashing. As an experiment, I tried this without the SDCARD and noticed it vibrated almost instantly, which suggests that it does try to load something from the SDCARD when inserted. I didn't get any further in this mode.

3. Final step I tried was to load into fastboot (Vol Down + Power). This worked and I got into a special "Rescue&Fastboot" mode. First thing I tried was to manually downgrade to kitkat by flashing the kitkat images using the fastboot flash command. The images boot.img, system.img, recovery.img flashed successfully. cust.img simply failed. I desperately wanted to flash the kitkat fastboot.img which doesn't contain the trusted firmware bl31 image stuff, but fastboot replied: FAILED (remote: Command not allowed). In fact, many of the fastboot commands fail with this same error message, even though there is the "PHONE unlocked" writing in red on my phone screen. With the limited command set available (even fastboot oem device-info is not allowed!), here is the diagnostic info I was able to get:

a) fastboot oem check-rootinfo

(bootloader) old_stat: RISK

(bootloader) now_stat: SAFE

(bootloader) change_time: 1452356543

I think this change from RISK to SAFE is the core of my problem. the change_time is from several days ago when I attempted to update. I think it reflects the trusted firmware state (I'm guessing here, as I can't find documentation for these commands).

b) fastboot oem backdoor info

(bootloader) FB LockState: LOCKED

(bootloader) USER LockState: UNLOCKED

I think that FB LockState: LOCKED means that fastboot is locked (guessing again, can't find documentation!), which explains why many of the commands fail.

c) fastboot oem check-image

(bootloader) secure image verify successfully

I think this checks the recovery image, because when I flash a different recovery, this signature check fails

d) fastboot getvar rescue_phoneinfo

rescue_phoneinfo: Che2-UL00 V100R001CHNC00B365

This appears to be the ROM version at the time of purchase.

e) fastboot oem get-build-number

(bootloader): Che2-UL00 V100R001CHNC00B384

This actually corresponds to the build number of kitkat I was using just before the failed upgrade to lollipop.

f) fastboot oem relock mycode

FAILED (remote: root type not allowed).

I tried this just to see if it wold relock. I'm not sure what the error means, but I do not that this command failed with signature verify fail if i change the recovery image.

Here are the questions I want to ask:

1. Can I force the device to flash a new image? I can't get into recovery or have full access to fastboot commands due to the trusted firmware stuff. And as I mentioned earlier the three button trick fails with a freeze at the logo screen. It appears that I need to do this using a means other than fastboot. The only interface I have is Android Sooner ADB Interface. adb devices renders nothing. Only fastboot finds a device.

2. Can I somehow make the "security verify check" pass so that I don't get that bl31 error? I'm not sure exactly which images this bl31 thing is trying to verify! Perhaps some combination of images from the new lollipop stuff I tried to flash and the kitkat build I had running previously?

3. Can somehow disable all this Trusted Firmware stuff??

4. Any other suggestions???

This is driving me to the brink on insanity!!! Gotta figure it out!! Thanks for reading and trying to help!