Building Pixel 4a kernels

[chenxiaolong]

Moving here from #238 (comment)

Trying to flash the new boot.img and vbmeta.img...

Well, seems that I have built the kernel wrong.
The phone did not boot with the modified boot image: flashing the modified boot.img to both boot_a and boot_b slots resulted in bootloop. Phone reboots several seconds after showing Google logo on the white background, and after 3 reboots phone loads fastboot with "Enter reason: no valid slot to boot".
Flashing the stock boot.img returns the phone to life, so I have decided to try a "clean" kernel from Google without KernelSU.
After I compiled the kernel and run fastboot boot Image.lz4-dtb the phone rebooted several seconds after showing Google logo on the black background, and then booted from the different boot slot (with a stock, working boot image).

I'm sorry for an offtopic, but could anyone point me to a working manual on how to build a kernel for Pixel 4a please?
A manual from https://source.android.com/docs/setup/build/building-pixel-kernels did not work for me:

repo init -u https://android.googlesource.com/kernel/manifest -b  android-msm-sunfish-4.14-android13-qpr3
repo sync -j4
KBUILD_BUILD_VERSION=1 KBUILD_BUILD_USER=build-user KBUILD_BUILD_HOST=build-host KBUILD_BUILD_TIMESTAMP="Thu 01 Jan 1970 12:00:00 AM UTC" BUILD_CONFIG=private/msm-google/build.config.sunfish build/build.sh

produced an unbootable Image.lz4-dtb file.

[chenxiaolong]

I think you built the kernel correctly. The issue is with fastboot boot Image.lz4-dtb. Fastboot only knows how to boot a boot image, not a raw kernel image.

You'll have to take the stock images and repack them to include what was build. There are 3 components:

• boot.img: kernel and dtb
• dtbo.img: dtbo

# Unpack boot.img
mkdir boot
cd boot
avbroot avb unpack -i ../boot.img
avbroot boot unpack -i raw.img

# Replace the kernel and dtb components
cp /path/to/out/android-msm-pixel-4.14/dist/Image.lz4 kernel.img
cp /path/to/out/android-msm-pixel-4.14/dist/sdmmagpie.dtb dtb.img

# Repack boot.img
avbroot boot pack -o raw.img
avbroot avb pack -o ../boot.modified.img -k /path/to/avb.key

# Unpack dtbo.img
mkdir ../dtbo
cd ../dtbo
avbroot avb unpack -i ../dtbo.img

# Replace the dtbo image
cp /path/to/out/android-msm-pixel-4.14/dist/dtbo.img raw.img

# Repack dtbo.img
avbroot avb pack -o ../dtbo.modified.img -k /path/to/avb.key

[vbooka1]

The issue is with fastboot boot Image.lz4-dtb. Fastboot only knows how to boot a boot image, not a raw kernel image.

fastboot creates the boot.img automatically when you execute command fastboot boot Image.lz4-dtb. As far as I understand the Image.lz4-dtb includes the device tree blob so it should boot well, although it does not.

Replace the kernel and dtb components
cp /path/to/out/android-msm-pixel-4.14/dist/Image.lz4 kernel.img
cp /path/to/out/android-msm-pixel-4.14/dist/sdmmagpie.dtb dtb.img

— that was my mistake, I've never seen sdmmagpie.dtb file mentioned in any manual on building the kernel, so I have used the stock dtb.img file when I was creating a patched boot.img, only kernel.img was replaced.

I have built a new boot.img with sdmmagpie.dtb following your instructions but the phone still does not boot.

# Extract the original OTA to get boot.img and dtbo.img
avbroot ota extract -i sunfish-ota_update-2023122200.zip -d extracted_original --all

cd extracted_original

# Unpack boot.img
mkdir boot
cd boot
avbroot avb unpack -i ../boot.img
avbroot boot unpack -i raw.img

# Replace the kernel and dtb components
cp ../../../kernel_build/out/android-msm-pixel-4.14/dist/Image.lz4 kernel.img
cp ../../../kernel_build/out/android-msm-pixel-4.14/dist/sdmmagpie.dtb dtb.img

# Repack boot.img
avbroot boot pack -o raw.img
avbroot avb pack -o ../boot.modified.img -k ../../avb.pem

# Unpack dtbo.img
mkdir ../dtbo
cd ../dtbo
avbroot avb unpack -i ../dtbo.img

# Replace the dtbo image
cp ../../../kernel_build/out/android-msm-pixel-4.14/dist/dtbo.img raw.img

# Repack dtbo.img
avbroot avb pack -o ../dtbo.modified.img -k ../../avb.pem

# patch the OTA
cd ../../

rm -f "sunfish-ota_update-2023122200.zip.patched";
rm -rf "./extracted_patched/";

avbroot ota patch --input "sunfish-ota_update-2023122200.zip" --key-avb avb.pem --key-ota avb.pem --cert-ota ota.crt --replace boot extracted_original/boot.modified.img --replace dtbo extracted_original/dtbo.modified.img --rootless

avbroot ota extract --input "sunfish-ota_update-2023122200.zip.patched" --directory ./extracted_patched/

# flash boot image
fastboot flash boot ./extracted_patched/boot.img
fastboot flash vbmeta ./extracted_patched/vbmeta.img

Flashing the new boot and vbmeta images results in bootloop, after 3 reboots fastboot reports no valid slot to boot.

How could I debug this? Are there any boot logs?
I recall reading something about boot logs in the fastboot Rescue mode but trying to boot the rescue mode still results in phone bootloop, I believe because my boot.img is faulty.

[chenxiaolong]

fastboot creates the boot.img automatically when you execute command fastboot boot Image.lz4-dtb. As far as I understand the Image.lz4-dtb includes the device tree blob so it should boot well, although it does not.

Interesting! I had no idea it did that.

— that was my mistake, I've never seen sdmmagpie.dtb file mentioned in any manual on building the kernel, so I have used the stock dtb.img file when I was creating a patched boot.img, only kernel.img was replaced.

I took a quick look at my build. sdmmagpie.dtb and the original dtb.img have the same checksum, so I guess that explains why it didn't help.

How could I debug this? Are there any boot logs?

Immediately after it bootloops, you could try flashing a rooted stock boot image and then looking at /sys/fs/pstore/console-ramoops-0. I don't know if the Pixel 4a clears the log when running fastboot boot. If it does, then I can't think of any way to get kernel logs besides using a debug cable.

I recall reading something about boot logs in the fastboot Rescue mode but trying to boot the rescue mode still results in phone bootloop, I believe because my boot.img is faulty.

Rescue mode won't help here, unfortunately. Rescue mode is the same as recovery mode, but only has the bare minimum functionality available. Pixel devices use the same kernel for both Android and recovery modes (and thus, also rescue mode).

[vbooka1]

Another strange thing: if I flash the stock avb_custom_key but modified boot.img, the bootloader does not complain about incorrect signature or anything. Is that normal fastboot behavior?
The phone just reboots several seconds after showing the Google logo on the black background. Same if I flash my own avb_pkmd.bin - the phone still bootloops.
I remember that fastboot complains about incorrect signature when trying to flash the whole OTA archive with a wrong avb_custom_key, but shouldn't fastboot complain about incorrect signature when flashing just the boot image?

My actions:

fastboot erase avb_custom_key 
fastboot flash avb_custom_key ./STOCK/avb_pkmd.bin
fastboot flash boot_a ./STOCK/boot.img
fastboot flash boot_b ./STOCK/boot.img
fastboot flash vbmeta ./STOCK/vbmeta.img
fastboot reboot bootloader

— the phone boots correctly.

fastboot erase avb_custom_key 
fastboot flash avb_custom_key ./patched/avb_pkmd.bin
fastboot flash boot_a ./patched/boot.img
fastboot flash boot_b ./patched/boot.img
fastboot flash vbmeta ./patched/vbmeta.img
fastboot reboot bootloader

— the phone bootloops, fastboot says no valid slot to boot.

fastboot erase avb_custom_key 
fastboot flash avb_custom_key ./STOCK/avb_pkmd.bin
fastboot flash boot_a ./patched/boot.img
fastboot flash boot_b ./patched/boot.img
fastboot flash vbmeta ./patched/vbmeta.img
fastboot reboot bootloader

— the phone bootloops, fastboot says no valid slot to boot and does not complain about wrong AVB signature.

[chenxiaolong]

I assume the bootloader unlocked when you tested this since you were able to run fastboot flash. The Pixel bootloader doesn't warn about incorrect signatures unless it is locked (at least on the devices I tested).

[vbooka1]

Further observations: I have found this blog: https://github.com/zhanghecn/luckzh_android_flash_notes/
This manual says that disabling the OverlayFS allowed to build a working kernel: https://github.com/zhanghecn/luckzh_android_flash_notes/blob/main/doc/note4-kernelSu/index.md

So I have removed the line

CONFIG_OVERLAY_FS=y

in private/msm-google/arch/arm64/configs/sunfish_defconfig
and commented the line

    depends on OVERLAY_FS

in private/msm-google/drivers/kernelsu/Kconfig, recompiled the kernel, tried to boot a resulting image by executing fastboot boot Image.lz4-dtb, and now phone reboots immediately after showing the Google logo on a black background. Note that in previous builds (with OverlayFS enabled) the phone showed Google logo for about 10 seconds before rebooting to the fastboot.

I will try to compile the kernel without both OverlayFS and KernelSU now.

[vbooka1]

I will try to compile the kernel without both OverlayFS and KernelSU now.

Still no luck. I have compiled the kernel without OverlayFS and KernelSU, tried to boot it with fastboot boot Image.lz4-dtb, and the phone rebooted after ~15 seconds showing Google logo on a black background.

phone reboots immediately after showing the Google logo

— this (probably) means that KernelSU depends on the OverlayFS. I don't know why the abovementioned user removed the OverlayFS in their blog post.

P.S. out of curiosity, do you know why sometimes the phone shows the Google logo on a white background, and sometimes on a black background?

[chenxiaolong]

Hmm, I know KernelSU's modules definitely require OverlayFS. Maybe if you don't install any modules and only use the root functionality, then it's optional?

P.S. out of curiosity, do you know why sometimes the phone shows the Google logo on a white background, and sometimes on a black background?

I've seen the white background once on a Pixel 6 Pro, but I have no idea what would've triggered it. At the time, I didn't flash anything and it didn't have any boot issues.

[vbooka1]

Maybe the white background is shown when the bootloader is locked (fastboot flashing lock) and the black background is shown when the bootloader is unlocked?

I will try to get the debug logs later in January. Have a good holidays, wish you a happy New Year!

[chenxiaolong]

Thanks, you too!