How do I flash a custom kernel on Pixel 7

Question

I built a custom kernel for my Pixel 7, to include the NFS kernel module. I'm struggling to flash this to my phone and get it loading.

After I flash this to my phone, the Google text appears, but not the G animation that follows. It dies with the following message:

Android Recovery

google/panther/panther

13/TQ1A.221205.011/9244662

user/release-keys

Use volume up/down and power.

Cannot load Android system. Your data may be corrupt. If you continue to get this message, you may need to perform a factory data reset and erase all user data stored on the device.

• [x] Try again
• [ ] Factory data reset

To recover from this I flashed the stock panther-tq1a.221205.011.zip/image-panther-tq1a.221205.011/boot.img back.

The only thing I could find is where the boot log /sys/fs/pstore/console-ramoops-0 has the message:

[  11.517099] [E] [DPM] check header failed
[  11.517105] [E] [LNXDBG] vendor combined_checksum must be 0x62352e30 but 0x620d2e30

I thought this was related to Android Verified Boot 2.0. To test this out, I tried to flash the stock image and stock vbmeta.img, with AVBv2 disabled:

$ fastboot flash --disable-verification vbmeta vbmeta.img

This also surprisingly results in the above boot loop. To recover I have to flash vbmeta.img without this flag:

$ fastboot flash vbmeta vbmeta.img

I tried to patch vbmeta.img flags at offset 0x7B to be 3 (aka AVB_VBMETA_IMAGE_FLAGS_HASHTREE_DISABLED | AVB_VBMETA_IMAGE_FLAGS_VERIFICATION_DISABLED). I flashed this, and the same boot loop occured.

My phone is rooted with Magisk.

Answer 1

This may not be exactly answering your question but is very similar. I wanted to flash KernelSU to my Pixel 7, and this is how I did it.

THIS WILL WIPE ALL DATA

First, make note of your build number. To find it, go to settings, about, then at the bottom is "build number". Mine is TQ3A.230605.012. Go to developers.google.com/android/images and download the image for your device. Make sure to download the file under the correct device heading, the build number may be used for multiple devices.

Unzipping this file then unzipping the image-*.zip gives a bunch of .img files. We now need to enable developer mode and USB debugging by repeatedly tapping the build number, then going into settings, system, developer options and enabling USB debugging.

Before we can flash a custom kernel we need to disable verity and verification. There is a good description of what these are here so I won't rehash it. To disable them, we need to reflash vbmeta.img which will erase all data on the device. To do so, reboot into fastboot

adb reboot bootloader # Alternatively shutdown, then hold vol-down and power

sudo fastboot flash --disable-verity --disable-verification vbmeta ./vbmeta.img

Sudo is used here due to my udev rules, it may not be necessary for you.
Now once the device boots it will be at the setup screen, feel free to set up the device here, that's what I did.

The next step is to prepare the kernel image. There are good instructions provided in the KernelSU installation guide. I downloaded Android-Image-Kitchen, unpacked boot.img, replaced boot.img-kernel with Image (Image becomes boot.img-kernel), then repacked the image giving image-new.img. Note: If like me your kernel is android13-4, the AnyKernel zips for android13-5 will work just fine

We can then flash our new image by rebooting into fastboot (see above) then running

sudo fastboot flash boot ./image-new.img

Once the device reboots, KernelSU should now hopefully be available. Make sure to download their app and enabling su in your terminal emulator so you don't panic when termux complains about no su binary.

Answer 2

If your device is bootloader unlocked and running a GKI compatible kernel (which the Pixel 6 and 7 devices are), then it's possible to update the core kernel without wiping user data or disabling verification if you don't change the core kernel ABI; however, since several kernel modules live on the vendor_dlkm dynamic partition you can't update those drivers on the dynamic partition without disabling verification since the hashtree footer is verified against the vbmeta_vendor partition (Refer to Note2).

To do this, you need to:

1. Add an AVB hash footer to the boot.img. Refer to https://android.googlesource.com/kernel/build/+/50333e298a0f02e7e64ef315f0825884cebd3acb/build_utils.sh#627

2. Set the security patch level (SPL) to be equal to or greater than the existing platform SPL on your device. I recently added this to the kernel build tools -- https://r.android.com/2795723.

If you use the latest kernel build tools (https://android.googlesource.com/kernel/build/+/refs/heads/main) to compile your kernel, then you should be able to flash a custom boot.img on Pixel 6 and Pixel 7 devices. Take a look at https://source.android.com/docs/setup/build/building-pixel-kernels for instructions on building custom Pixel kernels and https://source.android.com/docs/setup/build/building-kernels if you only want to build the core kernel (not Pixel drivers).

Note: Disabling verification is only needed when you update a custom dynamic partition that expects the AVB keys to be in the vbmeta_* partitions. If you are only updating the boot.img and it has a valid SPL with an AVB hash footer, then you don't need to wipe or disable verification when the bootloader is unlocked. By the way, a change like [1] will allow you to update the system_dlkm and vendor_dlkm partitions without needing to disable verification when your device is bootloader unlocked.

Note2: If you really want to update the drivers on the vendor_dlkm partition without wiping your device, then you can just add the updated module (and it's dependencies) to the vendor_kernel_boot image (make sure to include it in the module.load file there as well) to load it in first stage init. During second stage init, the original module on the vendor_dlkm partition will simply fail to load, but shouldn't cause any issues.

Note3: These steps are only applicable for android11-5.4, android12-5.4, android12-5.10, android13-5.10, and android13-5.15. Kernel branches before android11-5.4 are not GKI compatible with Android vendor kernel modules on the same kernel branch. That means the kernel ABI is not stable on those branches. For android14-* kernels (like the one shipped with Pixel 8), even though the kernel ABI is stable due to GKI, the introduction of protected GKI Modules has created a dependency between the boot.img and system_dlkm.img. That means if you update the core kernel (boot.img), then the existing GKI modules on the system_dlkm partition will fail to load which may cause your device to not be able to boot. At the minimum, updating the boot.img without updating the system_dlkm.img will remove critical device functionality like Wi-Fi. Until a change like [1] is merged for your device, which will let you update the system_dlkm and vendor_dlkm partitions on unlocked devices without disabling verification, you will have to wipe your device or move all of the vendor_dlkm modules that depend on GKI modules to the vendor_kernel_boot partition.

[1] https://r.android.com/2795415