Brief description

Without workarounds, the bootloader can no longer be locked again after returning to stock from a custom ROM, or when switching from one custom ROM to another. I was able to verify this issue with the latest 15.1 bootloaders; 15.0 and prior bootloaders, on the other hand, are not affected. Specific versions are referenced below.

There is apparently a problem with the way boot.img is flashed in relation to AVB. See Workarounds and steps to reproduce for details of this.

Impact

Affected devices

Pixel 6a (verified)
Pixel 8a (verified)
I suspect all supported Google Pixel devices

Affected source custom ROMs, as tested

If coming from any of these ROMs (and perhaps others), and going to an affected destination release, you will not be able to lock the bootloader without workarounds:

CalyxOS 6.2.2 (includes avb custom key) / bootloader bluejay-15.1-12292109
DivestOS divested-20.0-20241208-dos-bluejay (with or without avb custom key flashed) / bootloader bluejay-1.2-9894665
GrapheneOS 2024123000 (includes avb custom key) / bootloader bluejay-15.1-12292109

Unaffected source custom ROMs, as tested

If coming from any of these ROMs (and perhaps others), and going to an affected destination release, locking will still work fine:

/e/OS e-2.6.3-u-20241218455570-community-bluejay.zip (no avb custom key), bluejay-14.5-12088207
- But, flashing its boot image manually when trying to reproduce the problem does lead to the issue.

Affected bootloaders / destination releases, as tested

Stock 15 QPR1, bluejay: bluejay-ap4a.241205.013-factory-f6c5ddf3 / bootloader bluejay-15.1-12292109
Stock 15 QPR1, akita: akita-ap4a.241205.013-factory-e77805c2 / bootloader akita-15.1-12474670
CalyxOS 6.2.2, bluejay/akita

Unaffected bootloaders / destination releases, as tested

Stock bluejay-ap3a.241105.007-factory-c657cf23 / bootloader bluejay-15.0-11921129
Any custom ROM that flashes an earlier bootloader, or that is already installed and able to be locked

Affected flash methods

Factory zip flashing (via fastboot).

Unaffected flash methods

https://flash.android.com

Steps to reproduce for troubleshooting or testing:

Have boot.img files available from different ROMs - one from stock, one from something else.
- For stock, the boot.img is inside the .zip file that starts with "image-" inside the factory zip.
- To obtain a boot.img from another ROM, you can extract and flash a boot image from a /e/OS/'s recovery zip files for example (Pixel 6a, Pixel 8a).
Update an affected device to an affected release (just install the latest public stock Android), and unlock the bootloader if it's not already (fastboot flashing unlock).

Run commands.

fastboot flash boot stock/boot.img
fastboot flashing lock    # should succeed. no need to lock
fastboot flashing unlock  # if you locked above
fastboot flash boot custom_os/boot.img
fastboot flashing lock  # (optional) as expected, should fail with "invalid android images"
fastboot flash boot stock/boot.img  # back to stock's boot.img, which locked fine before
fastboot flashing lock  # with QPR1 bootloader, still fails, and keeps failing!

Real-world steps to reproduce

Install a custom ROM like GrapheneOS on a Pixel 6a or Pixel 8a (or probably any Pixel) using their factory zip. Try to lock the bootloader to confirm it doesn't show an error (run fastboot flashing lock), but you do not need to lock it.
(Optional) Boot into the custom ROM and use it. Not necessary for reproduction.
If you locked the bootloader earlier, unlock it.
Try to return to stock using one of the Pixel factory images.
Try to lock the bootloader (fastboot flashing lock).
Receive error invalid android images, skip locking. This also happens if you try to install another custom ROM using fastboot, e.g. CalyxOS.

Workarounds

Workaround 1

Flash a 15.0 bootloader and reboot into it. Then, flash boot.img again, and locking will work. Before locking, you can flash the 15.1 bootloader if you'd like, reboot into it, and then lock.

fastboot flash bootloader bootloader-bluejay-bluejay-15.0-11921129.img
fastboot reboot bootloader
fastboot flash boot boot.img
# flashing back to the newer bootloader is optional but works
fastboot flash bootloader bootloader-bluejay-bluejay-15.1-12292109.img
fastboot reboot bootloader
fastboot flashing lock

Workaround 2

Flash boot.img yet again in userspace fastboot. Unsure why this helps.

fastboot reboot fastboot
fastboot flash boot stock/boot.img
fastboot reboot bootloader
fastboot flashing lock

Workaround 3

Extract fastboot-info.txt from the factory image's image-*.zip.
Edit fastboot-info.txt to add an additional flash boot line after update-super.
Update the image-*.zip with this file
Flash again, and then try locking.

Further info

Downstream issue for CalyxOS: https://gitlab.com/CalyxOS/calyxos/-/issues/2907

Issue 387030988

Links (5)

Issue metadata