[Magisk] ScottIsMyName:
So the point of this thread is to try to get Magisk working on the new Pixel 2 phones. This might also pertain to other new phones that use A/B slots. This thread should be used for useful discussion only, in order to try to keep each post useful and informative. Please do not post saying it's not working for you either, or that you have a phone if testers are needed.

In this post I will summarize all that we've learned from the thread in the Pixel 2 XL forum.

Notes

TWRP does not exist for this device, so any attempt at using Magisk must be done with the new option of patching a stock boot image.

Since we do not have root or recovery, no Magisk logs can be obtained.

Here is the stock boot image and here is the Magisk 14.3 patched boot image

This may be the first time we have had a device use Android Verified Boot version 2 (which confusingly uses the avbtool currently versioned 1 .0.0) instead of normal verity. The following links 1 and 2 contains a TON of information from google on avb.

Note[MENTION=631273]Chainfire[/MENTION] alluded to Android moving towards avbtool when he made the boot signing zip earlier this year.

Here is the content of

fastboot getvar all

(bootloader) keep_efs:no
(bootloader) is_oem_unlocked:yes
(bootloader) have_oem_lock_id:yes
(bootloader) avb_stored_rollback_indexes:
(bootloader) avb_user_settable_key_set:no
(bootloader) avb_version:1.0.0
(bootloader) hw-color:VB
(bootloader) hw-variant:GA00137-US
(bootloader) hw-revision:rev_10
(bootloader) cid:00000000
(bootloader) erase-block-size:0x1000
(bootloader) logical-block-size:0x1000
(bootloader) unlocked:yes
(bootloader) off-mode-charge:1
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:4379
(bootloader) version-laf:0.0.16
(bootloader) version-baseband:g8998-00122-1708311414
(bootloader) version-bootloader:TMZ10n
(bootloader) version-abl:TMZ10n
(bootloader) version-aes:TMZ10n
(bootloader) version-cmnlib:TMZ10n
(bootloader) version-cmnlib64:TMZ10n
(bootloader) version-devcfg:TMZ10n
(bootloader) version-hyp:TMZ10n
(bootloader) version-keymaster:TMZ10n
(bootloader) version-pmic:TMZ10n
(bootloader) version-rpm:TMZ10n
(bootloader) version-xbl:TMZ10n
(bootloader) variant:MSM UFS
(bootloader) partition-type:laf_b:raw
(bootloader) partition-size:laf_b: 0x3000000
(bootloader) partition-type:laf_a:raw
(bootloader) partition-size:laf_a: 0x3000000
(bootloader) partition-type:dtbo_b:raw
(bootloader) partition-size:dtbo_b: 0x800000
(bootloader) partition-type:dtbo_a:raw
(bootloader) partition-size:dtbo_a: 0x800000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x2800000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x2800000
(bootloader) partition-type:vendor_b:ext4
(bootloader) partition-size:vendor_b: 0x1F400000
(bootloader) partition-type:vendor_a:ext4
(bootloader) partition-size:vendor_a: 0x1F400000
(bootloader) partition-type:persist:ext4
(bootloader) partition-size:persist: 0x2000000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x1C26BFB000
(bootloader) partition-type:system_b:ext4
(bootloader) partition-size:system_b: 0xA0000000
(bootloader) partition-type:system_a:ext4
(bootloader) partition-size:system_a: 0xA0000000
(bootloader) has-slot:laf:yes
(bootloader) has-slot:bootloader:yes
(bootloader) has-slot:vendor:yes
(bootloader) has-slot:dtbo:yes
(bootloader) has-slot:vbmeta:yes
(bootloader) has-slot:cmnlib64:yes
(bootloader) has-slot:cmnlib:yes
(bootloader) has-slot:keymaster:yes
(bootloader) has-slot:devcfg:yes
(bootloader) has-slot:hyp:yes
(bootloader) has-slot:pmic:yes
(bootloader) has-slot:abl:yes
(bootloader) has-slot:rpm:yes
(bootloader) has-slot:tz:yes
(bootloader) has-slot:xbl:yes
(bootloader) has-slot:radio:yes
(bootloader) has-slot:modem:yes
(bootloader) has-slot:system:yes
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:0
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:no
(bootloader) slot-retry-count:a:6
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2
(bootloader) slot-suffixes:a,b,
(bootloader) secure:yes
(bootloader) serialno:
(bootloader) product:taimen
(bootloader) max-download-size:0x20000000
(bootloader) kernel:uefi
all:
finished. total time: 0.004s

Magisk 14.0 Results

Using Magisk 14.0 results in a patched boot image that does in fact boot up, but Magisk Manager 5.3 and 5.4 both report that Magisk is not installed and that the device is not rooted. Not much else was attempted with 14.0 because I believe a lot of things for a/b devices were added after 14.0 were released.

Magisk 14.3 Results

Using Magisk 14.3 results in a patched boot image that bootloops the device at the initial splash screen. It should be noted that the reboot happens before the abd daemon is started, so adb logcat is not possible.

Differences between Pixel 1 and 2

After Magisk is ran on a stock Pixel 1 image, the kernel (zImage) is modified in 2 ways. The first change patches "skip_initramfs" to "want_initramfs". The second is that all instances of verity are removed by searching for and removing "verify" in the dtb (fstab). With the Pixel 2, the change to initramfs still happens, but because the boot image does not contain the dtb file, no changes to verify happen (more on this below). Relevant link from google. .

/system in the Pixel 1 file system was squashfs. With Pixel 2, now using ext4. However, system no longer is mounted with verify, but instead with avb

system / ext4 ro,barrier=1 wait,slotselect,avb

/vendor no longer shows up in the fstab in pixel 2. Instead this information appears to be in dtbo.img and is also mounted with avb. Pixel 1 did not have vendor mounted with avb (it was using verify).

I looked at dtbo.img in a hex editor and you can see references to avb around the reference to vendor.

Relevant dtsi

&firmware_android {
compatible = "android,firmware";
vbmeta {
compatible = "android,vbmeta";
parts = "vbmeta,boot,system,vendor,dtbo,laf";
by_name_prefix = "/dev/block/platform/soc/1da4000.ufshc/by-name";
};
fstab {
compatible = "android,fstab";
vendor {
compatible = "android,vendor";
dev = "/dev/block/platform/soc/1da4000.ufshc/by-name/vendor";
type = "ext4";
mnt_flags = "ro,barrier=1";
fsmgr_flags = "wait,slotselect,avb";
};
persist {
compatible = "android,persist";
dev = "/dev/block/platform/soc/1da4000.ufshc/by-name/persist";
type = "ext4";
mnt_flags = "nosuid,nodev,noatime,barrier=1";
fsmgr_flags = "wait";
};
};
};

What we have tried doing

Running fastboot boot patched_boot.img (instead of flash). Same result - bootloop.

Modifying the ramdisk to change some ro variables such as ro.secure to 0 and ro.debuggable to 1. These changes to default.prop do not take effect after booting up.

Using Magisk 14.3 on the latest 8.1 developer preview (same results as 8.0) - bootloop

Modifying the patched boot image to not change "skip_initramfs" to "want_initramfs". This no longer caused a bootloop, but also resulted in an unrooted phone. Nothing of interest shows up int he logcat since we actually need the initramfs code to execute in order to root the phone/have anything happen.

Using a modified kernel that removed the avb/verity checks (along with a patched dtbo.img) and then using that modified kernel as an input to magisk. We were able to actually get it booted, but again, no root. Other attempts resulted in a bootloop (most likely because of initramfs). For further details on the kernel modifications made and tested please see the post by [MENTION=5169465]DespairFactor[/MENTION]

After (hopefully) patching out verity/avb checking, making the changes to prop.default in the ramdisk for ro.secure and ro.debuggable. Still don't show up when booted.

Hoping we might get some input from [MENTION=4470081]topjohnwu[/MENTION] or [MENTION=4667597]Didgeridoohan[/MENTION]