编译带KASAN的Android 11

基本信息

  • 手机型号：Pixel 3 XL

  • AOSP分支：android-11.0.0_r39

  • Android kernel 分支：android-msm-crosshatch-4.9-android11-qpr2

下载代码

  1. 下载AOSP代码

可参考以下连接下载对应分支代码：

1
2
3
4
5
mkdir WORKING_DIRECTORY
cd WORKING_DIRECTORY

repo init -u https://android.googlesource.com/platform/manifest -b android-11.0.0_r39
repo sync -j 32
  1. 下载Android Kernel 代码：

可参考以下连接进行获取：

构建

编译Android

参考链接：编译 Android

1
2
3
4
5
sudo apt install libncurses5

source build/envsetup.sh
lunch 20
m

刷入Android

此步骤主要为了获取shell的root权限

1
2
cd out/target/product/crosshatch/
fastboot flashall -w

编译kernel

参考链接：

注意：这里与Google提供的文档有所不同

修改编译选项

当前Google的kernel编译工具链已更新，只需要根据需求修改build.config，无需使用make menuconfig 来修改。此外，Google官方还提供了很多预置的build.config文件，可以直接将其链接到Android-kernel下直接使用。具体介绍如下：

  • 工具位置：${KERNEL_DIR}/scripts/config （即private/msm-google/scripts/config）
  • usage：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
Manipulate options in a .config file from the command line.
Usage:
config options command ...
commands:
        --enable-e option   Enable option
        --disable-d option  Disable option
        --module-m option   Turn option into a module
        --set-str option string
                             Set option to "string"
        --set-val option value
                             Set option to value
        --undefine-u option Undefine option
        --state-s option    Print state of option (n,y,m,undef)

        --enable-after-E beforeopt option
                             Enable option directly after other option
        --disable-after-D beforeopt option
                             Disable option directly after other option
        --module-after-M beforeopt option
                             Turn option into module directly after other option

        commands can be repeated multiple times

options:
        --file config-file   .config file to change (default .config)
        --keep-case-k       Keep next symbols' case (dont' upper-case it)

config doesn't check the validity of the .config file. This is done at next
make time.

By default, config will upper-case the given symbol. Use --keep-case to keep
the case of all following symbols unchanged.

config uses 'CONFIG_' as the default symbol prefix. Set the environment
variable CONFIG_ to the prefix to use. Eg.: CONFIG_="FOO_" config ...
  • 预置build.config文件
1
2
3
4
5
6
7
build.config.aarch64*                   build.config.bluecross_gcc*             build.config.bonito_debug_kmemleak*     build.config.common*                    build.config.goldfish.mips64*
build.config.bluecross*                 build.config.bluecross_kasan*           build.config.bonito_debug_locking*      build.config.common.clang*              build.config.goldfish.x86*
build.config.bluecross_debug_api*       build.config.bluecross_lts*             build.config.bonito_debug_memory*       build.config.cuttlefish.aarch64*        build.config.goldfish.x86_64*
build.config.bluecross_debug_hang*      build.config.bluecross_no-cfi*          build.config.bonito_gcc*                build.config.cuttlefish.x86_64*         build.config.x86_64*
build.config.bluecross_debug_kmemleak*  build.config.bonito*                    build.config.bonito_kasan*              build.config.goldfish.arm*
build.config.bluecross_debug_locking*   build.config.bonito_debug_api*          build.config.bonito_lts*                build.config.goldfish.arm64*
build.config.bluecross_debug_memory*    build.config.bonito_debug_hang*         build.config.bonito_no-cfi*             build.config.goldfish.mips*

编译命令

1
2
3
4
5
6
cd android-kernel

mv build.config build.config.bak
ln -s ln -s private/msm-google/build.config.bluecross_kasan ./build.config

./build/build.sh

检查kasan是否存在

1
2
cd out/android-msm-pixel-4.9/dist
strings vmlinux  grep kasan_

若存在kasan相关字样，即证明编译成功

尝试启动

1
fastboot boot Image.lz4-dtb

若可正常启动，即可开始编译boot镜像了

编译boot镜像

拷贝编译好的内核镜像

1
cp ${android_kernel_repo_path}/out/android-msm-pixel-4.9/private/msm-google/arch/arm64/boot/Image.lz4-dtb ${aosp_repo_path}/device/google/crosshatch-kernel/

修改Device.mk

将内核改变为我们刚刚编译好的内核文件 {aosp_repo_path}/device/google/crosshatch/device.mk

1
2
--- LOCAL_KERNEL := device/google/crosshatch-kernel/Image.lz4
+++ LOCAL_KERNEL := device/google/crosshatch-kernel/Image.lz4-dtb

编译boot镜像

1
m bootimage

编译完成后，镜像存在于out/target/product/crosshatch/文件夹下，使用fastboot 命令启动boot.img，若可以正常启动，即可使用fastboot flash boot boot.img 命令刷入设备中。

触屏无法使用

参考Touchscreen not working after building and flashing clean msm kernel for the Google Pixel blueline 方法如下：

1
2
3
4
5
adb root
adb remount -R # The first execute maybe will reboot device, you need execute it again
adb push ${android_kernel_repo_path}/out/android-msm-pixel-4.9/dist/*.ko
/vendor/lib/modules/
adb reboot