一、内核层修改

lxc启动

arch/arm64/configs/vendor/kona_defconfig增加：

CONFIG_SYSVIPC=y
CONFIG_POSIX_MQUEUE=y

开启内核详细日志输出

kernel/printk.c注释：

    /* Ratelimit when not explicitly enabled. */
    if (!(devkmsg_log & DEVKMSG_LOG_MASK_ON)) {
        if (!___ratelimit(&user->rs, current->comm)){
            //return ret;
        }
    }

增加/dev/binder_pad驱动

drivers/android/Kconfig增加2个binder设备，vndbinder_pad和binder_pad：
default "binder,hwbinder,vndbinder,vndbinder_pad,binder_pad"

对应源码修改：

• 1）frameworks/native/libs/binder/ProcessState.cpp

#ifdef __ANDROID_VNDK__
const char* kDefaultDriver = "/dev/vndbinder_pad";
#else
const char* kDefaultDriver = "/dev/binder_pad";
#endif

• 2)初始化新增binder设备的读写权限
  在/ueventd.rc中增加：

  /dev/binder_pad           0666   root       root
  /dev/vndbinder_pad        0666   root       root

• 3)修改servicemanager与vndservicemanager默认的驱动设备
  采用修改rc配置文件的方式，不直接修改源码。
  2-1）/system/etc/init/servicemanager.rc
  service servicemanager /system/bin/servicemanager /dev/binder_pad
  2-2）/vendor/etc/init/vndservicemanager.rc
  service vndservicemanager /vendor/bin/vndservicemanager /dev/vndbinder_pad

二、系统及程序

挂载分区失败

system/core/init/first_stage_init.cpp注释：

    if (!DoFirstStageMount()) {
        //LOG(FATAL) << "Failed to mount required partitions early ...";
    }

TODO

system/core/init/util.cpp注释：

//    if ((sb.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
//        return Error() << "Skipping insecure file";
//    }

防止进入recovery模式

1)
system/core/init/builtins.cpp注释：

static Result<Success> reboot_into_recovery(const std::vector<std::string>& options) {
    LOG(ERROR) << "Rebooting into recovery";
//    //CZ
//    LOG(ERROR) << "CZLog give up write_bootloader_message";
//    return Success();

    std::string err;
//    if (!write_bootloader_message(options, &err)) {
//        return Error() << "Failed to set bootloader message: " << err;
//    }
//    property_set("sys.powerctl", "reboot,recovery");
    property_set("sys.powerctl", "reboot");
    return Success();
}

2)
system/core/init/reboot.cpp注释：

    LOG(INFO) << "CZLog force refuse shutdown trigger";

//    ActionManager::GetInstance().ClearQueue();
    // Queue shutdown trigger first
//    ActionManager::GetInstance().QueueEventTrigger("shutdown");
    // Queue built-in shutdown_done
    auto shutdown_handler = [cmd, command, reboot_target, run_fsck](const BuiltinArguments&) {
        DoReboot(cmd, command, reboot_target, run_fsck);
        return Success();
    };
    ActionManager::GetInstance().QueueBuiltinAction(shutdown_handler, "shutdown_done");

//    // Skip wait for prop if it is in progress
//    ResetWaitForProp();
//
//    // Clear EXEC flag if there is one pending
//    for (const auto& s : ServiceList::GetInstance()) {
//        s->UnSetExec();
//    }
    return false;

3)system/core/init/service.cpp注释

//                    // Aborts into bootloader
//                    LOG(FATAL) << "critical process '" << name_ << "' exited 4 times "
//                               << (boot_completed ? "in 4 minutes" : "before boot completed");

                    // Aborts into bootloader
                    LOG(ERROR) << "CZLog force refuse reboot,critical process '" << name_ << "' exited 4 times "
                               << (boot_completed ? "in 4 minutes" : "before boot completed");

system/core/init/vold/cryptfs.cpp返回：

static void cryptfs_reboot(RebootType rt) {
    SLOGI("CZLog cryptfs_reboot %d",rt);return;
    switch (rt) {

白名单方法

• frameworks/base/core/jni/com_android_internal_os_Zygote.cpp注释
  // gOpenFdTable->ReopenOrDetach(fail_fn);

• frameworks/base/core/jni/fd_utils.cpp注释

  if (!whitelist->IsAllowed(file_path)) {
  //fail_fn(std::string("Not whitelisted : ").append(file_path));
  }

  if (new_fd == -1) {
      PLOG(ERROR) << "CZLog return ReopenOrDetach" << android::base::StringPrintf("Failed open(%s, %i): %s",
                                                                           file_path.c_str(),
                                                                           open_flags,
                                                                           strerror(errno));
      return;
//    fail_fn(android::base::StringPrintf("Failed open(%s, %i): %s",
//                                        file_path.c_str(),
//                                        open_flags,
//                                        strerror(errno)));
  }

去除label校验

system/core/init/service.cpp注释：
1)

//    if (rc == 0 && computed_context == mycon.get()) {
//        return Error() << "File " << service_path << "(labeled \"" << filecon.get()
//                       << "\") has incorrect label or no domain transition from " << mycon.get()
//                       << " to another SELinux domain defined. Have you configured your "
//                          "service correctly? https://source.android.com/security/selinux/"
//                          "device-policy#label_new_services_and_address_denials";
//    }
//    if (rc < 0) {
//        return Error() << "Could not get process context";
//    }

禁止自动挂载adb设备

/vendor/etc/init/hw/init.qcom.usb.rc
注释onboot事件里的# mount functionfs adb /dev/usb-ffs/adb uid=2000,gid=1000,rmode=0770,fmode=0660

禁止vendor/etc/fstab.qcom自动挂载/data分区

#/dev/block/bootdevice/by-name/userdata /data

根文件系统目录创建目录

• /dev/cgroup_info/
  并需要把宿主机的cgroup.rc文件拷贝过来
• /mnt/vendor/metadata/
• /etc
• /odm
• /proc
• /product

三、zygote适配

创建/storage目录

四、配置修改

1.系统属性

• ro.lxc.container.enable
  对于云机此属性要设置为0或者空，此属性关联的一些设置：
  1）网卡解析
  见frameworks/opt/net/ethernet/java/com/android/server/ethernet/EthernetTracker.java类，通过ro.lxc.container.enable的值在设置网卡名称的正则。