[CLOSED, UNSOLVED] Unable to run Waydroid. Binder modules not working.

SeagullFish · 2023-10-28 21:06:12

Hello. I am having a hard time trying to install and run Waydroid in Arch Linux. I have read the instructions at the following sites:

Both sites state that Waydroid requires a Linux kernel that comes with the binder modules, in order to run. To get this in place, I may either:

Install a third party precompiled non-official kernel (for example the Linux-zen kernel), or
Compile a Linux kernel myself, or
Install binder_linux-dkms from the AUR as a loadable DKMS module.

I am not sure which option would be the wisest. I don’t know very much about the Linux-zen kernel, the people making it, and their intentions. So I don’t know if I would be compromising safety/security by using that kernel, or if that kernel may introduce new bugs/errors. Furthermore, I don’t have the expertise (nor the time) needed to start compiling kernels on my own. So I decided to try the last option. Unfortunately, this has not been entirely successful.

My computer is running Gnome Classic on Wayland, with kernel 6.5.9-arch2-1 (vanilla). This is what I have done:

[foo@bar ~]$ sudo aura -Ax binder_linux-dkms		# Success.
[foo@bar ~]$ sudo modprobe -a binder_linux		# Success.

Made the new file /etc/modules-load.d/waydroid.conf with the following contents:

# Load binder_linux module at boot:
binder_linux

Made the new file /etc/tmpfiles.d/waydroid.conf with the following contents:

#       Path                    Mode    UID     GID     Age     Argument
d!      /dev/binderfs           0755    root    root

Added the following lines to /etc/fstab:

# Waydroid:
none                                            /dev/binderfs       binder  nofail                      0       0

Commands:

[foo@bar ~]$ sudo modprobe -a binder_linux			# Success.
[foo@bar ~]$ sudo mkdir -p /dev/binderfs			# Success.
[foo@bar ~]$ sudo mount -t binder none /dev/binderfs		# ERROR!
Memory segmentation fault (core saved to file)			# Note: This error message was presented in my native language. I am not sure if my English translation is perfect.
[foo@bar ~]$ sudo aura -Ax waydroid				# Success.
[foo@bar ~]$ sudo waydroid init					# ERROR!
[18:28:31] ERROR: [Errno 2] No such file or directory: '/dev/binderfs/binder-control'
[18:28:31] See also: <https://github.com/waydroid>
Run 'waydroid log' for details.

I tried rebooting, and experienced the following:

The computer froze during shutdown procedure, after my graphical UI was terminated. Thus, automatic reboot failed, so I had to manually push the power button to shut down hard. Then I powered back on and booted.
While booting, error messages occurred, but they scrolled past the screen too fast for me to catch them. Anyway, Linux continued booting and succeeded.

In an attempt to figure out what happened, I did the following (truncated for readability/brevity):

[foo@bar ~]$ sudo dmesg
[...]
[    0.191426] ACPI Error: AE_NOT_FOUND, While resolving a named reference package element - ^SPI1.SPFD.CVFD (20230331/dspkginit-438)
[    0.191430] ACPI Error: AE_NOT_FOUND, While resolving a named reference package element - ^SPI1.SPFD.CVFD (20230331/dspkginit-438)
[    0.191432] ACPI Error: AE_NOT_FOUND, While resolving a named reference package element - ^XHCI.RHUB.HS04.VI2C (20230331/dspkginit-438)
[    0.191439] ACPI Error: AE_NOT_FOUND, While resolving a named reference package element - ^XHCI.RHUB.HS04.VI2C (20230331/dspkginit-438)
[...]
[    3.247129] systemd[1]: Failed to mount /dev/binderfs.
[...]
[    4.176917] traps: Missing ENDBR: kallsyms_lookup_name+0x4/0xd0
[    4.176925] ------------[ cut here ]------------
[    4.176926] kernel BUG at arch/x86/kernel/traps.c:255!
[...]
[    6.269704] Bluetooth: hci0: Malformed MSFT vendor event: 0x02
[...]
[    9.243663] ucsi_acpi USBC000:00: error -ETIMEDOUT: PPM init failed
[...]
[ 9731.171021] traps: Missing ENDBR: kallsyms_lookup_name+0x4/0xd0
[ 9731.171038] ------------[ cut here ]------------
[ 9731.171040] kernel BUG at arch/x86/kernel/traps.c:255!
[...]
[10097.267596] traps: Missing ENDBR: kallsyms_lookup_name+0x4/0xd0
[10097.267614] ------------[ cut here ]------------
[10097.267616] kernel BUG at arch/x86/kernel/traps.c:255!
[...]

I assume that the error message "systemd[1]: Failed to mount /dev/binderfs." is not related to the other error messages, but I am not sure about this.

[foo@bar ~]$ sudo dmesg | grep binder
[...]
[    3.201110] systemd[1]: Mounting /dev/binderfs...
[    3.216024] systemd[1]: dev-binderfs.mount: Mount process exited, code=exited, status=32/n/a
[    3.216028] systemd[1]: dev-binderfs.mount: Failed with result 'exit-code'.
[    3.247129] systemd[1]: Failed to mount /dev/binderfs.
[...]

Regardless: On the applications menu of my Desktop Environment, there is a new application shortcut available for Waydroid, that is configured to execute the following command:

[foo@bar ~]$ python3 /usr/bin/waydroid first-launch

That command executes fine and displays a graphical dialog window, offering me to download several files (system OTA and vendor OTA). But I don’t want to do this, until I have figured out why binder does not work as expected.

For the record, I should probably also mention that I have read the following posts (although they don’t seem to be very helpful in my case):

Question:

Do you have any suggestions as to what could be wrong?

Last edited by SeagullFish (2023-12-11 13:10:10)

progandy · 2023-10-29 06:50:02

This seems to be the problem here. The hacks used by binder_linux are apparently incompatible with IBT.

https://stackoverflow.com/questions/761 … tion-fault

Last edited by progandy (2023-10-29 06:51:42)

SeagullFish · 2023-10-29 18:55:19

progandy wrote:

This seems to be the problem here. The hacks used by binder_linux are apparently incompatible with IBT.
https://stackoverflow.com/questions/761 … tion-fault

Thank you. To be honest, I don’t understand all the details in either that post or the article referenced. I simply don’t have the competence level required.

But on an overall level, if I interpret the discussion right, I draw the following rough summary:

In the past, software developers were free to make software that made calls to one or more functions within the Linux kernel, either directly or by using pointers.
In march 2022, support for Intel’s «Indirect Branch Tracking» (IBT) (one of several technologies with the collective term «Control-Flow Integrity» (CFI)) was implemented in the Linux kernel. IBT is supported by kernel version 5.18 and later.
The purpose of IBT support is to close a known security hole, where malicious software previously (theoretically) could have been able to interfere with the kernel’s execution flow, by redirecting it. However, this new security measure also causes existing legitimate software to stop working if the software is programmed to call functions within the kernel using methods that IBT does not allow.

Questions:

1. @progandy: Are you saying that this specific problem applies to the binder_linux DKMS module, and that the author(s) need to reprogram it to make it work with current (and future) versions of the Linux kernel?
2. @Everyone: If yes to question 1: Should the Waydroid article at the Arch Linux wiki be improved/updated? And if so, how can this be initiated? (I think it would be a shame if others had to struggle with the same problem later.)

Last edited by SeagullFish (2023-10-29 18:59:11)

progandy · 2023-10-29 19:15:30

1. @progandy: Are you saying that this specific problem applies to the binder_linux DKMS module, and that the author(s) need to reprogram it to make it work with current (and future) versions of the Linux kernel?

I think it applies to the binder_linux module, because of the error you quoted (Missing ENDBR: kallsyms_lookup_name). The module will probably be have to be rewritten (Disabling ibt with ibt=off in the kernel commandline should theoretically work, but is not a good solution).
Maybe the binder/binderfs modules from the kernel tree can be compiled as DKMS modules as well, but I am not sure.
Edit: It looks like this is impossible as binder needs some functions that are not available to shared modules, only if it is builtin. I doubt that a patch to export them would be accepted upstream.

linux-zen is the simplest options as this kernel is compiled with binder/binderfs.

Last edited by progandy (2023-10-29 19:52:45)

Auerhuhn · 2023-12-06 22:18:25

progandy wrote:

The module will probably be have to be rewritten (Disabling ibt with ibt=off in the kernel commandline should theoretically work, but is not a good solution).

Current Intel CPUs offer support for a `notrack` prefix that disables IBT for a specific call. No need to disable IBT globally.

I’ve started working on a patch, trying to replace all indirect calls with `notrack` calls.
Work in progress here: https://github.com/choff/anbox-modules/ … les:master

It’s still segfaulting, but I have a feeling that I’m onto something. Help appreciated.

SeagullFish · 2023-12-11 13:09:34

Update on this thread:
For now, I chose to install the Linux-zen kernel, in order to get Waydroid working. This does not really solve the initial issue of this thread, but I don't plan on following up this thread any further. So I am changing the status of this thread to [CLOSED, UNSOLVED] now.

Arch Linux

#1 2023-10-28 21:06:12