Custom libre kernel configuration

Custom libre kernel configuration

[phodina]

Hi!

I'm attempting to compile a custom linux libre kernel with several additional config options enabled (listed below).

Unfortunately I get the following error messages:

Throw to key `match-error' with args `("match" "no matching pattern" ("CONFIG_ANDROID" . y))'.

I followed the blog post[1] on customizing kernel.

Downloaded the sources and checked for the options in menuconfig:

tar xf $(guix build linux-libre --source)
guix environment linux-libre --ad-hoc ncurses -- make menuconfig

Could you please give me hint on what I'm doing wrong?

Petr

--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -722,6 +722,14 @@ (define %bpf-extra-linux-options
     ;; kheaders module
     ("CONFIG_IKHEADERS" . #t)))

+(define %waydroid-extra-linux-options
+  `(;; Modules required for waydroid:
+   ("CONFIG_ASHMEM" . m)
+   ("CONFIG_ANDROID" . y)
+   ("CONFIG_ANDROID_BINDER_IPC" . m)
+   ("CONFIG_ANDROID_BINDERFS" . n)
+   ("CONFIG_ANDROID_BINDER_DEVICES" . "binder,hwbinder,vndbinder")))
+
 (define (config->string options)
   (string-join (map (match-lambda
                       ((option . 'm)
@@ -1143,6 +1151,25 @@ (define-public linux-libre-mips64el-fuloong2e
                       `(("CONFIG_OVERLAY_FS" . m))
                       %default-extra-linux-options)))

+(define-public linux-libre-with-waydroid
+  (let ((base-linux-libre
+         (make-linux-libre*
+          linux-libre-5.14-version
+          linux-libre-5.14-gnu-revision
+          linux-libre-5.14-source
+          '("x86_64-linux" "i686-linux" "armhf-linux"
+            "aarch64-linux" "riscv64-linux")
+          #:extra-version "bpf"
+          #:configuration-file kernel-config
+          #:extra-options
+          (append %bpf-extra-linux-options
+                  %waydroid-extra-linux-options
+                  %default-extra-linux-options))))
+    (package
+      (inherit base-linux-libre)
+         (name "linux-libre-waydroid")
+      (inputs `(("cpio" ,cpio) ,@(package-inputs base-linux-libre))))))
+
 (define-public linux-libre-with-bpf
   (let ((base-linux-libre
          (make-linux-libre*

---

[1] https://guix.gnu.org/en/blog/2019/creating-and-using-a-custom-linux-kernel-on-guix-system

Re: Custom libre kernel configuration

[André A. Gomes]

phodina <phodina@protonmail.com> writes:

> --- a/gnu/packages/linux.scm
> +++ b/gnu/packages/linux.scm
> @@ -722,6 +722,14 @@ (define %bpf-extra-linux-options
>      ;; kheaders module
>      ("CONFIG_IKHEADERS" . #t)))

Isn't there an extra closing parenthesis on this s-exp?


-- 
André A. Gomes
"Free Thought, Free World"

Re: Custom libre kernel configuration

[phodina]

Hi Andre,

On Thursday, November 11th, 2021 at 1:49 PM, André A. Gomes <andremegafone@gmail.com> wrote:

> phodina phodina@protonmail.com writes:
>
> > --- a/gnu/packages/linux.scm
> >
> > +++ b/gnu/packages/linux.scm
> >
> > @@ -722,6 +722,14 @@ (define %bpf-extra-linux-options
> >
> > ;; kheaders module
> >
> > ("CONFIG_IKHEADERS" . #t)))
>
> Isn't there an extra closing parenthesis on this s-exp?
>

Unfortunately no. If I leave only CONFIG_ASHMEM and CONFIG_ANDROID_BINDER_IPC the kernel builds.

Then again when I check the kernel menuconfig the other options are present, but for some reason Guix fails.

Petr

Re: Custom libre kernel configuration

[Tobias Geerinckx-Rice]

On 2021-11-11 13:31, phodina wrote:
> Throw to key `match-error' with args `("match" "no matching pattern"
> ("CONFIG_ANDROID" . y))'.

I guess you meant to write #t here.  With that change the rest looks 
correct, goodl uck!

Kind regards,

T G-R

Sent from a Web browser.  Excuse or enjoy my brevity.

Re: Custom libre kernel configuration

[phodina]

Hi Tobias,

On Thursday, November 11th, 2021 at 2:23 PM, Tobias Geerinckx-Rice <me@tobias.gr> wrote:

> On 2021-11-11 13:31, phodina wrote:
>
> > Throw to key `match-error' with args` ("match" "no matching pattern"
> >
> > ("CONFIG_ANDROID" . y))'.
>
> I guess you meant to write #t here. With that change the rest looks
>
> correct, goodl uck!
>
> Kind regards,
>
> T G-R
>

Thanks! Somehow it was staring at my face :-D

Though there is also one more issue. The match lambda does not accept strings. I'm added one more "case", though I'm not sure if it won't have any consequences.

(define (config->string options)
  (string-join (map (match-lambda
                      ((option . 'm)
                       (string-append option "=m"))
                      ((option . #t)
                       (string-append option "=y"))
                      ((option . #f)
                       (string-append option "=n"))
                      ((option . value)
                       (string-append option "=" value)))
                    options)
               "\n"))

Re: Custom libre kernel configuration

[Tobias Geerinckx-Rice]

> Though there is also one more issue. The match lambda does not accept 
> strings.
> I'm added one more "case", though I'm not sure if it won't have any
> consequences.

You're right.

I'm not on a GNU system right now but from memory, Kconfig places double 
quotation marks around "string values", doesn't add any around numbers.  
Don't know how liberal it is in accepting foo="42" and bar=string.

Add "s to you current string fallbakc and add a 'number' quasipattern 
above that without "s to play it safe.

Stupid: if I were on GNU I could just paste the code I use which does 
all that.  Sorz.

Kind regards,

T G-R

Sent from a Web browser.  Excuse or enjoy my brevity.

Re: Custom libre kernel configuration

[phodina]

> I'm not on a GNU system right now but from memory, Kconfig places double
>
> quotation marks around "string values", doesn't add any around numbers.
>
> Don't know how liberal it is in accepting foo="42" and bar=string.
>
> Add "s to you current string fallbakc and add a 'number' quasipattern
>
> above that without "s to play it safe.
>

I've modified it already. Seems to build, but I want to wait (well have to on my x230 :-D) till I can give a spin.

Here's the modification:

(define (config->string options)
  (string-join (map (match-lambda
                      ((option . 'm)
                       (string-append option "=m"))
                      ((option . #t)
                       (string-append option "=y"))
                      ((option . #f)
                       (string-append option "=n"))
                      ((option . number)
                       (string-append option "=" number))
                      ((option . string)
                       (string-append option "=\"" string "\"")))
                    options)
               "\n"))

Re: Custom libre kernel configuration

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 1614 bytes --]

Petr,

phodina 写道：
> Here's the modification:
>
> (define (config->string options)
>   (string-join (map (match-lambda
>                       ((option . 'm)
>                        (string-append option "=m"))
>                       ((option . #t)
>                        (string-append option "=y"))
>                       ((option . #f)
>                        (string-append option "=n"))
>                       ((option . number)
>                        (string-append option "=" number))
>                     options)
>                "\n"))

At this point, (option . number) will match anything.

You're not matching numbers here: ‘number’ is your chosen variable 
name, not magic.  It could be ‘foo’.  It could be anything, 
without changing the effect of this code.

>                       ((option . string)
>                        (string-append option "=\"" string 
>                        "\"")))

This will never be reached.

I'm almost certain that this is, at least in part, why your BINDER 
configuration isn't taking effect.

Here's mine:

(define option->string
  (match-lambda ((option . #f)
                 (format #f "# ~a is not set" option))
                ((option . #t)
                 (format #f "~a=y" option))
                ((option . 'm)
                 (format #f "~a=m" option))
                ((option . (? number? value))
                 (format #f "~a=~a" option value))
                ((option . (? string? value))
                 (format #f "~a=\"~a\"" option value))))

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

Re: Custom libre kernel configuration

[phodina]

Thanks Tobia,

> You're not matching numbers here: ‘number’ is your chosen variable name, not magic. It could be ‘foo’. It could be anything, without changing the effect of this code.
>
> >                       ((option . string)
> >                        (string-append option "=\\"" string >                        "\\"")))
> >
>
> This will never be reached.
>
> I'm almost certain that this is, at least in part, why your BINDER configuration isn't taking effect.
>
> Here's mine:
>
> (define option->string
>
> (match-lambda ((option . #f)
>
> (format #f "# ~a is not set" option))
>
> ((option . #t)
>
> (format #f "~a=y" option))
>
> ((option . 'm)
>
> (format #f "~a=m" option))
>
> ((option . (? number? value))
>
> (format #f "~a=~a" option value))
>
> ((option . (? string? value))
>
> (format #f "~a=\"~a\"" option value))))
>
> Kind regards,
>
> T G-R

I took your changes and applied them to the code:

(define (config->string options)
  (string-join (map (match-lambda
                      ((option . #f)
                       (format #f "# ~a is not set" option))
                      ((option . #t)
                       (format #f "~a=y" option))
                      ((option . 'm)
                       (format #f "~a=m" option))
                      ((option . (? number? value))
                       (format #f "~a=~a" option value))
                      ((option . (? string? value))
                       (format #f "~a=\"~a\"" option value)))
                    options)
               "\n"))

However, the CONFIG_ANDROID_BINDER_IPC is still not part of the config :-/

$ grep BINDER .config
# CONFIG_ANDROID_BINDER_IPC is not set

The Guix part of generating the code is fine though. Thanks.

So I digged little deeper and it seems that they have to be compiled into the kernel.

$ tar xf $(guix build linux-libre --source)
$ cd linux-5.14.17
$ guix environment linux --ad-hoc ncurses pkg-config -- make MENUCONFIG_COLOR=mono menuconfig
$ grep ANDROID .config
CONFIG_ANDROID=y
CONFIG_ANDROID_BINDER_IPC=y
CONFIG_ANDROID_BINDERFS=y
CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
# CONFIG_ANDROID_BINDER_IPC_SELFTEST is not set

Though the issue seems to come from the Archlinux Wiki[1] where they supply wrong CONFIG options.

Kind regards
Petr

[1] https://wiki.archlinux.org/title/Waydroid

Re: Custom libre kernel configuration devolving into Anbox review I guess

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 2974 bytes --]

Petr,

phodina 写道：
> Though the issue seems to come from the Archlinux Wiki[1] where 
> they supply wrong CONFIG options.

Well… yes, it's a wiki.  The Arch one in particular has a 
reputation to uphold.

Still, it[1] doesn't suggest either of the problematic

+   ("CONFIG_ASHMEM" . m)
+   ("CONFIG_ANDROID_BINDER_IPC" . m)

values.  These can't work:

  config ASHMEM
        bool "Enable the Anonymous Shared Memory Subsystem"
  config ANDROID_BINDER_IPC
        bool "Android Binder IPC Driver"

So don't waste time hunting down dependencies which don't exist. 
The third-party modules[2] were never part of Linux and are by now 
well obsolete.

From the same wiki:

> CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
> [lalala lala]
> With your new kernel, you will need to append the following to 
> your
> boot arguments:
> binder.devices=binder,hwbinder,vndbinder,anbox-binder,\
>   anbox-hwbinder,anbox-vndbinder

Why does it first recommend a different value from what ‘you will 
need’ to boot with later?  Merely because it's the Kconfig 
default?  This does not fill me with confidence.

Later(!) on, it suggests yet a third, seemingly preferred, option:

> scripts/config --set-str CONFIG_ANDROID_BINDER_DEVICES ""
> [because]
> Not everybody was happy with the binder module in Linux. To 
> address
> the issues, binderfs was created. One has to choose between the 
> old
> and the new way when compiling the kernel. With the options 
> [above],
> one will use binderfs instead.

So… maybe that's the cool (and more secure) new thing and we 
should be using binderfs without any DEVICES instead?  Is binderfs 
some kind of /dev/pts for them?  Have you tested Waydroid without 
any?

I'm picky because I want to suggest the following, which makes it 
important that at least one person understands these changes and 
that we get them right:

Do we really need yet another kernel variant?  Building 
nearly-identical kernels on CI is quite expensive, especially on 
ARM.  Let's not add them lightly.

Is this code so dubious — compared to the rest of CONFIG_STAGING, 
which we already enable — that it must be quarantined in a 
separate kernel?  If so, why?

Do these options make practical sense to enable on non-ARM 
kernels?  Does Android run on them?

Why was CONFIG_ANDROID_BINDERFS set to #f in your previous 
patch[0]?  Typo?  Evolved knowledge?

I often forget to do so myself but still recommend adding a 
human-readable ‘v1 -> v2’ changelog (that won't be added to the 
git commit message) to explain such changes and catch any 
unintented ones.

Kind regards,

T G-R

PS: Another nitpick, but as CONFIG_ANDROID ‘unlocks’ 
CONFIG_ASHMEM, please move the latter to the end of the list.

[0]: https://issues.guix.gnu.org/51771#1
[1]: https://wiki.archlinux.org/title/Waydroid
[2]: https://github.com/anbox/anbox-modules/issues/75

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

Re: Custom libre kernel configuration devolving into Anbox review I guess

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 440 bytes --]

Tobias Geerinckx-Rice 写道：
> So don't waste time hunting down dependencies which don't 
> exist. The
> third-party modules[2] were never part of Linux and are by now 
> well
> obsolete.

Seems like there's a random fork[0] that still compiles with 5.14. 
Not that I personally recommend following that white rabbit; I've 
been there many times before.

Kind regards,

T G-R

[0]: https://github.com/choff/anbox-modules

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

Re: Custom libre kernel configuration devolving into Anbox review I guess

[phodina]

Tobias,

On Saturday, November 13th, 2021 at 1:23 PM, Tobias Geerinckx-Rice <me@tobias.gr> wrote:

> Petr,
>
> phodina 写道：
>
> > Though the issue seems to come from the Archlinux Wiki[1] where > they supply wrong CONFIG options.
>
> Well… yes, it's a wiki. The Arch one in particular has a reputation to uphold.
>
> Still, it[1] doesn't suggest either of the problematic
>
> -   ("CONFIG_ASHMEM" . m)
> -   ("CONFIG_ANDROID_BINDER_IPC" . m)
>
>     values. These can't work:
>
>     config ASHMEM
>
>     bool "Enable the Anonymous Shared Memory Subsystem"
>
>     config ANDROID_BINDER_IPC
>
>     bool "Android Binder IPC Driver"
>
>     So don't waste time hunting down dependencies which don't exist. The third-party modules[2] were never part of Linux and are by now well obsolete.

I checked the kernel KConfig help on that one and compared the options with Fedora 35, where I have a running Waydroid instance.

>
>     From the same wiki:
>
> > CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
> >
> > [lalala lala]
> >
> > With your new kernel, you will need to append the following to > your
> >
> > boot arguments:
> >
> > binder.devices=binder,hwbinder,vndbinder,anbox-binder,\
> >
> > anbox-hwbinder,anbox-vndbinder
>
> Why does it first recommend a different value from what ‘you will need’ to boot with later? Merely because it's the Kconfig default? This does not fill me with confidence.

As you already mentioned this sounds fishy. I'm also noticing the inconsistencies and would like to get it right here in Guix.

>
> Later(!) on, it suggests yet a third, seemingly preferred, option:
>
> > scripts/config --set-str CONFIG_ANDROID_BINDER_DEVICES ""
> >
> > [because]
> >
> > Not everybody was happy with the binder module in Linux. To > address
> >
> > the issues, binderfs was created. One has to choose between the > old
> >
> > and the new way when compiling the kernel. With the options > [above],
> >
> > one will use binderfs instead.
>
> So… maybe that's the cool (and more secure) new thing and we should be using binderfs without any DEVICES instead? Is binderfs some kind of /dev/pts for them? Have you tested Waydroid without any?

I'm trying to test/port Waydroid now on Guix. However, firstly it requires the modification of the kernel as already discussed (though not resolved on what exact configuration is needed).

Secondly there needs to be the Waydroid Python userspace app. I've created a patch for that here [1]. Still awaits review.

In order to run Waydroid you need Wayland compositor and LXD service. The latter is not yet implemented. I've found a patch implementing the support, but it need some polishing [2]. Though at the current state the LXD runs.

After adding the LXD service to the system I managed to initiate the Waydroid.

But as I attempt to open a session I get error regarding not running wayland session which is strange.

# waydroid.py session start
Password:
[07:40:41] XDG Session is not "wayland"

The official setup is Debian with systemd, so I'll investigate this issue further on the repo's github issues.

On Fedora and Archlinux I don't have this issue.

>
> I'm picky because I want to suggest the following, which makes it important that at least one person understands these changes and that we get them right:
>
> Do we really need yet another kernel variant? Building nearly-identical kernels on CI is quite expensive, especially on ARM. Let's not add them lightly.
>

I totally agree with you as another kernel variant is huge demand on the CI resources. On the other hand people not wanting running the Android apps on their machine would probably prefer to have this disabled, right?

Also is it possible to add the kernel variant but mark it not to build on the CI?

> Is this code so dubious — compared to the rest of CONFIG_STAGING, which we already enable — that it must be quarantined in a separate kernel? If so, why?
>

Well you add additional code complexity, creating kernel which needs more resources and creating a potential security issue with new syscall. Though I'm not expert in this area and it definitely need deeper discussion.

I also used/I'm using Fedora/Archlinux and the current status there is that they these setting are not enabled by default in the "main" kernel, but they build one - Zen (Arch) and XanMod (Fedora) - where these options are enabled.

Don't know the reason why they separate it, IMHO it might be due to the reasons mentioned above.

> Do these options make practical sense to enable on non-ARM kernels? Does Android run on them?
>

Yes, you can run Android images for x86 [3]. You can play Android game or in my case I run unfortuantely a proprietary messaging app to chat with friends without touching the phone.

At the moment I run Waydroid on my x86 machine and on PinePhone (aarch64).

> Why was CONFIG_ANDROID_BINDERFS set to #f in your previous patch[0]? Typo? Evolved knowledge?
>

Yes, this was a typo. Sorry for the confusion.

> I often forget to do so myself but still recommend adding a human-readable ‘v1 -> v2’ changelog (that won't be added to the git commit message) to explain such changes and catch any unintented ones.
>

Good idea, I'll add it to my list of this to check.

> Kind regards,
>
> T G-R
>
> PS: Another nitpick, but as CONFIG_ANDROID ‘unlocks’ CONFIG_ASHMEM, please move the latter to the end of the list.

Sure.

>
> [0]: https://issues.guix.gnu.org/51771#1
>
> [1]: https://wiki.archlinux.org/title/Waydroid
>
> [2]: https://github.com/anbox/anbox-modules/issues/75


 [1]: https://issues.guix.gnu.org/51737
 [2]: https://issues.guix.gnu.org/50133
 [3]: https://www.android-x86.org/
 [4]: https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html