mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-01-18 04:20:44 +00:00
eafedbc7c0
We're generally not proponents of rewrites (nasty uncomfortable things that make you late for dinner!). So why rewrite Binder? Binder has been evolving over the past 15+ years to meet the evolving needs of Android. Its responsibilities, expectations, and complexity have grown considerably during that time. While we expect Binder to continue to evolve along with Android, there are a number of factors that currently constrain our ability to develop/maintain it. Briefly those are: 1. Complexity: Binder is at the intersection of everything in Android and fulfills many responsibilities beyond IPC. It has become many things to many people, and due to its many features and their interactions with each other, its complexity is quite high. In just 6kLOC it must deliver transactions to the right threads. It must correctly parse and translate the contents of transactions, which can contain several objects of different types (e.g., pointers, fds) that can interact with each other. It controls the size of thread pools in userspace, and ensures that transactions are assigned to threads in ways that avoid deadlocks where the threadpool has run out of threads. It must track refcounts of objects that are shared by several processes by forwarding refcount changes between the processes correctly. It must handle numerous error scenarios and it combines/nests 13 different locks, 7 reference counters, and atomic variables. Finally, It must do all of this as fast and efficiently as possible. Minor performance regressions can cause a noticeably degraded user experience. 2. Things to improve: Thousand-line functions [1], error-prone error handling [2], and confusing structure can occur as a code base grows organically. After more than a decade of development, this codebase could use an overhaul. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/android/binder.c?h=v6.5#n2896 [2]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/android/binder.c?h=v6.5#n3658 3. Security critical: Binder is a critical part of Android's sandboxing strategy. Even Android's most de-privileged sandboxes (e.g. the Chrome renderer, or SW Codec) have direct access to Binder. More than just about any other component, it's important that Binder provide robust security, and itself be robust against security vulnerabilities. It's #1 (high complexity) that has made continuing to evolve Binder and resolving #2 (tech debt) exceptionally difficult without causing #3 (security issues). For Binder to continue to meet Android's needs, we need better ways to manage (and reduce!) complexity without increasing the risk. The biggest change is obviously the choice of programming language. We decided to use Rust because it directly addresses a number of the challenges within Binder that we have faced during the last years. It prevents mistakes with ref counting, locking, bounds checking, and also does a lot to reduce the complexity of error handling. Additionally, we've been able to use the more expressive type system to encode the ownership semantics of the various structs and pointers, which takes the complexity of managing object lifetimes out of the hands of the programmer, reducing the risk of use-after-frees and similar problems. Rust has many different pointer types that it uses to encode ownership semantics into the type system, and this is probably one of the most important aspects of how it helps in Binder. The Binder driver has a lot of different objects that have complex ownership semantics; some pointers own a refcount, some pointers have exclusive ownership, and some pointers just reference the object and it is kept alive in some other manner. With Rust, we can use a different pointer type for each kind of pointer, which enables the compiler to enforce that the ownership semantics are implemented correctly. Another useful feature is Rust's error handling. Rust allows for more simplified error handling with features such as destructors, and you get compilation failures if errors are not properly handled. This means that even though Rust requires you to spend more lines of code than C on things such as writing down invariants that are left implicit in C, the Rust driver is still slightly smaller than C binder: Rust is 5.5kLOC and C is 5.8kLOC. (These numbers are excluding blank lines, comments, binderfs, and any debugging facilities in C that are not yet implemented in the Rust driver. The numbers include abstractions in rust/kernel/ that are unlikely to be used by other drivers than Binder.) Although this rewrite completely rethinks how the code is structured and how assumptions are enforced, we do not fundamentally change *how* the driver does the things it does. A lot of careful thought has gone into the existing design. The rewrite is aimed rather at improving code health, structure, readability, robustness, security, maintainability and extensibility. We also include more inline documentation, and improve how assumptions in the code are enforced. Furthermore, all unsafe code is annotated with a SAFETY comment that explains why it is correct. We have left the binderfs filesystem component in C. Rewriting it in Rust would be a large amount of work and requires a lot of bindings to the file system interfaces. Binderfs has not historically had the same challenges with security and complexity, so rewriting binderfs seems to have lower value than the rest of Binder. Correctness and feature parity ------------------------------ Rust binder passes all tests that validate the correctness of Binder in the Android Open Source Project. We can boot a device, and run a variety of apps and functionality without issues. We have performed this both on the Cuttlefish Android emulator device, and on a Pixel 6 Pro. As for feature parity, Rust binder currently implements all features that C binder supports, with the exception of some debugging facilities. The missing debugging facilities will be added before we submit the Rust implementation upstream. Tracepoints ----------- I did not include all of the tracepoints as I felt that the mechansim for making C access fields of Rust structs should be discussed on list separately. I also did not include the support for building Rust Binder as a module since that requires exporting a bunch of additional symbols on the C side. Original RFC Link with old benchmark numbers: https://lore.kernel.org/r/20231101-rust-binder-v1-0-08ba9197f637@google.com Co-developed-by: Wedson Almeida Filho <wedsonaf@gmail.com> Signed-off-by: Wedson Almeida Filho <wedsonaf@gmail.com> Co-developed-by: Matt Gilbride <mattgilbride@google.com> Signed-off-by: Matt Gilbride <mattgilbride@google.com> Acked-by: Carlos Llamas <cmllamas@google.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://lore.kernel.org/r/20250919-rust-binder-v2-1-a384b09f28dd@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
88 lines
2.9 KiB
C
88 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/* rust_binder_internal.h
|
|
*
|
|
* This file contains internal data structures used by Rust Binder. Mostly,
|
|
* these are type definitions used only by binderfs or things that Rust Binder
|
|
* define and export to binderfs.
|
|
*
|
|
* It does not include things exported by binderfs to Rust Binder since this
|
|
* file is not included as input to bindgen.
|
|
*
|
|
* Copyright (C) 2025 Google LLC.
|
|
*/
|
|
|
|
#ifndef _LINUX_RUST_BINDER_INTERNAL_H
|
|
#define _LINUX_RUST_BINDER_INTERNAL_H
|
|
|
|
#define RUST_BINDERFS_SUPER_MAGIC 0x6c6f6f71
|
|
|
|
#include <linux/seq_file.h>
|
|
#include <uapi/linux/android/binder.h>
|
|
#include <uapi/linux/android/binderfs.h>
|
|
|
|
/*
|
|
* The internal data types in the Rust Binder driver are opaque to C, so we use
|
|
* void pointer typedefs for these types.
|
|
*/
|
|
typedef void *rust_binder_context;
|
|
|
|
/**
|
|
* struct binder_device - information about a binder device node
|
|
* @minor: the minor number used by this device
|
|
* @ctx: the Rust Context used by this device, or null for binder-control
|
|
*
|
|
* This is used as the private data for files directly in binderfs, but not
|
|
* files in the binder_logs subdirectory. This struct owns a refcount on `ctx`
|
|
* and the entry for `minor` in `binderfs_minors`. For binder-control `ctx` is
|
|
* null.
|
|
*/
|
|
struct binder_device {
|
|
int minor;
|
|
rust_binder_context ctx;
|
|
};
|
|
|
|
int rust_binder_stats_show(struct seq_file *m, void *unused);
|
|
int rust_binder_state_show(struct seq_file *m, void *unused);
|
|
int rust_binder_transactions_show(struct seq_file *m, void *unused);
|
|
int rust_binder_proc_show(struct seq_file *m, void *pid);
|
|
|
|
extern const struct file_operations rust_binder_fops;
|
|
rust_binder_context rust_binder_new_context(char *name);
|
|
void rust_binder_remove_context(rust_binder_context device);
|
|
|
|
/**
|
|
* binderfs_mount_opts - mount options for binderfs
|
|
* @max: maximum number of allocatable binderfs binder devices
|
|
* @stats_mode: enable binder stats in binderfs.
|
|
*/
|
|
struct binderfs_mount_opts {
|
|
int max;
|
|
int stats_mode;
|
|
};
|
|
|
|
/**
|
|
* binderfs_info - information about a binderfs mount
|
|
* @ipc_ns: The ipc namespace the binderfs mount belongs to.
|
|
* @control_dentry: This records the dentry of this binderfs mount
|
|
* binder-control device.
|
|
* @root_uid: uid that needs to be used when a new binder device is
|
|
* created.
|
|
* @root_gid: gid that needs to be used when a new binder device is
|
|
* created.
|
|
* @mount_opts: The mount options in use.
|
|
* @device_count: The current number of allocated binder devices.
|
|
* @proc_log_dir: Pointer to the directory dentry containing process-specific
|
|
* logs.
|
|
*/
|
|
struct binderfs_info {
|
|
struct ipc_namespace *ipc_ns;
|
|
struct dentry *control_dentry;
|
|
kuid_t root_uid;
|
|
kgid_t root_gid;
|
|
struct binderfs_mount_opts mount_opts;
|
|
int device_count;
|
|
struct dentry *proc_log_dir;
|
|
};
|
|
|
|
#endif /* _LINUX_RUST_BINDER_INTERNAL_H */
|