Replace ashmem backend with memfd_create (runtime fallback)

shmem.c

@@ -11,6 +11,8 @@
 #include <string.h>
 #include <sys/mman.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/un.h>
 #include <unistd.h>
 #include <paths.h>
@@ -111,45 +113,66 @@ static int ancil_recv_fd(int sock)
 	return ((int*) CMSG_DATA(cmsg))[0];
 }
 
-static int ashmem_get_size_region(int fd)
-{
-#if __ANDROID_API__ >= 26
-	return ASharedMemory_getSize(fd);
-#else
-	return TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_GET_SIZE, NULL));
-#endif
-}
-
 /*
- * ashmem_create_region - creates a new named ashmem region and returns the file
- * descriptor, or <0 on error.
+ * Probe backends at runtime from newest/preferred to oldest:
+ *   1. memfd_create  (Linux 3.17+, anonymous, no FS dependency)
+ *   2. ASharedMemory (Android API 26+, NDK ashmem wrapper)
+ *   3. /dev/ashmem    (legacy, deprecated on some kernels)
  *
- * `name' is the label to give the region (visible in /proc/pid/maps)
- * `size' is the size of the region, in page-aligned bytes
+ * On newer devices (Honor kernel 5.10.226), ashmem SET_SIZE returns
+ * ENOTTY even though /dev/ashmem exists. Runtime fallback handles this.
  */
-static int ashmem_create_region(char const* name, size_t size)
+static int shmem_create_region(char const* name, size_t size)
 {
+	int fd = -1;
+
+	// 1) memfd_create — Linux 3.17+, available on most Android 10+ devices
+	//    Use direct syscall for NDK compatibility.
+	fd = syscall(279, name, 1);  // SYS_memfd_create=279 (arm64), MFD_CLOEXEC=1
+	if (fd >= 0) {
+		if (ftruncate(fd, (off_t)size) == 0)
+			return fd;
+		close(fd);
+	}
+
+	// 2) ASharedMemory — Android 8+ (API 26+)
 #if __ANDROID_API__ >= 26
-	return ASharedMemory_create(name, size);
-#else
-	// From https://android.googlesource.com/platform/system/core/+/master/libcutils/ashmem-dev.c
-	int fd = open("/dev/ashmem", O_RDWR);
+	fd = ASharedMemory_create(name, size);
+	if (fd >= 0)
+		return fd;
+#endif
+
+	// 3) /dev/ashmem — legacy, may return ENOTTY on newer kernels
+	fd = open("/dev/ashmem", O_RDWR);
 	if (fd < 0) return fd;
 
 	char name_buffer[ASHMEM_NAME_LEN] = {0};
 	strncpy(name_buffer, name, sizeof(name_buffer));
 	name_buffer[sizeof(name_buffer)-1] = 0;
 
-	int ret = ioctl(fd, ASHMEM_SET_NAME, name_buffer);
-	if (ret < 0) goto error;
-
-	ret = ioctl(fd, ASHMEM_SET_SIZE, size);
-	if (ret < 0) goto error;
+	if (ioctl(fd, ASHMEM_SET_NAME, name_buffer) < 0)
+		goto error;
+	if (ioctl(fd, ASHMEM_SET_SIZE, size) < 0)
+		goto error;
 
 	return fd;
 error:
 	close(fd);
-	return ret;
+	return -1;
+}
+
+static int shmem_get_size_region(int fd)
+{
+	// Try fstat first — works for memfd and regular fds
+	struct stat st;
+	if (fstat(fd, &st) == 0)
+		return (int)st.st_size;
+
+	// Fall back to ashmem-specific ioctl
+#if __ANDROID_API__ >= 26
+	return ASharedMemory_getSize(fd);
+#else
+	return TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_GET_SIZE, NULL));
 #endif
 }
 
@@ -275,9 +298,9 @@ static int ashv_read_remote_segment(int shmid)
 	}
 	close(recvsock);
 
-	int size = ashmem_get_size_region(descriptor);
+	int size = shmem_get_size_region(descriptor);
 	if (size == 0 || size == -1) {
-		DBG ("%s: ERROR: ashmem_get_size_region() returned %d on socket %s: %s", __PRETTY_FUNCTION__, size, addr.sun_path + 1, strerror(errno));
+		DBG ("%s: ERROR: shmem_get_size_region() returned %d on socket %s: %s", __PRETTY_FUNCTION__, size, addr.sun_path + 1, strerror(errno));
 		return -1;
 	}
 
@@ -399,14 +422,14 @@ int shmget(key_t key, size_t size, int flags)
 	shmem = realloc(shmem, shmem_amount * sizeof(shmem_t));
 	size = ROUND_UP(size, getpagesize());
 	shmem[idx].size = size;
-	shmem[idx].descriptor = ashmem_create_region(buf, size);
+	shmem[idx].descriptor = shmem_create_region(buf, size);
 	shmem[idx].addr = NULL;
 	shmem[idx].id = shmid;
 	shmem[idx].markedForDeletion = false;
 	shmem[idx].key = key;
 
 	if (shmem[idx].descriptor < 0) {
-		DBG("%s: ashmem_create_region() failed for size %zu: %s", __PRETTY_FUNCTION__, size, strerror(errno));
+		DBG("%s: shmem_create_region() failed for size %zu: %s", __PRETTY_FUNCTION__, size, strerror(errno));
 		shmem_amount --;
 		shmem = realloc(shmem, shmem_amount * sizeof(shmem_t));
 		pthread_mutex_unlock (&mutex);