1

Headless Android

AnDevCon III

Karim Yaghmour@karimyaghmour

karim.yaghmour@opersys.com

2

These slides are made available to you under a Creative Commons Share-Alike 3.0 license. The full terms of this license are here: https://creativecommons.org/licenses/by-sa/3.0/

Attribution requirements and misc., PLEASE READ:

● This slide must remain as-is in this specific location (slide #2), everything else you are free to change; including the logo :-)

● Use of figures in other documents must feature the below “Originals at” URL immediately under that figure and the below copyright notice where appropriate.

● You are free to fill in the “Delivered and/or customized by” space on the right as you see fit.

● You are FORBIDEN from using the default “About” slide as-is or any of its contents.

(C) Copyright 2012, Opersys inc.

These slides created by: Karim Yaghmour

Originals at: www.opersys.com/community/docs

Delivered and/or customized by

3

About

● Author of:

● Introduced Linux Trace Toolkit in 1999● Originated Adeos and relayfs (kernel/relay.c)● Training, Custom Dev, Consulting, ...

4

+ =

“And then GNU came back for revenge ...” -- Tarantino's sequel

5

Agenda

● Why?● What is it exactly?● How to get there?● What's in there anyway?● Demo

6

1. Why?

● Took me a long time to wrap my head around● “Why don't you just use embedded Linux?”

● What's “Embedded Linux” anyway?

7

1.1. What's “Embedded Linux”?

● A set of ad-hoc methods to package the Linux kernel with a (minimal) filesystem.

● FS content “to be determined” case-by-case

● APIs are specific to each device/build

● “Core software”:● BusyBox

● U-Boot

● GNU Toolchain

● Your flavor of:● glibc or uClibc or eglibc

● yocto or buildroot or eldk or ltib or ptxdist or ...

● No serious UX framework

8

1.2. What does Android offer?

● ... apart from its increasingly well known UX ...

● Fully-integrated Eclipse IDE

● SDK/NDK

● ADB

● Fastboot

● Published, well-known, and very rich APIs

● A large and growing developer community

● And still we can use the usual suspects:● GNU toolchain, BusyBox, u- boot, glibc, ...

An actual standardized dev. env. across all product lines

9

2. What is “Headless Android” exactly?

10

2.1. Possibilities

● No Java:● TinyAndroid:

$ BUILD_TINY_ANDROID=true make ­j4

● AOSP w/ custom products .mk file

● The full-blown stack without:● SurfaceFlinger● WindowManager● WallpaperService● InputMethodManager

11

2.2. Tiny Android

● 3MB filesystem● Minimal root fs● init● toolbox + shell● adb● bionic + utility libs● No “system/framework/”● No “system/app”

12

2.3. AOSP w/ custom product .mk

● Have a look at:● build/target/product/*.mk

● Create your own device under “/device” and have fun

● Disable zygote at startup● Remove all apks● ...

13

3. How do we get the full stack?

?

14

3.1. System Services

15

3.2. Challenges

● Integration● System Services are tightly coupled● House of cards

● Dependencies are deeply buried in internals● There are ~100KLOC of System Services● Framework expects all System Services● Rendering/Display are central tenants of arch.

16

3.3. Android's display architecture

17

3.4. Attempt #1

● Target: Kill SurfaceFlinger and WindowManager● Result: FAIL

18

3.5. Attempt #2

● Target: Kill link between SF and FB● Result: FAIL

19

3.6. Attempt #3

● Target: Use VirtualFB● Result: FAIL

20

3.7. Attempt #4

● Target: Kill SurfaceFlinger and WindowManager● Result: SUCCESS!!!

21

3.8. How?

● Disable:

● SurfaceFlinger

● WindowManager

● WallpaperService

● InputMethodManager

● SystemUI

● Don't let SurfaceFlinger Client try to open binder to SurfaceFlinger

● Feed bogus values back from SurfaceFlinger Client

● Disable qemud (emulator artefact)

● Tweak internals by disabling key calls:

● In ActivityStack.java:

– startHomeActivityLocked()

– setAppStartingWindow()

● wm.detectSafeMode()

● wm.systemReady()

● wm.reclaimSuraceMemoryLocked()

22

4. What's in there anyway?

● Most everything Android gives you:● No UX

● Fully-integrated Eclipse IDE

● SDK/NDK

● ADB

● Fastboot

● Published, well-known, and very rich APIs

● A large and growing developer community

● And still we can use the usual suspects:

– GNU toolchain, BusyBox, u- boot, glibc, ...

● Caveat -- “Activity” no longer works

● You have:● Services

● ContentProviders

● BroadcastReceivers

23

4.1. Usage recommendations

● Use “am” to start your components● Mark your apks as “persistent”● ...

24

5. Demo

25

● Full AndroidMemTotal:          94096 kBMemFree:            1628 kBBuffers:               0 kBCached:            31248 kBSwapCached:            0 kBActive:            33288 kBInactive:          40900 kBActive(anon):      25164 kBInactive(anon):    28132 kBActive(file):       8124 kBInactive(file):    12768 kBUnevictable:        6672 kBMlocked:               0 kBSwapTotal:             0 kBSwapFree:              0 kBDirty:                 0 kBWriteback:             0 kBAnonPages:         49648 kBMapped:            17272 kBSlab:               3492 kBSReclaimable:        972 kBSUnreclaim:         2520 kBPageTables:         4692 kBNFS_Unstable:          0 kBBounce:                0 kBWritebackTmp:          0 kBCommitLimit:       47048 kBCommitted_AS:     710456 kBVmallocTotal:     876544 kBVmallocUsed:       15456 kBVmallocChunk:     852996 kB

5.1. In numbers (/proc/meminfo)● Headless Android

MemTotal:          93960 kBMemFree:           13676 kBBuffers:               0 kBCached:            48844 kBSwapCached:            0 kBActive:            29484 kBInactive:          44328 kBActive(anon):      25020 kBInactive(anon):        0 kBActive(file):       4464 kBInactive(file):    44328 kBUnevictable:           0 kBMlocked:               0 kBSwapTotal:             0 kBSwapFree:              0 kBDirty:                 0 kBWriteback:             0 kBAnonPages:         24988 kBMapped:            23820 kBSlab:               2808 kBSReclaimable:        892 kBSUnreclaim:         1916 kBPageTables:         2096 kBNFS_Unstable:          0 kBBounce:                0 kBWritebackTmp:          0 kBCommitLimit:       46980 kBCommitted_AS:     276908 kBVmallocTotal:     876544 kBVmallocUsed:        5256 kBVmallocChunk:     870404 kB

12%

7% vs. 0%

26

●Full AndroidUSER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAMEroot      1     0     268    180   c009b74c 0000875c S /initroot      2     0     0      0     c004e72c 00000000 S kthreaddroot      3     2     0      0     c003fdc8 00000000 S ksoftirqd/0root      4     2     0      0     c004b2c4 00000000 S events/0root      5     2     0      0     c004b2c4 00000000 S khelperroot      6     2     0      0     c004b2c4 00000000 S suspendroot      7     2     0      0     c004b2c4 00000000 S kblockd/0root      8     2     0      0     c004b2c4 00000000 S cqueueroot      9     2     0      0     c018179c 00000000 S kseriodroot      10    2     0      0     c004b2c4 00000000 S kmmcdroot      11    2     0      0     c006fc74 00000000 S pdflushroot      12    2     0      0     c006fc74 00000000 S pdflushroot      13    2     0      0     c0079750 00000000 D kswapd0root      14    2     0      0     c004b2c4 00000000 S aio/0root      22    2     0      0     c017ef48 00000000 S mtdblockdroot      23    2     0      0     c004b2c4 00000000 S kstripedroot      24    2     0      0     c004b2c4 00000000 S hid_compatroot      25    2     0      0     c004b2c4 00000000 S rpciod/0root      26    1     232    136   c009b74c 0000875c S /sbin/ueventdsystem    27    1     804    196   c01a94a4 afd0b6fc S /system/bin/servicemanagerroot      28    1     3864   308   ffffffff afd0bdac S /system/bin/voldroot      29    1     3836   324   ffffffff afd0bdac S /system/bin/netdroot      30    1     664    188   c01b52b4 afd0c0cc S /system/bin/debuggerdradio     31    1     5396   448   ffffffff afd0bdac S /system/bin/rildroot      32    1     60884  16476 c009b74c afd0b844 S zygotemedia     33    1     17976  1016  ffffffff afd0b6fc S /system/bin/mediaserverbluetooth 34    1     1256   220   c009b74c afd0c59c S /system/bin/dbus­daemonroot      35    1     812    232   c02181f4 afd0b45c S /system/bin/installdkeystore  36    1     1744   212   c01b52b4 afd0c0cc S /system/bin/keystoreroot      38    1     824    268   c00b8fec afd0c51c S /system/bin/qemudshell     40    1     732    200   c0158eb0 afd0b45c S /system/bin/shroot      41    1     3364   168   ffffffff 00008294 S /sbin/adbdsystem    62    32    122088 25860 ffffffff afd0b6fc S system_serverapp_19    116   32    77280  17520 ffffffff afd0c51c S com.android.inputmethod.latinradio     122   32    86100  17992 ffffffff afd0c51c S com.android.phonesystem    126   32    73316  19028 ffffffff afd0c51c S com.android.systemuiapp_25    136   32    76564  21276 ffffffff afd0c51c S com.android.launcherroot      156   41    2132   452   c003da38 00110c84 S /bin/shapp_1     174   32    76092  18268 ffffffff afd0c51c S android.process.acoreapp_9     218   32    73168  17052 ffffffff afd0c51c S android.process.mediaapp_23    260   32    82464  16584 ffffffff afd0c51c S com.android.mmsapp_28    277   32    72804  17852 ffffffff afd0c51c S com.android.emailapp_13    289   32    70796  16532 ffffffff afd0c51c S com.android.quicksearchboxapp_21    309   32    69764  15552 ffffffff afd0c51c S com.android.protipsapp_18    318   32    70324  15812 ffffffff afd0c51c S com.android.musicapp_3     327   32    71484  16940 ffffffff afd0c51c S com.cooliris.mediaroot      344   156   888    328   00000000 afd0b45c R /system/bin/ps

5.2. Processes●

Headless AndroidUSER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAMEroot      1     0     268    180   c009ebcc 0000875c S /initroot      2     0     0      0     c004e8fc 00000000 S kthreaddroot      3     2     0      0     c003fc70 00000000 S ksoftirqd/0root      4     2     0      0     c004b22c 00000000 S events/0root      5     2     0      0     c004b22c 00000000 S khelperroot      6     2     0      0     c004b22c 00000000 S suspendroot      7     2     0      0     c004b22c 00000000 S kblockd/0root      8     2     0      0     c004b22c 00000000 S cqueueroot      9     2     0      0     c017c974 00000000 S kseriodroot      10    2     0      0     c004b22c 00000000 S kmmcdroot      11    2     0      0     c0072f5c 00000000 S pdflushroot      12    2     0      0     c0072f5c 00000000 S pdflushroot      13    2     0      0     c00777bc 00000000 S kswapd0root      14    2     0      0     c004b22c 00000000 S aio/0root      22    2     0      0     c0179ec0 00000000 S mtdblockdroot      23    2     0      0     c004b22c 00000000 S kstripedroot      24    2     0      0     c004b22c 00000000 S hid_compatroot      27    2     0      0     c004b22c 00000000 S rpciod/0root      28    1     232    136   c009ebcc 0000875c S /sbin/ueventdsystem    29    1     804    260   c01a4834 afd0b6fc S /system/bin/servicemanagerroot      30    1     3864   568   ffffffff afd0bdac S /system/bin/voldroot      31    1     3832   556   ffffffff afd0bdac S /system/bin/netdroot      32    1     664    264   c01b08f8 afd0c0cc S /system/bin/debuggerdroot      33    1     1268   588   c00522ac afd0bdac S /system/bin/rildroot      34    1     60864  25992 c009ebcc afd0b844 S zygotemedia     35    1     17972  3712  ffffffff afd0b6fc S /system/bin/mediaserverbluetooth 36    1     1256   572   c009ebcc afd0c59c S /system/bin/dbus­daemonroot      37    1     812    316   c0213b90 afd0b45c S /system/bin/installdkeystore  38    1     1744   432   c01b08f8 afd0c0cc S /system/bin/keystoreshell     41    1     732    312   c01532bc afd0b45c S /system/bin/shroot      42    1     3360   164   ffffffff 00008294 S /sbin/adbdsystem    60    34    101104 28276 ffffffff afd0b6fc S system_serverradio     99    34    81624  22600 ffffffff afd0c51c S com.android.phonesystem    116   34    73768  20740 ffffffff afd0c51c S com.android.settingsapp_1     133   34    81120  25596 ffffffff afd0c51c S android.process.acoreroot      147   42    732    344   c003d8d0 afd0c3ac S /system/bin/shroot      153   147   888    320   00000000 afd0b45c R ps

27

●Full Android0 phone: [com.android.internal.telephony.ITelephony]1 iphonesubinfo: [com.android.internal.telephony.IPhoneSubInfo]2 simphonebook: [com.android.internal.telephony.IIccPhoneBook]3 isms: [com.android.internal.telephony.ISms]4 opersys: [android.os.IOpersysService]5 diskstats: []6 appwidget: [com.android.internal.appwidget.IAppWidgetService]7 backup: [android.app.backup.IBackupManager]8 uimode: [android.app.IUiModeManager]9 usb: [android.hardware.usb.IUsbManager]10 audio: [android.media.IAudioService]11 wallpaper: [android.app.IWallpaperManager]12 dropbox: [com.android.internal.os.IDropBoxManagerService]13 search: [android.app.ISearchManager]14 location: [android.location.ILocationManager]15 devicestoragemonitor: []16 notification: [android.app.INotificationManager]17 mount: [IMountService]18 accessibility: [android.view.accessibility.IAccessibilityManager]19 throttle: [android.net.IThrottleManager]20 connectivity: [android.net.IConnectivityManager]21 wifi: [android.net.wifi.IWifiManager]22 network_management: [android.os.INetworkManagementService]23 netstat: [android.os.INetStatService]24 input_method: [com.android.internal.view.IInputMethodManager]25 clipboard: [android.text.IClipboard]26 statusbar: [com.android.internal.statusbar.IStatusBarService]27 device_policy: [android.app.admin.IDevicePolicyManager]28 window: [android.view.IWindowManager]29 alarm: [android.app.IAlarmManager]30 vibrator: [android.os.IVibratorService]31 hardware: [android.os.IHardwareService]32 battery: []33 content: [android.content.IContentService]34 account: [android.accounts.IAccountManager]35 permission: [android.os.IPermissionController]36 cpuinfo: []37 meminfo: []38 activity: [android.app.IActivityManager]39 package: [android.content.pm.IPackageManager]40 telephony.registry: [com.android.internal.telephony.ITelephonyRegistry]41 usagestats: [com.android.internal.app.IUsageStats]42 batteryinfo: [com.android.internal.app.IBatteryStats]43 power: [android.os.IPowerManager]44 entropy: []45 sensorservice: [android.gui.SensorServer]46 SurfaceFlinger: [android.ui.ISurfaceComposer]47 media.audio_policy: [android.media.IAudioPolicyService]48 media.camera: [android.hardware.ICameraService]49 media.player: [android.media.IMediaPlayerService]50 media.audio_flinger: [android.media.IAudioFlinger]

5.3. Services●

Headless Android0 phone: [com.android.internal.telephony.ITelephony]1 iphonesubinfo: [com.android.internal.telephony.IPhoneSubInfo]2 simphonebook: [com.android.internal.telephony.IIccPhoneBook]3 isms: [com.android.internal.telephony.ISms]4 diskstats: []5 appwidget: [com.android.internal.appwidget.IAppWidgetService]6 backup: [android.app.backup.IBackupManager]7 uimode: [android.app.IUiModeManager]8 usb: [android.hardware.usb.IUsbManager]9 audio: [android.media.IAudioService]10 dropbox: [com.android.internal.os.IDropBoxManagerService]11 search: [android.app.ISearchManager]12 location: [android.location.ILocationManager]13 devicestoragemonitor: []14 notification: [android.app.INotificationManager]15 mount: [IMountService]16 accessibility: [android.view.accessibility.IAccessibilityManager]17 throttle: [android.net.IThrottleManager]18 connectivity: [android.net.IConnectivityManager]19 wifi: [android.net.wifi.IWifiManager]20 network_management: [android.os.INetworkManagementService]21 netstat: [android.os.INetStatService]22 clipboard: [android.text.IClipboard]23 statusbar: [com.android.internal.statusbar.IStatusBarService]24 device_policy: [android.app.admin.IDevicePolicyManager]25 alarm: [android.app.IAlarmManager]26 vibrator: [android.os.IVibratorService]27 hardware: [android.os.IHardwareService]28 battery: []29 content: [android.content.IContentService]30 account: [android.accounts.IAccountManager]31 permission: [android.os.IPermissionController]32 cpuinfo: []33 meminfo: []34 activity: [android.app.IActivityManager]35 package: [android.content.pm.IPackageManager]36 telephony.registry: [com.android.internal.telephony.ITelephonyRegistry]37 usagestats: [com.android.internal.app.IUsageStats]38 batteryinfo: [com.android.internal.app.IBatteryStats]39 power: [android.os.IPowerManager]40 entropy: []41 sensorservice: [android.gui.SensorServer]42 media.audio_policy: [android.media.IAudioPolicyService]43 media.camera: [android.hardware.ICameraService]44 media.player: [android.media.IMediaPlayerService]45 media.audio_flinger: [android.media.IAudioFlinger]

28

6. Housekeeping

● Work in progress / proof-of-concept● Do NOT ship a product with this just yet● Branch in cyborgstack: cyborgstack.org● I haven't bothered removing any of the

standard apps: Browser, Email, Launcher2, ...● Lingering references to WindowManager in

ActivityManager● ... and likely tons I overlooked or didn't test ...

29

Thank you ...

VZADC3

karim.yaghmour@opersys.com

And then he said ...

“As your leader, I encourage you from time to time, and always in a respectful manner, to question my logic. If you're unconvinced that a particular plan of action I've decided is the wisest, tell me so, but allow me to convince you and I promise you right here and now, no subject will ever be taboo. Except, of course, the subject that was just under discussion. The price you pay for bringing up either my GNU or Linux heritage as a negative is... I collect your fucking head. Just like this fucker here. Now, if any of you sons of bitches got anything else to say, now's the fucking time!”