Karim Yaghmour's "Headless Android" presentation at AnDevCon3

1. Headless Android
AnDevCon III
Karim Yaghmour
@karimyaghmour
karim.yaghmour@opersys.com
1

2. These slides are made available to you under a Creative Commons Delivered and/or customized by
Share-Alike 3.0 license. The full terms of this license are here:
https://creativecommons.org/licenses/by-sa/3.0/
Attribution requirements and misc., PLEASE READ:
● This slide must remain as-is in this specific location (slide #2),
everything else you are free to change; including the logo :-)
● Use of figures in other documents must feature the below
“Originals at” URL immediately under that figure and the below
copyright notice where appropriate.
● You are free to fill in the “Delivered and/or customized by” space
on the right as you see fit.
● You are FORBIDEN from using the default “About” slide as-is or
any of its contents.
(C) Copyright 2012, Opersys inc.
These slides created by: Karim Yaghmour
Originals at: www.opersys.com/community/docs
2

3. About
● Author of:
● Introduced Linux Trace Toolkit in 1999
● Originated Adeos and relayfs (kernel/relay.c)
● Training, Custom Dev, Consulting, ...
3

4. + =
“And then GNU came back for revenge ...” -- Tarantino's sequel
4

5. Agenda
● Why?
● What is it exactly?
● How to get there?
● What's in there anyway?
● Demo
5

6. 1. Why?
● Took me a long time to wrap my head around
● “Why don't you just use embedded Linux?”
● What's “Embedded Linux” anyway?
6

7. 1.1. What's “Embedded Linux”?
● A set of ad-hoc methods to package the Linux kernel with a
(minimal) filesystem.
● FS content “to be determined” case-by-case
● APIs are specific to each device/build
● “Core software”:
● BusyBox
● U-Boot
● GNU Toolchain
● Your flavor of:
● glibc or uClibc or eglibc
● yocto or buildroot or eldk or ltib or ptxdist or ...
● No serious UX framework
7

8. 1.2. What does Android offer?
● ... apart from its increasingly well known UX ...
● Fully-integrated Eclipse IDE
● SDK/NDK
● ADB
● Fastboot
● Published, well-known, and very rich APIs
● A large and growing developer community
● And still we can use the usual suspects:
● GNU toolchain, BusyBox, u- boot, glibc, ...
An actual standardized dev. env. across all product lines
8

9. 2. What is “Headless Android” exactly?
9

10. 2.1. Possibilities
● No Java:
● TinyAndroid:
$ BUILD_TINY_ANDROID=true make ­j4
● AOSP w/ custom products .mk file
● The full-blown stack without:
● SurfaceFlinger
● WindowManager
● WallpaperService
● InputMethodManager
10

11. 2.2. Tiny Android
● 3MB filesystem
● Minimal root fs
● init
● toolbox + shell
● adb
● bionic + utility libs
● No “system/framework/”
● No “system/app”
11

12. 2.3. AOSP w/ custom product .mk
● Have a look at:
● build/target/product/*.mk
● Create your own device under “/device” and
have fun
● Disable zygote at startup
● Remove all apks
● ...
12

13. 3. How do we get the full stack?
?
13

14. 3.1. System Services
14

15. 3.2. Challenges
● Integration
● System Services are tightly coupled
● House of cards
● Dependencies are deeply buried in internals
● There are ~100KLOC of System Services
● Framework expects all System Services
● Rendering/Display are central tenants of arch.
15

16. 3.3. Android's display architecture
16

17. 3.4. Attempt #1
● Target: Kill SurfaceFlinger and WindowManager
● Result: FAIL
17

18. 3.5. Attempt #2
● Target: Kill link between SF and FB
● Result: FAIL
18

19. 3.6. Attempt #3
● Target: Use VirtualFB
● Result: FAIL
19

20. 3.7. Attempt #4
● Target: Kill SurfaceFlinger and WindowManager
● Result: SUCCESS!!!
20

21. 3.8. How?
● Disable:
● SurfaceFlinger
● WindowManager
● WallpaperService
● InputMethodManager
● SystemUI
● Don't let SurfaceFlinger Client try to open binder to SurfaceFlinger
● Feed bogus values back from SurfaceFlinger Client
● Disable qemud (emulator artefact)
● Tweak internals by disabling key calls:
● In ActivityStack.java:
– startHomeActivityLocked()
– setAppStartingWindow()
● wm.detectSafeMode()
● wm.systemReady()
● wm.reclaimSuraceMemoryLocked()
21

22. 4. What's in there anyway?
● Most everything Android gives you:
● No UX
● Fully-integrated Eclipse IDE
● SDK/NDK
● ADB
● Fastboot
● Published, well-known, and very rich APIs
● A large and growing developer community
● And still we can use the usual suspects:
– GNU toolchain, BusyBox, u- boot, glibc, ...
● Caveat -- “Activity” no longer works
● You have:
● Services
● ContentProviders
● BroadcastReceivers
22

23. 4.1. Usage recommendations
● Use “am” to start your components
● Mark your apks as “persistent”
● ...
23

24. 5. Demo
24

25. 5.1. In numbers (/proc/meminfo)
● Full Android ● Headless Android
MemTotal: 94096 kB 12% MemTotal: 93960 kB
MemFree: 1628 kB MemFree: 13676 kB
Buffers: 0 kB Buffers: 0 kB
Cached: 31248 kB Cached: 48844 kB
SwapCached: 0 kB SwapCached: 0 kB
Active: 33288 kB Active: 29484 kB
Inactive: 40900 kB Inactive: 44328 kB
Active(anon): 25164 kB Active(anon): 25020 kB
Inactive(anon): 28132 kB Inactive(anon): 0 kB
Active(file): 8124 kB Active(file): 4464 kB
Inactive(file): 12768 kB Inactive(file): 44328 kB
Unevictable: 6672 kB
7% vs. 0% Unevictable: 0 kB
Mlocked: 0 kB Mlocked: 0 kB
SwapTotal: 0 kB SwapTotal: 0 kB
SwapFree: 0 kB SwapFree: 0 kB
Dirty: 0 kB Dirty: 0 kB
Writeback: 0 kB Writeback: 0 kB
AnonPages: 49648 kB AnonPages: 24988 kB
Mapped: 17272 kB Mapped: 23820 kB
Slab: 3492 kB Slab: 2808 kB
SReclaimable: 972 kB SReclaimable: 892 kB
SUnreclaim: 2520 kB SUnreclaim: 1916 kB
PageTables: 4692 kB PageTables: 2096 kB
NFS_Unstable: 0 kB NFS_Unstable: 0 kB
Bounce: 0 kB Bounce: 0 kB
WritebackTmp: 0 kB WritebackTmp: 0 kB
CommitLimit: 47048 kB CommitLimit: 46980 kB
Committed_AS: 710456 kB Committed_AS: 276908 kB
VmallocTotal: 876544 kB VmallocTotal: 876544 kB
VmallocUsed: 15456 kB VmallocUsed: 5256 kB
VmallocChunk: 852996 kB VmallocChunk: 870404 kB
25

26. 5.2. Processes
●
Full Android ●
Headless Android
USER PID PPID VSIZE RSS WCHAN PC NAME USER PID PPID VSIZE RSS WCHAN PC NAME
root 1 0 268 180 c009b74c 0000875c S /init root 1 0 268 180 c009ebcc 0000875c S /init
root 2 0 0 0 c004e72c 00000000 S kthreadd root 2 0 0 0 c004e8fc 00000000 S kthreadd
root 3 2 0 0 c003fdc8 00000000 S ksoftirqd/0 root 3 2 0 0 c003fc70 00000000 S ksoftirqd/0
root 4 2 0 0 c004b2c4 00000000 S events/0 root 4 2 0 0 c004b22c 00000000 S events/0
root 5 2 0 0 c004b2c4 00000000 S khelper root 5 2 0 0 c004b22c 00000000 S khelper
root 6 2 0 0 c004b22c 00000000 S suspend
root 6 2 0 0 c004b2c4 00000000 S suspend
root 7 2 0 0 c004b22c 00000000 S kblockd/0
root 7 2 0 0 c004b2c4 00000000 S kblockd/0 root 8 2 0 0 c004b22c 00000000 S cqueue
root 8 2 0 0 c004b2c4 00000000 S cqueue root 9 2 0 0 c017c974 00000000 S kseriod
root 9 2 0 0 c018179c 00000000 S kseriod root 10 2 0 0 c004b22c 00000000 S kmmcd
root 10 2 0 0 c004b2c4 00000000 S kmmcd root 11 2 0 0 c0072f5c 00000000 S pdflush
root 11 2 0 0 c006fc74 00000000 S pdflush root 12 2 0 0 c0072f5c 00000000 S pdflush
root 12 2 0 0 c006fc74 00000000 S pdflush root 13 2 0 0 c00777bc 00000000 S kswapd0
root 13 2 0 0 c0079750 00000000 D kswapd0 root 14 2 0 0 c004b22c 00000000 S aio/0
root 14 2 0 0 c004b2c4 00000000 S aio/0 root 22 2 0 0 c0179ec0 00000000 S mtdblockd
root 22 2 0 0 c017ef48 00000000 S mtdblockd root 23 2 0 0 c004b22c 00000000 S kstriped
root 24 2 0 0 c004b22c 00000000 S hid_compat
root 23 2 0 0 c004b2c4 00000000 S kstriped
root 27 2 0 0 c004b22c 00000000 S rpciod/0
root 24 2 0 0 c004b2c4 00000000 S hid_compat root 28 1 232 136 c009ebcc 0000875c S /sbin/ueventd
root 25 2 0 0 c004b2c4 00000000 S rpciod/0 system 29 1 804 260 c01a4834 afd0b6fc S /system/bin/servicemanager
root 26 1 232 136 c009b74c 0000875c S /sbin/ueventd root 30 1 3864 568 ffffffff afd0bdac S /system/bin/vold
system 27 1 804 196 c01a94a4 afd0b6fc S /system/bin/servicemanager root 31 1 3832 556 ffffffff afd0bdac S /system/bin/netd
root 28 1 3864 308 ffffffff afd0bdac S /system/bin/vold root 32 1 664 264 c01b08f8 afd0c0cc S /system/bin/debuggerd
root 29 1 3836 324 ffffffff afd0bdac S /system/bin/netd root 33 1 1268 588 c00522ac afd0bdac S /system/bin/rild
root 30 1 664 188 c01b52b4 afd0c0cc S /system/bin/debuggerd root 34 1 60864 25992 c009ebcc afd0b844 S zygote
radio 31 1 5396 448 ffffffff afd0bdac S /system/bin/rild media 35 1 17972 3712 ffffffff afd0b6fc S /system/bin/mediaserver
root 32 1 60884 16476 c009b74c afd0b844 S zygote bluetooth 36 1 1256 572 c009ebcc afd0c59c S /system/bin/dbus­daemon
root 37 1 812 316 c0213b90 afd0b45c S /system/bin/installd
media 33 1 17976 1016 ffffffff afd0b6fc S /system/bin/mediaserver
keystore 38 1 1744 432 c01b08f8 afd0c0cc S /system/bin/keystore
bluetooth 34 1 1256 220 c009b74c afd0c59c S /system/bin/dbus­daemon shell 41 1 732 312 c01532bc afd0b45c S /system/bin/sh
root 35 1 812 232 c02181f4 afd0b45c S /system/bin/installd root 42 1 3360 164 ffffffff 00008294 S /sbin/adbd
keystore 36 1 1744 212 c01b52b4 afd0c0cc S /system/bin/keystore system 60 34 101104 28276 ffffffff afd0b6fc S system_server
root 38 1 824 268 c00b8fec afd0c51c S /system/bin/qemud radio 99 34 81624 22600 ffffffff afd0c51c S com.android.phone
shell 40 1 732 200 c0158eb0 afd0b45c S /system/bin/sh system 116 34 73768 20740 ffffffff afd0c51c S com.android.settings
root 41 1 3364 168 ffffffff 00008294 S /sbin/adbd app_1 133 34 81120 25596 ffffffff afd0c51c S android.process.acore
system 62 32 122088 25860 ffffffff afd0b6fc S system_server root 147 42 732 344 c003d8d0 afd0c3ac S /system/bin/sh
app_19 116 32 77280 17520 ffffffff afd0c51c S root 153 147 888 320 00000000 afd0b45c R ps
com.android.inputmethod.latin
radio 122 32 86100 17992 ffffffff afd0c51c S com.android.phone
system 126 32 73316 19028 ffffffff afd0c51c S com.android.systemui
app_25 136 32 76564 21276 ffffffff afd0c51c S com.android.launcher
root 156 41 2132 452 c003da38 00110c84 S /bin/sh
app_1 174 32 76092 18268 ffffffff afd0c51c S android.process.acore
app_9 218 32 73168 17052 ffffffff afd0c51c S android.process.media
app_23 260 32 82464 16584 ffffffff afd0c51c S com.android.mms
app_28 277 32 72804 17852 ffffffff afd0c51c S com.android.email
app_13 289 32 70796 16532 ffffffff afd0c51c S com.android.quicksearchbox
app_21 309 32 69764 15552 ffffffff afd0c51c S com.android.protips
app_18 318 32 70324 15812 ffffffff afd0c51c S com.android.music
app_3 327 32 71484 16940 ffffffff afd0c51c S com.cooliris.media
root 344 156 888 328 00000000 afd0b45c R /system/bin/ps
26

27. 5.3. Services
●
Full Android
0 phone: [com.android.internal.telephony.ITelephony]
1 iphonesubinfo: [com.android.internal.telephony.IPhoneSubInfo] ●
Headless Android
2 simphonebook: [com.android.internal.telephony.IIccPhoneBook] 0 phone: [com.android.internal.telephony.ITelephony]
3 isms: [com.android.internal.telephony.ISms] 1 iphonesubinfo: [com.android.internal.telephony.IPhoneSubInfo]
4 opersys: [android.os.IOpersysService] 2 simphonebook: [com.android.internal.telephony.IIccPhoneBook]
5 diskstats: [] 3 isms: [com.android.internal.telephony.ISms]
6 appwidget: [com.android.internal.appwidget.IAppWidgetService] 4 diskstats: []
7 backup: [android.app.backup.IBackupManager] 5 appwidget: [com.android.internal.appwidget.IAppWidgetService]
8 uimode: [android.app.IUiModeManager] 6 backup: [android.app.backup.IBackupManager]
7 uimode: [android.app.IUiModeManager]
9 usb: [android.hardware.usb.IUsbManager]
8 usb: [android.hardware.usb.IUsbManager]
10 audio: [android.media.IAudioService]
9 audio: [android.media.IAudioService]
11 wallpaper: [android.app.IWallpaperManager] 10 dropbox: [com.android.internal.os.IDropBoxManagerService]
12 dropbox: [com.android.internal.os.IDropBoxManagerService] 11 search: [android.app.ISearchManager]
13 search: [android.app.ISearchManager] 12 location: [android.location.ILocationManager]
14 location: [android.location.ILocationManager] 13 devicestoragemonitor: []
15 devicestoragemonitor: [] 14 notification: [android.app.INotificationManager]
16 notification: [android.app.INotificationManager] 15 mount: [IMountService]
17 mount: [IMountService] 16 accessibility: [android.view.accessibility.IAccessibilityManager]
18 accessibility: [android.view.accessibility.IAccessibilityManager] 17 throttle: [android.net.IThrottleManager]
19 throttle: [android.net.IThrottleManager] 18 connectivity: [android.net.IConnectivityManager]
20 connectivity: [android.net.IConnectivityManager] 19 wifi: [android.net.wifi.IWifiManager]
21 wifi: [android.net.wifi.IWifiManager] 20 network_management: [android.os.INetworkManagementService]
22 network_management: [android.os.INetworkManagementService] 21 netstat: [android.os.INetStatService]
23 netstat: [android.os.INetStatService] 22 clipboard: [android.text.IClipboard]
24 input_method: [com.android.internal.view.IInputMethodManager] 23 statusbar: [com.android.internal.statusbar.IStatusBarService]
25 clipboard: [android.text.IClipboard] 24 device_policy: [android.app.admin.IDevicePolicyManager]
25 alarm: [android.app.IAlarmManager]
26 statusbar: [com.android.internal.statusbar.IStatusBarService]
26 vibrator: [android.os.IVibratorService]
27 device_policy: [android.app.admin.IDevicePolicyManager]
27 hardware: [android.os.IHardwareService]
28 window: [android.view.IWindowManager] 28 battery: []
29 alarm: [android.app.IAlarmManager] 29 content: [android.content.IContentService]
30 vibrator: [android.os.IVibratorService] 30 account: [android.accounts.IAccountManager]
31 hardware: [android.os.IHardwareService] 31 permission: [android.os.IPermissionController]
32 battery: [] 32 cpuinfo: []
33 content: [android.content.IContentService] 33 meminfo: []
34 account: [android.accounts.IAccountManager] 34 activity: [android.app.IActivityManager]
35 permission: [android.os.IPermissionController] 35 package: [android.content.pm.IPackageManager]
36 cpuinfo: [] 36 telephony.registry: [com.android.internal.telephony.ITelephonyRegistry]
37 meminfo: [] 37 usagestats: [com.android.internal.app.IUsageStats]
38 activity: [android.app.IActivityManager] 38 batteryinfo: [com.android.internal.app.IBatteryStats]
39 package: [android.content.pm.IPackageManager] 39 power: [android.os.IPowerManager]
40 telephony.registry: [com.android.internal.telephony.ITelephonyRegistry] 40 entropy: []
41 usagestats: [com.android.internal.app.IUsageStats] 41 sensorservice: [android.gui.SensorServer]
42 media.audio_policy: [android.media.IAudioPolicyService]
42 batteryinfo: [com.android.internal.app.IBatteryStats]
43 media.camera: [android.hardware.ICameraService]
43 power: [android.os.IPowerManager]
44 media.player: [android.media.IMediaPlayerService]
44 entropy: [] 45 media.audio_flinger: [android.media.IAudioFlinger]
45 sensorservice: [android.gui.SensorServer]
46 SurfaceFlinger: [android.ui.ISurfaceComposer]
47 media.audio_policy: [android.media.IAudioPolicyService]
48 media.camera: [android.hardware.ICameraService]
49 media.player: [android.media.IMediaPlayerService]
50 media.audio_flinger: [android.media.IAudioFlinger]
27

28. 6. Housekeeping
● Work in progress / proof-of-concept
● Do NOT ship a product with this just yet
● Branch in cyborgstack: cyborgstack.org
● I haven't bothered removing any of the
standard apps: Browser, Email, Launcher2, ...
● Lingering references to WindowManager in
ActivityManager
● ... and likely tons I overlooked or didn't test ...
28

29. And then he said ...
“As your leader, I encourage you from time to time, and always in a respectful manner, to
question my logic. If you're unconvinced that a particular plan of action I've decided is the
wisest, tell me so, but allow me to convince you and I promise you right here and now, no
subject will ever be taboo. Except, of course, the subject that was just under discussion.
The price you pay for bringing up either my GNU or Linux heritage as a negative is... I
collect your fucking head. Just like this fucker here. Now, if any of you sons of bitches got
anything else to say, now's the fucking time!”
Thank you ...
VZADC3
karim.yaghmour@opersys.com
29