android

Android: Wakelocks and TuxOnIce

Wed, 29 Jun 2011 10:26:28 +0800

最近為了把 TuxOnIce 整到 Android 上面，著實把 Linux 的電源管理系統中關於 suspend 與 hibernation 的部份研究了一下。而 Android 為了增加待機時間加入了 wakelock 的機制，讓情況變得更加複雜。

TuxOnIce

TOI Patch

TuxOnIce 簡稱 TOI，前身是 Software Suspend 2，是一個長期在 linux upstream 以外耕耘的一個休眠補釘，相較於早期整合到 linux kernel 內的 swsusp，TOI 的功能非常豐富，可以指定把記憶體內容儲存到多種不同的位置，如檔案或置換空間，還可以選擇不同的壓縮方法。

首先幫 ARM 平台加上基本的休眠功能，使用 Hiroshi DOYU 的 patch:

http://article.gmane.org/gmane.linux.power-management.general/20543

然後到 TOI 網站下載最新的 3.2 補釘，打上去的時候會有一些衝突但是都還滿容易解決，要注意的是某些衝突是看不出來的，例如因為函式移動位置而造成重複定義，要小心檢查。

然後因為 TOI 對於非 x86 平台有一些假設現在已經不適用，所以需要修改

https://gitorious.org/0xlab-kernel/kernel/commit/e551caf

OMAPFB

使用 Pandaboard 加上 Android 測試才發現從休眠醒來後 LCD 不會自動點亮，通常在 x86 平台上有 pm-utils 或是 hibernate script 來幫忙處理這種關閉打開 LCD 的問題，這次我是先在 kernel 內幫 OMAPFB 加上一個電源管理的呼叫，讓 kernel 醒來的時候自己重新設定 LCD。

https://gitorious.org/0xlab-kernel/kernel/commit/21e0f14

Pandaboard & Beagleboard xM

在 Pandaboard 或 Beagleboard xM 上面沒有 NAND 可以當作儲存空間，所以一般都是把檔案放在MMC 上面，第一個 patch 讓 kernel 在開機的時候不要初始化不存在的 NAND 空間

https://gitorious.org/0xlab-kernel/kernel/commit/3ae6b4c

然後因為 MMC 的 probe 需要時間，第二個 patch 讓 TOI 等待指定的 resume device 已經偵測到之後才開始進行 resume

https://gitorious.org/0xlab-kernel/kernel/commit/1078bd7

Wakelock

wakelock 是 Android 為了讓裝置可以更積極的休眠又不妨礙正常工作的進行而加入的機制，究竟是好是壞已經在 LKML 與 LWN 上面討論過非常多次，可以參考：

失眠症

開始測試 TOI 的效果時遇到的第一個問題就是失眠症，因為 wakelock 從中作梗，導致每次休眠到一半就被取消掉。原來是因為 TOI 的休眠途徑會先強制檔案系統把內容寫回，而 MMC 子系統會在寫入/讀取一段時間後嘗試進入低耗電模式，偏偏 Android 在這裡安插了一個 wakelock，導致之後要凍結所有執行緒的時候失敗。

解法，首先因為休眠的後半段路徑其實就是要準備進行關機，而一般來說休眠都是人為啟動，因此可以假設此時使用者了解工作可能還未完成，可以忽略 wakelock，所以第一個 patch 就是讓休眠的路徑不去檢查 wakelock，避免像 MMC 這樣的問題。

https://gitorious.org/0xlab-kernel/kernel/commit/3bb5d6f

接下來是一般的待機路徑，似乎是因為新的 kernel 會積極的嘗試把 MMC 變成低耗電模式，但 OMAP 預設的 MMC timeout 是 100 毫秒，把工作放在 Queue 裡面反而不斷鎖住 wakelock 讓 Android 無法休眠，第二個 patch 就是讓 MMC 子系統在準備休眠的時候就不要作無謂的掙扎，直接進入低耗電模式。

https://gitorious.org/0xlab-kernel/kernel/commit/88823b9

嗜睡症

解決了失眠症沒想到接下來遇到嗜睡症，因為手機插著 USB 的時候是不會真正睡著的，所以一直沒機會觀察 Android 睡著是怎麼樣，原來只把 kernel 叫醒是沒用的，Android 還會檢查目前的 input event 是否屬於 user activity 的範圍，是的話才會把整個系統帶醒，不然因為 wakelock 的機制，馬上就會又睡著。

參考：

Android Power Management

Android 2.3 Introduction & Statistics

Wed, 29 Dec 2010 15:41:29 +0800

如果你有收看 LWN.net 的話，大概知道每次 linux kernel 有新的 release 前都會有一次針對這次 release 的統計資料，看看主要的貢獻是由哪些人，哪些公司完成。藉由這次跟 0xlab 分享 Android 2.3 新特性的時候，我學 LWN.net 做了一些小統計，還滿有趣的。

Most active Android 2.3 organizations (by changesets)

4204 google.com
1354 android.com
98 sonyericsson.com
71 gmail.com
39 codeaurora.org
39 samsung.com
38 intel.com
32 nokia.com
32 holtmann.org
29 0xlab.org
25 trusted-logic.com
17 openbossa.org
11 nxp.com
11 linux.org.tw

10 ti.com
10 acer.com.tw
8 themaw.net
8 garmin.com
7 snpe.rs
7 motorola.com
7 mc.pp.se
7 googlemail.com
5 invensense.com
4 mirbsd.org
3 windriver.com
3 realvnc.com
2 teleca.com
2 sharp.co.jp

2 nvidia.com
2 motoya.co.jp
2 lge.com
2 broadcom.com
1 yahoo-inc.com
1 xs4all.nl
1 wdsglobal.com
1 uwevoelker.de
1 strongswan.org
1 stericsson.com
1 signove.com
1 saftware.de
1 richlowe.net
1 pv.com

1 promwad.com
1 pcc.me.uk
1 padovan.org
1 osbeck.com
1 nii.net
1 martin.st
1 ilovelinux.de
1 happydroid.com
1 droidmod.org
1 cpeterso.com
1 big.or.jp
1 arm.com

Most active Android 2.3 developers (by lines changed)

Jesse Wilson
Eric Laurent
Dianne Hackborn
David 'Digit' Turner
Nick Pelly
Mathias Agopian
Nick Kralevich
Brian Carlstrom
Eric Fischer
Andreas Huber

12.8708%
12.13%
8.65%
6.84% 
5.35%
4.13%
3.42%
2.77%
2.05%
2.03%

投影片中還研究了一下各主要開發者主要研究的方向，看 log 的時候依照這個順序去看，有一定的脈絡可尋 :)

Android Service with dynamic arguments

Tue, 24 Aug 2010 16:01:34 +0800

Recently when I was preparing some Android training material I found this little trick.

Android "init" can do a lot of things, including "on property change" trigger; one can image some applications use this to implement an ad-hoc IPC. One example is the system/libnetutil that monitors the "init.svc.dhcpcd" property to detect whether dhcpcd is running or not.

Android framework can execute some predefined command (service) via the "ctl.start" property, the most interesting part is you can supply dynamic arguments to the command just like you were calling a command from shell.

The format is

setprop ctl.start service:arg1 arg2 arg3..

It must be a oneshot service, for example you can define a dhcpcd service like:

service dhcpcd /system/bin/dhcpcd -B
    group dhcp wifi system
    disabled
    oneshot

And set the target interface dynamically:

setprop ctl.start dhcpcd:eth0

"init" will then execute "dhcpcd -B eth0" with appropriate permissions.

Root your Phone with just 1-Click

Tue, 03 Aug 2010 17:32:25 +0800

Today I read that someone demoed how to put rootkit into your phone during the Defcon. But there are no details, the keywords like kernel moudle, install apk, remote phone call, ..., all reminds me the old phishing attack. Then I thought, can it be the trick used to root Droid X?

Actually this exploid works on almost every Android phone because it leverages a vulnerability in the framework. XDA developers also confirmed the success on various N1 model. But can it be used on real attack?

To demonstrate how dangerous the local exploit is, I wrote an Android application that inject the su program into your phone. With Superuser.apk you can gain root access whenever you run su from adb shell.

No additional permissions required! This works on my stock Nexus One and in theory any Android. Just one click I can root you phone (optionally take away your data simultaneously). Don't trust me or any other similar programs floating around the market, or simply don't install any program until your carrier fix this.

Download the apk here: http://0xlab.org/~kanru/RootDroid-release.apk

md5: 20894acd3be808c51ce32491872ba027
sha1: 889fc92692c0e58e83673dedbabbc66d5c6318b1

This vulnerability has been fixed in CyanogenMod two weeks ago, and the source code is landing the AOSP froyo branch, but there is still no official fix update from Google. Consider how dangerous this is, I may not install any third party application until an OTA arrives or just go ahead with a customized rom with my newly rooted phone ;-)

AndroidDev: Recent progress on Gallery3D

Wed, 19 May 2010 20:31:40 +0800

Gallery3D is the gallery application released with Éclair, contributed by Cooliris.

This application heavily uses OpenGL to render the scenes. It looks great on Nexus One. But 0xdroid does not yet support hardware accelerated 3D graphics and rely on libagl to rasterize the 3D graph.

Agl is the software OpenGL rendering engine used by android emulator. Gallery3D assumes there is hardware support and this caused a lot of trouble when one want to run it with agl. Even if the libagl implementation is correct and complete, Gallery3D may also assumes some implementation depended behavior. Not to mention the fundamental libagl implementations may have problems.

Anyway, we have some progress and I'd like to share the screenshots. Devkit8000 DVI output, 640x480 resolution, captured by DDMS.

[gallery link="file"]

I have a feeling there are more OpenGL tricks inside the source code then I'd expected.

AndroidDev: Provision the device

Wed, 12 May 2010 10:39:43 +0800

在 Devkit8000 上把 HOME key 設定好後卻無法作用，仔細看了下處理 HOME key 的地方是 polices 下的 PhoneWindowManager.java，會去檢查這個 device 是否被 "Provision" 了。

這個 Provision 的動作其實就是 Device 第一次啟用時做初始設定，在 Google phone 上面就是 SetupWizard，在 emulator 裏面則有簡單的 Provision.apk，之前無法作用就是因為一直沒有把 Provision.apk 放進去...

Provision.apk 做了什麼事呢？其實很簡短：

public class DefaultActivity extends Activity {

    @Override
    protected void onCreate(Bundle icicle) {
        super.onCreate(icicle);

        // Add a persistent setting to allow other apps to know
        // the device has been provisioned.
        Settings.Secure.putInt(getContentResolver(),
                               Settings.Secure.DEVICE_PROVISIONED, 1);

        // remove this activity from the package manager.
        PackageManager pm = getPackageManager();
        ComponentName name = new ComponentName(this,
                                     DefaultActivity.class);
        pm.setComponentEnabledSetting(name,
                   PackageManager.COMPONENT_ENABLED_STATE_DISABLED, 0);

        // terminate the activity.
        finish();
    }
}

因此若要提供一個類似 SetupWizard 的初始化介面在 Devit8000 上面，只要延伸這個 Provision.apk 做的事，提供 GUI 等等，最重要的就是設定這個 "Settings.Secure.DEVICE_PROVISIONED"

這是一個筆記。

Fourth 0xdroid Release for BeagleBoard and Devkit8000!

Tue, 27 Apr 2010 12:16:14 +0800

Today we are celebrating the 0xLab's one year old birthday! I'd like to write about the recently announced fourth 0xdroid release.

What's new in this release? The biggest one is that it is based on Éclair code base! While Éclair uses a lot more 3D stuff for its UI, the performance drop between Donut and Éclair is huge. After lots of testing and hacking, we finally bought the Éclair performance back to its original level. For detailed benchmark results, checkout the wiki page Benchmarks.

Second is new hardware support. 0xdroid now officially supports Devkit8000, a BeagleBoard clone. Developers did many works to bring up the all functionality include LCD/DVI output, touchscreen calibration, USB, Ethernet, etc. Running Éclair on Devkit8000 looks great!

Oh, and the new installer! The new installer used in this release supports both BeagleBoard and Devkit8000, with different display resolution and hardware revision. It can do a lot more than previous installer can do, for example it can download images from network, install to SD/MMC card and indicate progress via graphic display or via blinking LEDs. All of this will fit into a 1MB binary!

Enjoy the release video on the youtube:

Want to contribute? Download it and try now!

Got one A1 from Broncho

Mon, 15 Mar 2010 17:50:49 +0800

上週末下班前，在桌上發現一個包裹，原來是渡海而來的兩隻 A1！這兩隻 A1 是 Broncho 的產品，詳細規格可以參考 Broncho 的網頁。

大伙興奮的開箱啦！

包裝和 Hero 的很像。3.2 寸 LCD, 480x320 的解析度，200 萬畫素的相機鏡頭，CPU 是 Marvell 300 (624 MHz)，記憶體是 256 + 128 MB，支援 WIFI, Bluetooth, FM, GPS。不是使用標準的 USB 接口，但同一個接口可以接 USB、耳機、變壓器。觸控螢幕使用起來的感覺像是電容式的，反應非常靈敏，輕輕的觸摸就有反應。

系統是 Android Cupcake，內建軟體有不少 Google App，最另人驚訝旳是上面有 Android Market 可以用，試著從 Market 上面下載了一些小遊戲下來玩，完全沒有問題，真是太牛了！另外一點就是有內建手寫輸入，速度不快但是準確度不錯。除此之外還有谷歌拼音可以用。

測試的途中無線網路與 GPS 不是很穩，除此之外以一隻中低價位的手機來說表現的相當不錯。