Linus Torvalds on Android, the Linux fork

During his question and answer session at the Linux Foundation’s LinuxCon, Linus Torvalds, founder of Linux, revealed that while mainstream Linux and its popular smartphone and tablet son Google’s Android still aren’t as close as they should be, they’re slowly—ever so slowly—coming back together.

Over the last several years, some people have been seeing Android as not being Linux at all. Google didn’t help matters at all when in the fall of 2010, “Google engineer Patrick Brady stated unambiguously that Android is not Linux” That was never true. Android has always been Linux.

What’s also true though is that Google took Android in its own direction, a direction that wasn’t compatible with the mainstream Linux kernel. As Greg Kroah-Hartman, head of the Linux Driver Project and a Novell engineer, wrote in Android and the Linux kernel community, “The Android kernel code is more than just the few weird drivers that were in the drivers/staging/androidsubdirectory in the kernel. In order to get a working Android system, you need the new lock type they have created, as well as hooks in the core system for their security model. In order to write a driver for hardware to work on Android, you need to properly integrate into this new lock, as well as sometimes the bizarre security model. Oh, and then there’s the totally-different framebuffer driver infrastructure as well.” As you might imagine, that hasn’t gone over well in Android circles.

This disagreement sprang from several sources. One was that Google’s Android developers had taken their own way to address power issues with WakeLocks. The other cause, as Google open source engineering manager Chris DiBona essentially said, was that Android’s programmers were so busy working on Android device specifics that they had done a poor job of co-coordinating with the Linux kernel developers.

The upshot was that developer circles have had a lot of heated words over what’s the right way of handling Android specific code in Linux. Linus Torvalds dropped the Android drivers from the main Linux kernel in late 2009. This doesn’t mean that Android isn’t, but it has become something of a Linux fork.
That doesn’t, however, as some recent reports had it that Android and Linux are somehow in a fight with each other. Or, even, as one claim had it in March 2011, that Android was somehow in danger of being sued by Linux because of  Gnu General Public License, version 2 (GPLv2)violations. As Linus himself said at the time, claims that the Android violated the GPL were “totally bogus. We’ve always made it very clear that the kernel system call interfaces do not in any way result in a derived work as per the GPL, and the kernel details are exported through the kernel headers to all the normal glibc interfaces too.”

Still, it seemed as if Android and Linux were moving more on parallel paths than together, and that is indeed the case. At LinuxCon, Torvalds explained, that “there’s still a lot of merger to be done. … but that eventually Android and Linux would come back to a common kernel, but it will probably not be for four to five years.”

Kroah-Hartman added that one problem is that “Google’s Android team is very small and over-subscribed to so they’re resource restrained It would be cheaper in the long run for them to work with us.” Torvalds added that “I’m not at all afraid of forks… even when forks happen there are all these points of pain where two groups have had different issues, it just takes a while for people to join back, but the joining will happen. We’re just going different directions for a while, but in the long run the sides will come together so I’m not worried.”

Kroah-Hartman,pointed out that for years Google’s in-house Linux that it uses for servers, was a fork of the Linux 2.4 for many years. Torvalds explained that Google did this because they had made so many performance tweaks to improve it for Google’s search engine. He also added that many other companies tweak Linux for their particular uses. Fortunately, thanks to the GPLv2, all the significant changes come back to the mainstream kernel.

So, for the next few years, Android, while still a Linux, is indeed a Linux fork. In the long run, though, Torvalds is sure that Android will return to the mainstream Linux kernel. For better or worse though that may not be until 2016. Fortunately, for all end-users and almost all Android developers none of this will make any real world difference.

Android Apps on non Android Phones

The intriguing idea of running Google Androidapplications on non-Android phones is about to become a reality, courtesy of Myriad, a Zürich-based mobile applications software company.

At next week's Mobile World Congress event inBarcelona, the company will demonstrate its Alien Dalvik virtual machine solution, which enables phones running other mobile operating systems to use Android software.

The approach could be useful to consumers who own devices for which applications are limited, as well as help Android developers and carriers widen their audiences and boost revenues.

How could a non-Android device run software made specifically for Google's Android platform? It sounds like a stretch. In reality, all apps that run on Android phones or tablets run in a virtual machine, which Google calls Dalvik.

The solution is much like the Java Virtual Machine on a desktop: it's a constrained software implementation of a computer via software code. It brings greater security because apps in a VM are essentially walled off from other applications and from the device's operating system.

When the app in a VM crashes, it has no effect on other applications or on the operating system, ensuring stability. This video demo of Myriad's solution on a Nokia N900 running MeeGo shows that it performs on a level equal to that of the same app running on a comparable Android device.

Myriad's Alien Dalvik is a VM that supports Android applications, just like Google's Dalvik VM does, but it's one that can run on other devices. The company says that its first supported iteration will run on Nokia's MeeGo devices, which are also likely to be introduced next week—although they aren't likely to ship for some time.

Myriad has probably targeted MeeGo for its Linux underpinnings: Android too, is based on Linux, making for a bit of a common denominator. Palm's webOS is another Linux-based system; given the relative lack of applications when compared to other popular platforms, webOS could be a further target for Myriad.

Shadow of Oracle-Google litigation
Although its similarity to Google's Dalvik VM is clearly a positive, there could be a negative aspect, too. Last October, Oracle sued Google over the Dalvik VM, claiming that Google's implementation uses code stolen from Sun's Java VM.

Oracle purchased Sun Microsystems for $4.7 billion in 2009, gaining its Java virtualization technology and code. The suit is active and there's no indication yet if Myriad's VM uses any disputed code or if it has sought licensing or permission from Oracle.

If the Alien Dalvik solution delivers as advertised in the video demo—and if there's no fallout from the Oracle complaint—it could open Google's Android Market ecosystem up to a far wider range of consumers who use other smartphones or even higher-end feature phones.

Contrast that to Apple's iTunes App Store, which although it's the biggest platform store for software, serves only Apple iOS devices. Android software running on further platforms could draw greater developer interest in building Android applications. Carriers that adopt Myriad's VM on non-Android devices might gain a competitive advantage over peers that don't.

The proof will be in the pudding. Myriad will have to establish its Alien Dalvik as a viable way to get Android apps on other platforms. If Myriad does deliver, it could be a win for consumers, developers, and carriers alike—and could keep Android's general growth trajectory rising.

Malware in Android Market

Every day, we see more reports about malware in the Android Market. This time three developers known as MYOURNET, Kingmall2010, and we20090202, possibly the same person, were offering a number of Android apps for free download.

Many, if not all of the apps, were trojanized copies of legitimate apps from other developers.

I downloaded one app in particular called Super Guitar Solo. Upon reviewing the app, Its been found that, it contains the popular “rage against the cage” root exploit commonly used to “root” Android phones and gain superuser privileges. As any Linux guru will tell you, once you have superuser rights, you have full, administrator level access to the phone’s operating system. In this case the exploit is launched without the owner’s consent.

So what is the purpose of this Trojan? The application will attempt to gather product ID, device type, language, country, and userID among other things, and then upload them to a remote server. Unlike most of the other samples seen so far, there is no attempt at sending or receiving premium rate SMS messages.

This discovery is important because up until now most of the Android malware has been found outside of the Android Market, which requires a number of special steps to be taken in order to infect the phones. In this case, users are even able to install from the web with the new Android Market format.

UPDATE: Google has now removed the malicious apps and the corresponding download page from the Android Market.