Android is not open source

Cutting through Google’s marketing speak and seeking the truth

The Quantified VC

Aug 27, 2016 · 5 min read

I’m getting tired of hearing people claim that Android is open-source. The Android Open Source Project (AOSP) isn’t what ships on most Android devices and can’t be built unmodified. Most Android devices are not even shipping an OS that AOSP has the sources for internally. Android has become some proprietary OS that passes Android Compatibility Test Suite (CTS).

AOSP code still depends on Qualcomm build utilities which are not provided by the AOSP source tree. Without them, certain functionality ends up missing. The missing Qualcomm code is in many cases open source as part of CAF (a custom Linux kernel branch optimized for Snapdragon phones). Google DOES have a bunch of proprietary Qualcomm code in their internal tree, but takes the easy route of removing it all when converting from the internal tree to AOSP.

The “open source” Android codebase depends on proprietary applications. Android source is almost entirely per-device code.

In theory, AOSP could run on open hardware without this nonsense. It becomes a huge problem when it’s not possible to build for the non-open hardware, since that open hardware does not exist yet.

In 6.0 Marshmallow, it was possible to make an incomplete build of the Android Open Source Project for Nexus 5X and 6P with missing blobs. It’s apparently not even possible to get that far with AOSP in 7.0 Nougat, since Google open-sourced something without providing the dependencies. It’s no longer possible to do an incomplete build without setting up binary blobs (which they don’t offer now), since `device/huawei/angler/location` and `device/lge/bullhead/location` depend on a having the blob build system. Either way, you need blobs simply to boot, but can get away with unmodified `vendor.img` by not having verified boot.

Google added this code to the source tree of Nexus 5X without providing the dependencies, so the `aosp_bullhead` target simply doesn’t work at all. The same applies to the other Nexus devices. This code can simply be removed and bundled as a blob, but it demonstrates that Google hasn’t even built AOSP 7.0 for its Nexus devices.

The AOSP codebase is much, much worse than it used to be. It all started going downhill with the Nexus 9. Google’s pre-optimized proprietary apps are a massive roadblock. A Google engineer could easily fix that for Nexus devices, but instead Google has chosen to prevent binary releases and make dependencies unavailable in the source code. It doesn’t seem like anyone at Google works on AOSP anymore — it has become just an afterthought.

You pretty much have to reverse engineer the .dex files from the optimized code. Copy binaries from the factory images, like CyanogenMod does. Google stopped shipping proper apks with classes.dex some time ago, though. You now get only oat files. You can do a giant hack and convert the .oat files back into .dex files. Yet it doesn’t fully work. The new version of Android changes the formats of these files, so that mostly working workaround is gone for now.

This commit gives the impression that Google delayed the release of factory images and OTA updates for 7.0 Nougat on Nexus 6P because it couldn’t play 480p video properly.

The 6P release moves a lot of blobs from system to vendor unlike the 5X release. One of the problems is that the vendor partition is likely too small, i.e. they didn’t account for the required growth of the vendor partition since they started with half of the blobs in system. It likely won’t all fit. Regardless, the vendor partition has to be reassembled to make a proper build with functional verified boot among other issues without it.

The intended purpose appears to be allowing AOSP builds to bundle a `vendor.img` and ship it as is, but that’s broken. So what is the point?

The one nice thing about the vendor partition is that every blob on there needs to be included. For system, a list has to be built by hand choosing them. It also ends up fixing the oat issue on a case-by-case basis, but it would need to be fixed in all cases to avoid needing a tool to reverse engineer dex.

AOSP 7.0 really only has support for a single device right now: Google’s own Pixel C tablet, powered by the NVIDIA Tegra X1 processor. Building for anything else requires unofficial modifications. Google’s `vendor.img` shell game doesn’t work. They can’t move apps needing platform key signatures there; not regenerating that `vendor.img` is broken, with verified boot being the main issue. Open-source components now depend on the unpublished build system used to make the proprietary blobs. It’s still not possible to update the Nexus 5X bootloader without using the update-binary from stock OTA firmware due to a proprietary LG library.

On the Pixel C Android tablet, Google decided to use the open-source Nouveau DRM kernel driver by default for this ARM device powered by NVIDIA’s Tegra X1 SoC. Nouveau has terrible performance on Linux systems, just FYI.

What’s surprising is that NVIDIA is actually once of the leaders when it comes to mainlining code for their mobile platform (Tegra). Isn’t that a bit disturbing?

The Android kernel drivers are primarily open-source at this point, but few vendors try to land the code upstream. So they have 2–3 million of lines of code for their platform out-of-tree for a specific kernel version, with no hope of a mainline kernel ever being used. Users may receive security updates, but don’t hope for more than 2–3 years of updates since the kernels age poorly.

TLDR: Although the Android platform is advertised as “open source,” Android hardware makers can lock down the devices and prevent users from modifying the software — and they do — while carriers can have complete control over user experience.