Project Treble
Benefits for LWN subscribersThe primary benefit from subscribing to LWN is helping to keep us publishing, but, beyond that, subscribers get immediate access to all site content and access to a number of extra site features. Please sign up today!
Android's Project Treble is meant as a way to reduce the fragmentation in the Android ecosystem. It also makes porting Android 8 ("Oreo"—the first version to mandate Treble) more difficult, according to Fedor Tcymbal. He described the project and what it means for silicon and device vendors in a talk at Open Source Summit North America 2018 in Vancouver, Canada.
Tcymbal works for Mera, which is a software services company. It has worked with various system-on-chip (SoC) and device vendors to get Android running on their hardware. The company has done so for several Android versions along the way, but Android 8 "felt very different" because of Treble. It was "much more difficult to upgrade" to Oreo than to previous Android versions.
He put up several quotes from Google employees describing Treble (slides [PDF]). Those boil down to an acknowledgment that the changes made for Treble were extensive—and expensive. More than 300 developers worked for more than a year on Treble. It makes one wonder what could justify that amount of effort, Tcymbal said.
Google presents Project Treble as a re-architecture of Android to make it easier for vendors to update their devices to new versions of the mobile operating system. The Android Open Source Project (AOSP) architecture is layered, with apps at the top; the application framework, Binder, and Android system services in the middle; and hardware abstraction layers (HALs) and the Linux kernel at the bottom. Google provides the middle layer, while vendors provide the HALs and kernel.
He then outlined the normal pre-Treble process for an Android dessert release. When the release is made, it only runs on the reference platform (e.g. Pixel). Silicon vendors then get the kernel running for their SoC, turn it into a board support package (BSP), and hand that off to device makers to do all of the customizations for the actual device. The software is then given to the phone carriers, which get it out to the end users. This last step is not really required, but is common in North America, he said.
Each of those steps takes some time, which generally adds up to 6-12 months. In addition, those steps only happen if each participant is interested in making it happen. If the SoC or device is no longer being sold, those vendors may not do their part, so no upgrade is available to users. "Google does not like this", Tcymbal said.
In July, nearly a year after its release, Oreo was only on 12% of the devices in the field. That means that all of the new features, security upgrades, and so on, really only get to people after a few years when they buy a new device. In fact, the uptake for Oreo is roughly the same as the percentage of devices that remain on Jelly Bean and KitKat, which were released 5 or 6 years ago. That is different from the iOS world, where devices get updated right away. So Google's effort in creating new versions is largely wasted, he said; that is why the company spent so much effort on Treble.
HALs and APIs
When a new version of Android is released, all of the old apps continue to work because the old APIs are still supported. Upgrading to a new version of Android took so much time because Google did not recognize that it needed to do the same thing several layers down, Tcymbal said. The strict line separating Android system services and the HALs did not exist prior to Treble; that is the purpose of the project.
Prior to Treble, the HAL interfaces were specified as a bunch of C header files. Each new version of Android meant there were new interfaces and header files. So each HAL needed to be updated to the new interfaces and rebuilt for the new version of Android. That's the reason that vendors had to spend so much time updating.
With Treble, there is now a HAL interface definition language (HIDL) instead of the C header files. In addition, Google has several transitional steps that vendors can use to move toward the new architecture. Legacy HALs can still be called from a process, rather than from Binder, which is the way of the future. Google has created a wrapper for legacy HALs to make it easier to use those with Treble. The eventual destination that Google envisions is for the legacy HALs to be replaced with a vendor implementation of hardware services. Mera did not take that step, but continued using the legacy HALs; Tcymbal thinks that is likely what other vendors will do as well.
Treble introduces a vendor interface object that is checked before an over-the-air (OTA) update is performed. The device sends a manifest and compatibility matrix to the OTA server, which checks to see if the new version can be run on the device. The object has information about HAL versions and interfaces, kernel versions and configuration options, SELinux policy versions, and the Android verified boot version. The information provided by the device can be used to ensure that a device will not upgrade to a new Android version. Tcymbal said he does not understand why Google allowed that, because device vendors may have the incentive to block upgrades in order to sell newer devices.
There is now a "golden" /system image that gets installed on a device and it must run without modification. There is a new /vendor partition for the vendor-specific HALs. That all makes sense, he said, but it means the device must be repartitioned in order to upgrade to Android 8. However, some vendors are unwilling to allow that upgrade because they do not want to risk breaking users' working phones.
The compatibility test suite (CTS) for AOSP is meant to check that the Android framework is working as expected. Treble adds a vendor test suite (VTS) that extends the testing a few layers down into the system. It is meant to check whether a HAL is actually providing the interface it claims to provide. Vendors that want to certify their devices (in order to get access to Google Play services) need to pass the VTS. Passing that suite means that the /system golden image will run on the device.
Problems
Treble has mandated a lot of new things for device and SoC vendors, he said, which has caused some problems for some of those vendors. Normally, it would take a small team two months or so to upgrade to a new version of Android. Treble took six months for his team, he said; in general, most vendors found it took three times as long.
Another problem is with Binder, he said. The idea to have Binder mediate the hardware-specific handling, but it "is kind of slow" because it uses interprocess communication (IPC) to communicate. That is too slow for things like graphics, so there will always be a need for pass-through HALs, which is an exception to the architectural vision.
A big change like Treble can only lead to new bugs. He has heard that the Treble changes were around one million lines of code; with that size of a change, the Android developers "probably broke something". They may well have introduced new security vulnerabilities as well.
His last concern about Treble was that it might lead to more uniformity in the device space. Having to conform to various Google mandates might make it more difficult for device makers to introduce new features. Google says it wants all kinds of different devices, but Treble is a step toward standardization that could reduce that diversity.
Success?
Android 9 ("Pie") was introduced recently, but only adds a few final touches to Treble—most of the work was done for Oreo. It does give us a chance to see how well Treble is working out, he said. There are lots of devices upgrading from Oreo to Pie, which is a great result. In addition, there were 12 devices supported by the Pie beta release, where normally it would only be supported on a Pixel reference platform (or possibly one other on top of that).
While it is not directly related to Treble, Tcymbal found it interesting that the mandatory API target for new apps has been raised to API level 26 (which is what Android 8.0 provides). New apps cannot get on the Play store if they do not conform to that. This shows the overall direction that Google is headed: Treble pushes the device makers to conform, now the app makers are also being pushed. Without Treble, that would not have been possible, he said.
In summary, Treble is a bug fix for the worst kind of bug—an architectural bug. Google did not think through the implications of upgrading to newer versions and so it had to pay the price. Device and SoC vendors also paid for the mistake. Treble has clearly succeeded from a technical perspective, but it is less clear if it has succeeded from a business perspective. The idea was to extend the life of devices to four or five years, so it is too early to tell if that will be the case. We will have to wait and see.
[I would like to thank LWN's travel sponsor, the Linux Foundation, for
travel assistance to attend Open Source Summit in Vancouver.]
| Index entries for this article | |
|---|---|
| Conference | Open Source Summit North America/2018 |