The Platform Nerd

Android runs on Linux, but not quite the Linux you would install on a server. This page is about the four jobs the kernel does for Android, the handful of features Android bolted on, and what happened to each of them.

For years every phone shipped a different kernel, and a security fix could take years to arrive. GKI made the kernel a single signed binary and moved board support into loadable modules behind a frozen interface.

From a press of the power button to the first frame of the home screen: eight stages, four signed handoffs, and a device that has to prove what it is running before it is allowed to run it.

One small C++ program is PID 1, mounts the world, loads the security policy, starts every daemon and restarts them when they die. Its configuration language is the closest thing Android has to an init system.

Android had sockets, pipes and shared memory. It built a kernel driver instead — because IPC on a phone has to be fast, attributable, and bounded, and no general-purpose transport is all three.

One ioctl, a Parcel, a handle table and a reference count. The Binder driver is a small kernel component that decides how a hundred million calls a day behave when things go wrong.

Write the contract once, and the build generates the Parcel marshalling for both sides. AIDL is the difference between 'call transact()' and 'call getTaskCount()'.

Every app and system_server is a fork of one warm process. Zygote is why an app can start in a few hundred milliseconds despite having no main() of its own.

ART began as the runtime that compiled everything at install. It is now a hybrid of interpreter, JIT and profile-guided AOT, shipped as an updatable module — and each swing of that pendulum was a reaction to the previous one's cost.

A GC pause of 20 ms is a dropped frame. ART's collector history is a fifteen-year attempt to make that number independent of how much memory the app is using.

One Java process hosts most of the framework's services, is forked from Zygote at boot, and takes the whole UI down with it when it dies. This is what lives inside it and why it is shaped that way.

Two services divide the work of running apps: ActivityTaskManager owns activities and the back stack, and ActivityManager owns processes and everything else. The split explains most of what a launch actually costs.

Android 8.0 drew a line through the platform. On one side the system image, on the other the vendor image, and between them a versioned, declared, testable interface that neither side could silently break.

Treble made the vendor side replaceable. Mainline made the platform side replaceable too. The container is the APEX, and the delivery channel is the Play Store.

Linux has discretionary access control: if you own a file, you decide who else may read it. SELinux adds mandatory access control: a policy written by someone else decides, and even root is subject to it.

From a touch to photons: how one frame moves through the UI thread, the RenderThread, the GPU, BufferQueue, SurfaceFlinger and the display — and why 16.67 ms is the number that governs everything.

AOSP is tens of millions of lines across thousands of repositories. Reading it is a skill with a method: find the entry point, follow the Binder boundary, read the build file, and ignore the generated code. This page teaches the method.

Ten source-reading quests, each with a question and a place to look: the zygote fork, the init language, a system service's birth, the framework facade, an IPC call, package install, the frame loop, permissions, intent resolution, and a Mainline boundary.