Presented at Android Builders Summit on February 14th in Redwood Shores, CA by Aleksandar (Saša) Gargenta, from Marakana Inc. For the complete slides from this talk go to http://mrkn.co/munz7 "The most interesting part of Android stack are the Android System Services. The 60+ such services expose the low level functionality, such as Power Management, Wifi, Camera, Sensors, GPS, Display, Audio, Media, and so on, all the hardware all the way up to the application layer. While each one is different, the all have certain similarities, namely the way they rely on Binder (Android's IPC mechanism), use JNI to cross Java-C boundary, and use of shared libraries to abstract the Linux drivers. In this talk, we'll explore the common system services in Android and discuss their architecture. You will get to see the diagrams of the inner workings of some of the previously undocumented parts of the Android stack. By the end of the talk, you should have a better understanding of the underpinnings of the backbone of Android OS." https://events.linuxfoundation.org/events/android-builders-summit/gargentaa

1. Android Services Black Magic
by Aleksandar (Saša) Gargenta, Marakana Inc.
Android Builders Summit
February 14th, 2012
Redwood Shores, CA
Screencast @
http://mrkn.co/munz7

2. About
Aleksandar (Saša) Gargenta
• Developer and instructor of Android Internals and Security training at Marakana
• Founder and co-organizer of San Francisco Android User Group (sfandroid.org)
• Founder and co-organizer of San Francisco Java User Group (sfjava.org)
• Co-founder and co-organizer of San Francisco HTML5 User Group (sfhtml5.org)
• Speaker at AnDevCon, AndroidOpen, Android Builders Summit, etc.
• Server-side Java and Linux, since 1997
• Android/embedded Java and Linux, since 2009
• Worked on SMS, WAP Push, MMS, OTA provisioning in previous life
• @agargenta on Twitter
• aleksandar.gargenta@gmail.com on Google+
Marakana - Helping people get better at what they do
• Training on cutting edge open source software (like Android!)
• Rockstar team of experts, on staff
• Content is king
• http://marakana.com/

3. Android Stack
Applications
Content
Home Contacts Phone Browser
Providers
Application Framework
Activity Window Vibrator WiFi Battery
Service Service Service Service Service
Package Telephony Resource Location Notification
Service Service Manager Service Service
Native Layer
Surface Media Android Runtime
SQLite SSL
Flinger Framework
Core Libs
OpenGL vold netd WebKit
Dalvik
libwifi libcamera libgps libc VM
Display Camera Linux Kernel GPS Binder
Driver Driver Driver Driver
Keypad WiFi Audio Power
Driver Driver Driver Mgmt

4. Vibrator on Android
com.example.app (/data/app/ExampleApp.apk) system_server
DalvikVM DalvikVM
classes.dex /system/framework/framework.jar
com.example.app.ExampleActivity android.os.IVibratorService.Stub
extends
calls
/system/framework/framework.jar /system/framework/services.jar
registers "vibrator" service via ServiceManager
android.os.Vibrator com.android.server.SystemServer
creates
calls
android.os.IVibratorService.Stub.Proxy com.android.server.VibratorService
looks up "vibrator" service via SM
calls/links to
gets a reference to the ServiceManager (handle=0)
/system/lib/libandroid_servers.so
/system/lib/libandroid_runtime.so
references
uses (calls)
com_android_server_VibratorService.cpp
/system/lib/libbinder.so
calls
/system/lib/lib*.so /system/lib/libhardware_legacy.so
vibrator.c
invokes transaction
uses (io write)
/system/bin/servicemanager /system/lib/libandroid_runtime.so
service_manager.c /system/lib/libbinder.so
references
/system/lib/lib*.so /system/lib/lib*.so
/dev/binder /sys/class/timed_output/vibrator/enable
Kernel
registers as binder context manager
gets a reference to the ServiceManager (handle=0)

5. Power on Android
com.example.app (/data/app/ExampleApp.apk) system_server
DalvikVM DalvikVM
/system/framework/framework.jar
classes.dex
android.os.IPowerManager.Stub
com.example.app.ExampleActivity
android.os.Power
calls
calls
/system/framework/framework.jar /system/framework/services.jar
extends
creates
registers "power" service via ServiceManager
android.os.PowerManager com.android.server.SystemServer
creates
android.os.PowerManager.WakeLock com.android.server.PowerManagerService
looks up "power" service via SM
calls/links to
gets a reference to the ServiceManager (handle=0)
android.os.IPowerManager.Stub.Proxy calls
/system/lib/libandroid_runtime.so
/system/lib/libandroid_runtime.so
references
android_os_Power.cpp
/system/lib/libbinder.so
calls
/system/lib/lib*.so /system/lib/libhardware_legacy.so
uses (calls)
power.c
uses (io write)
/system/bin/servicemanager /system/lib/libandroid_runtime.so
service_manager.c /system/lib/libbinder.so
invokes
references
/system/lib/lib*.so /system/lib/lib*.so
/dev/binder /sys/power/wake_lock
Kernel
registers as binder context manager
gets a reference to the ServiceManager (handle=0)

6. Alarm on Android
com.android.deskclock system_server
(/system/app/DeskClock.apk)
DalvikVM
DalvikVM
/system/framework/framework.jar
classes.dex
android.app.IAlarmManager.Stub
calls
com.android.deskclock.AlarmClock
com.android.deskclock.Alarms
extends
/system/framework/services.jar
uses
calls
/system/framework/framework.jar
registers "alarm" service via ServiceManager
com.android.server.SystemServer
creates
android.app.ContextImpl
android.app.AlarmManager .AlarmManagerService
looks up "alarm" service via SM
calls
calls/links to
gets a reference to the ServiceManager (handle=0)
android.app.IAlarmManager.Stub.Proxy
/system/lib/libandroid_runtime.so
references
/system/lib/libandroid_servers.so
/system/lib/libbinder.so
uses (calls)
com_android_server_AlarmManagerService.cpp
/system/lib/lib*.so
/system/bin/servicemanager /system/lib/libandroid_runtime.so
uses (ioctl)
service_manager.c /system/lib/libbinder.so
invokes
references
/system/lib/lib*.so /system/lib/lib*.so
/dev/binder /dev/alarm
Kernel
registers as binder context manager
gets a reference to the ServiceManager (handle=0)

7. Package Manager on Android
com.android.packageinstaller system_server
(/system/app/PackageInstaller.apk)
DalvikVM
DalvikVM
classes.dex /system/framework/framework.jar
.PackageInstallerActivity android.content.pm.IPackageManager.Stub
calls
.InstallAppProgress
extends
extends
/system/framework/services.jar
/system/framework/framework.jar
calls
creates
android.content.pm.PackageManager com.android.server.SystemServer
android.app.ApplicationPackageManager com.android.server.pm.PackageManagerService
calls
calls
looks up "package" service via SM
registers "package" service via SM
gets a reference to the ServiceManager (handle=0)
android.content.pm.IPackageManager.Stub.Proxy
com.android.server.pm.Installer
/system/lib/libandroid_runtime.so
/system/lib/libandroid_runtime.so
references
/system/lib/libbinder.so
uses (calls)
/system/lib/libbinder.so
/system/lib/lib*.so
send messages
/system/lib/lib*.so
invokes transaction
/system/bin/servicemanager
service_manager.c installd
installd.c
references
/system/lib/lib*.so
get messages
/dev/binder /dev/socket/installd
Kernel
registers as binder context manager
gets a reference to the ServiceManager (handle=0)

8. WiFi Management on Android
com.example.app (/data/app/ExampleApp.apk) system_server
DalvikVM
DalvikVM
/system/framework/framework.jar
classes.dex
android.net.wifi.IWifiManager.Stub
com.example.app.ExampleActivity
android.net.wifi.WifiStateMachine
calls
calls
/system/framework/framework.jar android.net.wifi.WifiNative
extends
creates
calls
android.net.wifi.WifiManager /system/framework/services.jar
calls
com.android.server.SystemServer
android.net.wifi.IWifiManager.Stub.Proxy
calls/links to
gets a reference to the ServiceManager (handle=0)
looks up "wifi" service via SM
com.android.server.WifiService
registers "wifi" service via SM
/system/lib/libandroid_runtime.so /system/lib/libandroid_servers.so
android_net_wifi_Wifi.cpp
uses (calls)
/system/lib/libbinder.so
calls
references
/system/lib/libhardware_legacy.so
/system/lib/lib*.so wifi.c
calls
/system/lib/libwpa_client.so
/system/bin/servicemanager wpa_ctrl.c
sends commands
service_manager.c /system/lib/lib*.so
invokes
references
/system/lib/lib*.so
wpa_supplicant
/dev/binder bcmdhd /dev/socket/wpa_wlan0
Kernel
registers as binder context manager
calls (ioctl) read commands
as nl80211

9. Location on Android
com.example.app (/data/app/ExampleApp.apk) system_server
DalvikVM DalvikVM
/system/framework/framework.jar
classes.dex
.LocationManager.Stub
com.example.app.ExampleActivity
creates
extends
/system/framework/services.jar
calls
/system/framework/framework.jar com.android.server.SystemServer
calls
android.location.LocationManager .LocationManagerService
calls
.location.GpsLocationProvider
registers "location" service via SM
looks up "location" service via SM
gets a reference to the ServiceManager (handle=0)
.LocationManager.Stub.Proxy
links to
calls
/system/lib/libandroid_servers.so
/system/lib/libandroid_runtime.so _location_GpsLocationProvider.cpp
uses (calls)
references
/system/lib/libbinder.so
loads
calls
/vendor/lib/hw/gps.omap4.so
/system/lib/lib*.so impl of include/hardware/gps.h
/system/lib/libhardware.so
/system/bin/servicemanager
uses (io)
/system/lib/libandroid_runtime.so
service_manager.c /system/lib/libbinder.so
invokes
references
/system/lib/lib*.so /system/lib/lib*.so
/dev/binder /dev/ttyo0
Kernel
registers as binder context manager

10. Audio Policy on Android
com.example.app (/data/app/ExampleApp.apk) system_server
DalvikVM
DalvikVM /system/framework/framework.jar
extends
classes.dex android.media.IAudioService.Stub
com.example.app.ExampleActivity
android.media.AudioService
calls
calls
creates
/system/framework/framework.jar android.media.AudioSystem
links to/calls
android.media.AudioManager /system/framework/services.jar
calls
com.android.server.SystemServer
android.media.IAudioService.Stub.Proxy
looks up "audio" service via SM
gets a reference to the ServiceManager (handle=0)
/system/lib/libandroid_runtime.so
registers "audio" service via SM
android_media_AudioSystem.cpp
calls
/system/lib/libandroid_runtime.so
/system/lib/libmedia.so
android.AudioSystem
calls
/system/lib/libbinder.so android.BpAudioPolicyService
uses (calls)
/system/lib/lib*.so
references
mediaserver
calls
extends
/system/lib/libmedia.so
android.BnAudioPolicyService
/system/bin/servicemanager /system/lib/libaudioflinger.so
android.AudioPolicyService
calls
service_manager.c
invokes /system/lib/hw/audio_policy.default.so
android_audio_legacy.AudioPolicyManagerDefault
calls
/system/lib/lib*.so
/system/lib/hw/audio.primary.tuna.so
audio_hw.c
uses (ioctl) calls
references looks up "media.audio_policy"
/system/lib/libtinyalsa.so
registers as binder context manager mixer.c
/dev/binder /dev/snd/controlC0 (ALSA)
Kernel

11. Audio Playback on Android
com.ex.app (/data/app/ExampleApp.apk) mediaserver
DalvikVM /system/lib/libmediaplayerservice.so
/system/lib/libmedia.so
classes.dex
android.BnMediaPlayerService android.MediaPlayerService
com.ex.app.ExampleActivity
android.BnMediaPlayer android.MediaPlayerService.Client
/system/framework/framework.jar .AudioTrack .AudioSystem android.StagefrightPlayer
android.media.MediaPlayer
.MediaPlayerService.AudioOutput
/system/lib/libstagefright.so
/system/lib/libmedia_jni.so .AwesomePlayer .AudioPlayer /system/lib/libstagefright_soft_mp3dec.so
android_media_MediaPlayer.cpp .MediaSource .MP3Source android.SoftMP3
.OMXCodec .MP3Extractor
/system/lib/libmedia.so /system/lib/libaudioflinger.so
android.BpMediaPlayer .AudioFlinger .AudioPolicyService
android.BpMediaPlayerService
/system/lib/hw/audio.primary.tuna.so /system/lib/ /system/lib/
audio_hw.c libstagefrighthw.so libOMX_Core.so
/system/lib/lib*.so
android.TIOMXPlugin OMX_Core.c
/system/lib/libtinyalsa.so /system/lib/hw/audio_policy.default.so
/system/bin/servicemanager
service_manager.c pcm.c android_audio_legacy.AudioPolicyManagerDefault
/system/lib/lib*.so
/dev/binder /dev/snd/pcmC0D0p (ALSA) /dev/snd/controlC0 (ALSA)
Kernel

12. Telephony on Android
PhoneApp system_server
(/system/app/Phone.apk)
DalvikVM
DalvikVM /system/framework/framework.jar
classes.dex android.media.AudioService
uses
CallController
CallController
PhoneUtils
calls /system/framework/framework.jar
com.android.internal.telephony.CallManager
calls
android.media.AudioManager
com.android.internal.telephony.Phone
calls
implements rild
com.android.internal.telephony.gsm.GSMPhone
rild.c
calls
GsmCallTracker
Socket messages
/system/lib/libril.so
loads
RIL
uses
/system/lib/libsecril-client.so
RILSender RILReceiver
/vendor/lib/libsec-ril.so
Socket messages Socket messages uses
/dev/socket/rild /dev/ttys0 Audio drivers
Kernel

13. DevicePolicy on Android
com.example.enterpriseapp system_server
(/data/app/EnterpriseApp.apk)
DalvikVM
DalvikVM
/system/framework/framework.jar
classes.dex
android.app.admin.DevicePolicyManager.Stub
.ExampleActivity
calls
android.os.RecoverySystem
calls
calls
android.os.PowerManager
extends
/system/framework/framework.jar
calls
com.android.internal.app.ShutdownThread
android.app.admin.DevicePolicyManager
android.os.Power
looks up "device_policy" service via SM
calls
calls
registers "device_policy" service via SM
creates
calls
/system/framework/services.jar
gets a reference to the ServiceManager (handle=0)
android.app.admin.DevicePolicyManager.Stub.Proxy
com.android.server.SystemServer
com.android.server.DevicePolicyManagerService
/system/lib/libandroid_runtime.so
com.android.server.PowerManagerService
/system/lib/libbinder.so
links to/calls
references
/system/lib/lib*.so /system/lib/libandroid_runtime.so
uses (calls)
invokes transaction
android_os_Power.cpp
reboot
/system/bin/servicemanager /system/lib/lib*.so
service_manager.c recovery
writes
references
reads
/system/lib/lib*.so recovery.c
/cache/recovery/command
/dev/binder
/dev/block/platform/omap/omap_hsmmc.0/by-name/userdata erases
Kernel formats
registers as binder context manager
gets a reference to the ServiceManager (handle=0)

14. Thank You
For the complete screencast of this presentation go to
http://mrkn.co/munz7
@agargenta on Twitter
aleksandar.gargenta@gmail.com on G+