Users often perceive Android as a single whole, simply an “operating system” that runs on a smartphone. However, under the beautiful interface shell hides a complex multi-layer architecture, reminiscent of a layer cake. Understanding what is included in the Android system is critical for those who want to not only use the device, but also optimize its operation, solve complex compatibility problems, or choose custom firmware.
Unlike closed systems, the architecture Google Android is built on a modular principle. This means that each layer performs a strictly assigned function and interacts with neighboring layers through special interfaces. If one component fails, this does not always lead to a complete collapse of the device, since other modules can continue to function in an isolated mode.
In this article we will analyze the software stack in detail, starting from the lowest level of interaction with the hardware and ending with the familiar application icons on your screen. You will learn what the kernel is responsible for, how drivers work, and why some applications require root access to access certain functions.
Linux kernel level: the foundation of the entire system
The basis of the entire software package is Linux kernel (Linux Kernel). This is the lowest level of abstraction that directly interacts with the physical hardware of your smartphone. It is the kernel that controls the processor, RAM, power consumption and network interfaces. Without this component, not a single app can be executed.
The developers Google modified the standard Linux kernel by adding specific drivers necessary for mobile electronics. This includes display, camera, keyboard, Wi-Fi and flash memory drivers. These additions allow the OS to work correctly on a huge range of devices with different processor architectures (ARM, x86).
The key feature of the kernel is resource management. It decides which process to allocate more CPU time and which to put into sleep mode to save battery power. It also implements a user-level security system that isolates applications from each other.
The Linux kernel in Android runs in privileged mode. Damage to kernel files almost always leads to a “brick” of the device, which cannot be restored programmatically without flashing the bootloader.
It is important to note that it is the kernel version that often determines what new hardware support features will be available to the smartphone. Manufacturers rarely update this layer after the device is released, which is one of the main reasons for the aging of gadgets.
Hardware abstraction layer (HAL)
Above the core there is a layer Hardware Abstraction Layer (HAL). Its main purpose is to provide a standard interface to the upper levels of the system, hiding the implementation details of specific hardware. Simply put, HAL allows the system to "talk" to the camera or fingerprint sensor without knowing the exact model of the chip installed inside.
Each I/O device has its own HAL module. For example, the module audio.primary.so is responsible for working with the sound chip, and camera.vendor.so controls the camera matrix. This allows application developers to write universal code that will work on smartphones from Samsung, Xiaomi or Pixel without changes.
If the device manufacturer does not provide a correctly working HAL for a new component, this function simply will not be available in the system, even if the chip is physically soldered on the board. This is a common problem when installing custom firmware on little-known phone models.
⚠️ Attention: When flashing a device, an incompatible version of the HAL can lead to the inoperability of critical modules such as the communication modem or touch screen, even if the system itself boots.
The abstraction layer also includes implementation libraries that are often proprietary (closed). Processor manufacturers, such as Qualcomm or MediaTeksupply these libraries as binary files that cannot be modified or analyzed without special tools.
Android system libraries and runtime
The third level of the architecture contains a set of native libraries language C/C++ and application runtime. These libraries provide high performance for resource-intensive tasks such as graphics processing, video playback or working with databases.
Among the key components of this layer are:
- 📦 Surface Manager — controls access to the display subsystem and combines graphics layers from different applications.
- 🎵 Media Framework — supports playback and recording of many audio and video formats.
- 🌐 SQLite —a lightweight relational database available to all applications of the system.
- 🔣 FreeType —a library for rendering fonts.
The runtime environment works in parallel with the libraries. Android Runtime (ART). In modern versions of the system, it was ART that replaced the outdated Dalvik virtual machine. ART compiles application bytecode into machine code upon installation, which significantly speeds up the launch of apps and reduces the load on the processor during operation.
What is the difference between Dalvik and ART?
Dalvik used JIT compilation (at runtime), which slowed down the work but saved space. ART uses AOT compilation (during installation), taking up more disk space, but providing high application speed.
The libraries also include a graphics engine OpenGL ES or Vulkan, which are necessary for displaying complex 3D graphics in games and interfaces. Without these components, modern user experience would not be possible.
Application layer and framework
At the top of the pyramid is the application layer and framework. All those apps with which you interact every day are located here: phone, SMS, browser, maps and games. However, hidden underneath them is a powerful layer Android Frameworkthat provides an API for developers.
The framework consists of managers that control various aspects of the system:
- 📱 Activity Manager — manages the life cycle of applications and navigation between screens.
- 🔔 Notification Manager —allows applications to display notifications in status bar.
- 📍 Location Manager — provides access to geolocation data via GPS or network.
- 📞 Telephony Manager — manages calls and network status.
All system applications, such as Settings (Settings) or Launcher (Desktop), written using the same APIs as third-party apps from the store Google Play. This ensures unity of style and the ability to replace standard applications with alternative ones.
Developers can use these tools to create complex services that run in the background, synchronize data, or respond to device state changes. Access to these functions is regulated by a permission system.
System partitions and file structure
When we talk about what is included in the Android system in terms of the file system, we are talking about specific memory sections. Understanding the partition structure helps when manually restoring a device or cleaning up space.
The main sections of the firmware can be presented in the form of a table:
| Section | Purpose | Can it be changed |
|---|---|---|
/boot |
Contains the kernel Linux and ramdisk for boot | Only when flashing |
/system |
Main OS, applications and libraries (Read-only) | Only with root access |
/data |
User data, settings and installed applications | Yes (full access) |
/cache |
Temporary system and update files | Yes (can be cleared) |
/recovery |
Mini OS for recovery and factory reset | Replacement with custom Recovery |
The partition /system is usually mounted read-only. This is protection against accidental deletion of critical files by the user. To make changes to this section, you need to unlock the bootloader and obtain superuser rights.
The section /data is the most voluminous. This is where your photos, instant messenger conversations and application cache are stored. When performing a factory reset (Wipe Data), this particular partition is cleared, while the system files remain untouched.
The /system partition occupies a fixed amount of memory, determined when building the firmware. It is impossible to increase its size without rebuilding the system image.
Google services and proprietary add-ons
Purely technically, the project Android Open Source Project (AOSP) does not include services Google Play Services. However, in the vast majority of commercial smartphones this package is an integral part of the system. It provides push notifications, contact synchronization, geolocation and maps.
Without installed Google services, many popular applications, such as Uber, YouTube or banking clients, simply will not start or will work with errors. This creates the user's dependence on the corporation's ecosystem, even if an open operating system is used.
In addition to Google services, manufacturers add their own shells (MIUI, OneUI, ColorOS) and a set of pre-installed software. These add-ons are deeply integrated into the system framework, changing the behavior of notifications, power management and visual style.
⚠️ Warning: Removing manufacturer's system applications via ADB may lead to interface instability or endless rebooting if these applications are associated with system services.
In recent years, there has been a trend towards system modularization via project Project Treble. This allows you to update some system components regardless of the main firmware, which should theoretically speed up the release of security updates.
Frequently asked questions about the composition of the Android system
Is it possible to remove the Linux kernel and install another?
Theoretically, yes, but in practice this requires assembling your own kernel for a specific processor model and peripherals. This is inaccessible to the average user, as it requires deep knowledge of compilation and drivers.
Why does the system take up so much memory space?
A modern OS includes not only code, but also resources for many screens, languages, fonts and drivers. In addition, the section /system reserves space for future updates and temporary files.
What is the difference between ROM and RAM in the context of the system?
ROM (ROM) is a permanent memory where the firmware itself (system files) is stored. RAM (RAM) - random access memory where the system is loaded for operation. When you turn off the phone, the data in RAM is erased.
What is AOSP and how is it different from my Android?
AOSP is the bare metal version of the open source system. Your smartphone runs on AOSP, but with added drivers, Google services and a shell from the manufacturer.
Is it safe to change files in the /system partition?
No, it is dangerous. Any mistake when editing system files can cause the phone to stop booting (bootloop). Always make a full backup of the partition before intervening.