How Apps Communicate with ActivityManagerService

Overview

Apps communicate with ActivityManagerService (AMS) through Android's Binder IPC (Inter-Process Communication) mechanism.

The document explains the complete communication flow.

Architecture Overview

App Process
Activity/Service/etc ActivityManager IActivityManager
Binder Proxy Binder Driver
Kernel ActivityManagerService
System Server IActivityManager.Stub

Key Components

1. IActivityManager.aidl - The Interface Definition

Location: $IActivityManager.aidl$

This AIDL (Android Interface Definition Language) file defines the system API for communication between apps and AMS. It contains ~200+ methods including:

startActivity() - Launch activities
startService() - Start services
broadcastIntent() - Send broadcasts
bindService() - Bind to services
getContentProvider() - Access content providers
attachApplication() - Attach app process to AMS

Example methods:

java 复制代码

interface IActivityManager {
    // Start an activity
    int startActivityWithFeature(in IApplicationThread caller, 
        in String callingPackage, in String callingFeatureId, 
        in Intent intent, ...);
    
    // Start a service
    ComponentName startService(in IApplicationThread caller, 
        in Intent service, in String resolvedType, ...);
    
    // Broadcast intent
    int broadcastIntentWithFeature(in IApplicationThread caller,
        in String callingFeatureId, in Intent intent, ...);
}

2. ActivityManager - Client Side API

Location: $ActivityManager.java$

This class provides the app-facing API and internally uses Binder to communicate with AMS.

How Apps Get AMS Reference

java 复制代码

// Line 4738-4755
public static IActivityManager getService() {
    return IActivityManagerSingleton.get();
}

private static final Singleton<IActivityManager> IActivityManagerSingleton =
    new Singleton<IActivityManager>() {
        @Override
        protected IActivityManager create() {
            // 1. Get Binder reference from ServiceManager
            final IBinder b = ServiceManager.getService(Context.ACTIVITY_SERVICE);
            
            // 2. Convert to IActivityManager proxy
            final IActivityManager am = IActivityManager.Stub.asInterface(b);
            
            return am;
        }
    };

Key Steps:

ServiceManager.getService() - Retrieve Binder token for "activity" service
IActivityManager.Stub.asInterface() - Create Binder proxy
Singleton pattern - Cache reference for reuse

3. ActivityManagerService - Server Implementation

Location: $ActivityManagerService.java$

AMS extends IActivityManager.Stub (Binder server stub) and implements all interface methods.

Communication Flow

Example: Starting an Activity

App (Client) ActivityManager IActivityManager.Stub.Proxy Binder Driver IActivityManager.Stub ActivityManagerService startActivity(intent) getService() startActivityWithFeature(...) Parcel data transact() onTransact() startActivityWithFeature(...) Process request Return result Reply Result Result Result App (Client) ActivityManager IActivityManager.Stub.Proxy Binder Driver IActivityManager.Stub ActivityManagerService

Common Usage Patterns

Pattern 1: Direct IActivityManager Access

Used by framework classes like ActivityThread:

java 复制代码

// ActivityThread.java Line 4263
IActivityManager mgr = ActivityManager.getService();
mgr.attachApplication(mAppThread, startSeq);

Pattern 2: Through Context APIs

Apps typically use Context wrapper methods:

java 复制代码

// App code
context.startActivity(intent);
context.sendBroadcast(intent);
context.startService(intent);

// Internally in ContextImpl.java
ActivityManager.getService().broadcastIntentWithFeature(...);
ActivityManager.getService().startService(...);

Examples from Codebase

1. Activity Starting Activity

java 复制代码

// Activity.java Line 6938
IIntentSender target = ActivityManager.getService().getIntentSenderWithFeature(...);

2. Broadcasting Intent

java 复制代码

// ContextImpl.java Line 1193
ActivityManager.getService().broadcastIntentWithFeature(
    mMainThread.getApplicationThread(), 
    getAttributionTag(),
    intent, resolvedType, resultReceiver, ...);

3. Service Lifecycle

java 复制代码

// ActivityThread.java Line 4489
ActivityManager.getService().serviceDoneExecuting(
    token, SERVICE_DONE_EXECUTING_START, startId, res);

4. Content Provider Access

java 复制代码

// ActivityThread.java Line 7055
holder = ActivityManager.getService().getContentProvider(
    getApplicationThread(), auth, userId, stable);

Binder IPC Mechanism

What is Binder?

Binder is Android's custom IPC mechanism that enables:

Cross-process method calls
Object reference passing
Security (UID/PID verification)
Memory-efficient data transfer

Binder Components

Component	Role	Location
Binder Driver	Kernel module	Linux kernel
ServiceManager	Service registry	Native daemon
Stub	Server-side skeleton	AMS process
Proxy	Client-side proxy	App process

Data Flow

App calls method on Proxy
Proxy marshals parameters into Parcel
Binder Driver transfers Parcel to server process
Stub unmarshals Parcel
Stub calls actual AMS method
Result flows back through same path

Security & Permissions

UID/PID Verification

AMS verifies caller identity:

java 复制代码

int callingUid = Binder.getCallingUid();
int callingPid = Binder.getCallingPid();

Permission Checks

Many methods require permissions:

java 复制代码

// IActivityManager.aidl
@RequiresPermission(Manifest.permission.FORCE_STOP_PACKAGES)
void forceStopPackage(in String packageName, int userId);

Complete Example: App Launch Flow

1. App Code

java 复制代码

Intent intent = new Intent(this, TargetActivity.class);
startActivity(intent);

2. Activity.java

java 复制代码

public void startActivity(Intent intent) {
    startActivity(intent, null);
}

3. Instrumentation.java

java 复制代码

ActivityManager.getService().startActivityWithFeature(...);

4. Binder IPC

复制代码

[App Process] → Binder Proxy → Binder Driver → Binder Stub → [System Server]

5. ActivityManagerService

java 复制代码

public int startActivityWithFeature(...) {
    // Verify permissions
    // Create ActivityRecord
    // Start process if needed
    // Launch activity
}

Key Takeaways

Apps never directly access AMS - Always through Binder IPC
Single API : ActivityManager.getService() returns IActivityManager proxy
AIDL defines contract between app and system server
Binder handles all cross-process communication
Security enforced at Binder boundary (UID/PID checks, permissions)

Common API Categories

Category	Example Methods
Activity	startActivity, finishActivity, moveTaskToFront
Service	startService, stopService, bindService, unbindService
Broadcast	broadcastIntent, registerReceiver, unregisterReceiver
Provider	getContentProvider, publishContentProviders
Process	attachApplication, getRunningAppProcesses, killPids
Configuration	getConfiguration, updateConfiguration
System	getCurrentUser, isUserRunning, shutdown