Virtualization in Android
summary
Android builds a protected VM layer using pkvm (ARM64 KVM protected mode) and a Rust VMM (cross VM) to run tiny Android guests (a base distro called microdroid) that the host cannot read, with hypercalls for limited shared buffers and entropy; each VM gets a per-instance secret derived from device roots and measurements. The platform ships an isolated compilation use case in Android T that signs system jars and cuts first-boot OTA work by seconds to minutes; APIs are platform-only today.
AI-written summary · about
chapters (8)
- 0:00Introduction to talk
- 0:44Current Android security model
- 3:10Protected Computing vision
- 5:36pkvm hypervisor details
- 7:05Microdroid and communication
- 8:50Unique VM secrets and use cases
- 12:10Concrete virtualization use cases
- 14:19Future plans and ecosystem
related talks
44mVirtualization for the Masses: Exposing KVM on Android
13mAdding Third-Party Hypervisor to Android Virtualization Framework
45mAndroVM: A New Development and Testing Environment
43mUsing Android as OS for a single purpose system
55mCompilers. Dalvik. ART. And everything in between
35mBest practices in using the Android Emulator
13mPorting Android Automotive on Xen
43mAndroid Internals for Developers