Android Virtualization Framework (AVF) overview

Android Virtualization Framework (AVF) provides secure and private execution environments for executing code. AVF is ideal for security-oriented use cases that require stronger, even formally verified, isolation assurances over those offered by Android's app sandbox. Android provides a reference implementation of all the components needed to implement AVF. AVF is supported only on ARM64 devices. Figure 1 shows the architecture of AVF:

AVF architecture

Figure 1. AVF architecture.

Here are the definitions for the most important terms from figure 1:

apexd and zipfuse
Securely mounts APEXes and APKs imported from host.
authfs
A fuse file system for securely sharing multiple files between Android and pVM (host and guest).
binder
Primary means of inter-VM communication.
crosvm
A virtual machine monitor written in rust. crosvm allocates VM memory, creates virtual CPU threads, and implements the virtual device's back-ends.
Generic Kernel Image (GKI)
A boot image certified by Google that contains a GKI kernel built from an Android Common Kernel (ACK) source tree and is suitable to be flashed to the boot partition of an Android device. For further information, see the Kernel overview.
hypervisor
The virtualization technology used by AVF, also known as pKVM. The hypervisor maintains the integrity of the executed code and confidentiality of the pVM's assets, even if host Android or any of the other pVMs are compromised.
Java API
The VirtualizationService Java APIs, which are present only on devices with AVF support. These APIs are optional and not part of thebootclasspath.
Microdroid
A Google-provided mini-Android OS that runs in a pVM.
Microdroid Manager
Manages the pVM lifecycle, inside the pVM, and instance disk.
Native API
A subset of the Android Native Developers Kit (NDK).
protected kernel-based virtual machine (pKVM)
See Hypervisor.
pVM firmware (pvmfw)
The first code that runs on a pVM, pvmfw verifies the payload and derives the per-VM secret.
protected virtual machine (pVM)
A VM managed by a hypervisor, running in the non-secure or realm world and is isolated from the Android host OS so that access is prevented even in the event of a compromised Android host.

pVMs support rich environments, including Linux-based distributions. The pVM concept is not Google-exclusive. Partner-defined VMs (SoC/OEM) meeting isolation / memory access restrictions are also pVMs.

VirtualizationService
The Android service that manages the lifecycle of pVMs.

What's next?

  • If you want to better understand the need for AVF, refer to Why AVF?.
  • To read about how AVF can be used for isolated compilation, refer to Use cases.
  • If you want a more in-depth explanation of the AVF reference implementation's architecture, refer to AVF architecture.
  • If you want to learn about Microdroid, refer to Microdroid.
  • If you are interested in how AVF handles security, refer to Security.
  • To understand the role of the virtualization service, refer to VirtualizationService.
  • For source code of AVF or in-depth explanation about individual components, refer to AOSP repository