This document provides a technical overview of the Android Virtualization Framework (AVF) and its current integration across critical platform functions, demonstrating the use of both Protected Virtual Machines (pVMs) and standard VMs to enforce isolation, enhance security, and enable new developer features. The core AVF applications discussed include isolating sensitive system compilation processes via pVMs to reduce post-update boot time, deploying a non-protected Linux development environment accessible via a terminal application, and utilizing pVMs for privacy-centric Content Safety On-Device solutions (e.g., Play Protect live threat detection). A primary architectural focus across security-sensitive applications is the verification of code integrity via Verified Boot, the use of DICE profiles for key generation, and reliance on fs-verity for validating input and output file integrity when stored on the untrusted Android host.
AVF Architecture and Use Cases Summary
AOSP Development Model Update (Effective 2026): Source code publishing to AOSP will transition to a Q2 and Q4 schedule to align with the trunk stable development model. Contributors are advised to use the android-latest-release manifest branch instead of aosp-main.
Isolated Compilation via pVM:
Goal: Provides a secure enclave for compiling security-sensitive code, specifically bootclasspath and system server JARs triggered by APEX updates. This process shifts compilation from early boot to before reboot, significantly reducing boot time.
Implementation: Contained within the optional com.android.compos APEX.
Security: The pVM ensures compilation integrity. Output files are protected by a signature, which Android verifies against the VM’s public key.
Key Derivation: The VM's key is generated from the DICE profile, which is defined by the mounted APEXes, APKs, and other VM parameters (e.g., debuggability status).
Input/Output Integrity: Input files are verified using the fs-verity algorithm, with the root hash provided in a container that contributes to the VM’s DICE profile. Output integrity is maintained within the VM using a dynamically updated fs-verity tree format, and the final output is signature-protected.
Linux Development Environment (Non-Protected VM):
Functionality: Enables a Linux-based development environment directly on Android devices, running within a standard (non-protected) VM created by AVF.
Activation Flow: Activated via Developer Options, launching a dedicated Terminal app. The app downloads a slightly modified Debian-based OS image.
Interaction: The Terminal app uses a WebView to connect to a web service (ttyd) running inside the VM, which provides terminal access over HTTP.
Network: Connectivity is managed by the existing Android Tethering Manager subsystem.
Content Safety On-Device (pVM for PCC):
Objective: Implements privacy-preserving content safety classification (e.g., Play Protect live threat detection) while adhering to Private Compute Core (PCC) principles.
Security Benefit: Running model classification inside a pVM prevents reverse engineering and manipulation, even on rooted devices, by verifying approved code execution and isolating operations.
Key Flow: Private Compute Services starts the VM, obtains its public key, mediates attestation verification with the server, and receives encrypted protections. The VM is the sole entity possessing the private key necessary to decrypt and utilize these protections.
OEM Custom Use Cases:
AVF is available for custom implementations by OEMs. An example is OPPO, which utilizes AVF to enable an AI private computing space, running on-device risk control solutions for app clients within a VM.