Pocket-sized Virtual Machines: Booting Small Linux Payloads in Android (Pierre-Clement Tosi, Google)
Channel: BayLibre
Date: 02/11/2023

Android is a large and complicated system with the Linux kernel at its core, exposing dozens of potentially exploitable interfaces to untrusted code. The sheer size, complexity, fragmentation, and rate of change result in a high probability of security vulnerabilities. Exploiting the kernel compromises most of the Android system, including all applications. To address this, Android 13 added support for extending the main operating system with a hypervisor to isolate selected applications from the “host” kernel. To guarantee the integrity of a guest spawned by a potentially compromised host, the Android Virtualization Framework (AVF) relies on custom guest firmware injected in the virtual baremetal environment to verify the payload before its execution, implementing a software root-of-trust. This talk will introduce the AVF architecture before diving into the motivations behind and design of its Rust-based firmware. It will also cover how Linux-based Microdroid, the main AVF guest OS, was optimized to reduce the footprint of protected VMs.

Presentation from Pierre-Clement Tosi (Google) during Embedded Recipes 2023.

Slides: https://shorturl.at/elno8