Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine as a core Android Primitive

android-developers.googleblog.com

Post reply on HN
Print view View original

121–130 of 177 posts

Re: Virtual Machine as a core Android Primitive

#121

Post by berkes »

codedokode wrote: post #114

Looks like something absolutely overengineered and unnecessary. Why do you need a virtual machine with a separate kernel? Why do you need to protect it from kernel? I guess, it is made mostly for playing DRM content?

A use-case I can imagine is e.g. a password vault, a banking app, or a secure messaging app that you want isolated from everything. Even when running. And where "everything" includes infected apps, an infected host or even physical access.

Not sure if this architecture can handle that, nor of it's the best architecture to solve this problem, though.

Re: Virtual Machine as a core Android Primitive

#122

Post by glacia01 »

omeid2 wrote: post #82
robertwt7 wrote: post #77

Although this is very exciting. Surely performance is not the benefit here? It won’t perform better than android app built not on top of the virtualisation tdchnology?

Android apps are already running on top of a Virtualisation Technology", both current ART (Android Runtime) and the previous one, Delvik, runtimes are virtual machines, process level virtual machines, but they do bytecode translation/JIT nonetheless. If AVF allows running native code, it might actually be cheaper than the current arrangement.

I'm not Android expert in any way, but VM have nothing to do with virtualization. I think you're confusing something.

Re: Virtual Machine as a core Android Primitive

#123

Post by teleforce »

usrusr wrote: post #92

Back at university one lecture included an infographic about how CPU and operating system features like MMU, increasing register width and the like all started at mainframe-scale installations and trickled down to desktop scale systems and later to handheld devices at a surprisingly consistent pace. It was the time w2k was trying to make NT features mainstream and J2ME arrived on phones. I extrapolated a little and m…

The multi-user part for Android OS is not an extrapolation, it is inevitable.

Fun facts, Unix name is a joke to Multics, where Multi stands for multi-user, and everyone know what happened soon to Unix single user name indication.

Re: Virtual Machine as a core Android Primitive

#124

Post by __alexs »

VierScar wrote: post #103
usrusr wrote: post #92

Back at university one lecture included an infographic about how CPU and operating system features like MMU, increasing register width and the like all started at mainframe-scale installations and trickled down to desktop scale systems and later to handheld devices at a surprisingly consistent pace. It was the time w2k was trying to make NT features mainstream and J2ME arrived on phones. I extrapolated a little and m…

You can't claim you're not surprised? So you can claim you are surprised? You're surprised by this. I feel like I'm trying to understand double negatation logic in code haha

Double (triple, even quadruple) negatives meaning a negative are a common feature of english dialects. They are for emphasis!

Re: Virtual Machine as a core Android Primitive

#125

Post by usrusr »

VierScar wrote: post #103
usrusr wrote: post #92

Back at university one lecture included an infographic about how CPU and operating system features like MMU, increasing register width and the like all started at mainframe-scale installations and trickled down to desktop scale systems and later to handheld devices at a surprisingly consistent pace. It was the time w2k was trying to make NT features mainstream and J2ME arrived on phones. I extrapolated a little and m…

You can't claim you're not surprised? So you can claim you are surprised? You're surprised by this. I feel like I'm trying to understand double negatation logic in code haha

It means that I don't feel able to give in to the desire of claiming "told me so"

Re: Virtual Machine as a core Android Primitive

#126

Post by rfoo »

saagarjha wrote: post #86
sangnoir wrote: post #46

Earlier quoted context omitted.

I'd love for my banking app to be completely isolated from the rest of my phone OS, in case I get malware. I'm sure journalists at risk of targeting by NSO and its ilk would appreciate isolation or their messaging apps

This is an interesting usecase (basically Qubes) but it has high overhead and I don't really see the framework as being designed to support this, at least yet. You'd need to move all sorts of services into the VM to support the app (like, for example, someone needs to pass touch input and network traffic into the VM) and at this begins to look like an entire OS running in there.

Qualcomm does have similar architecture deployed, here is their hypervisor: https://github.com/quic/gunyah-hypervisor.

AFAIK Qualcomm's implementation does include passing touch input / display into the VM and is marketed in similar term ("Trusted User Interface") to TEE-based techs, except they are not in S-EL0/1.

I've only seen this used in some really obscure scenario (cryptocurrency wallet) though.

Re: Virtual Machine as a core Android Primitive

#127

Post by walteweiss »

heavyset_go wrote: post #15
awoimbee wrote: post #5

Will this allow running linux VMs on any Android device ? Via something like nestbox: https://www.patreon.com/posts/74333551 ?

This is already possible if your phones ship with the KVM kernel module, like on some Pixel devices, but reading the article suggests that KVM will become standard on all Android devices to enable this. edit: according to this[1], yes, the pKVM functionality that's standard in Android exposes KVM functionality so that you can run VMs on Android. [1] https://www.xda-developers.com/android-13-dp1-google-pixel-6...

Which Pixel devices? Is it something new or not-so-new?

Re: Virtual Machine as a core Android Primitive

#128

Post by walteweiss »

glacia01 wrote: post #122
omeid2 wrote: post #82

Earlier quoted context omitted.

Android apps are already running on top of a Virtualisation Technology", both current ART (Android Runtime) and the previous one, Delvik, runtimes are virtual machines, process level virtual machines, but they do bytecode translation/JIT nonetheless. If AVF allows running native code, it might actually be cheaper than the current arrangement.

I'm not Android expert in any way, but VM have nothing to do with virtualization. I think you're confusing something.

What do you mean?

Literally, the title: ‘Virtual Machine as a core Android Primitive’ and the very first sentence: ‘The Android Virtualization Framework (AVF) will be available on upcoming select Android 14 devices.’

Re: Virtual Machine as a core Android Primitive

#129

Post by worthless-trash »

bonzini wrote: post #91
ungamedplayer wrote: post #73

Earlier quoted context omitted.

> You can recognize them because hardware not commonly used with untrusted guests does not get a CVE. This is not true. Even non default configuration of any software or hardware that contains a security vulnerability can get a CVE. It has in the past and will again in the future. Source: I have assigned over 2000 cves for the kernel.

Yes, and the policy of QEMU is to not assign CVEs for bugs that would generally be hit only when QEMU is used as a development platform, as opposed to using it to offer virtualization services. https://www.qemu.org/contribute/security-process/ We are colleagues by the way. :)

> We are colleagues by the way. :)

I'm aware, I see you comment here regularly.

QEMU doesn't have to assign CVE's but any other CNA can. I do not believe that its good security or even good practice to negotiate out of exploitable flaws. Its a dis-service to users.

I don't have enough skin in the game to change upstream QEMU's mind on this, systems in exploitable configurations are just as exploitable with or without a CVE assigned. People with exploitable configurations now just can't find out there is a problem.

Re: Virtual Machine as a core Android Primitive

#130

Post by angm128 »

heavyset_go wrote: post #15
awoimbee wrote: post #5

Will this allow running linux VMs on any Android device ? Via something like nestbox: https://www.patreon.com/posts/74333551 ?

This is already possible if your phones ship with the KVM kernel module, like on some Pixel devices, but reading the article suggests that KVM will become standard on all Android devices to enable this. edit: according to this[1], yes, the pKVM functionality that's standard in Android exposes KVM functionality so that you can run VMs on Android. [1] https://www.xda-developers.com/android-13-dp1-google-pixel-6...

A full linux environment (with external monitor support) sounds awesome. I hope that enabled KVM becomes standard

Would graphics acceleration work properly?

Post reply on HN