All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 0/2] Add crosvm recipe to meta-virtualization
@ 2026-06-13  6:07 Keerthivasan Raghavan
  2026-06-13  6:07 ` [PATCH v2 1/2] crosvm: add recipe for ChromeOS Virtual Machine Monitor (VMM) Keerthivasan Raghavan
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Keerthivasan Raghavan @ 2026-06-13  6:07 UTC (permalink / raw)
  To: vkraleti, anujmitt, sbanerje, bruce.ashfield, meta-virtualization
  Cc: Keerthivasan Raghavan

This patch series introduces support for crosvm, the ChromeOS Virtual
Machine Monitor, into the meta-virtualization layer. The goal is to
provide a modern, security-oriented alternative to QEMU for
virtualization workloads.

QEMU continues to be the industry-standard VMM, offering extensive device
models, multi-architecture emulation, and a highly flexible subsystem
architecture. However, QEMU's strength and breadth contributes to a
large and complex monolithic codebase. As documented in QEMU's own
security guidance, the system architecture places numerous components
within a single process. This increases the trusted computing base and
expands the range of possible exploit surfaces. Maintaining device models
and legacy emulation paths further adds to complexity and potential
vulnerability exposure.

crosvm approaches virtualization from a different perspective. Its design
principles center on minimalism, isolation, and security. Instead of
supporting full-system emulation, crosvm relies exclusively on KVM for
hardware-assisted virtualization. It is implemented in Rust, enabling
strong memory safety guarantees and eliminating many classes of bugs that
commonly arise in large C codebases.

A key architectural distinction is crosvm's process separation model.
Each device backend is offloaded into its own tightly sandboxed process
using seccomp filters and Linux namespaces. This “process-per-device”
layout shrinks the trusted computing base and prevents a compromise in one
device model from affecting the rest of the system. These isolation
boundaries align closely with secure-by-design principles and provide a
more predictable attack surface.

For embedded, edge, and containerized environments—where minimalism,
stability, and strict isolation are essential—crosvm offers a compelling
VMM alternative. By integrating crosvm into meta-virtualization, we allow
Yocto users to choose between a feature-rich, broad-emulation platform
(QEMU) and a streamlined, security-hardened VMM (crosvm) best suited for
KVM-first workloads.

Patches follow.

Keerthivasan Raghavan (2):
  crosvm: add recipe for ChromeOS Virtual Machine Monitor (VMM)
  crosvm-image-minimal: add a reference image for crosvm demo

 recipes-extended/crosvm/crosvm-crates.inc     | 966 ++++++++++++++++++
 recipes-extended/crosvm/crosvm_0.1.0.bb       |  62 ++
 recipes-extended/images/README-crosvm.md      |  68 ++
 .../images/crosvm-image-minimal.bb            |  82 ++
 4 files changed, 1178 insertions(+)
 create mode 100644 recipes-extended/crosvm/crosvm-crates.inc
 create mode 100644 recipes-extended/crosvm/crosvm_0.1.0.bb
 create mode 100644 recipes-extended/images/README-crosvm.md
 create mode 100644 recipes-extended/images/crosvm-image-minimal.bb

-- 
2.34.1



^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-06-20  3:42 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-13  6:07 [PATCH v2 0/2] Add crosvm recipe to meta-virtualization Keerthivasan Raghavan
2026-06-13  6:07 ` [PATCH v2 1/2] crosvm: add recipe for ChromeOS Virtual Machine Monitor (VMM) Keerthivasan Raghavan
2026-06-20  3:42   ` Bruce Ashfield
2026-06-13  6:07 ` [PATCH v2 2/2] crosvm-image-minimal: add a reference image for crosvm demo Keerthivasan Raghavan
2026-06-20  3:42   ` Bruce Ashfield
2026-06-20  3:42 ` [PATCH v2 0/2] Add crosvm recipe to meta-virtualization Bruce Ashfield

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.