Re: [PATCH v5 0/2] Add crosvm recipe to meta-virtualization

[Bruce Ashfield <bruce.ashfield@gmail.com>]

Hi Keerthivasan,

Quick caveat before the per-patch reviews land: I see from the list
traffic that you sent a v1 series, but I can't find it in my inbox.
So my comments on 1/2 and 2/2 (sent separately as replies under
those messages) are based on v5. If anything I raise has already
been addressed in v1, please just say so and I'll move on from
those specific items.

Bruce

On Thu, May 28, 2026 at 00:40 +0530, Keerthivasan Raghavan wrote:
> This patch series introduces support for crosvm, the ChromeOS Virtual
> Machine Monitor, into the meta-virtualization layer. The goal is to
> provide a modern, security-oriented alternative to QEMU for
> virtualization workloads.
> 
> QEMU continues to be the industry-standard VMM, offering extensive device
> models, multi-architecture emulation, and a highly flexible subsystem
> architecture. However, QEMU's strength and breadth contributes to a
> large and complex monolithic codebase. As documented in QEMU's own
> security guidance, the system architecture places numerous components
> within a single process. This increases the trusted computing base and
> expands the range of possible exploit surfaces. Maintaining device models
> and legacy emulation paths further adds to complexity and potential
> vulnerability exposure.
> 
> crosvm approaches virtualization from a different perspective. Its design
> principles center on minimalism, isolation, and security. Instead of
> supporting full-system emulation, crosvm relies exclusively on KVM for
> hardware-assisted virtualization. It is implemented in Rust, enabling
> strong memory safety guarantees and eliminating many classes of bugs that
> commonly arise in large C codebases.
> 
> A key architectural distinction is crosvm's process separation model.
> Each device backend is offloaded into its own tightly sandboxed process
> using seccomp filters and Linux namespaces. This “process-per-device”
> layout shrinks the trusted computing base and prevents a compromise in one
> device model from affecting the rest of the system. These isolation
> boundaries align closely with secure-by-design principles and provide a
> more predictable attack surface.
> 
> For embedded, edge, and containerized environments—where minimalism,
> stability, and strict isolation are essential—crosvm offers a compelling
> VMM alternative. By integrating crosvm into meta-virtualization, we allow
> Yocto users to choose between a feature-rich, broad-emulation platform
> (QEMU) and a streamlined, security-hardened VMM (crosvm) best suited for
> KVM-first workloads.
> 
> Patches follow.
> 
> Keerthivasan Raghavan (2):
>   crosvm: add recipe for ChromeOS Virtual Machine Monitor (VMM)
>   crosvm-image-minimal: add a reference image for crosvm demo
> 
>  recipes-devtools/crosvm/crosvm-crates.inc     | 966 ++++++++++++++++++
>  recipes-devtools/crosvm/crosvm_0.1.0.bb       |  57 ++
>  recipes-extended/images/README-crosvm.md      |  68 ++
>  .../images/crosvm-image-minimal.bb            |  68 ++
>  4 files changed, 1159 insertions(+)
>  create mode 100644 recipes-devtools/crosvm/crosvm-crates.inc
>  create mode 100644 recipes-devtools/crosvm/crosvm_0.1.0.bb
>  create mode 100644 recipes-extended/images/README-crosvm.md
>  create mode 100644 recipes-extended/images/crosvm-image-minimal.bb
>