[PATCH v3 0/2] Add crosvm recipe to meta-virtualization

This patch series introduces support for crosvm, the ChromeOS Virtual
Machine Monitor, into the meta-virtualization layer. The goal is to
provide a modern, security-oriented alternative to QEMU for
virtualization workloads.

QEMU continues to be the industry-standard VMM, offering extensive device
models, multi-architecture emulation, and a highly flexible subsystem
architecture. However, QEMU's strength and breadth contributes to a
large and complex monolithic codebase. As documented in QEMU's own
security guidance, the system architecture places numerous components
within a single process. This increases the trusted computing base and
expands the range of possible exploit surfaces. Maintaining device models
and legacy emulation paths further adds to complexity and potential
vulnerability exposure.

crosvm approaches virtualization from a different perspective. Its design
principles center on minimalism, isolation, and security. Instead of
supporting full-system emulation, crosvm relies exclusively on KVM for
hardware-assisted virtualization. It is implemented in Rust, enabling
strong memory safety guarantees and eliminating many classes of bugs that
commonly arise in large C codebases.

A key architectural distinction is crosvm's process separation model.
Each device backend is offloaded into its own tightly sandboxed process
using seccomp filters and Linux namespaces. This =E2=80=9Cprocess-per-dev=
ice=E2=80=9D
layout shrinks the trusted computing base and prevents a compromise in on=
e
device model from affecting the rest of the system. These isolation
boundaries align closely with secure-by-design principles and provide a
more predictable attack surface.

For embedded, edge, and containerized environments=E2=80=94where minimali=
sm,
stability, and strict isolation are essential=E2=80=94crosvm offers a com=
pelling
VMM alternative. By integrating crosvm into meta-virtualization, we allow
Yocto users to choose between a feature-rich, broad-emulation platform
(QEMU) and a streamlined, security-hardened VMM (crosvm) best suited for
KVM-first workloads.

Patches follow.

Keerthivasan Raghavan (2):
  crosvm: add recipe for ChromeOS Virtual Machine Monitor (VMM)
  crosvm-image-minimal: add a reference image for crosvm demo

 recipes-extended/crosvm/crosvm-crates.inc     | 966 ++++++++++++++++++
 recipes-extended/crosvm/crosvm_0.1.0.bb       |  61 ++
 recipes-extended/images/README-crosvm.md      |  68 ++
 .../images/crosvm-image-minimal.bb            |  80 ++
 4 files changed, 1175 insertions(+)
 create mode 100644 recipes-extended/crosvm/crosvm-crates.inc
 create mode 100644 recipes-extended/crosvm/crosvm_0.1.0.bb
 create mode 100644 recipes-extended/images/README-crosvm.md
 create mode 100644 recipes-extended/images/crosvm-image-minimal.bb

--=20
2.34.1