We're hiring!
*

Quick hack: Experiments with crosvm

Tomeu Vizoso avatar

Tomeu Vizoso
November 09, 2017

Share this post:

Last week I played a bit with crosvm, a KVM monitor used within Chromium OS for application isolation. My goal is to learn more about the current limits of virtualization for isolating applications in mainline. Two of crosvm's defining characteristics is that it's written in Rust for increased security, and that uses namespaces extensively to reduce the attack surface of the monitor itself.

It was quite easy to get it running outside Chromium OS (have been testing with Fedora 26), with the only complication being that minijail isn't widely packaged in distros. In the instructions below we hack around the issue with linker environment variables so we don't have to install it properly. Instructions are in form of shell commands for illustrative purposes only.

Build kernel:

    $ cd ~/src
    $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    $ cd linux
    $ git checkout v4.12
    $ make x86_64_defconfig
    $ make bzImage
    $ cd .. 

Build minijail:

    $ git clone https://android.googlesource.com/platform/external/minijail
    $ cd minijail
    $ make
    $ cd .. 

Build crosvm:

    $ git clone https://chromium.googlesource.com/a/chromiumos/platform/crosvm
    $ cd crosvm
    $ LIBRARY_PATH=~/src/minijail cargo build 

Generate rootfs:

    $ cd ~/src/crosvm
    $ dd if=/dev/zero of=rootfs.ext4 bs=1K count=1M
    $ mkfs.ext4 rootfs.ext4
    $ mkdir rootfs/
    $ sudo mount rootfs.ext4 rootfs/
    $ debootstrap testing rootfs/
    $ sudo umount rootfs/

Run crosvm:

    $ LD_LIBRARY_PATH=~/src/minijail ./target/debug/crosvm run -r rootfs.ext4 --seccomp-policy-dir=./seccomp/x86_64/ ~/src/linux/arch/x86/boot/compressed/vmlinux.bin

The work ahead includes figuring out the best way for Wayland clients in the guest interact with the compositor in the host, and also for guests to make efficient use of the GPU.

 

Original post

Comments (3)

  1. Jun Sun:
    Sep 27, 2019 at 09:55 PM

    When I tried to build crosvm, I got the following error. Any ideas?

    Caused by:
    failed to load source for a dependency on `audio_streams`

    Reply to this comment

    Reply to this comment

      1. Tomeu Vizoso:
        Mar 05, 2021 at 05:39 AM

        Changes in Crosvm have introduced new dependencies. I would recommend nowadays to base on this Dockerfile when building Crosvm: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/Docker/Dockerfile.

        More instructions here: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/README.md

        Reply to this comment

        Reply to this comment


Add a Comment






Allowed tags: <b><i><br>Add a new comment:


Search the newsroom

Latest Blog Posts

Adding VP9 and MPEG2 stateless support in v4l2codecs for GStreamer

23/06/2021

Earlier this year, from January to April 2021, I worked on adding support for stateless decoders for GStreamer as part of a multimedia internship…

Bag of Freebies for XR Hand Tracking: Machine Learning & OpenXR

17/06/2021

In our previous post, we presented a project backed by INVEST-AI which introduces a multi-stage neural network-based solution. Now let's…

Testing cameras with lc-compliance on KernelCI

15/06/2021

Initiated as a joint effort by the Google Chrome OS team and Collabora, the recent KernelCI hackfest brought the addition of new tests including…

Zink: Summer 2021 update

14/06/2021

There's a lot that has happened in the world of Zink since my last update, so let's see if I can bring you up to date on the most important…

Open Source OpenGL ES 3.1 on Mali GPUs with Panfrost

11/06/2021

Panfrost, the open source driver for Arm Mali, now supports OpenGL ES 3.1 on both Midgard (Mali T760 and newer) and Bifrost (Mali G31, G52,…

Optimizing 3D performance with virglrenderer

17/05/2021

Collabora has been investing into Perfetto to enable driver authors & users to get deep insights into driver internals and GPU performance.…

Open Since 2005 logo

We use cookies on this website to ensure that you get the best experience. By continuing to use this website you are consenting to the use of these cookies. To find out more please follow this link.

Collabora Ltd © 2005-2021. All rights reserved. Privacy Notice. Sitemap.

Collabora Limited is registered in England and Wales. Company Registration number: 5513718. Registered office: The Platinum Building, St John's Innovation Park, Cambridge, CB4 0DS, United Kingdom. VAT number: 874 1630 19.