From 7f15ed6f15822f2dfb2e1949db7f7e36df0ed052 Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Thu, 29 Oct 2026 11:15:17 -0700 Subject: [PATCH 1/2] openvmm: verify pinned CPU profiles at partition creation Pin microsoft/openvmm#4807 at c32c57d129a36fc8c82308d6659f8d7ab5955474, two commits on bd2b27a2e, the previous pin, which is the head of feature/microvm/dev since microsoft/openvmm#4794 merged. At partition creation, for cold boot and restore, step 1 of the CPU profile verification in section 2.2.1.3 of the architecture guide requires the VMM to verify that the CPU profile is valid, including its canonical encoding, density, ownership masks, and CPU time bits. OpenVMM did so for host profiles, but built each pinned profile from the constants of pinned_data.rs on first use without validating or encoding it, so a stale or malformed pinned_data.rs reached partition creation unchecked; only the catalog's tests would have caught it. Its profile validation did not check the CPU time bits either, so the host profile document that a snapshot carries did not have to fix them on KVM and MSHV, whose preflights, unlike WHP's, do not check the time bits that the backend presents. The first commit adds the CPU time bits of section 3.2.3 to profile validation, naming every bit that violates them, so that decoding a host profile document that violates them, and so restoring its snapshot, fails with E_PROFILE_DIGEST. The second verifies each pinned profile once per process, on its first use: its built-in values must form a valid profile, CPU time bits included, whose canonical encoding is the built-in encoding that snapshots embed. A defective profile fails the cold boot or restore that selects it with E_PROFILE_DIGEST, before the partition exists. The verification encodes the profile but does not hash it: its digest stays a constant that OpenVMM's tests check against the golden digests. It adds about 40 to 55 us to the first profile use of each OpenVMM process, which NVX's single-process OpenVMM makes once per cold boot or restore, on current hosts, and 40 to 180 us on Skylake-SP hosts. The protocol vectors and built-in CPU profiles that nvx-rs copies are unchanged. Refs #567 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- openvmm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvmm b/openvmm index bd2b27a2e..c32c57d12 160000 --- a/openvmm +++ b/openvmm @@ -1 +1 @@ -Subproject commit bd2b27a2ef9339bd16692c93facb8d84952dc9f8 +Subproject commit c32c57d129a36fc8c82308d6659f8d7ab5955474 From 5be4850e868386244ab1a6b1317308554ce0d5d9 Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Thu, 29 Oct 2026 11:16:19 -0700 Subject: [PATCH 2/2] doc: map the pinned CPU profile verification in the OpenVMM roadmap Record the two commits that the previous commit pins as positions 360 and 361 of the microVM chain, and move the NVX pin to c32c57d12. Positions 360 and 361 verify CPU profiles as the architecture guide's partition-creation checks require: profile validation checks the CPU time bits, so a snapshot's host profile document must fix them too, and the catalog verifies each pinned profile once per process, before a partition uses it, while the tests keep checking the golden digests. They change only cpu_profile, the fork's CPU profile crate that positions 159-269 add, a test helper of virt_mshv, and the snapshot guide, so they build on that fork-only code; say so in the table's remarks. The pin is now 204 commits past the mapped tip. Positions 355-359 are no longer only a proposal: microsoft/openvmm#4794 merged them, so position 359, bd2b27a2e, is the head of feature/microvm/dev. Say so in the scope, and name microsoft/openvmm#4807 as the proposal of positions 360 and 361. Refs #567 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/openvmm-upstream-roadmap.md | 48 ++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/doc/openvmm-upstream-roadmap.md b/doc/openvmm-upstream-roadmap.md index 4d1b670ec..2afc782fe 100644 --- a/doc/openvmm-upstream-roadmap.md +++ b/doc/openvmm-upstream-roadmap.md @@ -9,23 +9,24 @@ - Mapped fork tip: `a0556d7d85ce1fff89f5b45a98f15c5c79cbb6fb`, position 157. The graph, PR summary, and commit mapping below cover positions 001-157 and the fixups at positions 334-340, 344, and 345. -- NVX's pinned OpenVMM revision: `bd2b27a2ef9339bd16692c93facb8d84952dc9f8`, position 359. - Positions 355-359, which microsoft/openvmm#4794 proposes for `feature/microvm/dev`, are - five commits on position 354, `832d5bb48`, the head of `feature/microvm/dev` since - microsoft/openvmm#4775 merged positions 353 and 354. Those are two commits on position 352, - `b92daa350`, which microsoft/openvmm#4773 merged with positions 350 and 351. Positions - 350-352 are three commits on position 349, `d2338ea22`, which microsoft/openvmm#4769 merged - with position 348. Positions 348 and 349 are two commits on position 347, `57d0a18b3`, which - microsoft/openvmm#4767 merged with position 346. Positions 346 and 347 are two commits on - position 345, `e68871cc6`, which microsoft/openvmm#4762 merged with position 344. Positions - 344 and 345 are two commits on position 343, `a12d9167f`, which microsoft/openvmm#4749 - merged with positions 341 and 342. Positions 341-343 are three commits on position 340, - `2b681564d`, which microsoft/openvmm#4735 merged with position 339. Positions 339 and 340 are - two commits on position 338, `8a0d945ed`, which microsoft/openvmm#4734 merged, and position - 338 is one commit on `79a501b63`, the head of the `feature/microvm/release/v2.3` branch of - microsoft/openvmm. The pin is 202 commits past the mapped tip on the same first-parent chain. - Positions 158-333, 341-343, and 346-359 are not yet assigned to PRs; see - [Commits after the mapped tip](#commits-after-the-mapped-tip). +- NVX's pinned OpenVMM revision: `c32c57d129a36fc8c82308d6659f8d7ab5955474`, position 361. + Positions 360 and 361, which microsoft/openvmm#4807 proposes for `feature/microvm/dev`, are + two commits on position 359, `bd2b27a2e`, the head of `feature/microvm/dev` since + microsoft/openvmm#4794 merged positions 355-359. Those are five commits on position 354, + `832d5bb48`, which microsoft/openvmm#4775 merged with position 353. Positions 353 and 354 + are two commits on position 352, `b92daa350`, which microsoft/openvmm#4773 merged with + positions 350 and 351. Positions 350-352 are three commits on position 349, `d2338ea22`, + which microsoft/openvmm#4769 merged with position 348. Positions 348 and 349 are two commits + on position 347, `57d0a18b3`, which microsoft/openvmm#4767 merged with position 346. + Positions 346 and 347 are two commits on position 345, `e68871cc6`, which + microsoft/openvmm#4762 merged with position 344. Positions 344 and 345 are two commits on + position 343, `a12d9167f`, which microsoft/openvmm#4749 merged with positions 341 and 342. + Positions 341-343 are three commits on position 340, `2b681564d`, which microsoft/openvmm#4735 + merged with position 339. Positions 339 and 340 are two commits on position 338, `8a0d945ed`, + which microsoft/openvmm#4734 merged, and position 338 is one commit on `79a501b63`, the head + of the `feature/microvm/release/v2.3` branch of microsoft/openvmm. The pin is 204 commits + past the mapped tip on the same first-parent chain. Positions 158-333, 341-343, and 346-361 + are not yet assigned to PRs; see [Commits after the mapped tip](#commits-after-the-mapped-tip). - Upstream main: `22c0485be597f87a76771e1db03eaa823a685ffc` (2026-10-22), the fork base. ## Upstream status @@ -315,8 +316,8 @@ The physical branch is one first-parent chain: -> PR14 fixup [336] -> PR09 fixup [337] -> PR02 fixup [338] -> PR20 fixup [339] -> PR23 fixup [340] -> unassigned [341-343] -> PR18 fixups [344-345] - -> unassigned [346-359] - -> bd2b27a2e (NVX pin) + -> unassigned [346-361] + -> c32c57d12 (NVX pin) ``` For upstream review, PR01-PR08 and PR14 can be rebased independently onto current upstream main, @@ -338,8 +339,8 @@ PR18's position 111. ## Commits after the mapped tip -The NVX pin extends the chain past position 157 without merges. Of the 202 later commits, -positions 158-333, 341-343, and 346-359 are not yet classified or assigned to PRs, positions +The NVX pin extends the chain past position 157 without merges. Of the 204 later commits, +positions 158-333, 341-343, and 346-361 are not yet classified or assigned to PRs, positions 334-337 are the fixups of the `feature/microvm/release/v2.3` rebase, position 338 is a PR02 fixup, positions 339 and 340 are PR20 and PR23 fixups, and positions 344 and 345 are PR18 fixups. @@ -392,6 +393,7 @@ This table groups them by topic in chain order; ranges are inclusive, as in the | 353 | `057a2eaa6` | 1 | Test that the microVM virtio-fs device takes a dormant slot's state into the device of an aggregate of a directory and a file, which then saves the aggregate | | 354 | `832d5bb48` | 1 | A platform restore may bind an aggregate, `--mount-aggregate` with its children, policy paths, and owner mode, to the filesystem slot that the snapshot left dormant, validated as at a cold boot, while the slot's device and the captured command line stay as captured; other tiers keep binding only a `--mount` (microsoft/openvmm#4775) | | 355-359 | `2607a7d55..bd2b27a2e` | 5 | microVM virtio devices reach only the RAM ranges of the e820 map: guest memory views that admit only a set of ranges, a virtio queue that refuses a descriptor unless its memory admits the whole buffer, an MMIO transport that restricts device DMA and marks a device that addresses other memory as needing reset, and the loader's e820 RAM ranges, to which every microVM device is restricted (microsoft/openvmm#4794) | +| 360-361 | `c9ac93a63..c32c57d12` | 2 | CPU profile validation checks the CPU time bits, so a snapshot's host profile document must fix them too, and the catalog verifies each pinned profile once per process, before a partition uses it: its static data must form a valid profile whose canonical encoding is the encoding that snapshots embed, while the tests keep checking its digest (microsoft/openvmm#4807) | Some of these commits change mapped work rather than add to it. Positions 246-250 remove the legacy microVM clock paths and change files that PR10 and PR17 also change. Position 252 makes @@ -407,7 +409,9 @@ have alike and no other commit of the chain changes, so they can go upstream on Position 355 likewise changes only `guestmem`, which no other commit of the chain changes, so it can go upstream on its own, and position 356 adds only the virtio queue's check on top of it. Positions 357-359 build on the fork's virtio-mmio shared interrupt-status transport, MP-table -loader, and microVM worker. +loader, and microVM worker. Positions 360 and 361 change only `cpu_profile`, the fork's CPU +profile crate that positions 159-269 add, one of its test helpers in `virt_mshv`, and the +snapshot guide, so they build on that fork-only code. ## PR summary