From 70adf891841bf65947caba48c98b75b8d49387bb Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Thu, 29 Oct 2026 23:04:28 -0700 Subject: [PATCH 1/2] openvmm: map VM times beyond the host clock to its latest time Pin microsoft/openvmm#4820 at 5e0ab772eeea14f4d0f5ed05474856569358f80e, two commits on bcfc47cff, the previous pin, which is the head of feature/microvm/dev. OpenVMM's VM time keeper maps a VM time to the host time at which VM time reaches it, to arm its host timer and for VmTimeAccess::host_time, from the time's circular distance after the last start. A timeout more than about 584 years ahead, beyond what the host clock's 64 bits of nanoseconds can represent, overflowed that host time and panicked the task that armed it: a timeout armed across a restore to a VM time that it follows by 2.66e18 units panicked the keeper's task at start(). A timeout nearly half the ring, about 29,000 years, ahead of now, which VM time's circular order puts before the start once VM time has run, mapped to the start's host time, in the past, so the keeper's host timer fired and was re-armed forever, with the timer state's lock held. The first commit saturates the host time at the host clock's latest time, a deadline that every timer backend accepts and never reaches. The second maps a time that the circular order puts before the start, but after now, to that latest time too. Each adds tests that fail without it. The protocol vectors and built-in CPU profiles that nvx-rs copies are unchanged. Fixes #1038 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- openvmm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvmm b/openvmm index bcfc47cff..5e0ab772e 160000 --- a/openvmm +++ b/openvmm @@ -1 +1 @@ -Subproject commit bcfc47cff6606afadffef97551e538962895b598 +Subproject commit 5e0ab772eeea14f4d0f5ed05474856569358f80e From 6d3442d14e529a18b47e679ff81e47ac29c07af8 Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Thu, 29 Oct 2026 23:07:18 -0700 Subject: [PATCH 2/2] doc: map the VM time fixes in the OpenVMM roadmap Record the two commits that the previous commit pins as positions 368 and 369 of the microVM chain, and move the NVX pin to 5e0ab772e. Positions 368 and 369 make OpenVMM's VM time keeper map a timeout beyond what the host clock can represent to the host clock's latest time: one more than about 584 years after the last start no longer panics the task that arms it, and one nearly half the ring after now, which VM time's circular order puts before the start, no longer arms the host timer in the past. They change only vmcore's vmtime.rs, which upstream main and the fork base have alike, and apply to upstream main as they are; say so in the table's remarks. The pin is now 212 commits past the mapped tip. Position 367, bcfc47cff, is the head of feature/microvm/dev since microsoft/openvmm#4818 merged positions 366 and 367. Say so in the scope, and name microsoft/openvmm#4820 as the proposal of positions 368 and 369. Refs #1038 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/openvmm-upstream-roadmap.md | 37 +++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/doc/openvmm-upstream-roadmap.md b/doc/openvmm-upstream-roadmap.md index b4b9ea266..9df7c77ce 100644 --- a/doc/openvmm-upstream-roadmap.md +++ b/doc/openvmm-upstream-roadmap.md @@ -9,14 +9,15 @@ - Mapped fork tip: `a0556d7d85ce1fff89f5b45a98f15c5c79cbb6fb`, position 157. The graph, PR summary, and commit mapping below cover positions 001-157 and the fixups at positions 334-340, 344, and 345. -- NVX's pinned OpenVMM revision: `bcfc47cff6606afadffef97551e538962895b598`, position 367. - Positions 366 and 367, which microsoft/openvmm#4818 proposes for `feature/microvm/dev`, are two - commits on position 365, `e4c741e18`, the head of `feature/microvm/dev` since - microsoft/openvmm#4804 merged positions 362-365. Those are four commits on position 361, - `c32c57d12`, which microsoft/openvmm#4807 merged with position 360. Positions 360 and 361 are - two commits on position 359, `bd2b27a2e`, which microsoft/openvmm#4794 merged with positions - 355-358. Positions 355-359 are five commits on position 354, `832d5bb48`, which - microsoft/openvmm#4775 merged with position 353. Positions 353 and 354 are two commits on +- NVX's pinned OpenVMM revision: `5e0ab772eeea14f4d0f5ed05474856569358f80e`, position 369. + Positions 368 and 369, which microsoft/openvmm#4820 proposes for `feature/microvm/dev`, are two + commits on position 367, `bcfc47cff`, the head of `feature/microvm/dev` since + microsoft/openvmm#4818 merged positions 366 and 367. Those are two commits on position 365, + `e4c741e18`, which microsoft/openvmm#4804 merged with positions 362-364. Positions 362-365 are + four commits on position 361, `c32c57d12`, which microsoft/openvmm#4807 merged with position 360. + Positions 360 and 361 are two commits on position 359, `bd2b27a2e`, which microsoft/openvmm#4794 + merged with positions 355-358. Positions 355-359 are five commits on position 354, `832d5bb48`, + which microsoft/openvmm#4775 merged with position 353. Positions 353 and 354 are two commits on position 352, `b92daa350`, which microsoft/openvmm#4773 merged with positions 350 and 351. Positions 350-352 are three commits on position 349, `d2338ea22`, which microsoft/openvmm#4769 merged with position 348. Positions 348 and 349 are two commits on position 347, `57d0a18b3`, @@ -25,10 +26,10 @@ and 345 are two commits on position 343, `a12d9167f`, which microsoft/openvmm#4749 merged with positions 341 and 342. Positions 341-343 are three commits on position 340, `2b681564d`, which microsoft/openvmm#4735 merged with position 339. Positions 339 and 340 are two commits on - position 338, `8a0d945ed`, which microsoft/openvmm#4734 merged, and position 338 is one commit - on `79a501b63`, the head of the `feature/microvm/release/v2.3` branch of microsoft/openvmm. The - pin is 210 commits past the mapped tip on the same first-parent chain. Positions 158-333, - 341-343, and 346-367 are not yet assigned to PRs; see + position 338, `8a0d945ed`, which microsoft/openvmm#4734 merged, and position 338 is one commit on + `79a501b63`, the head of the `feature/microvm/release/v2.3` branch of microsoft/openvmm. The pin + is 212 commits past the mapped tip on the same first-parent chain. Positions 158-333, 341-343, + and 346-369 are not yet assigned to PRs; see [Commits after the mapped tip](#commits-after-the-mapped-tip). - Upstream main: `22c0485be597f87a76771e1db03eaa823a685ffc` (2026-10-22), the fork base. @@ -319,8 +320,8 @@ The physical branch is one first-parent chain: -> PR14 fixup [336] -> PR09 fixup [337] -> PR02 fixup [338] -> PR20 fixup [339] -> PR23 fixup [340] -> unassigned [341-343] -> PR18 fixups [344-345] - -> unassigned [346-367] - -> bcfc47cff (NVX pin) + -> unassigned [346-369] + -> 5e0ab772e (NVX pin) ``` For upstream review, PR01-PR08 and PR14 can be rebased independently onto current upstream main, @@ -342,8 +343,8 @@ PR18's position 111. ## Commits after the mapped tip -The NVX pin extends the chain past position 157 without merges. Of the 210 later commits, -positions 158-333, 341-343, and 346-367 are not yet classified or assigned to PRs, positions +The NVX pin extends the chain past position 157 without merges. Of the 212 later commits, +positions 158-333, 341-343, and 346-369 are not yet classified or assigned to PRs, positions 334-337 are the fixups of the `feature/microvm/release/v2.3` rebase, position 338 is a PR02 fixup, positions 339 and 340 are PR20 and PR23 fixups, and positions 344 and 345 are PR18 fixups. @@ -399,6 +400,7 @@ This table groups them by topic in chain order; ranges are inclusive, as in the | 360-361 | `c9ac93a63..c32c57d12` | 2 | CPU profile validation checks the CPU time bits, so a snapshot's host profile document must fix them too, and the catalog verifies each pinned profile once per process, before a partition uses it: its static data must form a valid profile whose canonical encoding is the encoding that snapshots embed, while the tests keep checking its digest (microsoft/openvmm#4807) | | 362-365 | `69ddc715b..e4c741e18` | 4 | The microVM's `E_CPU_SURFACE` errors name every CPUID difference rather than the first 16, each entry of a snapshot's effective CPUID record on one line with the registers in which it differs, and VP 0's non-zero CPUID entries outside the profile's tables together with the results that VP 0 does not observe; and the VM worker runs every CPU check of a partition, the comparison with the snapshot's record, the check of VP 0's CPUID, and the check that the backend supports the profile, even after one fails, and reports their failures together (microsoft/openvmm#4804) | | 366-367 | `e51ab72d3..bcfc47cff` | 2 | The restore's comparison of the effective CPUID with a snapshot's record names every difference of a record that the decoder admits although no OpenVMM writes it, each entry that the record lists more than once, each of its listings that differs, and a record out of order, together with the entries that differ; and its tests check each register, value, and mask that the error names (microsoft/openvmm#4818) | +| 368-369 | `342887c99..5e0ab772e` | 2 | The VM time keeper maps a timeout beyond what the host clock can represent to the host clock's latest time: one more than about 584 years after the last start no longer panics the task that arms it, as one armed across a restore to a far VM time panicked the keeper's task at start (microsoft/nvx#1038), and one nearly half the ring after now, which VM time's circular order puts before the start, no longer arms the host timer in the past, which made the keeper spin (microsoft/openvmm#4820) | Some of these commits change mapped work rather than add to it. Positions 246-250 remove the legacy microVM clock paths and change files that PR10 and PR17 also change. Position 252 makes @@ -420,6 +422,9 @@ snapshot guide, so they build on that fork-only code. Positions 362-365 change o checks of the VM worker's time ABI, which positions 159-269 also add, and the snapshot guide's description of them. Positions 366 and 367 change only the first of those checks, the comparison with a snapshot's record, its tests, and the snapshot guide's description of it. +Positions 368 and 369 change only the VM time keeper of `vmcore`, whose `vmtime.rs` upstream main +and the fork base have alike. Positions 043 and 301 change other parts of that file, and positions +368 and 369 apply to upstream main as they are, so they can go upstream on their own. ## PR summary