Repin OpenVMM to microVM v2.2

[Pedro Henrique Penna (ppenna)]

Repin OpenVMM to microVM v2.2

This PR pins the openvmm submodule to d0bdbed8f6e3b86271277dc22658109e2e633b2d, the head of the new nanvix/openvmm microvm/v2.2 branch. A second commit stops the Linux VMM-test runs from selecting the nested tests that the new pin brings in (see CI).

• Previous pin: 5ab8a8462, nanvix/openvmm main. microvm/v2.1 was fast-forwarded from 2130f24b5 to this commit (12 commits), so it now records the complete v2.1 line.
• New pin: d0bdbed8f, which is 5ab8a8462's 320-commit microVM stack rebased onto microsoft/openvmm main at 790132851 (75 upstream commits after v2.1's base e1cdbd916). The branch has 312 linear commits, and every one carries a good signature.
• OpenVMM review PR: none. microvm/v2.2 was pushed directly, and nanvix/openvmm upstream/main was not changed.
• Head submitted to CI: 3c0bbc15e5320329da654617e15d93795d914346, two commits on dev e67a06f40.

Equivalence

git range-diff e1cdbd916..5ab8a8462 790132851..d0bdbed8f reports 262 unchanged commits, 50 changed commits, and 8 dropped commits. No commit was added or reordered. Of the changed commits, 23 differ only in context lines. The tree differs from the previous pin by the upstream changes and the resolutions and adaptations below, so this is a behavioral promotion, not a tree-identical one.

Dropped commits:

• Already upstream with identical patches: virt_mshv: describe SNP guest workarounds without ACI-specific names (virt_mshv: describe SNP guest workarounds generically openvmm#4580), virtio: make interrupt tests wait for queue completion (virtio: make interrupt tests wait for queue completion openvmm#4592), fuse: rate-limit guest-triggerable diagnostics (fuse: rate-limit guest-triggerable diagnostics openvmm#4581), virtio_console: rate-limit worker errors (virtio_console: rate-limit worker errors openvmm#4614), and openvmm_entry: accept delay:<ms>:<disk> disk wrappers (openvmm_entry: accept delay:<ms>:<disk> disk wrappers openvmm#4610).
• Upstreamed with review changes: nextest: scope a longer budget to the exhaustive ring-buffer loom test (nextest: raise the loom test budget and apply it to the agent profile openvmm#4584) and pal: create files and directories with explicit security descriptors (pal: create files and directories with explicit security descriptors openvmm#4599). Keeping them would have left shadowed nextest overrides and a second copy of the two pal functions. Snapshot staging now calls upstream's create_file_with_security and create_directory_with_security, whose bodies are byte-identical to the fork's.
• Superseded: kvm: preserve pending external interrupts across VP-state capture. kvm: preserve PIC interrupts across VP state save and restore openvmm#4522 fixes the same lost-ExtINT-on-capture bug by injecting PIC interrupts through the KVM_SET_VCPU_EVENTS slot, and it rejects the user-mode vector tracking that this commit added. No later commit used the removed API.

Resolved conflicts:

• Time control (virt: control partition time at VM lifecycle boundaries openvmm#4524): MSHV and WHP partitions now start with time frozen, and the partition unit freezes time after VPs stop and thaws it before they run. The fork's finalize_memory, fallible state-unit start, snapshot module, MSHV time ABI field, and LAPIC re-assert keep their behavior around the new calls. MSHV no longer thaws time in run_vp.
• KVM ExtINT injection (kvm: preserve PIC interrupts across VP state save and restore openvmm#4522): the fork's cpu_contract, fingerprint, and time ABI code sit beside upstream's extint module, run_vp keeps upstream's interrupt-window bookkeeping before the time ABI sync, and both error variants are kept.
• net_tap LSO checksums (net_tap, gdma: fix checksums on LSO frames openvmm#3812): the fork moved and later rewrote the transmit path, so upstream's IPv6 UDP-segmentation length fixup and fixup_gso_pseudo_header call were ported into tx.rs, ahead of the egress-policy check.
• Configurable virtio-blk serial (virtio_blk: Make device serial configurable openvmm#4511): threaded through the fork's restructured worker loop, the sandbox block slots, and the ttrpc tests.
• IGVM personality (openvmm_entry: require igvm personality, add openhcl personality openvmm#4551): --machine microvm is checked before the new IgvmCli match, and the controller takes igvm_path from IgvmCli.firmware.
• Petri (petri: nested test support openvmm#4578): kept upstream's move of with_nested_virt and its nested-virt save/restore TODO beside the fork's port-based virtio-net save/restore predicate.
• Serial null backend (serial: add null backend openvmm#4572), test-name helpers, Cargo.lock dependency lists, and module lists were merged.
• ci: restrict privileged, self-hosted, and publishing jobs to microsoft/openvmm: upstream's vmm-perf job now targets ARM Windows too ([VMMPerf] Add support for ARM Windows openvmm#4568), and the pipelines were regenerated with cargo xflowey regen.

Adaptations, each folded into the commit that introduced the affected code so that intermediate commits build:

• virt: control partition time at VM lifecycle boundaries openvmm#4524 replaced the fallible MshvPartitionInner::freeze_time and thaw_time that the fork's TSC synchronization and time ABI code call. They are restored, and upstream's infallible PartitionTimeControl implementation delegates to them with the same panic messages.
• virt and virt_kvm depend on cpu_profile, which brings serde_json and its PartialEq<Value> implementations for integers into the dependency graph. Upstream comparisons of the form x == y.into() in openhcl_tdisp and the new KVM ExtINT tests became ambiguous, so their conversions are explicit.
• New upstream code that builds or destructures types the fork extends: the MANA vport ConsommeHandle (openhcl: support explicit VMBus offer ordering for MANA VFs openvmm#4507), petri's QEMU builder (petri: nested test support openvmm#4578, which now asserts the standard machine profile), the partition-unit tests (virt: control partition time at VM lifecycle boundaries openvmm#4524: fallible start, VP capacity, omit_saved_tsc), the IGVM CLI tests (openvmm_entry: require igvm personality, add openhcl personality openvmm#4551: default MicrovmRestore), and DiskCli.serial and a virtio-blk test helper (virtio_blk: Make device serial configurable openvmm#4511).
• Two automatic merges produced duplicate [dev-dependencies] tables (serial_socket, vmm_core); each is merged in the commit that produced it.
• Upstream's new Patina nightly pipeline (flowey: Introduce nightly pipeline for UEFI with Patina DXE core openvmm#4527) runs self-hosted 1ES jobs on a schedule. It now uses the fork gate like the CI pipeline, so it runs only in microsoft/openvmm.

Wire compatibility

Every vmservice.proto field that the previous pin defines keeps its number, and no message reuses a tag. Upstream adds SerialBackend.file, VirtioBlk.serial, VirtioVsock.guest_cid, and SnpIsolationConfig, and it reshapes IsolationConfig from an enum to a oneof. NVX does not use IsolationConfig.

Validation

Bare metal

At this head, three bare-metal hosts with Intel Xeon Silver 4114 (Skylake-SP) CPUs ran CI's test steps from isolated checkouts: Linux/KVM (Ubuntu, kernel 7.0), Linux/MSHV (Azure Linux 3.0, kernel 6.6), and Windows Server 2025/WHP. The microVM steps were generated from run-nvx-microvm-tests.yml with CI's shells and inputs. Each host also ran the debug-kernel restore scenarios, which CI runs for MSHV and WHP only on pushes to dev. The guest images are CI's exact-head guest-artifacts and guest-debug-kernel. The MSHV and WHP hosts built OpenVMM from the pin. The KVM host's microVM tests used CI's exact-pin openvmm-linux-gnu build, whose SHA-256 matches its provenance, and its test-openvmm compiled from source.

Check	Linux/KVM	Linux/MSHV	Windows/WHP
doctor H1 to H4: CPU profile intel.skylake-sp.v1 and time ABI preflight	pass	pass	pass
test-microvm, every scenario	41 pass	41 pass	41 pass
test-microvm --debug-kernel	8 pass	8 pass	8 pass
Managed sandbox acceptance, Ubuntu smoke, and Azure Linux smoke	pass	pass	pass
Ubuntu extended (KVM only)	pass	n/a	n/a
Ubuntu sandbox layer and share tests	6 pass	6 pass	5 pass
aci_edge_sandboxes lifecycle	pass	pass	pass
test-openvmm	58 of 58	57 of 57	29 of 29
test-openvmm-unit	not run; CI runs it on MSHV and WHP	5294 of 5294 tests, 391 doc-test binaries	4933 of 4933 tests, 391 doc-test binaries

• The Linux validate-nvx steps pass on the KVM host: 1181 tests.
• Every warp probe stayed within the time ABI's 1 µs cross-vCPU bound. KVM and MSHV saw no backward TSC step. WHP saw backward steps of up to 23 ns. An A/B on the same WHP host shows that this predates the pin: three alternating runs each of smp, smp-snapshot, and restore-processors gave maximum backward steps of 17, 17, and 21 ns at the previous pin and 21, 23, and 10 ns at this pin, with maximum offsets of 66 to 68 ns for both.
• No OpenVMM process outlived a test.

Build and unit checks

These checks ran on a Windows x86-64 workstation and in WSL2 Ubuntu with Rust 1.95.0.

Check	Linux	Windows
cargo check --workspace --all-targets --locked, every commit	304 of 312 pass	304 of 312 pass
cargo clippy --workspace --all-targets --locked -- -D warnings, head	pass	pass
test-openvmm-unit suite, head	5294 of 5294 tests, 391 doc-test binaries	4932 of 4933 tests, 391 doc-test binaries

• The eight failing commits, from virt: build the time ABI effective CPUID in one place to virt_mshv, virt_whp: name test host fixtures by CPU, don't build the virt_support_x86emu tests on either platform. Their v2.1 counterparts have the same gap: virt starts depending on serde_json there, and the stack's own virt_support_x86emu: make the tests' vector and VTL comparisons explicit fixes it right after them. Those test lines are unchanged since e1cdbd916.
• On Windows, the eight commits from virt_whp: use the shared Hyper-V feature table warn about unused constants in virt_whp/src/profile_features.rs. That file and its users match v2.1 at those commits. No other commit warns on either platform.
• cargo metadata --locked passes at every commit, and cargo xtask fmt passes at the head.
• The Windows unit failure was an openvmm_helpers snapshot-publishing test. In each of two full runs under heavy load, one such test, a different one each time, failed because renaming a freshly written staging directory in %TEMP% returned ERROR_ACCESS_DENIED. openvmm_helpers passed 10 of 10 runs alone, both at this pin and at the previous pin, and its code differs from the previous pin only by calling upstream's byte-identical pal functions. One net_consomme loopback test failed once with WSAEACCES under the same load and passes alone. On the bare-metal WHP host, all 4933 tests pass.
• NVX verify and the Windows validate-nvx steps pass at the pin commit. One host-loopback script test exceeded its 10-second budget while the per-commit builds ran, and it passes alone.

CI

On the pin commit alone, run 39103565708 passed every job except the KVM and MSHV OpenVMM vmm-tests jobs, with the WHP VMM and microVM jobs still running when the fix was pushed. microsoft/openvmm#4578 adds nested VMM tests whose names contain openvmm, which the Linux filter selects. Nine of them need an aarch64-unknown-linux-musl test archive, which the runners can't build, so flowey failed while it defined the pipeline. The tenth needs nested virtualization.

Exclude OpenVMM's nested VMM tests from the Linux runs adds !test(vm_host) to both Linux filters, because every nested test name contains its L1 host's vm_host* test function. Listing the vmm_tests binary at the pin on Linux shows the fix removes exactly those 10 tests and nothing else (KVM: 68 to 58, MSHV: 67 to 57). ruff, pyright for both platforms, and test_nvx_tools pass.

At this head, run 39130146896 passed every job: the OpenVMM builds, unit tests, and VMM tests on all three backends, the NVX microVM tests (including the KVM debug kernel), the KVM, MSHV, and WHP platform benchmarks, and the performance regression gate.

[Copilot]

🔵 Needs a closer look

The behavioral hypervisor rebase needs human review and completed KVM, MSHV, and WHP runtime and benchmark validation.

No open issues 🎉

What changed in this PR

Promotes NVX’s OpenVMM dependency to microVM v2.2, incorporating an upstream rebase and compatibility adaptations.

Changes:

• Updates only the openvmm gitlink from 5ab8a8462 to d0bdbed8f.
• Introduces behavioral changes affecting time control, interrupts, networking, and device configuration.

File	Description

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The reviewed filter and regression-test changes have no identified blocking defects.

1 open issue

• Document CI coverage changes and Linux runner limitations · New

_{Review effort: Balanced}