OpenVMM prerequisite: fixed NIC with pre-vCPU mutable policy on platform restore #536

Activity

1. Pedro Henrique Penna (ppenna)

   added the

   Feature

   issue type on Oct 20, 2026
2. ppenna commented on Oct 23, 2026

   

   Pedro Henrique Penna (ppenna)

   on Oct 23, 2026

   Contributor

   More actions

   Folding in #799, which asked for the same change and is now closed as a duplicate of this issue. These are its code-level notes, with corrections from review. OpenVMM links use 79a501b6, the revision that NVX's dev pins, and NVX links use dev at 2df68ba9.

   Gates that refuse a new policy today. None of them depends on the tier.

   1. Option validation refuses --network-ingress allow, --host-loopback allow, and --host-loopback-forward with --snapshot-destination or --restore-snapshot (cli_args/microvm.rs#L731-L739, #L1225-L1229, #L1239-L1247). It runs with the saved machine contract at hand, but not the tier, which only the manifest records. validate_early_options also refuses explicit host loopback right after argument parsing, before the snapshot is opened (lib.rs#L2754).
   2. validate_microvm_network_policy requires the saved policy mode, digest, and active flag.
   3. validate_restore_contract builds the expected contract from the restore-time policy, and the comparison checks the whole network record (microvm.rs#L1626-L1629).

   Already in place. The endpoint isn't snapshot state: Consomme has no save or restore code. The device installs the restore-time policy when it's built (virtio_net/src/lib.rs#L618), and the endpoint binds every explicit forward when it's resolved (resolver.rs#L67-L109). Both happen before any vCPU runs, so a busy forward port already fails the restore. Whether the endpoint consumes listener announcements follows the policy (egress.rs#L893-L908).

   Eligibility from the digest. #799 proposed deciding eligibility from saved state alone, without a manifest change: rebuild the canonical complete deny-all policy (host loopback denied, no proxy, no ingress) for the saved identity, compare its digest with the saved one, and require the platform tier. The explicit template mode of this issue is the alternative. With the digest:

   • Require encoding version 3 or later. Versions 0 to 2 encode neither the host-loopback action nor the proxy endpoint, and under version 1, deny-all with and without a proxy hash the same.
   • Plain --network-egress deny leaves host loopback allowed, so its digest isn't a complete deny-all's, although the policy drops every guest frame either way (egress.rs#L1253-L1258). As this issue notes, nvx::host::network attaches no NIC for a deny-all policy that denies host loopback, and when host loopback is left to OpenVMM, it attaches one with plain --network-egress deny (mod.rs#L660-L683). The digest rule alone would therefore admit no template that NVX launches today.
   • Check the restore-time policy against the saved identity, not the saved encoding version. Ingress and explicit host loopback need encoding version 5, which a version 3 or 4 snapshot can't represent (canonical_bytes_for_version).

   Not enough on its own.

   • The guest reads virtnet_dns= and virtnet_ingress= only at boot (init#L175-L276), and the post-restore repair does no network work (nvx-snapshot#L295-L411). A deny-all capture records no virtnet_dns= (microvm.rs#L3480-L3492), and a platform command line can't carry virtnet_ingress= (#L2315-L2350). DNS, proxy settings, and listener announcements after restore need the activation record that doc: describe the managed layered root and platform-clone activation #591 describes.
   • Capture and restore are mutually exclusive (cli_args/microvm.rs#L295-L297), so a restored clone can't be recaptured with its new policy.
   • The ttrpc restore refuses snapshots that have a NIC (ttrpc/microvm.rs#L491-L494).
   • Restore-time validation of the new policy should match a cold boot's, including microVM: reject explicit host-loopback access on a /30 IPv4 network #553 (host loopback on a /30 network) and microVM: keep guests from reaching loopback-TCP console listeners through host loopback #551 (console listeners that host loopback exposes).
   • OpenVMM documents the current rules in its CLI reference (cli.md#L168-L170, #L216-L217, #L233-L234, #L239-L240) and in the help of --network-ingress and --host-loopback. Its snapshot guide doesn't cover network policy.

   Snapshots without a tier have the same rule, and neither this issue nor #543 covers them. #800 tracks them, together with an nvx run bug that keeps it from restoring any snapshot that has a NIC.
3. Pedro Henrique Penna (ppenna)

   marked microvm: A platform snapshot can only be restored with the network policy it was captured with #799 as a duplicate of this issue on Oct 23, 2026
4. Pedro Henrique Penna (ppenna)

   self-assigned this

   on Oct 23, 2026
5. Enrique Saurez (esaurez)

   added a parent issue on Oct 24, 2026

   • Snapshot/restore workstream, stage 2: the OpenVMM changes #835
6. esaurez commented on Oct 24, 2026

   

   Enrique Saurez (esaurez)

   on Oct 24, 2026

   ContributorAuthor

   More actions

   This issue is now a child of #835, the OpenVMM stage of platform clones (#833), and #850 brings it into the shared libraries. Its body predates the current design, and its parent, #535, is closed. Could it be aligned with #835's description? In short:

   • a NIC template captures a complete deny-all, and each clone's restore installs that clone's own policy before any vCPU runs;
   • clones without network come from templates without a NIC, so a no-network restore needs no NIC;
   • DNS, the proxy endpoint and listener announcements reach the guest through the activation record (nvx-rs: a canonical activation record and configuration identity for platform clones #838) after the restore, as the comment of 2026-10-23 notes;
   • no image slots or aggregates are involved; several exports per clone (microvm: at a platform restore, attach an aggregate export to the dormant filesystem slot #540) are later work.
7. Enrique Saurez (esaurez)

   marked this as blocking on Oct 24, 2026

   • nvx-rs: per-clone network policies on deny-all templates #850