Repository navigation
microVM: reconcile the 64-KiB command-line limit with the guest kernel's limit #570
Description
Summary
Section 5.1.2 of the architecture guide in doc/design/ limits the complete NUL-terminated kernel command line to 64 KiB, and OpenVMM enforces exactly that limit. The NVX guest kernel parses less: x86 Linux's COMMAND_LINE_SIZE is 2,048 bytes, as scripts/nvx_tools/sandbox.py also assumes, and neither kernel/config-microvm nor kernel/patches/ changes it. The VMM cannot read the kernel's limit from the uncompressed ELF image either.
OpenVMM can therefore accept a command line between 2 KiB and 64 KiB that the guest kernel truncates, and it reports no error. The machine profile appends its own tokens last (device discovery, nvx_control_tty=hvc2, and the network and host filesystem bootstrap tokens), so they are the first to be lost. This contradicts the rule that invalid configurations are rejected, never silently adjusted (section 1.4.1).
This is a gap in the architecture guide rather than an implementation deviation. Found while auditing the implementation against the guide.
Where it applies
- OpenVMM, at the gitlink nanvix/openvmm@c6d97c5:
MICROVM_COMMAND_LINE_MAX_SIZEis 64 KiB, checked in the profile (for example at L1453-L1456) and in the Linux direct loader. - The NVX launchers guard themselves.
nvx.py sandboxreserves 1,024 of the kernel's 2,048 bytes for OpenVMM (sandbox.pyL22-L26), andnvx-rslimits caller tokens to 1,024 bytes (COMMAND_LINE_BUDGET). Callers of OpenVMM itself have no such guard.
Options
- State the guest kernel's limit in section 5.1.2, and have OpenVMM reject an effective command line that exceeds it.
- Raise the guest kernel's command-line size with a kernel patch, so that the 64-KiB contract holds end to end.
Tasks
- Choose an option and update section 5.1.2 of the architecture guide.
- Implement it in nanvix/openvmm, and promote the pin, or in
kernel/patches/. - Add a boot test with a command line near the limit that checks that the last machine-profile token reaches the guest.
- If the guest kernel's limit rises above 4 KiB, make the managed agent read
/proc/cmdlineto its end within the new limit. The C agent and its Rust port in Port the managed agent to Rust #531 (mappings::prepare) read at most 4,095 bytes, so the agent would miss a laternvx_maps=token and refuseMAPS(#531 review).
Activity
esaurez commentedon Oct 20, 2026
#622 (A4) delivers this: OpenVMM rejects a kernel command line over 2,048 bytes, including the terminating NUL, which matches the guest kernel. #591 replaces the 64 KiB statement in section 5.1.2. Tracked under #535.
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
openvmm: refuse kernel command lines that the guest kernel would trun…
esaurez commentedon Oct 23, 2026
The VMM part landed in #661: OpenVMM refuses an effective command line over 2,047 bytes. Once #591 merges with the Section 5.1.2 update, this can close.
doc: state the guest kernel's 2,048-byte command-line limit
ppenna commentedon Oct 29, 2026
All four tasks are done on
dev:COMMAND_LINE_SIZEin section 5.1.2.bd2b27a2e, refuses before boot an effective command line over 2,047 bytes, both on a cold boot and on a restore.command-line-limitmicroVM scenario, in the defaulttest-microvmset./proc/cmdlineto its end above 4 KiBI re-ran the scenario at
dev8f3a840f6on three test VMs; the later270820dcdadds only performance baselines. nvx-rs was built at that commit, and the OpenVMM and guest artifacts came from releasev0.1.0-dev.17fb8404d575, which has the same OpenVMM pin, kernel, and guest init. I also passednvx-rs runa plain--cmdlineover the limit. That path has no launcher budget, so OpenVMM's check is the only guard.command-line-limitnvx-rs runover the limitnvx-kvm-testnvx-mshv-testnvx-whp-testOn every host:
/proc/cmdlineheld exactly 2,047 bytes, ending with the machine profile's last token,virtnet_gw6=fd00::a00:1.microVM kernel command line is 2048 bytes; the limit is 2047 bytes plus the terminating NUL.