Repository navigation
openvmm: pin the snapshot VM clock cut - #491
Merged
Pedro Henrique Penna (ppenna) merged 1 commit intoOct 12, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
UTC clock steps during capture can produce an incorrect Q and substantial guest clock divergence.
1 open finding
What changed in this PR
Pins OpenVMM’s snapshot clock-cut fix and aligns NVX’s time ABI documentation.
Changes:
- Records and applies VM-time cut-to-anchor interval
Q. - Documents restore semantics and compatibility.
- Updates the OpenVMM upstream roadmap.
| File | Description |
|---|---|
openvmm |
Advances the submodule to the clock-cut fix. |
doc/design/time-abi.md |
Specifies Q, validation, capture, and restore behavior. |
doc/design/snapshot-and-restore.md |
Updates the restore sequence. |
doc/openvmm-upstream-roadmap.md |
Records the new pin and commits. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/bump-openvmm-submodule-and-rebase
branch
from
October 11, 2026 18:37
f3b78e3 to
274f4f0
Compare
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/bump-openvmm-submodule-and-rebase
branch
from
October 11, 2026 19:02
274f4f0 to
b168e9d
Compare
10 tasks
d43dd87d5 (nanvix/openvmm#128, rebased onto main at 70dde4c65) keeps VM time and the RTC in step with the guest TSC across a microVM snapshot. Capture quiesces the state units, which stops VM time and the RTC, before it takes the time ABI capture anchor, while the guest TSC keeps running. Restore advanced VM time and the RTC by the anchor-to-restore downtime D alone, so they resumed behind the TSC by the interval from that cut to the anchor. VM time's keeper now reads the host monotonic clock that the capture anchor samples at the instant VM time stops and saves the reading with VM time's state, and capture records the interval Q from that cut to the anchor's host monotonic time in the time contract's new optional field 12, vm_time_cut_to_anchor_ns, so that a host wall-clock step cannot enter it. Restore advances VM time and the RTC by D + Q, while the TSC, the LAPIC timers, and the restore packet keep D, and it rejects a recorded Q or a D + Q above 30 days with E_DOWNTIME_EXCESSIVE. Recording Q is best effort: capture logs a warning and omits it when the saved stop sample is missing or Q would be negative or above 30 days, and a snapshot without it, including every earlier one, restores with Q = 0 and a warning. Manifests stay at version 6. The time ABI specification follows: its notation defines Q, and Downtime semantics, capture step 4, the SnapshotTimeContract table, restore steps 2, 5, and 15, E_DOWNTIME_EXCESSIVE, and the Guide appendix describe it. Snapshot and restore's restore sequence advances VM time, the RTC, and the PIT by the downtime plus Q. The upstream roadmap records the new pin, retains the partition halt-state fix at position 309, extends the branch DAG to position 311, and indexes the clock-cut commits at positions 310 and 311. The original reviewed head b435a486b was rebased and amended after review of this pin: Q uses the host monotonic clock rather than UTC, and the primary keeper reads it where it computes the stop time rather than around the asynchronous stop. This preserves the fixes for host wall-clock steps and scheduling delays, including the regression test. Rebase the validated source head 6d6e9c1e8 onto the latest OpenVMM main 70dde4c65 without conflicts. Both commits match in git range-diff and the complete diffs against their bases share stable patch ID 8b563430cc7079186a2019aac1c321ccc5ff8ea2. The new pin retains nanvix/openvmm#129's partition halt-state fix, now part of both default branches, and fast-forwards the current NVX pin by exactly two commits. Rebase this single NVX commit onto dev at d206d61, preserving the upstream changes and resolving the gitlink and roadmap conflicts with the combined revision. On the rebased source, cargo check, clippy, rustdoc, all 500 unit tests, and xtask fmt pass for the five clock-cut packages and vmm_core. NVX verification and the affected CLI, snapshot, and timing tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/bump-openvmm-submodule-and-rebase
branch
from
October 12, 2026 19:46
b168e9d to
29395bd
Compare
Pedro Henrique Penna (ppenna)
deleted the
agents/bump-openvmm-submodule-and-rebase
branch
October 12, 2026 21:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin
openvmmtod43dd87d5b9c27109c71100accb5b2790416acb4, from nanvix/openvmm#128 rebased onto the latest OpenVMMmain(70dde4c65), and update the NVX time ABI specification and upstream roadmap.NVX head:
29395bdf45672a311f1fb4580677f526bd9607cf, one signed commit directly ondevatd206d618ffc5f84fd7852c8b730bafe29acca3ab.The primary VM time keeper records the host monotonic clock at the VM-time cut. Capture stores the cut-to-anchor interval
Qin optionalSnapshotTimeContractfield 12,vm_time_cut_to_anchor_ns. Restore advances VM time and the RTC byD + Q; the TSC, LAPIC timers, and restore packet retain the anchor-to-restore downtimeD. The combined duration remains bounded by 30 days. Capture warns and omits unavailable cut metadata; snapshots without it retain the previous anchor-only behavior with a warning. Manifest version 6 is unchanged.Rebase and provenance
fix/snapshot-clock-cut6d6e9c1e860519f339a0d21f62aaae058f2ee0a9on2130f24b570dde4c65b16de084744b0fa85aeb581f0b5c6cd9b2073dedandd43dd87d5d43dd87d5b9c27109c71100accb5b2790416acb4d206d618ffc5f84fd7852c8b730bafe29acca3abThe OpenVMM rebase applied without conflicts.
git range-diff 2130f24b5..6d6e9c1e8 70dde4c65..d43dd87d5reports both commits as=. The complete diffs against their respective bases share stable patch ID8b563430cc7079186a2019aac1c321ccc5ff8ea2. This proves patch equivalence to the previously validated source head, not tree identity, because the base includes an additional commit.The original reviewed head
b435a486bwas previously rebased and amended after review of this NVX PR: the cut uses host monotonic time instead of UTC, and the primary keeper samples at the stop rather than around an asynchronous round trip. The regression test for a host wall-clock step is preserved unchanged by this rebase. The final pin is not claimed to be equivalent to that original, pre-fix head.nanvix/openvmm#129 is now merged into
main, and NVX already pins its halt-state fix through #492. This rebase retains it; it is no longer excluded. The gitlink fast-forwards the current NVX pin by exactly the two clock-cut commits, with no new prerequisite PRs.Scope
openvmm:70dde4c65..d43dd87d5.doc/design/time-abi.mdanddoc/design/snapshot-and-restore.md: preserve the clock-cut specification updates.doc/openvmm-upstream-roadmap.md: retain the upstream halt-state entry at position 309 and record the clock-cut commits at positions 310-311; the pin is now 145 commits past the mapped tip.The NVX rebase resolves the gitlink and roadmap conflicts with the combined source revision and preserves all other upstream changes. No implementation files, guest inputs, or performance baselines are changed by this PR.
Validation after this rebase
python scripts\nvx.py verify: passed on the final NVX head.cargo check,cargo clippy --all-targets,cargo doc --no-deps, andcargo nextest run --profile agentpassed on exact source headd43dd87d5, foropenvmm_core,openvmm_defs,openvmm_entry,openvmm_helpers,vmcore, andvmm_core: 500/500 tests passed. The existingcryptobackend build-script warning remains; no gate failed.cargo xtask fmt --fix: passed and left the source clean.41422f08d; the subsequent rebase absorbed onlydev's baseline CSV update. An exact diff confirmed the tested code, documentation, guest, kernel, and submodule inputs are unchanged in the final head.No fresh local VM boot or remote bare-metal suite was run for this rebase. The previous local and KVM/MSHV/WHP bare-metal evidence covers
b168e9d76with source6d6e9c1e8, and is historical rather than an exact-head claim for this combined revision.Previous exact-head CI: successful run 38166311023 on
b168e9d76. These prior results do not substitute for the rebased head's checks.Current exact-head CI: successful run 38299887059 on
29395bdf4. The full matrix passed, including the OpenVMM unit and VMM suites, KVM/MSHV/WHP microVM and platform jobs, KVM debug-kernel tests, performance gate, and required status check. Release publication and performance-history persistence remain skipped for this pull request, as intended.NVX head submitted to CI:
29395bdf45672a311f1fb4580677f526bd9607cf.