Repository navigation
host: add a peer-verified restore-ready listener - #1297
Draft
Enrique Saurez (esaurez) wants to merge 2 commits into
Draft
Enrique Saurez (esaurez) wants to merge 2 commits into
Enrique Saurez (esaurez) wants to merge 2 commits into
Conversation
Parse only the complete OpenVMM readiness event. Reuse the clone endpoint mechanics for private restore listeners, verify the held process during receives, and transfer native listeners without reopening them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e19737a6-412b-4652-b67e-b37837521925
Require a held-process liveness check after native peer PID matching. Keep temporary unused-code expectations active in unsupported-platform test builds, where the listener tests do not compile. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e19737a6-412b-4652-b67e-b37837521925
Enrique Saurez (esaurez)
added
the
tests-modified
Contributor
This pull request changes existing testsIt modifies or removes 2 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
Test policy
Relocated unchanged: 0; added: 26. Compared the merge base |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A critical Linux authentication flaw allows an exited client's queued event to be accepted if its PID is recycled for the VM, requiring stable peer identification and a stale-peer regression test.
1 open issue
What changed in this PR
Adds a reusable restore-ready listener and exact event parser as part of the caller-owned VM lifecycle work in #1099. Construction and blocking receive remain internal; native listener transfer supports caller-managed I/O.
Changes:
- Add exact decoding of
OPENVMM_RESTORE_READY_V1\n. - Add owner-only endpoints, process checks, and native listener ownership transfer.
- Add protocol and listener tests, documentation, and public API entries.
| File | Description |
|---|---|
scripts/test-layout-allowlist.json |
Update temporary test-hook allowances. |
nvx-rs/src/protocol/restore_ready/tests.rs |
Test exact event bytes and malformed inputs. |
nvx-rs/src/protocol/restore_ready.rs |
Add the restore-ready event parser. |
nvx-rs/src/protocol/mod.rs |
Export the parser module. |
nvx-rs/src/host/vm.rs |
Remove the fulfilled endpoint dead-code allowance. |
nvx-rs/src/host/restore/tests.rs |
Test process checks, endpoint privacy, and native transfer. |
nvx-rs/src/host/restore.rs |
Add the process-checked listener wrapper. |
nvx-rs/src/host/platform/windows/endpoint.rs |
Extract reusable pipe binding and add handle transfer. |
nvx-rs/src/host/platform/linux/endpoint.rs |
Add native Unix listener transfer. |
nvx-rs/src/host/mod.rs |
Export and document the restore module. |
nvx-rs/README.md |
Document parser and listener contracts. |
nvx-rs/public-api/windows.txt |
Record the new Windows public API entries. |
nvx-rs/public-api/linux.txt |
Record the new Linux public API entries. |
Review effort: Balanced
Comment on lines
+100
to
+103
| let open = self | ||
| .listener | ||
| .receive(process.reference().pid, received, limit, timeout) | ||
| .map_err(listener_error)?; |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1099
Stacked on #1280.
Adds an exact byte decoder for
OPENVMM_RESTORE_READY_V1\nand a reusablerestore-ready listener. Linux and Windows endpoints are owner-only; receives
verify the peer against the held VM process, check liveness before and after
I/O, and reject changes to the expected identity.
into_stdtransfers theexisting native listener without reopening it. Construction and blocking
receive remain crate-private; no restore sequencing or async framework is added.
Six counted files were approved for this PR, as #1076 allows where a split would
be harder to follow. The platform edits only expose existing endpoint mechanics
for reuse; existing clone behavior and tests are retained. The adjusted size is
168 core lines in six production files; the raw scan is 170 lines in seven
files, including two excluded lines of test-policy metadata.
Existing tests and wiring
nvx-rs/src/host/vm.rs: remove the fulfilled dead-code test hook fromrestore_ready_endpointnow that the listener uses it, and tighten itsallowlist count.
scripts/test-layout-allowlist.json: allow the new restore module's threenecessary future-call hooks for its crate-private bind, endpoint, and receive
methods. Tests stay in their own module files; no assertions are relaxed.
New tests cover exact event bytes, real correct/rogue/exited child processes,
immutable expected identity, owner-only permissions, and native transfer after
an empty receive.
Validation
Local qualification uses the clean merge of this head with
devat256ebe3d, without rebasing the stacked branch. Complete required Rust and CLIchecks passed on Windows and Linux, together with both API snapshots, Linux
quality checks, and freshly rebuilt native guests. The complete Python suite ran
1,810 tests on each OS. WHP and MSHV each passed all five public sandbox/snapshot
scenarios and all 156 canonical adapter scenarios across 11 targets, with
consumed artifact hashes unchanged.