nvx-rs: boot templates with an adapter's kernel tuning parameters

doc/openvmm-upstream-roadmap.md

@@ -8,10 +8,11 @@
   reorganization kept it there; see [Upstream status](#upstream-status).
 - Mapped fork tip: `7677ad8d56a59864475012b63b6f01a22575c30d`, position 131. The graph, PR
   summary, and commit mapping below cover positions 001-131.
-- NVX's pinned OpenVMM revision: `f41a1ecfc13379e501cf78e2a96585426f16c87e`, position 234, the
-  head of microsoft/openvmm#4997, whose commit follows position 233, `d501e5066`, the head of
-  `feature/microvm/dev`, which microsoft/openvmm#4996 merged after position 232, `6cb6ba87c`,
-  which microsoft/openvmm#4995 merged after position 231, `98e5b3ca5`, which
+- NVX's pinned OpenVMM revision: `b4028c1aa775d8aafba1a170857acc032c7c86a1`, position 235, the
+  head of microsoft/openvmm#5001, whose commit follows position 234, `f41a1ecfc`, the head of
+  `feature/microvm/dev`, which microsoft/openvmm#4997 merged after position 233, `d501e5066`,
+  which microsoft/openvmm#4996 merged after position 232, `6cb6ba87c`, which
+  microsoft/openvmm#4995 merged after position 231, `98e5b3ca5`, which
   microsoft/openvmm#4994 merged with position 230 after position 229, `ed8fc0713`, which
   microsoft/openvmm#4993 merged after position 228, `d6addf8c1`, which
   microsoft/openvmm#4992 merged after position 227, `154548a0e`, which
@@ -27,8 +28,8 @@
   position 221 into positions 035 and 036, and combined v5.1 positions 222 and 223, the two commits
   of microsoft/openvmm#4984, into position 220. Positions 001-147 keep their positions, v5.1
   positions 149-220 are positions 148-219, and the tree of position 220 is the tree of
-  `3f2ab4c2f`; see [The v6.0 reorganization](#the-v60-reorganization). The pin is 103 commits past
-  the mapped tip on the same first-parent chain. Positions 132-234 are not yet assigned to PRs; see
+  `3f2ab4c2f`; see [The v6.0 reorganization](#the-v60-reorganization). The pin is 104 commits past
+  the mapped tip on the same first-parent chain. Positions 132-235 are not yet assigned to PRs; see
   [Commits after the mapped tip](#commits-after-the-mapped-tip).
 - Upstream main: `ba105dd7f00499acc1862456c179c0930cb2c8f7` (2026-11-06), the fork base itself;
   see [Upstream main past the fork base](#upstream-main-past-the-fork-base).
@@ -990,7 +991,8 @@ ba105dd7f
   -> unknown paired-scratch restore mode refused [232]
   -> clone's activation record carried in the restore packet [233]
   -> no-replace snapshot publication on every target [234]
-  -> f41a1ecfc (NVX pin)
+  -> kernel tuning admitted on platform command lines [235]
+  -> b4028c1aa (NVX pin)
 ```
 
 For upstream review, PR01-PR06 and PR14 can be rebased independently onto current upstream main,
@@ -1006,13 +1008,13 @@ reorganization folded the PR20 and PR12 fixups into the commits that they fix; s
 
 ## Commits after the mapped tip
 
-The NVX pin extends the chain past position 131 without merges. None of the 103 later commits is a
+The NVX pin extends the chain past position 131 without merges. None of the 104 later commits is a
 fixup of a mapped PR, and none is yet classified or assigned to PRs. Each of positions 132-186
 combines the v2.4 commits that the table lists, as v3.0 positions 145-160 and 162-200 did, which
 developed one concept; "(part)" marks a v2.4 fixup that split across commits. Positions 187-191
 followed the v3.0 reorganization, positions 192-205 are the ABI restart of the v4.0
 reorganization, positions 206-211 followed it, positions 212-218 followed the v5.0
-reorganization, positions 219 and 220 followed the v5.1 rebase, and positions 221-234 followed the
+reorganization, positions 219 and 220 followed the v5.1 rebase, and positions 221-235 followed the
 v6.0 reorganization, so they combine none, apart from position 220, which combines v5.1 positions
 222 and 223. Each commit has the position that it
 had in v5.1 through position 147, and one less from v5.1 position 149 on; see
@@ -1124,6 +1126,7 @@ at `e1ca353eb`, whose first 210 commits are those of `feature/microvm/release/v4
 | 232 | `6cb6ba87c` | - | - | - | - | openvmm_helpers: refuse an unknown paired-scratch restore mode (microsoft/openvmm#4995) |
 | 233 | `d501e5066` | - | - | - | - | microvm: carry a clone's activation record in the restore packet (microsoft/openvmm#4996) |
 | 234 | `f41a1ecfc` | - | - | - | - | openvmm_helpers: don't publish a snapshot over an empty directory (microsoft/openvmm#4997) |
+| 235 | `b4028c1aa` | - | - | - | - | openvmm_helpers: admit kernel tuning on platform command lines (microsoft/openvmm#5001) |
 
 The remarks that say whether commits apply to upstream main record what the v3.0 reorganization
 found on its base, `b2676222b`, at the positions that the commits have now.
@@ -1242,6 +1245,12 @@ elsewhere: every target now renames through `pal`, which the commit gives a no-r
 Unix and on Windows, the latter on the extended-length encoding that position 219 moves into
 `pal`'s file system module. It also adds a test beside position 032's test of a destination
 created after staging, and extends the snapshot guide's sentence that PR17's position 076 adds.
+Position 235 changes the platform tier's check of a snapshot's command line, which PR19's position
+093 adds and PR20's position 097, PR23's position 116, and positions 147 and 168 change: the
+allowlist of the command line's tokens also admits a closed set of kernel tuning parameters, and
+the check refuses a command line that repeats one of them, after position 097's check of the
+boot-online processor count. It also extends the `--snapshot-tier` entry that position 093 adds to
+the CLI reference.
 Assigning the later commits therefore means revisiting those PRs, not only appending new ones.
 
 Position 177, by contrast, changes only `disk_blob`, which upstream main and the fork base
@@ -1471,6 +1480,16 @@ extended-length encoding of position 219 and that sentence; only the Unix rename
 manifest apply there. So it follows PR11 and PR17 upstream, and its Windows rename follows position
 219's `pal` change.
 
+Position 235 changes only the platform tier's check of the microVM snapshot module of
+`openvmm_helpers`, which PR17's position 074 adds, PR19's position 093 gives the platform tier, and
+PR20's position 097, PR23's position 116, and positions 147 and 168 change, and adds tests to that
+module, which use the paired-scratch manifest of PR19's position 092, the platform tier of position
+093, and the worker's platform command line of PR20's position 097. It also extends the
+`--snapshot-tier` entry that position 093 adds to the CLI reference of PR15's position 064.
+Replaying it on upstream main conflicts in both of its files: upstream main lacks the microVM
+snapshot module of position 074, the tiers of position 093, and the microVM CLI of position 064, so
+it follows PR15, PR17, and PR19 upstream.
+
 ## PR summary
 
 Each count is of v6.0 commits, which include the fixups that the v3.0, v4.0, v5.0, and v6.0

nvx-rs/README.md

@@ -679,9 +679,11 @@ policy, whatever the network's own, which each clone's restore replaces with the
 clone's; `TemplateResources`, with the processors, 1, 2, 4, or 8, and those
 online at boot, as many or fewer, and RAM and a `--memory-capacity` in blocks of
 `MEMORY_BLOCK_SIZE`; the kernel command line `nvx_sandbox=1`, with `maxcpus=`
-and the processors online at boot when they are fewer, so that the capture's
-whole command line holds tokens of OpenVMM's platform allowlist alone, and no
-tenant data, which the tests check with a copy of the allowlist's source; and
+and the processors online at boot when they are fewer, then the kernel tuning
+parameters of the template's class, which `TemplatePlan::with_kernel_tuning`
+sets, in their order, so that the capture's whole command line holds tokens of
+OpenVMM's platform allowlist alone, and no tenant data, which the tests check
+with a copy of the allowlist's source; and
 the capture's options, `--snapshot-tier platform`, a `--snapshot-destination`,
 `SNAPSHOT_NAME` in the transaction directory, and `--snapshot-generation-id`
 with the capture's bound-block `StorageGeneration`, which OpenVMM does not
@@ -701,11 +703,18 @@ those that make a manifest a template's.
 runtime, the guest's build, the backend, the requested CPU profile, the
 processors, those online at boot, and RAM, the geometries of the disks, the
 network, of which it takes what the template captures alone, its NIC at the
-guest's address under the complete deny-all policy, and the adapter's other
-`Invariants`.
+guest's address under the complete deny-all policy, the adapter's other
+`Invariants`, and the kernel tuning parameters with which the template's kernel
+boots, as the adapter's cold sandboxes do, so that its clones run their kernel
+configuration: those of `KERNEL_TUNING_PARAMETERS`, `mitigations=off`,
+`mitigations=auto`, or `mitigations=auto,nosmt`, `no_timer_check`, `quiet`,
+and `loglevel=0` to `loglevel=7`, each parameter at most once, which OpenVMM
+admits on a platform capture's command line, and which `CaptureClass::check`
+checks before any VM boots.
 
 `TemplateKey::new` checks that the capture made the machine that its class
-requested, and derives the template's compatibility key, from metadata alone:
+requested, the class's kernel tuning parameters on its kernel command line
+among it, and derives the template's compatibility key, from metadata alone:
 the runtime and contract versions through which its clones are restored, the
 backend, CPU profile and effective CPUID, topology, rates, resources, kernel
 command line, disks, and devices of its machine, with the NIC's addresses and
@@ -718,12 +727,17 @@ A key and a class each have one canonical, versioned encoding, whose
 domain-separated SHA-256 digest is its identity, a `KeyIdentity`, which converts
 to and from the `nvx::activation::Identity` by which a clone's activation record
 names its template's key, or a `ClassIdentity`; the
-[conformance vectors](tests/vectors/README.md) of version 1,
-`tests/vectors/template-key-v1.txt`, pin both encodings and identities. The
+[conformance vectors](tests/vectors/README.md) of version 1 of a key's,
+`tests/vectors/template-key-v1.txt`, and of version 2 of a class's,
+`tests/vectors/capture-class-v2.txt`, pin both encodings and identities. The
 key's encoding, version 1, leaves the network policy out, since templates
 capture their NIC under the complete deny-all policy, and has not been released,
 so a template store that an earlier build created is not supported: delete it
-and create a new one. There is no migration.
+and create a new one. There is no migration. A class's encoding, version 2,
+adds the kernel tuning parameters to version 1, so a creation finds no
+generation that a class of version 1 captured, and captures one again, while
+those generations still serve the clones that select them by their keys, which
+version 2 leaves as they were.
 
 `Store` keeps the generations of templates that a host published, apart from
 every sandbox's store, at a location that the adapter chooses: a private

nvx-rs/public-api/linux.txt

@@ -2681,6 +2681,7 @@ field nvx::host::template::CaptureClass::guest_build
 field nvx::host::template::CaptureClass::hypervisor
 method nvx::host::template::CaptureClass::identity
 field nvx::host::template::CaptureClass::invariants
+field nvx::host::template::CaptureClass::kernel_tuning
 field nvx::host::template::CaptureClass::memory
 field nvx::host::template::CaptureClass::memory_capacity
 field nvx::host::template::CaptureClass::network
@@ -2862,6 +2863,7 @@ method nvx::host::template::Invariants::iter
 method nvx::host::template::Invariants::len
 method nvx::host::template::Invariants::new
 method nvx::host::template::Invariants::with
+const nvx::host::template::KERNEL_TUNING_PARAMETERS
 const nvx::host::template::KEY_NAME
 struct nvx::host::template::KeyIdentity
 method nvx::host::template::KeyIdentity::as_bytes
@@ -3046,6 +3048,7 @@ method nvx::host::template::TemplatePlan::resources
 method nvx::host::template::TemplatePlan::scratch_length
 method nvx::host::template::TemplatePlan::scratch_path
 method nvx::host::template::TemplatePlan::transaction
+method nvx::host::template::TemplatePlan::with_kernel_tuning
 struct nvx::host::template::TemplateResources
 field nvx::host::template::TemplateResources::boot_processors
 field nvx::host::template::TemplateResources::memory

nvx-rs/public-api/windows.txt

@@ -1617,6 +1617,7 @@ field nvx::host::template::CaptureClass::guest_build
 field nvx::host::template::CaptureClass::hypervisor
 method nvx::host::template::CaptureClass::identity
 field nvx::host::template::CaptureClass::invariants
+field nvx::host::template::CaptureClass::kernel_tuning
 field nvx::host::template::CaptureClass::memory
 field nvx::host::template::CaptureClass::memory_capacity
 field nvx::host::template::CaptureClass::network
@@ -1798,6 +1799,7 @@ method nvx::host::template::Invariants::iter
 method nvx::host::template::Invariants::len
 method nvx::host::template::Invariants::new
 method nvx::host::template::Invariants::with
+const nvx::host::template::KERNEL_TUNING_PARAMETERS
 const nvx::host::template::KEY_NAME
 struct nvx::host::template::KeyIdentity
 method nvx::host::template::KeyIdentity::as_bytes
@@ -1982,6 +1984,7 @@ method nvx::host::template::TemplatePlan::resources
 method nvx::host::template::TemplatePlan::scratch_length
 method nvx::host::template::TemplatePlan::scratch_path
 method nvx::host::template::TemplatePlan::transaction
+method nvx::host::template::TemplatePlan::with_kernel_tuning
 struct nvx::host::template::TemplateResources
 field nvx::host::template::TemplateResources::boot_processors
 field nvx::host::template::TemplateResources::memory