[Pedro Henrique Penna (ppenna)]

Keeps a failed snapshot publication from leaving a restorable snapshot beside a source that resumes, for microsoft/nvx#1153. When the final rename of a microVM capture failed and so did the removal of its staging directory, OpenVMM resumed the source unless it had tried to link the source's live RAM into that directory. The staging directory of an independent memory copy, which a capture with supplied RAM backing publishes, holds a complete snapshot once its manifest is written, though, so the source resumed beside a snapshot that restore could open, and restoring it would start a second copy of the VM.

One commit on d6addf8c1, the head of feature/microvm/dev. microsoft/nvx#1415 pins this head.

Don't resume beside a restorable staged snapshot (ed8fc0713)

• Cause. StagingDirectory::rollback in openvmm_helpers::snapshot::publish returned SnapshotWriteError::CleanupUncertain, which makes the microVM controller terminate the source, only when the staging directory may hold an alias to live RAM, which it assumes from the moment that it tries to link the source's RAM. Otherwise it only warned that removing the staging directory failed and returned BeforeCommit, which the controller treats as rollback-safe, so it resumed the quiesced source whatever the staging directory still held.
• Change.
  • Restore cannot open a snapshot directory without manifest.bin, so cleanup removes the staged manifest first, proves it absent, and on Unix flushes the staging directory, before it removes the rest of the directory.
  • The staging directory records that it may hold a manifest from just before the manifest is written, as it records a live RAM alias from just before it tries to link the source's RAM. A failed cleanup returns BeforeCommit, with a warning, only when neither may remain, and otherwise CleanupUncertain with the staging path, so that the controller terminates the source.
  • CleanupUncertain's message and the controller's log speak of staging cleanup, not only of an automatic RAM alias.
• Alternatives. Returning CleanupUncertain for every failed cleanup of an independent copy would keep the guarantee too, but would stop the VM when nothing that restore can open remains: when the removal fails only after the manifest is gone, or when staging failed before it wrote the manifest, as when the filesystem turns read-only during the copy.
• Compatibility. The snapshot format is unchanged. Successful publications, and failed ones whose cleanup succeeds, behave as before.
• Tests. uncertain_cleanup_of_complete_independent_staging_is_not_rollback_safe stages a complete independent copy that restore can open, fails the final rename on a non-empty destination, injects a failed cleanup, and requires CleanupUncertain with the staging path; it fails at adb7c8bc8 on Windows and Linux. independent_staging_without_its_manifest_is_rollback_safe stops the removal after the manifest and requires that restore cannot open what remains and that rollback is safe, and uncertain_cleanup_of_staging_that_never_held_a_manifest_is_rollback_safe requires that a staging directory that never held a manifest still resumes the source.
• Guide. The snapshot guide's warning and the snapshot format's memory section say when a failed publication resumes the source.

Validation

With Rust 1.97.1, at this head:

• Linux (Azure Linux 3.0): cargo clippy --all-targets -- -D warnings, cargo doc --no-deps with -D warnings, and cargo nextest run --profile agent for openvmm_helpers and openvmm_entry: 437 passed. openvmm_helpers for x86_64-unknown-linux-musl: 126 passed, so the new tests' failed rename does not depend on renameat2.
• Windows: the same, 405 passed, and cargo xtask fmt --fix, clean.
• NVX's scratch-snapshot, snapshot-core, snapshot-rollback, and snapshot-tiers scenarios pass on KVM, MSHV, and WHP with OpenVMM built at this head, as do console-snapshot, sandbox-lifecycle, and smp-snapshot on KVM; openvmm: don't resume beside a restorable staged snapshot nvx#1415 reports them.

At 985336151, the same commit on adb7c8bc8 (an identical range-diff), on Linux: a cleanup that a read-only staging directory refuses for real, rather than by injection, returns CleanupUncertain, where adb7c8bc8 returned BeforeCommit while read_snapshot still opened the manifest, state, and memory that it left; and a removal refused only below a nested read-only directory, after the manifest's removal, returns BeforeCommit beside artifacts that restore cannot open.

Notes

• Land it by fast-forwarding feature/microvm/dev to this head, ed8fc0713b4c6301d3b82ffe88817e70084d84b8, since this repository's merge button squashes and would leave NVX's pin off the branch.

[github-actions]

1 Petri tests failed (0 unstable)