nvx-rs: lower adapter plans into the plans of template captures

.gitattributes

@@ -20,6 +20,8 @@ scripts/setup/tool-versions.conf text eol=lf
 # of its commit only if they are checked out unchanged: check nvx-rs out with LF line endings on
 # every platform, whatever core.autocrlf says.
 nvx-rs/** text=auto eol=lf
+# OpenVMM wrote these template manifests: they are bytes, never text.
+nvx-rs/tests/fixtures/template/**/manifest.bin binary
 
 .github/workflows/*.lock.yml linguist-generated=true
 # Recorded from the Python code that nvx-rs replaced, by scripts/nvx_rs_fixtures.py

.github/workflows/ci.yml

@@ -160,9 +160,11 @@ jobs:
       - name: Validate NVX CLI
         uses: ./.github/actions/validate-nvx
 
-      # nvx-rs's protocol tests read copies of OpenVMM's control-session
-      # protocol vectors, because the nvx-rs job cannot check out OpenVMM.
-      # This job can, so it compares the copies with the submodule's files.
+      # nvx-rs's protocol and template tests read copies of OpenVMM's
+      # control-session protocol vectors and of the lines of its platform
+      # allowlist, because the nvx-rs job cannot check out OpenVMM. This job
+      # can, so it compares the copies with the submodule's files, and
+      # nvx::contract's versions of OpenVMM's contracts with OpenVMM's.
       - name: Compare OpenVMM's protocol vectors
         shell: bash
         run: >-

aci_edge_sandboxes/tests/openvmm_fake.rs

@@ -17,7 +17,9 @@ use std::time::{Duration, Instant};
 use aci_edge_sandboxes::nvx::ErrorCode as NvxCode;
 use aci_edge_sandboxes::nvx::Hypervisor;
 use aci_edge_sandboxes::nvx::host::platform;
-use aci_edge_sandboxes::nvx::host::store::{ArtifactIdentity, RuntimeIdentity, SandboxStore};
+use aci_edge_sandboxes::nvx::host::store::{
+    ArtifactIdentity, LaunchId, RuntimeIdentity, SandboxStore,
+};
 use aci_edge_sandboxes::nvx::host::supervisor::{self, Launched, VmmCommand};
 use aci_edge_sandboxes::nvx::protocol::CAPABILITY_LEN;
 use aci_edge_sandboxes::openvmm::OpenVmmConfig;
@@ -1181,7 +1183,11 @@ fn interrupted_starts_before_an_endpoint_recover_or_retain_the_child() {
         let store = SandboxStore::open(&dir).unwrap();
         let mut locked = store.lock(None).unwrap();
         let mut launch = locked
-            .begin_launch(&runtime_with('1'), &CAPABILITY)
+            .begin_launch(
+                &LaunchId::generate().unwrap(),
+                &runtime_with('1'),
+                &CAPABILITY,
+            )
             .unwrap();
         let listen = arguments
             .iter()
@@ -1254,7 +1260,11 @@ fn unrecorded_launches_end_once_their_log_is_released() {
     let store = SandboxStore::open(&dir).unwrap();
     let mut locked = store.lock(None).unwrap();
     let mut launch = locked
-        .begin_launch(&runtime_with('1'), &CAPABILITY)
+        .begin_launch(
+            &LaunchId::generate().unwrap(),
+            &runtime_with('1'),
+            &CAPABILITY,
+        )
         .unwrap();
     let log = launch.take_log().unwrap();
     drop(launch);

doc/ci.md

@@ -541,8 +541,11 @@ for the curl shim test and the `nvx-rs` build. Each job first builds the
 `nvx-rs` executable that `nvx.py` runs, tests with it, and hands it to the
 microVM test and platform jobs of its operating system, as described above.
 Each also runs the ignored `nvx-rs` test `tests/openvmm_vectors.rs`, which
-compares the submodule's control-session protocol vectors with the copies that
-the protocol tests read in the `nvx-rs` job, which cannot check out OpenVMM;
+compares the submodule's control-session protocol vectors, and the lines of its
+platform allowlist of kernel command-line tokens, with the copies that the
+protocol and template tests read in the `nvx-rs` job, which cannot check out
+OpenVMM, and the versions of OpenVMM's snapshot format, saved-state schema,
+time ABI, and restore packet with those of `nvx::contract`;
 see [OpenVMM's vectors](../nvx-rs/tests/vectors/README.md#openvmms-vectors).
 Fork pull requests lack the OpenVMM deploy key, so the CLI jobs run, like the
 hypervisor jobs, only for pushes, full runs, and same-repository pull requests.

doc/project-structure.md

@@ -103,6 +103,7 @@ nvx/
 |-- nvx-rs/                      Rust crate `nvx` for the NVX mechanics
 |   |-- src/
 |   |   |-- protocol/            Control-console codec, NVXS session, and the guest targets that live shares may not take, shared by the host and the guest
+|   |   |-- activation/          The activation record of a layered root and what Ready reports about it, shared by the host, the guest, and every adapter's framing
 |   |   |-- contract.rs          Control-contract versions and release compatibility
 |   |   |-- net/                 CIDR parsing and subtraction, and hostname and guest-network forms
 |   |   |-- gpt/                 Strict reading of GPT disks whose first partition configures an adapter and whose other partitions hold a root's read-only layers, shared by the host and the guest

doc/usage.md

@@ -98,6 +98,9 @@ each code for callers of the `nvx` library.
 | `foreign-files` | 1 | `deprovision` found files that NVX does not own in the state directory, which the message names, and kept them with the directory. |
 | `outcome-report-exists` | 1 | A file exists at the `--outcome-report` path. |
 | `scratch-claimed` | 1 | Another sandbox claims the scratch image. |
+| `sandbox-leased` | 1 | The sandbox holds a lease of a template's generation, which allows no other lease, and one launch of its clone, until a release ends it once its VM has exited. |
+| `template-ineligible` | 1 | The restore window of a template's generation, which the time contract of its capture sets, excludes the host's time, so no clone may restore it now. |
+| `template-tombstoned` | 1 | A tombstone quarantines the template's generation, which takes no new clones. |
 | `exited` | 1 | OpenVMM exited, as when a start fails, whose message names the category and status of OpenVMM's outcome report when it has one. |
 | `exec-refused` | 1 | The guest agent refused the workload, as for a working directory that it cannot use. |
 | `endpoint-closed` | 1 | OpenVMM closed the control endpoint, as it does when the VM shuts down. |

nvx-rs/Cargo.toml

@@ -59,6 +59,8 @@ sha2 = { version = "0.10", optional = true }
 
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.61", optional = true, features = [
+    "Wdk_Foundation",
+    "Wdk_Storage_FileSystem",
     "Win32_Foundation",
     "Win32_Security",
     "Win32_Storage_FileSystem",
@@ -68,6 +70,7 @@ windows-sys = { version = "0.61", optional = true, features = [
     "Win32_System_Pipes",
     "Win32_System_Registry",
     "Win32_System_Threading",
+    "Win32_System_WindowsProgramming",
 ] }
 
 # The host and the fake OpenVMM also build on Unix hosts other than Linux, such as macOS.