Repository navigation
host: make the platform layer private to nvx (SL6.14) - #1529
Merged
Pedro Henrique Penna (ppenna) merged 2 commits intoNov 12, 2026
Merged
Pedro Henrique Penna (ppenna) merged 2 commits into
Pedro Henrique Penna (ppenna) merged 2 commits into
Conversation
Pedro Henrique Penna (ppenna)
added
tests-modified
Contributor
This pull request changes existing testsIt modifies or removes 70 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests. Test code
... and 17 more, which the job's summary lists. Test policy
Relocated unchanged: 0; added: 10. Compared the merge base |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the platform-visibility change.
No open issues 🎉
What changed in this PR
This PR implements SL6.14 of the NVX library-slimming workstream: it makes host::platform crate-private while preserving the public interfaces in host::vm, host::transport, and host::runtime.
Changes:
- Narrows platform visibility, removes unused directory helpers, and gates process-start-time helpers by their callers.
- Moves platform-dependent integration tests into their owning modules and updates remaining outside callers.
- Updates public-API snapshots, documentation, and coverage references to reflect the private platform layer.
| File | Description |
|---|---|
scripts/test-layout-allowlist.json |
Records four process-start-time test hooks. |
nvx-rs/tests/supervisor.rs |
Removes Windows process tests relocated to unit tests. |
nvx-rs/tests/security_checklist.rs |
Relocates saved-VM checks and updates checklist documentation. |
nvx-rs/tests/cli/one_shot.rs |
Reads fake-process start times without private APIs. |
nvx-rs/src/host/vm/tests/reattach.rs |
Receives saved-VM and endpoint-ownership checks. |
nvx-rs/src/host/process/tests/windows.rs |
Receives Windows process-access tests and helpers. |
nvx-rs/src/host/process/tests.rs |
Registers the Windows unit-test module. |
nvx-rs/src/host/process.rs |
Documents start-time values without private API links. |
nvx-rs/src/host/platform/windows/process.rs |
Narrows and gates process-start-time helpers. |
nvx-rs/src/host/platform/windows/private.rs |
Deletes the unused directory helper. |
nvx-rs/src/host/platform/windows/mod.rs |
Narrows exports and gates the start-time re-export. |
nvx-rs/src/host/platform/windows/identity.rs |
Makes file identity crate-private. |
nvx-rs/src/host/platform/other.rs |
Narrows fallback APIs and removes the unused directory helper. |
nvx-rs/src/host/platform/mod.rs |
Removes public platform re-exports. |
nvx-rs/src/host/platform/linux/process.rs |
Makes process start time crate-private. |
nvx-rs/src/host/platform/linux/private.rs |
Deletes the unused directory helper. |
nvx-rs/src/host/platform/linux/mod.rs |
Narrows exports, gates start-time access, and removes an unused constant. |
nvx-rs/src/host/platform/linux/identity.rs |
Makes file identity crate-private. |
nvx-rs/src/host/mod.rs |
Makes the platform module crate-private and updates its documentation. |
nvx-rs/README.md |
Documents public transport paths and relocated tests. |
nvx-rs/public-api/windows.txt |
Removes 11 platform API entries. |
nvx-rs/public-api/linux.txt |
Removes 11 platform API entries. |
nvx-rs/examples/external-launch.rs |
Imports Transport through its public transport path. |
doc/acceptance-case-matrix.md |
Points coverage references to the relocated VM test. |
Review effort: Balanced
Four tests of nvx-rs run hold the fake OpenVMM that the CLI launched through nvx::host::process, to see it exit and to end it if it does not: forwarding_failure_stops_the_verified_vm_during_connect_and_ handshake, terminal_ctrl_c_cancels_boot_and_handshake_and_restores_ the_terminal on Linux and on Windows, and terminal_quit_and_suspend_ keys_remain_guest_console_input. Their helper, gated_native, named the fake's process with nvx::host::platform::process_start_time, which SL6.14 (#1127) makes private to the crate. The tests drive the nvx-rs binary, so they stay integration tests, and the helper reads the start time itself, as ProcessRef's documentation defines it: on Linux, the starttime field of /proc/<pid>/stat, and on Windows, the process's creation time as a 64-bit FILETIME, which GetProcessTimes reports. It opens the same reference with Process::open as before, so the four tests assert what they asserted. Evidence: on Windows with Rust 1.95.0, cargo test --all-features --test cli -- one_shot passes (17 passed, 2 ignored), with the two tests that use the helper there; on nvx-kvm-test (Linux 6.6) and nvx-mshv-test (Linux 6.18), tests/cli.rs passes whole (120 passed), with the three tests that use it on Linux. Part of #1127 (SL6.14). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
nvx::host::platform, the host's operating-system layer, was a public module of nvx, with SUPPORTED, create_private_dir, file_identity, process_start_time, and the Transport trait and TransportHandle. Its public parts moved to host::vm, host::transport and host::runtime with the new interface, and its last outside users are gone, so SL6.14 (#1127) makes it crate-private where it is. The module becomes pub(crate), and its items pub(crate), as the unreachable_pub lint asks. Transport and TransportHandle stay pub where they are defined, since host::transport re-exports them as their public path. host::vm's create_private_dir, host::transport and host::runtime keep their public forms. The compiler then finds what only the public paths kept alive: - The platform's own create_private_dir, which nothing in the crate calls, goes on every host, with Linux's PRIVATE_DIR_MODE, which only it read; host::vm::create_private_dir is the VM directory's own function, and stays. SUPPORTED goes too: its last reader, the artifact discovery that SL6.6b deleted, is gone. - process_start_time serves only the CLI, which checks the processes that its records name, and the unit tests, which name the processes that they start. Its re-export on Linux and Windows, and on Windows the function and the open_existing_process that only it calls, are gated by cfg(any(test, feature = "cli")): four hooks, which the test-layout allowlist records as seams of linux/mod.rs, windows/mod.rs and windows/process.rs. On other hosts, where no test reads it, the cli feature alone gates it, and the import of std::fs, which only the CLI's code uses there now. Nothing that stays changes behavior. The integration tests that reached the platform layer become unit tests of their owners: - tests/security_checklist.rs's a_saved_vm_runs_until_its_process_exits_and_another_runtime_is_ refused_without_a_signal and reattaching_refuses_an_endpoint_that_ another_process_serves_and_keeps_the_vm_and_its_values, with the idle child and its ignored idle_child, move to host::vm's reattach tests, whose vm_dir, cold_runtime, saved and bind helpers do what the checklist's private_directory, runtime, saved and endpoint_server did. The child starts under the spawn lock, as the other children of the unit tests do. - tests/process.rs, whose tests of nvx::host::process name the children that they start by process_start_time, moves with git mv to host::process's tests as host::process::tests::orchestrator, with its seven tests unchanged. Its imports take crate paths, its module declaration holds its cfg, it names its fixtures by their unit-test paths, it starts its children under the spawn lock, as the other children of the unit tests start, and its Windows processes, whose security descriptors it restricts, allow the unsafe code that host's deny(unsafe_code) refuses. The case matrix names the moved checklist test and the moved process tests where they now live, and the checklist and the README say which unit tests check them. ProcessRef's documentation, which linked process_start_time, defines the start time itself, and host's module docs and the README name the platform layer as private: the README's module table and section cover report alone, and the Transport paragraphs move to host::transport's section, the trait's public path. The public-API snapshots drop host::platform's 11 items on each platform, and only those. Evidence, with Rust 1.95.0, on Windows: cargo clippy -D warnings passes for --all-targets --all-features, --all-targets, --lib, --lib --no-default-features, serde alone, --lib --bins with cli, and with testing alone, for x86_64-unknown-linux-gnu with those sets, and for x86_64-unknown-linux-musl with guest alone, --lib --bins and --all-targets, which also compile the external-launch example; cargo +1.89 check --all-targets --all-features and cargo check --all-targets --all-features for aarch64-apple-darwin pass, the latter with the one warning, in host::snapshot's tests, that the base has too; cargo doc -D warnings, for Windows and Linux, public_api.py, check_test_layout.py, check_markdown_links.py and the case matrix check pass; and cargo test --lib passes for host::process, with the seven moved tests, host::vm::tests::reattach, host::platform, host::transport and host::vm_directory, with the default features and with all of them, as do the security_checklist and host_modules tests and the CLI's one-shot tests. Part of #1127 (SL6.14). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/slim-sl6-14-platform-private
branch
from
November 12, 2026 15:15
5d1163f to
659b005
Compare
Pedro Henrique Penna (ppenna)
marked this pull request as ready for review
November 12, 2026 15:15
Pedro Henrique Penna (ppenna)
merged commit Nov 12, 2026
1610f77
into
feature/nvx-refactor
87 of 90 checks passed
Pedro Henrique Penna (ppenna)
deleted the
agents/slim-sl6-14-platform-private
branch
November 12, 2026 15:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1127 (SL6.14, "The host's platform layer is private"). Parent #1088, umbrella #1076.
Its base is
feature/nvx-refactorat04fbbd48. It was stacked on #1525 (SL6.12), which has merged.What and why
nvx::host::platformis the host's operating-system layer, which the library and the CLI use, yet it was a public module ofnvx, withSUPPORTED,create_private_dir,file_identity,process_start_time, and theTransporttrait andTransportHandle. Its public parts moved tohost::vm,host::transportandhost::runtimewith the new interface, and its last outside users are gone, so, as SL6.14's Scope says, this PR makes it crate-private where it is. Nothing that stays changes behavior, no production file moves or splits, and no other module becomes private.host::platformis crate-private (host: make the platform layer private to the crate). The module becomespub(crate) mod platform, andfile_identityandprocess_start_timebecomepub(crate)on Linux, Windows and other hosts, asunreachable_pubasks.TransportandTransportHandlestaypubwhere they are defined, sincehost::transportre-exports them as their public path. No alias ofTransportorprobe_hypervisorremained:host::runtime::probe_hypervisorwraps the platform's crate-private probe.host::vm::create_private_dir,host::transportandhost::runtimekeep their public forms.create_private_dir, on Linux, Windows and other hosts, which nothing in the crate calls (host::vm::create_private_diris the VM directory's own function), is deleted with Linux'sPRIVATE_DIR_MODE, which only it read. So isSUPPORTED, whose last reader, the artifact discovery that SL6.6b deleted (a55cb63e), is gone. No test reads either.process_start_timeserves only the CLI, which checks the processes that its records name, and the unit tests, which name the processes that they start. Its re-exports on Linux and Windows, and on Windows the function and theopen_existing_processthat only it calls, are gated bycfg(any(test, feature = "cli")); on other hosts, where no test reads it,cfg(feature = "cli")gates it, with thestd::fsimport that only the CLI's code uses there now. See Seams.tests/security_checklist.rs'sa_saved_vm_runs_until_its_process_exits_and_another_runtime_is_refused_without_a_signalandreattaching_refuses_an_endpoint_that_another_process_serves_and_keeps_the_vm_and_its_values, with the idle child and its ignoredidle_child, move tohost::vm::tests::reattach, whosevm_dir,cold_runtime,savedandbinddo what the checklist'sprivate_directory,runtime,savedandendpoint_serverdid. The idle child starts under the spawn lock, as the unit tests' other children do.tests/process.rs, into which SL6.3 turnedtests/supervisor.rs, names every child that it starts withprocess_start_time, so it moves withgit mvtohost::process::tests::orchestrator(nvx-rs/src/host/process/tests/orchestrator.rs), with its seven tests and two fixtures unchanged:processes_can_be_shared_between_threads,a_child_that_exits_wakes_its_waiter,a_process_that_is_not_a_child_wakes_its_waiters,a_reused_process_id_is_never_signaled,references_that_name_no_process_are_never_opened, and on Windowsa_process_that_this_user_may_not_query_has_an_unknown_stateanda_process_that_this_user_may_not_terminate_is_waited_for_but_never_signaled. Its imports take crate paths, its module declaration holds its cfg,fixture_argumentsnames the fixtures by their unit-test paths, its three spawns take the spawn lock, as the unit tests' children do, and its Windowsrestrictedmodule allows the unsafe code thathost'sdeny(unsafe_code)refuses. This replaces the earlier revision's copy of the two Windows tests inhost::process::tests::windows.tests/cli/one_shot.rs's four tests ofnvx-rs run(forwarding_failure_stops_the_verified_vm_during_connect_and_handshake,terminal_ctrl_c_cancels_boot_and_handshake_and_restores_the_terminalon Linux and on Windows,terminal_quit_and_suspend_keys_remain_guest_console_input) drive thenvx-rsbinary, so they stay integration tests, as nvx-rs slimming 4.3.4: NVXC, the host's platform layer and the guest's space are private #1127's notes allow, and their helper reads the fake OpenVMM's start time asProcessRef's docs define it (tests: read the one-shot fake's start time as ProcessRef documents it). Theexternal-launchexample needs nothing this PR makes private: since SL6.3 it launches its VMM itself, takesTransportfromhost::transport, and reads its VMM's start time asProcessRefdefines it, so the earlier revision'sexamples: take Transport from host::transportwent in the rebase, already upstream.mod nvx::host::platform,SUPPORTED,Transportwith its four methods,TransportHandle,create_private_dir,file_identityandprocess_start_time.host::transport::{Transport, TransportHandle},host::vm::create_private_dirandhost::runtime::probe_hypervisorstay listed.ProcessRef's docs define the start time without linking the private function;host's module docs nameplatformas private. Innvx-rs/README.md, thenvx::host::platform,reportrow and section becomenvx::host::report's, theTransportparagraphs move tonvx::host::transport's section, its public path, the host-path and security-checklist text say where the moved checks now live, and the testing section's "process and spawn test", which SL6.3 split intotests/process.rsand the spawn's unit tests, describes the process tests where they now live.a_host_program_of_another_runtime_finds_the_vm_mismatched_and_signals_nothinganda_host_program_of_another_runtime_ends_the_clone_through_its_verified_identityname the moved checklist test atnvx-rs/src/host/vm/tests/reattach.rs, and the retired row ofhost::supervisor's doc test namesnvx-rs/src/host/process/tests/orchestrator.rsfor the process tests. No inventoried test is added or removed, and SL5.2'scheck_matrix.pypasses.Seams
process_start_timekeeps four test hooks, whichscripts/test-layout-allowlist.jsonrecords:nvx-rs/src/host/platform/linux/mod.rsprocess_start_time, which the Linux platform itself also callsnvx-rs/src/host/platform/windows/mod.rsprocess_start_timenvx-rs/src/host/platform/windows/process.rsprocess_start_timeandopen_existing_processThe public re-export kept it in every build; outside the platform, only the CLI and the unit tests, which name the children that they spawn, call it.
Size
Measured: 0 core lines and 0 counted files, as the Estimate says. Every added code line of production Rust is a
pubnarrowed topub(crate), a feature or test gate, or an import edit that they force. Five platform files (linux/{mod,private}.rs,windows/{mod,private}.rs,other.rs) also lose the now-unusedcreate_private_dir,PRIVATE_DIR_MODEandSUPPORTED, deleted lines only. The rest is tests, docs, generated snapshots and test policy.Judgment calls, approved by the orchestrator for Pedro Henrique Penna (@ppenna)
create_private_diramong the items that becomepub(crate), but once crate-private the platform's owncreate_private_dirhas no caller, so it goes, rather than staying as dead code under anexpect(dead_code)with no later caller to name.host::vm::create_private_dirkeeps its public form.SUPPORTED, which SL6.6b left without a reader, follows the same rule in this revision.process_start_timeis gated bycfg(any(test, feature = "cli"))rather than gating its tests, with four seams inscripts/test-layout-allowlist.json(see Seams): one innvx-rs/src/host/platform/linux/mod.rs, its re-export; one innvx-rs/src/host/platform/windows/mod.rs, its re-export; and two innvx-rs/src/host/platform/windows/process.rs,process_start_timeandopen_existing_process.Other notes
nvx-rs runtests stay integration tests that drive the binary, and read the documented start time themselves; the security checklist's two saved-VM checks, and SL6.3'stests/process.rs, become unit tests ofhost::vmandhost::process, as the Scope says.Validation
The gates that
local_gates.py --filesselects, run from this branch's own action definitions, with Rust 1.95.0 andNVX_BUNDLE=skip, on this head,659b0052:cargo fmt --all --checkcargo clippy --locked -- -D warningswith--all-targets --all-features,--all-targets,--lib,--lib --no-default-features, serde alone,--lib --bins --features cli,--lib --bins --no-default-features --features testing(the--all-targetssets compile theexternal-launchexample)--target x86_64-unknown-linux-gnu, and--target x86_64-unknown-linux-musl --no-default-features --features guestwith--lib --binsand--all-targetsRUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps --all-features, for Windows andx86_64-unknown-linux-gnu;cargo +1.89 check --locked --all-targets --all-featurescargo check --locked --all-targets --all-features --target aarch64-apple-darwinall_processors_onlineandconsole_listenerunused inhost::snapshot's tests, is the base's toopython scripts/public_api.pyhost::platformcheck_test_layout.py,check_markdown_links.py, SL5.2'scheck_matrix.pyagainst99d2022085fcargo test --locked --libforhost::process(with the seven moved tests and both Windows restricted-process tests running their checks unprivileged),host::vm::tests::reattach,host::platform,host::transportandhost::vm_directory, with the default features and with all of them; thesecurity_checklistandhost_modulestests;cargo test --all-features --test cli -- one_shotnvx.py verify,cargo fmt --all --check, the seven clippy sets above, nativelycargo test --locked --all-features --no-fail-fast;cargo test --lockedguest::failures (1847 passed, 60 ignored), the same 28 that fail at the base on this kernel; the CLI's 120 pass, and the defaults' 681 unit tests passpublic_api.py;nvx.py check-guest-binariescheck-guest-binariesfails the same 7guest::tests as the base on this kernel (965 passed)nvx.py verify,cargo fmt --all --check, the seven clippy sets above, nativelycargo test --locked --all-features --no-fail-fast;cargo test --locked;public_api.pyOn both Linux hosts, the moved
host::process::tests::orchestratorandhost::vm::tests::reattachtests pass with all features and with the defaults, and so do the three Linux one-shot tests that use the newstart_time. The KVM host's 28 and 7guest::failures are the sets that the base fails on that kernel, compared on the earlier base8c402eac(no failure is only this branch's); this PR changes no guest code. A code-review subagent reviewed the earlier revision's whole diff and found no significant issues. Left to CI: the microVM scenarios, since no runtime path changes and no scenario runs a moved test; WHP; and benchmarks.Changes to existing tests
python scripts/check_test_changes.py --base origin/feature/nvx-refactorreports 70 changes to existing tests, 10 added test items, and none relocated unchanged; this PR carries thetests-modifiedlabel. Each change and its reason:host::process::tests::orchestrator(nvx-rs/tests/process.rs->nvx-rs/src/host/process/tests/orchestrator.rs, withgit mv): its seven tests, itsprocess_fixtureandlauncher_fixture, its helpers (PROCESS_MARKER,EXIT_MARKER,LAUNCHER_DIR,REFERENCE_PREFIX,TIMEOUT,PROCESS_LIFETIME,SHORT_WAIT,SPAWNS,serialized,fixture_arguments,spawn_process,reference_of,ProcessDirectory,Reaped,Launcher,open_running,assert_ended) and its Windowsrestrictedmodule (Running,spawn,restrict,may_open). Their assertions are unchanged. The tool reports each as modified because it now compiles under thetestcfg, and as removed its inner attribute (#![cfg(...)], now its module declaration's) and its imports (nvx::paths, nowcrate::paths);fixture_argumentsprefixes the fixture's unit-test path, andspawn_process,Launcher::startandrestricted::spawnspawn throughcrate::host::tests::spawn_locked.host::vm::tests::reattach(nvx-rs/tests/security_checklist.rs->nvx-rs/src/host/vm/tests/reattach.rs):a_saved_vm_runs_until_its_process_exits_and_another_runtime_is_refused_without_a_signal,reattaching_refuses_an_endpoint_that_another_process_serves_and_keeps_the_vm_and_its_values, the ignoredidle_child, andIdleChildwith itsstart,referenceandDrop. Their assertions are unchanged;vm::verifyandvm::reattachlose their module prefix,transport::connect_verifiedtakes its crate path,private_directoryandruntimebecomevm_dirandcold_runtime,IdleChildnames its test by its unit-test path and spawns under the spawn lock, andreferencereadscrate::host::platform::process_start_time.savedand bothendpoint_servers, which reattach's existingsavedandbindreplace: an endpoint in the same place, a test capability and the test runtime's identity, and on Windows the sameCreateNamedPipeWserver.tests/security_checklist.rs, which no longer reachplatform,transport,BootId,ProcessRefor the std items that only the moved tests used, and whoseio,CommandandStdioonly its Windows checks use now.tests/cli/one_shot.rs'sgated_nativetakes the start time from the newstart_time.host::process' tests'mod orchestrator, with the moved file's new imports and therestrictedmodule'sallow(unsafe_code); and the CLI helperstart_time, on Linux and on Windows.No test is retired.