Repository navigation
Port the time tools to Rust - #550
Draft
Pedro Henrique Penna (ppenna) wants to merge 14 commits into
Draft
Pedro Henrique Penna (ppenna) wants to merge 14 commits into
Pedro Henrique Penna (ppenna) wants to merge 14 commits into
Conversation
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The large stacked change includes privileged, concurrency-sensitive timekeeping code and still lacks the deferred KVM, MSHV, and WHP host validation.
0 open findings
What changed in this PR
Ports nvx-time and nvx-time-probe to Rust while preserving the existing C ABI and behavior; the stacked PR also contains earlier guest-tool ports.
Changes:
- Implements time repair, monitoring, diagnostics, latency, and warp tooling in Rust.
- Adds extensive parity and guest-binary tests.
- Builds, lints, and validates static musl executables in CI.
| File | Description |
|---|---|
.github/actions/check-nvx-rs/action.yml |
Adds musl guest validation. |
doc/ci.md |
Documents guest CI checks. |
doc/contribute.md |
Updates contributor guidance. |
doc/project-structure.md |
Documents Rust guest modules. |
doc/usage.md |
Updates guest-tool usage. |
nvx-rs/Cargo.toml |
Registers guest binaries and profile. |
nvx-rs/README.md |
Documents guest tooling. |
nvx-rs/src/bin/nvx-console-pending.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-device-io.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-exit.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-ingress.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-managed-agent.rs |
Adds agent entry point. |
nvx-rs/src/bin/nvx-mmio-write.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-port-io.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-reseed.rs |
Adds binary entry point. |
nvx-rs/src/bin/nvx-time-probe.rs |
Adds probe entry point. |
nvx-rs/src/bin/nvx-time.rs |
Adds time-tool entry point. |
nvx-rs/src/guest/agent/cgroup.rs |
Implements cgroup containment. |
nvx-rs/src/guest/agent/diagnostics.rs |
Implements agent diagnostics. |
nvx-rs/src/guest/agent/dispatch.rs |
Implements request dispatch. |
nvx-rs/src/guest/agent/exec.rs |
Implements workload execution. |
nvx-rs/src/guest/agent/exec_config.rs |
Handles execution configuration. |
nvx-rs/src/guest/agent/helper.rs |
Implements launch helper. |
nvx-rs/src/guest/agent/launch.rs |
Implements process launching. |
nvx-rs/src/guest/agent/loopback.rs |
Adds loopback integration coverage. |
nvx-rs/src/guest/agent/mappings.rs |
Implements host mappings. |
nvx-rs/src/guest/agent/mod.rs |
Wires agent modules. |
nvx-rs/src/guest/agent/seam.rs |
Adds privileged-operation seam. |
nvx-rs/src/guest/agent/session.rs |
Implements control sessions. |
nvx-rs/src/guest/agent/tty.rs |
Implements control TTY handling. |
nvx-rs/src/guest/console_pending.rs |
Ports console query tool. |
nvx-rs/src/guest/freestanding/args.rs |
Parses freestanding arguments. |
nvx-rs/src/guest/freestanding/device_io.rs |
Ports device benchmark. |
nvx-rs/src/guest/freestanding/exit.rs |
Implements guest exit. |
nvx-rs/src/guest/freestanding/hosted.rs |
Supports hosted testing. |
nvx-rs/src/guest/freestanding/mem.rs |
Provides memory primitives. |
nvx-rs/src/guest/freestanding/mod.rs |
Wires freestanding modules. |
nvx-rs/src/guest/freestanding/start.rs |
Implements process startup. |
nvx-rs/src/guest/freestanding/syscall.rs |
Provides raw syscalls. |
nvx-rs/src/guest/ingress/address.rs |
Parses ingress addresses. |
nvx-rs/src/guest/ingress/collect.rs |
Collects listening sockets. |
nvx-rs/src/guest/ingress/diag.rs |
Parses socket diagnostics. |
nvx-rs/src/guest/ingress/encode.rs |
Encodes announcements. |
nvx-rs/src/guest/ingress/mod.rs |
Wires ingress behavior. |
nvx-rs/src/guest/ingress/sender.rs |
Implements live announcements. |
nvx-rs/src/guest/ingress/table.rs |
Parses socket tables. |
nvx-rs/src/guest/ingress/test_mode.rs |
Adds ingress test mode. |
nvx-rs/src/guest/mmio_write.rs |
Ports MMIO writer. |
nvx-rs/src/guest/mod.rs |
Exposes guest modules. |
nvx-rs/src/guest/parse.rs |
Adds byte-oriented parsing. |
nvx-rs/src/guest/port_io.rs |
Ports port-I/O tool. |
nvx-rs/src/guest/reseed.rs |
Ports reseeding tool. |
nvx-rs/src/guest/sys.rs |
Provides guest system wrappers. |
nvx-rs/src/guest/time/checks.rs |
Implements time checks. |
nvx-rs/src/guest/time/commands.rs |
Implements time commands. |
nvx-rs/src/guest/time/daemon.rs |
Implements time daemon behavior. |
nvx-rs/src/guest/time/decoders.rs |
Decodes ABI records. |
nvx-rs/src/guest/time/events.rs |
Formats violation events. |
nvx-rs/src/guest/time/mod.rs |
Wires the time tool. |
nvx-rs/src/guest/time/state.rs |
Persists time state. |
nvx-rs/src/guest/time/system.rs |
Implements privileged operations. |
nvx-rs/src/guest/time/test_mode.rs |
Adds parity test hooks. |
nvx-rs/src/guest/time_probe/clock.rs |
Implements clock diagnostics. |
nvx-rs/src/guest/time_probe/format.rs |
Preserves C-style formatting. |
nvx-rs/src/guest/time_probe/latency.rs |
Implements latency probing. |
nvx-rs/src/guest/time_probe/mod.rs |
Dispatches probe commands. |
nvx-rs/src/guest/time_probe/support.rs |
Provides probe utilities. |
nvx-rs/src/guest/time_probe/warp.rs |
Implements warp detection. |
nvx-rs/src/guest/x86.rs |
Adds x86 guest primitives. |
nvx-rs/src/lib.rs |
Exposes guest functionality. |
nvx-rs/src/protocol/boot.rs |
Extends boot parsing. |
nvx-rs/src/protocol/exec.rs |
Adds guest EXEC decoding. |
nvx-rs/src/protocol/features.rs |
Adds guest feature masks. |
nvx-rs/src/protocol/maps.rs |
Adds mapping protocol support. |
nvx-rs/src/protocol/mod.rs |
Exposes protocol additions. |
nvx-rs/src/protocol/outer.rs |
Extends outer records. |
nvx-rs/src/protocol/tests.rs |
Adds protocol coverage. |
nvx-rs/tests/guest_tools.rs |
Exercises real guest binaries. |
scripts/nvx.py |
Exposes ELF validation command. |
scripts/nvx_tools/elf.py |
Validates static ELF binaries. |
scripts/test_nvx_tools.py |
Tests CLI and ELF validation. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/fix-issue-358-time-tools
branch
from
October 14, 2026 23:23
ea74389 to
ce99b8d
Compare
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/fix-issue-358-time-tools
branch
from
October 14, 2026 23:37
ce99b8d to
cfc0dd6
Compare
Document the private fields, constants, helpers, and platform modules that predate the guest ports. The rustdoc records ownership, error behavior, wire contracts, platform invariants, and the reasons for compatibility helpers instead of merely restating item names. Enable Clippy's missing_docs_in_private_items lint for the whole crate so future public and private code must provide the same detail on every target. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add the Linux guest feature and size-optimized musl profile, then port nvx-console-pending, nvx-mmio-write, nvx-port-io, and nvx-reseed with their C command lines, statuses, output, retry rules, and cleanup diagnostics. Golden unit and integration tests pin those contracts. Use nix 0.31.3, the latest MIT-licensed release compatible with Rust 1.89, for typed, owned syscall facilities with default features disabled. Confine all remaining libc, ioctl, mmap, and x86 unsafe operations to a documented safe guest::sys interface. OwnedFd-backed descriptors and owned mappings provide Drop cleanup plus consuming close and unmap operations where the C programs report failures; raw descriptors never leave the system layer. Give every tool a dedicated exit-status enum and typed internal errors. Call the statically linked libc strtoull with reset errno and a checked end pointer instead of reimplementing it, and deny unsafe code outside the system layer. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add a no_std workspace crate as the shared home of nvx-exit and nvx-device-io. The main nvx library links std, so linking it into these binaries would pull in the std runtime and conflict with their panic and startup language items; a package dependency replaces every path inclusion while workspace tests still exercise the pure logic on every host. Confine initial-stack decoding, raw syscalls, entry and panic handling, and compiler memory intrinsics to the documented runtime module. Safe RAII wrappers own every descriptor above it, and the command logic and binary roots deny unsafe code. Keep nvx-device-io libc-free and keep nvx-exit freestanding for the restored guest's cold first exec. Preserve device-io's wrapping parser and exact statuses 0, 2, 3, 4, and 255, and give both tools typed statuses and internal errors. The resulting nvx-exit remains smaller than the shipped C executable. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add build-guest-binaries to validate the exact Rust pin, build the six PR 1 executables in a fresh remapped target, suppress build IDs, check every static ELF, and atomically write source and binary SHA-256 values to a manifest. Add test-guest-binaries to run the musl integration suite against that staged inventory. Make check-nvx-rs call those commands instead of duplicating Cargo and linker arguments in YAML. Run the no_std workspace crate's tests, lints, docs, MSRV check, macOS cross-check, and musl checks without dropping any existing gate. Register focused Python tests in validate-nvx and document the commands and guest conventions. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add the guest attachment, acknowledgement, and credit records and window payloads. Parse the current nvx_maps count contract and expose the feature sets announced by each agent mode. Keep byte-oriented EXEC and MAPS decoders for the Linux guest beside the existing UTF-8 host decoders, including the C guest's 4096-byte cwd bound. Pin the new records and parser with golden and round-trip tests. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/fix-issue-358-time-tools
branch
from
October 15, 2026 02:30
cfc0dd6 to
0066c97
Compare
Port the managed agent as a static Rust guest binary while preserving its control session, execution, cgroup, host-mapping, sealed configuration, helper, and diagnostic contracts. Put every OS-facing unsafe operation behind documented safe nvx::guest::sys APIs. Use nix where its wrappers preserve the syscall contract, own descriptors, pipes, and memfds through OwnedFd, and use typed agent, helper, process, mapping, and launch outcomes. Prepare argv, envp, physical-PWD storage, and descriptor actions before fork. The child allocates nothing, runs only direct async-signal-safe Linux/musl operations, and terminates through exec or _exit. Keep the privileged seam for production wrappers and failure-injecting tests, and cover the complete path with the host-to-agent loopback. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Exercise the managed agent helper as a real process, including exact and layered environments, cwd handling, malformed configuration, the internal descriptor lifetime, and command-line failures. The tests can use either the Cargo test binary or the prebuilt guest-profile binary. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add nvx-managed-agent to the hosted Rust guest-binary inventory. The existing nvx.py build-guest-binaries and test-guest-binaries commands now build its static musl executable in a fresh reproducible target, check its ELF form, include its digest in the manifest, and run its prebuilt helper integration tests. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace the listener announcer with a byte-compatible Rust implementation. Split socket-table and address parsing, byte-level socket diagnostics, UDP settling, announcement encoding, the live sender, and snapshot test mode by concern. Confine socket, netlink, signal, stdio, clock, sleep, and libc parsing to documented safe guest system wrappers. Own every socket with RAII, preserve the injectable sender boundary, and use typed errors and exit statuses. Port the eight C-driven ingress cases, pin the golden wire vector, and cover malformed input, bounded encoding, sender failures, refreshes, and the real binary through NVX_GUEST_BINARIES. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add nvx-ingress to GuestRustBuildConstants.HOSTED_BINARIES after recording the preceding seven-binary inventory. Keep the earlier six-binary inventory recognized, and test that both owned outputs validate while the immediate predecessor upgrades in place. Document the command line. The guest-image build remains unchanged until the final switch. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add the byte-oriented restore packet, sample, state, kernel-log, timer, CPU, command-line, event, correction, and frequency logic for nvx-time. Expose every C test subcommand with injectable output and add golden unit and binary coverage. Introduce the documented safe guest system interface needed by the time series. Confine libc, descriptors, process operations, scheduling, clocks, x86 instructions, and port I/O to OwnedFd-backed or typed wrappers; the test command itself contains no unsafe code. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/fix-issue-358-time-tools
branch
from
October 15, 2026 05:41
0066c97 to
385635c
Compare
Implement every production command and conformance check, the exact scalar port restore and sample transactions, atomic runtime state, detector suppression, and exhaustive CPUID and MSR validation. Run the boot checker, grace-period release, and restore step 13 through the documented fork boundary with the original scheduling bounds, async-signal-safe child rules, and cross-fork CPU accounting. Use RAII timer, signal, pipe, kernel-log, lock, and MSR resources throughout the daemon. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Port the latency, pairwise warp, and clock diagnostics with safely owned pinned threads, 64-byte-separated atomics, the original acquire/release orderings, kernel-log fallback, CPUID reporting, and optional RAII MSR access. Keep every architecture and libc operation in guest::sys, render measured floating-point values through libc snprintf, and preserve the original command, marker, and exit-status formats. The shared size profile remains equivalent to the C -O2 probe without a per-binary override. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Record PR 3's exact eight-binary inventory, then add nvx-time and nvx-time-probe to the authoritative size-optimized static-musl build and prebuilt-binary tests. Preserve upgrades from each earlier recognized inventory. Document both programs, their libc-compatible formatting, and the measured decision to keep the probe on the shared guest profile rather than force opt-level 2. Part of #358. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/fix-issue-358-time-tools
branch
from
October 15, 2026 05:53
385635c to
b24e8ae
Compare
This was referenced Oct 15, 2026
Pedro Henrique Penna (ppenna)
marked this pull request as draft
October 15, 2026 18:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nvx-time, the guest side of NVX time ABI v1, to safe Rust;nvx-time-probelatency, warp, and clock diagnostics to safe Rust;system calls, port-access count/order, deferred work, and timing boundaries;
nvx.py.Part of #358 (PR 4 of 5). Stacked on #533, #531, and #528: the first ten
commits belong to them (verified); review from
b540e1a9680db9395145013b42426a2b7a561c3eon.Guest Rust conventions
sites across
time/,time_probe/, and both binary roots, down from129 / 3 / 8. All architecture and FFI code is confined to
nvx::guest::sys.inb/inl/outb,ioperm, clocks and absolute sleep,adjtimex,affinity and
SCHED_IDLE, timerfd, signalfd, polling, kernel logs, MSRs,libc parsing/formatting, namespaces, and process/fork/signal operations.
OwnedFd-backed RAII. Raw descriptors never leaveguest::sys.Child rules remain single-threaded/allocation-free where C required that;
raw wait statuses preserve real-time signals. The at-fork CPU share still
crosses one close-on-exec pipe.
the original acquire/release/relaxed/SeqCst orderings.
nvx-timehas typed process statuses 0/1/2 and typed power-off statuses193/194/195.
nvx-time-probehas typed statuses 0/1/2/3.pin libc
strtoullmodular-negation behavior.in eax, dx; the no-rangepacket still consumes exactly 24 reads. No hot-path allocation or syscall
was added.
Validation
Windows and Linux
check-nvx-rscommand, including workspace format/lints/tests,bundled artifacts, rustdoc with warnings denied, Rust 1.89 MSRV, macOS
cross-check, and all musl Clippy modes.
check-aci-edge-sandboxescommand.nvx.py verify, the complete Windows CLI unit list, Ruff check andformat, compileall, and Linux/Windows Pyright.
all-feature tests.
library tests, 32 musl guest-tool tests, and 14 freestanding tests.
build-guest-binariesruns were byte-identical, followed by all32 prebuilt tests. Final source digest:
35b6e39f64e5cbd96d0cc00c89ad368b79d2d3b77dfeaf319a8443bd0aabe23a.KVM/WSL binaries:
nvx-time590,416 bytes,27f211a8...a92df97; probe 512,640 bytes,26c3cf74...4c1901f. MSHV binaries retain the established 64-byte linkerdifference.
Differential
nvx-timeC/new cases match byte for byte.clock output with and without MSRs also match C and old Rust.
--tsc-hz 1e200output matches without truncation; regressions cover%.0f,%.1f, and%.9fthrough the complete finite-double range.WSL
musl-gcccomparison skips.In-VM
Both bare-metal
prometheus32(KVM) andprometheus30(MSHV) pass with allten new Rust binaries overlaid in copies of the guest initramfs:
restore-memory, restore-processors, all four long-downtime variants, and
exhaustive time-ABI conformance on eight vCPUs;
The curated Linux tree was rechecked with Alpine cold boot and snapshot core.
prometheus28also passes Alpine and Ubuntu boot/exhaustive checks on WHP;the review-fixed final head passes the complete WHP CI matrix.
Bare-metal timing
Five one-vCPU SMP snapshot runs per implementation were interleaved in rotated
C/old/new orders on each host. Each implementation contributes five boot and
capture samples and ten restore samples. Values are p50 microseconds,
elapsed / CPU:The refactor shows no material regression against old Rust; restore elapsed
time improved on both hosts in this sample.