kvcache-ai/firecracker

Fork 0

mirror of https://github.com/kvcache-ai/firecracker.git synced 2026-11-05 01:17:43 +00:00

[PR #27] fix: read legacy v9 snapshots in the nested KVM runtime #28

New issue

Open

opened 2026-10-29 14:30:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:30:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/firecracker/pull/27
Author: @Hygge-Gezelligheid
Created: 10/10/2026
Status: 🔄 Open

Base: v1.15.1-patch-nestedvirt ← Head: agent/nestedvirt-profile-tools-20261010

📝 Commits (5)

7009054 fix(snapshot): make the v1000 runtime compatible with legacy v9 snapshots
b57e38b build: prepare patch-v2 for x86_64 and aarch64
1054c5e fix(x86_64): preserve IA32_XSS across snapshot restore
7088964 fix(x86_64): preserve AMD GIF in header-only nested state
9b08a50 fix(x86_64): preserve MSRs across repeated snapshot restores

📊 Changes

20 files changed (+640 additions, -84 deletions)

View changed files

📝 .gitignore (+3 -0)
📝 CHANGELOG.md (+14 -0)
📝 Cargo.lock (+6 -6)
📝 src/cpu-template-helper/Cargo.toml (+1 -1)
📝 src/firecracker/Cargo.toml (+1 -1)
📝 src/firecracker/swagger/firecracker.yaml (+1 -1)
📝 src/jailer/Cargo.toml (+1 -1)
📝 src/rebase-snap/Cargo.toml (+1 -1)
📝 src/seccompiler/Cargo.toml (+1 -1)
📝 src/snapshot-editor/Cargo.toml (+1 -1)
📝 src/snapshot-editor/src/info.rs (+6 -7)
📝 src/snapshot-editor/src/utils.rs (+3 -3)
📝 src/vmm/src/arch/x86_64/msr.rs (+4 -0)
📝 src/vmm/src/arch/x86_64/vcpu.rs (+154 -22)
📝 src/vmm/src/cpu_config/x86_64/cpuid/common.rs (+28 -1)
📝 src/vmm/src/persist.rs (+1 -1)
➕ src/vmm/src/snapshot/legacy.rs (+69 -0)
📝 src/vmm/src/snapshot/mod.rs (+313 -37)
➕ src/vmm/testdata/README.md (+32 -0)
➕ src/vmm/testdata/snapshot-v9-x86_64.bin (+0 -0)

📄 Description

Allow the nested-KVM runtime to restore legacy v9 snapshots and continue saving v1000 state.

Changes

Decode legacy v9 snapshots on x86_64 and accept the unchanged v9.0.0 layout on aarch64, retaining size, CRC, architecture and version validation.
Query nested-state support before capture and align snapshot inspection and snapshot-editor behavior.
Preserve AMD SVM GIF in header-only nested state, so snapshot restore retains the guest's interrupt-blocking state.
Package x86_64 and aarch64 as 1.15.1-patch-v2.
Preserve IA32_XSS across x86_64 snapshot restore through upstream backport 490577590dc9ddd59ba8b9f13868cd56d0c3f9c2.

Validation

Runtime compatibility checks: 5 x86 MSR tests, 9 x86 snapshot tests and 8 aarch64 snapshot tests passed; aarch64 unit tests ran under QEMU userspace.
Intel nested-KVM API and raw Firecracker matrices: 9/9 each.
AMD nested-KVM API and raw matrices: 9/9 each. After the GIF fix, the targeted interrupt-preservation regression and the three-state raw matrix passed.
The GIF regression fails with the previous runtime and passes with the fix; the focused unit test also covers unchanged VMX decisions.
Native ARM64 KVM with the released runtime passed template restoration, fork isolation, pause/resume and service restart, with the process pool enabled and disabled.
Real old v9 templates and paused records restored, saved as v1000 and restored again. The ARM installation-script upgrade also passed using staged AgentENV packages.
Earlier companion AgentENV Rust integration tests and Docker Compose E2E passed.
Native ARM64 Linux 6.18 lifecycle and real v9-to-v1000 upgrade tests passed with the process pool enabled and disabled.
Empty-cache public-download, cold-start and pause/resume verification passed on Intel x86_64 and native ARM64 with the published patch-v2 assets.

Compatibility and release

Compatibility is old-to-new: v9 input files remain unchanged, and old runtimes cannot read v1000. Nested-KVM hardware validation covers Intel and AMD; the ARM hardware tests cover ordinary KVM.

Release: v1.15.1-patch-v2. Both runtime archives were built natively on their respective architectures from 95c9c9653ae3ed1517a312fd39a22bedc6586e01, matching the release tag. The PR and release source trees differ only in src/cpu-template-helper/build.rs; native builds select the same architecture-specific mock kernel. Each contains firecracker and cpu-template-helper; prebuilt Linux 6.18 kernels are available for both architectures. Installations retaining historical pre-fault patch-v2 binaries must replace that same-version cache.

Companion integration and nested test tools: AgentENV #358.

License Acceptance

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/firecracker/pull/27 **Author:** [@Hygge-Gezelligheid](https://github.com/Hygge-Gezelligheid) **Created:** 10/10/2026 **Status:** 🔄 Open **Base:** `v1.15.1-patch-nestedvirt` ← **Head:** `agent/nestedvirt-profile-tools-20261010` --- ### 📝 Commits (5) - [`7009054`](https://github.com/kvcache-ai/firecracker/commit/7009054d00016bb67adb4242dd4d2c55707ecf5d) fix(snapshot): make the v1000 runtime compatible with legacy v9 snapshots - [`b57e38b`](https://github.com/kvcache-ai/firecracker/commit/b57e38b3d4566f8046f2ed5a73bdd9554bce8d6e) build: prepare patch-v2 for x86_64 and aarch64 - [`1054c5e`](https://github.com/kvcache-ai/firecracker/commit/1054c5ee441f245adb2a0aa25d8a41b7bccf59da) fix(x86_64): preserve IA32_XSS across snapshot restore - [`7088964`](https://github.com/kvcache-ai/firecracker/commit/70889647fcf31a12860a553673f98dbdad040ebc) fix(x86_64): preserve AMD GIF in header-only nested state - [`9b08a50`](https://github.com/kvcache-ai/firecracker/commit/9b08a504b3bdabad1b8a8872f2c8f0f67f5afd30) fix(x86_64): preserve MSRs across repeated snapshot restores ### 📊 Changes **20 files changed** (+640 additions, -84 deletions) <details> <summary>View changed files</summary> 📝 `.gitignore` (+3 -0) 📝 `CHANGELOG.md` (+14 -0) 📝 `Cargo.lock` (+6 -6) 📝 `src/cpu-template-helper/Cargo.toml` (+1 -1) 📝 `src/firecracker/Cargo.toml` (+1 -1) 📝 `src/firecracker/swagger/firecracker.yaml` (+1 -1) 📝 `src/jailer/Cargo.toml` (+1 -1) 📝 `src/rebase-snap/Cargo.toml` (+1 -1) 📝 `src/seccompiler/Cargo.toml` (+1 -1) 📝 `src/snapshot-editor/Cargo.toml` (+1 -1) 📝 `src/snapshot-editor/src/info.rs` (+6 -7) 📝 `src/snapshot-editor/src/utils.rs` (+3 -3) 📝 `src/vmm/src/arch/x86_64/msr.rs` (+4 -0) 📝 `src/vmm/src/arch/x86_64/vcpu.rs` (+154 -22) 📝 `src/vmm/src/cpu_config/x86_64/cpuid/common.rs` (+28 -1) 📝 `src/vmm/src/persist.rs` (+1 -1) ➕ `src/vmm/src/snapshot/legacy.rs` (+69 -0) 📝 `src/vmm/src/snapshot/mod.rs` (+313 -37) ➕ `src/vmm/testdata/README.md` (+32 -0) ➕ `src/vmm/testdata/snapshot-v9-x86_64.bin` (+0 -0) </details> ### 📄 Description Allow the nested-KVM runtime to restore legacy v9 snapshots and continue saving v1000 state. ## Changes - Decode legacy v9 snapshots on x86_64 and accept the unchanged v9.0.0 layout on aarch64, retaining size, CRC, architecture and version validation. - Query nested-state support before capture and align snapshot inspection and snapshot-editor behavior. - Preserve AMD SVM GIF in header-only nested state, so snapshot restore retains the guest's interrupt-blocking state. - Package x86_64 and aarch64 as `1.15.1-patch-v2`. - Preserve IA32_XSS across x86_64 snapshot restore through upstream backport `490577590dc9ddd59ba8b9f13868cd56d0c3f9c2`. ## Validation - Runtime compatibility checks: 5 x86 MSR tests, 9 x86 snapshot tests and 8 aarch64 snapshot tests passed; aarch64 unit tests ran under QEMU userspace. - Intel nested-KVM API and raw Firecracker matrices: 9/9 each. - AMD nested-KVM API and raw matrices: 9/9 each. After the GIF fix, the targeted interrupt-preservation regression and the three-state raw matrix passed. - The GIF regression fails with the previous runtime and passes with the fix; the focused unit test also covers unchanged VMX decisions. - Native ARM64 KVM with the released runtime passed template restoration, fork isolation, pause/resume and service restart, with the process pool enabled and disabled. - Real old v9 templates and paused records restored, saved as v1000 and restored again. The ARM installation-script upgrade also passed using staged AgentENV packages. - Earlier companion AgentENV Rust integration tests and Docker Compose E2E passed. - Native ARM64 Linux 6.18 lifecycle and real v9-to-v1000 upgrade tests passed with the process pool enabled and disabled. - Empty-cache public-download, cold-start and pause/resume verification passed on Intel x86_64 and native ARM64 with the published patch-v2 assets. ## Compatibility and release Compatibility is old-to-new: v9 input files remain unchanged, and old runtimes cannot read v1000. Nested-KVM hardware validation covers Intel and AMD; the ARM hardware tests cover ordinary KVM. Release: [`v1.15.1-patch-v2`](https://github.com/kvcache-ai/firecracker/releases/tag/v1.15.1-patch-v2). Both runtime archives were built natively on their respective architectures from `95c9c9653ae3ed1517a312fd39a22bedc6586e01`, matching the release tag. The PR and release source trees differ only in `src/cpu-template-helper/build.rs`; native builds select the same architecture-specific mock kernel. Each contains `firecracker` and `cpu-template-helper`; prebuilt Linux 6.18 kernels are available for both architectures. Installations retaining historical pre-fault patch-v2 binaries must replace that same-version cache. Companion integration and nested test tools: [AgentENV #358](https://github.com/kvcache-ai/AgentENV/pull/358). ## License Acceptance By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-29 14:30:15 +00:00

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

kvcache-ai/firecracker#28

No description provided.

Rows
Columns