microVM: remove portb's host input

portb, the microVM's byte channel at ports 0xe9 to 0xeb, delivered host
input to the guest's hvc0 console. microsoft/nvx#549 removes that
input, so that host input reaches a microVM guest only through its boot
and control consoles, by design rather than by how a frontend wires
portb.

The device no longer reads its host endpoint: its input-pending status
bit stays clear, a data read without a selected record returns zeros,
and it no longer takes part in the snapshot input gate. A snapshot
saves an empty input buffer, and a restore refuses the state of an
earlier VMM that holds input the guest had not read, rather than drop
it. The output buffer keeps its 1 MiB bound, and the machine ABI its
version: a host that never sends input was always valid.

When the boot console does not own the terminal, portb still writes to
stdout and keeps the terminal, but OpenVMM now discards keystrokes
until Ctrl-Q opens the REPL, instead of handing them to a device that
no longer reads them. The CLI and RPC guides say so.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ppenna

Guide/src/reference/openvmm/management/cli.md

@@ -39,7 +39,11 @@ describes the source definitions.
 
   The kernel must be an uncompressed ELF64 image. The profile owns the base command line
   (`earlycon=xe9 console=hvc0 reboot=t panic=-1`) and switches the primary
-  console to `hvc1` when `--virtio-console` is present. It appends
+  console to `hvc1` when `--virtio-console` is present. The portb console,
+  `hvc0`, takes no host input, so an interactive guest console needs
+  `--virtio-console console`; without a boot console on the terminal, portb
+  writes to stdout, and OpenVMM discards keystrokes until Ctrl-Q opens the
+  REPL. It appends
   `nr_cpus=<capacity>` from the validated processor topology. It reserves a 1-GiB
   MMIO gap from 3 to 4 GiB and exposes only PIC/IOAPIC, PIT, a CMOS RTC
   anchored to UTC,
@@ -1006,7 +1010,8 @@ Serial devices can be configured to appear as different devices inside the guest
 * `--virtio-console <BACKEND>`: Expose a virtio console device. It normally
   appears as `/dev/hvc0`. Under `--machine microvm`, it occupies fixed MMIO
   `0xd0002000`, IRQ 18, and is selected as `/dev/hvc1`; the raw portb path
-  remains available as `hvc0` for early output and recovery.
+  remains available as `hvc0` for early output and failure reports, and takes
+  no host input.
 
   A microVM accepts these explicit attachment policies:
 

Guide/src/reference/openvmm/management/grpc.md

@@ -190,7 +190,7 @@ restore flow over both transports:
   absent, or may contain only the matching microVM profile, an optional exact
   processor-count assertion, a `cpu_profile` that the restore accepts (see
   below), serial port 0 host
-  attachment, matching `DevicesConfig.virtio_consoles` and
+  attachment, which receives portb's output and is never read, matching `DevicesConfig.virtio_consoles` and
   `DevicesConfig.virtiofs_config` attachments, and guest power actions.
   Guest-visible boot, memory, processor topology, other device, NUMA, and PCIe
   fields are rejected. A saved listener is reconstructed from the manifest; a saved

openvmm/openvmm_entry/src/microvm/config.rs

@@ -242,10 +242,13 @@ impl<'a> MicrovmConfigBuilder<'a> {
         }
     }
 
-    /// Connects the host side of the portb console (`hvc0`).
+    /// Connects the host side of the portb console (`hvc0`), which takes no
+    /// host input.
     ///
-    /// This must run before the other serial devices so that portb owns the
-    /// interactive console when the boot virtio-console does not.
+    /// When the boot virtio-console does not own the terminal, portb does: it
+    /// writes to stdout, and OpenVMM discards keystrokes until Ctrl-Q opens
+    /// the REPL. This must run before the other serial devices, which would
+    /// otherwise take the terminal.
     pub(crate) fn setup_portb(
         &mut self,
         console_state: &RefCell<Option<ConsoleState<'static>>>,
@@ -268,6 +271,7 @@ impl<'a> MicrovmConfigBuilder<'a> {
             "microvm-portb",
             backend,
             "hvc0",
+            false,
             console_state,
             serial_driver,
         )?);
@@ -324,6 +328,7 @@ impl<'a> MicrovmConfigBuilder<'a> {
                         "virtio-console",
                         SerialConfigCli::Console,
                         "hvc1",
+                        true,
                         console_state,
                         serial_driver,
                     )?;
@@ -856,11 +861,14 @@ fn aggregate_child_kind(
 }
 
 /// Connects a portb or boot virtio-console endpoint to the host console or
-/// stderr, returning its backend and output-relay completion.
+/// stderr, returning its backend and output-relay completion. The device
+/// receives the console's input when `input` is set; otherwise, OpenVMM
+/// discards it.
 fn setup_host_console(
     name: &str,
     backend: SerialConfigCli,
     device: &'static str,
+    input: bool,
     console_state: &RefCell<Option<ConsoleState<'static>>>,
     serial_driver: &DefaultDriver,
 ) -> anyhow::Result<(Resource<SerialBackendHandle>, OutputCompletion)> {
@@ -871,10 +879,12 @@ fn setup_host_console(
             }
             let (config, serial) = serial_io::anonymous_serial_pair(serial_driver)?;
             let (serial_read, serial_write) = AsyncReadExt::split(serial);
-            *console_state.borrow_mut() = Some(ConsoleState {
-                device,
-                input: Box::new(serial_write),
-            });
+            let input: Box<dyn futures::AsyncWrite + Unpin + Send> = if input {
+                Box::new(serial_write)
+            } else {
+                Box::new(futures::io::sink())
+            };
+            *console_state.borrow_mut() = Some(ConsoleState { device, input });
             let completed = spawn_output(name, serial_read, term::raw_stdout())?;
             (config, completed)
         }