openvmm_helpers: number the snapshot's fields without gaps

The manifest skipped fields 9 and 10, which held the artifact digests of
an earlier manifest version, and the machine contract skipped the clock
fields of earlier versions and the policies of a retired second virtio-fs
slot, so that no reader could mistake them. No reader of another version
reads a version 2 manifest, so the manifest's fields now follow upstream's
1 to 7 without gaps, from 8 to 15, and the machine contract's run from 1
to 25, with the time contract and the CPU profile record at 11 and 12,
where the clock fields were. The test that decoded the retired digests
goes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ppenna

Guide/src/dev_guide/snapshot_format.md

@@ -199,7 +199,7 @@ Key unsupported categories:
 ## Extending the format
 
 When adding new fields to `SnapshotManifest`, use the next available mesh
-tag number, never a retired one; the struct definitions list the retired tags.
+tag number.
 The protobuf encoding is forward-compatible: older readers will
 ignore unknown fields. However, removing or reordering existing fields is a
 breaking change. See [Save State](contrib/save-state.md) for the full set of

openvmm/openvmm_helpers/src/snapshot.rs

@@ -49,28 +49,26 @@ pub struct SnapshotManifest {
     /// Length of `state.bin` in bytes.
     #[mesh(8)]
     pub state_size_bytes: u64,
-    // Fields 9 and 10 held the artifact digests of manifest version 2. They
-    // are retired, and their numbers are never reused.
     /// Authoritative machine composition for versioned machine profiles.
-    #[mesh(11)]
+    #[mesh(9)]
     pub machine_contract: Option<microvm::SnapshotMachineContract>,
     /// Snapshot format magic.
-    #[mesh(12)]
+    #[mesh(10)]
     pub format_magic: Vec<u8>,
     /// Version of the serialized VM saved-state schema.
-    #[mesh(13)]
+    #[mesh(11)]
     pub saved_state_schema_version: u32,
     /// Fully qualified protobuf root type stored in `state.bin`.
-    #[mesh(14)]
+    #[mesh(12)]
     pub saved_state_root_type: String,
     /// Sandbox capture tier. Empty for blockless microVM snapshots.
-    #[mesh(15)]
+    #[mesh(13)]
     pub snapshot_tier: String,
     /// `clone` for reusable artifacts or `resume` for single-use artifacts.
-    #[mesh(16)]
+    #[mesh(14)]
     pub restore_policy: String,
     /// Bitmask of configuration sections consumed before capture.
-    #[mesh(17)]
+    #[mesh(15)]
     pub consumed_config_sections: u32,
 }
 

openvmm/openvmm_helpers/src/snapshot/format.rs

@@ -151,7 +151,6 @@ pub(super) fn validate_manifest_contents(manifest: &SnapshotManifest) -> anyhow:
 mod tests {
     use super::super::tests::test_manifest;
     use super::super::validate_manifest;
-    use super::*;
 
     #[test]
     fn other_versions_are_rejected_with_e_snapshot_version() {
@@ -193,32 +192,4 @@ mod tests {
         let err = validate_manifest(&manifest, "x86_64", 1024, 2, 4096).unwrap_err();
         assert!(err.to_string().contains("root type"));
     }
-
-    #[test]
-    fn retired_digest_fields_are_ignored_when_decoding() {
-        // A manifest encoded with fields 9 and 10 still decodes; the version
-        // check rejects every manifest that set them.
-        #[derive(mesh::payload::Protobuf)]
-        #[mesh(package = "openvmm.snapshot")]
-        struct WithDigests {
-            #[mesh(1)]
-            version: u32,
-            #[mesh(9)]
-            state_sha256: Vec<u8>,
-            #[mesh(10)]
-            memory_sha256: Vec<u8>,
-        }
-        let bytes = mesh::payload::encode(WithDigests {
-            version: 2,
-            state_sha256: vec![0xa5; SHA256_SIZE],
-            memory_sha256: vec![0x5a; SHA256_SIZE],
-        });
-        let manifest: SnapshotManifest = mesh::payload::decode(&bytes).unwrap();
-        assert_eq!(manifest.version, 2);
-        let error = validate_manifest_header(&manifest).unwrap_err();
-        assert!(
-            error.to_string().contains("[E_SNAPSHOT_VERSION]"),
-            "{error}"
-        );
-    }
 }

openvmm/openvmm_helpers/src/snapshot/microvm.rs

@@ -659,55 +659,51 @@ pub struct SnapshotMachineContract {
     /// Required host attachments.
     #[mesh(10)]
     pub attachments: Vec<SnapshotAttachment>,
-    // Fields 11 to 15, 17, and 20 held the clock fields of manifest versions
-    // 2 to 5. They are retired, and their numbers are never reused.
+    /// The NVX time ABI time contract; required.
+    #[mesh(11)]
+    pub time: Option<openvmm_defs::time_abi::SnapshotTimeContract>,
+    /// The NVX time ABI CPU profile record; required.
+    #[mesh(12)]
+    pub cpu_profile: Option<openvmm_defs::time_abi::SnapshotCpuProfile>,
     /// Version of the fixed cold-boot and memory layout.
-    #[mesh(16)]
+    #[mesh(13)]
     pub boot_layout_version: u32,
     /// Static identity of the optional microVM virtio-net device.
-    #[mesh(18)]
+    #[mesh(14)]
     pub microvm_network: Option<SnapshotMicrovmNetwork>,
     /// Guest-visible policy of the optional microVM virtio-fs device.
-    #[mesh(19)]
+    #[mesh(15)]
     pub microvm_filesystem: Option<SnapshotMicrovmFilesystem>,
     /// Fixed-role sandbox blocks in guest-visible order.
-    #[mesh(21)]
+    #[mesh(16)]
     pub microvm_sandbox_blocks: Vec<SnapshotMicrovmSandboxBlock>,
     /// Version of the reserved restore-attachable microVM virtio-fs slot.
-    #[mesh(22)]
+    #[mesh(17)]
     pub microvm_filesystem_slot_version: u32,
     /// Virtual processors online at boot, or zero when restore activation is disabled.
-    #[mesh(23)]
+    #[mesh(18)]
     pub boot_online_vp_count: u32,
     /// Virtio interrupt-delivery mode.
-    #[mesh(24)]
+    #[mesh(19)]
     pub virtio_interrupt_mode: String,
     /// Guest-physical base of the shared interrupt-status page, or zero when absent.
-    #[mesh(25)]
+    #[mesh(20)]
     pub virtio_shared_status_page_gpa: u64,
     /// Size of the shared interrupt-status page, or zero when absent.
-    #[mesh(26)]
+    #[mesh(21)]
     pub virtio_shared_status_page_size: u64,
     /// Restore-time memory expansion capability version, or zero when absent.
-    #[mesh(27)]
+    #[mesh(22)]
     pub memory_expansion_version: u32,
     /// Immutable maximum guest RAM size for restore-time expansion.
-    #[mesh(28)]
+    #[mesh(23)]
     pub memory_capacity_bytes: u64,
     /// Required alignment of every restore-time memory target and range.
-    #[mesh(29)]
+    #[mesh(24)]
     pub memory_block_size_bytes: u64,
     /// Canonical capacity ranges absent from the captured boot memory map.
-    #[mesh(30)]
+    #[mesh(25)]
     pub memory_expansion_ranges: Vec<SnapshotMemoryExpansionRange>,
-    /// The NVX time ABI time contract; required.
-    #[mesh(31)]
-    pub time: Option<openvmm_defs::time_abi::SnapshotTimeContract>,
-    /// The NVX time ABI CPU profile record; required.
-    #[mesh(32)]
-    pub cpu_profile: Option<openvmm_defs::time_abi::SnapshotCpuProfile>,
-    // Field 33 held the policies of a second virtio-fs slot, which the
-    // microVM no longer has. It is retired, and its number is never reused.
 }
 
 impl SnapshotMachineContract {