github hyperlight-dev/hyperlight v0.18.0
Release v0.18.0
on GitHub

latest release: dev-latest
6 hours ago

What's Changed

Added

  • Windows on ARM64 support using the WHP backend by @cshung in #1638
  • Virtqueue-based host-guest communication. Per-direction virtqueue configuration is available through SandboxConfiguration and SandboxBuilder, with allocations included in scratch sizing by @andreiltd in #1793 and #1794
  • Shared virtqueue framing with a 12-byte MsgHeader and external byte values, plus ExternalValueSource implementations for RecvChain and Segments by @andreiltd in #1792, #1793, and #1794
  • Producer batch completion without notification, and segmented payload assembly and extraction without flattening by @andreiltd in #1793 and #1794
  • MailboxValue, which defines the transport mailbox's allowed wire values, and virtq::canonical::validate_canon_prefix, which validates a bounded available descriptor prefix by @andreiltd in #1891
  • Retained guest Bytes and ByteChunks preserve contents and pointers across snapshot capture, restore, and cloning by @andreiltd in #1891
  • Namespaced application metadata on immutable snapshots by @ludfjig in #1860
  • Support overriding the guest log level when building or restoring initialized snapshots by @jprendes in #1833
  • Guest paging operations and AArch64 system-register macros in hyperlight-guest by @andreiltd in #1889
  • Architecture-independent page fault and undefined instruction exception hooks in hyperlight-guest-bin by @syntactically in #1877
  • Guest virtual memory support for lazily zero-initialized regions and in-place mapping modification by @syntactically in #1873 and #1874

Changed

  • Breaking: All guest logs and host and guest function calls now go through virtqueues. Virtqueue rings and pools occupy host-owned scratch before page tables, and canonical virtqueue rings are stored in versioned OCI transport layers. Retained-buffer checkpoints use ABI 6 and config schema v3, which rejects snapshots without transport state. Existing snapshots must be regenerated by @andreiltd in #1793, #1794, and #1891
  • Breaking: VirtqProducer::reset and GuestContext::prepare_snapshot are unsafe. Peers must stay stopped with no live consumer-side chain handles until their consumers are reset or replaced by @andreiltd in #1793 and #1794
  • Breaking: Snapshot checkpoints reject host function calls. Violations poison the sandbox by @andreiltd in #1896
  • Sandbox is the primary initialized sandbox type and is reached through hyperlight_host::Sandbox or hyperlight_host::sandbox::Sandbox. MultiUseSandbox remains as a deprecated alias, and sandbox::initialized_multi_use remains as a deprecated public path by @jprendes in #1866
  • hyperlight_guest_bin::exception::arch, previously available on amd64 only, has been deprecated in favour of the new architecture-independent exception handling hooks. The new interfaces are significantly more limited, but more portable; they will be extended in the future by @syntactically in #1877
  • ELF loading respects program header virtual addresses for non-PIE guest binaries by @cshung in #1530
  • Host virtqueue access uses checked copies and atomics across mapped scratch. Snapshot admission checks geometry, canonical rings, and distinct, aligned H2G pool slots. Consumers validate descriptors and payload accesses during use by @andreiltd in #1793 and #1794
  • Virtqueue producers use concrete SlotPool allocation and BufferLease ownership. BufferMap supplies complete owners exposing initialized bytes by @andreiltd in #1793
  • ChainBuilder::build() allocates readable and writable requests. writable_avail() reserves available upper-tier slots within the descriptor budget. It may add zero slots to a nonempty chain by @andreiltd in #1793
  • Guest transport aliases follow buffer ownership. Restored buffers keep captured backing while their scratch slots become reusable by @andreiltd in #1891
  • Running snapshots checkpoint dirty virtqueues before capture. Ordinary calls keep their deferred result path by @andreiltd in #1794
  • Keep registered Rust guest return values typed until transport encoding so external byte results avoid intermediate FlatBuffer copies by @andreiltd in #1794
  • Use the reclaimed stack pages to raise the default G2H and H2G pools to 12 and 8 pages by @andreiltd in #1794
  • C guests may omit c_guest_dispatch_function when they do not need custom fallback dispatch by @ludfjig in #1848
  • Expose C guest ByteChunks values as pointer and length arrays, and return typed hl_ReturnValue objects from C guest functions through hl_result_from_* constructors by @andreiltd in #1792
  • Guest tracing skips its per-call and per-callsite work while the guest log level is OFF. hyperlight_guest_tracing::is_trace_enabled reports whether the configured level is above OFF rather than whether the tracing state was allocated by @jprendes in #1840
  • MSHV: vCPU creation reads the partition's XSAVE format once. This removes one hypercall from every restore by @ludfjig in #1912

Removed

  • Legacy stack I/O, its GuestHandle methods, and its sandbox configuration and builder options by @andreiltd in #1794
  • Embedded byte payload tables and their value-union variants by @andreiltd in #1794
  • RunPool and the run-specific AllocError::InvalidAlign variant by @andreiltd in #1793

Fixed

  • Reserve 48 KiB for guest exception stacks and metadata to cover debug paging walks by @andreiltd in #1891
  • AMD64 exception handlers clear the direction flag before calling Rust by @andreiltd in #1882
  • Use a stronger TLB invalidation barrier when updating guest page tables by @syntactically in #1876
  • The gdb feature is now a no-op in release builds by @ludfjig in #1886
  • Use checked arithmetic and conversions in push_buffer as defense in depth by @JM00NJ in #1820 and #1825
  • Use a 16 KiB-aligned default scratch size for Apple Silicon compatibility by @andreiltd in #1793
  • Guest virtqueue copies reject overlapping buffers before accessing memory by @andreiltd in #1793
  • Linear-time segment consumption for fragmented virtqueue messages by @andreiltd in #1794
  • Allow reclaimed virtqueue completions to span multiple ring reuse cycles by @andreiltd in #1794
  • Virtqueue consumers return errors when payload copies or runtime bookkeeping cannot be allocated by @andreiltd in #1794
  • Keep sandboxes usable after an H2G request exceeds available virtqueue capacity, or when G2H calls exhaust reply capacity by @andreiltd in #1794
  • Snapshot checkpoints ignore idle cancellation and clear partial abort state by @andreiltd in #1794
  • Reject incompatible transport snapshots before changing sandbox state by @andreiltd in #1794
  • Allow guest host-return conversions to call or log to the host by @andreiltd in #1794
  • Sandbox::from_snapshot now honours the guest log level set via SandboxConfiguration::set_max_guest_log_level instead of ignoring it and falling back to RUST_LOG by @sethryanrollins in #1699

Full Changelog (excl. dependencies)

Full Changelog (dependencies)

New Contributors

Full Changelog: v0.17.0...v0.18.0

Check out latest releases or
releases around hyperlight-dev/hyperlight v0.18.0

Don't miss a new hyperlight release

NewReleases is sending notifications on new releases.

Get notifications