Make ELF loading respect program header virtual addresses for non-PIE binaries (#1530)

## Summary

For non-PIE (ET_EXEC) ELF binaries, the guest page table now maps the
code region at the ELF's declared virtual address rather than
identity-mapping it at the GPA. This allows statically-linked binaries
with a fixed load address (e.g., `--image-base=0x200000`) to execute
correctly.

## Problem

Previously, Hyperlight assumed code GVA == code GPA (identity mapping).
Non-PIE binaries that declare a non-zero base virtual address (via
program header `p_vaddr`) would triple-fault because the guest CPU
jumped to the ELF's declared entrypoint VA, which wasn't mapped in the
page tables.

## Solution

- Compute `code_virt_base` from the ELF's lowest LOAD segment `p_vaddr`
- For non-PIE (`base_va > 0`): map code at the declared VA in the guest
page tables
- For PIE (`base_va == 0`): preserve existing identity mapping behavior
(with assertion to guard the invariant)
- Compute entrypoint as `code_virt_base + (entrypoint_va - base_va)`

The fix leverages the existing `Mapping` struct's support for `phys_base
!= virt_base` — no changes to the page table code itself.

## Testing

- New `non_pie_guest_hello_world` integration test exercises full guest
lifecycle (init, COW, function call, return value) with a non-PIE
simpleguest built at `--image-base=0x200000`
- All existing PIE guest tests continue to pass (identity mapping
preserved)
- Tested on Windows/WHP and Linux/KVM

## Build infrastructure

- Added `build-rust-guests-non-pie` Justfile targets
- Non-PIE build runs first in `guests` recipe to avoid clobbering normal
guest binaries
- Added `simple_guest_non_pie_as_string()` test helper

Contributes to: #1408

---------

Signed-off-by: cshung <3410332+cshung@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6f20a05d-6bee-4e2e-b320-12f8d9759bbc

Author: cshung

.github/workflows/dep_build_guests.yml

@@ -54,14 +54,15 @@ jobs:
         run: |
           sudo chown -R $(id -u):$(id -g) /opt/cargo || true
 
-      # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
+      # cargo-hyperlight builds a custom sysroot for the Hyperlight guest target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
       - name: Sysroot cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: |
             src/tests/rust_guests/target/sysroot
+            src/tests/rust_guests/target-non-pie/sysroot
           key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml') }}
 
       - name: Rust cache
@@ -87,6 +88,11 @@ jobs:
           just build-rust-guests ${{ inputs.config }}
           just move-rust-guests ${{ inputs.config }}
 
+      - name: Build non-PIE Rust guests
+        run: |
+          just build-rust-guests-non-pie ${{ inputs.config }}
+          just move-rust-guests-non-pie ${{ inputs.config }}
+
       - name: Build C guests
         run: |
           just build-c-guests ${{ inputs.config }}
@@ -108,4 +114,3 @@ jobs:
           path: src/tests/c_guests/bin/${{ inputs.config }}/
           retention-days: 1
           if-no-files-found: error
-

.gitignore

@@ -454,6 +454,7 @@ $RECYCLE.BIN/
 
 # Rust build artifacts
 **/**target
+**/**target-non-pie
 libhyperlight_host.so
 libhyperlight_host.d
 hyperlight_host.dll

Justfile

@@ -50,7 +50,7 @@ build target=default-target:
     {{ cargo-cmd }} build --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }}
 
 # build testing guest binaries
-guests: build-and-move-rust-guests build-and-move-c-guests
+guests: build-and-move-rust-guests build-and-move-rust-guests-non-pie build-and-move-c-guests
 
 # Ensure the pinned cargo-hyperlight is installed. We compare the *actual*
 # installed binary's reported version instead of relying on `cargo install`
@@ -75,6 +75,22 @@ build-rust-guests target=default-target features="": (ensure-cargo-hyperlight)
 build-and-move-rust-guests: (build-rust-guests "debug") (move-rust-guests "debug") (build-rust-guests "release") (move-rust-guests "release")
 build-and-move-c-guests: (build-c-guests "debug") (move-c-guests "debug") (build-c-guests "release") (move-c-guests "release")
 
+# Build non-PIE variants of rust guests for testing ELF VA mapping.
+# Phase 1 builds the sysroot without RUSTFLAGS (avoids RUSTFLAGS leaking
+# into the sysroot wrapper build in cargo-hyperlight).
+# Phase 2 uses plain cargo with --sysroot and non-PIE link flags.
+build-rust-guests-non-pie target=default-target: (ensure-cargo-hyperlight)
+    cd src/tests/rust_guests/simpleguest && cargo hyperlight build --target-dir ../target-non-pie --profile={{ if target == "debug" { "dev" } else { target } }}
+    {{ if os() == "windows" { "$env:RUSTC_BOOTSTRAP=1; $env:RUSTFLAGS='--sysroot=' + (Resolve-Path src/tests/rust_guests/target-non-pie/sysroot).Path + ' -C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x1000000 --cfg=hyperlight --check-cfg=cfg(hyperlight) -Clink-args=-eentrypoint';" } else { "" } }} cd src/tests/rust_guests/simpleguest && {{ if os() == "windows" { "" } else { "RUSTC_BOOTSTRAP=1 RUSTFLAGS=\"--sysroot=$(cd .. && pwd)/target-non-pie/sysroot -C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x1000000 --cfg=hyperlight --check-cfg=cfg(hyperlight) -Clink-args=-eentrypoint\"" } }} cargo build --target {{ hyperlight-target }} --target-dir ../target-non-pie/build --profile={{ if target == "debug" { "dev" } else { target } }}
+
+non_pie_guests_target := "src/tests/rust_guests/target-non-pie/build/" + hyperlight-target
+
+@move-rust-guests-non-pie target=default-target:
+    {{ if os() == "windows" { "New-Item -ItemType Directory -Path " + rust_guests_bin_dir + "/" + target + "/non_pie -Force | Out-Null" } else { "mkdir -p " + rust_guests_bin_dir + "/" + target + "/non_pie" } }}
+    cp {{ non_pie_guests_target }}/{{ target }}/simpleguest {{ rust_guests_bin_dir }}/{{ target }}/non_pie/
+
+build-and-move-rust-guests-non-pie: (build-rust-guests-non-pie "debug") (move-rust-guests-non-pie "debug") (build-rust-guests-non-pie "release") (move-rust-guests-non-pie "release")
+
 clean: clean-rust
 
 clean-rust: 

src/hyperlight_host/src/hypervisor/gdb/mod.rs

@@ -94,7 +94,7 @@ impl<'a> DebugMemoryView<'a> {
     }
 
     pub(crate) fn code_section_offset(&self) -> u64 {
-        self.mem_mgr.layout.get_guest_code_address() as u64
+        self.mem_mgr.layout.get_guest_code_gva() as u64
     }
 
     /// Reads memory from the guest's address space with a maximum length of a PAGE_SIZE

src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs

@@ -874,7 +874,7 @@ mod tests {
     use crate::hypervisor::regs::{CommonSegmentRegister, CommonTableRegister, MXCSR_DEFAULT};
     use crate::hypervisor::virtual_machine::VirtualMachine;
     use crate::mem::layout::SandboxMemoryLayout;
-    use crate::mem::memory_region::{GuestMemoryRegion, MemoryRegionFlags};
+    use crate::mem::memory_region::MemoryRegionFlags;
     use crate::mem::mgr::{GuestPageTableBuffer, SandboxMemoryManager};
     use crate::mem::ptr::RawPtr;
     use crate::mem::shared_mem::{ExclusiveSharedMemory, ReadonlySharedMemory};
@@ -1431,16 +1431,12 @@ mod tests {
         let pt_base_gpa = layout.get_pt_base_gpa();
         let pt_buf = GuestPageTableBuffer::new(pt_base_gpa as usize);
 
-        for rgn in layout
-            .get_memory_regions_::<GuestMemoryRegion>(())
-            .unwrap()
-            .iter()
-        {
+        for rgn in layout.get_memory_regions().unwrap().iter() {
             let readable = rgn.flags.contains(MemoryRegionFlags::READ);
             let writable = rgn.flags.contains(MemoryRegionFlags::WRITE);
             let executable = rgn.flags.contains(MemoryRegionFlags::EXECUTE);
             let mapping = Mapping {
-                phys_base: rgn.guest_region.start as u64,
+                phys_base: rgn.host_region.start as u64,
                 virt_base: rgn.guest_region.start as u64,
                 len: rgn.guest_region.len() as u64,
                 kind: MappingKind::Basic(BasicMapping {
@@ -1496,7 +1492,7 @@ mod tests {
             layout,
             ro_mem.to_mgr_snapshot_mem().unwrap(),
             scratch_mem,
-            NextAction::Initialise(layout.get_guest_code_address() as u64),
+            NextAction::Initialise(layout.get_guest_code_gva() as u64),
         );
 
         let (mut hshm, gshm) = mem_mgr.build().unwrap();
@@ -2205,7 +2201,7 @@ mod tests {
             a.fxsave(ptr(rax)).unwrap();
 
             // Return dispatch ptr
-            a.mov(rax, layout.get_guest_code_address() as u64).unwrap();
+            a.mov(rax, layout.get_guest_code_gva() as u64).unwrap();
 
             a.hlt().unwrap();