Repository navigation
add file-backed ReadonlySharedMemory - #1498
Merged
Merged
Conversation
ludfjig
added
the
C-enhancement
ludfjig
marked this pull request as ready for review
June 2, 2026 17:45
ludfjig
requested review from
andreiltd,
danbugs,
dblnz,
devigned,
jprendes,
jsturtevant,
simongdavies,
squillace and
syntactically
as code owners
June 2, 2026 17:45
Contributor
There was a problem hiding this comment.
Pull request overview
This PR extends the host shared-memory layer to support file-backed snapshot blobs by adding ReadonlySharedMemory::from_file(file, guest_mapped_size) alongside a signature change to ReadonlySharedMemory::from_bytes (now requires an explicit guest_mapped_size). It also aligns snapshot creation/restoration logic and Windows surrogate mapping behavior with the “guest-visible prefix + host-only PT tail” snapshot blob layout.
Changes:
- Add file-backed
ReadonlySharedMemory::from_filewith OS-specific mapping implementations (Linuxmmap+MAP_FIXED, Windows placeholder splitting +MapViewOfFile3). - Make
ReadonlySharedMemory::from_bytesrequireguest_mapped_sizeand update snapshot/x86_64 test call sites accordingly. - Treat
MemoryRegionType::Snapshotas aReadOnlyFilesurrogate mapping on Windows and clarify snapshot/PT sizing semantics in layout comments.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| src/hyperlight_host/src/sandbox/snapshot/mod.rs | Updates snapshot construction/restore paths to pass explicit guest-visible snapshot prefix size into ReadonlySharedMemory::from_bytes. |
| src/hyperlight_host/src/mem/shared_mem.rs | Introduces Windows FileBacked mapping variant + Placeholder RAII, adds ReadonlySharedMemory::from_file, and changes from_bytes signature/behavior. |
| src/hyperlight_host/src/mem/memory_region.rs | Maps Snapshot regions as ReadOnlyFile for Windows surrogate mapping. |
| src/hyperlight_host/src/mem/layout.rs | Re-documents snapshot size as the guest-visible prefix and decouples it from PT tail bookkeeping. |
| src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs | Adjusts test code to pass the snapshot prefix length into ReadonlySharedMemory::from_bytes. |
ludfjig
force-pushed
the
file_backed_rsm
branch
2 times, most recently
from
June 2, 2026 19:02
3dd6d35 to
f74e189
Compare
simongdavies
previously approved these changes
Jun 2, 2026
simongdavies
left a comment
simongdavies
left a comment
Member
There was a problem hiding this comment.
A couple of comments but otherwise LGTM
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
simongdavies
approved these changes
Jun 2, 2026
ludfjig
pushed a commit
that referenced
this pull request
Oct 14, 2026
Fixes #1508 `guard_page_crash_test` (read/write/exec on the leading guard page of `ExclusiveSharedMemory`) runs on Linux and Windows. It uses the subprocess approach from #1498. What changed: * `test_path`, `run_guard_page_subprocess` and `killed_by_access_violation` live in a small `guard_page_subprocess` test module that both shims use. The bodies are unchanged, so `git diff --color-moved` shows them as a move. * The three tests print `reached_guard` / `survived_guard` around the bad access. The shim reruns the current test binary with `--ignored --exact` for each one. * The module is gated on `all(not(miri), any(target_os = "linux", windows))`. * Removed the `signal-hook-registry` dev-dependency. The SIGSEGV hook in these tests was its only user. A side effect on Linux: the old shim spawned `cargo test` without `--profile`, so under `just test release` it rebuilt and checked a debug binary. Rerunning `current_exe()` keeps the child on the parent's profile and skips the extra build. I left macOS out to match the issue. `from_file_tests` already runs there, but I couldn't check which signal the `exec` case raises on Apple silicon. Happy to widen the gate if you want it. Test-only change, so no changelog entry. Testing (Linux x86_64, KVM host): * `cargo test -p hyperlight-host --lib -- mem::shared_mem::tests`: 28 passed, 5 ignored * `cargo test -p hyperlight-host --profile=release --lib -- guard_page`: both shims pass * Sanity check: with the leading guard page left `PROT_READ | PROT_WRITE`, the shim fails with `survived=true` (reverted afterwards) * rustfmt and clippy: no findings in `shared_mem.rs`. I ran these with a 1.98 toolchain rather than the pinned 1.94 and nightly rustfmt, so CI is the real check. * Not run locally: Windows, macOS, `just miri-tests`, full `just test`. The Windows run comes from CI. Could a maintainer add `kind/enhancement`? I can't set labels from a fork. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: danieltangnes <danieltangnes1@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
ReadonlySharedMemory::from_file(file, guest_mapped_size), a file-backed counterpart to from_bytes. It reserves [guard][blob][guard] with the file mapped over the middle slot: Linux uses a PROT_NONE anonymous reservation with MAP_FIXED, Windows uses a VirtualAlloc2 placeholder split into three with MapViewOfFile3(MEM_REPLACE_PLACEHOLDER). The Windows path uses the WindowsMapping::FileBacked variant added in #1485 so surrogate-process plumbing can tell the two backings apart.ReadonlySharedMemory::from_bytesalso changes from Option to a required usize since no codepath passesNoneThis is currently unused but will be used in the future pr.