Make ELF loading respect program header virtual addresses for non-PIE binaries

.github/workflows/dep_build_guests.yml

@@ -54,14 +54,15 @@ jobs:
         run: |
           sudo chown -R $(id -u):$(id -g) /opt/cargo || true
 
-      # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
+      # cargo-hyperlight builds a custom sysroot for the Hyperlight guest target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
       - name: Sysroot cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: |
             src/tests/rust_guests/target/sysroot
+            src/tests/rust_guests/target-non-pie/sysroot
           key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml') }}
 
       - name: Rust cache
@@ -87,6 +88,11 @@ jobs:
           just build-rust-guests ${{ inputs.config }}
           just move-rust-guests ${{ inputs.config }}
 
+      - name: Build non-PIE Rust guests
+        run: |
+          just build-rust-guests-non-pie ${{ inputs.config }}
+          just move-rust-guests-non-pie ${{ inputs.config }}
+
       - name: Build C guests
         run: |
           just build-c-guests ${{ inputs.config }}
@@ -108,4 +114,3 @@ jobs:
           path: src/tests/c_guests/bin/${{ inputs.config }}/
           retention-days: 1
           if-no-files-found: error
-

.gitignore

@@ -454,6 +454,7 @@ $RECYCLE.BIN/
 
 # Rust build artifacts
 **/**target
+**/**target-non-pie
 libhyperlight_host.so
 libhyperlight_host.d
 hyperlight_host.dll

Justfile

@@ -50,7 +50,7 @@ build target=default-target:
     {{ cargo-cmd }} build --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }}
 
 # build testing guest binaries
-guests: build-and-move-rust-guests build-and-move-c-guests
+guests: build-and-move-rust-guests build-and-move-rust-guests-non-pie build-and-move-c-guests
 
 # Ensure the pinned cargo-hyperlight is installed. We compare the *actual*
 # installed binary's reported version instead of relying on `cargo install`
@@ -75,6 +75,22 @@ build-rust-guests target=default-target features="": (ensure-cargo-hyperlight)
 build-and-move-rust-guests: (build-rust-guests "debug") (move-rust-guests "debug") (build-rust-guests "release") (move-rust-guests "release")
 build-and-move-c-guests: (build-c-guests "debug") (move-c-guests "debug") (build-c-guests "release") (move-c-guests "release")
 
+# Build non-PIE variants of rust guests for testing ELF VA mapping.
+# Phase 1 builds the sysroot without RUSTFLAGS (avoids RUSTFLAGS leaking
+# into the sysroot wrapper build in cargo-hyperlight).
+# Phase 2 uses plain cargo with --sysroot and non-PIE link flags.
+build-rust-guests-non-pie target=default-target: (ensure-cargo-hyperlight)
+    cd src/tests/rust_guests/simpleguest && cargo hyperlight build --target-dir ../target-non-pie --profile={{ if target == "debug" { "dev" } else { target } }}
+    {{ if os() == "windows" { "$env:RUSTC_BOOTSTRAP=1; $env:RUSTFLAGS='--sysroot=' + (Resolve-Path src/tests/rust_guests/target-non-pie/sysroot).Path + ' -C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x1000000 --cfg=hyperlight --check-cfg=cfg(hyperlight) -Clink-args=-eentrypoint';" } else { "" } }} cd src/tests/rust_guests/simpleguest && {{ if os() == "windows" { "" } else { "RUSTC_BOOTSTRAP=1 RUSTFLAGS=\"--sysroot=$(cd .. && pwd)/target-non-pie/sysroot -C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x1000000 --cfg=hyperlight --check-cfg=cfg(hyperlight) -Clink-args=-eentrypoint\"" } }} cargo build --target {{ hyperlight-target }} --target-dir ../target-non-pie/build --profile={{ if target == "debug" { "dev" } else { target } }}
+
+non_pie_guests_target := "src/tests/rust_guests/target-non-pie/build/" + hyperlight-target
+
+@move-rust-guests-non-pie target=default-target:
+    {{ if os() == "windows" { "New-Item -ItemType Directory -Path " + rust_guests_bin_dir + "/" + target + "/non_pie -Force | Out-Null" } else { "mkdir -p " + rust_guests_bin_dir + "/" + target + "/non_pie" } }}
+    cp {{ non_pie_guests_target }}/{{ target }}/simpleguest {{ rust_guests_bin_dir }}/{{ target }}/non_pie/
+
+build-and-move-rust-guests-non-pie: (build-rust-guests-non-pie "debug") (move-rust-guests-non-pie "debug") (build-rust-guests-non-pie "release") (move-rust-guests-non-pie "release")
+
 clean: clean-rust
 
 clean-rust: 

src/hyperlight_host/src/hypervisor/hyperlight_vm/x86_64.rs

@@ -930,7 +930,7 @@ mod tests {
     use crate::hypervisor::regs::{CommonSegmentRegister, CommonTableRegister, MXCSR_DEFAULT};
     use crate::hypervisor::virtual_machine::VirtualMachine;
     use crate::mem::layout::SandboxMemoryLayout;
-    use crate::mem::memory_region::{GuestMemoryRegion, MemoryRegionFlags};
+    use crate::mem::memory_region::MemoryRegionFlags;
     use crate::mem::mgr::{GuestPageTableBuffer, SandboxMemoryManager};
     use crate::mem::ptr::RawPtr;
     use crate::mem::shared_mem::{ExclusiveSharedMemory, ReadonlySharedMemory};
@@ -1494,16 +1494,12 @@ mod tests {
         let pt_base_gpa = layout.get_pt_base_gpa();
         let pt_buf = GuestPageTableBuffer::new(pt_base_gpa as usize);
 
-        for rgn in layout
-            .get_memory_regions_::<GuestMemoryRegion>(())
-            .unwrap()
-            .iter()
-        {
+        for rgn in layout.get_memory_regions().unwrap().iter() {
             let readable = rgn.flags.contains(MemoryRegionFlags::READ);
             let writable = rgn.flags.contains(MemoryRegionFlags::WRITE);
             let executable = rgn.flags.contains(MemoryRegionFlags::EXECUTE);
             let mapping = Mapping {
-                phys_base: rgn.guest_region.start as u64,
+                phys_base: rgn.host_region.start as u64,
                 virt_base: rgn.guest_region.start as u64,
                 len: rgn.guest_region.len() as u64,
                 kind: MappingKind::Basic(BasicMapping {

src/hyperlight_host/src/mem/elf.rs

@@ -17,6 +17,7 @@ limitations under the License.
 #[cfg(feature = "mem_profile")]
 use std::sync::Arc;
 
+use goblin::elf::header::ET_DYN;
 #[cfg(target_arch = "aarch64")]
 use goblin::elf::reloc::{R_AARCH64_NONE, R_AARCH64_RELATIVE};
 #[cfg(target_arch = "x86_64")]
@@ -42,6 +43,8 @@ pub(crate) struct ElfInfo {
     shdrs: Vec<ResolvedSectionHeader>,
     entry: u64,
     relocs: Vec<Reloc>,
+    /// Whether this is a position-independent executable (ET_DYN).
+    is_pie: bool,
     /// The hyperlight version string embedded by `hyperlight-guest-bin`, if
     /// present. Used to detect version/ABI mismatches between guest and host.
     guest_bin_version: Option<String>,
@@ -143,6 +146,7 @@ impl ElfInfo {
                 .collect(),
             entry: elf.entry,
             relocs,
+            is_pie: elf.header.e_type == ET_DYN,
             guest_bin_version,
         })
     }
@@ -168,6 +172,11 @@ impl ElfInfo {
         self.entry
     }
 
+    /// Returns whether this is a position-independent executable (ET_DYN).
+    pub(crate) fn is_pie(&self) -> bool {
+        self.is_pie
+    }
+
     /// Returns the hyperlight version string embedded in the guest binary, if
     /// present. Used to detect version/ABI mismatches between guest and host.
     pub(crate) fn guest_bin_version(&self) -> Option<&str> {

src/hyperlight_host/src/mem/exe.rs

@@ -89,6 +89,12 @@ impl ExeInfo {
             ExeInfo::Elf(elf) => Offset::from(elf.entrypoint_va()),
         }
     }
+    /// Returns whether this is a position-independent executable (ET_DYN).
+    pub fn is_pie(&self) -> bool {
+        match self {
+            ExeInfo::Elf(elf) => elf.is_pie(),
+        }
+    }
     /// Returns the base virtual address of the loaded binary (lowest PT_LOAD p_vaddr).
     pub fn base_va(&self) -> u64 {
         match self {

src/hyperlight_host/src/mem/layout.rs

@@ -66,10 +66,10 @@ use std::mem::size_of;
 use hyperlight_common::mem::{HyperlightPEB, PAGE_SIZE_USIZE};
 use tracing::{Span, instrument};
 
-use super::memory_region::MemoryRegionType::{Code, Heap, InitData, Peb};
+use super::memory_region::MemoryRegionType::{self, Code, Heap, InitData, Peb};
 use super::memory_region::{
-    DEFAULT_GUEST_BLOB_MEM_FLAGS, MemoryRegion, MemoryRegion_, MemoryRegionFlags, MemoryRegionKind,
-    MemoryRegionVecBuilder,
+    DEFAULT_GUEST_BLOB_MEM_FLAGS, GuestMemoryRegion, MemoryRegion, MemoryRegion_,
+    MemoryRegionFlags, MemoryRegionVecBuilder,
 };
 #[cfg(readable_shared_mem)]
 use super::shared_mem::HostSharedMemory;
@@ -469,11 +469,8 @@ impl SandboxMemoryLayout {
 
     /// Returns the memory regions associated with this memory layout,
     /// suitable for passing to a hypervisor for mapping into memory
-    pub(crate) fn get_memory_regions_<K: MemoryRegionKind>(
-        &self,
-        host_base: K::HostBaseType,
-    ) -> Result<Vec<MemoryRegion_<K>>> {
-        let mut builder = MemoryRegionVecBuilder::new(Self::BASE_ADDRESS, host_base);
+    pub(crate) fn get_memory_regions(&self) -> Result<Vec<MemoryRegion_<GuestMemoryRegion>>> {
+        let mut builder = MemoryRegionVecBuilder::new(Self::BASE_ADDRESS, Self::BASE_ADDRESS);
 
         // code
         let peb_offset = builder.push_page_aligned(
@@ -555,6 +552,72 @@ impl SandboxMemoryLayout {
         Ok(builder.build())
     }
 
+    /// Compute the virtual base address for the code region, validate
+    /// that it does not overlap any other memory region, and return the
+    /// guest memory regions with the Code region's `guest_virt_addr`
+    /// already set to the computed virtual base.
+    ///
+    /// For PIE binaries (`is_pie == true`), the code is identity-mapped so
+    /// the virtual base equals the physical load address and no conflict
+    /// is possible by construction.
+    ///
+    /// For non-PIE binaries, the code appears at the ELF's declared
+    /// virtual address (`elf_base_va`), which may differ from the physical
+    /// load address.  This method checks that the resulting virtual range
+    /// `[elf_base_va, elf_base_va + loaded_size)` does not overlap any
+    /// non-Code region.
+    ///
+    /// Returns `(code_virt_base, regions)`.
+    pub(crate) fn get_guest_regions_with_code_va(
+        &self,
+        is_pie: bool,
+        elf_base_va: u64,
+        loaded_size: u64,
+    ) -> Result<(u64, Vec<MemoryRegion_<GuestMemoryRegion>>)> {
+        let load_addr = self.get_guest_code_address() as u64;
+        let code_virt_base = if is_pie { load_addr } else { elf_base_va };
+
+        let mut regions = self.get_memory_regions()?;
+
+        if !is_pie {
+            let code_virt_end = code_virt_base.checked_add(loaded_size).ok_or_else(|| {
+                new_error!(
+                    "Code mapping overflow: base {:#x} + size {:#x}",
+                    code_virt_base,
+                    loaded_size
+                )
+            })?;
+            for rgn in regions.iter() {
+                if rgn.region_type == MemoryRegionType::Code {
+                    continue;
+                }
+                let rgn_start = rgn.guest_region.start as u64;
+                let rgn_end = rgn_start + rgn.guest_region.len() as u64;
+                if code_virt_base < rgn_end && rgn_start < code_virt_end {
+                    return Err(new_error!(
+                        "Non-PIE code mapping [{:#x}, {:#x}) conflicts with {:?} region [{:#x}, {:#x})",
+                        code_virt_base,
+                        code_virt_end,
+                        rgn.region_type,
+                        rgn_start,
+                        rgn_end,
+                    ));
+                }
+            }
+        }
+
+        // Override the Code region's GVA (guest_region) to code_virt_base.
+        // host_region retains the GPA from the builder.
+        for rgn in regions.iter_mut() {
+            if rgn.region_type == MemoryRegionType::Code {
+                let len = rgn.guest_region.len();
+                rgn.guest_region = code_virt_base as usize..(code_virt_base as usize + len);
+            }
+        }
+
+        Ok((code_virt_base, regions))
+    }
+
     #[instrument(err(Debug), skip_all, parent = Span::current(), level= "Trace")]
     pub(crate) fn write_init_data(&self, out: &mut [u8], bytes: &[u8]) -> Result<()> {
         out[self.init_data_offset()..self.init_data_offset() + self.init_data_size]

src/hyperlight_host/src/mem/memory_region.rs

@@ -282,20 +282,26 @@ impl MemoryRegionKind for HostGuestMemoryRegion {
 pub(crate) struct GuestMemoryRegion {}
 
 impl MemoryRegionKind for GuestMemoryRegion {
-    type HostBaseType = ();
+    type HostBaseType = usize;
 
-    fn add(_base: Self::HostBaseType, _size: usize) -> Self::HostBaseType {}
+    fn add(base: Self::HostBaseType, size: usize) -> Self::HostBaseType {
+        base + size
+    }
 }
 
 /// represents a single memory region inside the guest. All memory within a region has
 /// the same memory permissions
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct MemoryRegion_<K: MemoryRegionKind> {
-    /// the range of guest memory addresses
+    /// The range of guest addresses. For `GuestMemoryRegion` this is
+    /// the guest virtual address range (GVA). For `HostGuestMemoryRegion`
+    /// and `CrashDumpMemoryRegion` this is the guest physical address
+    /// range (GPA) or GVA depending on the variant.
     pub guest_region: Range<usize>,
-    /// the range of host memory addresses
-    ///
-    /// Note that Range<()> = () x () = ().
+    /// The range of host-side addresses. For `HostGuestMemoryRegion` this
+    /// is the host virtual address range (HVA). For `GuestMemoryRegion`
+    /// this is the guest physical address range (GPA). For
+    /// `CrashDumpMemoryRegion` this is the HVA.
     pub host_region: Range<K::HostBaseType>,
     /// memory access flags for the given region
     pub flags: MemoryRegionFlags,
@@ -367,8 +373,9 @@ impl<K: MemoryRegionKind> MemoryRegionVecBuilder<K> {
         // we know this is safe because we check if the regions are empty above
         let last_region = self.regions.last().unwrap();
         let host_end = <K as MemoryRegionKind>::add(last_region.host_region.end, size);
+        let guest_start = last_region.guest_region.end;
         let new_region = MemoryRegion_ {
-            guest_region: last_region.guest_region.end..last_region.guest_region.end + size,
+            guest_region: guest_start..guest_start + size,
             host_region: last_region.host_region.end..host_end,
             flags,
             region_type,

src/hyperlight_host/src/mem/mgr.rs

@@ -147,6 +147,10 @@ pub(crate) struct SandboxMemoryManager<S: SharedMemory> {
     /// preserved across the `Initialise` -> `Call` transition so it
     /// can fill `AT_ENTRY` in guest core dumps. 0 if unknown.
     pub(crate) original_entrypoint: u64,
+    /// Virtual base address of the code region.
+    /// For PIE binaries this equals the physical load address (identity-mapped).
+    /// For non-PIE binaries this is the ELF-declared base VA.
+    pub(crate) code_virt_base: u64,
     /// Buffer for accumulating guest abort messages
     pub(crate) abort_buffer: Vec<u8>,
     /// Generation counter: how many snapshots have been taken from
@@ -288,6 +292,7 @@ where
             scratch_mem,
             next_action,
             original_entrypoint: 0,
+            code_virt_base: 0,
             abort_buffer: Vec::new(),
             snapshot_count: 0,
         }
@@ -323,6 +328,7 @@ where
             #[cfg(target_arch = "x86_64")]
             msrs,
             next_action,
+            self.code_virt_base,
             self.original_entrypoint,
             self.snapshot_count,
             host_functions,
@@ -338,6 +344,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
         let next_action = s.next_action();
         let mut mgr = Self::new(layout, shared_mem, scratch_mem, next_action);
         mgr.original_entrypoint = s.original_entrypoint();
+        mgr.code_virt_base = s.code_virt_base;
         // Inherit the snapshot's generation number for the same
         // reason `restore_snapshot` does: the guest-visible counter
         // reflects "which snapshot is the sandbox currently a clone
@@ -370,6 +377,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             layout: self.layout,
             next_action: self.next_action,
             original_entrypoint: self.original_entrypoint,
+            code_virt_base: self.code_virt_base,
             abort_buffer: self.abort_buffer,
             snapshot_count: self.snapshot_count,
         };
@@ -379,6 +387,7 @@ impl SandboxMemoryManager<ExclusiveSharedMemory> {
             layout: self.layout,
             next_action: self.next_action,
             original_entrypoint: self.original_entrypoint,
+            code_virt_base: self.code_virt_base,
             abort_buffer: Vec::new(), // Guest doesn't need abort buffer
             snapshot_count: self.snapshot_count,
         };
@@ -519,6 +528,7 @@ impl SandboxMemoryManager<HostSharedMemory> {
         // Carry the guest ELF entry point across restore so crashdumps
         // report the restored image's entry.
         self.original_entrypoint = snapshot.original_entrypoint();
+        self.code_virt_base = snapshot.code_virt_base;
 
         self.update_scratch_bookkeeping()?;
         Ok((gsnapshot, gscratch))