Repository navigation
Conversation
andreiltd
added this pull request to stack #1897
October 7, 2026 18:22
andreiltd
added
the
kind/enhancement
andreiltd
marked this pull request as ready for review
October 7, 2026 18:23
andreiltd
requested review from
danbugs,
dblnz,
devigned,
jprendes,
jsturtevant,
ludfjig,
simongdavies,
squillace and
syntactically
as code owners
October 7, 2026 18:23
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
4 open findings
VirtqSnapshot::capture(...)is invoked purely for validation and its result is discarded. If… · Newdispatch_guest_call_restrictedalways restores the mode toUnrestricted, which can silently… · New
What changed in this PR
Introduces a host-side execution mode to restrict what guest operations are accepted during snapshot checkpointing, primarily to prevent guest→host function calls during the checkpoint window.
Changes:
- Added
ExecutionModetoSandboxMemoryManagerand threaded it into outbound virtqueue handling. - Switched snapshot checkpoint dispatch to a restricted guest-execution path.
- Added post-checkpoint validation of virtqueue/mailbox state and documented the behavior in the changelog.
| File | Description |
|---|---|
| src/hyperlight_host/src/sandbox/outb.rs | Rejects guest host-function requests during restricted execution mode. |
| src/hyperlight_host/src/sandbox/initialized.rs | Dispatches guest execution in restricted mode during snapshot checkpointing. |
| src/hyperlight_host/src/mem/mgr.rs | Adds ExecutionMode state and validates virtqueues/mailbox after checkpoint. |
| CHANGELOG.md | Documents restricted host-call behavior and added validation during checkpoints. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This comment has been minimized.
This comment has been minimized.
andreiltd
force-pushed
the
virtq-restricted-checkpoint
branch
2 times, most recently
from
October 7, 2026 19:37
942a49b to
8c55f9d
Compare
This comment has been minimized.
This comment has been minimized.
ludfjig
approved these changes
Oct 7, 2026
ludfjig
left a comment
ludfjig
left a comment
Contributor
There was a problem hiding this comment.
lgtm. Should we prevent any other outb as well you think or is this sufficient? (debug print, tracing)?
ludfjig
requested changes
Oct 7, 2026
Contributor
There was a problem hiding this comment.
Actually I think we need to reset the mode in restore(). If dispatch panics during the checkpoint, the reset line is skipped and the sandbox stays Restricted even after a restore. Maybe a test for this would be good as well (unless hard to repro).
andreiltd
force-pushed
the
virtq-restricted-checkpoint
branch
from
October 8, 2026 08:39
8c55f9d to
be8b588
Compare
Benchmark ResultsMeasured commit: kvm / amd (Linux) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
kvm / intel (Linux) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
mshv3 / amd (Linux) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
mshv3 / intel (Linux) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
hyperv-ws2025 / amd (Windows) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
hyperv-ws2025 / intel (Windows) (➖ stable)No benchmark improved or regressed. Benchmark Resultsfunction_call_codec
payload_allocation
sandboxes
slot_pool
snapshot_files
virtq_readonly
virtq_readwrite
Reported by |
andreiltd
force-pushed
the
virtq-restricted-checkpoint
branch
from
October 8, 2026 09:34
be8b588 to
925741c
Compare
syntactically
previously approved these changes
Oct 8, 2026
| self.g2h_consumer = None; | ||
| self.h2g_consumer = None; | ||
|
|
||
| // A panic during restricted dispatch can skip the mode reset. |
Member
There was a problem hiding this comment.
I'm probably missing something obvious, but why can this happen? I see that dispatch_guest_call_restricted will still do the reset even if dispatch_guest_call returns Err(...), and I thought a guest call would show up there as Err(HyperlightError::GuestAborted(...)).
Contributor
There was a problem hiding this comment.
This is referring to panic in host. But yeah as I don't think we have any promises if host panics, this might be overly cautions.
Keep transport pools and aliases stable. Pin pages backing live buffers and exclude overlapping slots until a checkpoint finds those pages empty. Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>
Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>
This patch introduces the execution mode on the host and allows call guest function and prohibit the guest to call host functions. The only user of this mode is snapshotting for now. Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>
andreiltd
force-pushed
the
virtq-restricted-checkpoint
branch
from
October 8, 2026 21:47
925741c to
926a925
Compare
ludfjig
approved these changes
Oct 9, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This patch introduces the execution mode on the host and allows call guest function and prohibit the guest to call host functions. The only user of this mode is snapshotting for now.
Closes: #1883