diff --git a/CHANGELOG.md b/CHANGELOG.md index 21ecfcb42..9eac2ff63 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,93 +5,68 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Prerelease] - Unreleased ### Added -* Namespaced application metadata on immutable snapshots. -* Guest paging operations and AArch64 system-register macros in `hyperlight-guest`. -* Per-direction virtqueue configuration through `SandboxConfiguration` and - `SandboxBuilder`, with allocations included in scratch sizing. -* Shared virtqueue framing with a 12-byte `MsgHeader` and external byte values. -* `MailboxValue` defines the transport mailbox's allowed wire values. -* `virtq::canonical::validate_canon_prefix` validates a bounded available - descriptor prefix. -* `ExternalValueSource` implementations for `RecvChain` and `Segments`. -* Producer batch completion without notification and segmented payload - assembly and extraction without flattening. -* Retained guest `Bytes` and `ByteChunks` preserve contents and pointers across - snapshot capture, restore, and cloning. ### Changed -* Guest transport aliases follow buffer ownership. Restored buffers keep - captured backing while their scratch slots become reusable. -* `Sandbox` is the primary initialized sandbox type. `MultiUseSandbox` remains - as a deprecated alias. -* `Sandbox` lives in the private `sandbox::initialized` module and is reached - through `hyperlight_host::Sandbox` or `hyperlight_host::sandbox::Sandbox`. - `sandbox::initialized_multi_use` remains as a deprecated public path. -* C guests may omit `c_guest_dispatch_function` when they do not need custom - fallback dispatch. -* Support overriding the guest log level when building or restoring initialized - snapshots. -* Expose C guest `ByteChunks` values as pointer and length arrays. -* Return typed `hl_ReturnValue` objects from C guest functions through - `hl_result_from_*` constructors. -* Guest tracing skips its per-call and per-callsite work while the guest log - level is `OFF`. `hyperlight_guest_tracing::is_trace_enabled` reports whether - the configured level is above `OFF` rather than whether the tracing state was - allocated. -* **Breaking:** Virtqueue rings and pools occupy host-owned scratch before page - tables. Retained-buffer checkpoints use ABI 6 and config schema v3. Existing - snapshots must be regenerated. -* Host virtqueue access uses checked copies and atomics across mapped scratch. - Snapshot admission checks geometry, canonical rings, and distinct, aligned - H2G pool slots. - Consumers validate descriptors and payload accesses during use. -* Virtqueue producers use concrete `SlotPool` allocation and `BufferLease` - ownership. `BufferMap` supplies complete owners exposing initialized bytes. -* `VirtqProducer::reset` and `GuestContext::prepare_snapshot` are unsafe. - Peers must stay stopped with no live consumer-side chain handles until - their consumers are reset or replaced. -* `ChainBuilder::build()` allocates readable and writable requests. - `writable_avail()` reserves available upper-tier slots within the descriptor - budget. It may add zero slots to a nonempty chain. -* Require guest logs and all host and guest function calls to use virtqueues. -* Keep registered Rust guest return values typed until transport encoding so - external byte results avoid intermediate FlatBuffer copies. -* Store canonical virtqueue rings in versioned OCI transport layers. Config v3 - rejects snapshots without transport state. -* Running snapshots checkpoint dirty virtqueues before capture. Ordinary calls - keep their deferred result path. -* Snapshot checkpoints reject host function calls. Violations poison the - sandbox. -* Use the reclaimed stack pages to raise the default G2H and H2G pools to 12 - and 8 pages. -* `hyperlight_guest_bin::exception::arch`, previously available on - amd64 only, has been deprecated in favour of new - architecture-independent exception handling hooks. The new - interfaces are significantly more liminited, but more portable; they - will be extended in the future. -* MSHV: vCPU creation reads the partition's XSAVE format once. This removes - one hypercall from every restore. ### Removed -* `RunPool` and the run-specific `AllocError::InvalidAlign` variant. -* Remove legacy stack I/O, its `GuestHandle` methods, and its sandbox - configuration and builder options. -* Embedded byte payload tables and their value-union variants. ### Fixed -* Reserve 48 KiB for guest exception stacks and metadata to cover debug paging walks. -* AMD64 exception handlers clear the direction flag before calling Rust. -* Linear-time segment consumption for fragmented virtqueue messages. -* Allow reclaimed virtqueue completions to span multiple ring reuse cycles. -* Virtqueue consumers return errors when payload copies or runtime bookkeeping - cannot be allocated. -* Use a 16 KiB-aligned default scratch size for Apple Silicon compatibility. -* Guest virtqueue copies reject overlapping buffers before accessing memory. -* Keep sandboxes usable after an H2G request exceeds available virtqueue capacity. -* Snapshot checkpoints ignore idle cancellation and clear partial abort state. -* Keep sandboxes usable when G2H calls exhaust reply capacity. -* Reject incompatible transport snapshots before changing sandbox state. -* Allow guest host-return conversions to call or log to the host. + +## [v0.18.0] - 2026-10-13 + +### Added +* Windows on ARM64 support using the WHP backend by @cshung in https://github.com/hyperlight-dev/hyperlight/pull/1638 +* Virtqueue-based host-guest communication. Per-direction virtqueue configuration is available through `SandboxConfiguration` and `SandboxBuilder`, with allocations included in scratch sizing by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 and https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Shared virtqueue framing with a 12-byte `MsgHeader` and external byte values, plus `ExternalValueSource` implementations for `RecvChain` and `Segments` by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1792, https://github.com/hyperlight-dev/hyperlight/pull/1793, and https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Producer batch completion without notification, and segmented payload assembly and extraction without flattening by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 and https://github.com/hyperlight-dev/hyperlight/pull/1794 +* `MailboxValue`, which defines the transport mailbox's allowed wire values, and `virtq::canonical::validate_canon_prefix`, which validates a bounded available descriptor prefix by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1891 +* Retained guest `Bytes` and `ByteChunks` preserve contents and pointers across snapshot capture, restore, and cloning by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1891 +* Namespaced application metadata on immutable snapshots by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1860 +* Support overriding the guest log level when building or restoring initialized snapshots by @jprendes in https://github.com/hyperlight-dev/hyperlight/pull/1833 +* Guest paging operations and AArch64 system-register macros in `hyperlight-guest` by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1889 +* Architecture-independent page fault and undefined instruction exception hooks in `hyperlight-guest-bin` by @syntactically in https://github.com/hyperlight-dev/hyperlight/pull/1877 +* Guest virtual memory support for lazily zero-initialized regions and in-place mapping modification by @syntactically in https://github.com/hyperlight-dev/hyperlight/pull/1873 and https://github.com/hyperlight-dev/hyperlight/pull/1874 + +### Changed +* **Breaking:** All guest logs and host and guest function calls now go through virtqueues. Virtqueue rings and pools occupy host-owned scratch before page tables, and canonical virtqueue rings are stored in versioned OCI transport layers. Retained-buffer checkpoints use ABI 6 and config schema v3, which rejects snapshots without transport state. Existing snapshots must be regenerated by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793, https://github.com/hyperlight-dev/hyperlight/pull/1794, and https://github.com/hyperlight-dev/hyperlight/pull/1891 +* **Breaking:** `VirtqProducer::reset` and `GuestContext::prepare_snapshot` are unsafe. Peers must stay stopped with no live consumer-side chain handles until their consumers are reset or replaced by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 and https://github.com/hyperlight-dev/hyperlight/pull/1794 +* **Breaking:** Snapshot checkpoints reject host function calls. Violations poison the sandbox by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1896 +* `Sandbox` is the primary initialized sandbox type and is reached through `hyperlight_host::Sandbox` or `hyperlight_host::sandbox::Sandbox`. `MultiUseSandbox` remains as a deprecated alias, and `sandbox::initialized_multi_use` remains as a deprecated public path by @jprendes in https://github.com/hyperlight-dev/hyperlight/pull/1866 +* `hyperlight_guest_bin::exception::arch`, previously available on amd64 only, has been deprecated in favour of the new architecture-independent exception handling hooks. The new interfaces are significantly more limited, but more portable; they will be extended in the future by @syntactically in https://github.com/hyperlight-dev/hyperlight/pull/1877 +* ELF loading respects program header virtual addresses for non-PIE guest binaries by @cshung in https://github.com/hyperlight-dev/hyperlight/pull/1530 +* Host virtqueue access uses checked copies and atomics across mapped scratch. Snapshot admission checks geometry, canonical rings, and distinct, aligned H2G pool slots. Consumers validate descriptors and payload accesses during use by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 and https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Virtqueue producers use concrete `SlotPool` allocation and `BufferLease` ownership. `BufferMap` supplies complete owners exposing initialized bytes by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 +* `ChainBuilder::build()` allocates readable and writable requests. `writable_avail()` reserves available upper-tier slots within the descriptor budget. It may add zero slots to a nonempty chain by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 +* Guest transport aliases follow buffer ownership. Restored buffers keep captured backing while their scratch slots become reusable by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1891 +* Running snapshots checkpoint dirty virtqueues before capture. Ordinary calls keep their deferred result path by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Keep registered Rust guest return values typed until transport encoding so external byte results avoid intermediate FlatBuffer copies by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Use the reclaimed stack pages to raise the default G2H and H2G pools to 12 and 8 pages by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* C guests may omit `c_guest_dispatch_function` when they do not need custom fallback dispatch by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1848 +* Expose C guest `ByteChunks` values as pointer and length arrays, and return typed `hl_ReturnValue` objects from C guest functions through `hl_result_from_*` constructors by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1792 +* Guest tracing skips its per-call and per-callsite work while the guest log level is `OFF`. `hyperlight_guest_tracing::is_trace_enabled` reports whether the configured level is above `OFF` rather than whether the tracing state was allocated by @jprendes in https://github.com/hyperlight-dev/hyperlight/pull/1840 +* MSHV: vCPU creation reads the partition's XSAVE format once. This removes one hypercall from every restore by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1912 + +### Removed +* Legacy stack I/O, its `GuestHandle` methods, and its sandbox configuration and builder options by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Embedded byte payload tables and their value-union variants by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* `RunPool` and the run-specific `AllocError::InvalidAlign` variant by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 + +### Fixed +* Reserve 48 KiB for guest exception stacks and metadata to cover debug paging walks by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1891 +* AMD64 exception handlers clear the direction flag before calling Rust by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1882 +* Use a stronger TLB invalidation barrier when updating guest page tables by @syntactically in https://github.com/hyperlight-dev/hyperlight/pull/1876 +* The `gdb` feature is now a no-op in release builds by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1886 +* Use checked arithmetic and conversions in `push_buffer` as defense in depth by @JM00NJ in https://github.com/hyperlight-dev/hyperlight/pull/1820 and https://github.com/hyperlight-dev/hyperlight/pull/1825 +* Use a 16 KiB-aligned default scratch size for Apple Silicon compatibility by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 +* Guest virtqueue copies reject overlapping buffers before accessing memory by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1793 +* Linear-time segment consumption for fragmented virtqueue messages by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Allow reclaimed virtqueue completions to span multiple ring reuse cycles by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Virtqueue consumers return errors when payload copies or runtime bookkeeping cannot be allocated by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Keep sandboxes usable after an H2G request exceeds available virtqueue capacity, or when G2H calls exhaust reply capacity by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Snapshot checkpoints ignore idle cancellation and clear partial abort state by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Reject incompatible transport snapshots before changing sandbox state by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* Allow guest host-return conversions to call or log to the host by @andreiltd in https://github.com/hyperlight-dev/hyperlight/pull/1794 +* `Sandbox::from_snapshot` now honours the guest log level set via `SandboxConfiguration::set_max_guest_log_level` instead of ignoring it and falling back to `RUST_LOG` by @sethryanrollins in https://github.com/hyperlight-dev/hyperlight/pull/1699 ## [v0.17.0] - 2026-08-27 @@ -121,7 +96,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). * Reset XCR0 during x86 snapshot restore by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1718 * Reseed guest libc `rand()` and `random()` after restoring a snapshot to avoid multiple sandboxes sharing PRNG state by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/1667 * Validate ELF program headers in `ElfInfo::new()` to prevent host process abort from malformed guest binaries. PT_LOAD segments are now bounds-checked, `base_va`/`va_size` are stored as fields, and `load_at()` uses fully checked arithmetic by @danbugs -* `MultiUseSandbox::from_snapshot` now honours the guest log level set via `SandboxConfiguration::set_max_guest_log_level` instead of ignoring it and falling back to `RUST_LOG` by @sethryanrollins in https://github.com/hyperlight-dev/hyperlight/pull/1699 ## [v0.16.0] - 2026-06-26 @@ -442,7 +416,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The Initial Hyperlight Release 🎉 -[Prerelease]: +[Prerelease]: +[v0.18.0]: [v0.17.0]: [v0.16.0]: [v0.15.0]: diff --git a/Cargo.lock b/Cargo.lock index 618511ff9..b4965f646 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1633,7 +1633,7 @@ dependencies = [ [[package]] name = "hyperlight-common" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "arbitrary", @@ -1657,7 +1657,7 @@ dependencies = [ [[package]] name = "hyperlight-component-macro" -version = "0.17.0" +version = "0.18.0" dependencies = [ "env_logger", "hyperlight-component-util", @@ -1670,7 +1670,7 @@ dependencies = [ [[package]] name = "hyperlight-component-util" -version = "0.17.0" +version = "0.18.0" dependencies = [ "itertools 0.15.0", "prettyplease 0.3.0", @@ -1696,7 +1696,7 @@ dependencies = [ [[package]] name = "hyperlight-guest" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "flatbuffers", @@ -1709,7 +1709,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-bin" -version = "0.17.0" +version = "0.18.0" dependencies = [ "buddy_system_allocator", "flatbuffers", @@ -1726,7 +1726,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-macro" -version = "0.17.0" +version = "0.18.0" dependencies = [ "proc-macro-crate", "proc-macro2", @@ -1736,7 +1736,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-tracing" -version = "0.17.0" +version = "0.18.0" dependencies = [ "hyperlight-common", "spin 0.12.3", @@ -1746,7 +1746,7 @@ dependencies = [ [[package]] name = "hyperlight-host" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "bindgen", @@ -1823,7 +1823,7 @@ dependencies = [ [[package]] name = "hyperlight-libc" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "bindgen", @@ -1848,7 +1848,7 @@ dependencies = [ [[package]] name = "hyperlight_guest_capi" -version = "0.17.0" +version = "0.18.0" dependencies = [ "cbindgen", "flatbuffers", diff --git a/Cargo.toml b/Cargo.toml index 0b1c83201..60ee2443d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -28,7 +28,7 @@ exclude = [ ] [workspace.package] -version = "0.17.0" +version = "0.18.0" edition = "2024" rust-version = "1.89" license = "Apache-2.0" @@ -37,16 +37,16 @@ repository = "https://github.com/hyperlight-dev/hyperlight" readme = "README.md" [workspace.dependencies] -hyperlight-common = { path = "src/hyperlight_common", version = "0.17.0", default-features = false } -hyperlight-host = { path = "src/hyperlight_host", version = "0.17.0", default-features = false } -hyperlight-guest = { path = "src/hyperlight_guest", version = "0.17.0", default-features = false } -hyperlight-guest-bin = { path = "src/hyperlight_guest_bin", version = "0.17.0", default-features = false } -hyperlight-guest-macro = { path = "src/hyperlight_guest_macro", version = "0.17.0", default-features = false } +hyperlight-common = { path = "src/hyperlight_common", version = "0.18.0", default-features = false } +hyperlight-host = { path = "src/hyperlight_host", version = "0.18.0", default-features = false } +hyperlight-guest = { path = "src/hyperlight_guest", version = "0.18.0", default-features = false } +hyperlight-guest-bin = { path = "src/hyperlight_guest_bin", version = "0.18.0", default-features = false } +hyperlight-guest-macro = { path = "src/hyperlight_guest_macro", version = "0.18.0", default-features = false } hyperlight-testing = { path = "src/hyperlight_testing", default-features = false } -hyperlight-guest-tracing = { path = "src/hyperlight_guest_tracing", version = "0.17.0", default-features = false } -hyperlight-libc = { path = "src/hyperlight_libc", version = "0.17.0", default-features = false } -hyperlight-component-util = { path = "src/hyperlight_component_util", version = "0.17.0", default-features = false } -hyperlight-component-macro = { path = "src/hyperlight_component_macro", version = "0.17.0", default-features = false } +hyperlight-guest-tracing = { path = "src/hyperlight_guest_tracing", version = "0.18.0", default-features = false } +hyperlight-libc = { path = "src/hyperlight_libc", version = "0.18.0", default-features = false } +hyperlight-component-util = { path = "src/hyperlight_component_util", version = "0.18.0", default-features = false } +hyperlight-component-macro = { path = "src/hyperlight_component_macro", version = "0.18.0", default-features = false } [workspace.lints.rust] unsafe_op_in_unsafe_fn = "deny" diff --git a/src/tests/rust_guests/Cargo.lock b/src/tests/rust_guests/Cargo.lock index 108f75b9d..14c069827 100644 --- a/src/tests/rust_guests/Cargo.lock +++ b/src/tests/rust_guests/Cargo.lock @@ -235,7 +235,7 @@ dependencies = [ [[package]] name = "hyperlight-common" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "bitflags 2.13.1", @@ -252,7 +252,7 @@ dependencies = [ [[package]] name = "hyperlight-component-macro" -version = "0.17.0" +version = "0.18.0" dependencies = [ "env_logger", "hyperlight-component-util", @@ -265,7 +265,7 @@ dependencies = [ [[package]] name = "hyperlight-component-util" -version = "0.17.0" +version = "0.18.0" dependencies = [ "itertools", "prettyplease", @@ -281,7 +281,7 @@ dependencies = [ [[package]] name = "hyperlight-guest" -version = "0.17.0" +version = "0.18.0" dependencies = [ "anyhow", "flatbuffers", @@ -294,7 +294,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-bin" -version = "0.17.0" +version = "0.18.0" dependencies = [ "buddy_system_allocator", "flatbuffers", @@ -310,7 +310,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-macro" -version = "0.17.0" +version = "0.18.0" dependencies = [ "proc-macro-crate", "proc-macro2", @@ -320,7 +320,7 @@ dependencies = [ [[package]] name = "hyperlight-guest-tracing" -version = "0.17.0" +version = "0.18.0" dependencies = [ "hyperlight-common", "spin 0.12.3",