feat: restrict guest capabilities during snapshot checkpoint by andreiltd · Pull Request #1896 · hyperlight-dev/hyperlight

andreiltd · 2026-10-07T18:22:20Z

This patch introduces the execution mode on the host and allows call guest function and prohibit the guest to call host functions. The only user of this mode is snapshotting for now.

Closes: #1883

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open findings

VirtqSnapshot::capture(...) is invoked purely for validation and its result is discarded. If… · New
dispatch_guest_call_restricted always restores the mode to Unrestricted, which can silently… · New
This introduces new security/behavioral enforcement (rejecting guest host-function calls during… · New
This error lacks actionable context for debugging (e.g., which host function ID/name was attempted,… · New

What changed in this PR

Introduces a host-side execution mode to restrict what guest operations are accepted during snapshot checkpointing, primarily to prevent guest→host function calls during the checkpoint window.

Changes:

Added ExecutionMode to SandboxMemoryManager and threaded it into outbound virtqueue handling.
Switched snapshot checkpoint dispatch to a restricted guest-execution path.
Added post-checkpoint validation of virtqueue/mailbox state and documented the behavior in the changelog.

File	Description
src/hyperlight_host/src/sandbox/outb.rs	Rejects guest host-function requests during restricted execution mode.
src/hyperlight_host/src/sandbox/initialized.rs	Dispatches guest execution in restricted mode during snapshot checkpointing.
src/hyperlight_host/src/mem/mgr.rs	Adds `ExecutionMode` state and validates virtqueues/mailbox after checkpoint.
CHANGELOG.md	Documents restricted host-call behavior and added validation during checkpoints.

🧠 Review effort: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

ludfjig

lgtm. Should we prevent any other outb as well you think or is this sufficient? (debug print, tracing)?

ludfjig

Actually I think we need to reset the mode in restore(). If dispatch panics during the checkpoint, the reset line is skipped and the sandbox stays Restricted even after a restore. Maybe a test for this would be good as well (unless hard to repro).

syntactically

LGTM

This patch introduces the execution mode on the host and allows call guest function and prohibit the guest to call host functions. The only user of this mode is snapshotting for now. Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>

hyperlight-gh-bot · 2026-10-13T13:15:41Z

Benchmark Results

Measured commit: b2e8495478d6
Baseline commit: f24ef059dacc

kvm / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`775.78 ns` (➖ 1.03x slower)
`vec_bytes`	`583.05 ns` (➖ 1.00x slower)
		`382.22 µs` (➖ 1.02x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`523.06 ns` (➖ 1.01x faster)
`65536`	`142.02 ns` (➖ 1.00x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`81.09 ms` (➖ 1.02x slower)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`7.78 ns` (➖ 1.00x slower)	`7.78 ns` (➖ 1.00x slower)	`7.78 ns` (➖ 1.00x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`93.00 µs` (➖ 1.00x slower)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`7.49 µs` (➖ 1.07x slower)	`7.17 µs` (➖ 1.00x slower)
`65536`	`2.07 µs` (➖ 1.07x slower)	`1.93 µs` (➖ 1.10x faster)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`6.35 µs` (➖ 1.01x faster)	`6.26 µs` (➖ 1.00x faster)
`8192`	`1.09 µs` (➖ 1.02x slower)	`1.16 µs` (➖ 1.08x slower)
`262144`		`27.33 µs` (➖ 1.01x faster)

kvm / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`672.03 ns` (➖ 1.02x faster)
`vec_bytes`	`514.30 ns` (➖ 1.10x faster)
		`677.09 µs` (➖ 1.02x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`496.48 ns` (➖ 1.03x faster)
`65536`	`134.26 ns` (➖ 1.02x faster)

sandboxes

	`create_initialized_and_drop`
`medium`	`78.42 ms` (➖ 1.02x faster)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`7.12 ns` (➖ 1.03x slower)	`7.07 ns` (➖ 1.03x slower)	`7.06 ns` (➖ 1.03x slower)

snapshot_files

	`load_snapshot_unverified`
`small`	`46.99 µs` (➖ 1.07x slower)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`7.63 µs` (➖ 1.01x slower)	`7.52 µs` (➖ 1.00x faster)
`65536`	`2.14 µs` (➖ 1.02x faster)	`2.20 µs` (➖ 1.04x slower)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`7.13 µs` (➖ 1.02x faster)	`7.08 µs` (➖ 1.02x faster)
`8192`	`758.98 ns` (➖ 1.04x faster)	`751.96 ns` (➖ 1.01x slower)
`262144`		`29.42 µs` (➖ 1.09x faster)

mshv3 / amd (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`969.79 ns` (➖ 1.01x faster)
`vec_bytes`	`732.19 ns` (➖ 1.03x slower)
		`315.59 µs` (➖ 1.06x faster)

payload_allocation

	`slot_pool_segmented`
`262144`	`721.87 ns` (➖ 1.01x slower)
`65536`	`191.59 ns` (➖ 1.01x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`60.28 ms` (➖ 1.01x faster)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`9.41 ns` (➖ 1.01x faster)	`9.60 ns` (➖ 1.00x slower)	`9.49 ns` (➖ 1.03x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`86.16 µs` (➖ 1.02x faster)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`10.86 µs` (➖ 1.02x slower)	`9.59 µs` (➖ 1.02x slower)
`65536`	`2.42 µs` (➖ 1.03x faster)	`2.22 µs` (➖ 1.01x faster)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`8.48 µs` (➖ 1.14x faster)	`8.51 µs` (➖ 1.13x faster)
`8192`	`1.26 µs` (➖ 1.03x faster)	`1.24 µs` (➖ 1.01x faster)
`262144`		`36.21 µs` (➖ 1.06x faster)

mshv3 / intel (Linux) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`906.15 ns` (➖ 1.02x faster)
`vec_bytes`	`667.79 ns` (➖ 1.02x slower)
		`772.09 µs` (➖ 1.01x faster)

payload_allocation

	`slot_pool_segmented`
`262144`	`647.87 ns` (➖ 1.01x slower)
`65536`	`170.29 ns` (➖ 1.00x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`65.40 ms` (➖ 1.02x faster)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`9.55 ns` (➖ 1.00x slower)	`9.43 ns` (➖ 1.00x slower)	`9.06 ns` (➖ 1.01x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`45.73 µs` (➖ 1.02x slower)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`7.94 µs` (➖ 1.01x slower)	`7.93 µs` (➖ 1.01x slower)
`65536`	`2.29 µs` (➖ 1.02x slower)	`2.26 µs` (➖ 1.02x slower)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`7.61 µs` (➖ 1.00x slower)	`7.51 µs` (➖ 1.02x faster)
`8192`	`922.91 ns` (➖ 1.04x faster)	`932.90 ns` (➖ 1.03x slower)
`262144`		`37.87 µs` (➖ 1.07x faster)

hyperv-ws2025 / amd (Windows) (❌ 2.05x)

Top regressions

payload_allocation/slot_pool_segmented/262144 — ❌ 2.05x slower

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`1.22 µs` (➖ 1.04x slower)
`vec_bytes`	`808.06 ns` (➖ 1.00x slower)
		`2.27 ms` (➖ 1.01x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`1.62 µs` (❌ 2.05x slower)
`65536`	`246.88 ns` (➖ 1.06x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`96.68 ms` (➖ 1.04x faster)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`10.36 ns` (➖ 1.09x faster)	`10.41 ns` (➖ 1.01x faster)	`10.07 ns` (➖ 1.01x faster)

snapshot_files

	`load_snapshot_unverified`
`small`	`1.05 ms` (➖ 1.36x slower)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`9.31 µs` (➖ 1.00x faster)	`9.06 µs` (➖ 1.00x faster)
`65536`	`2.36 µs` (➖ 1.02x faster)	`2.36 µs` (➖ 1.00x slower)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`8.74 µs` (➖ 1.06x faster)	`9.46 µs` (➖ 1.07x slower)
`8192`	`1.33 µs` (➖ 1.04x faster)	`1.31 µs` (➖ 1.01x slower)
`262144`		`48.91 µs` (➖ 1.21x slower)

hyperv-ws2025 / intel (Windows) (➖ stable)

No benchmark improved or regressed.

Benchmark Results

function_call_codec

	`encode_control`	`decode_vec_bytes_copy`
`byte_chunks`	`977.46 ns` (➖ 1.02x slower)
`vec_bytes`	`623.22 ns` (➖ 1.04x faster)
		`3.65 ms` (➖ 1.01x slower)

payload_allocation

	`slot_pool_segmented`
`262144`	`650.91 ns` (➖ 1.01x faster)
`65536`	`184.26 ns` (➖ 1.01x slower)

sandboxes

	`create_initialized_and_drop`
`medium`	`129.45 ms` (➖ 1.08x faster)

slot_pool

	`alloc_dealloc_1500`	`alloc_dealloc_4096`	`alloc_dealloc_128`
	`8.56 ns` (➖ 1.02x slower)	`8.49 ns` (➖ 1.02x slower)	`8.69 ns` (➖ 1.04x slower)

snapshot_files

	`load_snapshot_unverified`
`small`	`456.85 µs` (➖ 1.22x slower)

virtq_readonly

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`262144`	`8.44 µs` (➖ 1.02x slower)	`8.40 µs` (➖ 1.02x faster)
`65536`	`2.46 µs` (➖ 1.02x slower)	`2.45 µs` (➖ 1.01x faster)

virtq_readwrite

	`slot_pool_segmented_fragmented`	`slot_pool_segmented`
`65536`	`8.95 µs` (➖ 1.01x slower)	`8.87 µs` (➖ 1.00x faster)
`8192`	`1.11 µs` (➖ 1.01x slower)	`1.09 µs` (➖ 1.00x slower)
`262144`		`33.63 µs` (➖ 1.01x slower)

_{Reported by cargo ci bench-report --candidate run:38397718290 --config-file bench_report.toml.}

andreiltd added this pull request to stack #1897 October 7, 2026 18:22

andreiltd added the kind/enhancement For PRs adding features, improving functionality, docs, tests, etc. label Oct 7, 2026

andreiltd marked this pull request as ready for review October 7, 2026 18:23

Copilot AI balanced review requested due to automatic review settings October 7, 2026 18:23

andreiltd requested review from danbugs, dblnz, devigned, jprendes, jsturtevant, ludfjig, simongdavies, squillace and syntactically as code owners October 7, 2026 18:23

Copilot started reviewing on behalf of andreiltd October 7, 2026 18:39 View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

Comment thread src/hyperlight_host/src/mem/mgr.rs Outdated

Comment thread src/hyperlight_host/src/sandbox/initialized.rs Outdated

Comment thread src/hyperlight_host/src/sandbox/outb.rs

Comment thread src/hyperlight_host/src/sandbox/outb.rs

This comment has been minimized.

Sign in to view

andreiltd force-pushed the virtq-restricted-checkpoint branch 2 times, most recently from 942a49b to 8c55f9d Compare October 7, 2026 19:37

This comment has been minimized.

Sign in to view

ludfjig approved these changes Oct 7, 2026

View reviewed changes

ludfjig requested changes Oct 7, 2026

View reviewed changes

andreiltd force-pushed the virtq-restricted-checkpoint branch from 8c55f9d to be8b588 Compare October 8, 2026 08:39

This comment has been minimized.

Sign in to view

andreiltd force-pushed the virtq-restricted-checkpoint branch from be8b588 to 925741c Compare October 8, 2026 09:34

syntactically previously approved these changes Oct 8, 2026

View reviewed changes

Comment thread src/hyperlight_host/src/mem/mgr.rs

andreiltd dismissed syntactically’s stale review via 926a925 October 8, 2026 21:47

andreiltd force-pushed the virtq-restricted-checkpoint branch from 925741c to 926a925 Compare October 8, 2026 21:47

ludfjig previously approved these changes Oct 9, 2026

View reviewed changes

andreiltd dismissed ludfjig’s stale review via fa74cb3 October 12, 2026 13:52

andreiltd force-pushed the virtq-restricted-checkpoint branch from 926a925 to fa74cb3 Compare October 12, 2026 13:52

This comment has been minimized.

Sign in to view

andreiltd force-pushed the virtq-restricted-checkpoint branch from fa74cb3 to dd56e29 Compare October 13, 2026 08:22

This comment has been minimized.

Sign in to view

Base automatically changed from virtq-lazy-pool-generations to main October 13, 2026 12:06

andreiltd force-pushed the virtq-restricted-checkpoint branch 2 times, most recently from f5071cc to f6b869b Compare October 13, 2026 12:19

andreiltd force-pushed the virtq-restricted-checkpoint branch from f6b869b to b2e8495 Compare October 13, 2026 12:29

yoshuawuyts approved these changes Oct 13, 2026

View reviewed changes

andreiltd merged commit ad05110 into main Oct 13, 2026
66 checks passed

andreiltd deleted the virtq-restricted-checkpoint branch October 13, 2026 15:08

Conversation

andreiltd commented Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

ludfjig left a comment

Choose a reason for hiding this comment

Uh oh!

ludfjig left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

syntactically left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

hyperlight-gh-bot Bot commented Oct 13, 2026

Benchmark Results

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Top regressions

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Benchmark Results

function_call_codec

payload_allocation

sandboxes

slot_pool

snapshot_files

virtq_readonly

virtq_readwrite

Uh oh!

andreiltd commented Oct 7, 2026 •

edited

Loading

ludfjig left a comment •

edited

Loading