Relax layout requirements for MultiUseSandbox::restore - #1728
Open
ludfjig wants to merge 5 commits into
Open
Conversation
ludfjig
changed the title
ludfjig
added
the
kind/enhancement
ludfjig
force-pushed
the
ll/snapshot-restore-layout-compatibility
branch
from
August 12, 2026 18:11
2074b7b to
2150200
Compare
ludfjig
force-pushed
the
ll/snapshot-restore-layout-compatibility
branch
2 times, most recently
from
August 12, 2026 23:08
afdbb20 to
d4e7519
Compare
ludfjig
force-pushed
the
ll/snapshot-restore-layout-compatibility
branch
from
August 13, 2026 19:46
d4e7519 to
f0fa0c2
Compare
ludfjig
force-pushed
the
ll/snapshot-restore-layout-compatibility
branch
2 times, most recently
from
August 13, 2026 21:38
3518a13 to
a110461
Compare
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com>
ludfjig
force-pushed
the
ll/snapshot-restore-layout-compatibility
branch
from
August 13, 2026 22:44
a110461 to
8297af8
Compare
ludfjig
marked this pull request as ready for review
August 13, 2026 23:20
ludfjig
requested review from
dblnz,
devigned,
jprendes and
jsturtevant
as code owners
August 13, 2026 23:20
ludfjig
requested review from
andreiltd,
simongdavies,
squillace and
syntactically
as code owners
August 13, 2026 23:20
Contributor
There was a problem hiding this comment.
Pull request overview
This PR relaxes MultiUseSandbox::restore compatibility rules so snapshots can be restored across different guest binaries and sandbox memory layouts, as long as the target sandbox’s registered host functions satisfy the snapshot’s requirements.
Changes:
- Remove layout-compatibility validation from snapshot restore, and drop the
SnapshotLayoutMismatcherror path. - Update restore to fully reset VM mappings during restore and clear crashdump state that would otherwise refer to the pre-restore guest.
- Add/expand tests covering cross-guest restore (WIT/Rust/C) and cross-layout restore, including persisted snapshots with non-default layouts.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/hyperlight_host/tests/wit_test.rs | Adds integration tests restoring WIT snapshots over Rust/C guests and vice-versa. |
| src/hyperlight_host/src/sandbox/snapshot/mod.rs | Removes Snapshot::validate_compatibility (layout + host funcs) helper. |
| src/hyperlight_host/src/sandbox/snapshot/file_tests.rs | Adds persisted non-default layout test; updates restore semantics comment. |
| src/hyperlight_host/src/sandbox/initialized_multi_use.rs | Implements relaxed restore (host-func-only validation) and remaps/unmaps regions during restore; updates docs/tests. |
| src/hyperlight_host/src/mem/layout.rs | Removes SandboxMemoryLayout::is_compatible_with and its tests. |
| src/hyperlight_host/src/hypervisor/hyperlight_vm/mod.rs | Adds clear_crashdump_binary_path for post-restore crashdump correctness. |
| src/hyperlight_host/src/error.rs | Removes HyperlightError::SnapshotLayoutMismatch variant. |
| CHANGELOG.md | Notes the new restore flexibility. |
Suppressed comments (1)
src/hyperlight_host/src/sandbox/initialized_multi_use.rs:469
restorenow unmaps all VM regions returned byself.vm.get_mapped_regions()before applying the snapshot. The rustdoc forrestoredoes not mention that mappings created viamap_region/map_file_cowwill be removed, which is a user-visible behavior change and can surprise callers relying on those mappings persisting across restores.
/// signature). Extras on the sandbox are allowed. The registry
/// itself is left unchanged. A mismatch returns
/// [`SnapshotHostFunctionMismatch`](crate::HyperlightError::SnapshotHostFunctionMismatch)
/// carrying the missing names and signature differences.
///
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| MSRs, on MSHV and WHP this is not enforced. by @ludfjig in https://github.com/hyperlight-dev/hyperlight/pull/991 | ||
| * **Breaking:** Filesystem paths are now represented using `PathBuf`. `GuestBinary::FilePath` now stores a `PathBuf` instead of a `String`, and `MultiUseSandbox::generate_crashdump_to_dir` accepts `Into<PathBuf>` instead of `Into<String>`. Callers passing a `String` to `GuestBinary::FilePath` must convert it using `.into()`. | ||
| * Deprecate `MultiUseSandbox::poisoned` in favor of `MultiUseSandbox::status().is_poisoned()`. | ||
| * `MultiUseSandbox::restore` has been made more flexible and now accepts snapshots from any guest binary or memory layout when host functions are compatible. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This makes it possible to restore snapshots from different guest binaries and memory layouts into a sandbox, provided the registered host functions are compatible.