Make ELF loading respect program header virtual addresses

cshung · Copilot · cshung · commit 3fa110a422e4 · 2026-06-15T11:49:19.000-07:00
For non-PIE binaries (ET_EXEC), the page table now maps the code region at the ELF's declared virtual address rather than identity mapping at the GPA. The entrypoint is computed correctly as a GVA. PIE binaries (base_va == 0) continue to use identity mapping, preserving existing behavior. Also adds build infrastructure and integration test for non-PIE guests: - Justfile: build-rust-guests-non-pie target builds simpleguest with static relocation model and --image-base=0x200000 - hyperlight_testing: add simple_guest_non_pie_as_string() path helper - integration_test: non_pie_guest_hello_world exercises full guest lifecycle (init, COW, function call) with absolute addresses Contributes to: #1408 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: cshung <3410332+cshung@users.noreply.github.com>
diff --git a/Justfile b/Justfile
@@ -45,7 +45,7 @@ build target=default-target:
     {{ cargo-cmd }} build --profile={{ if target == "debug" { "dev" } else { target } }} {{ target-triple-flag }}
 
 # build testing guest binaries
-guests: build-and-move-rust-guests build-and-move-c-guests
+guests: build-and-move-rust-guests-non-pie build-and-move-rust-guests build-and-move-c-guests
 
 ensure-cargo-hyperlight:
     cargo install --locked --version 0.1.11 cargo-hyperlight
@@ -69,6 +69,16 @@ build-rust-guests target=default-target features="": (witguest-wit) (ensure-carg
 build-and-move-rust-guests: (build-rust-guests "debug") (move-rust-guests "debug") (build-rust-guests "release") (move-rust-guests "release")
 build-and-move-c-guests: (build-c-guests "debug") (move-c-guests "debug") (build-c-guests "release") (move-c-guests "release")
 
+# Build non-PIE variants of rust guests for testing ELF VA mapping
+build-rust-guests-non-pie target=default-target: (ensure-cargo-hyperlight)
+    {{ if os() == "windows" { "$env:RUSTFLAGS='-C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x200000';" } else { "" } }} cd src/tests/rust_guests/simpleguest && {{ if os() == "windows" { "" } else { "RUSTFLAGS='-C relocation-model=static -C link-args=--no-pie -C link-args=--image-base=0x200000'" } }} cargo hyperlight build --profile={{ if target == "debug" { "dev" } else { target } }}
+
+@move-rust-guests-non-pie target=default-target:
+    {{ if os() == "windows" { "New-Item -ItemType Directory -Path " + rust_guests_bin_dir + "/" + target + "/non_pie -Force | Out-Null" } else { "mkdir -p " + rust_guests_bin_dir + "/" + target + "/non_pie" } }}
+    cp {{ simpleguest_source }}/{{ target }}/simpleguest {{ rust_guests_bin_dir }}/{{ target }}/non_pie/
+
+build-and-move-rust-guests-non-pie: (build-rust-guests-non-pie "debug") (move-rust-guests-non-pie "debug") (build-rust-guests-non-pie "release") (move-rust-guests-non-pie "release")
+
 clean: clean-rust
 
 clean-rust: 
diff --git a/src/hyperlight_host/src/sandbox/snapshot/mod.rs b/src/hyperlight_host/src/sandbox/snapshot/mod.rs
@@ -28,7 +28,7 @@ use crate::Result;
 use crate::hypervisor::regs::CommonSpecialRegisters;
 use crate::mem::exe::{ExeInfo, LoadInfo};
 use crate::mem::layout::SandboxMemoryLayout;
-use crate::mem::memory_region::{GuestMemoryRegion, MemoryRegion, MemoryRegionFlags};
+use crate::mem::memory_region::{GuestMemoryRegion, MemoryRegion, MemoryRegionFlags, MemoryRegionType};
 use crate::mem::mgr::{GuestPageTableBuffer, SnapshotSharedMemory};
 use crate::mem::shared_mem::{ReadonlySharedMemory, SharedMemory};
 use crate::sandbox::SandboxConfiguration;
@@ -308,6 +308,16 @@ impl Snapshot {
         let base_va = exe_info.base_va();
         let entrypoint_va: u64 = exe_info.entrypoint().into();
 
+        // Determine the virtual base address for the code region.
+        // For non-PIE binaries (base_va > 0), the code should appear at the
+        // ELF's declared virtual address. For PIE binaries (base_va == 0),
+        // we use the physical load address (identity mapping).
+        let code_virt_base = if base_va > 0 {
+            base_va
+        } else {
+            load_addr
+        };
+
         let mut memory = vec![0; layout.get_memory_size()?];
 
         let load_info = exe_info.load(
@@ -340,9 +350,26 @@ impl Snapshot {
                     executable,
                 })
             };
+
+            // For the code region, use code_virt_base as the GVA.
+            // For non-PIE this is the ELF's declared base VA (non-identity mapping).
+            // For PIE this should equal the GPA (identity mapping).
+            let virt_base = if rgn.region_type == MemoryRegionType::Code {
+                if base_va == 0 {
+                    assert_eq!(
+                        code_virt_base,
+                        rgn.guest_region.start as u64,
+                        "PIE code region should be identity-mapped"
+                    );
+                }
+                code_virt_base
+            } else {
+                rgn.guest_region.start as u64
+            };
+
             let mapping = Mapping {
                 phys_base: rgn.guest_region.start as u64,
-                virt_base: rgn.guest_region.start as u64,
+                virt_base,
                 len: rgn.guest_region.len() as u64,
                 kind,
                 user_accessible: false,
@@ -361,13 +388,21 @@ impl Snapshot {
             - hyperlight_common::layout::SCRATCH_TOP_EXN_STACK_OFFSET
             + 1;
 
+        let entrypoint_offset = entrypoint_va.checked_sub(base_va).ok_or_else(|| {
+            crate::new_error!(
+                "ELF entrypoint VA ({:#x}) is below base VA ({:#x})",
+                entrypoint_va,
+                base_va
+            )
+        })?;
+
         Ok(Self {
             memory: ReadonlySharedMemory::from_bytes(&memory, layout.snapshot_size)?,
             layout,
             load_info,
             stack_top_gva: exn_stack_top_gva,
             sregs: None,
-            entrypoint: NextAction::Initialise(load_addr + entrypoint_va - base_va),
+            entrypoint: NextAction::Initialise(code_virt_base + entrypoint_offset),
             snapshot_generation: 0,
             host_functions: HostFunctionDetails {
                 host_functions: None,
diff --git a/src/hyperlight_host/tests/integration_test.rs b/src/hyperlight_host/tests/integration_test.rs
@@ -21,7 +21,7 @@ use std::time::Duration;
 use hyperlight_common::flatbuffer_wrappers::guest_error::ErrorCode;
 use hyperlight_common::log_level::GuestLogFilter;
 use hyperlight_host::sandbox::SandboxConfiguration;
-use hyperlight_host::{HyperlightError, MultiUseSandbox};
+use hyperlight_host::{HyperlightError, MultiUseSandbox, UninitializedSandbox};
 use hyperlight_testing::simplelogger::{LOGGER, SimpleLogger};
 use serial_test::serial;
 use tracing_core::LevelFilter;
@@ -1872,3 +1872,20 @@ fn hw_timer_interrupts() {
         );
     });
 }
+
+#[test]
+#[serial]
+fn non_pie_guest_hello_world() {
+    let path =
+        hyperlight_testing::simple_guest_non_pie_as_string().expect("non-PIE guest not found");
+    let sandbox = UninitializedSandbox::new(
+        hyperlight_host::GuestBinary::FilePath(path),
+        None,
+    )
+    .unwrap();
+    let mut multi_use_sandbox: MultiUseSandbox = sandbox.evolve().unwrap();
+    let result: i32 = multi_use_sandbox
+        .call("PrintOutput", "Hello from non-PIE guest!\n".to_string())
+        .unwrap();
+    assert_eq!(result, 26);
+}
diff --git a/src/hyperlight_testing/src/lib.rs b/src/hyperlight_testing/src/lib.rs
@@ -88,6 +88,37 @@ pub fn dummy_guest_as_string() -> Result<String> {
         .ok_or_else(|| anyhow!("couldn't convert dummy guest PathBuf to string"))
 }
 
+/// Get a fully qualified OS-specific path to the non-PIE simpleguest elf binary
+pub fn simple_guest_non_pie_as_string() -> Result<String> {
+    let buf = rust_guest_non_pie_as_pathbuf("simpleguest");
+    buf.to_str()
+        .map(|s| s.to_string())
+        .ok_or_else(|| anyhow!("couldn't convert non-PIE simple guest PathBuf to string"))
+}
+
+/// Get a new `PathBuf` to a specified non-PIE Rust guest
+/// $REPO_ROOT/src/tests/rust_guests/bin/${profile}/non_pie/
+fn rust_guest_non_pie_as_pathbuf(guest: &str) -> PathBuf {
+    let build_dir_selector = if cfg!(debug_assertions) {
+        "debug"
+    } else {
+        "release"
+    };
+
+    join_to_path(
+        MANIFEST_DIR,
+        vec![
+            "..",
+            "tests",
+            "rust_guests",
+            "bin",
+            build_dir_selector,
+            "non_pie",
+            guest,
+        ],
+    )
+}
+
 pub fn c_guest_as_pathbuf(guest: &str) -> PathBuf {
     let build_dir_selector = if cfg!(debug_assertions) {
         "debug"
