feat: enable ASLR for PIE guest binaries

Add pick_aslr_address() that selects a random page-aligned virtual
base for PIE code regions within 47-bit canonical user space. For PIE
guests, Snapshot::new() calls this instead of identity-mapping code at
the physical load address, then passes the result to set_code_gva().

Non-PIE binaries continue using their declared ELF base VA.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 6f20a05d-6bee-4e2e-b320-12f8d9759bbc
Signed-off-by: cshung <3410332+cshung@users.noreply.github.com>

Author: cshung

src/hyperlight_host/src/hypervisor/hyperlight_vm/aarch64.rs

@@ -12,7 +12,7 @@ use super::{
 #[cfg(hvf)]
 use crate::hypervisor::HvfInterruptHandle;
 use crate::hypervisor::InterruptHandleImpl;
-#[cfg(any(kvm, mshv3))]
+#[cfg(target_os = "linux")]
 use crate::hypervisor::LinuxInterruptHandle;
 #[cfg(gdb)]
 use crate::hypervisor::gdb::{DebugCommChannel, DebugMsg, DebugResponse};

src/hyperlight_host/src/hypervisor/mod.rs

@@ -508,8 +508,8 @@ pub(crate) mod tests {
         )?;
 
         // Set up required parameters for initialise
-        let peb_addr = RawPtr::from(0x1000u64); // Dummy PEB address
-        let seed = 12345u64; // Random seed
+        let peb_addr = RawPtr::from(0x230000u64);
+        let seed = 1234567890u64;
         let host_funcs = Arc::new(Mutex::new(FunctionRegistry::default()));
         let guest_max_log_level = Some(tracing_core::LevelFilter::ERROR);
 

src/hyperlight_host/src/mem/layout.rs

@@ -568,6 +568,30 @@ impl SandboxMemoryLayout {
         Ok(())
     }
 
+    /// Pick a random page-aligned virtual address for ASLR.
+    ///
+    /// The address is chosen within 47-bit canonical user space:
+    /// lower bound 16 MiB (above identity-mapped layout regions),
+    /// upper bound accounts for `loaded_size` so the mapping fits.
+    pub(crate) fn pick_aslr_address(loaded_size: u64) -> Result<u64> {
+        use rand::RngExt;
+        let code_size_pages = loaded_size.div_ceil(PAGE_SIZE as u64);
+        let min_page = 0x1000_u64; // 0x1000 * PAGE_SIZE = 0x1000000 (16 MiB)
+        let max_page = 0x7_FFFF_FFFF_u64
+            .checked_sub(code_size_pages)
+            .ok_or_else(|| {
+                new_error!(
+                    "PIE code region too large ({} pages) for ASLR randomization",
+                    code_size_pages
+                )
+            })?;
+        let mut rng = rand::rng();
+        let page_number = rng.random_range(min_page..max_page);
+        page_number
+            .checked_mul(PAGE_SIZE as u64)
+            .ok_or_else(|| new_error!("ASLR page number overflow"))
+    }
+
     #[instrument(err(Debug), skip_all, parent = Span::current(), level= "Trace")]
     pub(crate) fn write_init_data(&self, out: &mut [u8], bytes: &[u8]) -> Result<()> {
         out[self.init_data_offset()..self.init_data_offset() + self.init_data_size]

src/hyperlight_host/src/sandbox/initialized_multi_use.rs

@@ -2766,9 +2766,12 @@ mod tests {
     /// `read_guest_memory_by_gva`, then assert both views are identical.
     #[cfg(feature = "trace_guest")]
     fn assert_gva_read_matches(sbox: &mut MultiUseSandbox, gva: u64, len: usize) {
-        // Guest reads via its own page tables
+        // Guest reads via its own page tables.
+        // do_map = false: the code region is already mapped (identity-mapped
+        // or ASLR-mapped), so we must not remap it with an identity mapping
+        // that would use the GVA as a physical address.
         let expected: Vec<u8> = sbox
-            .call("ReadMappedBuffer", (gva, len as u64, true))
+            .call("ReadMappedBuffer", (gva, len as u64, false))
             .unwrap();
         assert_eq!(expected.len(), len);
 

src/hyperlight_host/src/sandbox/snapshot/mod.rs

@@ -326,7 +326,14 @@ impl Snapshot {
         let entrypoint_va: u64 = exe_info.entrypoint().into();
         let is_pie = exe_info.is_pie();
 
-        let code_gva = if is_pie { load_addr } else { base_va };
+        let code_gva = if is_pie {
+            SandboxMemoryLayout::pick_aslr_address(exe_info.loaded_size() as u64)?
+        } else if base_va == load_addr {
+            // PIE binary at default load address (identity-mapped)
+            load_addr
+        } else {
+            base_va
+        };
         layout.set_code_gva(code_gva)?;
         let regions = layout.get_memory_regions()?;