Changes to allow different toolchains for host and guest

.devcontainer/Dockerfile

@@ -49,14 +49,14 @@ RUN SNIPPET="export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhisto
 
 USER $USER
 
-ARG RUST_TOOLCHAIN=1.94
+ARG RUST_TOOLCHAIN=1.99.1
+ARG GUEST_RUST_TOOLCHAIN=1.94.1
 
 # Install rust
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
     && rustup default ${RUST_TOOLCHAIN} \
-    && rustup target add x86_64-unknown-linux-gnu \
-    && rustup target add x86_64-unknown-linux-musl \
-    && rustup target add x86_64-unknown-none      \
+    && rustup target add x86_64-unknown-linux-gnu x86_64-unknown-linux-musl --toolchain ${RUST_TOOLCHAIN} \
+    && rustup toolchain install ${GUEST_RUST_TOOLCHAIN} --component clippy,rust-src --target x86_64-unknown-none \
     && rustup toolchain add nightly-2026-09-22-x86_64-unknown-linux-gnu \
     && cargo install just \
     && cargo install cross --locked --version 0.2.5

.github/workflows/CargoAudit.yml

@@ -19,7 +19,6 @@ jobs:
       # TODO: Once the runner image is updated to include the necessary tools (without downloading), we can switch to the common workflow.
       - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
-          toolchain: "1.94"
           cache: false
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998  # v2.0.0

.github/workflows/CargoPublish.yml

@@ -38,9 +38,7 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
 
       - name: Check crate versions
         shell: bash

.github/workflows/Coverage.yml

@@ -38,9 +38,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/CreateDevcontainerImage.yml

@@ -8,6 +8,8 @@ on:
       - ".devcontainer/Dockerfile"
       - ".github/workflows/CreateDevcontainerImage.yml"
       - "rust-toolchain.toml"
+      - "src/tests/rust_guests/rust-toolchain.toml"
+      - "src/hyperlight_guest_capi/rust-toolchain.toml"
 
 # Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
 env:
@@ -16,8 +18,6 @@ env:
   USER: vscode
   GROUP: vscode
   LLVM_VERSION: 18
-  RUST_TOOLCHAIN_DEFAULT: 1.94
-  RUST_TOOLCHAIN_FILE: rust-toolchain.toml
 
 # There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
 jobs:
@@ -32,13 +32,24 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - name: Read Rust toolchain version from ${{ env.RUST_TOOLCHAIN_FILE }}
+      - name: Read Rust toolchain versions
         id: toolchain
         run: |
-          version=$(cat ${{ env.RUST_TOOLCHAIN_FILE }} | sed -n '/\[toolchain\]/,/^\[/{/^\s*channel = /s/[^"]*"\([^"]*\)".*/\1/p}')
-          cat ${{ env.RUST_TOOLCHAIN_FILE }} | grep $version &> /dev/null \
-            && echo "RUST_TOOLCHAIN=${version}" >> "$GITHUB_OUTPUT" \
-            || echo "RUST_TOOLCHAIN=${{ env.RUST_TOOLCHAIN_FILE }}" >> "$GITHUB_OUTPUT"
+          python3 - <<'PY'
+          import os
+          import tomllib
+
+          def channel(path):
+              with open(path, "rb") as source:
+                  return tomllib.load(source)["toolchain"]["channel"]
+
+          guest = channel("src/tests/rust_guests/rust-toolchain.toml")
+          if guest != channel("src/hyperlight_guest_capi/rust-toolchain.toml"):
+              raise ValueError("Guest Rust toolchains must match")
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              print(f"RUST_TOOLCHAIN={channel('rust-toolchain.toml')}", file=output)
+              print(f"GUEST_RUST_TOOLCHAIN={guest}", file=output)
+          PY
 
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Log in to the Container registry
@@ -69,3 +80,4 @@ jobs:
             GROUP=${{ env.GROUP }}
             LLVM_VERSION=${{ env.LLVM_VERSION }}
             RUST_TOOLCHAIN=${{ steps.toolchain.outputs.RUST_TOOLCHAIN }}
+            GUEST_RUST_TOOLCHAIN=${{ steps.toolchain.outputs.GUEST_RUST_TOOLCHAIN }}

.github/workflows/CreateRelease.yml

@@ -35,9 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -56,9 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -134,9 +130,9 @@ jobs:
           fetch-tags: true
           submodules: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/PrimeCaches.yml

@@ -119,9 +119,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/RegenSnapshotGoldens.yml

@@ -171,9 +171,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/RustNightly.yml

@@ -44,9 +44,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/ValidatePullRequest.yml

@@ -111,9 +111,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -317,9 +315,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/copilot-setup-steps.yml

@@ -21,18 +21,8 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      # For rust-fmt 
-      - name: Set up nightly rust 
-        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          toolchain: nightly
-          components: rustfmt
-          # The agent runs on branches, where saved caches serve only that branch and evict those of main.
-          cache: false
-
-
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dep_benchmarks.yml

@@ -75,9 +75,9 @@ jobs:
           # The baseline pass checks out another commit, which needs its history.
           fetch-depth: ${{ inputs.baseline_ref == '' && 1 || 0 }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/dep_build_guests.yml

@@ -81,9 +81,19 @@ jobs:
           }
           git checkout --detach ${{ inputs.ref }}
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - name: Select guest toolchain
+        id: guest-toolchain
+        run: |
+          # Older commits use the root toolchain for both host and guests.
+          if [[ -f src/tests/rust_guests/rust-toolchain.toml ]]; then
+            echo "directory=src/tests/rust_guests" >> "$GITHUB_OUTPUT"
+          else
+            echo "directory=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: ${{ steps.guest-toolchain.outputs.directory }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -95,7 +105,7 @@ jobs:
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: src/tests/rust_guests/target/sysroot
-          key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-linux-${{ inputs.arch }}-${{ inputs.config }}-${{ hashFiles('rust-toolchain.toml', 'src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       # Priming builds cold, so the entry holds only what this commit needs.
       - name: Rust cache

.github/workflows/dep_build_test.yml

@@ -84,9 +84,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/dep_code_checks.yml

@@ -42,12 +42,21 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Check guest toolchains match
+        run: |
+          guest=$(cd src/tests/rust_guests && rustup show active-toolchain)
+          capi=$(cd src/hyperlight_guest_capi && rustup show active-toolchain)
+          if [[ "${guest%% *}" != "${capi%% *}" ]]; then
+            echo "::error::Guest Rust toolchains must match"
+            exit 1
+          fi
+
       # cargo-hyperlight builds a custom sysroot for x86_64-hyperlight-none target.
       # rust-cache cleans "anything not a dependency" from target dirs, removing the sysroot.
       # We cache sysroot separately to avoid rebuilding it (~10s) on every run.
@@ -57,7 +66,7 @@ jobs:
         with:
           path: |
             src/tests/rust_guests/target/sysroot
-          key: sysroot-linux-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-linux-${{ hashFiles('src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       # Priming builds cold, so the entry holds only what this commit needs.
       - name: Rust cache
@@ -139,9 +148,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94" 
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -154,7 +163,7 @@ jobs:
         with:
           path: |
             src/tests/rust_guests/target/sysroot
-          key: sysroot-windows-${{ hashFiles('rust-toolchain.toml') }}
+          key: sysroot-windows-${{ hashFiles('src/tests/rust_guests/rust-toolchain.toml', 'src/hyperlight_guest_capi/rust-toolchain.toml') }}
 
       # Priming builds cold, so the entry holds only what this commit needs.
       - name: Rust cache

.github/workflows/dep_fuzzing.yml

@@ -58,9 +58,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/dep_miri.yml

@@ -50,9 +50,11 @@ jobs:
       # The shared setup reads /dev/kvm to report what the runner offers, which
       # a hosted one need not have. Miri wants a toolchain and two tools, so it
       # asks for those rather than everything a hypervisor job needs.
-      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # master
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f  # v2.0.0
         with:
-          toolchain: "1.94"
+          cache: "false"
+          # Miri's generated sysroot manifest emits a Cargo warning.
+          build-warnings: warn
 
       - uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29  # v2.87.21
         with:

.github/workflows/dep_run_examples.yml

@@ -62,9 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
-        with:
-          rust-toolchain: "1.94"
+      - uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/dep_update_guest_locks.yml

@@ -50,9 +50,9 @@ jobs:
           persist-credentials: false
 
       - name: Setup Rust toolchain
-        uses: hyperlight-dev/ci-setup-workflow@2f4142ba17cf573af44fc1e1f1ffc743daded5b3  # v1.10.0
+        uses: hyperlight-dev/ci-setup-workflow@3935a41ca357d6acb4274edc072b75a73a19e2b3  # v2.3.0
         with:
-          rust-toolchain: "1.94"
+          additional-toolchain-directory: src/tests/rust_guests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

CHANGELOG.md

@@ -8,10 +8,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+* **Breaking:** Generated libc bindings use `usize` for `size_t` arguments and return values, including `strlen` and `memcpy`. Rust callers that use `u64` or `c_ulong` need explicit conversions. The C ABI is unchanged.
+
 ### Removed
 
 ### Fixed
 
+* Guest libc accepts null buffers for zero-length writes.
+
 ## [v0.18.0] - 2026-10-13
 
 ### Added