feat(whp): support no-surrogate mode via HYPERLIGHT_MAX_SURROGATES=0

[danbugs]

• When HYPERLIGHT_MAX_SURROGATES=0, skip surrogate process creation entirely and use VirtualAlloc + WHvMapGpaRange instead of CreateFileMappingA + surrogate + WHvMapGpaRange2
• This is a single-VM-per-process mode (WHvMapGpaRange returns ERROR_VID_PARTITION_ALREADY_EXISTS when called from multiple partitions in the same process)
• compute_surrogate_counts() now accepts 0 as a valid minimum, and surrogates_disabled() checks the env var at runtime
• WhpVm::surrogate_process is now Option<SurrogateProcess>, with map_memory/unmap_memory branching at runtime
• ExclusiveSharedMemory::new() uses VirtualAlloc (via new DirectAllocation RAII type) when surrogates are disabled, CreateFileMappingA otherwise

[Copilot]

Pull request overview

Adds an optional Windows-only WHP mode (whp-no-surrogate) that bypasses the surrogate process for GPA mapping, intended for single-partition-per-process scenarios, and refactors shared-memory allocation to share validation/guard-page setup across allocation paths.

Changes:

• Introduces a new whp-no-surrogate feature flag in hyperlight-host.
• Adds a VirtualAlloc-backed shared memory allocation path (vs CreateFileMappingA) and maps GPAs via WHvMapGpaRange (vs dynamically-loaded WHvMapGpaRange2 through the surrogate).
• Refactors Windows shared memory creation to reuse validated_total_size() and set_guard_pages() helpers.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
src/hyperlight_host/src/mem/shared_mem.rs	Adds DirectAlloc mapping mode + VirtualAlloc allocation path and refactors guard-page/size validation helpers.
src/hyperlight_host/src/hypervisor/virtual_machine/whp.rs	Adds feature-gated mapping path using WHvMapGpaRange and removes surrogate-process usage when enabled.
src/hyperlight_host/Cargo.toml	Declares the new whp-no-surrogate feature flag.

[ludfjig]

Have you considered making this a runtime option instead, for example on SandboxConfiguration? If possible I think I would prefer it

[danbugs]

Have you considered making this a runtime option instead, for example on SandboxConfiguration? If possible I think I would prefer it

Had a chat w/ @simongdavies and modified this PR to integrate w/ HYPERLIGHT_MAX_SURROGATES. Now, if you set that to zero, it just doesn't spawn a surrogate process–so, essentially, a runtime config 👍