syntactically · Oct 19, 2026 · Oct 19, 2026 · Oct 20, 2026 · Oct 22, 2026 · Oct 22, 2026
diff --git a/.github/workflows/Benchmarks.yml b/.github/workflows/Benchmarks.yml
@@ -58,8 +58,8 @@ jobs:
     - name: Download Wasm Modules
       uses: actions/download-artifact@v5
       with:
-        name: guest-modules-lts
-        path: ./x64/${{ matrix.config }}
+        name: guest-modules-X64-lts
+        path: ./build/${{ matrix.config }}
 
     ### Benchmarks ###
 

diff --git a/.github/workflows/dep_build_wasm_examples.yml b/.github/workflows/dep_build_wasm_examples.yml
@@ -23,6 +23,15 @@ permissions:
 jobs:
     build-docker-image:
       if: ${{ inputs.docs_only == 'false' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+      strategy:
+        matrix:
+          arch:
+            - name: X64
+              runner: ubuntu-latest
+              docker-platform: linux/amd64
+            - name: arm64
+              runner: ubuntu-24.04-arm
+              docker-platform: linux/arm64
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v5
@@ -46,15 +55,18 @@ jobs:
           with:
             images: ${{ github.repository_owner }}/wasm-clang-builder
         - name: Calculate ghcr cache destination
+          id: ghcr-dest
           env:
             CAN_WRITE: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) && github.actor != 'dependabot[bot]' }}
           run: |
             if [ "$CAN_WRITE" = "true" ]; then
               echo "CACHE_TO=type=registry,ref=ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:buildcache,mode=max" >> $GITHUB_ENV
               echo "DO_PUSH=true" >> $GITHUB_ENV
+              echo "DO_PUSH=false" >> $GITHUB_OUTPUT
             else
               echo "CACHE_TO=type=local,dest=/tmp/wasm-clang-builder-cache/" >> $GITHUB_ENV
               echo "DO_PUSH=false" >> $GITHUB_ENV
+              echo "DO_PUSH=false" >> $GITHUB_OUTPUT
             fi
         - name: Build and push wasm-clang-builder
         # Only push if not from a fork, not from pull request, and not from dependabot
@@ -67,28 +79,59 @@ jobs:
             build-args: |
               WASI_SDK_VERSION_FULL=25.0
               GCC_VERSION=12
-            tags: ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:latest
+            platforms: ${{ matrix.arch.docker-platform }}
+            tags: ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:latest-${{ matrix.arch.name }}
             cache-from: type=registry,ref=ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:buildcache
             cache-to: ${{ env.CACHE_TO }}
+      outputs:
+        do_push: ${{ steps.ghcr-dest.outputs.DO_PUSH }}
 
-    build-wasm-examples:
+    merge-docker-image:
       needs: build-docker-image
+      if: ${{ needs.build-docker-image.outputs.do_push }}
       runs-on: ubuntu-latest
+      steps:
+        - name: Login to Registry
+          uses: docker/login-action@v3
+          with:
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password: ${{ secrets.GITHUB_TOKEN }}
+        - name: Create manifest
+          run: |
+            docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:latest \
+              ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:latest-X64 \
+              ghcr.io/${{ github.repository_owner }}/wasm-clang-builder:latest-arm64
+
+    build-wasm-examples:
+      needs: merge-docker-image
+      # Required because merge-docker-image is skipped on some runs,
+      # and a skipped dependency transitively skips all downstream
+      # jobs.  See: https://github.com/actions/runner/issues/2205
+      if: ${{ !cancelled() && !failure() }}
       strategy:
         matrix:
           wasmtime_version:
             - name: lts
               features: ""
             - name: latest
               features: "wasmtime_latest"
+          arch:
+            - name: X64
+              runner: ubuntu-latest
+            - name: arm64
+              runner: ubuntu-24.04-arm
+      runs-on: ${{ matrix.arch.runner }}
       steps:
         - uses: actions/checkout@v5
           with:
             fetch-depth: 0
         - name: Remove default clang
           run: sudo rm /usr/bin/clang
+        - name: Fake /dev/kvm for ci-setup-workflow action
+          run: sudo touch /dev/kvm
         - name: Hyperlight setup workflow
-          uses: hyperlight-dev/ci-setup-workflow@v1.8.0
+          uses: hyperlight-dev/ci-setup-workflow@v2.3.0
           with:
             rust-toolchain: "1.94"
         - name: Set up Docker Buildx
@@ -110,6 +153,6 @@ jobs:
         - name: Upload Wasm Modules (wasmtime ${{ matrix.wasmtime_version.name }})
           uses: actions/upload-artifact@v4
           with:
-            name: guest-modules-${{ matrix.wasmtime_version.name }}
+            name: guest-modules-${{ matrix.arch.name }}-${{ matrix.wasmtime_version.name }}
             path: | 
-              x64/release/*.aot
+              build/release/*.aot
diff --git a/.github/workflows/dep_rust.yml b/.github/workflows/dep_rust.yml
@@ -39,25 +39,54 @@ jobs:
         # failed-job rerun does not need to repeat the entire matrix.
         fail-fast: false
         matrix:
-          hypervisor: [hyperv, mshv3, kvm] # hyperv is windows, mshv and kvm are linux
-          cpu: [amd, intel]
+          hypervisor: [hyperv, mshv3, kvm, hvf] # hyperv is windows, mshv and kvm are linux
+          cpu: [amd, intel, apple, microsoft]
+          arch: [X64, arm64]
           config: [debug, release]
           wasmtime: [latest, lts]
           exclude:
             # Latest testing: skip debug builds to reduce CI load
             - wasmtime: latest
               config: debug
-
-    runs-on: ${{ fromJson(
-        format('["self-hosted", "{0}", "X64", "1ES.Pool=hld-{1}-{2}", "JobId=build-{3}-{4}-{5}-{6}-{7}"]',
-          matrix.hypervisor == 'hyperv' && 'Windows' || 'Linux', 
-          matrix.hypervisor == 'hyperv' && 'win2025' || matrix.hypervisor == 'mshv3' && 'azlinux3-mshv' || matrix.hypervisor, 
-          matrix.cpu,
-          matrix.config,
-          matrix.wasmtime,
-          github.run_id,
-          github.run_number,
-          github.run_attempt)) }} 
+            - cpu: apple
+              hypervisor: hyperv
+            - cpu: apple
+              hypervisor: mshv3
+            - cpu: microsoft
+              hypervisor: mshv3
+            - cpu: microsoft
+              hypervisor: kvm
+            - cpu: microsoft
+              hypervisor: hvf
+            - arch: X64
+              hypervisor: hvf
+            - cpu: amd
+              arch: arm64
+            - cpu: intel
+              arch: arm64
+            - cpu: apple
+              arch: X64
+            - cpu: microsoft
+              arch: X64
+    runs-on: ${{ fromJson(matrix.arch == 'X64'
+        && format('["self-hosted", "{0}", "X64", "1ES.Pool=hld-{1}-{2}", "JobId=build-{3}-{4}-{5}-{6}-{7}"]',
+            matrix.hypervisor == 'hyperv' && 'Windows' || 'Linux',
+            matrix.hypervisor == 'hyperv' && 'win2025' || matrix.hypervisor == 'mshv3' && 'azlinux3-mshv' || matrix.hypervisor,
+            matrix.cpu,
+            matrix.config,
+            matrix.wasmtime,
+            github.run_id,
+            github.run_number,
+            github.run_attempt)
+        || matrix.hypervisor == 'hyperv'
+        && format('["self-hosted", "Windows", "ARM64", "1ES.Pool=hl-windows-arm", "JobId=build-{0}-{1}-{2}-{3}"]',
+            matrix.config,
+            matrix.run_id,
+            matrix.run_number,
+            matrix.run_attempt)
+        || format('["self-hosted", "{0}", "arm64", "{1}"]',
+            matrix.hypervisor == 'hvf' && 'macos' || 'Linux',
+            matrix.hypervisor)) }}
     env:
       # Features to pass to cargo. 
       # On Windows LTS builds, do not pass any features.
@@ -69,7 +98,7 @@ jobs:
       - uses: actions/checkout@v5
 
       - name: Hyperlight setup
-        uses: hyperlight-dev/ci-setup-workflow@v1.8.0
+        uses: hyperlight-dev/ci-setup-workflow@v2.3.0
         with:
           rust-toolchain: "1.94"
 
@@ -86,11 +115,32 @@ jobs:
         if: runner.os == 'Windows'
         run: rustup component add --toolchain nightly-x86_64-pc-windows-msvc rustfmt
 
+      - name: Configure ARM64 libclang
+        if: runner.os == 'Windows' && matrix.arch == 'arm64'
+        shell: pwsh
+        run: |
+          if (-not $env:VSINSTALLDIR) {
+            throw "Visual Studio developer environment did not set VSINSTALLDIR"
+          }
+          $libclang = Join-Path $env:VSINSTALLDIR "VC\Tools\Llvm\ARM64\bin\libclang.dll"
+          if (-not (Test-Path $libclang)) {
+            throw "ARM64 libclang not found at '$libclang'"
+          }
+          $llvmPath = Split-Path $libclang
+          "LIBCLANG_PATH=$llvmPath" >> $env:GITHUB_ENV
+          $llvmPath >> $env:GITHUB_PATH
+
+      - name: Install clang tools (macOS)
+        if: ${{ runner.os == 'macOS' }}
+        run: |
+          brew install llvm
+          echo "$(brew --prefix llvm)/bin" >> "$GITHUB_PATH"
+
       - name: Download Wasm Modules
         uses: actions/download-artifact@v5
         with:
-          name: guest-modules-${{ matrix.wasmtime }}
-          path: ./x64/${{ matrix.config }}
+          name: guest-modules-${{ matrix.arch }}-${{ matrix.wasmtime }}
+          path: ./build/${{ matrix.config }}
 
       - name: Build Rust component model examples
         run:  |
@@ -174,8 +224,8 @@ jobs:
       - name: Download Wasm Modules
         uses: actions/download-artifact@v5
         with:
-          name: guest-modules-${{ matrix.wasmtime }}
-          path: ./x64/release
+          name: guest-modules-${{ matrix.arch }}-${{ matrix.wasmtime }}
+          path: ./build/release
 
       - name: Download benchmarks from "latest"
         run: just bench-download ${{ runner.os }} ${{ matrix.hypervisor }} ${{ matrix.cpu }} dev-latest

diff --git a/Justfile b/Justfile
@@ -27,8 +27,8 @@ build target=default-target features="": (fmt-check)
     cargo build {{ if features =="" {''} else if features=="no-default-features" {"--no-default-features" } else {"--no-default-features -F " + features } }} --verbose --profile={{ if target == "debug" {"dev"} else { target } }}
 
 mkdir-redist target=default-target:
-    mkdir {{ mkdir-arg }} x64
-    mkdir {{ mkdir-arg }} x64/{{ target }}
+    mkdir {{ mkdir-arg }} build
+    mkdir {{ mkdir-arg }} build/{{ target }}
 
 compile-wit:
     wasm-tools component wit ./src/tests/c_guests/wasmsamples/components/runcomponent.wit -w -o ./src/tests/c_guests/wasmsamples/components/runcomponent-world.wasm
@@ -42,28 +42,28 @@ build-wasm-examples target=default-target features="": (compile-wit)
 build-rust-wasm-examples target=default-target features="": (mkdir-redist target)
     rustup target add wasm32-unknown-unknown
     cd ./src/tests/rust_guests/rust_wasm_samples && cargo build --target wasm32-unknown-unknown --profile={{ if target == "debug" {"dev"} else { target } }}
-    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} ./src/tests/rust_guests/rust_wasm_samples/target/wasm32-unknown-unknown/{{ target }}/rust_wasm_samples.wasm ./x64/{{ target }}/rust_wasm_samples.aot
+    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} ./src/tests/rust_guests/rust_wasm_samples/target/wasm32-unknown-unknown/{{ target }}/rust_wasm_samples.wasm ./build/{{ target }}/rust_wasm_samples.aot
 
 build-pulley-rust-wasm-examples target=default-target features="": (mkdir-redist target)
     rustup target add wasm32-unknown-unknown
     cd ./src/tests/rust_guests/rust_wasm_samples && cargo build --target wasm32-unknown-unknown --profile={{ if target == "debug" {"dev"} else { target } }}
-    cargo run -p hyperlight-wasm-aot compile --pulley {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} ./src/tests/rust_guests/rust_wasm_samples/target/wasm32-unknown-unknown/{{ target }}/rust_wasm_samples.wasm ./x64/{{ target }}/rust_wasm_samples.aot
+    cargo run -p hyperlight-wasm-aot compile --pulley {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} ./src/tests/rust_guests/rust_wasm_samples/target/wasm32-unknown-unknown/{{ target }}/rust_wasm_samples.wasm ./build/{{ target }}/rust_wasm_samples.aot
 
 build-rust-component-examples target=default-target features="": (compile-wit)
     # use cargo component so we don't get all the wasi imports https://github.com/bytecodealliance/cargo-component?tab=readme-ov-file#relationship-with-wasm32-wasip2
     # we also explicitly target wasm32-unknown-unknown since cargo component might try to pull in wasi imports https://github.com/bytecodealliance/cargo-component/issues/290
     rustup target add wasm32-unknown-unknown
     cd ./src/tests/rust_guests/component_sample && cargo component build --target wasm32-unknown-unknown --profile={{ if target == "debug" {"dev"} else { target } }}
-    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/component_sample/target/wasm32-unknown-unknown/{{ target }}/component_sample.wasm ./x64/{{ target }}/component_sample.aot
+    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/component_sample/target/wasm32-unknown-unknown/{{ target }}/component_sample.wasm ./build/{{ target }}/component_sample.aot
     cd ./src/tests/rust_guests/greeter_sample && cargo component build --target wasm32-unknown-unknown --profile={{ if target == "debug" {"dev"} else { target } }}
-    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/greeter_sample/target/wasm32-unknown-unknown/{{ target }}/greeter_sample.wasm ./x64/{{ target }}/greeter_sample.aot
+    cargo run -p hyperlight-wasm-aot compile {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/greeter_sample/target/wasm32-unknown-unknown/{{ target }}/greeter_sample.wasm ./build/{{ target }}/greeter_sample.aot
 
 build-pulley-rust-component-examples target=default-target features="": (compile-wit)
     # use cargo component so we don't get all the wasi imports https://github.com/bytecodealliance/cargo-component?tab=readme-ov-file#relationship-with-wasm32-wasip2
     # we also explicitly target wasm32-unknown-unknown since cargo component might try to pull in wasi imports https://github.com/bytecodealliance/cargo-component/issues/290
     rustup target add wasm32-unknown-unknown
     cd ./src/tests/rust_guests/component_sample && cargo component build --target wasm32-unknown-unknown --profile={{ if target == "debug" {"dev"} else { target } }}
-    cargo run -p hyperlight-wasm-aot compile --pulley {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/component_sample/target/wasm32-unknown-unknown/{{ target }}/component_sample.wasm ./x64/{{ target }}/component_sample.aot
+    cargo run -p hyperlight-wasm-aot compile --pulley {{ if features =~ "gdb" {"--debug"} else {""} }} {{ if features =~ "wasmtime_latest" {"--wasmtime-version latest"} else {""} }} --component ./src/tests/rust_guests/component_sample/target/wasm32-unknown-unknown/{{ target }}/component_sample.wasm ./build/{{ target }}/component_sample.aot
 
 check target=default-target:
     cargo check --profile={{ if target == "debug" {"dev"} else { target } }}
@@ -90,14 +90,17 @@ fmt:
     cd src/hyperlight_wasm_runtime && cargo +nightly fmt -v --all
     cd src/hyperlight_wasm_macro && cargo +nightly fmt -v --all
 
+clippy-excluded-features := if arch() == "aarch64" { "gdb,trace_guest,crashdump" } else { "" }
+clippy-runtime-features := if arch() == "aarch64" { "" } else { ",gdb,trace_guest" }
+
 clippy target=default-target: (check target)
-    cargo clippy --workspace --exclude hyperlight-wasm-runtime --exclude hyperlight-wasm-macro --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --all-features -- -D warnings
+    cargo clippy --workspace --exclude hyperlight-wasm-runtime --exclude hyperlight-wasm-macro --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --features "$(cargo metadata --format-version 1 --no-deps | jq -r '[.packages[]|.name as$pkg|.features|keys.[]|select(.!="default" and (IN($ARGS.positional[0]//""|split(",")[])|not))|$pkg+"/"+.]|join(",")' --args {{clippy-excluded-features}})" -- -D warnings
     cd src/tests/rust_guests/rust_wasm_samples &&  cargo clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --all-features -- -D warnings
     cd src/tests/rust_guests/component_sample &&  cargo clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --all-features -- -D warnings
     cd src/tests/rust_guests/greeter_sample &&  cargo clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --all-features -- -D warnings
     # hyperlight_wasm_runtime has mutually exclusive wasmtime features, so we run clippy for each separately with all other features
-    cd src/hyperlight_wasm_runtime && cargo hyperlight clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --no-default-features --features wasmtime_latest,gdb,trace_guest,pulley -- -D warnings
-    cd src/hyperlight_wasm_runtime && cargo hyperlight clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --no-default-features --features wasmtime_lts,gdb,trace_guest -- -D warnings
+    cd src/hyperlight_wasm_runtime && cargo hyperlight clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --no-default-features --features wasmtime_latest{{clippy-runtime-features}},pulley -- -D warnings
+    cd src/hyperlight_wasm_runtime && cargo hyperlight clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --no-default-features --features wasmtime_lts{{clippy-runtime-features}} -- -D warnings
     cd src/hyperlight_wasm_macro && cargo clippy --profile={{ if target == "debug" {"dev"} else { target } }} --all-targets --all-features -- -D warnings
 
 # TESTING

diff --git a/docs/wasm-modules-debugging.md b/docs/wasm-modules-debugging.md
@@ -39,7 +39,7 @@ After you attach, you can set breakpoints, step through the code, and inspect va
     {
       "id": "program",
       "type": "promptString",
-      "default": "x64/debug/hyperlight_wasm_runtime",
+      "default": "build/debug/hyperlight_wasm_runtime",
       "description": "Path to the program to debug"
     },
   ],

diff --git a/src/examples_common/src/lib.rs b/src/examples_common/src/lib.rs
@@ -20,7 +20,7 @@ use std::path::Path;
 use hyperlight_host::{Result, new_error};
 
 /// Get the Wasm module called `name` from the standard module location
-/// at `$REPO_ROOT/x64/[debug|release]/$name`.
+/// at `$REPO_ROOT/build/[debug|release]/$name`.
 pub fn get_wasm_module_path(name: &str) -> Result<String> {
     #[cfg(debug_assertions)]
     let config = "debug";
@@ -32,17 +32,17 @@ pub fn get_wasm_module_path(name: &str) -> Result<String> {
             .expect("Failed to get CARGO_MANIFEST_DIR  or RUST_DIR_FOR_DEBUGGING_TESTS env var")
     });
 
-    let x64_dir = Path::new(&proj_dir)
-        .join("../../x64")
+    let build_dir = Path::new(&proj_dir)
+        .join("../../build")
         .join(config)
         .join(name);
 
-    let path = match x64_dir.canonicalize() {
+    let path = match build_dir.canonicalize() {
         Ok(path) => path.to_str().unwrap().to_string(),
         Err(e) => {
             return Err(new_error!(
                 "Failed to get the path to the Wasm module: {:?} {}",
-                x64_dir,
+                build_dir,
                 e,
             ));
         }