Harden hypervisor process liveness checks - #363

Open

yummybomb wants to merge 48 commits into

hypeship/generalize-vgpu-devicefrom

hypeship/hypervisor-liveness

Commits on Aug 21, 2026

Unify hypervisor liveness checks on ProcessExists
yummybomb
authored
ea498ad
Wait for non-child hypervisor exit before finishing kill
yummybomb
authored
86710af
Verify socket ownership before treating a hypervisor PID as live
yummybomb
authored
017ce62
Fail closed on hypervisor liveness checks
yummybomb
authored
4ba2222
Fail closed on duplicate socket paths
yummybomb
authored
92c5966
Resolve socket owner from listening entries only
yummybomb
authored
02c1d23
Verify socket ownership before force-killing a hypervisor PID
yummybomb
authored
7c90df3
Skip hypervisor kill when socket ownership is unconfirmed
yummybomb
authored
d283052
Fail delete when hypervisor ownership is unconfirmed
yummybomb
authored
d051a9b
Verify hypervisor ownership before killing
yummybomb
authored
e960315
Fail closed on unconfirmed socket match with no stored PID
yummybomb
authored
afc4205
Treat unsignalable hypervisor processes as alive
yummybomb
authored
8bcebb2
Document fail-closed hypervisor errors
yummybomb
authored
ed3ffd5
Handle process exit races during socket scans
yummybomb
authored
6d765be
Confirm hypervisor identity before kill
yummybomb
authored
6bb9b91
Handle hypervisor identity edge cases
yummybomb
authored
059628d
Disambiguate inherited hypervisor sockets
yummybomb
authored
2b8e651
Add non-Linux process owner resolver
yummybomb
authored
f8021dc
Scope hypervisor identity to host boot
yummybomb
authored
8cfc830
Verify graceful shutdown process ownership
yummybomb
authored
4f6c53c
Mint hypervisor identity tokens only for confirmed PIDs
yummybomb
authored
64c1a75
Treat a hypervisor identity from a previous boot as dead
yummybomb
authored
c0afcbc
Treat a socket with no owning process as proof the hypervisor is gone
yummybomb
authored
0264733
Confirm the expected owner's socket fd before scanning all of /proc
yummybomb
authored
b668187
Backfill hypervisor process identity at startup
yummybomb
authored
85496d5
Memoize the host boot ID
yummybomb
authored
a0d4c49
Skip unreadable fds in the candidate socket ownership check
yummybomb
authored
70b3b93
Record a bare PID when the fallback hypervisor PID is dead
yummybomb
authored
79d7f2d
Resolve hypervisor ownership before shutdown kill
yummybomb
authored
99eed9f
Handle dead owners in shutdown and socket classification
yummybomb
authored
7dace03
Keep the fail-closed resolver off the hydration hot path
yummybomb
authored
ed61a3b
Extract hypervisor process identity logic into process_identity.go
yummybomb
authored
f374510
Group hypervisor process identity fields into a struct
yummybomb
authored
d7383f8
Collapse the three SIGKILL-and-wait paths into one helper
yummybomb
authored
52f0ab2
Log a summary line after hypervisor identity backfill
yummybomb
authored
bbddd62
Reduce hypervisor SIGKILL wait from 30s to 2s
yummybomb
authored
c2cb5a6
Defer stuck delete teardown to a background finalizer
yummybomb
authored
e56150f
Revert "Defer stuck delete teardown to a background finalizer"
yummybomb
authored
7739c3c
Drop unused identity checks and redundant kill-wait constant
yummybomb
authored
43fe762
Consolidate redundant identity tests
yummybomb
authored
2ae7af4
Merge forceKillHypervisorProcess into killHypervisor
yummybomb
authored
d24922c
Abort standby when the hypervisor cannot be confirmed dead
yummybomb
authored
037fed6
Remove the hypervisor socket only after confirmed exit
yummybomb
authored
83fdb81
Remove the command-line fallback from socket owner resolution
yummybomb
authored
09296ec
Skip the force-kill fallback after a confirmed hypervisor shutdown
yummybomb
authored
370aa1d
Remove the startup hypervisor identity backfill
yummybomb
authored
193c5aa
Reap zombie child VMMs and scan /proc in the churn test
yummybomb
authored
07d7fac
Retry cleanup deletes until the hypervisor teardown converges
yummybomb
authored
f42204d