Harden hypervisor process liveness checks

[yummybomb]

Summary

Layer 1 of the vendor VFIO vGPU stack (generalize-vgpu-device ← this ← vendor-vfio-backend ← vendor-vfio-vgpu). Pure hypervisor-process hardening with no vGPU-specific code; reviewable in isolation.

The upper layers guard vGPU release decisions on "is this instance's hypervisor still alive", so the liveness answer has to be trustworthy first:

• Unify liveness checks on ProcessExists — one exported, EPERM-aware, zombie-filtering definition instead of scattered bare kill(pid, 0) probes. EPERM means the process exists but cannot be signaled; treating it as dead would be wrong.
• Wait for non-child hypervisor exit before finishing kill — after a hypeman restart the hypervisor is not our child, so Wait4 returns ECHILD immediately and the kill loop finished before the process had exited. Poll for actual exit in that case.
• Verify process identity before teardown — a bare PID probe treats any process that reused a stored hypervisor PID as the owning VMM. On Linux, require confirmed socket ownership or a matching PID/start-time token scoped to the current host boot, including the graceful stop/delete wait path.
• Treat provable death as death — two disproofs unwedge stop/delete instead of failing closed forever: an identity token recorded under a different host boot cannot be the recorded VMM, and a socket that no process owns or references (both the listener scan and the full command-line scan come up empty) proves the recorded VMM is gone even when a recycled PID is live. The genuinely ambiguous case — a live process matching the socket by command line only — still fails closed, and the recycled PID is never signaled.

Testing

• go build ./..., go vet clean
• go test -race ./lib/instances/ targeted suites pass (TestCreateInstanceWithNetwork requires image pulls + iptables and fails in this environment on the unmodified base as well)

---

Note

High Risk
Changes core stop/delete/kill and PID resolution on Linux; mistakes could skip killing a live VMM or signal the wrong process, and delete now fails instead of best-effort cleanup when kill is uncertain.

Overview
Hardens hypervisor liveness so stop, delete, and teardown only target the real VMM—not a recycled PID or a cmdline-only match.

Instance metadata gains HypervisorStartTime and HypervisorBootID (with ProcessExists replacing ad-hoc kill(pid,0) checks). resolveLiveHypervisorPID ties a live hypervisor to confirmed socket ownership or a matching boot-scoped identity; provable death (wrong boot, empty socket owner scan) unwedges legacy metadata without signaling unrelated processes. Linux socket resolution now returns a confirmed flag, prefers listeners via __SO_ACCEPTCON, and adds ResolveProcessPIDForOwner.

Stop/delete/kill paths wait on the resolved socket owner, fail closed when ownership is ambiguous, and delete aborts resource teardown if kill cannot confirm the hypervisor is gone. API startup runs BackfillHypervisorProcessIdentities for older instances missing identity tokens.

^{Reviewed by Cursor Bugbot for commit 310c003. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 310c003. Configure here.}

[cursor]

Stop kill bypasses ownership checks

High Severity

When tryGracefulGuestShutdown fails closed on unconfirmed ownership, stop still calls shutdownHypervisor, which SIGKILLs the raw stored PID (and possibly its process group) and unlinks the socket before forceKillHypervisorProcess runs. That undermines the new ownership checks and can signal an unrelated recycled PID while leaving the real socket owner alive.

Additional Locations (1)

• lib/instances/standby.go#L388-L433

 

^{Reviewed by Cursor Bugbot for commit 310c003. Configure here.}

[cursor]

Identity minted for dead fallback

Medium Severity

On ResolveProcessPID failure, resolveRuntimeHypervisorPID calls setHypervisorProcessIdentity with the already-dead fallbackPID. That records a boot ID beside a zero start time for a PID that was just proven not to exist, contradicting the helper’s rule that tokens are only minted for the live child or a confirmed socket owner.

 

^{Reviewed by Cursor Bugbot for commit 310c003. Configure here.}