VZVirtualMachine behavior when its owning process unexpectedly terminates

App & System Services Core OS
rustamdev OP
Created
Replies 3
Boosts 0
Views 379
Participants 3

I'm looking for clarification on the supported lifecycle semantics of VZVirtualMachine on macOS.

Suppose process A creates and starts a VZVirtualMachine. While that VM is running, process A unexpectedly terminates or crashes.

What is the supported behavior of that same original running VM instance?

  1. Is the VM automatically stopped or terminated when its owning process exits or crashes?

  2. If the VM can continue running, is there a supported API for a newly started process B to reconnect to or obtain control of that same already-running VM instance?

  3. If process B can reacquire the original VM, can it then force noncooperative termination of that instance, equivalent to using stop(completionHandler:) while the original controlling object still exists?

  4. Is there a supported way for process B to determine authoritatively that the original VM has stopped after process A is gone?

  5. Are there relevant differences between normal process exit, an unexpected crash, and forced process termination?

I'm specifically asking about the same original running VM instance. Creating a new VZVirtualMachine with the same configuration, or restoring previously saved machine state, would not answer the question.

If the owner-loss behavior is intentionally unspecified, or if there is no supported mechanism for another process to reacquire the same running VM, that would also answer the question.

I'm interested in the supported Virtualization.framework contract rather than experimentally observed behavior.

Environment: macOS 26.5.1 on Apple Silicon.

Answered by DTS Engineer in 912412022

I was reviewing recent Virtualization questions and realised that we’d never driven this to a conclusion.

There have been a tonne of forums threads related to this task recently. I recommend that you review all the recent threads for the Virtualization tag. Specifically, check out this thread.

If you have follow-up questions, put them in a reply here and I’ll take a look.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies  3
Boosts 0
Views  379
Participants  3
Engineer OP
Apple

Could you provide some context for the question?

The behavior is one thing but you are likely looking to enable a specific use case that is larger than this. We might be able to better answer the question knowing the end goal.
rustamdev OP

Thanks for the reply.

The use case is a security-sensitive execution system that runs a potentially faulty or unresponsive workload inside a Linux VM on Apple Silicon. The host process remains the trusted control plane.

The important property for us is that the guest must not be able to retain execution or resource authority indefinitely after the host has decided that the execution is no longer valid. We therefore need to understand the guarantees provided by Virtualization.framework itself, rather than relying only on experimentally observed behavior.

More specifically, assume a VZVirtualMachine is running and the guest becomes completely unresponsive — for example, its kernel is hung or stuck in a non-cooperative execution state.

From the host side, we then request that the VM stop.

We are trying to determine:

  1. Does Virtualization.framework provide a supported host-controlled mechanism that guarantees termination of the VM even if the guest does not cooperate?
  2. After that operation reports completion/success, is the guest guaranteed to no longer execute on any virtual CPU?
  3. Is there any documented case where guest execution could continue indefinitely after the host has requested the strongest supported stop/termination operation?
  4. Does this guarantee depend on guest cooperation, or is enforcement entirely outside the guest?
  5. If the normal stop API cannot provide such a guarantee, is there another supported Virtualization.framework lifecycle operation intended for this use case?

We do not need a timing guarantee such as “termination occurs within X milliseconds.” The key requirement is whether the framework provides a host-enforced eventual termination guarantee independent of guest cooperation.

Environment: macOS 26.5.1, Apple Silicon.

I hope this explains the reason behind the question. I’m specifically trying to understand the supported Virtualization.framework contract, not undocumented or experimentally observed behavior.

DTS Engineer OP
Apple
Recommended

I was reviewing recent Virtualization questions and realised that we’d never driven this to a conclusion.

There have been a tonne of forums threads related to this task recently. I recommend that you review all the recent threads for the Virtualization tag. Specifically, check out this thread.

If you have follow-up questions, put them in a reply here and I’ll take a look.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"