Title: Hypervisor.framework — vCPU cessation guarantee after VM-owning process termination
Hello,
I'm investigating the failure-containment guarantees of Hypervisor.framework on Apple Silicon, specifically for an application that uses QEMU's HVF accelerator.
In the QEMU 11.1.2 ARM64 implementation:
hv_vm_create()creates the VM within the QEMU process.- Each vCPU is created and executed on a QEMU pthread using
hv_vcpu_create()andhv_vcpu_run(). - No separate userspace VM-execution helper was identified in the reviewed execution path.
The security requirement is to establish guest-execution cessation independently when the VM-owning application fails.
My primary question:
If a supervising parent successfully observes that the QEMU process has actually terminated through waitpid() — whether normally or following SIGKILL — is that a supported guarantee that every Hypervisor.framework vCPU belonging to that process has ceased guest execution and cannot resume?
I am specifically asking about irreversible cessation of guest execution, not necessarily completion of all VM resource reclamation.
A few related questions:
-
Does an
EVFILT_PROC/NOTE_EXITnotification establish the same guarantee, and is there a documented ordering relationship between that notification and cessation of all associated vCPUs? -
If a thread is executing
hv_vcpu_run()when its process receives SIGKILL or SIGSTOP, what cessation or suspension guarantees apply? -
Is there a documented upper bound for cessation following process termination, or could kernel/framework blockage delay it without a specified bound?
-
Can any other userspace process retain or acquire resources allowing those vCPUs to continue executing after the original owner has terminated?
-
If the original supervising parent also crashes, is there a supported mechanism for a successor controller to obtain equivalent positive evidence of termination and vCPU cessation for the original execution instance?
The distinction between a process merely receiving a termination request and the operating system confirming actual process termination is important here.
I'm trying to establish which guarantees are supported by the framework rather than relying on experimental observations or assumptions about kernel cleanup.
Any clarification would be greatly appreciated.
Thanks, Gary
Virtualization and Hypervisor are very different when it comes to process management. In Virtualization, the OS is responsible for managing the process that runs the VM. This is something we’ve talked about in your previous thread.
In Hypervisor that’s not the case. Rather, you are responsible for running the VM. Typically that means starting your own thread to run each vCPU by calling hv_vcpu_run(_:).
Given that architecture, your question boils down to “What does QEMU do?”, and that’s not something I can answer. You can either look at the QEMU source or escalate your question via QEMU’s support channel.
Oh wait, one of your questions still make sense given the above:
4- Can any other userspace process retain or acquire resources allowing those vCPUs to continue executing after the original owner has terminated?
And the answer to that is “No.”
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
