Tighten QEMU launch prerequisites

Author: rgarcia

lib/hypervisor/cloudhypervisor/cloudhypervisor.go

@@ -48,11 +48,11 @@ func (c *CloudHypervisor) Capabilities() hypervisor.Capabilities {
 	return capabilities()
 }
 
-// capabilities resolves the effective capability set from the configured
-// default version (see GetDefaultVersion), matching what the capability
-// registry reports, rather than the compile-time vmm.DefaultVersion.
+// capabilities preserves the legacy client behavior for clients that do not
+// carry instance-version metadata. The runtime registry separately resolves
+// capabilities for the configured default used by new launches.
 func capabilities() hypervisor.Capabilities {
-	return CapabilitiesForVersion(GetDefaultVersion())
+	return CapabilitiesForVersion(vmm.DefaultVersion)
 }
 
 // CapabilitiesForVersion returns capabilities for a specific CH version.

lib/hypervisor/qemu/register_linux.go

@@ -72,9 +72,9 @@ func checkLaunchPrerequisites() error {
 //     (versionFromBinary), because every cold start persists ResolveVersion's
 //     result and treats failure as fatal — a non-executable or broken binary
 //     accepted by GetBinaryPath's bare os.Stat must not report available;
-//   - the vhost-vsock host device must exist, because every created instance
-//     receives a nonzero vsock CID and buildArgs unconditionally attaches a
-//     vhost-vsock device for it.
+//   - the vhost-vsock host device must be a character device that this process
+//     can open read/write, because every created instance receives a nonzero
+//     vsock CID and buildArgs unconditionally attaches a vhost-vsock device.
 //
 // Split from checkLaunchPrerequisites so unavailable cases are testable with
 // fake binaries and device paths regardless of the host's QEMU install.
@@ -85,8 +85,23 @@ func checkLaunchPrerequisitesFor(ctx context.Context, binaryPath, vsockDevicePat
 	if _, err := versionFromBinary(ctx, binaryPath); err != nil {
 		return fmt.Errorf("qemu binary %s is not usable: %w", binaryPath, err)
 	}
-	if _, err := os.Stat(vsockDevicePath); err != nil {
-		return fmt.Errorf("vsock device %s is required for instance launches (load the vhost_vsock kernel module): %w", vsockDevicePath, err)
+	return validateVsockDevice(vsockDevicePath, os.OpenFile)
+}
+
+func validateVsockDevice(path string, openFile func(string, int, os.FileMode) (*os.File, error)) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return fmt.Errorf("vsock device %s is required for instance launches (load the vhost_vsock kernel module): %w", path, err)
+	}
+	if info.Mode().Type() != os.ModeDevice|os.ModeCharDevice {
+		return fmt.Errorf("vsock device %s must be a character device (load the vhost_vsock kernel module)", path)
+	}
+	device, err := openFile(path, os.O_RDWR, 0)
+	if err != nil {
+		return fmt.Errorf("vsock device %s is not accessible read/write for instance launches: %w", path, err)
+	}
+	if err := device.Close(); err != nil {
+		return fmt.Errorf("close vsock device %s after launch check: %w", path, err)
 	}
 	return nil
 }

lib/hypervisor/qemu/register_linux_test.go

@@ -76,12 +76,15 @@ func fakeQEMUBinary(t *testing.T, dir string) string {
 	return path
 }
 
-// fakeVsockDevice creates a stand-in for /dev/vhost-vsock: the prerequisite
-// check only requires the device node to exist.
-func fakeVsockDevice(t *testing.T, dir string) string {
+// fakeVsockDevice uses a harmless character device as a stand-in for
+// /dev/vhost-vsock. The prerequisite check verifies node type and O_RDWR
+// access; it deliberately does not issue vhost ioctls during diagnostics.
+func fakeVsockDevice(t *testing.T, _ string) string {
 	t.Helper()
-	path := filepath.Join(dir, "vhost-vsock")
-	require.NoError(t, os.WriteFile(path, nil, 0o600))
+	const path = "/dev/null"
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	require.Equal(t, os.ModeDevice|os.ModeCharDevice, info.Mode().Type())
 	return path
 }
 
@@ -149,6 +152,34 @@ func TestCheckLaunchPrerequisitesFor(t *testing.T) {
 		require.ErrorContains(t, err, "vhost_vsock")
 	})
 
+	t.Run("regular file is not a vsock device", func(t *testing.T) {
+		dir := t.TempDir()
+		binary := fakeQEMUBinary(t, dir)
+		path := filepath.Join(dir, "vhost-vsock")
+		require.NoError(t, os.WriteFile(path, nil, 0o600))
+		err := retryingETXTBSY(t, func() error {
+			return checkLaunchPrerequisitesFor(ctx, binary, path)
+		})
+		require.ErrorContains(t, err, "must be a character device")
+	})
+
+	t.Run("directory is not a vsock device", func(t *testing.T) {
+		dir := t.TempDir()
+		binary := fakeQEMUBinary(t, dir)
+		err := retryingETXTBSY(t, func() error {
+			return checkLaunchPrerequisitesFor(ctx, binary, dir)
+		})
+		require.ErrorContains(t, err, "must be a character device")
+	})
+
+	t.Run("inaccessible character device fails", func(t *testing.T) {
+		err := validateVsockDevice("/dev/null", func(string, int, os.FileMode) (*os.File, error) {
+			return nil, os.ErrPermission
+		})
+		require.ErrorContains(t, err, "not accessible read/write")
+		require.ErrorIs(t, err, os.ErrPermission)
+	})
+
 	t.Run("hung binary fails at the context deadline", func(t *testing.T) {
 		// A wedged QEMU binary must fail the prerequisite check when its
 		// bounded context expires instead of blocking the capability request