[libvirt] [PATCH v4] qemu: Unlink the managed state only if restoring succeeded

[Osier Yang]

Both "qemuDomainStartWithFlags" and "qemuAutostartDomain" try to
restore the domain from managedsave'ed image if it exists (by
invoking "qemuDomainObjRestore"), but it unlinks the image even
if restoring fails, which causes data loss. (This problem exists
for "virsh managedsave dom; virsh start dom").

The fix is to:
   * Don't unlink()s the managed saved state if the restoring
     fails.
   * Add doc for restoring in virsh mannual to tell user it's
     not encourage to reuse a saved state file.
---
 src/qemu/qemu_driver.c |    8 +++-----
 tools/virsh.pod        |    6 +++++-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 48fe266..fdd58c7 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3423,18 +3423,16 @@ static int qemudDomainObjStart(virConnectPtr conn,

     /*
      * If there is a managed saved state restore it instead of starting
-     * from scratch. In any case the old state is removed.
+     * from scratch. The old state is removed once the restoring succeeded.
      */
     managed_save = qemuDomainManagedSavePath(driver, vm);
     if ((managed_save) && (virFileExists(managed_save))) {
         ret = qemuDomainObjRestore(conn, driver, vm, managed_save);

-        if (unlink(managed_save) < 0) {
+        if ((ret == 0) && (unlink(managed_save) < 0))
             VIR_WARN("Failed to remove the managed state %s", managed_save);
-        }

-        if (ret == 0)
-            goto cleanup;
+        goto cleanup;
     }

     ret = qemuProcessStart(conn, driver, vm, NULL, start_paused, -1, NULL,
diff --git a/tools/virsh.pod b/tools/virsh.pod
index f4bd294..6319373 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -546,7 +546,11 @@ I<on_reboot> parameter in the domain's XML definition.

 =item B<restore> I<state-file>

-Restores a domain from an B<virsh save> state file.  See I<save> for more info.
+Restores a domain from an B<virsh save> state file. See I<save> for more info.
+
+B<Note>: To avoid corrupting file system contents within the domain, you
+should not reuse the saved state file to B<restore> unless you are convinced
+with reverting the domain to the previous state.

 =item B<save> I<domain-id> I<state-file>

--
1.7.4