[libvirt] [PATCH] qemu: Prevent disk corruption on domain shutdown

[Jiri Denemark]

On Thu, Sep 15, 2011 at 12:07:27 +0200, Jiri Denemark wrote:
> Ever since we introduced fake reboot, we call qemuProcessKill as a
> reaction to SHUTDOWN event. Unfortunately, qemu doesn't guarantee it
> flushed all internal buffers before sending SHUTDOWN, in which case
> killing the process forcibly may result in (virtual) disk corruption.
> 
> By sending just SIGTERM without SIGKILL we give qemu time to to flush
> all buffers and exit. Once qemu exits, we will see an EOF on monitor
> connection and tear down the domain. In case qemu ignores SIGTERM or
> just hangs there, the process stays running but that's not any different
> from a possible hang anytime during the shutdown process so I think it's
> just fine.
> 
> Also qemu (since 0.14 until it's fixed) has a bug in SIGTERM processing
> which causes it not to exit but instead send new SHUTDOWN event and keep
> waiting. I think the best we can do is to ignore duplicate SHUTDOWN
> events to avoid a SHUTDOWN-SIGTERM loop and leave the domain in paused
> state.

Oops, I git send-email -1 instead of the file with prepared patch so it's
missing some additional comments. Mainly, this is a v2 of the patch and the
difference from v1 is:

    - reuse qemuProcessKill to send just SIGTERM instead of introducing
      qemuProcessQuit that would send SIGQUIT (which is not handled by
      qemu anyway)
    - don't do anything if we get SHUTDOWN event after we have already
      seen one

Jirka