fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migration: Do not try to start VM if disk activation fails

Browse source 
If a rare split brain happens (e.g. dest QEMU started running somehow,
taking shared drive locks), src QEMU may not be able to activate the
drives anymore.  In this case, src QEMU shouldn't start the VM or it might
crash the block layer later with something like:

Meanwhile, src QEMU cannot try to continue either even if dest QEMU can
release the drive locks (e.g. by QMP "stop").  Because as long as dest QEMU
started running, it means dest QEMU's RAM is the only version that is
consistent with current status of the shared storage.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251103183301.3840862-3-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
This commit is contained in:
Peter Xu 2025-11-03 19:32:51 +01:00
parent 1529ec8f5f
commit 26f65c01ed
1 changed files with 24 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

29
migration/migration.c
View file

@ -3526,6 +3526,8 @@ static MigIterateState migration_iteration_run(MigrationState *s)
static void migration_iteration_finish(MigrationState *s)
{
Error *local_err = NULL;
bql_lock();
/*
@ -3549,11 +3551,28 @@ static void migration_iteration_finish(MigrationState *s)
case MIGRATION_STATUS_FAILED:
case MIGRATION_STATUS_CANCELLED:
case MIGRATION_STATUS_CANCELLING:
/*
* Re-activate the block drives if they're inactivated. Note, COLO
* shouldn't use block_active at all, so it should be no-op there.
*/
migration_block_activate(NULL);
if (!migration_block_activate(&local_err)) {
/*
* Re-activate the block drives if they're inactivated.
*
* If it fails (e.g. in case of a split brain, where dest QEMU
* might have taken some of the drive locks and running!), do
* not start VM, instead wait for mgmt to decide the next step.
*
* If dest already started, it means dest QEMU should contain
* all the data it needs and it properly owns all the drive
* locks. Then even if src QEMU got a FAILED in migration, it
* normally should mean we should treat the migration as
* COMPLETED.
*
* NOTE: it's not safe anymore to start VM on src now even if
* dest would release the drive locks. It's because as long as
* dest started running then only dest QEMU's RAM is consistent
* with the shared storage.
*/
error_free(local_err);
break;
}
if (runstate_is_live(s->vm_old_state)) {
if (!runstate_check(RUN_STATE_SHUTDOWN)) {
vm_start();