I previously pushed a patch that adds a new flag,
VIR_DOMAIN_DESTROY_GRACEFUL, to virDomainDestroyFlags, so that a
management application can destroy a domain without danger of sending
SIGKILL to the qemu process too early (which occasionally results in a
corrupted disk image due to qemu being unable to flush its disk
buffers quickly enough).
That patch will enable management applications to solve the problem by
calling virDomainDestroyFlags with the new flag, and if they receive
an error back from libvirtd, they can decide (or let the admin decide)
when/if it is appropriate to call the more heavy-handed version of
virDomainDestroy.
However, that patch does *not* help those installations that are able
to upgrade libvirt but have no available updated management
application to install. Since the root cause of this bug is in
libvirt, we need to do our best to mitigate the situation for these people.
These two patches do two things:
1) Drop the driver lock while sleeping during qemuProcessKill(), so
that it can wait for a longer period without locking up all other
libvirtd threads.
This patch is a slight re-work of a patch Eric sent to the list back
in November.
2) Wait for a considerably longer period after sending SIGTERM before
sending SIGKILL.