Re: controlled shutdown of VMs by ups software, before shutting sown the host

On Oct 26, 2026, at 8:31 AM, Paul Vixie <paul@redbarn.org> wrote:
> 
> On Monday, October 26, 2026 5:21:11 a.m. Pacific Daylight Time void wrote:
> > Hi,
> >
> > Is it "safe" if, on a freebsd-current bhyve host, to issue 'shutdown -p
> > now'. By that, I mean, is shutdown -p on the host civilized enough to issue
> > a controlled shutdown of bhyve VMs before shutting itself off?
> >
> > Civilized enough to avoid having to fsck the VMs before they fully
> > come back up.
> 
> i've had it go badly if the guest has a huge dirty set in its buffer cache, for example if it has mmap()'d a lot and scribbled on that. what i think happens is bhyve gets its SIGTERM from shutdown and sends the guest an ACPI poweroff which then causes the guest's init to (among other things) call sync(). if that guest sync() has a lot to do, it can lose the race against the host sync() which will at some point have no further dirty pages, and allow the host shutdown to proceed even though the guest is still in its sync(). this probably will not make reboot-subsequent guest fsck fail since the file system metadata is very unlikely to be affected, but it can corrupt the guest file content that was mmap()'d and still sync()'ing at the time of reboot.

I believe this warrants a PR in the hope that this fixed up right!

> these things are semi-synchronous. if you need actual synchrony you'll have to do it in your own logic. as in, reach into the guest from the host and stop various processes before sending its bhyve a SIGTERM on the host. most of us seem to be in "hope for the best" mode on the topic.