review: whole-repo round — fuse post-stop quiesce, reuse the network seam

Drop QuiesceIfPending's namespace re-read on the stop and hibernate
paths: under the held ops lock the committed generation is derivable
from the loaded record plus whether UpdateStates landed, so
quiesceAfterStop quiesces and clears directly — one meta transaction
per stop instead of two. vm net resize now goes through the
process-wide NetworkSeam instead of building a throwaway provider
cache; NewNetProviders is unexported. Also: convergeExit's log tag
mirrors its function, and EntryGuardLoad's godoc no longer references
the removed EntryGuard.

Author: CMGS

cmd/core/network.go

@@ -32,11 +32,11 @@ type NetProviders struct {
 
 // NetworkSeam returns the process-wide seam, so both backends share one provider cache.
 func NetworkSeam(conf *config.Config) *NetProviders {
-	netOnce.Do(func() { netSeam = NewNetProviders(conf) })
+	netOnce.Do(func() { netSeam = newNetProviders(conf) })
 	return netSeam
 }
 
-func NewNetProviders(conf *config.Config) *NetProviders {
+func newNetProviders(conf *config.Config) *NetProviders {
 	return &NetProviders{conf: conf, bridge: map[string]network.Network{}}
 }
 

cmd/vm/netresize.go

@@ -53,5 +53,5 @@ func plumbingForVM(conf *config.Config, vm *types.VM) (network.Network, error) {
 	if backend == types.BackendCNI && vm.ResolvedNetnsPath() == "" {
 		return nil, fmt.Errorf("cni backend but no netns; resize would target host netns")
 	}
-	return cmdcore.NewNetProviders(conf).ForVM(vm)
+	return cmdcore.NetworkSeam(conf).ForVM(vm)
 }

daemon/reconcile.go

@@ -209,7 +209,7 @@ func (d *Daemon) convergeExit(ctx context.Context, ev exitEvent) bool {
 	if dead, _ := d.confirmDead(ctx, b, rec); rec.TransitionGeneration != ev.gen || !dead {
 		return false
 	}
-	logger := log.WithFunc("daemon.handleExit")
+	logger := log.WithFunc("daemon.convergeExit")
 	if err := b.ConvergeDead(ctx, ev.key.vmID, ev.gen, ev.at); err != nil {
 		logger.Errorf(ctx, err, "converge %s", ev.key.vmID)
 		return false

hypervisor/network.go

@@ -26,13 +26,22 @@ func (b *Backend) RecoverNetwork(ctx context.Context, rec *VMRecord) error {
 	return b.Net.Recover(ctx, &rec.VM)
 }
 
-// quiesceAfterStop runs the quiesce a just-committed stop scheduled, gated on the pre-stop record so an unplumbed VM pays no extra read; a failure keeps the pending flag for a later pass.
-func (b *Backend) quiesceAfterStop(ctx context.Context, id string, rec *VMRecord) {
-	if !needsQuiesce(rec) {
+// quiesceAfterStop runs the quiesce a just-committed stop scheduled without re-reading the record: under the caller's ops lock the committed generation is rec's, plus one exactly when the stop just landed its transition. A quiesce failure keeps the pending flag for a later pass.
+func (b *Backend) quiesceAfterStop(ctx context.Context, id string, rec *VMRecord, transitioned bool) {
+	gen, pending := rec.TransitionGeneration, rec.QuiescePending
+	if transitioned {
+		gen, pending = gen+1, needsQuiesce(rec)
+	}
+	if !pending {
+		return
+	}
+	logger := log.WithFunc(b.Typ + ".quiesceAfterStop")
+	if err := b.quiesceNetwork(ctx, &rec.VM); err != nil {
+		logger.Warnf(ctx, "quiesce network for VM %s (pending kept): %v", id, err)
 		return
 	}
-	if err := b.QuiesceIfPending(ctx, id); err != nil {
-		log.WithFunc(b.Typ+".quiesceAfterStop").Warnf(ctx, "%v", err)
+	if err := b.clearQuiescePending(ctx, id, gen); err != nil {
+		logger.Warnf(ctx, "clear pending quiesce for VM %s: %v", id, err)
 	}
 }
 

hypervisor/snapshot.go

@@ -147,10 +147,11 @@ func (b *Backend) HibernateSequence(ctx context.Context, ref string, spec Hibern
 
 	CleanupRuntimeFiles(ctx, rec.RunDir, spec.RuntimeFiles)
 	// Warn-and-continue like StopAll: the VMM is dead and the flip self-heals; the snapshot is already durable.
-	if uErr := b.UpdateStates(ctx, []string{vmID}, types.VMStateStopped); uErr != nil {
+	uErr := b.UpdateStates(ctx, []string{vmID}, types.VMStateStopped)
+	if uErr != nil {
 		logger.Warnf(ctx, "mark stopped %s: %v", vmID, uErr)
 	}
-	b.quiesceAfterStop(ctx, vmID, &rec)
+	b.quiesceAfterStop(ctx, vmID, &rec, uErr == nil)
 	return nil
 }
 

hypervisor/stop.go

@@ -56,15 +56,18 @@ func (b *Backend) StopOneLocked(ctx context.Context, id string, spec StopSpec) e
 	if err := b.HandleStopResult(ctx, id, rec.RunDir, spec.RuntimeFiles, shutdownErr); err != nil {
 		return err
 	}
+	transitioned := false
 	if !settled {
 		// Warn-and-continue: the VMM is dead and the flip self-heals on the next reconcile.
 		logger := log.WithFunc(b.Typ + ".StopOneLocked")
 		if err := b.UpdateStates(ctx, []string{id}, types.VMStateStopped); err != nil {
 			logger.Warnf(ctx, "mark stopped %s: %v", id, err)
+		} else {
+			transitioned = true
 		}
 	}
 	// Still under the caller's ops lock: an idle TAP's TC redirect storms softirqs until its host NICs go down (#130).
-	b.quiesceAfterStop(ctx, id, &rec)
+	b.quiesceAfterStop(ctx, id, &rec, transitioned)
 	return nil
 }
 

hypervisor/teardown.go

@@ -122,8 +122,10 @@ func (b *Backend) recoverVMTombstone(ctx context.Context, id string) (done bool,
 	return true, nil
 }
 
-// EntryGuardLoad is EntryGuard returning the VM's record from the guard's own
-// transaction, sparing lock-held entry paths a second whole-namespace read.
+// EntryGuardLoad runs the tombstone entry guard under the caller's ops lock —
+// roll a leased tombstone back, drive a deleting one to completion and refuse —
+// returning the record from the guard's own transaction, sparing lock-held
+// entry paths a second whole-namespace read.
 func (b *Backend) EntryGuardLoad(ctx context.Context, id string) (VMRecord, error) {
 	rec, err := b.entryGuard(ctx, id)
 	if err != nil {