Destroy deletes the NVRAM file only when asked (VIR_DOMAIN_UNDEFINE_NVRAM,
otherwise KEEP_NVRAM): a unit test checks the flags, live tests check the
file on the host both ways. A VM whose disk is an overlay with a snapshot
goes with its own image and the snapshot metadata, and the base image
stays, since other images may grow from it.
The Destroy button was disabled and the confirmation page refused a
paused VM ("Instance is suspended, cannot destroy!"), while the destroy
request itself stops a paused VM like a running one. Both now offer it.
Destroy:
- Stops every active state, not only running; a paused VM used to keep
running as a transient domain after the undefine.
- Undefines with MANAGED_SAVE and SNAPSHOTS_METADATA, before any disk is
deleted. A managed-save image used to make the undefine fail after the
disks were already gone; now a failed undefine deletes nothing.
- Keeps disks that another domain references, directly or as a backing
file anywhere in its chain (running domains' backingStore, and the
backingStore of the volumes in the active pools for stopped ones), and
says so; they used to be deleted with the VM.
Volume delete:
- Detaches from the live domain in every active state, including paused.
- Deletes the volume only after neither the live nor the persistent
definition has the disk (bounded wait for the guest to release it),
and refuses a volume another VM references. Otherwise the volume is
kept and the user is told why.
Both hold the compute exclusively for the usage scan and the deletion,
so another VM cannot attach the disk in between; the destroy
confirmation page (GET) takes no lock.
Live tests reproduce each case on a RHEL qemu-kvm host and fail on the
previous code; unit tests cover the destroy ordering and the locks.
