PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6
   7 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
   8 use PVE::SafeSyslog;
   9 use PVE::Tools qw(extract_param);
  10 use PVE::Exception qw(raise raise_param_exc);
  11 use PVE::Storage;
  12 use PVE::JSONSchema qw(get_standard_option);
  13 use PVE::RESTHandler;
  14 use PVE::QemuServer;
  15 use PVE::QemuMigrate;
  16 use PVE::RPCEnvironment;
  17 use PVE::AccessControl;
  18 use PVE::INotify;
  19
  20 use Data::Dumper; # fixme: remove
  21
  22 use base qw(PVE::RESTHandler);
  23
  24 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  25
  26 my $resolve_cdrom_alias = sub {
  27     my $param = shift;
  28
  29     if (my $value = $param->{cdrom}) {
  30         $value .= ",media=cdrom" if $value !~ m/media=/;
  31         $param->{ide2} = $value;
  32         delete $param->{cdrom};
  33     }
  34 };
  35
  36
  37 my $check_storage_access = sub {
  38    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  39
  40    PVE::QemuServer::foreach_drive($settings, sub {
  41         my ($ds, $drive) = @_;
  42
  43         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  44
  45         my $volid = $drive->{file};
  46
  47         if (!$volid || $volid eq 'none') {
  48             # nothing to check
  49         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  50             $rpcenv->check($authuser, "/", ['Sys.Console']);
  51         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  52             my ($storeid, $size) = ($2 || $default_storage, $3);
  53             die "no storage ID specified (and no default storage)\n" if !$storeid;
  54             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  55         } else {
  56             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  57         }
  58     });
  59 };
  60
  61 # Note: $pool is only needed when creating a VM, because pool permissions
  62 # are automatically inherited if VM already exists inside a pool.
  63 my $create_disks = sub {
  64     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
  65
  66     my $vollist = [];
  67
  68     my $res = {};
  69     PVE::QemuServer::foreach_drive($settings, sub {
  70         my ($ds, $disk) = @_;
  71
  72         my $volid = $disk->{file};
  73
  74         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
  75             $res->{$ds} = $settings->{$ds};
  76         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
  77             my ($storeid, $size) = ($2 || $default_storage, $3);
  78             die "no storage ID specified (and no default storage)\n" if !$storeid;
  79             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
  80             my $fmt = $disk->{format} || $defformat;
  81             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
  82                                                   $fmt, undef, $size*1024*1024);
  83             $disk->{file} = $volid;
  84             $disk->{size} = $size*1024*1024*1024;
  85             push @$vollist, $volid;
  86             delete $disk->{format}; # no longer needed
  87             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
  88         } else {
  89
  90             my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  91
  92             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
  93
  94             my $foundvolid = undef;
  95
  96             if ($storeid) {
  97                 PVE::Storage::activate_volumes($storecfg, [ $volid ]);
  98                 my $dl = PVE::Storage::vdisk_list($storecfg, $storeid, undef);
  99
 100                 PVE::Storage::foreach_volid($dl, sub {
 101                     my ($volumeid) = @_;
 102                     if($volumeid eq $volid) {
 103                         $foundvolid = 1;
 104                         return;
 105                     }
 106                 });
 107             }
 108
 109             die "image '$path' does not exists\n" if (!(-f $path || -b $path || $foundvolid));
 110
 111             my ($size) = PVE::Storage::volume_size_info($storecfg, $volid, 1);
 112             $disk->{size} = $size;
 113             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 114         }
 115     });
 116
 117     # free allocated images on error
 118     if (my $err = $@) {
 119         syslog('err', "VM $vmid creating disks failed");
 120         foreach my $volid (@$vollist) {
 121             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 122             warn $@ if $@;
 123         }
 124         die $err;
 125     }
 126
 127     # modify vm config if everything went well
 128     foreach my $ds (keys %$res) {
 129         $conf->{$ds} = $res->{$ds};
 130     }
 131
 132     return $vollist;
 133 };
 134
 135 my $check_vm_modify_config_perm = sub {
 136     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 137
 138     return 1 if $authuser eq 'root@pam';
 139
 140     foreach my $opt (@$key_list) {
 141         # disk checks need to be done somewhere else
 142         next if PVE::QemuServer::valid_drivename($opt);
 143
 144         if ($opt eq 'sockets' || $opt eq 'cores' ||
 145             $opt eq 'cpu' || $opt eq 'smp' ||
 146             $opt eq 'cpulimit' || $opt eq 'cpuunits') {
 147             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 148         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 149             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 150         } elsif ($opt eq 'memory' || $opt eq 'balloon') {
 151             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 152         } elsif ($opt eq 'args' || $opt eq 'lock') {
 153             die "only root can set '$opt' config\n";
 154         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' ||
 155                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet') {
 156             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 157         } elsif ($opt =~ m/^net\d+$/) {
 158             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 159         } else {
 160             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 161         }
 162     }
 163
 164     return 1;
 165 };
 166
 167 __PACKAGE__->register_method({
 168     name => 'vmlist',
 169     path => '',
 170     method => 'GET',
 171     description => "Virtual machine index (per node).",
 172     permissions => {
 173         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 174         user => 'all',
 175     },
 176     proxyto => 'node',
 177     protected => 1, # qemu pid files are only readable by root
 178     parameters => {
 179         additionalProperties => 0,
 180         properties => {
 181             node => get_standard_option('pve-node'),
 182         },
 183     },
 184     returns => {
 185         type => 'array',
 186         items => {
 187             type => "object",
 188             properties => {},
 189         },
 190         links => [ { rel => 'child', href => "{vmid}" } ],
 191     },
 192     code => sub {
 193         my ($param) = @_;
 194
 195         my $rpcenv = PVE::RPCEnvironment::get();
 196         my $authuser = $rpcenv->get_user();
 197
 198         my $vmstatus = PVE::QemuServer::vmstatus();
 199
 200         my $res = [];
 201         foreach my $vmid (keys %$vmstatus) {
 202             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 203
 204             my $data = $vmstatus->{$vmid};
 205             $data->{vmid} = $vmid;
 206             push @$res, $data;
 207         }
 208
 209         return $res;
 210     }});
 211
 212 __PACKAGE__->register_method({
 213     name => 'create_vm',
 214     path => '',
 215     method => 'POST',
 216     description => "Create or restore a virtual machine.",
 217     permissions => {
 218         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 219         check => [ 'or',
 220                    [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 221                    [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
 222             ],
 223     },
 224     protected => 1,
 225     proxyto => 'node',
 226     parameters => {
 227         additionalProperties => 0,
 228         properties => PVE::QemuServer::json_config_properties(
 229             {
 230                 node => get_standard_option('pve-node'),
 231                 vmid => get_standard_option('pve-vmid'),
 232                 archive => {
 233                     description => "The backup file.",
 234                     type => 'string',
 235                     optional => 1,
 236                     maxLength => 255,
 237                 },
 238                 storage => get_standard_option('pve-storage-id', {
 239                     description => "Default storage.",
 240                     optional => 1,
 241                 }),
 242                 force => {
 243                     optional => 1,
 244                     type => 'boolean',
 245                     description => "Allow to overwrite existing VM.",
 246                     requires => 'archive',
 247                 },
 248                 unique => {
 249                     optional => 1,
 250                     type => 'boolean',
 251                     description => "Assign a unique random ethernet address.",
 252                     requires => 'archive',
 253                 },
 254                 pool => {
 255                     optional => 1,
 256                     type => 'string', format => 'pve-poolid',
 257                     description => "Add the VM to the specified pool.",
 258                 },
 259             }),
 260     },
 261     returns => {
 262         type => 'string',
 263     },
 264     code => sub {
 265         my ($param) = @_;
 266
 267         my $rpcenv = PVE::RPCEnvironment::get();
 268
 269         my $authuser = $rpcenv->get_user();
 270
 271         my $node = extract_param($param, 'node');
 272
 273         my $vmid = extract_param($param, 'vmid');
 274
 275         my $archive = extract_param($param, 'archive');
 276
 277         my $storage = extract_param($param, 'storage');
 278
 279         my $force = extract_param($param, 'force');
 280
 281         my $unique = extract_param($param, 'unique');
 282
 283         my $pool = extract_param($param, 'pool');
 284
 285         my $filename = PVE::QemuServer::config_file($vmid);
 286
 287         my $storecfg = PVE::Storage::config();
 288
 289         PVE::Cluster::check_cfs_quorum();
 290
 291         if (defined($pool)) {
 292             $rpcenv->check_pool_exist($pool);
 293         }
 294
 295         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 296             if defined($storage);
 297
 298         if (!$archive) {
 299             &$resolve_cdrom_alias($param);
 300
 301             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 302
 303             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 304
 305             foreach my $opt (keys %$param) {
 306                 if (PVE::QemuServer::valid_drivename($opt)) {
 307                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 308                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 309
 310                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 311                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 312                 }
 313             }
 314
 315             PVE::QemuServer::add_random_macs($param);
 316         } else {
 317             my $keystr = join(' ', keys %$param);
 318             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 319
 320             if ($archive eq '-') {
 321                 die "pipe requires cli environment\n"
 322                     if $rpcenv->{type} ne 'cli';
 323             } else {
 324                 my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $archive);
 325
 326                 PVE::Storage::activate_volumes($storecfg, [ $archive ])
 327                     if PVE::Storage::parse_volume_id ($archive, 1);
 328
 329                 die "can't find archive file '$archive'\n" if !($path && -f $path);
 330                 $archive = $path;
 331             }
 332         }
 333
 334         my $addVMtoPoolFn = sub {
 335             my $usercfg = cfs_read_file("user.cfg");
 336             if (my $data = $usercfg->{pools}->{$pool}) {
 337                 $data->{vms}->{$vmid} = 1;
 338                 $usercfg->{vms}->{$vmid} = $pool;
 339                 cfs_write_file("user.cfg", $usercfg);
 340             }
 341         };
 342
 343         my $restorefn = sub {
 344
 345             if (-f $filename) {
 346                 die "unable to restore vm $vmid: config file already exists\n"
 347                     if !$force;
 348
 349                 die "unable to restore vm $vmid: vm is running\n"
 350                     if PVE::QemuServer::check_running($vmid);
 351
 352                 # destroy existing data - keep empty config
 353                 PVE::QemuServer::destroy_vm($storecfg, $vmid, 1);
 354             }
 355
 356             my $realcmd = sub {
 357                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 358                     storage => $storage,
 359                     pool => $pool,
 360                     unique => $unique });
 361
 362                 PVE::AccessControl::lock_user_config($addVMtoPoolFn, "can't add VM to pool") if $pool;
 363             };
 364
 365             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 366         };
 367
 368         my $createfn = sub {
 369
 370             # test after locking
 371             die "unable to create vm $vmid: config file already exists\n"
 372                 if -f $filename;
 373
 374             my $realcmd = sub {
 375
 376                 my $vollist = [];
 377
 378                 my $conf = $param;
 379
 380                 eval {
 381
 382                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 383
 384                     # try to be smart about bootdisk
 385                     my @disks = PVE::QemuServer::disknames();
 386                     my $firstdisk;
 387                     foreach my $ds (reverse @disks) {
 388                         next if !$conf->{$ds};
 389                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 390                         next if PVE::QemuServer::drive_is_cdrom($disk);
 391                         $firstdisk = $ds;
 392                     }
 393
 394                     if (!$conf->{bootdisk} && $firstdisk) {
 395                         $conf->{bootdisk} = $firstdisk;
 396                     }
 397
 398                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 399
 400                 };
 401                 my $err = $@;
 402
 403                 if ($err) {
 404                     foreach my $volid (@$vollist) {
 405                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 406                         warn $@ if $@;
 407                     }
 408                     die "create failed - $err";
 409                 }
 410
 411                 PVE::AccessControl::lock_user_config($addVMtoPoolFn, "can't add VM to pool") if $pool;
 412             };
 413
 414             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 415         };
 416
 417         return PVE::QemuServer::lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 418     }});
 419
 420 __PACKAGE__->register_method({
 421     name => 'vmdiridx',
 422     path => '{vmid}',
 423     method => 'GET',
 424     proxyto => 'node',
 425     description => "Directory index",
 426     permissions => {
 427         user => 'all',
 428     },
 429     parameters => {
 430         additionalProperties => 0,
 431         properties => {
 432             node => get_standard_option('pve-node'),
 433             vmid => get_standard_option('pve-vmid'),
 434         },
 435     },
 436     returns => {
 437         type => 'array',
 438         items => {
 439             type => "object",
 440             properties => {
 441                 subdir => { type => 'string' },
 442             },
 443         },
 444         links => [ { rel => 'child', href => "{subdir}" } ],
 445     },
 446     code => sub {
 447         my ($param) = @_;
 448
 449         my $res = [
 450             { subdir => 'config' },
 451             { subdir => 'status' },
 452             { subdir => 'unlink' },
 453             { subdir => 'vncproxy' },
 454             { subdir => 'migrate' },
 455             { subdir => 'resize' },
 456             { subdir => 'rrd' },
 457             { subdir => 'rrddata' },
 458             { subdir => 'monitor' },
 459             ];
 460
 461         return $res;
 462     }});
 463
 464 __PACKAGE__->register_method({
 465     name => 'rrd',
 466     path => '{vmid}/rrd',
 467     method => 'GET',
 468     protected => 1, # fixme: can we avoid that?
 469     permissions => {
 470         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 471     },
 472     description => "Read VM RRD statistics (returns PNG)",
 473     parameters => {
 474         additionalProperties => 0,
 475         properties => {
 476             node => get_standard_option('pve-node'),
 477             vmid => get_standard_option('pve-vmid'),
 478             timeframe => {
 479                 description => "Specify the time frame you are interested in.",
 480                 type => 'string',
 481                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 482             },
 483             ds => {
 484                 description => "The list of datasources you want to display.",
 485                 type => 'string', format => 'pve-configid-list',
 486             },
 487             cf => {
 488                 description => "The RRD consolidation function",
 489                 type => 'string',
 490                 enum => [ 'AVERAGE', 'MAX' ],
 491                 optional => 1,
 492             },
 493         },
 494     },
 495     returns => {
 496         type => "object",
 497         properties => {
 498             filename => { type => 'string' },
 499         },
 500     },
 501     code => sub {
 502         my ($param) = @_;
 503
 504         return PVE::Cluster::create_rrd_graph(
 505             "pve2-vm/$param->{vmid}", $param->{timeframe},
 506             $param->{ds}, $param->{cf});
 507
 508     }});
 509
 510 __PACKAGE__->register_method({
 511     name => 'rrddata',
 512     path => '{vmid}/rrddata',
 513     method => 'GET',
 514     protected => 1, # fixme: can we avoid that?
 515     permissions => {
 516         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 517     },
 518     description => "Read VM RRD statistics",
 519     parameters => {
 520         additionalProperties => 0,
 521         properties => {
 522             node => get_standard_option('pve-node'),
 523             vmid => get_standard_option('pve-vmid'),
 524             timeframe => {
 525                 description => "Specify the time frame you are interested in.",
 526                 type => 'string',
 527                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 528             },
 529             cf => {
 530                 description => "The RRD consolidation function",
 531                 type => 'string',
 532                 enum => [ 'AVERAGE', 'MAX' ],
 533                 optional => 1,
 534             },
 535         },
 536     },
 537     returns => {
 538         type => "array",
 539         items => {
 540             type => "object",
 541             properties => {},
 542         },
 543     },
 544     code => sub {
 545         my ($param) = @_;
 546
 547         return PVE::Cluster::create_rrd_data(
 548             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 549     }});
 550
 551
 552 __PACKAGE__->register_method({
 553     name => 'vm_config',
 554     path => '{vmid}/config',
 555     method => 'GET',
 556     proxyto => 'node',
 557     description => "Get virtual machine configuration.",
 558     permissions => {
 559         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 560     },
 561     parameters => {
 562         additionalProperties => 0,
 563         properties => {
 564             node => get_standard_option('pve-node'),
 565             vmid => get_standard_option('pve-vmid'),
 566         },
 567     },
 568     returns => {
 569         type => "object",
 570         properties => {
 571             digest => {
 572                 type => 'string',
 573                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 574             }
 575         },
 576     },
 577     code => sub {
 578         my ($param) = @_;
 579
 580         my $conf = PVE::QemuServer::load_config($param->{vmid});
 581
 582         delete $conf->{snapshots};
 583
 584         return $conf;
 585     }});
 586
 587 my $vm_is_volid_owner = sub {
 588     my ($storecfg, $vmid, $volid) =@_;
 589
 590     if ($volid !~  m|^/|) {
 591         my ($path, $owner);
 592         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 593         if ($owner && ($owner == $vmid)) {
 594             return 1;
 595         }
 596     }
 597
 598     return undef;
 599 };
 600
 601 my $test_deallocate_drive = sub {
 602     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 603
 604     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 605         my $volid = $drive->{file};
 606         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 607             if ($force || $key =~ m/^unused/) {
 608                 my $sid = PVE::Storage::parse_volume_id($volid);
 609                 return $sid;
 610             }
 611         }
 612     }
 613
 614     return undef;
 615 };
 616
 617 my $delete_drive = sub {
 618     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 619
 620     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 621         my $volid = $drive->{file};
 622         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 623             if ($force || $key =~ m/^unused/) {
 624                 eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 625                 die $@ if $@;
 626             } else {
 627                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 628             }
 629         }
 630     }
 631
 632     delete $conf->{$key};
 633 };
 634
 635 my $vmconfig_delete_option = sub {
 636     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 637
 638     return if !defined($conf->{$opt});
 639
 640     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 641
 642     if ($isDisk) {
 643         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 644
 645         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 646         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 647             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.Allocate']);
 648         }
 649     }
 650
 651     die "error hot-unplug $opt" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 652
 653     if ($isDisk) {
 654         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 655         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 656     } else {
 657         delete $conf->{$opt};
 658     }
 659
 660     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 661 };
 662
 663 my $safe_num_ne = sub {
 664     my ($a, $b) = @_;
 665
 666     return 0 if !defined($a) && !defined($b);
 667     return 1 if !defined($a);
 668     return 1 if !defined($b);
 669
 670     return $a != $b;
 671 };
 672
 673 my $vmconfig_update_disk = sub {
 674     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 675
 676     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 677
 678     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 679         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 680     } else {
 681         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 682     }
 683
 684     if ($conf->{$opt}) {
 685
 686         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 687
 688             my $media = $drive->{media} || 'disk';
 689             my $oldmedia = $old_drive->{media} || 'disk';
 690             die "unable to change media type\n" if $media ne $oldmedia;
 691
 692             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 693                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 694
 695                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 696                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 697             }
 698
 699             if(&$safe_num_ne($drive->{mbps}, $old_drive->{mbps}) ||
 700                &$safe_num_ne($drive->{mbps_rd}, $old_drive->{mbps_rd}) ||
 701                &$safe_num_ne($drive->{mbps_wr}, $old_drive->{mbps_wr}) ||
 702                &$safe_num_ne($drive->{iops}, $old_drive->{iops}) ||
 703                &$safe_num_ne($drive->{iops_rd}, $old_drive->{iops_rd}) ||
 704                &$safe_num_ne($drive->{iops_wr}, $old_drive->{iops_wr})) {
 705                PVE::QemuServer::qemu_block_set_io_throttle($vmid,"drive-$opt", $drive->{mbps}*1024*1024,
 706                                                            $drive->{mbps_rd}*1024*1024, $drive->{mbps_wr}*1024*1024,
 707                                                            $drive->{iops}, $drive->{iops_rd}, $drive->{iops_wr})
 708                    if !PVE::QemuServer::drive_is_cdrom($drive);
 709             }
 710         }
 711     }
 712
 713     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 714     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 715
 716     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 717     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 718
 719     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 720
 721         if (PVE::QemuServer::check_running($vmid)) {
 722             if ($drive->{file} eq 'none') {
 723                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt");
 724             } else {
 725                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 726                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt"); #force eject if locked
 727                 PVE::QemuServer::vm_mon_cmd($vmid, "change",device => "drive-$opt",target => "$path") if $path;
 728             }
 729         }
 730
 731     } else { # hotplug new disks
 732
 733         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 734     }
 735 };
 736
 737 my $vmconfig_update_net = sub {
 738     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 739
 740     if ($conf->{$opt}) {
 741         #if online update, then unplug first
 742         die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 743     }
 744
 745     $conf->{$opt} = $value;
 746     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 747     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 748
 749     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 750
 751     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 752 };
 753
 754 my $vm_config_perm_list = [
 755             'VM.Config.Disk',
 756             'VM.Config.CDROM',
 757             'VM.Config.CPU',
 758             'VM.Config.Memory',
 759             'VM.Config.Network',
 760             'VM.Config.HWType',
 761             'VM.Config.Options',
 762     ];
 763
 764 __PACKAGE__->register_method({
 765     name => 'update_vm',
 766     path => '{vmid}/config',
 767     method => 'PUT',
 768     protected => 1,
 769     proxyto => 'node',
 770     description => "Set virtual machine options.",
 771     permissions => {
 772         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
 773     },
 774     parameters => {
 775         additionalProperties => 0,
 776         properties => PVE::QemuServer::json_config_properties(
 777             {
 778                 node => get_standard_option('pve-node'),
 779                 vmid => get_standard_option('pve-vmid'),
 780                 skiplock => get_standard_option('skiplock'),
 781                 delete => {
 782                     type => 'string', format => 'pve-configid-list',
 783                     description => "A list of settings you want to delete.",
 784                     optional => 1,
 785                 },
 786                 force => {
 787                     type => 'boolean',
 788                     description => $opt_force_description,
 789                     optional => 1,
 790                     requires => 'delete',
 791                 },
 792                 digest => {
 793                     type => 'string',
 794                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
 795                     maxLength => 40,
 796                     optional => 1,
 797                 }
 798             }),
 799     },
 800     returns => { type => 'null'},
 801     code => sub {
 802         my ($param) = @_;
 803
 804         my $rpcenv = PVE::RPCEnvironment::get();
 805
 806         my $authuser = $rpcenv->get_user();
 807
 808         my $node = extract_param($param, 'node');
 809
 810         my $vmid = extract_param($param, 'vmid');
 811
 812         my $digest = extract_param($param, 'digest');
 813
 814         my @paramarr = (); # used for log message
 815         foreach my $key (keys %$param) {
 816             push @paramarr, "-$key", $param->{$key};
 817         }
 818
 819         my $skiplock = extract_param($param, 'skiplock');
 820         raise_param_exc({ skiplock => "Only root may use this option." })
 821             if $skiplock && $authuser ne 'root@pam';
 822
 823         my $delete_str = extract_param($param, 'delete');
 824
 825         my $force = extract_param($param, 'force');
 826
 827         die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 828
 829         my $storecfg = PVE::Storage::config();
 830
 831         &$resolve_cdrom_alias($param);
 832
 833         # now try to verify all parameters
 834
 835         my @delete = ();
 836         foreach my $opt (PVE::Tools::split_list($delete_str)) {
 837             $opt = 'ide2' if $opt eq 'cdrom';
 838             raise_param_exc({ delete => "you can't use '-$opt' and " .
 839                                   "-delete $opt' at the same time" })
 840                 if defined($param->{$opt});
 841
 842             if (!PVE::QemuServer::option_exists($opt)) {
 843                 raise_param_exc({ delete => "unknown option '$opt'" });
 844             }
 845
 846             push @delete, $opt;
 847         }
 848
 849         foreach my $opt (keys %$param) {
 850             if (PVE::QemuServer::valid_drivename($opt)) {
 851                 # cleanup drive path
 852                 my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 853                 PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 854                 $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 855             } elsif ($opt =~ m/^net(\d+)$/) {
 856                 # add macaddr
 857                 my $net = PVE::QemuServer::parse_net($param->{$opt});
 858                 $param->{$opt} = PVE::QemuServer::print_net($net);
 859             }
 860         }
 861
 862         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 863
 864         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 865
 866         &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 867
 868         my $updatefn =  sub {
 869
 870             my $conf = PVE::QemuServer::load_config($vmid);
 871
 872             die "checksum missmatch (file change by other user?)\n"
 873                 if $digest && $digest ne $conf->{digest};
 874
 875             PVE::QemuServer::check_lock($conf) if !$skiplock;
 876
 877             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
 878
 879             foreach my $opt (@delete) { # delete
 880                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 881                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 882             }
 883
 884             foreach my $opt (keys %$param) { # add/change
 885
 886                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 887
 888                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
 889
 890                 if (PVE::QemuServer::valid_drivename($opt)) {
 891
 892                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
 893                                            $opt, $param->{$opt}, $force);
 894
 895                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
 896
 897                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
 898                                           $opt, $param->{$opt});
 899
 900                 } else {
 901
 902                     $conf->{$opt} = $param->{$opt};
 903                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 904                 }
 905             }
 906         };
 907
 908         PVE::QemuServer::lock_config($vmid, $updatefn);
 909
 910         return undef;
 911     }});
 912
 913
 914 __PACKAGE__->register_method({
 915     name => 'destroy_vm',
 916     path => '{vmid}',
 917     method => 'DELETE',
 918     protected => 1,
 919     proxyto => 'node',
 920     description => "Destroy the vm (also delete all used/owned volumes).",
 921     permissions => {
 922         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 923     },
 924     parameters => {
 925         additionalProperties => 0,
 926         properties => {
 927             node => get_standard_option('pve-node'),
 928             vmid => get_standard_option('pve-vmid'),
 929             skiplock => get_standard_option('skiplock'),
 930         },
 931     },
 932     returns => {
 933         type => 'string',
 934     },
 935     code => sub {
 936         my ($param) = @_;
 937
 938         my $rpcenv = PVE::RPCEnvironment::get();
 939
 940         my $authuser = $rpcenv->get_user();
 941
 942         my $vmid = $param->{vmid};
 943
 944         my $skiplock = $param->{skiplock};
 945         raise_param_exc({ skiplock => "Only root may use this option." })
 946             if $skiplock && $authuser ne 'root@pam';
 947
 948         # test if VM exists
 949         my $conf = PVE::QemuServer::load_config($vmid);
 950
 951         my $storecfg = PVE::Storage::config();
 952
 953         my $delVMfromPoolFn = sub {
 954             my $usercfg = cfs_read_file("user.cfg");
 955             if (my $pool = $usercfg->{vms}->{$vmid}) {
 956                 if (my $data = $usercfg->{pools}->{$pool}) {
 957                     delete $data->{vms}->{$vmid};
 958                     delete $usercfg->{vms}->{$vmid};
 959                     cfs_write_file("user.cfg", $usercfg);
 960                 }
 961             }
 962         };
 963
 964         my $realcmd = sub {
 965             my $upid = shift;
 966
 967             syslog('info', "destroy VM $vmid: $upid\n");
 968
 969             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
 970
 971             PVE::AccessControl::lock_user_config($delVMfromPoolFn, "pool cleanup failed");
 972         };
 973
 974         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
 975     }});
 976
 977 __PACKAGE__->register_method({
 978     name => 'unlink',
 979     path => '{vmid}/unlink',
 980     method => 'PUT',
 981     protected => 1,
 982     proxyto => 'node',
 983     description => "Unlink/delete disk images.",
 984     permissions => {
 985         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
 986     },
 987     parameters => {
 988         additionalProperties => 0,
 989         properties => {
 990             node => get_standard_option('pve-node'),
 991             vmid => get_standard_option('pve-vmid'),
 992             idlist => {
 993                 type => 'string', format => 'pve-configid-list',
 994                 description => "A list of disk IDs you want to delete.",
 995             },
 996             force => {
 997                 type => 'boolean',
 998                 description => $opt_force_description,
 999                 optional => 1,
1000             },
1001         },
1002     },
1003     returns => { type => 'null'},
1004     code => sub {
1005         my ($param) = @_;
1006
1007         $param->{delete} = extract_param($param, 'idlist');
1008
1009         __PACKAGE__->update_vm($param);
1010
1011         return undef;
1012     }});
1013
1014 my $sslcert;
1015
1016 __PACKAGE__->register_method({
1017     name => 'vncproxy',
1018     path => '{vmid}/vncproxy',
1019     method => 'POST',
1020     protected => 1,
1021     permissions => {
1022         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1023     },
1024     description => "Creates a TCP VNC proxy connections.",
1025     parameters => {
1026         additionalProperties => 0,
1027         properties => {
1028             node => get_standard_option('pve-node'),
1029             vmid => get_standard_option('pve-vmid'),
1030         },
1031     },
1032     returns => {
1033         additionalProperties => 0,
1034         properties => {
1035             user => { type => 'string' },
1036             ticket => { type => 'string' },
1037             cert => { type => 'string' },
1038             port => { type => 'integer' },
1039             upid => { type => 'string' },
1040         },
1041     },
1042     code => sub {
1043         my ($param) = @_;
1044
1045         my $rpcenv = PVE::RPCEnvironment::get();
1046
1047         my $authuser = $rpcenv->get_user();
1048
1049         my $vmid = $param->{vmid};
1050         my $node = $param->{node};
1051
1052         my $authpath = "/vms/$vmid";
1053
1054         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1055
1056         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1057             if !$sslcert;
1058
1059         my $port = PVE::Tools::next_vnc_port();
1060
1061         my $remip;
1062
1063         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1064             $remip = PVE::Cluster::remote_node_ip($node);
1065         }
1066
1067         # NOTE: kvm VNC traffic is already TLS encrypted,
1068         # so we select the fastest chipher here (or 'none'?)
1069         my $remcmd = $remip ? ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes',
1070                                '-c', 'blowfish-cbc', $remip] : [];
1071
1072         my $timeout = 10;
1073
1074         my $realcmd = sub {
1075             my $upid = shift;
1076
1077             syslog('info', "starting vnc proxy $upid\n");
1078
1079             my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1080
1081             my $qmstr = join(' ', @$qmcmd);
1082
1083             # also redirect stderr (else we get RFB protocol errors)
1084             my $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1085
1086             PVE::Tools::run_command($cmd);
1087
1088             return;
1089         };
1090
1091         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1092
1093         return {
1094             user => $authuser,
1095             ticket => $ticket,
1096             port => $port,
1097             upid => $upid,
1098             cert => $sslcert,
1099         };
1100     }});
1101
1102 __PACKAGE__->register_method({
1103     name => 'vmcmdidx',
1104     path => '{vmid}/status',
1105     method => 'GET',
1106     proxyto => 'node',
1107     description => "Directory index",
1108     permissions => {
1109         user => 'all',
1110     },
1111     parameters => {
1112         additionalProperties => 0,
1113         properties => {
1114             node => get_standard_option('pve-node'),
1115             vmid => get_standard_option('pve-vmid'),
1116         },
1117     },
1118     returns => {
1119         type => 'array',
1120         items => {
1121             type => "object",
1122             properties => {
1123                 subdir => { type => 'string' },
1124             },
1125         },
1126         links => [ { rel => 'child', href => "{subdir}" } ],
1127     },
1128     code => sub {
1129         my ($param) = @_;
1130
1131         # test if VM exists
1132         my $conf = PVE::QemuServer::load_config($param->{vmid});
1133
1134         my $res = [
1135             { subdir => 'current' },
1136             { subdir => 'start' },
1137             { subdir => 'stop' },
1138             ];
1139
1140         return $res;
1141     }});
1142
1143 my $vm_is_ha_managed = sub {
1144     my ($vmid) = @_;
1145
1146     my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1147     if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $vmid, 1)) {
1148         return 1;
1149     }
1150     return 0;
1151 };
1152
1153 __PACKAGE__->register_method({
1154     name => 'vm_status',
1155     path => '{vmid}/status/current',
1156     method => 'GET',
1157     proxyto => 'node',
1158     protected => 1, # qemu pid files are only readable by root
1159     description => "Get virtual machine status.",
1160     permissions => {
1161         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1162     },
1163     parameters => {
1164         additionalProperties => 0,
1165         properties => {
1166             node => get_standard_option('pve-node'),
1167             vmid => get_standard_option('pve-vmid'),
1168         },
1169     },
1170     returns => { type => 'object' },
1171     code => sub {
1172         my ($param) = @_;
1173
1174         # test if VM exists
1175         my $conf = PVE::QemuServer::load_config($param->{vmid});
1176
1177         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1178         my $status = $vmstatus->{$param->{vmid}};
1179
1180         $status->{ha} = &$vm_is_ha_managed($param->{vmid});
1181
1182         return $status;
1183     }});
1184
1185 __PACKAGE__->register_method({
1186     name => 'vm_start',
1187     path => '{vmid}/status/start',
1188     method => 'POST',
1189     protected => 1,
1190     proxyto => 'node',
1191     description => "Start virtual machine.",
1192     permissions => {
1193         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1194     },
1195     parameters => {
1196         additionalProperties => 0,
1197         properties => {
1198             node => get_standard_option('pve-node'),
1199             vmid => get_standard_option('pve-vmid'),
1200             skiplock => get_standard_option('skiplock'),
1201             stateuri => get_standard_option('pve-qm-stateuri'),
1202             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1203
1204         },
1205     },
1206     returns => {
1207         type => 'string',
1208     },
1209     code => sub {
1210         my ($param) = @_;
1211
1212         my $rpcenv = PVE::RPCEnvironment::get();
1213
1214         my $authuser = $rpcenv->get_user();
1215
1216         my $node = extract_param($param, 'node');
1217
1218         my $vmid = extract_param($param, 'vmid');
1219
1220         my $stateuri = extract_param($param, 'stateuri');
1221         raise_param_exc({ stateuri => "Only root may use this option." })
1222             if $stateuri && $authuser ne 'root@pam';
1223
1224         my $skiplock = extract_param($param, 'skiplock');
1225         raise_param_exc({ skiplock => "Only root may use this option." })
1226             if $skiplock && $authuser ne 'root@pam';
1227
1228         my $migratedfrom = extract_param($param, 'migratedfrom');
1229         raise_param_exc({ migratedfrom => "Only root may use this option." })
1230             if $migratedfrom && $authuser ne 'root@pam';
1231
1232         my $storecfg = PVE::Storage::config();
1233
1234         if (&$vm_is_ha_managed($vmid) && !$stateuri &&
1235             $rpcenv->{type} ne 'ha') {
1236
1237             my $hacmd = sub {
1238                 my $upid = shift;
1239
1240                 my $service = "pvevm:$vmid";
1241
1242                 my $cmd = ['clusvcadm', '-e', $service, '-m', $node];
1243
1244                 print "Executing HA start for VM $vmid\n";
1245
1246                 PVE::Tools::run_command($cmd);
1247
1248                 return;
1249             };
1250
1251             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1252
1253         } else {
1254
1255             my $realcmd = sub {
1256                 my $upid = shift;
1257
1258                 syslog('info', "start VM $vmid: $upid\n");
1259
1260                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom);
1261
1262                 return;
1263             };
1264
1265             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1266         }
1267     }});
1268
1269 __PACKAGE__->register_method({
1270     name => 'vm_stop',
1271     path => '{vmid}/status/stop',
1272     method => 'POST',
1273     protected => 1,
1274     proxyto => 'node',
1275     description => "Stop virtual machine.",
1276     permissions => {
1277         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1278     },
1279     parameters => {
1280         additionalProperties => 0,
1281         properties => {
1282             node => get_standard_option('pve-node'),
1283             vmid => get_standard_option('pve-vmid'),
1284             skiplock => get_standard_option('skiplock'),
1285             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1286             timeout => {
1287                 description => "Wait maximal timeout seconds.",
1288                 type => 'integer',
1289                 minimum => 0,
1290                 optional => 1,
1291             },
1292             keepActive => {
1293                 description => "Do not decativate storage volumes.",
1294                 type => 'boolean',
1295                 optional => 1,
1296                 default => 0,
1297             }
1298         },
1299     },
1300     returns => {
1301         type => 'string',
1302     },
1303     code => sub {
1304         my ($param) = @_;
1305
1306         my $rpcenv = PVE::RPCEnvironment::get();
1307
1308         my $authuser = $rpcenv->get_user();
1309
1310         my $node = extract_param($param, 'node');
1311
1312         my $vmid = extract_param($param, 'vmid');
1313
1314         my $skiplock = extract_param($param, 'skiplock');
1315         raise_param_exc({ skiplock => "Only root may use this option." })
1316             if $skiplock && $authuser ne 'root@pam';
1317
1318         my $keepActive = extract_param($param, 'keepActive');
1319         raise_param_exc({ keepActive => "Only root may use this option." })
1320             if $keepActive && $authuser ne 'root@pam';
1321
1322         my $migratedfrom = extract_param($param, 'migratedfrom');
1323         raise_param_exc({ migratedfrom => "Only root may use this option." })
1324             if $migratedfrom && $authuser ne 'root@pam';
1325
1326
1327         my $storecfg = PVE::Storage::config();
1328
1329         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1330
1331             my $hacmd = sub {
1332                 my $upid = shift;
1333
1334                 my $service = "pvevm:$vmid";
1335
1336                 my $cmd = ['clusvcadm', '-d', $service];
1337
1338                 print "Executing HA stop for VM $vmid\n";
1339
1340                 PVE::Tools::run_command($cmd);
1341
1342                 return;
1343             };
1344
1345             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1346
1347         } else {
1348             my $realcmd = sub {
1349                 my $upid = shift;
1350
1351                 syslog('info', "stop VM $vmid: $upid\n");
1352
1353                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1354                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1355
1356                 return;
1357             };
1358
1359             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1360         }
1361     }});
1362
1363 __PACKAGE__->register_method({
1364     name => 'vm_reset',
1365     path => '{vmid}/status/reset',
1366     method => 'POST',
1367     protected => 1,
1368     proxyto => 'node',
1369     description => "Reset virtual machine.",
1370     permissions => {
1371         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1372     },
1373     parameters => {
1374         additionalProperties => 0,
1375         properties => {
1376             node => get_standard_option('pve-node'),
1377             vmid => get_standard_option('pve-vmid'),
1378             skiplock => get_standard_option('skiplock'),
1379         },
1380     },
1381     returns => {
1382         type => 'string',
1383     },
1384     code => sub {
1385         my ($param) = @_;
1386
1387         my $rpcenv = PVE::RPCEnvironment::get();
1388
1389         my $authuser = $rpcenv->get_user();
1390
1391         my $node = extract_param($param, 'node');
1392
1393         my $vmid = extract_param($param, 'vmid');
1394
1395         my $skiplock = extract_param($param, 'skiplock');
1396         raise_param_exc({ skiplock => "Only root may use this option." })
1397             if $skiplock && $authuser ne 'root@pam';
1398
1399         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1400
1401         my $realcmd = sub {
1402             my $upid = shift;
1403
1404             PVE::QemuServer::vm_reset($vmid, $skiplock);
1405
1406             return;
1407         };
1408
1409         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1410     }});
1411
1412 __PACKAGE__->register_method({
1413     name => 'vm_shutdown',
1414     path => '{vmid}/status/shutdown',
1415     method => 'POST',
1416     protected => 1,
1417     proxyto => 'node',
1418     description => "Shutdown virtual machine.",
1419     permissions => {
1420         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1421     },
1422     parameters => {
1423         additionalProperties => 0,
1424         properties => {
1425             node => get_standard_option('pve-node'),
1426             vmid => get_standard_option('pve-vmid'),
1427             skiplock => get_standard_option('skiplock'),
1428             timeout => {
1429                 description => "Wait maximal timeout seconds.",
1430                 type => 'integer',
1431                 minimum => 0,
1432                 optional => 1,
1433             },
1434             forceStop => {
1435                 description => "Make sure the VM stops.",
1436                 type => 'boolean',
1437                 optional => 1,
1438                 default => 0,
1439             },
1440             keepActive => {
1441                 description => "Do not decativate storage volumes.",
1442                 type => 'boolean',
1443                 optional => 1,
1444                 default => 0,
1445             }
1446         },
1447     },
1448     returns => {
1449         type => 'string',
1450     },
1451     code => sub {
1452         my ($param) = @_;
1453
1454         my $rpcenv = PVE::RPCEnvironment::get();
1455
1456         my $authuser = $rpcenv->get_user();
1457
1458         my $node = extract_param($param, 'node');
1459
1460         my $vmid = extract_param($param, 'vmid');
1461
1462         my $skiplock = extract_param($param, 'skiplock');
1463         raise_param_exc({ skiplock => "Only root may use this option." })
1464             if $skiplock && $authuser ne 'root@pam';
1465
1466         my $keepActive = extract_param($param, 'keepActive');
1467         raise_param_exc({ keepActive => "Only root may use this option." })
1468             if $keepActive && $authuser ne 'root@pam';
1469
1470         my $storecfg = PVE::Storage::config();
1471
1472         my $realcmd = sub {
1473             my $upid = shift;
1474
1475             syslog('info', "shutdown VM $vmid: $upid\n");
1476
1477             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1478                                      1, $param->{forceStop}, $keepActive);
1479
1480             return;
1481         };
1482
1483         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1484     }});
1485
1486 __PACKAGE__->register_method({
1487     name => 'vm_suspend',
1488     path => '{vmid}/status/suspend',
1489     method => 'POST',
1490     protected => 1,
1491     proxyto => 'node',
1492     description => "Suspend virtual machine.",
1493     permissions => {
1494         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1495     },
1496     parameters => {
1497         additionalProperties => 0,
1498         properties => {
1499             node => get_standard_option('pve-node'),
1500             vmid => get_standard_option('pve-vmid'),
1501             skiplock => get_standard_option('skiplock'),
1502         },
1503     },
1504     returns => {
1505         type => 'string',
1506     },
1507     code => sub {
1508         my ($param) = @_;
1509
1510         my $rpcenv = PVE::RPCEnvironment::get();
1511
1512         my $authuser = $rpcenv->get_user();
1513
1514         my $node = extract_param($param, 'node');
1515
1516         my $vmid = extract_param($param, 'vmid');
1517
1518         my $skiplock = extract_param($param, 'skiplock');
1519         raise_param_exc({ skiplock => "Only root may use this option." })
1520             if $skiplock && $authuser ne 'root@pam';
1521
1522         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1523
1524         my $realcmd = sub {
1525             my $upid = shift;
1526
1527             syslog('info', "suspend VM $vmid: $upid\n");
1528
1529             PVE::QemuServer::vm_suspend($vmid, $skiplock);
1530
1531             return;
1532         };
1533
1534         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
1535     }});
1536
1537 __PACKAGE__->register_method({
1538     name => 'vm_resume',
1539     path => '{vmid}/status/resume',
1540     method => 'POST',
1541     protected => 1,
1542     proxyto => 'node',
1543     description => "Resume virtual machine.",
1544     permissions => {
1545         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1546     },
1547     parameters => {
1548         additionalProperties => 0,
1549         properties => {
1550             node => get_standard_option('pve-node'),
1551             vmid => get_standard_option('pve-vmid'),
1552             skiplock => get_standard_option('skiplock'),
1553         },
1554     },
1555     returns => {
1556         type => 'string',
1557     },
1558     code => sub {
1559         my ($param) = @_;
1560
1561         my $rpcenv = PVE::RPCEnvironment::get();
1562
1563         my $authuser = $rpcenv->get_user();
1564
1565         my $node = extract_param($param, 'node');
1566
1567         my $vmid = extract_param($param, 'vmid');
1568
1569         my $skiplock = extract_param($param, 'skiplock');
1570         raise_param_exc({ skiplock => "Only root may use this option." })
1571             if $skiplock && $authuser ne 'root@pam';
1572
1573         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1574
1575         my $realcmd = sub {
1576             my $upid = shift;
1577
1578             syslog('info', "resume VM $vmid: $upid\n");
1579
1580             PVE::QemuServer::vm_resume($vmid, $skiplock);
1581
1582             return;
1583         };
1584
1585         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
1586     }});
1587
1588 __PACKAGE__->register_method({
1589     name => 'vm_sendkey',
1590     path => '{vmid}/sendkey',
1591     method => 'PUT',
1592     protected => 1,
1593     proxyto => 'node',
1594     description => "Send key event to virtual machine.",
1595     permissions => {
1596         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1597     },
1598     parameters => {
1599         additionalProperties => 0,
1600         properties => {
1601             node => get_standard_option('pve-node'),
1602             vmid => get_standard_option('pve-vmid'),
1603             skiplock => get_standard_option('skiplock'),
1604             key => {
1605                 description => "The key (qemu monitor encoding).",
1606                 type => 'string'
1607             }
1608         },
1609     },
1610     returns => { type => 'null'},
1611     code => sub {
1612         my ($param) = @_;
1613
1614         my $rpcenv = PVE::RPCEnvironment::get();
1615
1616         my $authuser = $rpcenv->get_user();
1617
1618         my $node = extract_param($param, 'node');
1619
1620         my $vmid = extract_param($param, 'vmid');
1621
1622         my $skiplock = extract_param($param, 'skiplock');
1623         raise_param_exc({ skiplock => "Only root may use this option." })
1624             if $skiplock && $authuser ne 'root@pam';
1625
1626         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
1627
1628         return;
1629     }});
1630
1631 __PACKAGE__->register_method({
1632     name => 'migrate_vm',
1633     path => '{vmid}/migrate',
1634     method => 'POST',
1635     protected => 1,
1636     proxyto => 'node',
1637     description => "Migrate virtual machine. Creates a new migration task.",
1638     permissions => {
1639         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
1640     },
1641     parameters => {
1642         additionalProperties => 0,
1643         properties => {
1644             node => get_standard_option('pve-node'),
1645             vmid => get_standard_option('pve-vmid'),
1646             target => get_standard_option('pve-node', { description => "Target node." }),
1647             online => {
1648                 type => 'boolean',
1649                 description => "Use online/live migration.",
1650                 optional => 1,
1651             },
1652             force => {
1653                 type => 'boolean',
1654                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
1655                 optional => 1,
1656             },
1657         },
1658     },
1659     returns => {
1660         type => 'string',
1661         description => "the task ID.",
1662     },
1663     code => sub {
1664         my ($param) = @_;
1665
1666         my $rpcenv = PVE::RPCEnvironment::get();
1667
1668         my $authuser = $rpcenv->get_user();
1669
1670         my $target = extract_param($param, 'target');
1671
1672         my $localnode = PVE::INotify::nodename();
1673         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1674
1675         PVE::Cluster::check_cfs_quorum();
1676
1677         PVE::Cluster::check_node_exists($target);
1678
1679         my $targetip = PVE::Cluster::remote_node_ip($target);
1680
1681         my $vmid = extract_param($param, 'vmid');
1682
1683         raise_param_exc({ force => "Only root may use this option." })
1684             if $param->{force} && $authuser ne 'root@pam';
1685
1686         # test if VM exists
1687         my $conf = PVE::QemuServer::load_config($vmid);
1688
1689         # try to detect errors early
1690
1691         PVE::QemuServer::check_lock($conf);
1692
1693         if (PVE::QemuServer::check_running($vmid)) {
1694             die "cant migrate running VM without --online\n"
1695                 if !$param->{online};
1696         }
1697
1698         my $storecfg = PVE::Storage::config();
1699         PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
1700
1701         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1702
1703             my $hacmd = sub {
1704                 my $upid = shift;
1705
1706                 my $service = "pvevm:$vmid";
1707
1708                 my $cmd = ['clusvcadm', '-M', $service, '-m', $target];
1709
1710                 print "Executing HA migrate for VM $vmid to node $target\n";
1711
1712                 PVE::Tools::run_command($cmd);
1713
1714                 return;
1715             };
1716
1717             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1718
1719         } else {
1720
1721             my $realcmd = sub {
1722                 my $upid = shift;
1723
1724                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
1725             };
1726
1727             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
1728         }
1729
1730     }});
1731
1732 __PACKAGE__->register_method({
1733     name => 'monitor',
1734     path => '{vmid}/monitor',
1735     method => 'POST',
1736     protected => 1,
1737     proxyto => 'node',
1738     description => "Execute Qemu monitor commands.",
1739     permissions => {
1740         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
1741     },
1742     parameters => {
1743         additionalProperties => 0,
1744         properties => {
1745             node => get_standard_option('pve-node'),
1746             vmid => get_standard_option('pve-vmid'),
1747             command => {
1748                 type => 'string',
1749                 description => "The monitor command.",
1750             }
1751         },
1752     },
1753     returns => { type => 'string'},
1754     code => sub {
1755         my ($param) = @_;
1756
1757         my $vmid = $param->{vmid};
1758
1759         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
1760
1761         my $res = '';
1762         eval {
1763             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
1764         };
1765         $res = "ERROR: $@" if $@;
1766
1767         return $res;
1768     }});
1769
1770 __PACKAGE__->register_method({
1771     name => 'resize_vm',
1772     path => '{vmid}/resize',
1773     method => 'PUT',
1774     protected => 1,
1775     proxyto => 'node',
1776     description => "Extend volume size.",
1777     permissions => {
1778         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1779     },
1780     parameters => {
1781         additionalProperties => 0,
1782         properties => {
1783             node => get_standard_option('pve-node'),
1784             vmid => get_standard_option('pve-vmid'),
1785             skiplock => get_standard_option('skiplock'),
1786             disk => {
1787                 type => 'string',
1788                 description => "The disk you want to resize.",
1789                 enum => [PVE::QemuServer::disknames()],
1790             },
1791             size => {
1792                 type => 'string',
1793                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
1794                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
1795             },
1796             digest => {
1797                 type => 'string',
1798                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1799                 maxLength => 40,
1800                 optional => 1,
1801             },
1802         },
1803     },
1804     returns => { type => 'null'},
1805     code => sub {
1806         my ($param) = @_;
1807
1808         my $rpcenv = PVE::RPCEnvironment::get();
1809
1810         my $authuser = $rpcenv->get_user();
1811
1812         my $node = extract_param($param, 'node');
1813
1814         my $vmid = extract_param($param, 'vmid');
1815
1816         my $digest = extract_param($param, 'digest');
1817
1818         my $disk = extract_param($param, 'disk');
1819
1820         my $sizestr = extract_param($param, 'size');
1821
1822         my $skiplock = extract_param($param, 'skiplock');
1823         raise_param_exc({ skiplock => "Only root may use this option." })
1824             if $skiplock && $authuser ne 'root@pam';
1825
1826         my $storecfg = PVE::Storage::config();
1827
1828         my $updatefn =  sub {
1829
1830             my $conf = PVE::QemuServer::load_config($vmid);
1831
1832             die "checksum missmatch (file change by other user?)\n"
1833                 if $digest && $digest ne $conf->{digest};
1834             PVE::QemuServer::check_lock($conf) if !$skiplock;
1835
1836             die "disk '$disk' does not exist\n" if !$conf->{$disk};
1837
1838             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
1839
1840             my $volid = $drive->{file};
1841
1842             die "disk '$disk' has no associated volume\n" if !$volid;
1843
1844             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
1845
1846             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
1847
1848             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
1849
1850             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
1851
1852             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
1853             my ($ext, $newsize, $unit) = ($1, $2, $4);
1854             if ($unit) {
1855                 if ($unit eq 'K') {
1856                     $newsize = $newsize * 1024;
1857                 } elsif ($unit eq 'M') {
1858                     $newsize = $newsize * 1024 * 1024;
1859                 } elsif ($unit eq 'G') {
1860                     $newsize = $newsize * 1024 * 1024 * 1024;
1861                 } elsif ($unit eq 'T') {
1862                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
1863                 }
1864             }
1865             $newsize += $size if $ext;
1866             $newsize = int($newsize);
1867
1868             die "unable to skrink disk size\n" if $newsize < $size;
1869
1870             return if $size == $newsize;
1871
1872             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
1873
1874             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
1875
1876             $drive->{size} = $newsize;
1877             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
1878
1879             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1880         };
1881
1882         PVE::QemuServer::lock_config($vmid, $updatefn);
1883         return undef;
1884     }});
1885
1886 __PACKAGE__->register_method({
1887     name => 'snapshot_vm',
1888     path => '{vmid}/snapshot',
1889     method => 'PUT',
1890     protected => 1,
1891     proxyto => 'node',
1892     description => "Snapshot a VM.",
1893     permissions => {
1894         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
1895     },
1896     parameters => {
1897         additionalProperties => 0,
1898         properties => {
1899             node => get_standard_option('pve-node'),
1900             vmid => get_standard_option('pve-vmid'),
1901             skiplock => get_standard_option('skiplock'),
1902             action => {
1903                 type => 'string',
1904                 description => "Action",
1905                 enum => [ 'create', 'delete', 'rollback' ],
1906             },
1907             snapname => {
1908                 type => 'string',
1909                 description => "The name of the snapshot",
1910                 maxLength => 40,
1911             },
1912             vmstate => {
1913                 optional => 1,
1914                 type => 'boolean',
1915                 description => "Save the vmstate",
1916             },
1917             freezefs => {
1918                 optional => 1,
1919                 type => 'boolean',
1920                 description => "Freeze the filesystem",
1921             },
1922             digest => {
1923                 type => 'string',
1924                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1925                 maxLength => 40,
1926                 optional => 1,
1927             },
1928         },
1929     },
1930     returns => { type => 'null'},
1931     code => sub {
1932         my ($param) = @_;
1933
1934         my $rpcenv = PVE::RPCEnvironment::get();
1935
1936         my $authuser = $rpcenv->get_user();
1937
1938         my $node = extract_param($param, 'node');
1939
1940         my $vmid = extract_param($param, 'vmid');
1941
1942         my $digest = extract_param($param, 'digest');
1943
1944         my $action = extract_param($param, 'action');
1945
1946         my $snapname = extract_param($param, 'snapname');
1947
1948         my $vmstate = extract_param($param, 'vmstate');
1949
1950         my $freezefs = extract_param($param, 'freezefs');
1951
1952         my $skiplock = extract_param($param, 'skiplock');
1953         raise_param_exc({ skiplock => "Only root may use this option." })
1954                 if $skiplock && $authuser ne 'root@pam';
1955
1956
1957         # fixme: digest?
1958         # fixme: access rights?
1959         # &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $conf);
1960         # fixme: need to implement a check to see if all storages support snapshots
1961
1962         if($action eq 'create') {
1963             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
1964             PVE::QemuServer::snapshot_create($vmid, $snapname, $vmstate, $freezefs);
1965         } elsif($action eq 'rollback'){
1966             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
1967             PVE::QemuServer::snapshot_rollback($vmid, $snapname);
1968         } elsif($action eq 'delete') {
1969             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
1970             PVE::QemuServer::snapshot_delete($vmid, $snapname, $vmstate);
1971         }
1972
1973         return undef;
1974     }});
1975
1976 1;