]> git.proxmox.com Git - qemu-server.git/blobdiff - PVE/API2/Qemu.pm
api: create disks: avoid adding secondary cloud-init drives
[qemu-server.git] / PVE / API2 / Qemu.pm
index 6830009d51287efe323a219aa18e878548ac2b93..3ec31c26898644114c7727d9030a6545626dd849 100644 (file)
@@ -21,8 +21,9 @@ use PVE::ReplicationConfig;
 use PVE::GuestHelpers;
 use PVE::QemuConfig;
 use PVE::QemuServer;
-use PVE::QemuServer::Drive;
 use PVE::QemuServer::CPUConfig;
+use PVE::QemuServer::Drive;
+use PVE::QemuServer::ImportDisk;
 use PVE::QemuServer::Monitor qw(mon_cmd);
 use PVE::QemuServer::Machine;
 use PVE::QemuMigrate;
@@ -63,11 +64,65 @@ my $resolve_cdrom_alias = sub {
     }
 };
 
+# Used in import-enabled API endpoints. Parses drives using the extended '_with_alloc' schema.
+my $foreach_volume_with_alloc = sub {
+    my ($param, $func) = @_;
+
+    for my $opt (sort keys $param->%*) {
+       next if !PVE::QemuServer::is_valid_drivename($opt);
+
+       my $drive = PVE::QemuServer::Drive::parse_drive($opt, $param->{$opt}, 1);
+       next if !$drive;
+
+       $func->($opt, $drive);
+    }
+};
+
 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
+
+my $check_drive_param = sub {
+    my ($param, $storecfg, $extra_checks) = @_;
+
+    for my $opt (sort keys $param->%*) {
+       next if !PVE::QemuServer::is_valid_drivename($opt);
+
+       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt}, 1);
+       raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
+
+       if ($drive->{'import-from'}) {
+           if ($drive->{file} !~ $NEW_DISK_RE || $3 != 0) {
+               raise_param_exc({
+                   $opt => "'import-from' requires special syntax - ".
+                       "use <storage ID>:0,import-from=<source>",
+               });
+           }
+
+           if ($opt eq 'efidisk0') {
+               for my $required (qw(efitype pre-enrolled-keys)) {
+                   if (!defined($drive->{$required})) {
+                       raise_param_exc({
+                           $opt => "need to specify '$required' when using 'import-from'",
+                       });
+                   }
+               }
+           } elsif ($opt eq 'tpmstate0') {
+               raise_param_exc({ $opt => "need to specify 'version' when using 'import-from'" })
+                   if !defined($drive->{version});
+           }
+       }
+
+       PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
+
+       $extra_checks->($drive) if $extra_checks;
+
+       $param->{$opt} = PVE::QemuServer::print_drive($drive, 1);
+    }
+};
+
 my $check_storage_access = sub {
    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
 
-   PVE::QemuConfig->foreach_volume($settings, sub {
+   $foreach_volume_with_alloc->($settings, sub {
        my ($ds, $drive) = @_;
 
        my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
@@ -88,6 +143,26 @@ my $check_storage_access = sub {
                if !$scfg->{content}->{images};
        } else {
            PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
+           if ($storeid) {
+               my ($vtype) = PVE::Storage::parse_volname($storecfg, $volid);
+               raise_param_exc({ $ds => "content type needs to be 'images' or 'iso'" })
+                   if $vtype ne 'images' && $vtype ne 'iso';
+           }
+       }
+
+       if (my $src_image = $drive->{'import-from'}) {
+           my $src_vmid;
+           if (PVE::Storage::parse_volume_id($src_image, 1)) { # PVE-managed volume
+               (my $vtype, undef, $src_vmid) = PVE::Storage::parse_volname($storecfg, $src_image);
+               raise_param_exc({ $ds => "$src_image has wrong type '$vtype' - not an image" })
+                   if $vtype ne 'images';
+           }
+
+           if ($src_vmid) { # might be actively used by VM and will be copied via clone_disk()
+               $rpcenv->check($authuser, "/vms/${src_vmid}", ['VM.Clone']);
+           } else {
+               PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $src_image);
+           }
        }
     });
 
@@ -147,6 +222,91 @@ my $check_storage_access_migrate = sub {
        if !$scfg->{content}->{images};
 };
 
+my $import_from_volid = sub {
+    my ($storecfg, $src_volid, $dest_info, $vollist) = @_;
+
+    die "could not get size of $src_volid\n"
+       if !PVE::Storage::volume_size_info($storecfg, $src_volid, 10);
+
+    die "cannot import from cloudinit disk\n"
+       if PVE::QemuServer::Drive::drive_is_cloudinit({ file => $src_volid });
+
+    my $src_vmid = (PVE::Storage::parse_volname($storecfg, $src_volid))[2];
+
+    my $src_vm_state = sub {
+       my $exists = $src_vmid && PVE::Cluster::get_vmlist()->{ids}->{$src_vmid} ? 1 : 0;
+
+       my $runs = 0;
+       if ($exists) {
+           eval { PVE::QemuConfig::assert_config_exists_on_node($src_vmid); };
+           die "owner VM $src_vmid not on local node\n" if $@;
+           $runs = PVE::QemuServer::Helpers::vm_running_locally($src_vmid) || 0;
+       }
+
+       return ($exists, $runs);
+    };
+
+    my ($src_vm_exists, $running) = $src_vm_state->();
+
+    die "cannot import from '$src_volid' - full clone feature is not supported\n"
+       if !PVE::Storage::volume_has_feature($storecfg, 'copy', $src_volid, undef, $running);
+
+    my $clonefn = sub {
+       my ($src_vm_exists_now, $running_now) = $src_vm_state->();
+
+       die "owner VM $src_vmid changed state unexpectedly\n"
+           if $src_vm_exists_now != $src_vm_exists || $running_now != $running;
+
+       my $src_conf = $src_vm_exists_now ? PVE::QemuConfig->load_config($src_vmid) : {};
+
+       my $src_drive = { file => $src_volid };
+       my $src_drivename;
+       PVE::QemuConfig->foreach_volume($src_conf, sub {
+           my ($ds, $drive) = @_;
+
+           return if $src_drivename;
+
+           if ($drive->{file} eq $src_volid) {
+               $src_drive = $drive;
+               $src_drivename = $ds;
+           }
+       });
+
+       my $source_info = {
+           vmid => $src_vmid,
+           running => $running_now,
+           drivename => $src_drivename,
+           drive => $src_drive,
+           snapname => undef,
+       };
+
+       my ($src_storeid) = PVE::Storage::parse_volume_id($src_volid);
+
+       return PVE::QemuServer::clone_disk(
+           $storecfg,
+           $source_info,
+           $dest_info,
+           1,
+           $vollist,
+           undef,
+           undef,
+           $src_conf->{agent},
+           PVE::Storage::get_bandwidth_limit('clone', [$src_storeid, $dest_info->{storage}]),
+       );
+    };
+
+    my $cloned;
+    if ($running) {
+       $cloned = PVE::QemuConfig->lock_config_full($src_vmid, 30, $clonefn);
+    } elsif ($src_vmid) {
+       $cloned = PVE::QemuConfig->lock_config_shared($src_vmid, 30, $clonefn);
+    } else {
+       $cloned = $clonefn->();
+    }
+
+    return $cloned->@{qw(file size)};
+};
+
 # Note: $pool is only needed when creating a VM, because pool permissions
 # are automatically inherited if VM already exists inside a pool.
 my $create_disks = sub {
@@ -168,6 +328,15 @@ my $create_disks = sub {
        } elsif (defined($volname) && $volname eq 'cloudinit') {
            $storeid = $storeid // $default_storage;
            die "no storage ID specified (and no default storage)\n" if !$storeid;
+
+           if (
+               my $ci_key = PVE::QemuConfig->has_cloudinit($conf, $ds)
+               || PVE::QemuConfig->has_cloudinit($conf->{pending} || {}, $ds)
+               || PVE::QemuConfig->has_cloudinit($res, $ds)
+           ) {
+               die "$ds - cloud-init drive is already attached at '$ci_key'\n";
+           }
+
            my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
            my $name = "vm-$vmid-cloudinit";
 
@@ -187,58 +356,106 @@ my $create_disks = sub {
            push @$vollist, $volid;
            delete $disk->{format}; # no longer needed
            $res->{$ds} = PVE::QemuServer::print_drive($disk);
+           print "$ds: successfully created disk '$res->{$ds}'\n";
        } elsif ($volid =~ $NEW_DISK_RE) {
            my ($storeid, $size) = ($2 || $default_storage, $3);
            die "no storage ID specified (and no default storage)\n" if !$storeid;
-           my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
-           my $fmt = $disk->{format} || $defformat;
-
-           $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
-
-           my $volid;
-           if ($ds eq 'efidisk0') {
-               my $smm = PVE::QemuServer::Machine::machine_type_is_q35($conf);
-               ($volid, $size) = PVE::QemuServer::create_efidisk(
-                   $storecfg, $storeid, $vmid, $fmt, $arch, $disk, $smm);
-           } elsif ($ds eq 'tpmstate0') {
-               # swtpm can only use raw volumes, and uses a fixed size
-               $size = PVE::Tools::convert_size(PVE::QemuServer::Drive::TPMSTATE_DISK_SIZE, 'b' => 'kb');
-               $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, "raw", undef, $size);
-           } else {
-               $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
-           }
-           push @$vollist, $volid;
-           $disk->{file} = $volid;
-           $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
-           delete $disk->{format}; # no longer needed
-           $res->{$ds} = PVE::QemuServer::print_drive($disk);
-       } else {
 
-           PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
+           if (my $source = delete $disk->{'import-from'}) {
+               my $dst_volid;
 
-           my $volid_is_new = 1;
-
-           if ($conf->{$ds}) {
-               my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
-               $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
-           }
-
-           if ($volid_is_new) {
+               if (PVE::Storage::parse_volume_id($source, 1)) { # PVE-managed volume
+                   my $dest_info = {
+                       vmid => $vmid,
+                       drivename => $ds,
+                       storage => $storeid,
+                       format => $disk->{format},
+                   };
 
-               PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
+                   $dest_info->{efisize} = PVE::QemuServer::get_efivars_size($conf, $disk)
+                       if $ds eq 'efidisk0';
 
-               my $size = PVE::Storage::volume_size_info($storecfg, $volid);
+                   ($dst_volid, $size) = eval {
+                       $import_from_volid->($storecfg, $source, $dest_info, $vollist);
+                   };
+                   die "cannot import from '$source' - $@" if $@;
+               } else {
+                   $source = PVE::Storage::abs_filesystem_path($storecfg, $source, 1);
+                   $size = PVE::Storage::file_size_info($source);
+                   die "could not get file size of $source\n" if !$size;
 
-               die "volume $volid does not exist\n" if !$size;
+                   (undef, $dst_volid) = PVE::QemuServer::ImportDisk::do_import(
+                       $source,
+                       $vmid,
+                       $storeid,
+                       {
+                           drive_name => $ds,
+                           format => $disk->{format},
+                           'skip-config-update' => 1,
+                       },
+                   );
+                   push @$vollist, $dst_volid;
+               }
 
+               $disk->{file} = $dst_volid;
                $disk->{size} = $size;
+               delete $disk->{format}; # no longer needed
+               $res->{$ds} = PVE::QemuServer::print_drive($disk);
+           } else {
+               my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
+               my $fmt = $disk->{format} || $defformat;
+
+               $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
+
+               my $volid;
+               if ($ds eq 'efidisk0') {
+                   my $smm = PVE::QemuServer::Machine::machine_type_is_q35($conf);
+                   ($volid, $size) = PVE::QemuServer::create_efidisk(
+                       $storecfg, $storeid, $vmid, $fmt, $arch, $disk, $smm);
+               } elsif ($ds eq 'tpmstate0') {
+                   # swtpm can only use raw volumes, and uses a fixed size
+                   $size = PVE::Tools::convert_size(PVE::QemuServer::Drive::TPMSTATE_DISK_SIZE, 'b' => 'kb');
+                   $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, "raw", undef, $size);
+               } else {
+                   $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
+               }
+               push @$vollist, $volid;
+               $disk->{file} = $volid;
+               $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
+               delete $disk->{format}; # no longer needed
+               $res->{$ds} = PVE::QemuServer::print_drive($disk);
+           }
+
+           print "$ds: successfully created disk '$res->{$ds}'\n";
+       } else {
+           PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
+           if ($storeid) {
+               my ($vtype) = PVE::Storage::parse_volname($storecfg, $volid);
+               die "cannot use volume $volid - content type needs to be 'images' or 'iso'"
+                   if $vtype ne 'images' && $vtype ne 'iso';
+
+               if (PVE::QemuServer::Drive::drive_is_cloudinit($disk)) {
+                   if (
+                       my $ci_key = PVE::QemuConfig->has_cloudinit($conf, $ds)
+                       || PVE::QemuConfig->has_cloudinit($conf->{pending} || {}, $ds)
+                       || PVE::QemuConfig->has_cloudinit($res, $ds)
+                   ) {
+                       die "$ds - cloud-init drive is already attached at '$ci_key'\n";
+                   }
+               }
            }
 
+           PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
+
+           my $size = PVE::Storage::volume_size_info($storecfg, $volid);
+           die "volume $volid does not exist\n" if !$size;
+           $disk->{size} = $size;
+
            $res->{$ds} = PVE::QemuServer::print_drive($disk);
        }
     };
 
-    eval { PVE::QemuConfig->foreach_volume($settings, $code); };
+    eval { $foreach_volume_with_alloc->($settings, $code); };
 
     # free allocated images on error
     if (my $err = $@) {
@@ -250,12 +467,7 @@ my $create_disks = sub {
        die $err;
     }
 
-    # modify vm config if everything went well
-    foreach my $ds (keys %$res) {
-       $conf->{$ds} = $res->{$ds};
-    }
-
-    return $vollist;
+    return ($vollist, $res);
 };
 
 my $check_cpu_model_access = sub {
@@ -570,7 +782,9 @@ __PACKAGE__->register_method({
                    default => 0,
                    description => "Start VM after it was created successfully.",
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => {
        type => 'string',
@@ -623,7 +837,31 @@ __PACKAGE__->register_method({
            raise_perm_exc();
        }
 
-       if (!$archive) {
+       if ($archive) {
+           for my $opt (sort keys $param->%*) {
+               if (PVE::QemuServer::Drive::is_valid_drivename($opt)) {
+                   raise_param_exc({ $opt => "option conflicts with option 'archive'" });
+               }
+           }
+
+           if ($archive eq '-') {
+               die "pipe requires cli environment\n" if $rpcenv->{type} ne 'cli';
+               $archive = { type => 'pipe' };
+           } else {
+               PVE::Storage::check_volume_access(
+                   $rpcenv,
+                   $authuser,
+                   $storecfg,
+                   $vmid,
+                   $archive,
+                   'backup',
+               );
+
+               $archive = $parse_restore_archive->($storecfg, $archive);
+           }
+       }
+
+       if (scalar(keys $param->%*) > 0) {
            &$resolve_cdrom_alias($param);
 
            &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
@@ -635,29 +873,9 @@ __PACKAGE__->register_method({
 
            &$check_cpu_model_access($rpcenv, $authuser, $param);
 
-           foreach my $opt (keys %$param) {
-               if (PVE::QemuServer::is_valid_drivename($opt)) {
-                   my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
-                   raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
-
-                   PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
-                   $param->{$opt} = PVE::QemuServer::print_drive($drive);
-               }
-           }
+           $check_drive_param->($param, $storecfg);
 
            PVE::QemuServer::add_random_macs($param);
-       } else {
-           my $keystr = join(' ', keys %$param);
-           raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
-
-           if ($archive eq '-') {
-               die "pipe requires cli environment\n" if $rpcenv->{type} ne 'cli';
-               $archive = { type => 'pipe' };
-           } else {
-               PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
-
-               $archive = $parse_restore_archive->($storecfg, $archive);
-           }
        }
 
        my $emsg = $is_restore ? "unable to restore VM $vmid -" : "unable to create VM $vmid -";
@@ -680,6 +898,7 @@ __PACKAGE__->register_method({
                    unique => $unique,
                    bwlimit => $bwlimit,
                    live => $live_restore,
+                   override_conf => $param,
                };
                if ($archive->{type} eq 'file' || $archive->{type} eq 'pipe') {
                    die "live-restore is only compatible with backup images from a Proxmox Backup Server\n"
@@ -725,7 +944,18 @@ __PACKAGE__->register_method({
 
                my $vollist = [];
                eval {
-                   $vollist = &$create_disks($rpcenv, $authuser, $conf, $arch, $storecfg, $vmid, $pool, $param, $storage);
+                   ($vollist, my $created_opts) = $create_disks->(
+                       $rpcenv,
+                       $authuser,
+                       $conf,
+                       $arch,
+                       $storecfg,
+                       $vmid,
+                       $pool,
+                       $param,
+                       $storage,
+                   );
+                   $conf->{$_} = $created_opts->{$_} for keys $created_opts->%*;
 
                    if (!$conf->{boot}) {
                        my $devs = PVE::QemuServer::get_default_bootdevices($conf);
@@ -1202,15 +1432,10 @@ my $update_vm_api  = sub {
        die "cannot add non-replicatable volume to a replicated VM\n";
     };
 
+    $check_drive_param->($param, $storecfg, $check_replication);
+
     foreach my $opt (keys %$param) {
-       if (PVE::QemuServer::is_valid_drivename($opt)) {
-           # cleanup drive path
-           my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
-           raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
-           PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
-           $check_replication->($drive);
-           $param->{$opt} = PVE::QemuServer::print_drive($drive);
-       } elsif ($opt =~ m/^net(\d+)$/) {
+       if ($opt =~ m/^net(\d+)$/) {
            # add macaddr
            my $net = PVE::QemuServer::parse_net($param->{$opt});
            $param->{$opt} = PVE::QemuServer::print_net($net);
@@ -1286,7 +1511,7 @@ my $update_vm_api  = sub {
 
            my $check_drive_perms = sub {
                my ($opt, $val) = @_;
-               my $drive = PVE::QemuServer::parse_drive($opt, $val);
+               my $drive = PVE::QemuServer::parse_drive($opt, $val, 1);
                # FIXME: cloudinit: CDROM or Disk?
                if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
                    $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
@@ -1377,12 +1602,22 @@ my $update_vm_api  = sub {
                    PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
                        if defined($conf->{pending}->{$opt});
 
-                   &$create_disks($rpcenv, $authuser, $conf->{pending}, $arch, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
+                   my (undef, $created_opts) = $create_disks->(
+                       $rpcenv,
+                       $authuser,
+                       $conf,
+                       $arch,
+                       $storecfg,
+                       $vmid,
+                       undef,
+                       {$opt => $param->{$opt}},
+                   );
+                   $conf->{pending}->{$_} = $created_opts->{$_} for keys $created_opts->%*;
 
                    # default legacy boot order implies all cdroms anyway
                    if (@bootorder) {
                        # append new CD drives to bootorder to mark them bootable
-                       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
+                       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt}, 1);
                        if (PVE::QemuServer::drive_is_cdrom($drive, 1) && !grep(/^$opt$/, @bootorder)) {
                            push @bootorder, $opt;
                            $conf->{pending}->{boot} = PVE::QemuServer::print_bootorder(\@bootorder);
@@ -1411,7 +1646,7 @@ my $update_vm_api  = sub {
                        if ($new_bootcfg->{order}) {
                            my @devs = PVE::Tools::split_list($new_bootcfg->{order});
                            for my $dev (@devs) {
-                               my $exists = $conf->{$dev} || $conf->{pending}->{$dev};
+                               my $exists = $conf->{$dev} || $conf->{pending}->{$dev} || $param->{$dev};
                                my $deleted = grep {$_ eq $dev} @delete;
                                die "invalid bootorder: device '$dev' does not exist'\n"
                                    if !$exists || $deleted;
@@ -1545,7 +1780,9 @@ __PACKAGE__->register_method({
                    maximum => 30,
                    optional => 1,
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => {
        type => 'string',
@@ -1593,7 +1830,9 @@ __PACKAGE__->register_method({
                    maxLength => 40,
                    optional => 1,
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => { type => 'null' },
     code => sub {
@@ -2221,7 +2460,12 @@ __PACKAGE__->register_method({
 
        $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
 
-       $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
+       if ($conf->{vga}) {
+           my $vga = PVE::QemuServer::parse_vga($conf->{vga});
+           my $spice = defined($vga->{type}) && $vga->{type} =~ /^virtio/;
+           $spice ||= PVE::QemuServer::vga_conf_has_spice($conf->{vga});
+           $status->{spice} = 1 if $spice;
+       }
        $status->{agent} = 1 if PVE::QemuServer::get_qga_key($conf, 'enabled');
 
        return $status;
@@ -2287,9 +2531,7 @@ __PACKAGE__->register_method({
        my $node = extract_param($param, 'node');
        my $vmid = extract_param($param, 'vmid');
        my $timeout = extract_param($param, 'timeout');
-
        my $machine = extract_param($param, 'machine');
-       my $force_cpu = extract_param($param, 'force-cpu');
 
        my $get_root_param = sub {
            my $value = extract_param($param, $_[0]);
@@ -2304,6 +2546,7 @@ __PACKAGE__->register_method({
        my $migration_type = $get_root_param->('migration_type');
        my $migration_network = $get_root_param->('migration_network');
        my $targetstorage = $get_root_param->('targetstorage');
+       my $force_cpu = $get_root_param->('force-cpu');
 
        my $storagemap;
 
@@ -2319,6 +2562,7 @@ __PACKAGE__->register_method({
        my $spice_ticket;
        my $nbd_protocol_version = 0;
        my $replicated_volumes = {};
+       my $offline_volumes = {};
        if ($stateuri && ($stateuri eq 'tcp' || $stateuri eq 'unix') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
            while (defined(my $line = <STDIN>)) {
                chomp $line;
@@ -2328,9 +2572,15 @@ __PACKAGE__->register_method({
                    $nbd_protocol_version = $1;
                } elsif ($line =~ m/^replicated_volume: (.*)$/) {
                    $replicated_volumes->{$1} = 1;
-               } else {
+               } elsif ($line =~ m/^tpmstate0: (.*)$/) { # Deprecated, use offline_volume instead
+                   $offline_volumes->{tpmstate0} = $1;
+               } elsif ($line =~ m/^offline_volume: ([^:]+): (.*)$/) {
+                   $offline_volumes->{$1} = $2;
+               } elsif (!$spice_ticket) {
                    # fallback for old source node
                    $spice_ticket = $line;
+               } else {
+                   warn "unknown 'start' parameter on STDIN: '$line'\n";
                }
            }
        }
@@ -2367,6 +2617,7 @@ __PACKAGE__->register_method({
                    storagemap => $storagemap,
                    nbd_proto_version => $nbd_protocol_version,
                    replicated_volumes => $replicated_volumes,
+                   offline_volumes => $offline_volumes,
                };
 
                my $params = {
@@ -2745,10 +2996,17 @@ __PACKAGE__->register_method({
        # early check for storage permission, for better user feedback
        if ($todisk) {
            $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
+           my $conf = PVE::QemuConfig->load_config($vmid);
+
+           # cannot save the state of a non-virtualized PCIe device, so resume cannot really work
+           for my $key (keys %$conf) {
+               next if $key !~ /^hostpci\d+/;
+               die "cannot suspend VM to disk due to passed-through PCI device(s), which lack the"
+                   ." possibility to save/restore their internal state\n";
+           }
 
            if (!$statestorage) {
                # get statestorage from config if none is given
-               my $conf = PVE::QemuConfig->load_config($vmid);
                my $storecfg = PVE::Storage::config();
                $statestorage = PVE::QemuServer::find_vmstate_storage($conf, $storecfg);
            }
@@ -3040,7 +3298,6 @@ __PACKAGE__->register_method({
        my $vmid = extract_param($param, 'vmid');
        my $newid = extract_param($param, 'newid');
        my $pool = extract_param($param, 'pool');
-       $rpcenv->check_pool_exist($pool) if defined($pool);
 
         my $snapname = extract_param($param, 'snapname');
        my $storage = extract_param($param, 'storage');
@@ -3053,28 +3310,28 @@ __PACKAGE__->register_method({
            undef $target;
        }
 
-       PVE::Cluster::check_node_exists($target) if $target;
-
-       my $storecfg = PVE::Storage::config();
+       my $running = PVE::QemuServer::check_running($vmid) || 0;
 
-       if ($storage) {
-           # check if storage is enabled on local node
-           PVE::Storage::storage_check_enabled($storecfg, $storage);
-           if ($target) {
-               # check if storage is available on target node
-               PVE::Storage::storage_check_enabled($storecfg, $storage, $target);
-               # clone only works if target storage is shared
-               my $scfg = PVE::Storage::storage_config($storecfg, $storage);
-               die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
-           }
-       }
+       my $load_and_check = sub {
+           $rpcenv->check_pool_exist($pool) if defined($pool);
+           PVE::Cluster::check_node_exists($target) if $target;
 
-       PVE::Cluster::check_cfs_quorum();
+           my $storecfg = PVE::Storage::config();
 
-       my $running = PVE::QemuServer::check_running($vmid) || 0;
+           if ($storage) {
+               # check if storage is enabled on local node
+               PVE::Storage::storage_check_enabled($storecfg, $storage);
+               if ($target) {
+                   # check if storage is available on target node
+                   PVE::Storage::storage_check_enabled($storecfg, $storage, $target);
+                   # clone only works if target storage is shared
+                   my $scfg = PVE::Storage::storage_config($storecfg, $storage);
+                   die "can't clone to non-shared storage '$storage'\n"
+                       if !$scfg->{shared};
+               }
+           }
 
-       my $clonefn = sub {
-           # do all tests after lock but before forking worker - if possible
+           PVE::Cluster::check_cfs_quorum();
 
            my $conf = PVE::QemuConfig->load_config($vmid);
            PVE::QemuConfig->check_lock($conf);
@@ -3085,7 +3342,7 @@ __PACKAGE__->register_method({
            die "snapshot '$snapname' does not exist\n"
                if $snapname && !defined( $conf->{snapshots}->{$snapname});
 
-           my $full = extract_param($param, 'full') // !PVE::QemuConfig->is_template($conf);
+           my $full = $param->{full} // !PVE::QemuConfig->is_template($conf);
 
            die "parameter 'storage' not allowed for linked clones\n"
                if defined($storage) && !$full;
@@ -3119,6 +3376,9 @@ __PACKAGE__->register_method({
                # no need to copy unused images, because VMID(owner) changes anyways
                next if $opt =~ m/^unused\d+$/;
 
+               die "cannot clone TPM state while VM is running\n"
+                   if $full && $running && !$snapname && $opt eq 'tpmstate0';
+
                # always change MAC! address
                if ($opt =~ m/^net(\d+)$/) {
                    my $net = PVE::QemuServer::parse_net($value);
@@ -3150,7 +3410,14 @@ __PACKAGE__->register_method({
                }
            }
 
-            # auto generate a new uuid
+           return ($conffile, $newconf, $oldconf, $vollist, $drives, $fullclone);
+       };
+
+       my $clonefn = sub {
+           my ($conffile, $newconf, $oldconf, $vollist, $drives, $fullclone) = $load_and_check->();
+           my $storecfg = PVE::Storage::config();
+
+           # auto generate a new uuid
            my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
            $smbios1->{uuid} = PVE::QemuServer::generate_uuid();
            $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
@@ -3175,105 +3442,110 @@ __PACKAGE__->register_method({
            # FIXME use PVE::QemuConfig->create_and_lock_config and adapt code
            PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
 
-           my $realcmd = sub {
-               my $upid = shift;
+           PVE::Firewall::clone_vmfw_conf($vmid, $newid);
 
-               my $newvollist = [];
-               my $jobs = {};
+           my $newvollist = [];
+           my $jobs = {};
 
-               eval {
-                   local $SIG{INT} =
-                       local $SIG{TERM} =
-                       local $SIG{QUIT} =
-                       local $SIG{HUP} = sub { die "interrupted by signal\n"; };
+           eval {
+               local $SIG{INT} =
+                   local $SIG{TERM} =
+                   local $SIG{QUIT} =
+                   local $SIG{HUP} = sub { die "interrupted by signal\n"; };
 
-                   PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
+               PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
 
-                   my $bwlimit = extract_param($param, 'bwlimit');
+               my $bwlimit = extract_param($param, 'bwlimit');
 
-                   my $total_jobs = scalar(keys %{$drives});
-                   my $i = 1;
+               my $total_jobs = scalar(keys %{$drives});
+               my $i = 1;
 
-                   foreach my $opt (sort keys %$drives) {
-                       my $drive = $drives->{$opt};
-                       my $skipcomplete = ($total_jobs != $i); # finish after last drive
-                       my $completion = $skipcomplete ? 'skip' : 'complete';
+               foreach my $opt (sort keys %$drives) {
+                   my $drive = $drives->{$opt};
+                   my $skipcomplete = ($total_jobs != $i); # finish after last drive
+                   my $completion = $skipcomplete ? 'skip' : 'complete';
 
-                       my $src_sid = PVE::Storage::parse_volume_id($drive->{file});
-                       my $storage_list = [ $src_sid ];
-                       push @$storage_list, $storage if defined($storage);
-                       my $clonelimit = PVE::Storage::get_bandwidth_limit('clone', $storage_list, $bwlimit);
+                   my $src_sid = PVE::Storage::parse_volume_id($drive->{file});
+                   my $storage_list = [ $src_sid ];
+                   push @$storage_list, $storage if defined($storage);
+                   my $clonelimit = PVE::Storage::get_bandwidth_limit('clone', $storage_list, $bwlimit);
 
-                       my $newdrive = PVE::QemuServer::clone_disk(
-                           $storecfg,
-                           $vmid,
-                           $running,
-                           $opt,
-                           $drive,
-                           $snapname,
-                           $newid,
-                           $storage,
-                           $format,
-                           $fullclone->{$opt},
-                           $newvollist,
-                           $jobs,
-                           $completion,
-                           $oldconf->{agent},
-                           $clonelimit,
-                           $oldconf
-                       );
+                   my $source_info = {
+                       vmid => $vmid,
+                       running => $running,
+                       drivename => $opt,
+                       drive => $drive,
+                       snapname => $snapname,
+                   };
 
-                       $newconf->{$opt} = PVE::QemuServer::print_drive($newdrive);
+                   my $dest_info = {
+                       vmid => $newid,
+                       drivename => $opt,
+                       storage => $storage,
+                       format => $format,
+                   };
 
-                       PVE::QemuConfig->write_config($newid, $newconf);
-                       $i++;
-                   }
+                   $dest_info->{efisize} = PVE::QemuServer::get_efivars_size($oldconf)
+                       if $opt eq 'efidisk0';
 
-                   delete $newconf->{lock};
+                   my $newdrive = PVE::QemuServer::clone_disk(
+                       $storecfg,
+                       $source_info,
+                       $dest_info,
+                       $fullclone->{$opt},
+                       $newvollist,
+                       $jobs,
+                       $completion,
+                       $oldconf->{agent},
+                       $clonelimit,
+                   );
 
-                   # do not write pending changes
-                   if (my @changes = keys %{$newconf->{pending}}) {
-                       my $pending = join(',', @changes);
-                       warn "found pending changes for '$pending', discarding for clone\n";
-                       delete $newconf->{pending};
-                   }
+                   $newconf->{$opt} = PVE::QemuServer::print_drive($newdrive);
 
                    PVE::QemuConfig->write_config($newid, $newconf);
+                   $i++;
+               }
 
-                    if ($target) {
-                       # always deactivate volumes - avoid lvm LVs to be active on several nodes
-                       PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
-                       PVE::Storage::deactivate_volumes($storecfg, $newvollist);
+               delete $newconf->{lock};
 
-                       my $newconffile = PVE::QemuConfig->config_file($newid, $target);
-                       die "Failed to move config to node '$target' - rename failed: $!\n"
-                           if !rename($conffile, $newconffile);
-                   }
+               # do not write pending changes
+               if (my @changes = keys %{$newconf->{pending}}) {
+                   my $pending = join(',', @changes);
+                   warn "found pending changes for '$pending', discarding for clone\n";
+                   delete $newconf->{pending};
+               }
 
-                   PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
-               };
-               if (my $err = $@) {
-                   eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
-                   sleep 1; # some storage like rbd need to wait before release volume - really?
+               PVE::QemuConfig->write_config($newid, $newconf);
 
-                   foreach my $volid (@$newvollist) {
-                       eval { PVE::Storage::vdisk_free($storecfg, $volid); };
-                       warn $@ if $@;
-                   }
+               if ($target) {
+                   # always deactivate volumes - avoid lvm LVs to be active on several nodes
+                   PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
+                   PVE::Storage::deactivate_volumes($storecfg, $newvollist);
 
-                   PVE::Firewall::remove_vmfw_conf($newid);
+                   my $newconffile = PVE::QemuConfig->config_file($newid, $target);
+                   die "Failed to move config to node '$target' - rename failed: $!\n"
+                       if !rename($conffile, $newconffile);
+               }
 
-                   unlink $conffile; # avoid races -> last thing before die
+               PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
+           };
+           if (my $err = $@) {
+               eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
+               sleep 1; # some storage like rbd need to wait before release volume - really?
 
-                   die "clone failed: $err";
+               foreach my $volid (@$newvollist) {
+                   eval { PVE::Storage::vdisk_free($storecfg, $volid); };
+                   warn $@ if $@;
                }
 
-               return;
-           };
+               PVE::Firewall::remove_vmfw_conf($newid);
 
-           PVE::Firewall::clone_vmfw_conf($vmid, $newid);
+               unlink $conffile; # avoid races -> last thing before die
+
+               die "clone failed: $err";
+           }
 
-           return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
+           return;
        };
 
        # Aquire exclusive lock lock for $newid
@@ -3281,12 +3553,18 @@ __PACKAGE__->register_method({
            return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
        };
 
-       # exclusive lock if VM is running - else shared lock is enough;
-       if ($running) {
-           return PVE::QemuConfig->lock_config_full($vmid, 1, $lock_target_vm);
-       } else {
-           return PVE::QemuConfig->lock_config_shared($vmid, 1, $lock_target_vm);
-       }
+       my $lock_source_vm = sub {
+           # exclusive lock if VM is running - else shared lock is enough;
+           if ($running) {
+               return PVE::QemuConfig->lock_config_full($vmid, 1, $lock_target_vm);
+           } else {
+               return PVE::QemuConfig->lock_config_shared($vmid, 1, $lock_target_vm);
+           }
+       };
+
+       $load_and_check->(); # early checks before forking/locking
+
+       return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $lock_source_vm);
     }});
 
 __PACKAGE__->register_method({
@@ -3386,7 +3664,7 @@ __PACKAGE__->register_method({
 
        my $storecfg = PVE::Storage::config();
 
-       my $move_updatefn =  sub {
+       my $load_and_check_move = sub {
            my $conf = PVE::QemuConfig->load_config($vmid);
            PVE::QemuConfig->check_lock($conf);
 
@@ -3406,8 +3684,8 @@ __PACKAGE__->register_method({
                $oldfmt = $1;
            }
 
-           die "you can't move to the same storage with same format\n" if $oldstoreid eq $storeid &&
-                (!$format || !$oldfmt || $oldfmt eq $format);
+           die "you can't move to the same storage with same format\n"
+               if $oldstoreid eq $storeid && (!$format || !$oldfmt || $oldfmt eq $format);
 
            # this only checks snapshots because $disk is passed!
            my $snapshotted = PVE::QemuServer::Drive::is_volume_in_use(
@@ -3419,6 +3697,13 @@ __PACKAGE__->register_method({
            die "you can't move a disk with snapshots and delete the source\n"
                if $snapshotted && $param->{delete};
 
+           return ($conf, $drive, $oldstoreid, $snapshotted);
+       };
+
+       my $move_updatefn = sub {
+           my ($conf, $drive, $oldstoreid, $snapshotted) = $load_and_check_move->();
+           my $old_volid = $drive->{file};
+
            PVE::Cluster::log_msg(
                'info',
                $authuser,
@@ -3429,83 +3714,90 @@ __PACKAGE__->register_method({
 
            PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
 
-           my $realcmd = sub {
-               my $newvollist = [];
+           my $newvollist = [];
 
-               eval {
-                   local $SIG{INT} =
-                       local $SIG{TERM} =
-                       local $SIG{QUIT} =
-                       local $SIG{HUP} = sub { die "interrupted by signal\n"; };
-
-                   warn "moving disk with snapshots, snapshots will not be moved!\n"
-                       if $snapshotted;
-
-                   my $bwlimit = extract_param($param, 'bwlimit');
-                   my $movelimit = PVE::Storage::get_bandwidth_limit(
-                       'move',
-                       [$oldstoreid, $storeid],
-                       $bwlimit
-                   );
+           eval {
+               local $SIG{INT} =
+                   local $SIG{TERM} =
+                   local $SIG{QUIT} =
+                   local $SIG{HUP} = sub { die "interrupted by signal\n"; };
 
-                   my $newdrive = PVE::QemuServer::clone_disk(
-                       $storecfg,
-                       $vmid,
-                       $running,
-                       $disk,
-                       $drive,
-                       undef,
-                       $vmid,
-                       $storeid,
-                       $format,
-                       1,
-                       $newvollist,
-                       undef,
-                       undef,
-                       undef,
-                       $movelimit,
-                       $conf,
-                   );
-                   $conf->{$disk} = PVE::QemuServer::print_drive($newdrive);
+               warn "moving disk with snapshots, snapshots will not be moved!\n"
+                   if $snapshotted;
 
-                   PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
+               my $bwlimit = extract_param($param, 'bwlimit');
+               my $movelimit = PVE::Storage::get_bandwidth_limit(
+                   'move',
+                   [$oldstoreid, $storeid],
+                   $bwlimit
+               );
 
-                   # convert moved disk to base if part of template
-                   PVE::QemuServer::template_create($vmid, $conf, $disk)
-                       if PVE::QemuConfig->is_template($conf);
+               my $source_info = {
+                   vmid => $vmid,
+                   running => $running,
+                   drivename => $disk,
+                   drive => $drive,
+                   snapname => undef,
+               };
 
-                   PVE::QemuConfig->write_config($vmid, $conf);
+               my $dest_info = {
+                   vmid => $vmid,
+                   drivename => $disk,
+                   storage => $storeid,
+                   format => $format,
+               };
 
-                   my $do_trim = PVE::QemuServer::get_qga_key($conf, 'fstrim_cloned_disks');
-                   if ($running && $do_trim && PVE::QemuServer::qga_check_running($vmid)) {
-                       eval { mon_cmd($vmid, "guest-fstrim") };
-                   }
+               $dest_info->{efisize} = PVE::QemuServer::get_efivars_size($conf)
+                   if $disk eq 'efidisk0';
 
-                   eval {
-                       # try to deactivate volumes - avoid lvm LVs to be active on several nodes
-                       PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
-                           if !$running;
-                   };
-                   warn $@ if $@;
-               };
-               if (my $err = $@) {
-                   foreach my $volid (@$newvollist) {
-                       eval { PVE::Storage::vdisk_free($storecfg, $volid) };
-                       warn $@ if $@;
-                   }
-                   die "storage migration failed: $err";
-                }
+               my $newdrive = PVE::QemuServer::clone_disk(
+                   $storecfg,
+                   $source_info,
+                   $dest_info,
+                   1,
+                   $newvollist,
+                   undef,
+                   undef,
+                   undef,
+                   $movelimit,
+               );
+               $conf->{$disk} = PVE::QemuServer::print_drive($newdrive);
 
-               if ($param->{delete}) {
-                   eval {
-                       PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
-                       PVE::Storage::vdisk_free($storecfg, $old_volid);
-                   };
-                   warn $@ if $@;
+               PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
+
+               # convert moved disk to base if part of template
+               PVE::QemuServer::template_create($vmid, $conf, $disk)
+                   if PVE::QemuConfig->is_template($conf);
+
+               PVE::QemuConfig->write_config($vmid, $conf);
+
+               my $do_trim = PVE::QemuServer::get_qga_key($conf, 'fstrim_cloned_disks');
+               if ($running && $do_trim && PVE::QemuServer::qga_check_running($vmid)) {
+                   eval { mon_cmd($vmid, "guest-fstrim") };
                }
+
+               eval {
+                   # try to deactivate volumes - avoid lvm LVs to be active on several nodes
+                   PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
+                       if !$running;
+               };
+               warn $@ if $@;
            };
+           if (my $err = $@) {
+               foreach my $volid (@$newvollist) {
+                   eval { PVE::Storage::vdisk_free($storecfg, $volid) };
+                   warn $@ if $@;
+               }
+               die "storage migration failed: $err";
+           }
 
-            return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
+           if ($param->{delete}) {
+               eval {
+                   PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
+                   PVE::Storage::vdisk_free($storecfg, $old_volid);
+               };
+               warn $@ if $@;
+           }
        };
 
        my $load_and_check_reassign_configs = sub {
@@ -3614,6 +3906,13 @@ __PACKAGE__->register_method({
 
                    $drive->{file} = $new_volid;
 
+                   my $boot_order = PVE::QemuServer::device_bootorder($source_conf);
+                   if (defined(delete $boot_order->{$disk})) {
+                       print "removing disk '$disk' from boot order config\n";
+                       my $boot_devs = [ sort { $boot_order->{$a} <=> $boot_order->{$b} } keys %$boot_order ];
+                       $source_conf->{boot} = PVE::QemuServer::print_bootorder($boot_devs);
+                   }
+
                    delete $source_conf->{$disk};
                    print "removing disk '${disk}' from VM '${vmid}' config\n";
                    PVE::QemuConfig->write_config($vmid, $source_conf);
@@ -3685,7 +3984,14 @@ __PACKAGE__->register_method({
 
            die "cannot move disk '$disk', only configured disks can be moved to another storage\n"
                if $disk =~ m/^unused\d+$/;
-           return PVE::QemuConfig->lock_config($vmid, $move_updatefn);
+
+           $load_and_check_move->(); # early checks before forking/locking
+
+           my $realcmd = sub {
+               PVE::QemuConfig->lock_config($vmid, $move_updatefn);
+           };
+
+           return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
        } else {
            my $msg = "both 'storage' and 'target-vmid' missing, either needs to be set";
            raise_param_exc({ 'target-vmid' => $msg, 'storage' => $msg });
@@ -4530,11 +4836,25 @@ __PACKAGE__->register_method({
 
        my $snapname = extract_param($param, 'snapname');
 
-       my $realcmd = sub {
+       my $lock_obtained;
+       my $do_delete = sub {
+           $lock_obtained = 1;
            PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
            PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
        };
 
+       my $realcmd = sub {
+           if ($param->{force}) {
+               $do_delete->();
+           } else {
+               eval { PVE::GuestHelpers::guest_migration_lock($vmid, 10, $do_delete); };
+               if (my $err = $@) {
+                   die $err if $lock_obtained;
+                   die "Failed to obtain guest migration lock - replication running?\n";
+               }
+           }
+       };
+
        return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
     }});