X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=PVE%2FQemuMigrate.pm;h=27c5b7af7b42bd0979aec9dc5797d7b508c1070d;hb=71c58bb7edd5916e61092acf67d57e032325ed9a;hp=5caac15f397c3c79dae1a253c151d13b61e2de4a;hpb=46883f80f64ce26d15a8619cefc7e4f64fa08f12;p=qemu-server.git

diff --git a/PVE/QemuMigrate.pm b/PVE/QemuMigrate.pm
index 5caac15..27c5b7a 100644
--- a/PVE/QemuMigrate.pm
+++ b/PVE/QemuMigrate.pm
@@ -11,8 +11,13 @@ use PVE::Tools;
 use PVE::Cluster;
 use PVE::Storage;
 use PVE::QemuServer;
+use PVE::QemuServer::Machine;
+use PVE::QemuServer::Monitor qw(mon_cmd);
 use Time::HiRes qw( usleep );
 use PVE::RPCEnvironment;
+use PVE::ReplicationConfig;
+use PVE::ReplicationState;
+use PVE::Replication;
 
 use base qw(PVE::AbstractMigrate);
 
@@ -88,20 +93,62 @@ sub finish_command_pipe {
 	if !&$collect_child_process();
 }
 
+sub read_tunnel {
+    my ($self, $tunnel, $timeout) = @_;
+
+    $timeout = 60 if !defined($timeout);
+
+    my $reader = $tunnel->{reader};
+
+    my $output;
+    eval {
+	PVE::Tools::run_with_timeout($timeout, sub { $output = <$reader>; });
+    };
+    die "reading from tunnel failed: $@\n" if $@;
+
+    chomp $output;
+
+    return $output;
+}
+
+sub write_tunnel {
+    my ($self, $tunnel, $timeout, $command) = @_;
+
+    $timeout = 60 if !defined($timeout);
+
+    my $writer = $tunnel->{writer};
+
+    eval {
+	PVE::Tools::run_with_timeout($timeout, sub {
+	    print $writer "$command\n";
+	    $writer->flush();
+	});
+    };
+    die "writing to tunnel failed: $@\n" if $@;
+
+    if ($tunnel->{version} && $tunnel->{version} >= 1) {
+	my $res = eval { $self->read_tunnel($tunnel, 10); };
+	die "no reply to command '$command': $@\n" if $@;
+
+	if ($res eq 'OK') {
+	    return;
+	} else {
+	    die "tunnel replied '$res' to command '$command'\n";
+	}
+    }
+}
+
 sub fork_tunnel {
     my ($self, $tunnel_addr) = @_;
 
     my @localtunnelinfo = defined($tunnel_addr) ? ('-L' , $tunnel_addr ) : ();
 
-    my $cmd = [@{$self->{rem_ssh}}, '-o ExitOnForwardFailure=yes', @localtunnelinfo, 'qm', 'mtunnel' ];
+    my $cmd = [@{$self->{rem_ssh}}, '-o ExitOnForwardFailure=yes', @localtunnelinfo, '/usr/sbin/qm', 'mtunnel' ];
 
     my $tunnel = $self->fork_command_pipe($cmd);
 
-    my $reader = $tunnel->{reader};
-
-    my $helo;
     eval {
-	PVE::Tools::run_with_timeout(60, sub { $helo = <$reader>; });
+	my $helo = $self->read_tunnel($tunnel, 60);
 	die "no reply\n" if !$helo;
 	die "no quorum on target node\n" if $helo =~ m/^no quorum$/;
 	die "got strange reply from mtunnel ('$helo')\n"
@@ -109,6 +156,16 @@ sub fork_tunnel {
     };
     my $err = $@;
 
+    eval {
+	my $ver = $self->read_tunnel($tunnel, 10);
+	if ($ver =~ /^ver (\d+)$/) {
+	    $tunnel->{version} = $1;
+	    $self->log('info', "ssh tunnel $ver\n");
+	} else {
+	    $err = "received invalid tunnel version string '$ver'\n" if !$err;
+	}
+    };
+
     if ($err) {
 	$self->finish_command_pipe($tunnel);
 	die "can't open migration tunnel - $err";
@@ -119,14 +176,7 @@ sub fork_tunnel {
 sub finish_tunnel {
     my ($self, $tunnel) = @_;
 
-    my $writer = $tunnel->{writer};
-
-    eval {
-	PVE::Tools::run_with_timeout(30, sub {
-	    print $writer "quit\n";
-	    $writer->flush();
-	});
-    };
+    eval { $self->write_tunnel($tunnel, 30, 'quit'); };
     my $err = $@;
 
     $self->finish_command_pipe($tunnel, 30);
@@ -167,13 +217,13 @@ sub prepare {
 	die "can't migrate running VM without --online\n" if !$online;
 	$running = $pid;
 
-	$self->{forcemachine} = PVE::QemuServer::qemu_machine_pxe($vmid, $conf);
+	$self->{forcemachine} = PVE::QemuServer::Machine::qemu_machine_pxe($vmid, $conf);
 
     }
-
-    if (my $loc_res = PVE::QemuServer::check_local_resources($conf, 1)) {
+    my $loc_res = PVE::QemuServer::check_local_resources($conf, 1);
+    if (scalar @$loc_res) {
 	if ($self->{running} || !$self->{opts}->{force}) {
-	    die "can't migrate VM which uses local devices\n";
+	    die "can't migrate VM which uses local devices: " . join(", ", @$loc_res) . "\n";
 	} else {
 	    $self->log('info', "migrating VM which uses local devices");
 	}
@@ -186,7 +236,7 @@ sub prepare {
 	my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 
 	# check if storage is available on both nodes
-	my $targetsid = $self->{opts}->{targetstorage} ? $self->{opts}->{targetstorage} : $sid;
+	my $targetsid = $self->{opts}->{targetstorage} // $sid;
 
 	my $scfg = PVE::Storage::storage_check_node($self->{storecfg}, $sid);
 	PVE::Storage::storage_check_node($self->{storecfg}, $targetsid, $self->{node});
@@ -198,6 +248,7 @@ sub prepare {
 		if !$plugin->check_connection($sid, $scfg);
 	} else {
 	    # only activate if not shared
+	    next if ($volid =~ m/vm-\d+-cloudinit/);
 	    push @$need_activate, $volid;
 	}
     }
@@ -221,7 +272,7 @@ sub sync_disks {
     # local volumes which have been copied
     $self->{volumes} = [];
 
-    my $res = [];
+    my $override_targetsid = $self->{opts}->{targetstorage};
 
     eval {
 
@@ -255,7 +306,7 @@ sub sync_disks {
 
 	    next if @{$dl->{$storeid}} == 0;
 
-	    my $targetsid = $self->{opts}->{targetstorage} ? $self->{opts}->{targetstorage} : $storeid;
+	    my $targetsid = $override_targetsid // $storeid;
 
 	    # check if storage is available on target node
 	    PVE::Storage::storage_check_node($self->{storecfg}, $targetsid, $self->{node});
@@ -264,26 +315,28 @@ sub sync_disks {
 	    PVE::Storage::foreach_volid($dl, sub {
 		my ($volid, $sid, $volname) = @_;
 
-		$local_volumes->{$volid} = 'storage';
+		$local_volumes->{$volid}->{ref} = 'storage';
 	    });
 	}
 
 	my $test_volid = sub {
-	    my ($volid, $is_cdrom, $snapname) = @_;
-
-	    return if !$volid;
+	    my ($volid, $attr) = @_;
 
 	    if ($volid =~ m|^/|) {
-		$local_volumes->{$volid} = 'config';
+		return if $attr->{shared};
+		$local_volumes->{$volid}->{ref} = 'config';
 		die "local file/device\n";
 	    }
 
-	    if ($is_cdrom) {
+	    my $snaprefs = $attr->{referenced_in_snapshot};
+
+	    if ($attr->{cdrom}) {
 		if ($volid eq 'cdrom') {
 		    my $msg = "can't migrate local cdrom drive";
-		    $msg .= " (referenced in snapshot '$snapname')"
-			if defined($snapname);
-
+		    if (defined($snaprefs) && !$attr->{referenced_in_config}) {
+			my $snapnames = join(', ', sort keys %$snaprefs);
+			$msg .= " (referenced in snapshot - $snapnames)";
+		    }
 		    &$log_error("$msg\n");
 		    return;
 		}
@@ -292,7 +345,7 @@ sub sync_disks {
 
 	    my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 
-	    my $targetsid = $self->{opts}->{targetstorage} ? $self->{opts}->{targetstorage} : $sid;
+	    my $targetsid = $override_targetsid // $sid;
 	    # check if storage is available on both nodes
 	    my $scfg = PVE::Storage::storage_check_node($self->{storecfg}, $sid);
 	    PVE::Storage::storage_check_node($self->{storecfg}, $targetsid, $self->{node});
@@ -301,20 +354,27 @@ sub sync_disks {
 
 	    $sharedvm = 0;
 
-	    $local_volumes->{$volid} = defined($snapname) ? 'snapshot' : 'config';
+	    $local_volumes->{$volid}->{ref} = $attr->{referenced_in_config} ? 'config' : 'snapshot';
 
-	    die "local cdrom image\n" if $is_cdrom;
+	    if ($attr->{cdrom}) {
+		if ($volid =~ /vm-\d+-cloudinit/) {
+		    $local_volumes->{$volid}->{ref} = 'generated';
+		    return;
+		}
+		die "local cdrom image\n";
+	    }
 
 	    my ($path, $owner) = PVE::Storage::path($self->{storecfg}, $volid);
 
 	    die "owned by other VM (owner = VM $owner)\n"
 		if !$owner || ($owner != $self->{vmid});
 
-	    if (defined($snapname)) {
+	    my $format = PVE::QemuServer::qemu_img_format($scfg, $volname);
+	    $local_volumes->{$volid}->{snapshots} = defined($snaprefs) || ($format =~ /^(?:qcow2|vmdk)$/);
+	    if (defined($snaprefs)) {
 		# we cannot migrate shapshots on local storage
 		# exceptions: 'zfspool' or 'qcow2' files (on directory storage)
 
-		my $format = PVE::QemuServer::qemu_img_format($scfg, $volname);
 		die "online storage migration not possible if snapshot exists\n" if $self->{running};
 		if (!($scfg->{type} eq 'zfspool' || $format eq 'qcow2')) {
 		    die "non-migratable snapshot exists\n";
@@ -325,35 +385,26 @@ sub sync_disks {
 		if PVE::Storage::volume_is_base_and_used($self->{storecfg}, $volid);
 	};
 
-	my $test_drive = sub {
-	    my ($ds, $drive, $snapname) = @_;
-
-	    eval {
-		&$test_volid($drive->{file}, PVE::QemuServer::drive_is_cdrom($drive), $snapname);
-	    };
-
-	    &$log_error($@, $drive->{file}) if $@;
-	};
-
-	foreach my $snapname (keys %{$conf->{snapshots}}) {
-	    eval {
-		&$test_volid($conf->{snapshots}->{$snapname}->{'vmstate'}, 0, undef)
-		    if defined($conf->{snapshots}->{$snapname}->{'vmstate'});
-	    };
-	    &$log_error($@, $conf->{snapshots}->{$snapname}->{'vmstate'}) if $@;
-
-	    PVE::QemuServer::foreach_drive($conf->{snapshots}->{$snapname}, $test_drive, $snapname);
-	}
-	PVE::QemuServer::foreach_drive($conf, $test_drive);
+	PVE::QemuServer::foreach_volid($conf, sub {
+	    my ($volid, $attr) = @_;
+	    eval { $test_volid->($volid, $attr); };
+	    if (my $err = $@) {
+		&$log_error($err, $volid);
+	    }
+        });
 
 	foreach my $vol (sort keys %$local_volumes) {
-	    if ($local_volumes->{$vol} eq 'storage') {
+	    my $ref = $local_volumes->{$vol}->{ref};
+	    if ($ref eq 'storage') {
 		$self->log('info', "found local disk '$vol' (via storage)\n");
-	    } elsif ($local_volumes->{$vol} eq 'config') {
-		die "can't live migrate attached local disks without with-local-disks option\n" if $self->{running} && !$self->{opts}->{"with-local-disks"};
+	    } elsif ($ref eq 'config') {
+		&$log_error("can't live migrate attached local disks without with-local-disks option\n", $vol)
+		    if $self->{running} && !$self->{opts}->{"with-local-disks"};
 		$self->log('info', "found local disk '$vol' (in current VM config)\n");
-	    } elsif ($local_volumes->{$vol} eq 'snapshot') {
+	    } elsif ($ref eq 'snapshot') {
 		$self->log('info', "found local disk '$vol' (referenced by snapshot(s))\n");
+	    } elsif ($ref eq 'generated') {
+		$self->log('info', "found generated disk '$vol' (in current VM config)\n");
 	    } else {
 		$self->log('info', "found local disk '$vol'\n");
 	    }
@@ -366,10 +417,6 @@ sub sync_disks {
 	    $self->log('warn', "$err");
 	}
 
-	if ($self->{running} && !$sharedvm && !$self->{opts}->{targetstorage}) {
-	    $self->{opts}->{targetstorage} = 1; #use same sid for remote local
-	}
-
 	if ($abort) {
 	    die "can't migrate VM - check log\n";
 	}
@@ -379,8 +426,7 @@ sub sync_disks {
 	    my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 	    my $scfg =  PVE::Storage::storage_config($self->{storecfg}, $sid);
 
-	    my $migratable = ($scfg->{type} eq 'dir') || ($scfg->{type} eq 'zfspool') ||
-		($scfg->{type} eq 'lvmthin') || ($scfg->{type} eq 'lvm');
+	    my $migratable = $scfg->{type} =~ /^(?:dir|zfspool|lvmthin|lvm)$/;
 
 	    die "can't migrate '$volid' - storage type '$scfg->{type}' not supported\n"
 		if !$migratable;
@@ -391,15 +437,42 @@ sub sync_disks {
 	    }
 	}
 
-	$self->log('info', "copying disk images");
+	my $rep_cfg = PVE::ReplicationConfig->new();
+	if (my $jobcfg = $rep_cfg->find_local_replication_job($vmid, $self->{node})) {
+	    die "can't live migrate VM with replicated volumes\n" if $self->{running};
+	    $self->log('info', "replicating disk images");
+	    my $start_time = time();
+	    my $logfunc = sub { $self->log('info', shift) };
+	    $self->{replicated_volumes} = PVE::Replication::run_replication(
+	       'PVE::QemuConfig', $jobcfg, $start_time, $start_time, $logfunc);
+	}
+
+	$self->log('info', "copying local disk images") if scalar(%$local_volumes);
 
 	foreach my $volid (keys %$local_volumes) {
 	    my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
-	    if ($self->{running} && $self->{opts}->{targetstorage} && $local_volumes->{$volid} eq 'config') {
+	    my $targetsid = $override_targetsid // $sid;
+	    my $ref = $local_volumes->{$volid}->{ref};
+	    if ($self->{running} && $ref eq 'config') {
 		push @{$self->{online_local_volumes}}, $volid;
+	    } elsif ($ref eq 'generated') {
+		die "can't live migrate VM with local cloudinit disk. use a shared storage instead\n" if $self->{running};
+		# skip all generated volumes but queue them for deletion in phase3_cleanup
+		push @{$self->{volumes}}, $volid;
+		next;
 	    } else {
+		next if $self->{replicated_volumes}->{$volid};
 		push @{$self->{volumes}}, $volid;
-		PVE::Storage::storage_migrate($self->{storecfg}, $volid, $self->{nodeip}, $sid);
+		my $opts = $self->{opts};
+		my $insecure = $opts->{migration_type} eq 'insecure';
+		my $with_snapshots = $local_volumes->{$volid}->{snapshots};
+		# use 'migrate' limit for transfer to other node
+		my $bwlimit = PVE::Storage::get_bandwidth_limit('migrate', [$targetsid, $sid], $opts->{bwlimit});
+		# JSONSchema and get_bandwidth_limit use kbps - storage_migrate bps
+		$bwlimit = $bwlimit * 1024 if defined($bwlimit);
+
+		PVE::Storage::storage_migrate($self->{storecfg}, $volid, $self->{ssh_info}, $targetsid,
+					      undef, undef, undef, $bwlimit, $insecure, $with_snapshots);
 	    }
 	}
     };
@@ -476,24 +549,13 @@ sub phase2 {
 
     my $spice_ticket;
     if (PVE::QemuServer::vga_conf_has_spice($conf->{vga})) {
-	my $res = PVE::QemuServer::vm_mon_cmd($vmid, 'query-spice');
+	my $res = mon_cmd($vmid, 'query-spice');
 	$spice_ticket = $res->{ticket};
     }
 
     push @$cmd , 'qm', 'start', $vmid, '--skiplock', '--migratedfrom', $nodename;
 
-    # we use TCP only for unsecure migrations as TCP ssh forward tunnels often
-    # did appeared to late (they are hard, if not impossible, to check for)
-    # secure migration use UNIX sockets now, this *breaks* compatibilty when trying
-    # to migrate from new to old but *not* from old to new.
-    my $datacenterconf = PVE::Cluster::cfs_read_file('datacenter.cfg');
-
-    my $migration_type = 'secure';
-    if (defined($self->{opts}->{migration_type})) {
-	$migration_type = $self->{opts}->{migration_type};
-    } elsif (defined($datacenterconf->{migration}->{type})) {
-        $migration_type = $datacenterconf->{migration}->{type};
-    }
+    my $migration_type = $self->{opts}->{migration_type};
 
     push @$cmd, '--migration_type', $migration_type;
 
@@ -510,8 +572,8 @@ sub phase2 {
 	push @$cmd, '--machine', $self->{forcemachine};
     }
 
-    if ($self->{opts}->{targetstorage}) {
-	push @$cmd, '--targetstorage', $self->{opts}->{targetstorage};
+    if ($self->{online_local_volumes}) {
+	push @$cmd, '--targetstorage', ($self->{opts}->{targetstorage} // '1');
     }
 
     my $spice_port;
@@ -536,10 +598,10 @@ sub phase2 {
 	    $rport = int($1);
 	    $ruri = "tcp:$raddr:$rport";
 	}
-        elsif ($line =~ m/^spice listens on port (\d+)$/) {
+	elsif ($line =~ m/^spice listens on port (\d+)$/) {
 	    $spice_port = int($1);
 	}
-        elsif ($line =~ m/^storage migration listens on nbd:(localhost|[\d\.]+|\[[\d\.:a-fA-F]+\]):(\d+):exportname=(\S+) volume:(\S+)$/) {
+	elsif ($line =~ m/^storage migration listens on nbd:(localhost|[\d\.]+|\[[\d\.:a-fA-F]+\]):(\d+):exportname=(\S+) volume:(\S+)$/) {
 	    my $volid = $4;
 	    my $nbd_uri = "nbd:$1:$2:exportname=$3";
 	    my $targetdrive = $3;
@@ -556,8 +618,9 @@ sub phase2 {
 
     die "unable to detect remote migration address\n" if !$raddr;
 
+    $self->log('info', "start remote tunnel");
+
     if ($migration_type eq 'secure') {
-	$self->log('info', "start remote tunnel");
 
 	if ($ruri =~ /^unix:/) {
 	    unlink $raddr;
@@ -590,11 +653,16 @@ sub phase2 {
 	} else {
 	    die "unsupported protocol in migration URI: $ruri\n";
 	}
+    } else {
+	#fork tunnel for insecure migration, to send faster commands like resume
+	$self->{tunnel} = $self->fork_tunnel();
     }
 
     my $start = time();
 
-    if ($self->{opts}->{targetstorage} && defined($self->{online_local_volumes})) {
+    my $opt_bwlimit = $self->{opts}->{bwlimit};
+
+    if (defined($self->{online_local_volumes})) {
 	$self->{storage_migration} = 1;
 	$self->{storage_migration_jobs} = {};
 	$self->log('info', "starting storage migration");
@@ -602,9 +670,14 @@ sub phase2 {
 	die "The number of local disks does not match between the source and the destination.\n"
 	    if (scalar(keys %{$self->{target_drive}}) != scalar @{$self->{online_local_volumes}});
 	foreach my $drive (keys %{$self->{target_drive}}){
-	    my $nbd_uri = $self->{target_drive}->{$drive}->{nbd_uri};
-	    $self->log('info', "$drive: start migration to to $nbd_uri");
-	    PVE::QemuServer::qemu_drive_mirror($vmid, $drive, $nbd_uri, $vmid, undef, $self->{storage_migration_jobs}, 1);
+	    my $target = $self->{target_drive}->{$drive};
+	    my $nbd_uri = $target->{nbd_uri};
+	    my $source_sid = PVE::Storage::Plugin::parse_volume_id($conf->{$drive});
+	    my $target_sid = PVE::Storage::Plugin::parse_volume_id($target->{volid});
+	    my $bwlimit = PVE::Storage::get_bandwidth_limit('migrate', [$source_sid, $target_sid], $opt_bwlimit);
+
+	    $self->log('info', "$drive: start migration to $nbd_uri");
+	    PVE::QemuServer::qemu_drive_mirror($vmid, $drive, $nbd_uri, $vmid, undef, $self->{storage_migration_jobs}, 1, undef, $bwlimit);
 	}
     }
 
@@ -614,14 +687,24 @@ sub phase2 {
     # load_defaults
     my $defaults = PVE::QemuServer::load_defaults();
 
-    # always set migrate speed (overwrite kvm default of 32m)
-    # we set a very hight default of 8192m which is basically unlimited
-    my $migrate_speed = $defaults->{migrate_speed} || 8192;
-    $migrate_speed = $conf->{migrate_speed} || $migrate_speed;
-    $migrate_speed = $migrate_speed * 1048576;
+    # migrate speed can be set via bwlimit (datacenter.cfg and API) and via the
+    # migrate_speed parameter in qm.conf - take the lower of the two.
+    my $bwlimit = PVE::Storage::get_bandwidth_limit('migrate', undef, $opt_bwlimit) // 0;
+    my $migrate_speed = $conf->{migrate_speed} // $bwlimit;
+    # migrate_speed is in MB/s, bwlimit in KB/s
+    $migrate_speed *= 1024;
+
+    $migrate_speed = ($bwlimit < $migrate_speed) ? $bwlimit : $migrate_speed;
+
+    # always set migrate speed (overwrite kvm default of 32m) we set a very high
+    # default of 8192m which is basically unlimited
+    $migrate_speed ||= ($defaults->{migrate_speed} || 8192) * 1024;
+
+    # qmp takes migrate_speed in B/s.
+    $migrate_speed *= 1024;
     $self->log('info', "migrate_set_speed: $migrate_speed");
     eval {
-        PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate_set_speed", value => int($migrate_speed));
+	mon_cmd($vmid, "migrate_set_speed", value => int($migrate_speed));
     };
     $self->log('info', "migrate_set_speed error: $@") if $@;
 
@@ -630,7 +713,7 @@ sub phase2 {
     if (defined($migrate_downtime)) {
 	$self->log('info', "migrate_set_downtime: $migrate_downtime");
 	eval {
-	    PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate_set_downtime", value => int($migrate_downtime*100)/100);
+	    mon_cmd($vmid, "migrate_set_downtime", value => int($migrate_downtime*100)/100);
 	};
 	$self->log('info', "migrate_set_downtime error: $@") if $@;
     }
@@ -641,11 +724,14 @@ sub phase2 {
     };
     warn $@ if $@;
 
-    #set cachesize 10% of the total memory
-    my $cachesize = int($conf->{memory}*1048576/10);
+    # set cachesize to 10% of the total memory
+    my $memory =  $conf->{memory} || $defaults->{memory};
+    my $cachesize = int($memory * 1048576 / 10);
+    $cachesize = round_powerof2($cachesize);
+
     $self->log('info', "set cachesize: $cachesize");
     eval {
-	PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate-set-cache-size", value => int($cachesize));
+	mon_cmd($vmid, "migrate-set-cache-size", value => int($cachesize));
     };
     $self->log('info', "migrate-set-cache-size error: $@") if $@;
 
@@ -656,13 +742,13 @@ sub phase2 {
 	my (undef, $proxyticket) = PVE::AccessControl::assemble_spice_ticket($authuser, $vmid, $self->{node});
 
 	my $filename = "/etc/pve/nodes/$self->{node}/pve-ssl.pem";
-        my $subject =  PVE::AccessControl::read_x509_subject_spice($filename);
+	my $subject =  PVE::AccessControl::read_x509_subject_spice($filename);
 
 	$self->log('info', "spice client_migrate_info");
 
 	eval {
-	    PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "client_migrate_info", protocol => 'spice', 
-						hostname => $proxyticket, 'tls-port' => $spice_port, 
+	    mon_cmd($vmid, "client_migrate_info", protocol => 'spice',
+						hostname => $proxyticket, 'port' => 0, 'tls-port' => $spice_port,
 						'cert-subject' => $subject);
 	};
 	$self->log('info', "client_migrate_info error: $@") if $@;
@@ -671,13 +757,13 @@ sub phase2 {
 
     $self->log('info', "start migrate command to $ruri");
     eval {
-        PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate", uri => $ruri);
+	mon_cmd($vmid, "migrate", uri => $ruri);
     };
     my $merr = $@;
     $self->log('info', "migrate uri => $ruri failed: $merr") if $merr;
 
     my $lstat = 0;
-    my $usleep = 2000000;
+    my $usleep = 1000000;
     my $i = 0;
     my $err_count = 0;
     my $lastrem = undef;
@@ -689,7 +775,7 @@ sub phase2 {
 	usleep($usleep);
 	my $stat;
 	eval {
-	    $stat = PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "query-migrate");
+	    $stat = mon_cmd($vmid, "query-migrate");
 	};
 	if (my $err = $@) {
 	    $err_count++;
@@ -713,7 +799,7 @@ sub phase2 {
 	    if ($stat->{status} eq 'completed') {
 		my $delay = time() - $start;
 		if ($delay > 0) {
-		    my $mbps = sprintf "%.2f", $conf->{memory}/$delay;
+		    my $mbps = sprintf "%.2f", $memory / $delay;
 		    my $downtime = $stat->{downtime} || 0;
 		    $self->log('info', "migration speed: $mbps MB/s - downtime $downtime ms");
 		}
@@ -738,8 +824,8 @@ sub phase2 {
 		my $xbzrlepages = $stat->{"xbzrle-cache"}->{"pages"} || 0;
 		my $xbzrlecachemiss = $stat->{"xbzrle-cache"}->{"cache-miss"} || 0;
 		my $xbzrleoverflow = $stat->{"xbzrle-cache"}->{"overflow"} || 0;
-		#reduce sleep if remainig memory if lower than the everage transfert 
-		$usleep = 300000 if $avglstat && $rem < $avglstat;
+		# reduce sleep if remainig memory is lower than the average transfer speed
+		$usleep = 100000 if $avglstat && $rem < $avglstat;
 
 		$self->log('info', "migration status: $stat->{status} (transferred ${trans}, " .
 			   "remaining ${rem}), total ${total})");
@@ -758,7 +844,7 @@ sub phase2 {
 		    $migrate_downtime *= 2;
 		    $self->log('info', "migrate_set_downtime: $migrate_downtime");
 		    eval {
-			PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate_set_downtime", value => int($migrate_downtime*100)/100);
+			mon_cmd($vmid, "migrate_set_downtime", value => int($migrate_downtime*100)/100);
 		    };
 		    $self->log('info', "migrate_set_downtime error: $@") if $@;
             	}
@@ -767,22 +853,12 @@ sub phase2 {
 
 
 	    $lstat = $stat->{ram}->{transferred};
-	    
+
 	} else {
 	    die $merr if $merr;
 	    die "unable to parse migration status '$stat->{status}' - aborting\n";
 	}
     }
-
-    # just to be sure that the tunnel gets closed on successful migration, on error
-    # phase2_cleanup closes it *after* stopping the remote waiting VM
-    if (!$self->{errors} && $self->{tunnel}) {
-	eval { finish_tunnel($self, $self->{tunnel});  };
-	if (my $err = $@) {
-	    $self->log('err', $err);
-	    $self->{errors} = 1;
-	}
-    }
 }
 
 sub phase2_cleanup {
@@ -795,7 +871,7 @@ sub phase2_cleanup {
 
     $self->log('info', "migrate_cancel");
     eval {
-	PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "migrate_cancel");
+	mon_cmd($vmid, "migrate_cancel");
     };
     $self->log('info', "migrate_cancel error: $@") if $@;
 
@@ -821,7 +897,7 @@ sub phase2_cleanup {
     }
 
     my $nodename = PVE::INotify::nodename();
- 
+
     my $cmd = [@{$self->{rem_ssh}}, 'qm', 'stop', $vmid, '--skiplock', '--migratedfrom', $nodename];
     eval{ PVE::Tools::run_command($cmd, outfunc => sub {}, errfunc => sub {}) };
     if (my $err = $@) {
@@ -861,6 +937,8 @@ sub phase3_cleanup {
     my $conf = $self->{vmconf};
     return if $self->{phase2errors};
 
+    my $tunnel = $self->{tunnel};
+
     if ($self->{storage_migration}) {
 	# finish block-job
 	eval { PVE::QemuServer::qemu_drive_mirror_monitor($vmid, undef, $self->{storage_migration_jobs}); };
@@ -868,16 +946,19 @@ sub phase3_cleanup {
 	if (my $err = $@) {
 	    eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $self->{storage_migration_jobs}) };
 	    eval { PVE::QemuMigrate::cleanup_remotedisks($self) };
-	    die "Failed to completed storage migration\n";
+	    die "Failed to complete storage migration: $err\n";
 	} else {
 	    foreach my $target_drive (keys %{$self->{target_drive}}) {
 		my $drive = PVE::QemuServer::parse_drive($target_drive, $self->{target_drive}->{$target_drive}->{volid});
-		$conf->{$target_drive} = PVE::QemuServer::print_drive($vmid, $drive);
+		$conf->{$target_drive} = PVE::QemuServer::print_drive($drive);
 		PVE::QemuConfig->write_config($vmid, $conf);
 	    }
 	}
     }
 
+    # transfer replication state before move config
+    $self->transfer_replication_state() if $self->{replicated_volumes};
+
     # move config to remote node
     my $conffile = PVE::QemuConfig->config_file($vmid);
     my $newconffile = PVE::QemuConfig->config_file($vmid, $self->{node});
@@ -885,13 +966,10 @@ sub phase3_cleanup {
     die "Failed to move config to node '$self->{node}' - rename failed: $!\n"
         if !rename($conffile, $newconffile);
 
+    $self->switch_replication_job_target() if $self->{replicated_volumes};
+
     if ($self->{livemigration}) {
 	if ($self->{storage_migration}) {
-	    # remove drives referencing the nbd server from source
-	    # otherwise vm_stop might hang later on
-	    foreach my $drive (keys %{$self->{target_drive}}){
-		PVE::QemuServer::vm_mon_cmd_nocheck($vmid, "device_del", id => $drive);
-	    }
 	    # stop nbd server on remote vm - requirement for resume since 2.9
 	    my $cmd = [@{$self->{rem_ssh}}, 'qm', 'nbdstop', $vmid];
 
@@ -901,14 +979,38 @@ sub phase3_cleanup {
 		$self->{errors} = 1;
 	    }
 	}
+
 	# config moved and nbd server stopped - now we can resume vm on target
-	my $cmd = [@{$self->{rem_ssh}}, 'qm', 'resume', $vmid, '--skiplock', '--nocheck'];
-	eval{ PVE::Tools::run_command($cmd, outfunc => sub {}, 
-		errfunc => sub {
-		    my $line = shift;
-        	    $self->log('err', $line);
-		});
-	};
+	if ($tunnel && $tunnel->{version} && $tunnel->{version} >= 1) {
+	    eval {
+		$self->write_tunnel($tunnel, 30, "resume $vmid");
+	    };
+	    if (my $err = $@) {
+		$self->log('err', $err);
+		$self->{errors} = 1;
+	    }
+	} else {
+	    my $cmd = [@{$self->{rem_ssh}}, 'qm', 'resume', $vmid, '--skiplock', '--nocheck'];
+	    my $logf = sub {
+		my $line = shift;
+		$self->log('err', $line);
+	    };
+	    eval { PVE::Tools::run_command($cmd, outfunc => sub {}, errfunc => $logf); };
+	    if (my $err = $@) {
+		$self->log('err', $err);
+		$self->{errors} = 1;
+	    }
+	}
+
+	if ($self->{storage_migration} && PVE::QemuServer::parse_guest_agent($conf)->{fstrim_cloned_disks} && $self->{running}) {
+	    my $cmd = [@{$self->{rem_ssh}}, 'qm', 'guest', 'cmd', $vmid, 'fstrim'];
+	    eval{ PVE::Tools::run_command($cmd, outfunc => sub {}, errfunc => sub {}) };
+	}
+    }
+
+    # close tunnel on successful migration, on error phase2_cleanup closed it
+    if ($tunnel) {
+	eval { finish_tunnel($self, $tunnel);  };
 	if (my $err = $@) {
 	    $self->log('err', $err);
 	    $self->{errors} = 1;
@@ -920,12 +1022,12 @@ sub phase3_cleanup {
 	if (PVE::QemuServer::vga_conf_has_spice($conf->{vga}) && $self->{running}) {
 	    $self->log('info', "Waiting for spice server migration");
 	    while (1) {
-		my $res = PVE::QemuServer::vm_mon_cmd_nocheck($vmid, 'query-spice');
+		my $res = mon_cmd($vmid, 'query-spice');
 		last if int($res->{'migrated'}) == 1;
 		last if $timer > 50;
 		$timer ++;
 		usleep(200000);
- 	    }
+	    }
 	}
     };
 
@@ -972,4 +1074,9 @@ sub final_cleanup {
     # nothing to do
 }
 
+sub round_powerof2 {
+    return 1 if $_[0] < 2;
+    return 2 << int(log($_[0]-1)/log(2));
+}
+
 1;