PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6
   7 use PVE::Cluster;
   8 use PVE::SafeSyslog;
   9 use PVE::Tools qw(extract_param);
  10 use PVE::Exception qw(raise raise_param_exc);
  11 use PVE::Storage;
  12 use PVE::JSONSchema qw(get_standard_option);
  13 use PVE::RESTHandler;
  14 use PVE::QemuServer;
  15 use PVE::QemuMigrate;
  16 use PVE::RPCEnvironment;
  17 use PVE::AccessControl;
  18 use PVE::INotify;
  19
  20 use Data::Dumper; # fixme: remove
  21
  22 use base qw(PVE::RESTHandler);
  23
  24 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  25
  26 my $resolve_cdrom_alias = sub {
  27     my $param = shift;
  28
  29     if (my $value = $param->{cdrom}) {
  30         $value .= ",media=cdrom" if $value !~ m/media=/;
  31         $param->{ide2} = $value;
  32         delete $param->{cdrom};
  33     }
  34 };
  35
  36 my $check_volume_access = sub {
  37     my ($rpcenv, $authuser, $storecfg, $vmid, $volid, $pool) = @_;
  38
  39     my $path;
  40     if (my ($sid, $volname) = PVE::Storage::parse_volume_id($volid, 1)) {
  41         my ($ownervm, $vtype);
  42         ($path, $ownervm, $vtype) = PVE::Storage::path($storecfg, $volid);
  43         if ($vtype eq 'iso' || $vtype eq 'vztmpl') {
  44             # we simply allow access
  45         } elsif (!$ownervm || ($ownervm != $vmid)) {
  46             # allow if we are Datastore administrator
  47             $rpcenv->check_storage_perm($authuser, $vmid, $pool, $sid, [ 'Datastore.Allocate' ]);
  48         }
  49     } else {
  50         die "Only root can pass arbitrary filesystem paths."
  51             if $authuser ne 'root@pam';
  52
  53         $path = abs_path($volid);
  54     }
  55     return $path;
  56 };
  57
  58 my $check_storage_access = sub {
  59    my ($rpcenv, $authuser, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
  60
  61    PVE::QemuServer::foreach_drive($settings, sub {
  62         my ($ds, $drive) = @_;
  63
  64         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  65
  66         my $volid = $drive->{file};
  67
  68         if (!$volid || $volid eq 'none') {
  69             # nothing to check
  70         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  71             my ($storeid, $size) = ($2 || $default_storage, $3);
  72             die "no storage ID specified (and no default storage)\n" if !$storeid;
  73             $rpcenv->check_storage_perm($authuser, $vmid, $pool, $storeid, [ 'Datastore.AllocateSpace' ]);
  74         } else {
  75             my $path = &$check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid, $pool);
  76             die "image '$path' does not exists\n" if (!(-f $path || -b $path));
  77         }
  78     });
  79 };
  80
  81 # Note: $pool is only needed when creating a VM, because pool permissions
  82 # are automatically inherited if VM already exists inside a pool.
  83 my $create_disks = sub {
  84     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
  85
  86     my $vollist = [];
  87
  88     my $res = {};
  89     PVE::QemuServer::foreach_drive($settings, sub {
  90         my ($ds, $disk) = @_;
  91
  92         my $volid = $disk->{file};
  93
  94         if (!$volid || $volid eq 'none') {
  95             $res->{$ds} = $settings->{$ds};
  96         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
  97             my ($storeid, $size) = ($2 || $default_storage, $3);
  98             die "no storage ID specified (and no default storage)\n" if !$storeid;
  99             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 100             my $fmt = $disk->{format} || $defformat;
 101             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
 102                                                   $fmt, undef, $size*1024*1024);
 103             $disk->{file} = $volid;
 104             push @$vollist, $volid;
 105             delete $disk->{format}; # no longer needed
 106             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 107         } else {
 108             my $path = &$check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid, $pool);
 109             die "image '$path' does not exists\n" if (!(-f $path || -b $path));
 110             $res->{$ds} = $settings->{$ds};
 111         }
 112     });
 113
 114     # free allocated images on error
 115     if (my $err = $@) {
 116         syslog('err', "VM $vmid creating disks failed");
 117         foreach my $volid (@$vollist) {
 118             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 119             warn $@ if $@;
 120         }
 121         die $err;
 122     }
 123
 124     # modify vm config if everything went well
 125     foreach my $ds (keys %$res) {
 126         $conf->{$ds} = $res->{$ds};
 127     }
 128
 129     return $vollist;
 130 };
 131
 132 my $check_vm_modify_config_perm = sub {
 133     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 134
 135     return 1 if $authuser ne 'root@pam';
 136
 137     foreach my $opt (@$key_list) {
 138         # disk checks need to be done somewhere else
 139         next if PVE::QemuServer::valid_drivename($opt);
 140
 141         if ($opt eq 'sockets' || $opt eq 'cores' ||
 142             $opt eq 'cpu' || $opt eq 'smp' ||
 143             $opt eq 'cpuimit' || $opt eq 'cpuunits') {
 144             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 145         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 146             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 147         } elsif ($opt eq 'memory' || $opt eq 'balloon') {
 148             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 149         } elsif ($opt eq 'args' || $opt eq 'lock') {
 150             die "only root can set '$opt' config\n";
 151         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' ||
 152                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet') {
 153             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 154         } elsif ($opt =~ m/^net\d+$/) {
 155             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 156         } else {
 157             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 158         }
 159     }
 160
 161     return 1;
 162 };
 163
 164 __PACKAGE__->register_method({
 165     name => 'vmlist',
 166     path => '',
 167     method => 'GET',
 168     description => "Virtual machine index (per node).",
 169     permissions => {
 170         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 171         user => 'all',
 172     },
 173     proxyto => 'node',
 174     protected => 1, # qemu pid files are only readable by root
 175     parameters => {
 176         additionalProperties => 0,
 177         properties => {
 178             node => get_standard_option('pve-node'),
 179         },
 180     },
 181     returns => {
 182         type => 'array',
 183         items => {
 184             type => "object",
 185             properties => {},
 186         },
 187         links => [ { rel => 'child', href => "{vmid}" } ],
 188     },
 189     code => sub {
 190         my ($param) = @_;
 191
 192         my $rpcenv = PVE::RPCEnvironment::get();
 193         my $authuser = $rpcenv->get_user();
 194
 195         my $vmstatus = PVE::QemuServer::vmstatus();
 196
 197         my $res = [];
 198         foreach my $vmid (keys %$vmstatus) {
 199             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 200
 201             my $data = $vmstatus->{$vmid};
 202             $data->{vmid} = $vmid;
 203             push @$res, $data;
 204         }
 205
 206         return $res;
 207     }});
 208
 209 __PACKAGE__->register_method({
 210     name => 'create_vm',
 211     path => '',
 212     method => 'POST',
 213     description => "Create or restore a virtual machine.",
 214     permissions => {
 215         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 216         check => [ 'or',
 217                    [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 218                    [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
 219             ],
 220     },
 221     protected => 1,
 222     proxyto => 'node',
 223     parameters => {
 224         additionalProperties => 0,
 225         properties => PVE::QemuServer::json_config_properties(
 226             {
 227                 node => get_standard_option('pve-node'),
 228                 vmid => get_standard_option('pve-vmid'),
 229                 archive => {
 230                     description => "The backup file.",
 231                     type => 'string',
 232                     optional => 1,
 233                     maxLength => 255,
 234                 },
 235                 storage => get_standard_option('pve-storage-id', {
 236                     description => "Default storage.",
 237                     optional => 1,
 238                 }),
 239                 force => {
 240                     optional => 1,
 241                     type => 'boolean',
 242                     description => "Allow to overwrite existing VM.",
 243                     requires => 'archive',
 244                 },
 245                 unique => {
 246                     optional => 1,
 247                     type => 'boolean',
 248                     description => "Assign a unique random ethernet address.",
 249                     requires => 'archive',
 250                 },
 251                 pool => {
 252                     optional => 1,
 253                     type => 'string', format => 'pve-poolid',
 254                     description => "Add the VM to the specified pool.",
 255                 },
 256             }),
 257     },
 258     returns => {
 259         type => 'string',
 260     },
 261     code => sub {
 262         my ($param) = @_;
 263
 264         my $rpcenv = PVE::RPCEnvironment::get();
 265
 266         my $authuser = $rpcenv->get_user();
 267
 268         my $node = extract_param($param, 'node');
 269
 270         my $vmid = extract_param($param, 'vmid');
 271
 272         my $archive = extract_param($param, 'archive');
 273
 274         my $storage = extract_param($param, 'storage');
 275
 276         my $force = extract_param($param, 'force');
 277
 278         my $unique = extract_param($param, 'unique');
 279
 280         my $pool = extract_param($param, 'pool');
 281
 282         my $filename = PVE::QemuServer::config_file($vmid);
 283
 284         my $storecfg = PVE::Storage::config();
 285
 286         PVE::Cluster::check_cfs_quorum();
 287
 288         if (defined($pool)) {
 289             $rpcenv->check_pool_exist($pool);
 290             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 291         }
 292
 293         $rpcenv->check_storage_perm($authuser, $vmid, $pool, $storage, [ 'Datastore.AllocateSpace' ])
 294             if defined($storage);
 295
 296         if (!$archive) {
 297             &$resolve_cdrom_alias($param);
 298
 299             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $pool, $param, $storage);
 300
 301             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 302
 303             foreach my $opt (keys %$param) {
 304                 if (PVE::QemuServer::valid_drivename($opt)) {
 305                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 306                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 307
 308                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 309                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 310                 }
 311             }
 312
 313             PVE::QemuServer::add_random_macs($param);
 314         } else {
 315             my $keystr = join(' ', keys %$param);
 316             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 317
 318             if ($archive eq '-') {
 319                 die "pipe requires cli environment\n"
 320                     && $rpcenv->{type} ne 'cli';
 321             } else {
 322                 my $path = &$check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive, $pool);
 323                 die "can't find archive file '$archive'\n" if !($path && -f $path);
 324                 $archive = $path;
 325             }
 326         }
 327
 328         my $restorefn = sub {
 329
 330             if (-f $filename) {
 331                 die "unable to restore vm $vmid: config file already exists\n"
 332                     if !$force;
 333
 334                 die "unable to restore vm $vmid: vm is running\n"
 335                     if PVE::QemuServer::check_running($vmid);
 336
 337                 # destroy existing data - keep empty config
 338                 PVE::QemuServer::destroy_vm($storecfg, $vmid, 1);
 339             }
 340
 341             my $realcmd = sub {
 342                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 343                     storage => $storage,
 344                     pool => $pool,
 345                     unique => $unique });
 346             };
 347
 348             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 349         };
 350
 351         my $createfn = sub {
 352
 353             # second test (after locking test is accurate)
 354             die "unable to create vm $vmid: config file already exists\n"
 355                 if -f $filename;
 356
 357             my $realcmd = sub {
 358
 359                 my $vollist = [];
 360
 361                 my $conf = $param;
 362
 363                 eval {
 364
 365                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 366
 367                     # try to be smart about bootdisk
 368                     my @disks = PVE::QemuServer::disknames();
 369                     my $firstdisk;
 370                     foreach my $ds (reverse @disks) {
 371                         next if !$conf->{$ds};
 372                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 373                         next if PVE::QemuServer::drive_is_cdrom($disk);
 374                         $firstdisk = $ds;
 375                     }
 376
 377                     if (!$conf->{bootdisk} && $firstdisk) {
 378                         $conf->{bootdisk} = $firstdisk;
 379                     }
 380
 381                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 382
 383                 };
 384                 my $err = $@;
 385
 386                 if ($err) {
 387                     foreach my $volid (@$vollist) {
 388                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 389                         warn $@ if $@;
 390                     }
 391                     die "create failed - $err";
 392                 }
 393             };
 394
 395             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 396         };
 397
 398         return PVE::QemuServer::lock_config($vmid, $archive ? $restorefn : $createfn);
 399     }});
 400
 401 __PACKAGE__->register_method({
 402     name => 'vmdiridx',
 403     path => '{vmid}',
 404     method => 'GET',
 405     proxyto => 'node',
 406     description => "Directory index",
 407     permissions => {
 408         user => 'all',
 409     },
 410     parameters => {
 411         additionalProperties => 0,
 412         properties => {
 413             node => get_standard_option('pve-node'),
 414             vmid => get_standard_option('pve-vmid'),
 415         },
 416     },
 417     returns => {
 418         type => 'array',
 419         items => {
 420             type => "object",
 421             properties => {
 422                 subdir => { type => 'string' },
 423             },
 424         },
 425         links => [ { rel => 'child', href => "{subdir}" } ],
 426     },
 427     code => sub {
 428         my ($param) = @_;
 429
 430         my $res = [
 431             { subdir => 'config' },
 432             { subdir => 'status' },
 433             { subdir => 'unlink' },
 434             { subdir => 'vncproxy' },
 435             { subdir => 'migrate' },
 436             { subdir => 'rrd' },
 437             { subdir => 'rrddata' },
 438             { subdir => 'monitor' },
 439             ];
 440
 441         return $res;
 442     }});
 443
 444 __PACKAGE__->register_method({
 445     name => 'rrd',
 446     path => '{vmid}/rrd',
 447     method => 'GET',
 448     protected => 1, # fixme: can we avoid that?
 449     permissions => {
 450         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 451     },
 452     description => "Read VM RRD statistics (returns PNG)",
 453     parameters => {
 454         additionalProperties => 0,
 455         properties => {
 456             node => get_standard_option('pve-node'),
 457             vmid => get_standard_option('pve-vmid'),
 458             timeframe => {
 459                 description => "Specify the time frame you are interested in.",
 460                 type => 'string',
 461                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 462             },
 463             ds => {
 464                 description => "The list of datasources you want to display.",
 465                 type => 'string', format => 'pve-configid-list',
 466             },
 467             cf => {
 468                 description => "The RRD consolidation function",
 469                 type => 'string',
 470                 enum => [ 'AVERAGE', 'MAX' ],
 471                 optional => 1,
 472             },
 473         },
 474     },
 475     returns => {
 476         type => "object",
 477         properties => {
 478             filename => { type => 'string' },
 479         },
 480     },
 481     code => sub {
 482         my ($param) = @_;
 483
 484         return PVE::Cluster::create_rrd_graph(
 485             "pve2-vm/$param->{vmid}", $param->{timeframe},
 486             $param->{ds}, $param->{cf});
 487
 488     }});
 489
 490 __PACKAGE__->register_method({
 491     name => 'rrddata',
 492     path => '{vmid}/rrddata',
 493     method => 'GET',
 494     protected => 1, # fixme: can we avoid that?
 495     permissions => {
 496         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 497     },
 498     description => "Read VM RRD statistics",
 499     parameters => {
 500         additionalProperties => 0,
 501         properties => {
 502             node => get_standard_option('pve-node'),
 503             vmid => get_standard_option('pve-vmid'),
 504             timeframe => {
 505                 description => "Specify the time frame you are interested in.",
 506                 type => 'string',
 507                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 508             },
 509             cf => {
 510                 description => "The RRD consolidation function",
 511                 type => 'string',
 512                 enum => [ 'AVERAGE', 'MAX' ],
 513                 optional => 1,
 514             },
 515         },
 516     },
 517     returns => {
 518         type => "array",
 519         items => {
 520             type => "object",
 521             properties => {},
 522         },
 523     },
 524     code => sub {
 525         my ($param) = @_;
 526
 527         return PVE::Cluster::create_rrd_data(
 528             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 529     }});
 530
 531
 532 __PACKAGE__->register_method({
 533     name => 'vm_config',
 534     path => '{vmid}/config',
 535     method => 'GET',
 536     proxyto => 'node',
 537     description => "Get virtual machine configuration.",
 538     permissions => {
 539         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 540     },
 541     parameters => {
 542         additionalProperties => 0,
 543         properties => {
 544             node => get_standard_option('pve-node'),
 545             vmid => get_standard_option('pve-vmid'),
 546         },
 547     },
 548     returns => {
 549         type => "object",
 550         properties => {
 551             digest => {
 552                 type => 'string',
 553                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 554             }
 555         },
 556     },
 557     code => sub {
 558         my ($param) = @_;
 559
 560         my $conf = PVE::QemuServer::load_config($param->{vmid});
 561
 562         return $conf;
 563     }});
 564
 565 my $vm_is_volid_owner = sub {
 566     my ($storecfg, $vmid, $volid) =@_;
 567
 568     if ($volid !~  m|^/|) {
 569         my ($path, $owner);
 570         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 571         if ($owner && ($owner == $vmid)) {
 572             return 1;
 573         }
 574     }
 575
 576     return undef;
 577 };
 578
 579 my $test_deallocate_drive = sub {
 580     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 581
 582     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 583         my $volid = $drive->{file};
 584         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 585             if ($force || $key =~ m/^unused/) {
 586                 my $sid = PVE::Storage::parse_volume_id($volid);
 587                 return $sid;
 588             }
 589         }
 590     }
 591
 592     return undef;
 593 };
 594
 595 my $delete_drive = sub {
 596     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 597
 598     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 599         my $volid = $drive->{file};
 600         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 601             if ($force || $key =~ m/^unused/) {
 602                 eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 603                 warn $@ if $@;
 604             } else {
 605                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 606             }
 607             delete $conf->{$key};
 608         }
 609     }
 610 };
 611
 612 my $vmconfig_delete_option = sub {
 613     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 614
 615     return if !defined($conf->{$opt});
 616
 617     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 618
 619     if ($isDisk) {
 620         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 621
 622         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 623         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 624             $rpcenv->check_storage_perm($authuser, $vmid, undef, $sid, [ 'Datastore.Allocate' ]);
 625         }
 626     }
 627
 628     die "error hot-unplug $opt" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 629
 630     if ($isDisk) {
 631         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 632         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 633     } else {
 634         delete $conf->{$opt};
 635     }
 636
 637     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 638 };
 639
 640 my $vmconfig_update_disk = sub {
 641     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 642
 643     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 644
 645     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 646         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 647     } else {
 648         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 649     }
 650
 651     if ($conf->{$opt}) {
 652
 653         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 654
 655             my $media = $drive->{media} || 'disk';
 656             my $oldmedia = $old_drive->{media} || 'disk';
 657             die "unable to change media type\n" if $media ne $oldmedia;
 658
 659             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 660                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 661
 662                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 663                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 664             }
 665         }
 666     }
 667
 668     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 669     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 670
 671     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 672     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 673
 674     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 675
 676         if (PVE::QemuServer::check_running($vmid)) {
 677             if ($drive->{file} eq 'none') {
 678                 PVE::QemuServer::vm_monitor_command($vmid, "eject -f drive-$opt", 0);
 679             } else {
 680                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 681                 PVE::QemuServer::vm_monitor_command($vmid, "eject -f drive-$opt", 0); #force eject if locked
 682                 PVE::QemuServer::vm_monitor_command($vmid, "change drive-$opt \"$path\"", 0) if $path;
 683             }
 684         }
 685
 686     } else { # hotplug new disks
 687
 688         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 689     }
 690 };
 691
 692 my $vmconfig_update_net = sub {
 693     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 694
 695     if ($conf->{$opt}) {
 696         #if online update, then unplug first
 697         die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 698     }
 699
 700     $conf->{$opt} = $value;
 701     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 702     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 703
 704     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 705
 706     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 707 };
 708
 709 my $vm_config_perm_list = [
 710             'VM.Config.Disk',
 711             'VM.Config.CDROM',
 712             'VM.Config.CPU',
 713             'VM.Config.Memory',
 714             'VM.Config.Network',
 715             'VM.Config.HWType',
 716             'VM.Config.Options',
 717     ];
 718
 719 __PACKAGE__->register_method({
 720     name => 'update_vm',
 721     path => '{vmid}/config',
 722     method => 'PUT',
 723     protected => 1,
 724     proxyto => 'node',
 725     description => "Set virtual machine options.",
 726     permissions => {
 727         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
 728     },
 729     parameters => {
 730         additionalProperties => 0,
 731         properties => PVE::QemuServer::json_config_properties(
 732             {
 733                 node => get_standard_option('pve-node'),
 734                 vmid => get_standard_option('pve-vmid'),
 735                 skiplock => get_standard_option('skiplock'),
 736                 delete => {
 737                     type => 'string', format => 'pve-configid-list',
 738                     description => "A list of settings you want to delete.",
 739                     optional => 1,
 740                 },
 741                 force => {
 742                     type => 'boolean',
 743                     description => $opt_force_description,
 744                     optional => 1,
 745                     requires => 'delete',
 746                 },
 747                 digest => {
 748                     type => 'string',
 749                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
 750                     maxLength => 40,
 751                     optional => 1,
 752                 }
 753             }),
 754     },
 755     returns => { type => 'null'},
 756     code => sub {
 757         my ($param) = @_;
 758
 759         my $rpcenv = PVE::RPCEnvironment::get();
 760
 761         my $authuser = $rpcenv->get_user();
 762
 763         my $node = extract_param($param, 'node');
 764
 765         my $vmid = extract_param($param, 'vmid');
 766
 767         my $digest = extract_param($param, 'digest');
 768
 769         my @paramarr = (); # used for log message
 770         foreach my $key (keys %$param) {
 771             push @paramarr, "-$key", $param->{$key};
 772         }
 773
 774         my $skiplock = extract_param($param, 'skiplock');
 775         raise_param_exc({ skiplock => "Only root may use this option." })
 776             if $skiplock && $authuser ne 'root@pam';
 777
 778         my $delete_str = extract_param($param, 'delete');
 779
 780         my $force = extract_param($param, 'force');
 781
 782         die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 783
 784         my $storecfg = PVE::Storage::config();
 785
 786         &$resolve_cdrom_alias($param);
 787
 788         # now try to verify all parameters
 789
 790         my @delete = ();
 791         foreach my $opt (PVE::Tools::split_list($delete_str)) {
 792             $opt = 'ide2' if $opt eq 'cdrom';
 793             raise_param_exc({ delete => "you can't use '-$opt' and " .
 794                                   "-delete $opt' at the same time" })
 795                 if defined($param->{$opt});
 796
 797             if (!PVE::QemuServer::option_exists($opt)) {
 798                 raise_param_exc({ delete => "unknown option '$opt'" });
 799             }
 800
 801             push @delete, $opt;
 802         }
 803
 804         foreach my $opt (keys %$param) {
 805             if (PVE::QemuServer::valid_drivename($opt)) {
 806                 # cleanup drive path
 807                 my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 808                 PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 809                 $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 810             } elsif ($opt =~ m/^net(\d+)$/) {
 811                 # add macaddr
 812                 my $net = PVE::QemuServer::parse_net($param->{$opt});
 813                 $param->{$opt} = PVE::QemuServer::print_net($net);
 814             }
 815         }
 816
 817         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 818
 819         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 820
 821         &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, undef, $param);
 822
 823         my $updatefn =  sub {
 824
 825             my $conf = PVE::QemuServer::load_config($vmid);
 826
 827             die "checksum missmatch (file change by other user?)\n"
 828                 if $digest && $digest ne $conf->{digest};
 829
 830             PVE::QemuServer::check_lock($conf) if !$skiplock;
 831
 832             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
 833
 834             foreach my $opt (@delete) { # delete
 835                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 836                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 837             }
 838
 839             foreach my $opt (keys %$param) { # add/change
 840
 841                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 842
 843                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
 844
 845                 if (PVE::QemuServer::valid_drivename($opt)) {
 846
 847                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
 848                                            $opt, $param->{$opt}, $force);
 849
 850                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
 851
 852                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
 853                                           $opt, $param->{$opt});
 854
 855                 } else {
 856
 857                     $conf->{$opt} = $param->{$opt};
 858                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 859                 }
 860             }
 861         };
 862
 863         PVE::QemuServer::lock_config($vmid, $updatefn);
 864
 865         return undef;
 866     }});
 867
 868
 869 __PACKAGE__->register_method({
 870     name => 'destroy_vm',
 871     path => '{vmid}',
 872     method => 'DELETE',
 873     protected => 1,
 874     proxyto => 'node',
 875     description => "Destroy the vm (also delete all used/owned volumes).",
 876     permissions => {
 877         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 878     },
 879     parameters => {
 880         additionalProperties => 0,
 881         properties => {
 882             node => get_standard_option('pve-node'),
 883             vmid => get_standard_option('pve-vmid'),
 884             skiplock => get_standard_option('skiplock'),
 885         },
 886     },
 887     returns => {
 888         type => 'string',
 889     },
 890     code => sub {
 891         my ($param) = @_;
 892
 893         my $rpcenv = PVE::RPCEnvironment::get();
 894
 895         my $authuser = $rpcenv->get_user();
 896
 897         my $vmid = $param->{vmid};
 898
 899         my $skiplock = $param->{skiplock};
 900         raise_param_exc({ skiplock => "Only root may use this option." })
 901             if $skiplock && $authuser ne 'root@pam';
 902
 903         # test if VM exists
 904         my $conf = PVE::QemuServer::load_config($vmid);
 905
 906         my $storecfg = PVE::Storage::config();
 907
 908         my $realcmd = sub {
 909             my $upid = shift;
 910
 911             syslog('info', "destroy VM $vmid: $upid\n");
 912
 913             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
 914         };
 915
 916         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
 917     }});
 918
 919 __PACKAGE__->register_method({
 920     name => 'unlink',
 921     path => '{vmid}/unlink',
 922     method => 'PUT',
 923     protected => 1,
 924     proxyto => 'node',
 925     description => "Unlink/delete disk images.",
 926     permissions => {
 927         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
 928     },
 929     parameters => {
 930         additionalProperties => 0,
 931         properties => {
 932             node => get_standard_option('pve-node'),
 933             vmid => get_standard_option('pve-vmid'),
 934             idlist => {
 935                 type => 'string', format => 'pve-configid-list',
 936                 description => "A list of disk IDs you want to delete.",
 937             },
 938             force => {
 939                 type => 'boolean',
 940                 description => $opt_force_description,
 941                 optional => 1,
 942             },
 943         },
 944     },
 945     returns => { type => 'null'},
 946     code => sub {
 947         my ($param) = @_;
 948
 949         $param->{delete} = extract_param($param, 'idlist');
 950
 951         __PACKAGE__->update_vm($param);
 952
 953         return undef;
 954     }});
 955
 956 my $sslcert;
 957
 958 __PACKAGE__->register_method({
 959     name => 'vncproxy',
 960     path => '{vmid}/vncproxy',
 961     method => 'POST',
 962     protected => 1,
 963     permissions => {
 964         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 965     },
 966     description => "Creates a TCP VNC proxy connections.",
 967     parameters => {
 968         additionalProperties => 0,
 969         properties => {
 970             node => get_standard_option('pve-node'),
 971             vmid => get_standard_option('pve-vmid'),
 972         },
 973     },
 974     returns => {
 975         additionalProperties => 0,
 976         properties => {
 977             user => { type => 'string' },
 978             ticket => { type => 'string' },
 979             cert => { type => 'string' },
 980             port => { type => 'integer' },
 981             upid => { type => 'string' },
 982         },
 983     },
 984     code => sub {
 985         my ($param) = @_;
 986
 987         my $rpcenv = PVE::RPCEnvironment::get();
 988
 989         my $authuser = $rpcenv->get_user();
 990
 991         my $vmid = $param->{vmid};
 992         my $node = $param->{node};
 993
 994         my $authpath = "/vms/$vmid";
 995
 996         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
 997
 998         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
 999             if !$sslcert;
1000
1001         my $port = PVE::Tools::next_vnc_port();
1002
1003         my $remip;
1004
1005         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1006             $remip = PVE::Cluster::remote_node_ip($node);
1007         }
1008
1009         # NOTE: kvm VNC traffic is already TLS encrypted,
1010         # so we select the fastest chipher here (or 'none'?)
1011         my $remcmd = $remip ? ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes',
1012                                '-c', 'blowfish-cbc', $remip] : [];
1013
1014         my $timeout = 10;
1015
1016         my $realcmd = sub {
1017             my $upid = shift;
1018
1019             syslog('info', "starting vnc proxy $upid\n");
1020
1021             my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1022
1023             my $qmstr = join(' ', @$qmcmd);
1024
1025             # also redirect stderr (else we get RFB protocol errors)
1026             my $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1027
1028             PVE::Tools::run_command($cmd);
1029
1030             return;
1031         };
1032
1033         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1034
1035         return {
1036             user => $authuser,
1037             ticket => $ticket,
1038             port => $port,
1039             upid => $upid,
1040             cert => $sslcert,
1041         };
1042     }});
1043
1044 __PACKAGE__->register_method({
1045     name => 'vmcmdidx',
1046     path => '{vmid}/status',
1047     method => 'GET',
1048     proxyto => 'node',
1049     description => "Directory index",
1050     permissions => {
1051         user => 'all',
1052     },
1053     parameters => {
1054         additionalProperties => 0,
1055         properties => {
1056             node => get_standard_option('pve-node'),
1057             vmid => get_standard_option('pve-vmid'),
1058         },
1059     },
1060     returns => {
1061         type => 'array',
1062         items => {
1063             type => "object",
1064             properties => {
1065                 subdir => { type => 'string' },
1066             },
1067         },
1068         links => [ { rel => 'child', href => "{subdir}" } ],
1069     },
1070     code => sub {
1071         my ($param) = @_;
1072
1073         # test if VM exists
1074         my $conf = PVE::QemuServer::load_config($param->{vmid});
1075
1076         my $res = [
1077             { subdir => 'current' },
1078             { subdir => 'start' },
1079             { subdir => 'stop' },
1080             ];
1081
1082         return $res;
1083     }});
1084
1085 __PACKAGE__->register_method({
1086     name => 'vm_status',
1087     path => '{vmid}/status/current',
1088     method => 'GET',
1089     proxyto => 'node',
1090     protected => 1, # qemu pid files are only readable by root
1091     description => "Get virtual machine status.",
1092     permissions => {
1093         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1094     },
1095     parameters => {
1096         additionalProperties => 0,
1097         properties => {
1098             node => get_standard_option('pve-node'),
1099             vmid => get_standard_option('pve-vmid'),
1100         },
1101     },
1102     returns => { type => 'object' },
1103     code => sub {
1104         my ($param) = @_;
1105
1106         # test if VM exists
1107         my $conf = PVE::QemuServer::load_config($param->{vmid});
1108
1109         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid});
1110         my $status = $vmstatus->{$param->{vmid}};
1111
1112         my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1113         if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $param->{vmid}, 1)) {
1114             $status->{ha} = 1;
1115         } else {
1116             $status->{ha} = 0;
1117         }
1118
1119         return $status;
1120     }});
1121
1122 __PACKAGE__->register_method({
1123     name => 'vm_start',
1124     path => '{vmid}/status/start',
1125     method => 'POST',
1126     protected => 1,
1127     proxyto => 'node',
1128     description => "Start virtual machine.",
1129     permissions => {
1130         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1131     },
1132     parameters => {
1133         additionalProperties => 0,
1134         properties => {
1135             node => get_standard_option('pve-node'),
1136             vmid => get_standard_option('pve-vmid'),
1137             skiplock => get_standard_option('skiplock'),
1138             stateuri => get_standard_option('pve-qm-stateuri'),
1139         },
1140     },
1141     returns => {
1142         type => 'string',
1143     },
1144     code => sub {
1145         my ($param) = @_;
1146
1147         my $rpcenv = PVE::RPCEnvironment::get();
1148
1149         my $authuser = $rpcenv->get_user();
1150
1151         my $node = extract_param($param, 'node');
1152
1153         my $vmid = extract_param($param, 'vmid');
1154
1155         my $stateuri = extract_param($param, 'stateuri');
1156         raise_param_exc({ stateuri => "Only root may use this option." })
1157             if $stateuri && $authuser ne 'root@pam';
1158
1159         my $skiplock = extract_param($param, 'skiplock');
1160         raise_param_exc({ skiplock => "Only root may use this option." })
1161             if $skiplock && $authuser ne 'root@pam';
1162
1163         my $storecfg = PVE::Storage::config();
1164
1165         my $realcmd = sub {
1166             my $upid = shift;
1167
1168             syslog('info', "start VM $vmid: $upid\n");
1169
1170             PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock);
1171
1172             return;
1173         };
1174
1175         return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1176     }});
1177
1178 __PACKAGE__->register_method({
1179     name => 'vm_stop',
1180     path => '{vmid}/status/stop',
1181     method => 'POST',
1182     protected => 1,
1183     proxyto => 'node',
1184     description => "Stop virtual machine.",
1185     permissions => {
1186         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1187     },
1188     parameters => {
1189         additionalProperties => 0,
1190         properties => {
1191             node => get_standard_option('pve-node'),
1192             vmid => get_standard_option('pve-vmid'),
1193             skiplock => get_standard_option('skiplock'),
1194             timeout => {
1195                 description => "Wait maximal timeout seconds.",
1196                 type => 'integer',
1197                 minimum => 0,
1198                 optional => 1,
1199             },
1200             keepActive => {
1201                 description => "Do not decativate storage volumes.",
1202                 type => 'boolean',
1203                 optional => 1,
1204                 default => 0,
1205             }
1206         },
1207     },
1208     returns => {
1209         type => 'string',
1210     },
1211     code => sub {
1212         my ($param) = @_;
1213
1214         my $rpcenv = PVE::RPCEnvironment::get();
1215
1216         my $authuser = $rpcenv->get_user();
1217
1218         my $node = extract_param($param, 'node');
1219
1220         my $vmid = extract_param($param, 'vmid');
1221
1222         my $skiplock = extract_param($param, 'skiplock');
1223         raise_param_exc({ skiplock => "Only root may use this option." })
1224             if $skiplock && $authuser ne 'root@pam';
1225
1226         my $keepActive = extract_param($param, 'keepActive');
1227         raise_param_exc({ keepActive => "Only root may use this option." })
1228             if $keepActive && $authuser ne 'root@pam';
1229
1230         my $storecfg = PVE::Storage::config();
1231
1232         my $realcmd = sub {
1233             my $upid = shift;
1234
1235             syslog('info', "stop VM $vmid: $upid\n");
1236
1237             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1238                                      $param->{timeout}, 0, 1, $keepActive);
1239
1240             return;
1241         };
1242
1243         return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1244     }});
1245
1246 __PACKAGE__->register_method({
1247     name => 'vm_reset',
1248     path => '{vmid}/status/reset',
1249     method => 'POST',
1250     protected => 1,
1251     proxyto => 'node',
1252     description => "Reset virtual machine.",
1253     permissions => {
1254         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1255     },
1256     parameters => {
1257         additionalProperties => 0,
1258         properties => {
1259             node => get_standard_option('pve-node'),
1260             vmid => get_standard_option('pve-vmid'),
1261             skiplock => get_standard_option('skiplock'),
1262         },
1263     },
1264     returns => {
1265         type => 'string',
1266     },
1267     code => sub {
1268         my ($param) = @_;
1269
1270         my $rpcenv = PVE::RPCEnvironment::get();
1271
1272         my $authuser = $rpcenv->get_user();
1273
1274         my $node = extract_param($param, 'node');
1275
1276         my $vmid = extract_param($param, 'vmid');
1277
1278         my $skiplock = extract_param($param, 'skiplock');
1279         raise_param_exc({ skiplock => "Only root may use this option." })
1280             if $skiplock && $authuser ne 'root@pam';
1281
1282         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1283
1284         my $realcmd = sub {
1285             my $upid = shift;
1286
1287             PVE::QemuServer::vm_reset($vmid, $skiplock);
1288
1289             return;
1290         };
1291
1292         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1293     }});
1294
1295 __PACKAGE__->register_method({
1296     name => 'vm_shutdown',
1297     path => '{vmid}/status/shutdown',
1298     method => 'POST',
1299     protected => 1,
1300     proxyto => 'node',
1301     description => "Shutdown virtual machine.",
1302     permissions => {
1303         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1304     },
1305     parameters => {
1306         additionalProperties => 0,
1307         properties => {
1308             node => get_standard_option('pve-node'),
1309             vmid => get_standard_option('pve-vmid'),
1310             skiplock => get_standard_option('skiplock'),
1311             timeout => {
1312                 description => "Wait maximal timeout seconds.",
1313                 type => 'integer',
1314                 minimum => 0,
1315                 optional => 1,
1316             },
1317             forceStop => {
1318                 description => "Make sure the VM stops.",
1319                 type => 'boolean',
1320                 optional => 1,
1321                 default => 0,
1322             },
1323             keepActive => {
1324                 description => "Do not decativate storage volumes.",
1325                 type => 'boolean',
1326                 optional => 1,
1327                 default => 0,
1328             }
1329         },
1330     },
1331     returns => {
1332         type => 'string',
1333     },
1334     code => sub {
1335         my ($param) = @_;
1336
1337         my $rpcenv = PVE::RPCEnvironment::get();
1338
1339         my $authuser = $rpcenv->get_user();
1340
1341         my $node = extract_param($param, 'node');
1342
1343         my $vmid = extract_param($param, 'vmid');
1344
1345         my $skiplock = extract_param($param, 'skiplock');
1346         raise_param_exc({ skiplock => "Only root may use this option." })
1347             if $skiplock && $authuser ne 'root@pam';
1348
1349         my $keepActive = extract_param($param, 'keepActive');
1350         raise_param_exc({ keepActive => "Only root may use this option." })
1351             if $keepActive && $authuser ne 'root@pam';
1352
1353         my $storecfg = PVE::Storage::config();
1354
1355         my $realcmd = sub {
1356             my $upid = shift;
1357
1358             syslog('info', "shutdown VM $vmid: $upid\n");
1359
1360             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1361                                      1, $param->{forceStop}, $keepActive);
1362
1363             return;
1364         };
1365
1366         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1367     }});
1368
1369 __PACKAGE__->register_method({
1370     name => 'vm_suspend',
1371     path => '{vmid}/status/suspend',
1372     method => 'POST',
1373     protected => 1,
1374     proxyto => 'node',
1375     description => "Suspend virtual machine.",
1376     permissions => {
1377         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1378     },
1379     parameters => {
1380         additionalProperties => 0,
1381         properties => {
1382             node => get_standard_option('pve-node'),
1383             vmid => get_standard_option('pve-vmid'),
1384             skiplock => get_standard_option('skiplock'),
1385         },
1386     },
1387     returns => {
1388         type => 'string',
1389     },
1390     code => sub {
1391         my ($param) = @_;
1392
1393         my $rpcenv = PVE::RPCEnvironment::get();
1394
1395         my $authuser = $rpcenv->get_user();
1396
1397         my $node = extract_param($param, 'node');
1398
1399         my $vmid = extract_param($param, 'vmid');
1400
1401         my $skiplock = extract_param($param, 'skiplock');
1402         raise_param_exc({ skiplock => "Only root may use this option." })
1403             if $skiplock && $authuser ne 'root@pam';
1404
1405         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1406
1407         my $realcmd = sub {
1408             my $upid = shift;
1409
1410             syslog('info', "suspend VM $vmid: $upid\n");
1411
1412             PVE::QemuServer::vm_suspend($vmid, $skiplock);
1413
1414             return;
1415         };
1416
1417         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
1418     }});
1419
1420 __PACKAGE__->register_method({
1421     name => 'vm_resume',
1422     path => '{vmid}/status/resume',
1423     method => 'POST',
1424     protected => 1,
1425     proxyto => 'node',
1426     description => "Resume virtual machine.",
1427     permissions => {
1428         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1429     },
1430     parameters => {
1431         additionalProperties => 0,
1432         properties => {
1433             node => get_standard_option('pve-node'),
1434             vmid => get_standard_option('pve-vmid'),
1435             skiplock => get_standard_option('skiplock'),
1436         },
1437     },
1438     returns => {
1439         type => 'string',
1440     },
1441     code => sub {
1442         my ($param) = @_;
1443
1444         my $rpcenv = PVE::RPCEnvironment::get();
1445
1446         my $authuser = $rpcenv->get_user();
1447
1448         my $node = extract_param($param, 'node');
1449
1450         my $vmid = extract_param($param, 'vmid');
1451
1452         my $skiplock = extract_param($param, 'skiplock');
1453         raise_param_exc({ skiplock => "Only root may use this option." })
1454             if $skiplock && $authuser ne 'root@pam';
1455
1456         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1457
1458         my $realcmd = sub {
1459             my $upid = shift;
1460
1461             syslog('info', "resume VM $vmid: $upid\n");
1462
1463             PVE::QemuServer::vm_resume($vmid, $skiplock);
1464
1465             return;
1466         };
1467
1468         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
1469     }});
1470
1471 __PACKAGE__->register_method({
1472     name => 'vm_sendkey',
1473     path => '{vmid}/sendkey',
1474     method => 'PUT',
1475     protected => 1,
1476     proxyto => 'node',
1477     description => "Send key event to virtual machine.",
1478     permissions => {
1479         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1480     },
1481     parameters => {
1482         additionalProperties => 0,
1483         properties => {
1484             node => get_standard_option('pve-node'),
1485             vmid => get_standard_option('pve-vmid'),
1486             skiplock => get_standard_option('skiplock'),
1487             key => {
1488                 description => "The key (qemu monitor encoding).",
1489                 type => 'string'
1490             }
1491         },
1492     },
1493     returns => { type => 'null'},
1494     code => sub {
1495         my ($param) = @_;
1496
1497         my $rpcenv = PVE::RPCEnvironment::get();
1498
1499         my $authuser = $rpcenv->get_user();
1500
1501         my $node = extract_param($param, 'node');
1502
1503         my $vmid = extract_param($param, 'vmid');
1504
1505         my $skiplock = extract_param($param, 'skiplock');
1506         raise_param_exc({ skiplock => "Only root may use this option." })
1507             if $skiplock && $authuser ne 'root@pam';
1508
1509         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
1510
1511         return;
1512     }});
1513
1514 __PACKAGE__->register_method({
1515     name => 'migrate_vm',
1516     path => '{vmid}/migrate',
1517     method => 'POST',
1518     protected => 1,
1519     proxyto => 'node',
1520     description => "Migrate virtual machine. Creates a new migration task.",
1521     permissions => {
1522         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
1523     },
1524     parameters => {
1525         additionalProperties => 0,
1526         properties => {
1527             node => get_standard_option('pve-node'),
1528             vmid => get_standard_option('pve-vmid'),
1529             target => get_standard_option('pve-node', { description => "Target node." }),
1530             online => {
1531                 type => 'boolean',
1532                 description => "Use online/live migration.",
1533                 optional => 1,
1534             },
1535             force => {
1536                 type => 'boolean',
1537                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
1538                 optional => 1,
1539             },
1540         },
1541     },
1542     returns => {
1543         type => 'string',
1544         description => "the task ID.",
1545     },
1546     code => sub {
1547         my ($param) = @_;
1548
1549         my $rpcenv = PVE::RPCEnvironment::get();
1550
1551         my $authuser = $rpcenv->get_user();
1552
1553         my $target = extract_param($param, 'target');
1554
1555         my $localnode = PVE::INotify::nodename();
1556         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1557
1558         PVE::Cluster::check_cfs_quorum();
1559
1560         PVE::Cluster::check_node_exists($target);
1561
1562         my $targetip = PVE::Cluster::remote_node_ip($target);
1563
1564         my $vmid = extract_param($param, 'vmid');
1565
1566         raise_param_exc({ force => "Only root may use this option." })
1567             if $param->{force} && $authuser ne 'root@pam';
1568
1569         # test if VM exists
1570         my $conf = PVE::QemuServer::load_config($vmid);
1571
1572         # try to detect errors early
1573
1574         PVE::QemuServer::check_lock($conf);
1575
1576         if (PVE::QemuServer::check_running($vmid)) {
1577             die "cant migrate running VM without --online\n"
1578                 if !$param->{online};
1579         }
1580
1581         my $realcmd = sub {
1582             my $upid = shift;
1583
1584             PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
1585         };
1586
1587         my $upid = $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
1588
1589         return $upid;
1590     }});
1591
1592 __PACKAGE__->register_method({
1593     name => 'monitor',
1594     path => '{vmid}/monitor',
1595     method => 'POST',
1596     protected => 1,
1597     proxyto => 'node',
1598     description => "Execute Qemu monitor commands.",
1599     permissions => {
1600         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
1601     },
1602     parameters => {
1603         additionalProperties => 0,
1604         properties => {
1605             node => get_standard_option('pve-node'),
1606             vmid => get_standard_option('pve-vmid'),
1607             command => {
1608                 type => 'string',
1609                 description => "The monitor command.",
1610             }
1611         },
1612     },
1613     returns => { type => 'string'},
1614     code => sub {
1615         my ($param) = @_;
1616
1617         my $vmid = $param->{vmid};
1618
1619         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
1620
1621         my $res = '';
1622         eval {
1623             $res = PVE::QemuServer::vm_monitor_command($vmid, $param->{command});
1624         };
1625         $res = "ERROR: $@" if $@;
1626
1627         return $res;
1628     }});
1629
1630 1;