PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8
   9 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  10 use PVE::SafeSyslog;
  11 use PVE::Tools qw(extract_param);
  12 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  13 use PVE::Storage;
  14 use PVE::JSONSchema qw(get_standard_option);
  15 use PVE::RESTHandler;
  16 use PVE::QemuServer;
  17 use PVE::QemuMigrate;
  18 use PVE::RPCEnvironment;
  19 use PVE::AccessControl;
  20 use PVE::INotify;
  21 use PVE::Network;
  22 use PVE::API2::Firewall::VM;
  23
  24 use Data::Dumper; # fixme: remove
  25
  26 use base qw(PVE::RESTHandler);
  27
  28 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  29
  30 my $resolve_cdrom_alias = sub {
  31     my $param = shift;
  32
  33     if (my $value = $param->{cdrom}) {
  34         $value .= ",media=cdrom" if $value !~ m/media=/;
  35         $param->{ide2} = $value;
  36         delete $param->{cdrom};
  37     }
  38 };
  39
  40
  41 my $check_storage_access = sub {
  42    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  43
  44    PVE::QemuServer::foreach_drive($settings, sub {
  45         my ($ds, $drive) = @_;
  46
  47         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  48
  49         my $volid = $drive->{file};
  50
  51         if (!$volid || $volid eq 'none') {
  52             # nothing to check
  53         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  54             $rpcenv->check($authuser, "/", ['Sys.Console']);
  55         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  56             my ($storeid, $size) = ($2 || $default_storage, $3);
  57             die "no storage ID specified (and no default storage)\n" if !$storeid;
  58             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  59         } else {
  60             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  61         }
  62     });
  63 };
  64
  65 my $check_storage_access_clone = sub {
  66    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  67
  68    my $sharedvm = 1;
  69
  70    PVE::QemuServer::foreach_drive($conf, sub {
  71         my ($ds, $drive) = @_;
  72
  73         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  74
  75         my $volid = $drive->{file};
  76
  77         return if !$volid || $volid eq 'none';
  78
  79         if ($isCDROM) {
  80             if ($volid eq 'cdrom') {
  81                 $rpcenv->check($authuser, "/", ['Sys.Console']);
  82             } else {
  83                 # we simply allow access
  84                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  85                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  86                 $sharedvm = 0 if !$scfg->{shared};
  87
  88             }
  89         } else {
  90             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  91             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  92             $sharedvm = 0 if !$scfg->{shared};
  93
  94             $sid = $storage if $storage;
  95             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
  96         }
  97     });
  98
  99    return $sharedvm;
 100 };
 101
 102 # Note: $pool is only needed when creating a VM, because pool permissions
 103 # are automatically inherited if VM already exists inside a pool.
 104 my $create_disks = sub {
 105     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 106
 107     my $vollist = [];
 108
 109     my $res = {};
 110     PVE::QemuServer::foreach_drive($settings, sub {
 111         my ($ds, $disk) = @_;
 112
 113         my $volid = $disk->{file};
 114
 115         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 116             delete $disk->{size};
 117             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 118         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
 119             my ($storeid, $size) = ($2 || $default_storage, $3);
 120             die "no storage ID specified (and no default storage)\n" if !$storeid;
 121             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 122             my $fmt = $disk->{format} || $defformat;
 123             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
 124                                                   $fmt, undef, $size*1024*1024);
 125             $disk->{file} = $volid;
 126             $disk->{size} = $size*1024*1024*1024;
 127             push @$vollist, $volid;
 128             delete $disk->{format}; # no longer needed
 129             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 130         } else {
 131
 132             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
 133
 134             my $volid_is_new = 1;
 135
 136             if ($conf->{$ds}) {
 137                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 138                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 139             }
 140
 141             if ($volid_is_new) {
 142
 143                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 144
 145                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 146
 147                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 148
 149                 die "volume $volid does not exists\n" if !$size;
 150
 151                 $disk->{size} = $size;
 152             }
 153
 154             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 155         }
 156     });
 157
 158     # free allocated images on error
 159     if (my $err = $@) {
 160         syslog('err', "VM $vmid creating disks failed");
 161         foreach my $volid (@$vollist) {
 162             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 163             warn $@ if $@;
 164         }
 165         die $err;
 166     }
 167
 168     # modify vm config if everything went well
 169     foreach my $ds (keys %$res) {
 170         $conf->{$ds} = $res->{$ds};
 171     }
 172
 173     return $vollist;
 174 };
 175
 176 my $check_vm_modify_config_perm = sub {
 177     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 178
 179     return 1 if $authuser eq 'root@pam';
 180
 181     foreach my $opt (@$key_list) {
 182         # disk checks need to be done somewhere else
 183         next if PVE::QemuServer::valid_drivename($opt);
 184
 185         if ($opt eq 'sockets' || $opt eq 'cores' ||
 186             $opt eq 'cpu' || $opt eq 'smp' ||
 187             $opt eq 'cpulimit' || $opt eq 'cpuunits') {
 188             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 189         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 190             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 191         } elsif ($opt eq 'memory' || $opt eq 'balloon' || $opt eq 'shares') {
 192             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 193         } elsif ($opt eq 'args' || $opt eq 'lock') {
 194             die "only root can set '$opt' config\n";
 195         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' || $opt eq 'machine' ||
 196                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet' || $opt eq 'smbios1') {
 197             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 198         } elsif ($opt =~ m/^net\d+$/) {
 199             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 200         } else {
 201             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 202         }
 203     }
 204
 205     return 1;
 206 };
 207
 208 __PACKAGE__->register_method({
 209     name => 'vmlist',
 210     path => '',
 211     method => 'GET',
 212     description => "Virtual machine index (per node).",
 213     permissions => {
 214         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 215         user => 'all',
 216     },
 217     proxyto => 'node',
 218     protected => 1, # qemu pid files are only readable by root
 219     parameters => {
 220         additionalProperties => 0,
 221         properties => {
 222             node => get_standard_option('pve-node'),
 223         },
 224     },
 225     returns => {
 226         type => 'array',
 227         items => {
 228             type => "object",
 229             properties => {},
 230         },
 231         links => [ { rel => 'child', href => "{vmid}" } ],
 232     },
 233     code => sub {
 234         my ($param) = @_;
 235
 236         my $rpcenv = PVE::RPCEnvironment::get();
 237         my $authuser = $rpcenv->get_user();
 238
 239         my $vmstatus = PVE::QemuServer::vmstatus();
 240
 241         my $res = [];
 242         foreach my $vmid (keys %$vmstatus) {
 243             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 244
 245             my $data = $vmstatus->{$vmid};
 246             $data->{vmid} = int($vmid);
 247             push @$res, $data;
 248         }
 249
 250         return $res;
 251     }});
 252
 253
 254
 255 __PACKAGE__->register_method({
 256     name => 'create_vm',
 257     path => '',
 258     method => 'POST',
 259     description => "Create or restore a virtual machine.",
 260     permissions => {
 261         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 262             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 263             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 264         user => 'all', # check inside
 265     },
 266     protected => 1,
 267     proxyto => 'node',
 268     parameters => {
 269         additionalProperties => 0,
 270         properties => PVE::QemuServer::json_config_properties(
 271             {
 272                 node => get_standard_option('pve-node'),
 273                 vmid => get_standard_option('pve-vmid'),
 274                 archive => {
 275                     description => "The backup file.",
 276                     type => 'string',
 277                     optional => 1,
 278                     maxLength => 255,
 279                 },
 280                 storage => get_standard_option('pve-storage-id', {
 281                     description => "Default storage.",
 282                     optional => 1,
 283                 }),
 284                 force => {
 285                     optional => 1,
 286                     type => 'boolean',
 287                     description => "Allow to overwrite existing VM.",
 288                     requires => 'archive',
 289                 },
 290                 unique => {
 291                     optional => 1,
 292                     type => 'boolean',
 293                     description => "Assign a unique random ethernet address.",
 294                     requires => 'archive',
 295                 },
 296                 pool => {
 297                     optional => 1,
 298                     type => 'string', format => 'pve-poolid',
 299                     description => "Add the VM to the specified pool.",
 300                 },
 301             }),
 302     },
 303     returns => {
 304         type => 'string',
 305     },
 306     code => sub {
 307         my ($param) = @_;
 308
 309         my $rpcenv = PVE::RPCEnvironment::get();
 310
 311         my $authuser = $rpcenv->get_user();
 312
 313         my $node = extract_param($param, 'node');
 314
 315         my $vmid = extract_param($param, 'vmid');
 316
 317         my $archive = extract_param($param, 'archive');
 318
 319         my $storage = extract_param($param, 'storage');
 320
 321         my $force = extract_param($param, 'force');
 322
 323         my $unique = extract_param($param, 'unique');
 324
 325         my $pool = extract_param($param, 'pool');
 326
 327         my $filename = PVE::QemuServer::config_file($vmid);
 328
 329         my $storecfg = PVE::Storage::config();
 330
 331         PVE::Cluster::check_cfs_quorum();
 332
 333         if (defined($pool)) {
 334             $rpcenv->check_pool_exist($pool);
 335         }
 336
 337         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 338             if defined($storage);
 339
 340         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 341             # OK
 342         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 343             # OK
 344         } elsif ($archive && $force && (-f $filename) &&
 345                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 346             # OK: user has VM.Backup permissions, and want to restore an existing VM
 347         } else {
 348             raise_perm_exc();
 349         }
 350
 351         if (!$archive) {
 352             &$resolve_cdrom_alias($param);
 353
 354             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 355
 356             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 357
 358             foreach my $opt (keys %$param) {
 359                 if (PVE::QemuServer::valid_drivename($opt)) {
 360                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 361                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 362
 363                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 364                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 365                 }
 366             }
 367
 368             PVE::QemuServer::add_random_macs($param);
 369         } else {
 370             my $keystr = join(' ', keys %$param);
 371             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 372
 373             if ($archive eq '-') {
 374                 die "pipe requires cli environment\n"
 375                     if $rpcenv->{type} ne 'cli';
 376             } else {
 377                 $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $archive);
 378                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 379             }
 380         }
 381
 382         my $restorefn = sub {
 383
 384             # fixme: this test does not work if VM exists on other node!
 385             if (-f $filename) {
 386                 die "unable to restore vm $vmid: config file already exists\n"
 387                     if !$force;
 388
 389                 die "unable to restore vm $vmid: vm is running\n"
 390                     if PVE::QemuServer::check_running($vmid);
 391             }
 392
 393             my $realcmd = sub {
 394                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 395                     storage => $storage,
 396                     pool => $pool,
 397                     unique => $unique });
 398
 399                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 400             };
 401
 402             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 403         };
 404
 405         my $createfn = sub {
 406
 407             # test after locking
 408             die "unable to create vm $vmid: config file already exists\n"
 409                 if -f $filename;
 410
 411             my $realcmd = sub {
 412
 413                 my $vollist = [];
 414
 415                 my $conf = $param;
 416
 417                 eval {
 418
 419                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 420
 421                     # try to be smart about bootdisk
 422                     my @disks = PVE::QemuServer::disknames();
 423                     my $firstdisk;
 424                     foreach my $ds (reverse @disks) {
 425                         next if !$conf->{$ds};
 426                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 427                         next if PVE::QemuServer::drive_is_cdrom($disk);
 428                         $firstdisk = $ds;
 429                     }
 430
 431                     if (!$conf->{bootdisk} && $firstdisk) {
 432                         $conf->{bootdisk} = $firstdisk;
 433                     }
 434
 435                     # auto generate uuid if user did not specify smbios1 option
 436                     if (!$conf->{smbios1}) {
 437                         my ($uuid, $uuid_str);
 438                         UUID::generate($uuid);
 439                         UUID::unparse($uuid, $uuid_str);
 440                         $conf->{smbios1} = "uuid=$uuid_str";
 441                     }
 442
 443                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 444
 445                 };
 446                 my $err = $@;
 447
 448                 if ($err) {
 449                     foreach my $volid (@$vollist) {
 450                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 451                         warn $@ if $@;
 452                     }
 453                     die "create failed - $err";
 454                 }
 455
 456                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 457             };
 458
 459             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 460         };
 461
 462         return PVE::QemuServer::lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 463     }});
 464
 465 __PACKAGE__->register_method({
 466     name => 'vmdiridx',
 467     path => '{vmid}',
 468     method => 'GET',
 469     proxyto => 'node',
 470     description => "Directory index",
 471     permissions => {
 472         user => 'all',
 473     },
 474     parameters => {
 475         additionalProperties => 0,
 476         properties => {
 477             node => get_standard_option('pve-node'),
 478             vmid => get_standard_option('pve-vmid'),
 479         },
 480     },
 481     returns => {
 482         type => 'array',
 483         items => {
 484             type => "object",
 485             properties => {
 486                 subdir => { type => 'string' },
 487             },
 488         },
 489         links => [ { rel => 'child', href => "{subdir}" } ],
 490     },
 491     code => sub {
 492         my ($param) = @_;
 493
 494         my $res = [
 495             { subdir => 'config' },
 496             { subdir => 'status' },
 497             { subdir => 'unlink' },
 498             { subdir => 'vncproxy' },
 499             { subdir => 'migrate' },
 500             { subdir => 'resize' },
 501             { subdir => 'move' },
 502             { subdir => 'rrd' },
 503             { subdir => 'rrddata' },
 504             { subdir => 'monitor' },
 505             { subdir => 'snapshot' },
 506             { subdir => 'spiceproxy' },
 507             { subdir => 'sendkey' },
 508             { subdir => 'firewall' },
 509             ];
 510
 511         return $res;
 512     }});
 513
 514 __PACKAGE__->register_method ({
 515     subclass => "PVE::API2::Firewall::VM",
 516     path => '{vmid}/firewall',
 517 });
 518
 519 __PACKAGE__->register_method({
 520     name => 'rrd',
 521     path => '{vmid}/rrd',
 522     method => 'GET',
 523     protected => 1, # fixme: can we avoid that?
 524     permissions => {
 525         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 526     },
 527     description => "Read VM RRD statistics (returns PNG)",
 528     parameters => {
 529         additionalProperties => 0,
 530         properties => {
 531             node => get_standard_option('pve-node'),
 532             vmid => get_standard_option('pve-vmid'),
 533             timeframe => {
 534                 description => "Specify the time frame you are interested in.",
 535                 type => 'string',
 536                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 537             },
 538             ds => {
 539                 description => "The list of datasources you want to display.",
 540                 type => 'string', format => 'pve-configid-list',
 541             },
 542             cf => {
 543                 description => "The RRD consolidation function",
 544                 type => 'string',
 545                 enum => [ 'AVERAGE', 'MAX' ],
 546                 optional => 1,
 547             },
 548         },
 549     },
 550     returns => {
 551         type => "object",
 552         properties => {
 553             filename => { type => 'string' },
 554         },
 555     },
 556     code => sub {
 557         my ($param) = @_;
 558
 559         return PVE::Cluster::create_rrd_graph(
 560             "pve2-vm/$param->{vmid}", $param->{timeframe},
 561             $param->{ds}, $param->{cf});
 562
 563     }});
 564
 565 __PACKAGE__->register_method({
 566     name => 'rrddata',
 567     path => '{vmid}/rrddata',
 568     method => 'GET',
 569     protected => 1, # fixme: can we avoid that?
 570     permissions => {
 571         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 572     },
 573     description => "Read VM RRD statistics",
 574     parameters => {
 575         additionalProperties => 0,
 576         properties => {
 577             node => get_standard_option('pve-node'),
 578             vmid => get_standard_option('pve-vmid'),
 579             timeframe => {
 580                 description => "Specify the time frame you are interested in.",
 581                 type => 'string',
 582                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 583             },
 584             cf => {
 585                 description => "The RRD consolidation function",
 586                 type => 'string',
 587                 enum => [ 'AVERAGE', 'MAX' ],
 588                 optional => 1,
 589             },
 590         },
 591     },
 592     returns => {
 593         type => "array",
 594         items => {
 595             type => "object",
 596             properties => {},
 597         },
 598     },
 599     code => sub {
 600         my ($param) = @_;
 601
 602         return PVE::Cluster::create_rrd_data(
 603             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 604     }});
 605
 606
 607 __PACKAGE__->register_method({
 608     name => 'vm_config',
 609     path => '{vmid}/config',
 610     method => 'GET',
 611     proxyto => 'node',
 612     description => "Get virtual machine configuration.",
 613     permissions => {
 614         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 615     },
 616     parameters => {
 617         additionalProperties => 0,
 618         properties => {
 619             node => get_standard_option('pve-node'),
 620             vmid => get_standard_option('pve-vmid'),
 621         },
 622     },
 623     returns => {
 624         type => "object",
 625         properties => {
 626             digest => {
 627                 type => 'string',
 628                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 629             }
 630         },
 631     },
 632     code => sub {
 633         my ($param) = @_;
 634
 635         my $conf = PVE::QemuServer::load_config($param->{vmid});
 636
 637         delete $conf->{snapshots};
 638
 639         return $conf;
 640     }});
 641
 642 my $vm_is_volid_owner = sub {
 643     my ($storecfg, $vmid, $volid) =@_;
 644
 645     if ($volid !~  m|^/|) {
 646         my ($path, $owner);
 647         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 648         if ($owner && ($owner == $vmid)) {
 649             return 1;
 650         }
 651     }
 652
 653     return undef;
 654 };
 655
 656 my $test_deallocate_drive = sub {
 657     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 658
 659     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 660         my $volid = $drive->{file};
 661         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 662             if ($force || $key =~ m/^unused/) {
 663                 my $sid = PVE::Storage::parse_volume_id($volid);
 664                 return $sid;
 665             }
 666         }
 667     }
 668
 669     return undef;
 670 };
 671
 672 my $delete_drive = sub {
 673     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 674
 675     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 676         my $volid = $drive->{file};
 677
 678         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 679             if ($force || $key =~ m/^unused/) {
 680                 eval {
 681                     # check if the disk is really unused
 682                     my $used_paths = PVE::QemuServer::get_used_paths($vmid, $storecfg, $conf, 1, $key);
 683                     my $path = PVE::Storage::path($storecfg, $volid);
 684
 685                     die "unable to delete '$volid' - volume is still in use (snapshot?)\n"
 686                         if $used_paths->{$path};
 687
 688                     PVE::Storage::vdisk_free($storecfg, $volid);
 689                 };
 690                 die $@ if $@;
 691             } else {
 692                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 693             }
 694         }
 695     }
 696
 697     delete $conf->{$key};
 698 };
 699
 700 my $vmconfig_delete_option = sub {
 701     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 702
 703     return if !defined($conf->{$opt});
 704
 705     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 706
 707     if ($isDisk) {
 708         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 709
 710         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 711         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 712             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 713         }
 714     }
 715
 716     my $unplugwarning = "";
 717     if ($conf->{ostype} && $conf->{ostype} eq 'l26') {
 718         $unplugwarning = "<br>verify that you have acpiphp && pci_hotplug modules loaded in your guest VM";
 719     } elsif ($conf->{ostype} && $conf->{ostype} eq 'l24') {
 720         $unplugwarning = "<br>kernel 2.4 don't support hotplug, please disable hotplug in options";
 721     } elsif (!$conf->{ostype} || ($conf->{ostype} && $conf->{ostype} eq 'other')) {
 722         $unplugwarning = "<br>verify that your guest support acpi hotplug";
 723     }
 724
 725     if ($opt eq 'tablet') {
 726         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
 727     } else {
 728         die "error hot-unplug $opt $unplugwarning" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 729     }
 730
 731     if ($isDisk) {
 732         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 733         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 734     } else {
 735         delete $conf->{$opt};
 736     }
 737
 738     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 739 };
 740
 741 my $safe_num_ne = sub {
 742     my ($a, $b) = @_;
 743
 744     return 0 if !defined($a) && !defined($b);
 745     return 1 if !defined($a);
 746     return 1 if !defined($b);
 747
 748     return $a != $b;
 749 };
 750
 751 my $vmconfig_update_disk = sub {
 752     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 753
 754     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 755
 756     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 757         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 758     } else {
 759         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 760     }
 761
 762     if ($conf->{$opt}) {
 763
 764         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 765
 766             my $media = $drive->{media} || 'disk';
 767             my $oldmedia = $old_drive->{media} || 'disk';
 768             die "unable to change media type\n" if $media ne $oldmedia;
 769
 770             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 771                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 772
 773                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 774                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 775             }
 776
 777             if(&$safe_num_ne($drive->{mbps}, $old_drive->{mbps}) ||
 778                &$safe_num_ne($drive->{mbps_rd}, $old_drive->{mbps_rd}) ||
 779                &$safe_num_ne($drive->{mbps_wr}, $old_drive->{mbps_wr}) ||
 780                &$safe_num_ne($drive->{iops}, $old_drive->{iops}) ||
 781                &$safe_num_ne($drive->{iops_rd}, $old_drive->{iops_rd}) ||
 782                &$safe_num_ne($drive->{iops_wr}, $old_drive->{iops_wr}) ||
 783                &$safe_num_ne($drive->{mbps_max}, $old_drive->{mbps_max}) ||
 784                &$safe_num_ne($drive->{mbps_rd_max}, $old_drive->{mbps_rd_max}) ||
 785                &$safe_num_ne($drive->{mbps_wr_max}, $old_drive->{mbps_wr_max}) ||
 786                &$safe_num_ne($drive->{iops_max}, $old_drive->{iops_max}) ||
 787                &$safe_num_ne($drive->{iops_rd_max}, $old_drive->{iops_rd_max}) ||
 788                &$safe_num_ne($drive->{iops_wr_max}, $old_drive->{iops_wr_max})) {
 789                PVE::QemuServer::qemu_block_set_io_throttle($vmid,"drive-$opt",
 790                                                            ($drive->{mbps} || 0)*1024*1024,
 791                                                            ($drive->{mbps_rd} || 0)*1024*1024,
 792                                                            ($drive->{mbps_wr} || 0)*1024*1024,
 793                                                            $drive->{iops} || 0,
 794                                                            $drive->{iops_rd} || 0,
 795                                                            $drive->{iops_wr} || 0,
 796                                                            ($drive->{mbps_max} || 0)*1024*1024,
 797                                                            ($drive->{mbps_rd_max} || 0)*1024*1024,
 798                                                            ($drive->{mbps_wr_max} || 0)*1024*1024,
 799                                                            $drive->{iops_max} || 0,
 800                                                            $drive->{iops_rd_max} || 0,
 801                                                            $drive->{iops_wr_max} || 0)
 802                    if !PVE::QemuServer::drive_is_cdrom($drive);
 803             }
 804         }
 805     }
 806
 807     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 808     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 809
 810     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 811     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 812
 813     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 814
 815         if (PVE::QemuServer::check_running($vmid)) {
 816             if ($drive->{file} eq 'none') {
 817                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt");
 818             } else {
 819                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 820                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt"); #force eject if locked
 821                 PVE::QemuServer::vm_mon_cmd($vmid, "change",device => "drive-$opt",target => "$path") if $path;
 822             }
 823         }
 824
 825     } else { # hotplug new disks
 826
 827         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 828     }
 829 };
 830
 831 my $vmconfig_update_net = sub {
 832     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 833
 834     if ($conf->{$opt} && PVE::QemuServer::check_running($vmid)) {
 835         my $oldnet = PVE::QemuServer::parse_net($conf->{$opt});
 836         my $newnet = PVE::QemuServer::parse_net($value);
 837
 838         if($oldnet->{model} ne $newnet->{model}){
 839             #if model change, we try to hot-unplug
 840             die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 841         }else{
 842
 843             if($newnet->{bridge} && $oldnet->{bridge}){
 844                 my $iface = "tap".$vmid."i".$1 if $opt =~ m/net(\d+)/;
 845
 846                 if($newnet->{rate} ne $oldnet->{rate}){
 847                     PVE::Network::tap_rate_limit($iface, $newnet->{rate});
 848                 }
 849
 850                 if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag}) || ($newnet->{firewall} ne $oldnet->{firewall})){
 851                     PVE::Network::tap_unplug($iface);
 852                     PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag}, $newnet->{firewall});
 853                 }
 854
 855             }else{
 856                 #if bridge/nat mode change, we try to hot-unplug
 857                 die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 858             }
 859         }
 860
 861     }
 862     $conf->{$opt} = $value;
 863     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 864     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 865
 866     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 867
 868     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 869 };
 870
 871 # POST/PUT {vmid}/config implementation
 872 #
 873 # The original API used PUT (idempotent) an we assumed that all operations
 874 # are fast. But it turned out that almost any configuration change can
 875 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 876 # time to complete and have side effects (not idempotent).
 877 #
 878 # The new implementation uses POST and forks a worker process. We added
 879 # a new option 'background_delay'. If specified we wait up to
 880 # 'background_delay' second for the worker task to complete. It returns null
 881 # if the task is finished within that time, else we return the UPID.
 882
 883 my $update_vm_api  = sub {
 884     my ($param, $sync) = @_;
 885
 886     my $rpcenv = PVE::RPCEnvironment::get();
 887
 888     my $authuser = $rpcenv->get_user();
 889
 890     my $node = extract_param($param, 'node');
 891
 892     my $vmid = extract_param($param, 'vmid');
 893
 894     my $digest = extract_param($param, 'digest');
 895
 896     my $background_delay = extract_param($param, 'background_delay');
 897
 898     my @paramarr = (); # used for log message
 899     foreach my $key (keys %$param) {
 900         push @paramarr, "-$key", $param->{$key};
 901     }
 902
 903     my $skiplock = extract_param($param, 'skiplock');
 904     raise_param_exc({ skiplock => "Only root may use this option." })
 905         if $skiplock && $authuser ne 'root@pam';
 906
 907     my $delete_str = extract_param($param, 'delete');
 908
 909     my $force = extract_param($param, 'force');
 910
 911     die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 912
 913     my $storecfg = PVE::Storage::config();
 914
 915     my $defaults = PVE::QemuServer::load_defaults();
 916
 917     &$resolve_cdrom_alias($param);
 918
 919     # now try to verify all parameters
 920
 921     my @delete = ();
 922     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 923         $opt = 'ide2' if $opt eq 'cdrom';
 924         raise_param_exc({ delete => "you can't use '-$opt' and " .
 925                               "-delete $opt' at the same time" })
 926             if defined($param->{$opt});
 927
 928         if (!PVE::QemuServer::option_exists($opt)) {
 929             raise_param_exc({ delete => "unknown option '$opt'" });
 930         }
 931
 932         push @delete, $opt;
 933     }
 934
 935     foreach my $opt (keys %$param) {
 936         if (PVE::QemuServer::valid_drivename($opt)) {
 937             # cleanup drive path
 938             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 939             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 940             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 941         } elsif ($opt =~ m/^net(\d+)$/) {
 942             # add macaddr
 943             my $net = PVE::QemuServer::parse_net($param->{$opt});
 944             $param->{$opt} = PVE::QemuServer::print_net($net);
 945         }
 946     }
 947
 948     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 949
 950     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 951
 952     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 953
 954     my $pending_delete_option = sub {
 955         my ($conf, $key) = @_;
 956
 957         delete $conf->{pending}->{$key};
 958         my $pending_delete_hash = { $key => 1 };
 959         foreach my $opt (PVE::Tools::split_list($conf->{pending}->{delete})) {
 960             $pending_delete_hash->{$opt} = 1;
 961         }
 962         $conf->{pending}->{delete} = join(',', keys %$pending_delete_hash);
 963     };
 964
 965     my $pending_undelete_option = sub {
 966         my ($conf, $key) = @_;
 967
 968         my $pending_delete_hash = {};
 969         foreach my $opt (PVE::Tools::split_list($conf->{pending}->{delete})) {
 970             $pending_delete_hash->{$opt} = 1;
 971         }
 972         delete $pending_delete_hash->{$key};
 973
 974         my @keylist = keys %$pending_delete_hash;
 975         if (scalar(@keylist)) {
 976             $conf->{pending}->{delete} = join(',', @keylist);
 977         } else {
 978             delete $conf->{pending}->{delete};
 979         }
 980     };
 981
 982     my $register_unused_drive = sub {
 983         my ($conf, $drive) = @_;
 984         if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 985             my $volid = $drive->{file};
 986             if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 987                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 988             }
 989         }
 990     };
 991
 992     my $updatefn =  sub {
 993
 994         my $conf = PVE::QemuServer::load_config($vmid);
 995
 996         die "checksum missmatch (file change by other user?)\n"
 997             if $digest && $digest ne $conf->{digest};
 998
 999         PVE::QemuServer::check_lock($conf) if !$skiplock;
1000
1001         # fixme: wrong place? howto handle pending changes? @delete ?
1002         if ($param->{memory} || defined($param->{balloon})) {
1003             my $maxmem = $param->{memory} || $conf->{memory} || $defaults->{memory};
1004             my $balloon = defined($param->{balloon}) ?  $param->{balloon} : $conf->{balloon};
1005
1006             die "balloon value too large (must be smaller than assigned memory)\n"
1007                 if $balloon && $balloon > $maxmem;
1008         }
1009
1010         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1011
1012         my $worker = sub {
1013
1014             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1015
1016             # write updates to pending section
1017
1018             foreach my $opt (@delete) {
1019                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
1020                 if ($opt =~ m/^unused/) {
1021                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1022                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1023                     if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
1024                         $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
1025                         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive);
1026                         PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1027                     }
1028                 } elsif (PVE::QemuServer::valid_drivename($opt)) {
1029                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1030                     &$register_unused_drive($conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1031                         if defined($conf->{pending}->{$opt});
1032                     &$pending_delete_option($conf, $opt);
1033                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1034                 } else {
1035                     &$pending_delete_option($conf, $opt);
1036                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1037                 }
1038             }
1039
1040             foreach my $opt (keys %$param) { # add/change
1041                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
1042                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1043
1044                 if (PVE::QemuServer::valid_drivename($opt)) {
1045                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1046                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1047                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1048                     } else {
1049                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1050                     }
1051                     &$register_unused_drive($conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1052                         if defined($conf->{pending}->{$opt});
1053
1054                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1055                 } else {
1056                     $conf->{pending}->{$opt} = $param->{$opt};
1057                 }
1058                 &$pending_undelete_option($conf, $opt);
1059                 PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1060             }
1061
1062             # remove pending changes when nothing changed
1063             my $changes;
1064             $conf = PVE::QemuServer::load_config($vmid); # update/reload
1065             foreach my $opt (keys %{$conf->{pending}}) { # add/change
1066                 if (defined($conf->{$opt}) && ($conf->{pending}->{$opt} eq  $conf->{$opt})) {
1067                     $changes = 1;
1068                     delete $conf->{pending}->{$opt};
1069                 }
1070             }
1071             PVE::QemuServer::update_config_nolock($vmid, $conf, 1) if $changes;
1072
1073             return if !scalar(keys %{$conf->{pending}});
1074
1075             return; # TODO: apply changes
1076
1077             my $running = PVE::QemuServer::check_running($vmid);
1078
1079             foreach my $opt (keys %$param) { # add/change
1080
1081                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
1082
1083                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
1084
1085                 if (PVE::QemuServer::valid_drivename($opt)) {
1086
1087                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
1088                                            $opt, $param->{$opt}, $force);
1089
1090                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
1091
1092                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
1093                                           $opt, $param->{$opt});
1094
1095                 } else {
1096
1097                     if($opt eq 'tablet' && $param->{$opt} == 1){
1098                         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
1099                     } elsif($opt eq 'tablet' && $param->{$opt} == 0){
1100                         PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
1101                     }
1102
1103                     if($opt eq 'cores' && $conf->{maxcpus}){
1104                         PVE::QemuServer::qemu_cpu_hotplug($vmid, $conf, $param->{$opt});
1105                     }
1106
1107                     $conf->{$opt} = $param->{$opt};
1108                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
1109                 }
1110             }
1111
1112             # allow manual ballooning if shares is set to zero
1113             if ($running && defined($param->{balloon}) &&
1114                 defined($conf->{shares}) && ($conf->{shares} == 0)) {
1115                 my $balloon = $param->{'balloon'} || $conf->{memory} || $defaults->{memory};
1116                 PVE::QemuServer::vm_mon_cmd($vmid, "balloon", value => $balloon*1024*1024);
1117             }
1118         };
1119
1120         if ($sync) {
1121             &$worker();
1122             return undef;
1123         } else {
1124             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1125
1126             if ($background_delay) {
1127
1128                 # Note: It would be better to do that in the Event based HTTPServer
1129                 # to avoid blocking call to sleep.
1130
1131                 my $end_time = time() + $background_delay;
1132
1133                 my $task = PVE::Tools::upid_decode($upid);
1134
1135                 my $running = 1;
1136                 while (time() < $end_time) {
1137                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1138                     last if !$running;
1139                     sleep(1); # this gets interrupted when child process ends
1140                 }
1141
1142                 if (!$running) {
1143                     my $status = PVE::Tools::upid_read_status($upid);
1144                     return undef if $status eq 'OK';
1145                     die $status;
1146                 }
1147             }
1148
1149             return $upid;
1150         }
1151     };
1152
1153     return PVE::QemuServer::lock_config($vmid, $updatefn);
1154 };
1155
1156 my $vm_config_perm_list = [
1157             'VM.Config.Disk',
1158             'VM.Config.CDROM',
1159             'VM.Config.CPU',
1160             'VM.Config.Memory',
1161             'VM.Config.Network',
1162             'VM.Config.HWType',
1163             'VM.Config.Options',
1164     ];
1165
1166 __PACKAGE__->register_method({
1167     name => 'update_vm_async',
1168     path => '{vmid}/config',
1169     method => 'POST',
1170     protected => 1,
1171     proxyto => 'node',
1172     description => "Set virtual machine options (asynchrounous API).",
1173     permissions => {
1174         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1175     },
1176     parameters => {
1177         additionalProperties => 0,
1178         properties => PVE::QemuServer::json_config_properties(
1179             {
1180                 node => get_standard_option('pve-node'),
1181                 vmid => get_standard_option('pve-vmid'),
1182                 skiplock => get_standard_option('skiplock'),
1183                 delete => {
1184                     type => 'string', format => 'pve-configid-list',
1185                     description => "A list of settings you want to delete.",
1186                     optional => 1,
1187                 },
1188                 force => {
1189                     type => 'boolean',
1190                     description => $opt_force_description,
1191                     optional => 1,
1192                     requires => 'delete',
1193                 },
1194                 digest => {
1195                     type => 'string',
1196                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1197                     maxLength => 40,
1198                     optional => 1,
1199                 },
1200                 background_delay => {
1201                     type => 'integer',
1202                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1203                     minimum => 1,
1204                     maximum => 30,
1205                     optional => 1,
1206                 },
1207             }),
1208     },
1209     returns => {
1210         type => 'string',
1211         optional => 1,
1212     },
1213     code => $update_vm_api,
1214 });
1215
1216 __PACKAGE__->register_method({
1217     name => 'update_vm',
1218     path => '{vmid}/config',
1219     method => 'PUT',
1220     protected => 1,
1221     proxyto => 'node',
1222     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1223     permissions => {
1224         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1225     },
1226     parameters => {
1227         additionalProperties => 0,
1228         properties => PVE::QemuServer::json_config_properties(
1229             {
1230                 node => get_standard_option('pve-node'),
1231                 vmid => get_standard_option('pve-vmid'),
1232                 skiplock => get_standard_option('skiplock'),
1233                 delete => {
1234                     type => 'string', format => 'pve-configid-list',
1235                     description => "A list of settings you want to delete.",
1236                     optional => 1,
1237                 },
1238                 force => {
1239                     type => 'boolean',
1240                     description => $opt_force_description,
1241                     optional => 1,
1242                     requires => 'delete',
1243                 },
1244                 digest => {
1245                     type => 'string',
1246                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1247                     maxLength => 40,
1248                     optional => 1,
1249                 },
1250             }),
1251     },
1252     returns => { type => 'null' },
1253     code => sub {
1254         my ($param) = @_;
1255         &$update_vm_api($param, 1);
1256         return undef;
1257     }
1258 });
1259
1260
1261 __PACKAGE__->register_method({
1262     name => 'destroy_vm',
1263     path => '{vmid}',
1264     method => 'DELETE',
1265     protected => 1,
1266     proxyto => 'node',
1267     description => "Destroy the vm (also delete all used/owned volumes).",
1268     permissions => {
1269         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1270     },
1271     parameters => {
1272         additionalProperties => 0,
1273         properties => {
1274             node => get_standard_option('pve-node'),
1275             vmid => get_standard_option('pve-vmid'),
1276             skiplock => get_standard_option('skiplock'),
1277         },
1278     },
1279     returns => {
1280         type => 'string',
1281     },
1282     code => sub {
1283         my ($param) = @_;
1284
1285         my $rpcenv = PVE::RPCEnvironment::get();
1286
1287         my $authuser = $rpcenv->get_user();
1288
1289         my $vmid = $param->{vmid};
1290
1291         my $skiplock = $param->{skiplock};
1292         raise_param_exc({ skiplock => "Only root may use this option." })
1293             if $skiplock && $authuser ne 'root@pam';
1294
1295         # test if VM exists
1296         my $conf = PVE::QemuServer::load_config($vmid);
1297
1298         my $storecfg = PVE::Storage::config();
1299
1300         my $delVMfromPoolFn = sub {
1301             my $usercfg = cfs_read_file("user.cfg");
1302             if (my $pool = $usercfg->{vms}->{$vmid}) {
1303                 if (my $data = $usercfg->{pools}->{$pool}) {
1304                     delete $data->{vms}->{$vmid};
1305                     delete $usercfg->{vms}->{$vmid};
1306                     cfs_write_file("user.cfg", $usercfg);
1307                 }
1308             }
1309         };
1310
1311         my $realcmd = sub {
1312             my $upid = shift;
1313
1314             syslog('info', "destroy VM $vmid: $upid\n");
1315
1316             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1317
1318             PVE::AccessControl::remove_vm_from_pool($vmid);
1319         };
1320
1321         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1322     }});
1323
1324 __PACKAGE__->register_method({
1325     name => 'unlink',
1326     path => '{vmid}/unlink',
1327     method => 'PUT',
1328     protected => 1,
1329     proxyto => 'node',
1330     description => "Unlink/delete disk images.",
1331     permissions => {
1332         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1333     },
1334     parameters => {
1335         additionalProperties => 0,
1336         properties => {
1337             node => get_standard_option('pve-node'),
1338             vmid => get_standard_option('pve-vmid'),
1339             idlist => {
1340                 type => 'string', format => 'pve-configid-list',
1341                 description => "A list of disk IDs you want to delete.",
1342             },
1343             force => {
1344                 type => 'boolean',
1345                 description => $opt_force_description,
1346                 optional => 1,
1347             },
1348         },
1349     },
1350     returns => { type => 'null'},
1351     code => sub {
1352         my ($param) = @_;
1353
1354         $param->{delete} = extract_param($param, 'idlist');
1355
1356         __PACKAGE__->update_vm($param);
1357
1358         return undef;
1359     }});
1360
1361 my $sslcert;
1362
1363 __PACKAGE__->register_method({
1364     name => 'vncproxy',
1365     path => '{vmid}/vncproxy',
1366     method => 'POST',
1367     protected => 1,
1368     permissions => {
1369         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1370     },
1371     description => "Creates a TCP VNC proxy connections.",
1372     parameters => {
1373         additionalProperties => 0,
1374         properties => {
1375             node => get_standard_option('pve-node'),
1376             vmid => get_standard_option('pve-vmid'),
1377             websocket => {
1378                 optional => 1,
1379                 type => 'boolean',
1380                 description => "starts websockify instead of vncproxy",
1381             },
1382         },
1383     },
1384     returns => {
1385         additionalProperties => 0,
1386         properties => {
1387             user => { type => 'string' },
1388             ticket => { type => 'string' },
1389             cert => { type => 'string' },
1390             port => { type => 'integer' },
1391             upid => { type => 'string' },
1392         },
1393     },
1394     code => sub {
1395         my ($param) = @_;
1396
1397         my $rpcenv = PVE::RPCEnvironment::get();
1398
1399         my $authuser = $rpcenv->get_user();
1400
1401         my $vmid = $param->{vmid};
1402         my $node = $param->{node};
1403         my $websocket = $param->{websocket};
1404
1405         my $conf = PVE::QemuServer::load_config($vmid, $node); # check if VM exists
1406
1407         my $authpath = "/vms/$vmid";
1408
1409         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1410
1411         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1412             if !$sslcert;
1413
1414         my $port = PVE::Tools::next_vnc_port();
1415
1416         my $remip;
1417         my $remcmd = [];
1418
1419         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1420             $remip = PVE::Cluster::remote_node_ip($node);
1421             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1422             $remcmd = ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes', $remip];
1423         }
1424
1425         my $timeout = 10;
1426
1427         my $realcmd = sub {
1428             my $upid = shift;
1429
1430             syslog('info', "starting vnc proxy $upid\n");
1431
1432             my $cmd;
1433
1434             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1435
1436                 die "Websocket mode is not supported in vga serial mode!" if $websocket;
1437
1438                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga} ];
1439                 #my $termcmd = "/usr/bin/qm terminal -iface $conf->{vga}";
1440                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1441                         '-timeout', $timeout, '-authpath', $authpath,
1442                         '-perm', 'Sys.Console', '-c', @$remcmd, @$termcmd];
1443             } else {
1444
1445                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1446
1447                 my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1448
1449                 my $qmstr = join(' ', @$qmcmd);
1450
1451                 # also redirect stderr (else we get RFB protocol errors)
1452                 $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1453             }
1454
1455             PVE::Tools::run_command($cmd);
1456
1457             return;
1458         };
1459
1460         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1461
1462         PVE::Tools::wait_for_vnc_port($port);
1463
1464         return {
1465             user => $authuser,
1466             ticket => $ticket,
1467             port => $port,
1468             upid => $upid,
1469             cert => $sslcert,
1470         };
1471     }});
1472
1473 __PACKAGE__->register_method({
1474     name => 'vncwebsocket',
1475     path => '{vmid}/vncwebsocket',
1476     method => 'GET',
1477     permissions => {
1478         description => "You also need to pass a valid ticket (vncticket).",
1479         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1480     },
1481     description => "Opens a weksocket for VNC traffic.",
1482     parameters => {
1483         additionalProperties => 0,
1484         properties => {
1485             node => get_standard_option('pve-node'),
1486             vmid => get_standard_option('pve-vmid'),
1487             vncticket => {
1488                 description => "Ticket from previous call to vncproxy.",
1489                 type => 'string',
1490                 maxLength => 512,
1491             },
1492             port => {
1493                 description => "Port number returned by previous vncproxy call.",
1494                 type => 'integer',
1495                 minimum => 5900,
1496                 maximum => 5999,
1497             },
1498         },
1499     },
1500     returns => {
1501         type => "object",
1502         properties => {
1503             port => { type => 'string' },
1504         },
1505     },
1506     code => sub {
1507         my ($param) = @_;
1508
1509         my $rpcenv = PVE::RPCEnvironment::get();
1510
1511         my $authuser = $rpcenv->get_user();
1512
1513         my $vmid = $param->{vmid};
1514         my $node = $param->{node};
1515
1516         my $authpath = "/vms/$vmid";
1517
1518         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1519
1520         my $conf = PVE::QemuServer::load_config($vmid, $node); # VM exists ?
1521
1522         # Note: VNC ports are acessible from outside, so we do not gain any
1523         # security if we verify that $param->{port} belongs to VM $vmid. This
1524         # check is done by verifying the VNC ticket (inside VNC protocol).
1525
1526         my $port = $param->{port};
1527
1528         return { port => $port };
1529     }});
1530
1531 __PACKAGE__->register_method({
1532     name => 'spiceproxy',
1533     path => '{vmid}/spiceproxy',
1534     method => 'POST',
1535     protected => 1,
1536     proxyto => 'node',
1537     permissions => {
1538         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1539     },
1540     description => "Returns a SPICE configuration to connect to the VM.",
1541     parameters => {
1542         additionalProperties => 0,
1543         properties => {
1544             node => get_standard_option('pve-node'),
1545             vmid => get_standard_option('pve-vmid'),
1546             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1547         },
1548     },
1549     returns => get_standard_option('remote-viewer-config'),
1550     code => sub {
1551         my ($param) = @_;
1552
1553         my $rpcenv = PVE::RPCEnvironment::get();
1554
1555         my $authuser = $rpcenv->get_user();
1556
1557         my $vmid = $param->{vmid};
1558         my $node = $param->{node};
1559         my $proxy = $param->{proxy};
1560
1561         my $conf = PVE::QemuServer::load_config($vmid, $node);
1562         my $title = "VM $vmid - $conf->{'name'}",
1563
1564         my $port = PVE::QemuServer::spice_port($vmid);
1565
1566         my ($ticket, undef, $remote_viewer_config) =
1567             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1568
1569         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1570         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1571
1572         return $remote_viewer_config;
1573     }});
1574
1575 __PACKAGE__->register_method({
1576     name => 'vmcmdidx',
1577     path => '{vmid}/status',
1578     method => 'GET',
1579     proxyto => 'node',
1580     description => "Directory index",
1581     permissions => {
1582         user => 'all',
1583     },
1584     parameters => {
1585         additionalProperties => 0,
1586         properties => {
1587             node => get_standard_option('pve-node'),
1588             vmid => get_standard_option('pve-vmid'),
1589         },
1590     },
1591     returns => {
1592         type => 'array',
1593         items => {
1594             type => "object",
1595             properties => {
1596                 subdir => { type => 'string' },
1597             },
1598         },
1599         links => [ { rel => 'child', href => "{subdir}" } ],
1600     },
1601     code => sub {
1602         my ($param) = @_;
1603
1604         # test if VM exists
1605         my $conf = PVE::QemuServer::load_config($param->{vmid});
1606
1607         my $res = [
1608             { subdir => 'current' },
1609             { subdir => 'start' },
1610             { subdir => 'stop' },
1611             ];
1612
1613         return $res;
1614     }});
1615
1616 my $vm_is_ha_managed = sub {
1617     my ($vmid) = @_;
1618
1619     my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1620     if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $vmid, 1)) {
1621         return 1;
1622     }
1623     return 0;
1624 };
1625
1626 __PACKAGE__->register_method({
1627     name => 'vm_status',
1628     path => '{vmid}/status/current',
1629     method => 'GET',
1630     proxyto => 'node',
1631     protected => 1, # qemu pid files are only readable by root
1632     description => "Get virtual machine status.",
1633     permissions => {
1634         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1635     },
1636     parameters => {
1637         additionalProperties => 0,
1638         properties => {
1639             node => get_standard_option('pve-node'),
1640             vmid => get_standard_option('pve-vmid'),
1641         },
1642     },
1643     returns => { type => 'object' },
1644     code => sub {
1645         my ($param) = @_;
1646
1647         # test if VM exists
1648         my $conf = PVE::QemuServer::load_config($param->{vmid});
1649
1650         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1651         my $status = $vmstatus->{$param->{vmid}};
1652
1653         $status->{ha} = &$vm_is_ha_managed($param->{vmid});
1654
1655         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1656
1657         return $status;
1658     }});
1659
1660 __PACKAGE__->register_method({
1661     name => 'vm_start',
1662     path => '{vmid}/status/start',
1663     method => 'POST',
1664     protected => 1,
1665     proxyto => 'node',
1666     description => "Start virtual machine.",
1667     permissions => {
1668         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1669     },
1670     parameters => {
1671         additionalProperties => 0,
1672         properties => {
1673             node => get_standard_option('pve-node'),
1674             vmid => get_standard_option('pve-vmid'),
1675             skiplock => get_standard_option('skiplock'),
1676             stateuri => get_standard_option('pve-qm-stateuri'),
1677             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1678             machine => get_standard_option('pve-qm-machine'),
1679         },
1680     },
1681     returns => {
1682         type => 'string',
1683     },
1684     code => sub {
1685         my ($param) = @_;
1686
1687         my $rpcenv = PVE::RPCEnvironment::get();
1688
1689         my $authuser = $rpcenv->get_user();
1690
1691         my $node = extract_param($param, 'node');
1692
1693         my $vmid = extract_param($param, 'vmid');
1694
1695         my $machine = extract_param($param, 'machine');
1696
1697         my $stateuri = extract_param($param, 'stateuri');
1698         raise_param_exc({ stateuri => "Only root may use this option." })
1699             if $stateuri && $authuser ne 'root@pam';
1700
1701         my $skiplock = extract_param($param, 'skiplock');
1702         raise_param_exc({ skiplock => "Only root may use this option." })
1703             if $skiplock && $authuser ne 'root@pam';
1704
1705         my $migratedfrom = extract_param($param, 'migratedfrom');
1706         raise_param_exc({ migratedfrom => "Only root may use this option." })
1707             if $migratedfrom && $authuser ne 'root@pam';
1708
1709         # read spice ticket from STDIN
1710         my $spice_ticket;
1711         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1712             if (defined(my $line = <>)) {
1713                 chomp $line;
1714                 $spice_ticket = $line;
1715             }
1716         }
1717
1718         my $storecfg = PVE::Storage::config();
1719
1720         if (&$vm_is_ha_managed($vmid) && !$stateuri &&
1721             $rpcenv->{type} ne 'ha') {
1722
1723             my $hacmd = sub {
1724                 my $upid = shift;
1725
1726                 my $service = "pvevm:$vmid";
1727
1728                 my $cmd = ['clusvcadm', '-e', $service, '-m', $node];
1729
1730                 print "Executing HA start for VM $vmid\n";
1731
1732                 PVE::Tools::run_command($cmd);
1733
1734                 return;
1735             };
1736
1737             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1738
1739         } else {
1740
1741             my $realcmd = sub {
1742                 my $upid = shift;
1743
1744                 syslog('info', "start VM $vmid: $upid\n");
1745
1746                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1747                                           $machine, $spice_ticket);
1748
1749                 return;
1750             };
1751
1752             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1753         }
1754     }});
1755
1756 __PACKAGE__->register_method({
1757     name => 'vm_stop',
1758     path => '{vmid}/status/stop',
1759     method => 'POST',
1760     protected => 1,
1761     proxyto => 'node',
1762     description => "Stop virtual machine.",
1763     permissions => {
1764         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1765     },
1766     parameters => {
1767         additionalProperties => 0,
1768         properties => {
1769             node => get_standard_option('pve-node'),
1770             vmid => get_standard_option('pve-vmid'),
1771             skiplock => get_standard_option('skiplock'),
1772             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1773             timeout => {
1774                 description => "Wait maximal timeout seconds.",
1775                 type => 'integer',
1776                 minimum => 0,
1777                 optional => 1,
1778             },
1779             keepActive => {
1780                 description => "Do not decativate storage volumes.",
1781                 type => 'boolean',
1782                 optional => 1,
1783                 default => 0,
1784             }
1785         },
1786     },
1787     returns => {
1788         type => 'string',
1789     },
1790     code => sub {
1791         my ($param) = @_;
1792
1793         my $rpcenv = PVE::RPCEnvironment::get();
1794
1795         my $authuser = $rpcenv->get_user();
1796
1797         my $node = extract_param($param, 'node');
1798
1799         my $vmid = extract_param($param, 'vmid');
1800
1801         my $skiplock = extract_param($param, 'skiplock');
1802         raise_param_exc({ skiplock => "Only root may use this option." })
1803             if $skiplock && $authuser ne 'root@pam';
1804
1805         my $keepActive = extract_param($param, 'keepActive');
1806         raise_param_exc({ keepActive => "Only root may use this option." })
1807             if $keepActive && $authuser ne 'root@pam';
1808
1809         my $migratedfrom = extract_param($param, 'migratedfrom');
1810         raise_param_exc({ migratedfrom => "Only root may use this option." })
1811             if $migratedfrom && $authuser ne 'root@pam';
1812
1813
1814         my $storecfg = PVE::Storage::config();
1815
1816         if (&$vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
1817
1818             my $hacmd = sub {
1819                 my $upid = shift;
1820
1821                 my $service = "pvevm:$vmid";
1822
1823                 my $cmd = ['clusvcadm', '-d', $service];
1824
1825                 print "Executing HA stop for VM $vmid\n";
1826
1827                 PVE::Tools::run_command($cmd);
1828
1829                 return;
1830             };
1831
1832             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1833
1834         } else {
1835             my $realcmd = sub {
1836                 my $upid = shift;
1837
1838                 syslog('info', "stop VM $vmid: $upid\n");
1839
1840                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1841                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1842
1843                 return;
1844             };
1845
1846             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1847         }
1848     }});
1849
1850 __PACKAGE__->register_method({
1851     name => 'vm_reset',
1852     path => '{vmid}/status/reset',
1853     method => 'POST',
1854     protected => 1,
1855     proxyto => 'node',
1856     description => "Reset virtual machine.",
1857     permissions => {
1858         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1859     },
1860     parameters => {
1861         additionalProperties => 0,
1862         properties => {
1863             node => get_standard_option('pve-node'),
1864             vmid => get_standard_option('pve-vmid'),
1865             skiplock => get_standard_option('skiplock'),
1866         },
1867     },
1868     returns => {
1869         type => 'string',
1870     },
1871     code => sub {
1872         my ($param) = @_;
1873
1874         my $rpcenv = PVE::RPCEnvironment::get();
1875
1876         my $authuser = $rpcenv->get_user();
1877
1878         my $node = extract_param($param, 'node');
1879
1880         my $vmid = extract_param($param, 'vmid');
1881
1882         my $skiplock = extract_param($param, 'skiplock');
1883         raise_param_exc({ skiplock => "Only root may use this option." })
1884             if $skiplock && $authuser ne 'root@pam';
1885
1886         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1887
1888         my $realcmd = sub {
1889             my $upid = shift;
1890
1891             PVE::QemuServer::vm_reset($vmid, $skiplock);
1892
1893             return;
1894         };
1895
1896         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1897     }});
1898
1899 __PACKAGE__->register_method({
1900     name => 'vm_shutdown',
1901     path => '{vmid}/status/shutdown',
1902     method => 'POST',
1903     protected => 1,
1904     proxyto => 'node',
1905     description => "Shutdown virtual machine.",
1906     permissions => {
1907         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1908     },
1909     parameters => {
1910         additionalProperties => 0,
1911         properties => {
1912             node => get_standard_option('pve-node'),
1913             vmid => get_standard_option('pve-vmid'),
1914             skiplock => get_standard_option('skiplock'),
1915             timeout => {
1916                 description => "Wait maximal timeout seconds.",
1917                 type => 'integer',
1918                 minimum => 0,
1919                 optional => 1,
1920             },
1921             forceStop => {
1922                 description => "Make sure the VM stops.",
1923                 type => 'boolean',
1924                 optional => 1,
1925                 default => 0,
1926             },
1927             keepActive => {
1928                 description => "Do not decativate storage volumes.",
1929                 type => 'boolean',
1930                 optional => 1,
1931                 default => 0,
1932             }
1933         },
1934     },
1935     returns => {
1936         type => 'string',
1937     },
1938     code => sub {
1939         my ($param) = @_;
1940
1941         my $rpcenv = PVE::RPCEnvironment::get();
1942
1943         my $authuser = $rpcenv->get_user();
1944
1945         my $node = extract_param($param, 'node');
1946
1947         my $vmid = extract_param($param, 'vmid');
1948
1949         my $skiplock = extract_param($param, 'skiplock');
1950         raise_param_exc({ skiplock => "Only root may use this option." })
1951             if $skiplock && $authuser ne 'root@pam';
1952
1953         my $keepActive = extract_param($param, 'keepActive');
1954         raise_param_exc({ keepActive => "Only root may use this option." })
1955             if $keepActive && $authuser ne 'root@pam';
1956
1957         my $storecfg = PVE::Storage::config();
1958
1959         my $realcmd = sub {
1960             my $upid = shift;
1961
1962             syslog('info', "shutdown VM $vmid: $upid\n");
1963
1964             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1965                                      1, $param->{forceStop}, $keepActive);
1966
1967             return;
1968         };
1969
1970         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1971     }});
1972
1973 __PACKAGE__->register_method({
1974     name => 'vm_suspend',
1975     path => '{vmid}/status/suspend',
1976     method => 'POST',
1977     protected => 1,
1978     proxyto => 'node',
1979     description => "Suspend virtual machine.",
1980     permissions => {
1981         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1982     },
1983     parameters => {
1984         additionalProperties => 0,
1985         properties => {
1986             node => get_standard_option('pve-node'),
1987             vmid => get_standard_option('pve-vmid'),
1988             skiplock => get_standard_option('skiplock'),
1989         },
1990     },
1991     returns => {
1992         type => 'string',
1993     },
1994     code => sub {
1995         my ($param) = @_;
1996
1997         my $rpcenv = PVE::RPCEnvironment::get();
1998
1999         my $authuser = $rpcenv->get_user();
2000
2001         my $node = extract_param($param, 'node');
2002
2003         my $vmid = extract_param($param, 'vmid');
2004
2005         my $skiplock = extract_param($param, 'skiplock');
2006         raise_param_exc({ skiplock => "Only root may use this option." })
2007             if $skiplock && $authuser ne 'root@pam';
2008
2009         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2010
2011         my $realcmd = sub {
2012             my $upid = shift;
2013
2014             syslog('info', "suspend VM $vmid: $upid\n");
2015
2016             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2017
2018             return;
2019         };
2020
2021         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2022     }});
2023
2024 __PACKAGE__->register_method({
2025     name => 'vm_resume',
2026     path => '{vmid}/status/resume',
2027     method => 'POST',
2028     protected => 1,
2029     proxyto => 'node',
2030     description => "Resume virtual machine.",
2031     permissions => {
2032         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2033     },
2034     parameters => {
2035         additionalProperties => 0,
2036         properties => {
2037             node => get_standard_option('pve-node'),
2038             vmid => get_standard_option('pve-vmid'),
2039             skiplock => get_standard_option('skiplock'),
2040         },
2041     },
2042     returns => {
2043         type => 'string',
2044     },
2045     code => sub {
2046         my ($param) = @_;
2047
2048         my $rpcenv = PVE::RPCEnvironment::get();
2049
2050         my $authuser = $rpcenv->get_user();
2051
2052         my $node = extract_param($param, 'node');
2053
2054         my $vmid = extract_param($param, 'vmid');
2055
2056         my $skiplock = extract_param($param, 'skiplock');
2057         raise_param_exc({ skiplock => "Only root may use this option." })
2058             if $skiplock && $authuser ne 'root@pam';
2059
2060         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2061
2062         my $realcmd = sub {
2063             my $upid = shift;
2064
2065             syslog('info', "resume VM $vmid: $upid\n");
2066
2067             PVE::QemuServer::vm_resume($vmid, $skiplock);
2068
2069             return;
2070         };
2071
2072         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2073     }});
2074
2075 __PACKAGE__->register_method({
2076     name => 'vm_sendkey',
2077     path => '{vmid}/sendkey',
2078     method => 'PUT',
2079     protected => 1,
2080     proxyto => 'node',
2081     description => "Send key event to virtual machine.",
2082     permissions => {
2083         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2084     },
2085     parameters => {
2086         additionalProperties => 0,
2087         properties => {
2088             node => get_standard_option('pve-node'),
2089             vmid => get_standard_option('pve-vmid'),
2090             skiplock => get_standard_option('skiplock'),
2091             key => {
2092                 description => "The key (qemu monitor encoding).",
2093                 type => 'string'
2094             }
2095         },
2096     },
2097     returns => { type => 'null'},
2098     code => sub {
2099         my ($param) = @_;
2100
2101         my $rpcenv = PVE::RPCEnvironment::get();
2102
2103         my $authuser = $rpcenv->get_user();
2104
2105         my $node = extract_param($param, 'node');
2106
2107         my $vmid = extract_param($param, 'vmid');
2108
2109         my $skiplock = extract_param($param, 'skiplock');
2110         raise_param_exc({ skiplock => "Only root may use this option." })
2111             if $skiplock && $authuser ne 'root@pam';
2112
2113         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2114
2115         return;
2116     }});
2117
2118 __PACKAGE__->register_method({
2119     name => 'vm_feature',
2120     path => '{vmid}/feature',
2121     method => 'GET',
2122     proxyto => 'node',
2123     protected => 1,
2124     description => "Check if feature for virtual machine is available.",
2125     permissions => {
2126         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2127     },
2128     parameters => {
2129         additionalProperties => 0,
2130         properties => {
2131             node => get_standard_option('pve-node'),
2132             vmid => get_standard_option('pve-vmid'),
2133             feature => {
2134                 description => "Feature to check.",
2135                 type => 'string',
2136                 enum => [ 'snapshot', 'clone', 'copy' ],
2137             },
2138             snapname => get_standard_option('pve-snapshot-name', {
2139                 optional => 1,
2140             }),
2141         },
2142     },
2143     returns => {
2144         type => "object",
2145         properties => {
2146             hasFeature => { type => 'boolean' },
2147             nodes => {
2148                 type => 'array',
2149                 items => { type => 'string' },
2150             }
2151         },
2152     },
2153     code => sub {
2154         my ($param) = @_;
2155
2156         my $node = extract_param($param, 'node');
2157
2158         my $vmid = extract_param($param, 'vmid');
2159
2160         my $snapname = extract_param($param, 'snapname');
2161
2162         my $feature = extract_param($param, 'feature');
2163
2164         my $running = PVE::QemuServer::check_running($vmid);
2165
2166         my $conf = PVE::QemuServer::load_config($vmid);
2167
2168         if($snapname){
2169             my $snap = $conf->{snapshots}->{$snapname};
2170             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2171             $conf = $snap;
2172         }
2173         my $storecfg = PVE::Storage::config();
2174
2175         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2176         my $hasFeature = PVE::QemuServer::has_feature($feature, $conf, $storecfg, $snapname, $running);
2177
2178         return {
2179             hasFeature => $hasFeature,
2180             nodes => [ keys %$nodelist ],
2181         };
2182     }});
2183
2184 __PACKAGE__->register_method({
2185     name => 'clone_vm',
2186     path => '{vmid}/clone',
2187     method => 'POST',
2188     protected => 1,
2189     proxyto => 'node',
2190     description => "Create a copy of virtual machine/template.",
2191     permissions => {
2192         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2193             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2194             "'Datastore.AllocateSpace' on any used storage.",
2195         check =>
2196         [ 'and',
2197           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2198           [ 'or',
2199             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2200             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2201           ],
2202         ]
2203     },
2204     parameters => {
2205         additionalProperties => 0,
2206         properties => {
2207             node => get_standard_option('pve-node'),
2208             vmid => get_standard_option('pve-vmid'),
2209             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2210             name => {
2211                 optional => 1,
2212                 type => 'string', format => 'dns-name',
2213                 description => "Set a name for the new VM.",
2214             },
2215             description => {
2216                 optional => 1,
2217                 type => 'string',
2218                 description => "Description for the new VM.",
2219             },
2220             pool => {
2221                 optional => 1,
2222                 type => 'string', format => 'pve-poolid',
2223                 description => "Add the new VM to the specified pool.",
2224             },
2225             snapname => get_standard_option('pve-snapshot-name', {
2226                 optional => 1,
2227             }),
2228             storage => get_standard_option('pve-storage-id', {
2229                 description => "Target storage for full clone.",
2230                 requires => 'full',
2231                 optional => 1,
2232             }),
2233             'format' => {
2234                 description => "Target format for file storage.",
2235                 requires => 'full',
2236                 type => 'string',
2237                 optional => 1,
2238                 enum => [ 'raw', 'qcow2', 'vmdk'],
2239             },
2240             full => {
2241                 optional => 1,
2242                 type => 'boolean',
2243                 description => "Create a full copy of all disk. This is always done when " .
2244                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2245                 default => 0,
2246             },
2247             target => get_standard_option('pve-node', {
2248                 description => "Target node. Only allowed if the original VM is on shared storage.",
2249                 optional => 1,
2250             }),
2251         },
2252     },
2253     returns => {
2254         type => 'string',
2255     },
2256     code => sub {
2257         my ($param) = @_;
2258
2259         my $rpcenv = PVE::RPCEnvironment::get();
2260
2261         my $authuser = $rpcenv->get_user();
2262
2263         my $node = extract_param($param, 'node');
2264
2265         my $vmid = extract_param($param, 'vmid');
2266
2267         my $newid = extract_param($param, 'newid');
2268
2269         my $pool = extract_param($param, 'pool');
2270
2271         if (defined($pool)) {
2272             $rpcenv->check_pool_exist($pool);
2273         }
2274
2275         my $snapname = extract_param($param, 'snapname');
2276
2277         my $storage = extract_param($param, 'storage');
2278
2279         my $format = extract_param($param, 'format');
2280
2281         my $target = extract_param($param, 'target');
2282
2283         my $localnode = PVE::INotify::nodename();
2284
2285         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2286
2287         PVE::Cluster::check_node_exists($target) if $target;
2288
2289         my $storecfg = PVE::Storage::config();
2290
2291         if ($storage) {
2292             # check if storage is enabled on local node
2293             PVE::Storage::storage_check_enabled($storecfg, $storage);
2294             if ($target) {
2295                 # check if storage is available on target node
2296                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2297                 # clone only works if target storage is shared
2298                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2299                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2300             }
2301         }
2302
2303         PVE::Cluster::check_cfs_quorum();
2304
2305         my $running = PVE::QemuServer::check_running($vmid) || 0;
2306
2307         # exclusive lock if VM is running - else shared lock is enough;
2308         my $shared_lock = $running ? 0 : 1;
2309
2310         my $clonefn = sub {
2311
2312             # do all tests after lock
2313             # we also try to do all tests before we fork the worker
2314
2315             my $conf = PVE::QemuServer::load_config($vmid);
2316
2317             PVE::QemuServer::check_lock($conf);
2318
2319             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2320
2321             die "unexpected state change\n" if $verify_running != $running;
2322
2323             die "snapshot '$snapname' does not exist\n"
2324                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2325
2326             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2327
2328             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2329
2330             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2331
2332             my $conffile = PVE::QemuServer::config_file($newid);
2333
2334             die "unable to create VM $newid: config file already exists\n"
2335                 if -f $conffile;
2336
2337             my $newconf = { lock => 'clone' };
2338             my $drives = {};
2339             my $vollist = [];
2340
2341             foreach my $opt (keys %$oldconf) {
2342                 my $value = $oldconf->{$opt};
2343
2344                 # do not copy snapshot related info
2345                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2346                     $opt eq 'vmstate' || $opt eq 'snapstate';
2347
2348                 # always change MAC! address
2349                 if ($opt =~ m/^net(\d+)$/) {
2350                     my $net = PVE::QemuServer::parse_net($value);
2351                     $net->{macaddr} =  PVE::Tools::random_ether_addr();
2352                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2353                 } elsif (PVE::QemuServer::valid_drivename($opt)) {
2354                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2355                     die "unable to parse drive options for '$opt'\n" if !$drive;
2356                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2357                         $newconf->{$opt} = $value; # simply copy configuration
2358                     } else {
2359                         if ($param->{full}) {
2360                             die "Full clone feature is not available"
2361                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2362                             $drive->{full} = 1;
2363                         } else {
2364                             # not full means clone instead of copy
2365                             die "Linked clone feature is not available"
2366                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2367                         }
2368                         $drives->{$opt} = $drive;
2369                         push @$vollist, $drive->{file};
2370                     }
2371                 } else {
2372                     # copy everything else
2373                     $newconf->{$opt} = $value;
2374                 }
2375             }
2376
2377             # auto generate a new uuid
2378             my ($uuid, $uuid_str);
2379             UUID::generate($uuid);
2380             UUID::unparse($uuid, $uuid_str);
2381             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2382             $smbios1->{uuid} = $uuid_str;
2383             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2384
2385             delete $newconf->{template};
2386
2387             if ($param->{name}) {
2388                 $newconf->{name} = $param->{name};
2389             } else {
2390                 if ($oldconf->{name}) {
2391                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2392                 } else {
2393                     $newconf->{name} = "Copy-of-VM-$vmid";
2394                 }
2395             }
2396
2397             if ($param->{description}) {
2398                 $newconf->{description} = $param->{description};
2399             }
2400
2401             # create empty/temp config - this fails if VM already exists on other node
2402             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2403
2404             my $realcmd = sub {
2405                 my $upid = shift;
2406
2407                 my $newvollist = [];
2408
2409                 eval {
2410                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2411
2412                     PVE::Storage::activate_volumes($storecfg, $vollist);
2413
2414                     foreach my $opt (keys %$drives) {
2415                         my $drive = $drives->{$opt};
2416
2417                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2418                                                                    $newid, $storage, $format, $drive->{full}, $newvollist);
2419
2420                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2421
2422                         PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2423                     }
2424
2425                     delete $newconf->{lock};
2426                     PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2427
2428                     if ($target) {
2429                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2430                         PVE::Storage::deactivate_volumes($storecfg, $vollist);
2431
2432                         my $newconffile = PVE::QemuServer::config_file($newid, $target);
2433                         die "Failed to move config to node '$target' - rename failed: $!\n"
2434                             if !rename($conffile, $newconffile);
2435                     }
2436
2437                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2438                 };
2439                 if (my $err = $@) {
2440                     unlink $conffile;
2441
2442                     sleep 1; # some storage like rbd need to wait before release volume - really?
2443
2444                     foreach my $volid (@$newvollist) {
2445                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2446                         warn $@ if $@;
2447                     }
2448                     die "clone failed: $err";
2449                 }
2450
2451                 return;
2452             };
2453
2454             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2455         };
2456
2457         return PVE::QemuServer::lock_config_mode($vmid, 1, $shared_lock, sub {
2458             # Aquire exclusive lock lock for $newid
2459             return PVE::QemuServer::lock_config_full($newid, 1, $clonefn);
2460         });
2461
2462     }});
2463
2464 __PACKAGE__->register_method({
2465     name => 'move_vm_disk',
2466     path => '{vmid}/move_disk',
2467     method => 'POST',
2468     protected => 1,
2469     proxyto => 'node',
2470     description => "Move volume to different storage.",
2471     permissions => {
2472         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
2473             "and 'Datastore.AllocateSpace' permissions on the storage.",
2474         check =>
2475         [ 'and',
2476           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2477           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2478         ],
2479     },
2480     parameters => {
2481         additionalProperties => 0,
2482         properties => {
2483             node => get_standard_option('pve-node'),
2484             vmid => get_standard_option('pve-vmid'),
2485             disk => {
2486                 type => 'string',
2487                 description => "The disk you want to move.",
2488                 enum => [ PVE::QemuServer::disknames() ],
2489             },
2490             storage => get_standard_option('pve-storage-id', { description => "Target Storage." }),
2491             'format' => {
2492                 type => 'string',
2493                 description => "Target Format.",
2494                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2495                 optional => 1,
2496             },
2497             delete => {
2498                 type => 'boolean',
2499                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2500                 optional => 1,
2501                 default => 0,
2502             },
2503             digest => {
2504                 type => 'string',
2505                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2506                 maxLength => 40,
2507                 optional => 1,
2508             },
2509         },
2510     },
2511     returns => {
2512         type => 'string',
2513         description => "the task ID.",
2514     },
2515     code => sub {
2516         my ($param) = @_;
2517
2518         my $rpcenv = PVE::RPCEnvironment::get();
2519
2520         my $authuser = $rpcenv->get_user();
2521
2522         my $node = extract_param($param, 'node');
2523
2524         my $vmid = extract_param($param, 'vmid');
2525
2526         my $digest = extract_param($param, 'digest');
2527
2528         my $disk = extract_param($param, 'disk');
2529
2530         my $storeid = extract_param($param, 'storage');
2531
2532         my $format = extract_param($param, 'format');
2533
2534         my $storecfg = PVE::Storage::config();
2535
2536         my $updatefn =  sub {
2537
2538             my $conf = PVE::QemuServer::load_config($vmid);
2539
2540             die "checksum missmatch (file change by other user?)\n"
2541                 if $digest && $digest ne $conf->{digest};
2542
2543             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2544
2545             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2546
2547             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2548
2549             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2550
2551             my $oldfmt;
2552             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2553             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2554                 $oldfmt = $1;
2555             }
2556
2557             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2558                 (!$format || !$oldfmt || $oldfmt eq $format);
2559
2560             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2561
2562             my $running = PVE::QemuServer::check_running($vmid);
2563
2564             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2565
2566             my $realcmd = sub {
2567
2568                 my $newvollist = [];
2569
2570                 eval {
2571                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2572
2573                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2574                                                                $vmid, $storeid, $format, 1, $newvollist);
2575
2576                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2577
2578                     PVE::QemuServer::add_unused_volume($conf, $old_volid) if !$param->{delete};
2579
2580                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2581
2582                     eval {
2583                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2584                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2585                             if !$running;
2586                     };
2587                     warn $@ if $@;
2588                 };
2589                 if (my $err = $@) {
2590
2591                    foreach my $volid (@$newvollist) {
2592                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2593                         warn $@ if $@;
2594                     }
2595                     die "storage migration failed: $err";
2596                 }
2597
2598                 if ($param->{delete}) {
2599                     my $used_paths = PVE::QemuServer::get_used_paths($vmid, $storecfg, $conf, 1, 1);
2600                     my $path = PVE::Storage::path($storecfg, $old_volid);
2601                     if ($used_paths->{$path}){
2602                         warn "volume $old_volid have snapshots. Can't delete it\n";
2603                         PVE::QemuServer::add_unused_volume($conf, $old_volid);
2604                         PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2605                     } else {
2606                         eval { PVE::Storage::vdisk_free($storecfg, $old_volid); };
2607                         warn $@ if $@;
2608                     }
2609                 }
2610             };
2611
2612             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2613         };
2614
2615         return PVE::QemuServer::lock_config($vmid, $updatefn);
2616     }});
2617
2618 __PACKAGE__->register_method({
2619     name => 'migrate_vm',
2620     path => '{vmid}/migrate',
2621     method => 'POST',
2622     protected => 1,
2623     proxyto => 'node',
2624     description => "Migrate virtual machine. Creates a new migration task.",
2625     permissions => {
2626         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2627     },
2628     parameters => {
2629         additionalProperties => 0,
2630         properties => {
2631             node => get_standard_option('pve-node'),
2632             vmid => get_standard_option('pve-vmid'),
2633             target => get_standard_option('pve-node', { description => "Target node." }),
2634             online => {
2635                 type => 'boolean',
2636                 description => "Use online/live migration.",
2637                 optional => 1,
2638             },
2639             force => {
2640                 type => 'boolean',
2641                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2642                 optional => 1,
2643             },
2644         },
2645     },
2646     returns => {
2647         type => 'string',
2648         description => "the task ID.",
2649     },
2650     code => sub {
2651         my ($param) = @_;
2652
2653         my $rpcenv = PVE::RPCEnvironment::get();
2654
2655         my $authuser = $rpcenv->get_user();
2656
2657         my $target = extract_param($param, 'target');
2658
2659         my $localnode = PVE::INotify::nodename();
2660         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2661
2662         PVE::Cluster::check_cfs_quorum();
2663
2664         PVE::Cluster::check_node_exists($target);
2665
2666         my $targetip = PVE::Cluster::remote_node_ip($target);
2667
2668         my $vmid = extract_param($param, 'vmid');
2669
2670         raise_param_exc({ force => "Only root may use this option." })
2671             if $param->{force} && $authuser ne 'root@pam';
2672
2673         # test if VM exists
2674         my $conf = PVE::QemuServer::load_config($vmid);
2675
2676         # try to detect errors early
2677
2678         PVE::QemuServer::check_lock($conf);
2679
2680         if (PVE::QemuServer::check_running($vmid)) {
2681             die "cant migrate running VM without --online\n"
2682                 if !$param->{online};
2683         }
2684
2685         my $storecfg = PVE::Storage::config();
2686         PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2687
2688         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2689
2690             my $hacmd = sub {
2691                 my $upid = shift;
2692
2693                 my $service = "pvevm:$vmid";
2694
2695                 my $cmd = ['clusvcadm', '-M', $service, '-m', $target];
2696
2697                 print "Executing HA migrate for VM $vmid to node $target\n";
2698
2699                 PVE::Tools::run_command($cmd);
2700
2701                 return;
2702             };
2703
2704             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2705
2706         } else {
2707
2708             my $realcmd = sub {
2709                 my $upid = shift;
2710
2711                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2712             };
2713
2714             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
2715         }
2716
2717     }});
2718
2719 __PACKAGE__->register_method({
2720     name => 'monitor',
2721     path => '{vmid}/monitor',
2722     method => 'POST',
2723     protected => 1,
2724     proxyto => 'node',
2725     description => "Execute Qemu monitor commands.",
2726     permissions => {
2727         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2728     },
2729     parameters => {
2730         additionalProperties => 0,
2731         properties => {
2732             node => get_standard_option('pve-node'),
2733             vmid => get_standard_option('pve-vmid'),
2734             command => {
2735                 type => 'string',
2736                 description => "The monitor command.",
2737             }
2738         },
2739     },
2740     returns => { type => 'string'},
2741     code => sub {
2742         my ($param) = @_;
2743
2744         my $vmid = $param->{vmid};
2745
2746         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
2747
2748         my $res = '';
2749         eval {
2750             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
2751         };
2752         $res = "ERROR: $@" if $@;
2753
2754         return $res;
2755     }});
2756
2757 __PACKAGE__->register_method({
2758     name => 'resize_vm',
2759     path => '{vmid}/resize',
2760     method => 'PUT',
2761     protected => 1,
2762     proxyto => 'node',
2763     description => "Extend volume size.",
2764     permissions => {
2765         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2766     },
2767     parameters => {
2768         additionalProperties => 0,
2769         properties => {
2770             node => get_standard_option('pve-node'),
2771             vmid => get_standard_option('pve-vmid'),
2772             skiplock => get_standard_option('skiplock'),
2773             disk => {
2774                 type => 'string',
2775                 description => "The disk you want to resize.",
2776                 enum => [PVE::QemuServer::disknames()],
2777             },
2778             size => {
2779                 type => 'string',
2780                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
2781                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
2782             },
2783             digest => {
2784                 type => 'string',
2785                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2786                 maxLength => 40,
2787                 optional => 1,
2788             },
2789         },
2790     },
2791     returns => { type => 'null'},
2792     code => sub {
2793         my ($param) = @_;
2794
2795         my $rpcenv = PVE::RPCEnvironment::get();
2796
2797         my $authuser = $rpcenv->get_user();
2798
2799         my $node = extract_param($param, 'node');
2800
2801         my $vmid = extract_param($param, 'vmid');
2802
2803         my $digest = extract_param($param, 'digest');
2804
2805         my $disk = extract_param($param, 'disk');
2806
2807         my $sizestr = extract_param($param, 'size');
2808
2809         my $skiplock = extract_param($param, 'skiplock');
2810         raise_param_exc({ skiplock => "Only root may use this option." })
2811             if $skiplock && $authuser ne 'root@pam';
2812
2813         my $storecfg = PVE::Storage::config();
2814
2815         my $updatefn =  sub {
2816
2817             my $conf = PVE::QemuServer::load_config($vmid);
2818
2819             die "checksum missmatch (file change by other user?)\n"
2820                 if $digest && $digest ne $conf->{digest};
2821             PVE::QemuServer::check_lock($conf) if !$skiplock;
2822
2823             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2824
2825             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2826
2827             my $volid = $drive->{file};
2828
2829             die "disk '$disk' has no associated volume\n" if !$volid;
2830
2831             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2832
2833             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
2834
2835             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
2836
2837             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
2838
2839             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
2840             my ($ext, $newsize, $unit) = ($1, $2, $4);
2841             if ($unit) {
2842                 if ($unit eq 'K') {
2843                     $newsize = $newsize * 1024;
2844                 } elsif ($unit eq 'M') {
2845                     $newsize = $newsize * 1024 * 1024;
2846                 } elsif ($unit eq 'G') {
2847                     $newsize = $newsize * 1024 * 1024 * 1024;
2848                 } elsif ($unit eq 'T') {
2849                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
2850                 }
2851             }
2852             $newsize += $size if $ext;
2853             $newsize = int($newsize);
2854
2855             die "unable to skrink disk size\n" if $newsize < $size;
2856
2857             return if $size == $newsize;
2858
2859             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
2860
2861             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
2862
2863             $drive->{size} = $newsize;
2864             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
2865
2866             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2867         };
2868
2869         PVE::QemuServer::lock_config($vmid, $updatefn);
2870         return undef;
2871     }});
2872
2873 __PACKAGE__->register_method({
2874     name => 'snapshot_list',
2875     path => '{vmid}/snapshot',
2876     method => 'GET',
2877     description => "List all snapshots.",
2878     permissions => {
2879         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2880     },
2881     proxyto => 'node',
2882     protected => 1, # qemu pid files are only readable by root
2883     parameters => {
2884         additionalProperties => 0,
2885         properties => {
2886             vmid => get_standard_option('pve-vmid'),
2887             node => get_standard_option('pve-node'),
2888         },
2889     },
2890     returns => {
2891         type => 'array',
2892         items => {
2893             type => "object",
2894             properties => {},
2895         },
2896         links => [ { rel => 'child', href => "{name}" } ],
2897     },
2898     code => sub {
2899         my ($param) = @_;
2900
2901         my $vmid = $param->{vmid};
2902
2903         my $conf = PVE::QemuServer::load_config($vmid);
2904         my $snaphash = $conf->{snapshots} || {};
2905
2906         my $res = [];
2907
2908         foreach my $name (keys %$snaphash) {
2909             my $d = $snaphash->{$name};
2910             my $item = {
2911                 name => $name,
2912                 snaptime => $d->{snaptime} || 0,
2913                 vmstate => $d->{vmstate} ? 1 : 0,
2914                 description => $d->{description} || '',
2915             };
2916             $item->{parent} = $d->{parent} if $d->{parent};
2917             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
2918             push @$res, $item;
2919         }
2920
2921         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
2922         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
2923         $current->{parent} = $conf->{parent} if $conf->{parent};
2924
2925         push @$res, $current;
2926
2927         return $res;
2928     }});
2929
2930 __PACKAGE__->register_method({
2931     name => 'snapshot',
2932     path => '{vmid}/snapshot',
2933     method => 'POST',
2934     protected => 1,
2935     proxyto => 'node',
2936     description => "Snapshot a VM.",
2937     permissions => {
2938         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2939     },
2940     parameters => {
2941         additionalProperties => 0,
2942         properties => {
2943             node => get_standard_option('pve-node'),
2944             vmid => get_standard_option('pve-vmid'),
2945             snapname => get_standard_option('pve-snapshot-name'),
2946             vmstate => {
2947                 optional => 1,
2948                 type => 'boolean',
2949                 description => "Save the vmstate",
2950             },
2951             description => {
2952                 optional => 1,
2953                 type => 'string',
2954                 description => "A textual description or comment.",
2955             },
2956         },
2957     },
2958     returns => {
2959         type => 'string',
2960         description => "the task ID.",
2961     },
2962     code => sub {
2963         my ($param) = @_;
2964
2965         my $rpcenv = PVE::RPCEnvironment::get();
2966
2967         my $authuser = $rpcenv->get_user();
2968
2969         my $node = extract_param($param, 'node');
2970
2971         my $vmid = extract_param($param, 'vmid');
2972
2973         my $snapname = extract_param($param, 'snapname');
2974
2975         die "unable to use snapshot name 'current' (reserved name)\n"
2976             if $snapname eq 'current';
2977
2978         my $realcmd = sub {
2979             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
2980             PVE::QemuServer::snapshot_create($vmid, $snapname, $param->{vmstate},
2981                                              $param->{description});
2982         };
2983
2984         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
2985     }});
2986
2987 __PACKAGE__->register_method({
2988     name => 'snapshot_cmd_idx',
2989     path => '{vmid}/snapshot/{snapname}',
2990     description => '',
2991     method => 'GET',
2992     permissions => {
2993         user => 'all',
2994     },
2995     parameters => {
2996         additionalProperties => 0,
2997         properties => {
2998             vmid => get_standard_option('pve-vmid'),
2999             node => get_standard_option('pve-node'),
3000             snapname => get_standard_option('pve-snapshot-name'),
3001         },
3002     },
3003     returns => {
3004         type => 'array',
3005         items => {
3006             type => "object",
3007             properties => {},
3008         },
3009         links => [ { rel => 'child', href => "{cmd}" } ],
3010     },
3011     code => sub {
3012         my ($param) = @_;
3013
3014         my $res = [];
3015
3016         push @$res, { cmd => 'rollback' };
3017         push @$res, { cmd => 'config' };
3018
3019         return $res;
3020     }});
3021
3022 __PACKAGE__->register_method({
3023     name => 'update_snapshot_config',
3024     path => '{vmid}/snapshot/{snapname}/config',
3025     method => 'PUT',
3026     protected => 1,
3027     proxyto => 'node',
3028     description => "Update snapshot metadata.",
3029     permissions => {
3030         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3031     },
3032     parameters => {
3033         additionalProperties => 0,
3034         properties => {
3035             node => get_standard_option('pve-node'),
3036             vmid => get_standard_option('pve-vmid'),
3037             snapname => get_standard_option('pve-snapshot-name'),
3038             description => {
3039                 optional => 1,
3040                 type => 'string',
3041                 description => "A textual description or comment.",
3042             },
3043         },
3044     },
3045     returns => { type => 'null' },
3046     code => sub {
3047         my ($param) = @_;
3048
3049         my $rpcenv = PVE::RPCEnvironment::get();
3050
3051         my $authuser = $rpcenv->get_user();
3052
3053         my $vmid = extract_param($param, 'vmid');
3054
3055         my $snapname = extract_param($param, 'snapname');
3056
3057         return undef if !defined($param->{description});
3058
3059         my $updatefn =  sub {
3060
3061             my $conf = PVE::QemuServer::load_config($vmid);
3062
3063             PVE::QemuServer::check_lock($conf);
3064
3065             my $snap = $conf->{snapshots}->{$snapname};
3066
3067             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3068
3069             $snap->{description} = $param->{description} if defined($param->{description});
3070
3071              PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
3072         };
3073
3074         PVE::QemuServer::lock_config($vmid, $updatefn);
3075
3076         return undef;
3077     }});
3078
3079 __PACKAGE__->register_method({
3080     name => 'get_snapshot_config',
3081     path => '{vmid}/snapshot/{snapname}/config',
3082     method => 'GET',
3083     proxyto => 'node',
3084     description => "Get snapshot configuration",
3085     permissions => {
3086         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3087     },
3088     parameters => {
3089         additionalProperties => 0,
3090         properties => {
3091             node => get_standard_option('pve-node'),
3092             vmid => get_standard_option('pve-vmid'),
3093             snapname => get_standard_option('pve-snapshot-name'),
3094         },
3095     },
3096     returns => { type => "object" },
3097     code => sub {
3098         my ($param) = @_;
3099
3100         my $rpcenv = PVE::RPCEnvironment::get();
3101
3102         my $authuser = $rpcenv->get_user();
3103
3104         my $vmid = extract_param($param, 'vmid');
3105
3106         my $snapname = extract_param($param, 'snapname');
3107
3108         my $conf = PVE::QemuServer::load_config($vmid);
3109
3110         my $snap = $conf->{snapshots}->{$snapname};
3111
3112         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3113
3114         return $snap;
3115     }});
3116
3117 __PACKAGE__->register_method({
3118     name => 'rollback',
3119     path => '{vmid}/snapshot/{snapname}/rollback',
3120     method => 'POST',
3121     protected => 1,
3122     proxyto => 'node',
3123     description => "Rollback VM state to specified snapshot.",
3124     permissions => {
3125         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3126     },
3127     parameters => {
3128         additionalProperties => 0,
3129         properties => {
3130             node => get_standard_option('pve-node'),
3131             vmid => get_standard_option('pve-vmid'),
3132             snapname => get_standard_option('pve-snapshot-name'),
3133         },
3134     },
3135     returns => {
3136         type => 'string',
3137         description => "the task ID.",
3138     },
3139     code => sub {
3140         my ($param) = @_;
3141
3142         my $rpcenv = PVE::RPCEnvironment::get();
3143
3144         my $authuser = $rpcenv->get_user();
3145
3146         my $node = extract_param($param, 'node');
3147
3148         my $vmid = extract_param($param, 'vmid');
3149
3150         my $snapname = extract_param($param, 'snapname');
3151
3152         my $realcmd = sub {
3153             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3154             PVE::QemuServer::snapshot_rollback($vmid, $snapname);
3155         };
3156
3157         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $realcmd);
3158     }});
3159
3160 __PACKAGE__->register_method({
3161     name => 'delsnapshot',
3162     path => '{vmid}/snapshot/{snapname}',
3163     method => 'DELETE',
3164     protected => 1,
3165     proxyto => 'node',
3166     description => "Delete a VM snapshot.",
3167     permissions => {
3168         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3169     },
3170     parameters => {
3171         additionalProperties => 0,
3172         properties => {
3173             node => get_standard_option('pve-node'),
3174             vmid => get_standard_option('pve-vmid'),
3175             snapname => get_standard_option('pve-snapshot-name'),
3176             force => {
3177                 optional => 1,
3178                 type => 'boolean',
3179                 description => "For removal from config file, even if removing disk snapshots fails.",
3180             },
3181         },
3182     },
3183     returns => {
3184         type => 'string',
3185         description => "the task ID.",
3186     },
3187     code => sub {
3188         my ($param) = @_;
3189
3190         my $rpcenv = PVE::RPCEnvironment::get();
3191
3192         my $authuser = $rpcenv->get_user();
3193
3194         my $node = extract_param($param, 'node');
3195
3196         my $vmid = extract_param($param, 'vmid');
3197
3198         my $snapname = extract_param($param, 'snapname');
3199
3200         my $realcmd = sub {
3201             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3202             PVE::QemuServer::snapshot_delete($vmid, $snapname, $param->{force});
3203         };
3204
3205         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3206     }});
3207
3208 __PACKAGE__->register_method({
3209     name => 'template',
3210     path => '{vmid}/template',
3211     method => 'POST',
3212     protected => 1,
3213     proxyto => 'node',
3214     description => "Create a Template.",
3215     permissions => {
3216         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3217         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3218     },
3219     parameters => {
3220         additionalProperties => 0,
3221         properties => {
3222             node => get_standard_option('pve-node'),
3223             vmid => get_standard_option('pve-vmid'),
3224             disk => {
3225                 optional => 1,
3226                 type => 'string',
3227                 description => "If you want to convert only 1 disk to base image.",
3228                 enum => [PVE::QemuServer::disknames()],
3229             },
3230
3231         },
3232     },
3233     returns => { type => 'null'},
3234     code => sub {
3235         my ($param) = @_;
3236
3237         my $rpcenv = PVE::RPCEnvironment::get();
3238
3239         my $authuser = $rpcenv->get_user();
3240
3241         my $node = extract_param($param, 'node');
3242
3243         my $vmid = extract_param($param, 'vmid');
3244
3245         my $disk = extract_param($param, 'disk');
3246
3247         my $updatefn =  sub {
3248
3249             my $conf = PVE::QemuServer::load_config($vmid);
3250
3251             PVE::QemuServer::check_lock($conf);
3252
3253             die "unable to create template, because VM contains snapshots\n"
3254                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3255
3256             die "you can't convert a template to a template\n"
3257                 if PVE::QemuServer::is_template($conf) && !$disk;
3258
3259             die "you can't convert a VM to template if VM is running\n"
3260                 if PVE::QemuServer::check_running($vmid);
3261
3262             my $realcmd = sub {
3263                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3264             };
3265
3266             $conf->{template} = 1;
3267             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
3268
3269             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3270         };
3271
3272         PVE::QemuServer::lock_config($vmid, $updatefn);
3273         return undef;
3274     }});
3275
3276 1;