PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6 use Net::SSLeay;
   7 use UUID;
   8 use POSIX;
   9 use IO::Socket::IP;
  10
  11 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
  12 use PVE::SafeSyslog;
  13 use PVE::Tools qw(extract_param);
  14 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  15 use PVE::Storage;
  16 use PVE::JSONSchema qw(get_standard_option);
  17 use PVE::RESTHandler;
  18 use PVE::ReplicationConfig;
  19 use PVE::GuestHelpers;
  20 use PVE::QemuConfig;
  21 use PVE::QemuServer;
  22 use PVE::QemuMigrate;
  23 use PVE::RPCEnvironment;
  24 use PVE::AccessControl;
  25 use PVE::INotify;
  26 use PVE::Network;
  27 use PVE::Firewall;
  28 use PVE::API2::Firewall::VM;
  29
  30 BEGIN {
  31     if (!$ENV{PVE_GENERATING_DOCS}) {
  32         require PVE::HA::Env::PVE2;
  33         import PVE::HA::Env::PVE2;
  34         require PVE::HA::Config;
  35         import PVE::HA::Config;
  36     }
  37 }
  38
  39 use Data::Dumper; # fixme: remove
  40
  41 use base qw(PVE::RESTHandler);
  42
  43 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  44
  45 my $resolve_cdrom_alias = sub {
  46     my $param = shift;
  47
  48     if (my $value = $param->{cdrom}) {
  49         $value .= ",media=cdrom" if $value !~ m/media=/;
  50         $param->{ide2} = $value;
  51         delete $param->{cdrom};
  52     }
  53 };
  54
  55 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
  56 my $check_storage_access = sub {
  57    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  58
  59    PVE::QemuServer::foreach_drive($settings, sub {
  60         my ($ds, $drive) = @_;
  61
  62         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  63
  64         my $volid = $drive->{file};
  65
  66         if (!$volid || $volid eq 'none') {
  67             # nothing to check
  68         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  69             $rpcenv->check($authuser, "/", ['Sys.Console']);
  70         } elsif (!$isCDROM && ($volid =~ $NEW_DISK_RE)) {
  71             my ($storeid, $size) = ($2 || $default_storage, $3);
  72             die "no storage ID specified (and no default storage)\n" if !$storeid;
  73             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  74             my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
  75             raise_param_exc({ storage => "storage '$storeid' does not support vm images"})
  76                 if !$scfg->{content}->{images};
  77         } else {
  78             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
  79         }
  80     });
  81
  82    $rpcenv->check($authuser, "/storage/$settings->{vmstatestorage}", ['Datastore.AllocateSpace'])
  83        if defined($settings->{vmstatestorage});
  84 };
  85
  86 my $check_storage_access_clone = sub {
  87    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  88
  89    my $sharedvm = 1;
  90
  91    PVE::QemuServer::foreach_drive($conf, sub {
  92         my ($ds, $drive) = @_;
  93
  94         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  95
  96         my $volid = $drive->{file};
  97
  98         return if !$volid || $volid eq 'none';
  99
 100         if ($isCDROM) {
 101             if ($volid eq 'cdrom') {
 102                 $rpcenv->check($authuser, "/", ['Sys.Console']);
 103             } else {
 104                 # we simply allow access
 105                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 106                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 107                 $sharedvm = 0 if !$scfg->{shared};
 108
 109             }
 110         } else {
 111             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
 112             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
 113             $sharedvm = 0 if !$scfg->{shared};
 114
 115             $sid = $storage if $storage;
 116             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
 117         }
 118     });
 119
 120    $rpcenv->check($authuser, "/storage/$conf->{vmstatestorage}", ['Datastore.AllocateSpace'])
 121        if defined($conf->{vmstatestorage});
 122
 123    return $sharedvm;
 124 };
 125
 126 # Note: $pool is only needed when creating a VM, because pool permissions
 127 # are automatically inherited if VM already exists inside a pool.
 128 my $create_disks = sub {
 129     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 130
 131     my $vollist = [];
 132
 133     my $res = {};
 134
 135     my $code = sub {
 136         my ($ds, $disk) = @_;
 137
 138         my $volid = $disk->{file};
 139
 140         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 141             delete $disk->{size};
 142             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 143         } elsif ($volid =~ $NEW_DISK_RE) {
 144             my ($storeid, $size) = ($2 || $default_storage, $3);
 145             die "no storage ID specified (and no default storage)\n" if !$storeid;
 146             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 147             my $fmt = $disk->{format} || $defformat;
 148
 149             $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
 150
 151             my $volid;
 152             if ($ds eq 'efidisk0') {
 153                 ($volid, $size) = PVE::QemuServer::create_efidisk($storecfg, $storeid, $vmid, $fmt);
 154             } else {
 155                 $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
 156             }
 157             push @$vollist, $volid;
 158             $disk->{file} = $volid;
 159             $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
 160             delete $disk->{format}; # no longer needed
 161             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 162         } else {
 163
 164             PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
 165
 166             my $volid_is_new = 1;
 167
 168             if ($conf->{$ds}) {
 169                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 170                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 171             }
 172
 173             if ($volid_is_new) {
 174
 175                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 176
 177                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 178
 179                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 180
 181                 die "volume $volid does not exists\n" if !$size;
 182
 183                 $disk->{size} = $size;
 184             }
 185
 186             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 187         }
 188     };
 189
 190     eval { PVE::QemuServer::foreach_drive($settings, $code); };
 191
 192     # free allocated images on error
 193     if (my $err = $@) {
 194         syslog('err', "VM $vmid creating disks failed");
 195         foreach my $volid (@$vollist) {
 196             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 197             warn $@ if $@;
 198         }
 199         die $err;
 200     }
 201
 202     # modify vm config if everything went well
 203     foreach my $ds (keys %$res) {
 204         $conf->{$ds} = $res->{$ds};
 205     }
 206
 207     return $vollist;
 208 };
 209
 210 my $cpuoptions = {
 211     'cores' => 1,
 212     'cpu' => 1,
 213     'cpulimit' => 1,
 214     'cpuunits' => 1,
 215     'numa' => 1,
 216     'smp' => 1,
 217     'sockets' => 1,
 218     'vcpus' => 1,
 219 };
 220
 221 my $memoryoptions = {
 222     'memory' => 1,
 223     'balloon' => 1,
 224     'shares' => 1,
 225 };
 226
 227 my $hwtypeoptions = {
 228     'acpi' => 1,
 229     'hotplug' => 1,
 230     'kvm' => 1,
 231     'machine' => 1,
 232     'scsihw' => 1,
 233     'smbios1' => 1,
 234     'tablet' => 1,
 235     'vga' => 1,
 236     'watchdog' => 1,
 237 };
 238
 239 my $generaloptions = {
 240     'agent' => 1,
 241     'autostart' => 1,
 242     'bios' => 1,
 243     'description' => 1,
 244     'keyboard' => 1,
 245     'localtime' => 1,
 246     'migrate_downtime' => 1,
 247     'migrate_speed' => 1,
 248     'name' => 1,
 249     'onboot' => 1,
 250     'ostype' => 1,
 251     'protection' => 1,
 252     'reboot' => 1,
 253     'startdate' => 1,
 254     'startup' => 1,
 255     'tdf' => 1,
 256     'template' => 1,
 257 };
 258
 259 my $vmpoweroptions = {
 260     'freeze' => 1,
 261 };
 262
 263 my $diskoptions = {
 264     'boot' => 1,
 265     'bootdisk' => 1,
 266     'vmstatestorage' => 1,
 267 };
 268
 269 my $check_vm_modify_config_perm = sub {
 270     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 271
 272     return 1 if $authuser eq 'root@pam';
 273
 274     foreach my $opt (@$key_list) {
 275         # disk checks need to be done somewhere else
 276         next if PVE::QemuServer::is_valid_drivename($opt);
 277         next if $opt eq 'cdrom';
 278         next if $opt =~ m/^unused\d+$/;
 279
 280         if ($cpuoptions->{$opt} || $opt =~ m/^numa\d+$/) {
 281             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 282         } elsif ($memoryoptions->{$opt}) {
 283             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 284         } elsif ($hwtypeoptions->{$opt}) {
 285             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 286         } elsif ($generaloptions->{$opt}) {
 287             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 288             # special case for startup since it changes host behaviour
 289             if ($opt eq 'startup') {
 290                 $rpcenv->check_full($authuser, "/", ['Sys.Modify']);
 291             }
 292         } elsif ($vmpoweroptions->{$opt}) {
 293             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.PowerMgmt']);
 294         } elsif ($diskoptions->{$opt}) {
 295             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 296         } elsif ($opt =~ m/^net\d+$/) {
 297             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 298         } else {
 299             # catches usb\d+, hostpci\d+, args, lock, etc.
 300             # new options will be checked here
 301             die "only root can set '$opt' config\n";
 302         }
 303     }
 304
 305     return 1;
 306 };
 307
 308 __PACKAGE__->register_method({
 309     name => 'vmlist',
 310     path => '',
 311     method => 'GET',
 312     description => "Virtual machine index (per node).",
 313     permissions => {
 314         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 315         user => 'all',
 316     },
 317     proxyto => 'node',
 318     protected => 1, # qemu pid files are only readable by root
 319     parameters => {
 320         additionalProperties => 0,
 321         properties => {
 322             node => get_standard_option('pve-node'),
 323             full => {
 324                 type => 'boolean',
 325                 optional => 1,
 326                 description => "Determine the full status of active VMs.",
 327             },
 328         },
 329     },
 330     returns => {
 331         type => 'array',
 332         items => {
 333             type => "object",
 334             properties => {},
 335         },
 336         links => [ { rel => 'child', href => "{vmid}" } ],
 337     },
 338     code => sub {
 339         my ($param) = @_;
 340
 341         my $rpcenv = PVE::RPCEnvironment::get();
 342         my $authuser = $rpcenv->get_user();
 343
 344         my $vmstatus = PVE::QemuServer::vmstatus(undef, $param->{full});
 345
 346         my $res = [];
 347         foreach my $vmid (keys %$vmstatus) {
 348             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 349
 350             my $data = $vmstatus->{$vmid};
 351             $data->{vmid} = int($vmid);
 352             push @$res, $data;
 353         }
 354
 355         return $res;
 356     }});
 357
 358
 359
 360 __PACKAGE__->register_method({
 361     name => 'create_vm',
 362     path => '',
 363     method => 'POST',
 364     description => "Create or restore a virtual machine.",
 365     permissions => {
 366         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 367             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 368             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 369         user => 'all', # check inside
 370     },
 371     protected => 1,
 372     proxyto => 'node',
 373     parameters => {
 374         additionalProperties => 0,
 375         properties => PVE::QemuServer::json_config_properties(
 376             {
 377                 node => get_standard_option('pve-node'),
 378                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::Cluster::complete_next_vmid }),
 379                 archive => {
 380                     description => "The backup file.",
 381                     type => 'string',
 382                     optional => 1,
 383                     maxLength => 255,
 384                     completion => \&PVE::QemuServer::complete_backup_archives,
 385                 },
 386                 storage => get_standard_option('pve-storage-id', {
 387                     description => "Default storage.",
 388                     optional => 1,
 389                     completion => \&PVE::QemuServer::complete_storage,
 390                 }),
 391                 force => {
 392                     optional => 1,
 393                     type => 'boolean',
 394                     description => "Allow to overwrite existing VM.",
 395                     requires => 'archive',
 396                 },
 397                 unique => {
 398                     optional => 1,
 399                     type => 'boolean',
 400                     description => "Assign a unique random ethernet address.",
 401                     requires => 'archive',
 402                 },
 403                 pool => {
 404                     optional => 1,
 405                     type => 'string', format => 'pve-poolid',
 406                     description => "Add the VM to the specified pool.",
 407                 },
 408             }),
 409     },
 410     returns => {
 411         type => 'string',
 412     },
 413     code => sub {
 414         my ($param) = @_;
 415
 416         my $rpcenv = PVE::RPCEnvironment::get();
 417
 418         my $authuser = $rpcenv->get_user();
 419
 420         my $node = extract_param($param, 'node');
 421
 422         my $vmid = extract_param($param, 'vmid');
 423
 424         my $archive = extract_param($param, 'archive');
 425
 426         my $storage = extract_param($param, 'storage');
 427
 428         my $force = extract_param($param, 'force');
 429
 430         my $unique = extract_param($param, 'unique');
 431
 432         my $pool = extract_param($param, 'pool');
 433
 434         my $filename = PVE::QemuConfig->config_file($vmid);
 435
 436         my $storecfg = PVE::Storage::config();
 437
 438         PVE::Cluster::check_cfs_quorum();
 439
 440         if (defined($pool)) {
 441             $rpcenv->check_pool_exist($pool);
 442         }
 443
 444         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 445             if defined($storage);
 446
 447         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 448             # OK
 449         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 450             # OK
 451         } elsif ($archive && $force && (-f $filename) &&
 452                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 453             # OK: user has VM.Backup permissions, and want to restore an existing VM
 454         } else {
 455             raise_perm_exc();
 456         }
 457
 458         if (!$archive) {
 459             &$resolve_cdrom_alias($param);
 460
 461             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 462
 463             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 464
 465             foreach my $opt (keys %$param) {
 466                 if (PVE::QemuServer::is_valid_drivename($opt)) {
 467                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 468                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 469
 470                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 471                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 472                 }
 473             }
 474
 475             PVE::QemuServer::add_random_macs($param);
 476         } else {
 477             my $keystr = join(' ', keys %$param);
 478             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 479
 480             if ($archive eq '-') {
 481                 die "pipe requires cli environment\n"
 482                     if $rpcenv->{type} ne 'cli';
 483             } else {
 484                 PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
 485                 $archive = PVE::Storage::abs_filesystem_path($storecfg, $archive);
 486             }
 487         }
 488
 489         my $restorefn = sub {
 490             my $vmlist = PVE::Cluster::get_vmlist();
 491             if ($vmlist->{ids}->{$vmid}) {
 492                 my $current_node = $vmlist->{ids}->{$vmid}->{node};
 493                 if ($current_node eq $node) {
 494                     my $conf = PVE::QemuConfig->load_config($vmid);
 495
 496                     PVE::QemuConfig->check_protection($conf, "unable to restore VM $vmid");
 497
 498                     die "unable to restore vm $vmid - config file already exists\n"
 499                         if !$force;
 500
 501                     die "unable to restore vm $vmid - vm is running\n"
 502                         if PVE::QemuServer::check_running($vmid);
 503
 504                     die "unable to restore vm $vmid - vm is a template\n"
 505                         if PVE::QemuConfig->is_template($conf);
 506
 507                 } else {
 508                     die "unable to restore vm $vmid - already existing on cluster node '$current_node'\n";
 509                 }
 510             }
 511
 512             my $realcmd = sub {
 513                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 514                     storage => $storage,
 515                     pool => $pool,
 516                     unique => $unique });
 517
 518                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 519             };
 520
 521             # ensure no old replication state are exists
 522             PVE::ReplicationState::delete_guest_states($vmid);
 523
 524             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 525         };
 526
 527         my $createfn = sub {
 528
 529             # test after locking
 530             PVE::Cluster::check_vmid_unused($vmid);
 531
 532             # ensure no old replication state are exists
 533             PVE::ReplicationState::delete_guest_states($vmid);
 534
 535             my $realcmd = sub {
 536
 537                 my $vollist = [];
 538
 539                 my $conf = $param;
 540
 541                 eval {
 542
 543                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 544
 545                     if (!$conf->{bootdisk}) {
 546                         my $firstdisk = PVE::QemuServer::resolve_first_disk($conf);
 547                         $conf->{bootdisk} = $firstdisk if $firstdisk;
 548                     }
 549
 550                     # auto generate uuid if user did not specify smbios1 option
 551                     if (!$conf->{smbios1}) {
 552                         $conf->{smbios1} = PVE::QemuServer::generate_smbios1_uuid();
 553                     }
 554
 555                     PVE::QemuConfig->write_config($vmid, $conf);
 556
 557                 };
 558                 my $err = $@;
 559
 560                 if ($err) {
 561                     foreach my $volid (@$vollist) {
 562                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 563                         warn $@ if $@;
 564                     }
 565                     die "create failed - $err";
 566                 }
 567
 568                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 569             };
 570
 571             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 572         };
 573
 574         return PVE::QemuConfig->lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 575     }});
 576
 577 __PACKAGE__->register_method({
 578     name => 'vmdiridx',
 579     path => '{vmid}',
 580     method => 'GET',
 581     proxyto => 'node',
 582     description => "Directory index",
 583     permissions => {
 584         user => 'all',
 585     },
 586     parameters => {
 587         additionalProperties => 0,
 588         properties => {
 589             node => get_standard_option('pve-node'),
 590             vmid => get_standard_option('pve-vmid'),
 591         },
 592     },
 593     returns => {
 594         type => 'array',
 595         items => {
 596             type => "object",
 597             properties => {
 598                 subdir => { type => 'string' },
 599             },
 600         },
 601         links => [ { rel => 'child', href => "{subdir}" } ],
 602     },
 603     code => sub {
 604         my ($param) = @_;
 605
 606         my $res = [
 607             { subdir => 'config' },
 608             { subdir => 'pending' },
 609             { subdir => 'status' },
 610             { subdir => 'unlink' },
 611             { subdir => 'vncproxy' },
 612             { subdir => 'termproxy' },
 613             { subdir => 'migrate' },
 614             { subdir => 'resize' },
 615             { subdir => 'move' },
 616             { subdir => 'rrd' },
 617             { subdir => 'rrddata' },
 618             { subdir => 'monitor' },
 619             { subdir => 'agent' },
 620             { subdir => 'snapshot' },
 621             { subdir => 'spiceproxy' },
 622             { subdir => 'sendkey' },
 623             { subdir => 'firewall' },
 624             ];
 625
 626         return $res;
 627     }});
 628
 629 __PACKAGE__->register_method ({
 630     subclass => "PVE::API2::Firewall::VM",
 631     path => '{vmid}/firewall',
 632 });
 633
 634 __PACKAGE__->register_method({
 635     name => 'rrd',
 636     path => '{vmid}/rrd',
 637     method => 'GET',
 638     protected => 1, # fixme: can we avoid that?
 639     permissions => {
 640         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 641     },
 642     description => "Read VM RRD statistics (returns PNG)",
 643     parameters => {
 644         additionalProperties => 0,
 645         properties => {
 646             node => get_standard_option('pve-node'),
 647             vmid => get_standard_option('pve-vmid'),
 648             timeframe => {
 649                 description => "Specify the time frame you are interested in.",
 650                 type => 'string',
 651                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 652             },
 653             ds => {
 654                 description => "The list of datasources you want to display.",
 655                 type => 'string', format => 'pve-configid-list',
 656             },
 657             cf => {
 658                 description => "The RRD consolidation function",
 659                 type => 'string',
 660                 enum => [ 'AVERAGE', 'MAX' ],
 661                 optional => 1,
 662             },
 663         },
 664     },
 665     returns => {
 666         type => "object",
 667         properties => {
 668             filename => { type => 'string' },
 669         },
 670     },
 671     code => sub {
 672         my ($param) = @_;
 673
 674         return PVE::Cluster::create_rrd_graph(
 675             "pve2-vm/$param->{vmid}", $param->{timeframe},
 676             $param->{ds}, $param->{cf});
 677
 678     }});
 679
 680 __PACKAGE__->register_method({
 681     name => 'rrddata',
 682     path => '{vmid}/rrddata',
 683     method => 'GET',
 684     protected => 1, # fixme: can we avoid that?
 685     permissions => {
 686         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 687     },
 688     description => "Read VM RRD statistics",
 689     parameters => {
 690         additionalProperties => 0,
 691         properties => {
 692             node => get_standard_option('pve-node'),
 693             vmid => get_standard_option('pve-vmid'),
 694             timeframe => {
 695                 description => "Specify the time frame you are interested in.",
 696                 type => 'string',
 697                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 698             },
 699             cf => {
 700                 description => "The RRD consolidation function",
 701                 type => 'string',
 702                 enum => [ 'AVERAGE', 'MAX' ],
 703                 optional => 1,
 704             },
 705         },
 706     },
 707     returns => {
 708         type => "array",
 709         items => {
 710             type => "object",
 711             properties => {},
 712         },
 713     },
 714     code => sub {
 715         my ($param) = @_;
 716
 717         return PVE::Cluster::create_rrd_data(
 718             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 719     }});
 720
 721
 722 __PACKAGE__->register_method({
 723     name => 'vm_config',
 724     path => '{vmid}/config',
 725     method => 'GET',
 726     proxyto => 'node',
 727     description => "Get current virtual machine configuration. This does not include pending configuration changes (see 'pending' API).",
 728     permissions => {
 729         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 730     },
 731     parameters => {
 732         additionalProperties => 0,
 733         properties => {
 734             node => get_standard_option('pve-node'),
 735             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 736             current => {
 737                 description => "Get current values (instead of pending values).",
 738                 optional => 1,
 739                 default => 0,
 740                 type => 'boolean',
 741             },
 742         },
 743     },
 744     returns => {
 745         type => "object",
 746         properties => {
 747             digest => {
 748                 type => 'string',
 749                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 750             }
 751         },
 752     },
 753     code => sub {
 754         my ($param) = @_;
 755
 756         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 757
 758         delete $conf->{snapshots};
 759
 760         if (!$param->{current}) {
 761             foreach my $opt (keys %{$conf->{pending}}) {
 762                 next if $opt eq 'delete';
 763                 my $value = $conf->{pending}->{$opt};
 764                 next if ref($value); # just to be sure
 765                 $conf->{$opt} = $value;
 766             }
 767             my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 768             foreach my $opt (keys %$pending_delete_hash) {
 769                 delete $conf->{$opt} if $conf->{$opt};
 770             }
 771         }
 772
 773         delete $conf->{pending};
 774
 775         return $conf;
 776     }});
 777
 778 __PACKAGE__->register_method({
 779     name => 'vm_pending',
 780     path => '{vmid}/pending',
 781     method => 'GET',
 782     proxyto => 'node',
 783     description => "Get virtual machine configuration, including pending changes.",
 784     permissions => {
 785         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 786     },
 787     parameters => {
 788         additionalProperties => 0,
 789         properties => {
 790             node => get_standard_option('pve-node'),
 791             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
 792         },
 793     },
 794     returns => {
 795         type => "array",
 796         items => {
 797             type => "object",
 798             properties => {
 799                 key => {
 800                     description => "Configuration option name.",
 801                     type => 'string',
 802                 },
 803                 value => {
 804                     description => "Current value.",
 805                     type => 'string',
 806                     optional => 1,
 807                 },
 808                 pending => {
 809                     description => "Pending value.",
 810                     type => 'string',
 811                     optional => 1,
 812                 },
 813                 delete => {
 814                     description => "Indicates a pending delete request if present and not 0. " .
 815                                    "The value 2 indicates a force-delete request.",
 816                     type => 'integer',
 817                     minimum => 0,
 818                     maximum => 2,
 819                     optional => 1,
 820                 },
 821             },
 822         },
 823     },
 824     code => sub {
 825         my ($param) = @_;
 826
 827         my $conf = PVE::QemuConfig->load_config($param->{vmid});
 828
 829         my $pending_delete_hash = PVE::QemuServer::split_flagged_list($conf->{pending}->{delete});
 830
 831         my $res = [];
 832
 833         foreach my $opt (keys %$conf) {
 834             next if ref($conf->{$opt});
 835             my $item = { key => $opt };
 836             $item->{value} = $conf->{$opt} if defined($conf->{$opt});
 837             $item->{pending} = $conf->{pending}->{$opt} if defined($conf->{pending}->{$opt});
 838             $item->{delete} = ($pending_delete_hash->{$opt} ? 2 : 1) if exists $pending_delete_hash->{$opt};
 839             push @$res, $item;
 840         }
 841
 842         foreach my $opt (keys %{$conf->{pending}}) {
 843             next if $opt eq 'delete';
 844             next if ref($conf->{pending}->{$opt}); # just to be sure
 845             next if defined($conf->{$opt});
 846             my $item = { key => $opt };
 847             $item->{pending} = $conf->{pending}->{$opt};
 848             push @$res, $item;
 849         }
 850
 851         while (my ($opt, $force) = each %$pending_delete_hash) {
 852             next if $conf->{pending}->{$opt}; # just to be sure
 853             next if $conf->{$opt};
 854             my $item = { key => $opt, delete => ($force ? 2 : 1)};
 855             push @$res, $item;
 856         }
 857
 858         return $res;
 859     }});
 860
 861 # POST/PUT {vmid}/config implementation
 862 #
 863 # The original API used PUT (idempotent) an we assumed that all operations
 864 # are fast. But it turned out that almost any configuration change can
 865 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 866 # time to complete and have side effects (not idempotent).
 867 #
 868 # The new implementation uses POST and forks a worker process. We added
 869 # a new option 'background_delay'. If specified we wait up to
 870 # 'background_delay' second for the worker task to complete. It returns null
 871 # if the task is finished within that time, else we return the UPID.
 872
 873 my $update_vm_api  = sub {
 874     my ($param, $sync) = @_;
 875
 876     my $rpcenv = PVE::RPCEnvironment::get();
 877
 878     my $authuser = $rpcenv->get_user();
 879
 880     my $node = extract_param($param, 'node');
 881
 882     my $vmid = extract_param($param, 'vmid');
 883
 884     my $digest = extract_param($param, 'digest');
 885
 886     my $background_delay = extract_param($param, 'background_delay');
 887
 888     my @paramarr = (); # used for log message
 889     foreach my $key (sort keys %$param) {
 890         push @paramarr, "-$key", $param->{$key};
 891     }
 892
 893     my $skiplock = extract_param($param, 'skiplock');
 894     raise_param_exc({ skiplock => "Only root may use this option." })
 895         if $skiplock && $authuser ne 'root@pam';
 896
 897     my $delete_str = extract_param($param, 'delete');
 898
 899     my $revert_str = extract_param($param, 'revert');
 900
 901     my $force = extract_param($param, 'force');
 902
 903     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 904
 905     my $storecfg = PVE::Storage::config();
 906
 907     my $defaults = PVE::QemuServer::load_defaults();
 908
 909     &$resolve_cdrom_alias($param);
 910
 911     # now try to verify all parameters
 912
 913     my $revert = {};
 914     foreach my $opt (PVE::Tools::split_list($revert_str)) {
 915         if (!PVE::QemuServer::option_exists($opt)) {
 916             raise_param_exc({ revert => "unknown option '$opt'" });
 917         }
 918
 919         raise_param_exc({ delete => "you can't use '-$opt' and " .
 920                               "-revert $opt' at the same time" })
 921             if defined($param->{$opt});
 922
 923         $revert->{$opt} = 1;
 924     }
 925
 926     my @delete = ();
 927     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 928         $opt = 'ide2' if $opt eq 'cdrom';
 929
 930         raise_param_exc({ delete => "you can't use '-$opt' and " .
 931                               "-delete $opt' at the same time" })
 932             if defined($param->{$opt});
 933
 934         raise_param_exc({ revert => "you can't use '-delete $opt' and " .
 935                               "-revert $opt' at the same time" })
 936             if $revert->{$opt};
 937
 938         if (!PVE::QemuServer::option_exists($opt)) {
 939             raise_param_exc({ delete => "unknown option '$opt'" });
 940         }
 941
 942         push @delete, $opt;
 943     }
 944
 945     my $repl_conf = PVE::ReplicationConfig->new();
 946     my $is_replicated = $repl_conf->check_for_existing_jobs($vmid, 1);
 947     my $check_replication = sub {
 948         my ($drive) = @_;
 949         return if !$is_replicated;
 950         my $volid = $drive->{file};
 951         return if !$volid || !($drive->{replicate}//1);
 952         return if PVE::QemuServer::drive_is_cdrom($drive);
 953         my ($storeid, $format);
 954         if ($volid =~ $NEW_DISK_RE) {
 955             $storeid = $2;
 956             $format = $drive->{format} || PVE::Storage::storage_default_format($storecfg, $storeid);
 957         } else {
 958             ($storeid, undef) = PVE::Storage::parse_volume_id($volid, 1);
 959             $format = (PVE::Storage::parse_volname($storecfg, $volid))[6];
 960         }
 961         return if PVE::Storage::storage_can_replicate($storecfg, $storeid, $format);
 962         my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
 963         return if $scfg->{shared};
 964         die "cannot add non-replicatable volume to a replicated VM\n";
 965     };
 966
 967     foreach my $opt (keys %$param) {
 968         if (PVE::QemuServer::is_valid_drivename($opt)) {
 969             # cleanup drive path
 970             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 971             raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 972             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 973             $check_replication->($drive);
 974             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 975         } elsif ($opt =~ m/^net(\d+)$/) {
 976             # add macaddr
 977             my $net = PVE::QemuServer::parse_net($param->{$opt});
 978             $param->{$opt} = PVE::QemuServer::print_net($net);
 979         }
 980     }
 981
 982     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 983
 984     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 985
 986     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 987
 988     my $updatefn =  sub {
 989
 990         my $conf = PVE::QemuConfig->load_config($vmid);
 991
 992         die "checksum missmatch (file change by other user?)\n"
 993             if $digest && $digest ne $conf->{digest};
 994
 995         PVE::QemuConfig->check_lock($conf) if !$skiplock;
 996
 997         foreach my $opt (keys %$revert) {
 998             if (defined($conf->{$opt})) {
 999                 $param->{$opt} = $conf->{$opt};
1000             } elsif (defined($conf->{pending}->{$opt})) {
1001                 push @delete, $opt;
1002             }
1003         }
1004
1005         if ($param->{memory} || defined($param->{balloon})) {
1006             my $maxmem = $param->{memory} || $conf->{pending}->{memory} || $conf->{memory} || $defaults->{memory};
1007             my $balloon = defined($param->{balloon}) ? $param->{balloon} : $conf->{pending}->{balloon} || $conf->{balloon};
1008
1009             die "balloon value too large (must be smaller than assigned memory)\n"
1010                 if $balloon && $balloon > $maxmem;
1011         }
1012
1013         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
1014
1015         my $worker = sub {
1016
1017             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
1018
1019             # write updates to pending section
1020
1021             my $modified = {}; # record what $option we modify
1022
1023             foreach my $opt (@delete) {
1024                 $modified->{$opt} = 1;
1025                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1026                 if (!defined($conf->{$opt}) && !defined($conf->{pending}->{$opt})) {
1027                     warn "cannot delete '$opt' - not set in current configuration!\n";
1028                     $modified->{$opt} = 0;
1029                     next;
1030                 }
1031
1032                 if ($opt =~ m/^unused/) {
1033                     my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
1034                     PVE::QemuConfig->check_protection($conf, "can't remove unused disk '$drive->{file}'");
1035                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1036                     if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, $drive, $rpcenv, $authuser)) {
1037                         delete $conf->{$opt};
1038                         PVE::QemuConfig->write_config($vmid, $conf);
1039                     }
1040                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
1041                     PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'");
1042                     $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1043                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1044                         if defined($conf->{pending}->{$opt});
1045                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1046                     PVE::QemuConfig->write_config($vmid, $conf);
1047                 } else {
1048                     PVE::QemuServer::vmconfig_delete_pending_option($conf, $opt, $force);
1049                     PVE::QemuConfig->write_config($vmid, $conf);
1050                 }
1051             }
1052
1053             foreach my $opt (keys %$param) { # add/change
1054                 $modified->{$opt} = 1;
1055                 $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1056                 next if defined($conf->{pending}->{$opt}) && ($param->{$opt} eq $conf->{pending}->{$opt}); # skip if nothing changed
1057
1058                 if (PVE::QemuServer::is_valid_drivename($opt)) {
1059                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
1060                     if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
1061                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
1062                     } else {
1063                         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
1064                     }
1065                     PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $conf->{pending}->{$opt}))
1066                         if defined($conf->{pending}->{$opt});
1067
1068                     &$create_disks($rpcenv, $authuser, $conf->{pending}, $storecfg, $vmid, undef, {$opt => $param->{$opt}});
1069                 } else {
1070                     $conf->{pending}->{$opt} = $param->{$opt};
1071                 }
1072                 PVE::QemuServer::vmconfig_undelete_pending_option($conf, $opt);
1073                 PVE::QemuConfig->write_config($vmid, $conf);
1074             }
1075
1076             # remove pending changes when nothing changed
1077             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1078             my $changes = PVE::QemuServer::vmconfig_cleanup_pending($conf);
1079             PVE::QemuConfig->write_config($vmid, $conf) if $changes;
1080
1081             return if !scalar(keys %{$conf->{pending}});
1082
1083             my $running = PVE::QemuServer::check_running($vmid);
1084
1085             # apply pending changes
1086
1087             $conf = PVE::QemuConfig->load_config($vmid); # update/reload
1088
1089             if ($running) {
1090                 my $errors = {};
1091                 PVE::QemuServer::vmconfig_hotplug_pending($vmid, $conf, $storecfg, $modified, $errors);
1092                 raise_param_exc($errors) if scalar(keys %$errors);
1093             } else {
1094                 PVE::QemuServer::vmconfig_apply_pending($vmid, $conf, $storecfg, $running);
1095             }
1096
1097             return;
1098         };
1099
1100         if ($sync) {
1101             &$worker();
1102             return undef;
1103         } else {
1104             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1105
1106             if ($background_delay) {
1107
1108                 # Note: It would be better to do that in the Event based HTTPServer
1109                 # to avoid blocking call to sleep.
1110
1111                 my $end_time = time() + $background_delay;
1112
1113                 my $task = PVE::Tools::upid_decode($upid);
1114
1115                 my $running = 1;
1116                 while (time() < $end_time) {
1117                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1118                     last if !$running;
1119                     sleep(1); # this gets interrupted when child process ends
1120                 }
1121
1122                 if (!$running) {
1123                     my $status = PVE::Tools::upid_read_status($upid);
1124                     return undef if $status eq 'OK';
1125                     die $status;
1126                 }
1127             }
1128
1129             return $upid;
1130         }
1131     };
1132
1133     return PVE::QemuConfig->lock_config($vmid, $updatefn);
1134 };
1135
1136 my $vm_config_perm_list = [
1137             'VM.Config.Disk',
1138             'VM.Config.CDROM',
1139             'VM.Config.CPU',
1140             'VM.Config.Memory',
1141             'VM.Config.Network',
1142             'VM.Config.HWType',
1143             'VM.Config.Options',
1144     ];
1145
1146 __PACKAGE__->register_method({
1147     name => 'update_vm_async',
1148     path => '{vmid}/config',
1149     method => 'POST',
1150     protected => 1,
1151     proxyto => 'node',
1152     description => "Set virtual machine options (asynchrounous API).",
1153     permissions => {
1154         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1155     },
1156     parameters => {
1157         additionalProperties => 0,
1158         properties => PVE::QemuServer::json_config_properties(
1159             {
1160                 node => get_standard_option('pve-node'),
1161                 vmid => get_standard_option('pve-vmid'),
1162                 skiplock => get_standard_option('skiplock'),
1163                 delete => {
1164                     type => 'string', format => 'pve-configid-list',
1165                     description => "A list of settings you want to delete.",
1166                     optional => 1,
1167                 },
1168                 revert => {
1169                     type => 'string', format => 'pve-configid-list',
1170                     description => "Revert a pending change.",
1171                     optional => 1,
1172                 },
1173                 force => {
1174                     type => 'boolean',
1175                     description => $opt_force_description,
1176                     optional => 1,
1177                     requires => 'delete',
1178                 },
1179                 digest => {
1180                     type => 'string',
1181                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1182                     maxLength => 40,
1183                     optional => 1,
1184                 },
1185                 background_delay => {
1186                     type => 'integer',
1187                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1188                     minimum => 1,
1189                     maximum => 30,
1190                     optional => 1,
1191                 },
1192             }),
1193     },
1194     returns => {
1195         type => 'string',
1196         optional => 1,
1197     },
1198     code => $update_vm_api,
1199 });
1200
1201 __PACKAGE__->register_method({
1202     name => 'update_vm',
1203     path => '{vmid}/config',
1204     method => 'PUT',
1205     protected => 1,
1206     proxyto => 'node',
1207     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1208     permissions => {
1209         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1210     },
1211     parameters => {
1212         additionalProperties => 0,
1213         properties => PVE::QemuServer::json_config_properties(
1214             {
1215                 node => get_standard_option('pve-node'),
1216                 vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1217                 skiplock => get_standard_option('skiplock'),
1218                 delete => {
1219                     type => 'string', format => 'pve-configid-list',
1220                     description => "A list of settings you want to delete.",
1221                     optional => 1,
1222                 },
1223                 revert => {
1224                     type => 'string', format => 'pve-configid-list',
1225                     description => "Revert a pending change.",
1226                     optional => 1,
1227                 },
1228                 force => {
1229                     type => 'boolean',
1230                     description => $opt_force_description,
1231                     optional => 1,
1232                     requires => 'delete',
1233                 },
1234                 digest => {
1235                     type => 'string',
1236                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1237                     maxLength => 40,
1238                     optional => 1,
1239                 },
1240             }),
1241     },
1242     returns => { type => 'null' },
1243     code => sub {
1244         my ($param) = @_;
1245         &$update_vm_api($param, 1);
1246         return undef;
1247     }
1248 });
1249
1250
1251 __PACKAGE__->register_method({
1252     name => 'destroy_vm',
1253     path => '{vmid}',
1254     method => 'DELETE',
1255     protected => 1,
1256     proxyto => 'node',
1257     description => "Destroy the vm (also delete all used/owned volumes).",
1258     permissions => {
1259         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1260     },
1261     parameters => {
1262         additionalProperties => 0,
1263         properties => {
1264             node => get_standard_option('pve-node'),
1265             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1266             skiplock => get_standard_option('skiplock'),
1267         },
1268     },
1269     returns => {
1270         type => 'string',
1271     },
1272     code => sub {
1273         my ($param) = @_;
1274
1275         my $rpcenv = PVE::RPCEnvironment::get();
1276
1277         my $authuser = $rpcenv->get_user();
1278
1279         my $vmid = $param->{vmid};
1280
1281         my $skiplock = $param->{skiplock};
1282         raise_param_exc({ skiplock => "Only root may use this option." })
1283             if $skiplock && $authuser ne 'root@pam';
1284
1285         # test if VM exists
1286         my $conf = PVE::QemuConfig->load_config($vmid);
1287
1288         my $storecfg = PVE::Storage::config();
1289
1290         PVE::QemuConfig->check_protection($conf, "can't remove VM $vmid");
1291
1292         die "unable to remove VM $vmid - used in HA resources\n"
1293             if PVE::HA::Config::vm_is_ha_managed($vmid);
1294
1295         # do not allow destroy if there are replication jobs
1296         my $repl_conf = PVE::ReplicationConfig->new();
1297         $repl_conf->check_for_existing_jobs($vmid);
1298
1299         # early tests (repeat after locking)
1300         die "VM $vmid is running - destroy failed\n"
1301             if PVE::QemuServer::check_running($vmid);
1302
1303         my $realcmd = sub {
1304             my $upid = shift;
1305
1306             syslog('info', "destroy VM $vmid: $upid\n");
1307
1308             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1309
1310             PVE::AccessControl::remove_vm_access($vmid);
1311
1312             PVE::Firewall::remove_vmfw_conf($vmid);
1313         };
1314
1315         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1316     }});
1317
1318 __PACKAGE__->register_method({
1319     name => 'unlink',
1320     path => '{vmid}/unlink',
1321     method => 'PUT',
1322     protected => 1,
1323     proxyto => 'node',
1324     description => "Unlink/delete disk images.",
1325     permissions => {
1326         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1327     },
1328     parameters => {
1329         additionalProperties => 0,
1330         properties => {
1331             node => get_standard_option('pve-node'),
1332             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
1333             idlist => {
1334                 type => 'string', format => 'pve-configid-list',
1335                 description => "A list of disk IDs you want to delete.",
1336             },
1337             force => {
1338                 type => 'boolean',
1339                 description => $opt_force_description,
1340                 optional => 1,
1341             },
1342         },
1343     },
1344     returns => { type => 'null'},
1345     code => sub {
1346         my ($param) = @_;
1347
1348         $param->{delete} = extract_param($param, 'idlist');
1349
1350         __PACKAGE__->update_vm($param);
1351
1352         return undef;
1353     }});
1354
1355 my $sslcert;
1356
1357 __PACKAGE__->register_method({
1358     name => 'vncproxy',
1359     path => '{vmid}/vncproxy',
1360     method => 'POST',
1361     protected => 1,
1362     permissions => {
1363         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1364     },
1365     description => "Creates a TCP VNC proxy connections.",
1366     parameters => {
1367         additionalProperties => 0,
1368         properties => {
1369             node => get_standard_option('pve-node'),
1370             vmid => get_standard_option('pve-vmid'),
1371             websocket => {
1372                 optional => 1,
1373                 type => 'boolean',
1374                 description => "starts websockify instead of vncproxy",
1375             },
1376         },
1377     },
1378     returns => {
1379         additionalProperties => 0,
1380         properties => {
1381             user => { type => 'string' },
1382             ticket => { type => 'string' },
1383             cert => { type => 'string' },
1384             port => { type => 'integer' },
1385             upid => { type => 'string' },
1386         },
1387     },
1388     code => sub {
1389         my ($param) = @_;
1390
1391         my $rpcenv = PVE::RPCEnvironment::get();
1392
1393         my $authuser = $rpcenv->get_user();
1394
1395         my $vmid = $param->{vmid};
1396         my $node = $param->{node};
1397         my $websocket = $param->{websocket};
1398
1399         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1400
1401         my $authpath = "/vms/$vmid";
1402
1403         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1404
1405         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1406             if !$sslcert;
1407
1408         my ($remip, $family);
1409         my $remcmd = [];
1410
1411         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1412             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1413             # NOTE: kvm VNC traffic is already TLS encrypted or is known unsecure
1414             $remcmd = ['/usr/bin/ssh', '-e', 'none', '-T', '-o', 'BatchMode=yes', $remip];
1415         } else {
1416             $family = PVE::Tools::get_host_address_family($node);
1417         }
1418
1419         my $port = PVE::Tools::next_vnc_port($family);
1420
1421         my $timeout = 10;
1422
1423         my $realcmd = sub {
1424             my $upid = shift;
1425
1426             syslog('info', "starting vnc proxy $upid\n");
1427
1428             my $cmd;
1429
1430             if ($conf->{vga} && ($conf->{vga} =~ m/^serial\d+$/)) {
1431
1432                 die "Websocket mode is not supported in vga serial mode!" if $websocket;
1433
1434                 my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid, '-iface', $conf->{vga} ];
1435                 #my $termcmd = "/usr/bin/qm terminal -iface $conf->{vga}";
1436                 $cmd = ['/usr/bin/vncterm', '-rfbport', $port,
1437                         '-timeout', $timeout, '-authpath', $authpath,
1438                         '-perm', 'Sys.Console', '-c', @$remcmd, @$termcmd];
1439                 PVE::Tools::run_command($cmd);
1440             } else {
1441
1442                 $ENV{LC_PVE_TICKET} = $ticket if $websocket; # set ticket with "qm vncproxy"
1443
1444                 $cmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1445
1446                 my $sock = IO::Socket::IP->new(
1447                     ReuseAddr => 1,
1448                     Listen => 1,
1449                     LocalPort => $port,
1450                     Proto => 'tcp',
1451                     GetAddrInfoFlags => 0,
1452                     ) or die "failed to create socket: $!\n";
1453                 # Inside the worker we shouldn't have any previous alarms
1454                 # running anyway...:
1455                 alarm(0);
1456                 local $SIG{ALRM} = sub { die "connection timed out\n" };
1457                 alarm $timeout;
1458                 accept(my $cli, $sock) or die "connection failed: $!\n";
1459                 alarm(0);
1460                 close($sock);
1461                 if (PVE::Tools::run_command($cmd,
1462                     output => '>&'.fileno($cli),
1463                     input => '<&'.fileno($cli),
1464                     noerr => 1) != 0)
1465                 {
1466                     die "Failed to run vncproxy.\n";
1467                 }
1468             }
1469
1470             return;
1471         };
1472
1473         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1474
1475         PVE::Tools::wait_for_vnc_port($port);
1476
1477         return {
1478             user => $authuser,
1479             ticket => $ticket,
1480             port => $port,
1481             upid => $upid,
1482             cert => $sslcert,
1483         };
1484     }});
1485
1486 __PACKAGE__->register_method({
1487     name => 'termproxy',
1488     path => '{vmid}/termproxy',
1489     method => 'POST',
1490     protected => 1,
1491     permissions => {
1492         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1493     },
1494     description => "Creates a TCP proxy connections.",
1495     parameters => {
1496         additionalProperties => 0,
1497         properties => {
1498             node => get_standard_option('pve-node'),
1499             vmid => get_standard_option('pve-vmid'),
1500             serial=> {
1501                 optional => 1,
1502                 type => 'string',
1503                 enum => [qw(serial0 serial1 serial2 serial3)],
1504                 description => "opens a serial terminal (defaults to display)",
1505             },
1506         },
1507     },
1508     returns => {
1509         additionalProperties => 0,
1510         properties => {
1511             user => { type => 'string' },
1512             ticket => { type => 'string' },
1513             port => { type => 'integer' },
1514             upid => { type => 'string' },
1515         },
1516     },
1517     code => sub {
1518         my ($param) = @_;
1519
1520         my $rpcenv = PVE::RPCEnvironment::get();
1521
1522         my $authuser = $rpcenv->get_user();
1523
1524         my $vmid = $param->{vmid};
1525         my $node = $param->{node};
1526         my $serial = $param->{serial};
1527
1528         my $conf = PVE::QemuConfig->load_config($vmid, $node); # check if VM exists
1529
1530         if (!defined($serial)) {
1531             if ($conf->{vga} && $conf->{vga} =~ m/^serial\d+$/) {
1532                 $serial = $conf->{vga};
1533             }
1534         }
1535
1536         my $authpath = "/vms/$vmid";
1537
1538         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1539
1540         my ($remip, $family);
1541
1542         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1543             ($remip, $family) = PVE::Cluster::remote_node_ip($node);
1544         } else {
1545             $family = PVE::Tools::get_host_address_family($node);
1546         }
1547
1548         my $port = PVE::Tools::next_vnc_port($family);
1549
1550         my $remcmd = $remip ?
1551             ['/usr/bin/ssh', '-e', 'none', '-t', $remip, '--'] : [];
1552
1553         my $termcmd = [ '/usr/sbin/qm', 'terminal', $vmid];
1554         push @$termcmd, '-iface', $serial if $serial;
1555
1556         my $realcmd = sub {
1557             my $upid = shift;
1558
1559             syslog('info', "starting qemu termproxy $upid\n");
1560
1561             my $cmd = ['/usr/bin/termproxy', $port, '--path', $authpath,
1562                        '--perm', 'VM.Console', '--'];
1563             push @$cmd, @$remcmd, @$termcmd;
1564
1565             PVE::Tools::run_command($cmd);
1566         };
1567
1568         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd, 1);
1569
1570         PVE::Tools::wait_for_vnc_port($port);
1571
1572         return {
1573             user => $authuser,
1574             ticket => $ticket,
1575             port => $port,
1576             upid => $upid,
1577         };
1578     }});
1579
1580 __PACKAGE__->register_method({
1581     name => 'vncwebsocket',
1582     path => '{vmid}/vncwebsocket',
1583     method => 'GET',
1584     permissions => {
1585         description => "You also need to pass a valid ticket (vncticket).",
1586         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1587     },
1588     description => "Opens a weksocket for VNC traffic.",
1589     parameters => {
1590         additionalProperties => 0,
1591         properties => {
1592             node => get_standard_option('pve-node'),
1593             vmid => get_standard_option('pve-vmid'),
1594             vncticket => {
1595                 description => "Ticket from previous call to vncproxy.",
1596                 type => 'string',
1597                 maxLength => 512,
1598             },
1599             port => {
1600                 description => "Port number returned by previous vncproxy call.",
1601                 type => 'integer',
1602                 minimum => 5900,
1603                 maximum => 5999,
1604             },
1605         },
1606     },
1607     returns => {
1608         type => "object",
1609         properties => {
1610             port => { type => 'string' },
1611         },
1612     },
1613     code => sub {
1614         my ($param) = @_;
1615
1616         my $rpcenv = PVE::RPCEnvironment::get();
1617
1618         my $authuser = $rpcenv->get_user();
1619
1620         my $vmid = $param->{vmid};
1621         my $node = $param->{node};
1622
1623         my $authpath = "/vms/$vmid";
1624
1625         PVE::AccessControl::verify_vnc_ticket($param->{vncticket}, $authuser, $authpath);
1626
1627         my $conf = PVE::QemuConfig->load_config($vmid, $node); # VM exists ?
1628
1629         # Note: VNC ports are acessible from outside, so we do not gain any
1630         # security if we verify that $param->{port} belongs to VM $vmid. This
1631         # check is done by verifying the VNC ticket (inside VNC protocol).
1632
1633         my $port = $param->{port};
1634
1635         return { port => $port };
1636     }});
1637
1638 __PACKAGE__->register_method({
1639     name => 'spiceproxy',
1640     path => '{vmid}/spiceproxy',
1641     method => 'POST',
1642     protected => 1,
1643     proxyto => 'node',
1644     permissions => {
1645         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1646     },
1647     description => "Returns a SPICE configuration to connect to the VM.",
1648     parameters => {
1649         additionalProperties => 0,
1650         properties => {
1651             node => get_standard_option('pve-node'),
1652             vmid => get_standard_option('pve-vmid'),
1653             proxy => get_standard_option('spice-proxy', { optional => 1 }),
1654         },
1655     },
1656     returns => get_standard_option('remote-viewer-config'),
1657     code => sub {
1658         my ($param) = @_;
1659
1660         my $rpcenv = PVE::RPCEnvironment::get();
1661
1662         my $authuser = $rpcenv->get_user();
1663
1664         my $vmid = $param->{vmid};
1665         my $node = $param->{node};
1666         my $proxy = $param->{proxy};
1667
1668         my $conf = PVE::QemuConfig->load_config($vmid, $node);
1669         my $title = "VM $vmid";
1670         $title .= " - ". $conf->{name} if $conf->{name};
1671
1672         my $port = PVE::QemuServer::spice_port($vmid);
1673
1674         my ($ticket, undef, $remote_viewer_config) =
1675             PVE::AccessControl::remote_viewer_config($authuser, $vmid, $node, $proxy, $title, $port);
1676
1677         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1678         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1679
1680         return $remote_viewer_config;
1681     }});
1682
1683 __PACKAGE__->register_method({
1684     name => 'vmcmdidx',
1685     path => '{vmid}/status',
1686     method => 'GET',
1687     proxyto => 'node',
1688     description => "Directory index",
1689     permissions => {
1690         user => 'all',
1691     },
1692     parameters => {
1693         additionalProperties => 0,
1694         properties => {
1695             node => get_standard_option('pve-node'),
1696             vmid => get_standard_option('pve-vmid'),
1697         },
1698     },
1699     returns => {
1700         type => 'array',
1701         items => {
1702             type => "object",
1703             properties => {
1704                 subdir => { type => 'string' },
1705             },
1706         },
1707         links => [ { rel => 'child', href => "{subdir}" } ],
1708     },
1709     code => sub {
1710         my ($param) = @_;
1711
1712         # test if VM exists
1713         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1714
1715         my $res = [
1716             { subdir => 'current' },
1717             { subdir => 'start' },
1718             { subdir => 'stop' },
1719             ];
1720
1721         return $res;
1722     }});
1723
1724 __PACKAGE__->register_method({
1725     name => 'vm_status',
1726     path => '{vmid}/status/current',
1727     method => 'GET',
1728     proxyto => 'node',
1729     protected => 1, # qemu pid files are only readable by root
1730     description => "Get virtual machine status.",
1731     permissions => {
1732         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1733     },
1734     parameters => {
1735         additionalProperties => 0,
1736         properties => {
1737             node => get_standard_option('pve-node'),
1738             vmid => get_standard_option('pve-vmid'),
1739         },
1740     },
1741     returns => { type => 'object' },
1742     code => sub {
1743         my ($param) = @_;
1744
1745         # test if VM exists
1746         my $conf = PVE::QemuConfig->load_config($param->{vmid});
1747
1748         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1749         my $status = $vmstatus->{$param->{vmid}};
1750
1751         $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
1752
1753         $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
1754
1755         return $status;
1756     }});
1757
1758 __PACKAGE__->register_method({
1759     name => 'vm_start',
1760     path => '{vmid}/status/start',
1761     method => 'POST',
1762     protected => 1,
1763     proxyto => 'node',
1764     description => "Start virtual machine.",
1765     permissions => {
1766         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1767     },
1768     parameters => {
1769         additionalProperties => 0,
1770         properties => {
1771             node => get_standard_option('pve-node'),
1772             vmid => get_standard_option('pve-vmid',
1773                                         { completion => \&PVE::QemuServer::complete_vmid_stopped }),
1774             skiplock => get_standard_option('skiplock'),
1775             stateuri => get_standard_option('pve-qm-stateuri'),
1776             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1777             migration_type => {
1778                 type => 'string',
1779                 enum => ['secure', 'insecure'],
1780                 description => "Migration traffic is encrypted using an SSH " .
1781                   "tunnel by default. On secure, completely private networks " .
1782                   "this can be disabled to increase performance.",
1783                 optional => 1,
1784             },
1785             migration_network => {
1786                 type => 'string', format => 'CIDR',
1787                 description => "CIDR of the (sub) network that is used for migration.",
1788                 optional => 1,
1789             },
1790             machine => get_standard_option('pve-qm-machine'),
1791             targetstorage => {
1792                 description => "Target storage for the migration. (Can be '1' to use the same storage id as on the source node.)",
1793                 type => 'string',
1794                 optional => 1
1795             }
1796         },
1797     },
1798     returns => {
1799         type => 'string',
1800     },
1801     code => sub {
1802         my ($param) = @_;
1803
1804         my $rpcenv = PVE::RPCEnvironment::get();
1805
1806         my $authuser = $rpcenv->get_user();
1807
1808         my $node = extract_param($param, 'node');
1809
1810         my $vmid = extract_param($param, 'vmid');
1811
1812         my $machine = extract_param($param, 'machine');
1813
1814         my $stateuri = extract_param($param, 'stateuri');
1815         raise_param_exc({ stateuri => "Only root may use this option." })
1816             if $stateuri && $authuser ne 'root@pam';
1817
1818         my $skiplock = extract_param($param, 'skiplock');
1819         raise_param_exc({ skiplock => "Only root may use this option." })
1820             if $skiplock && $authuser ne 'root@pam';
1821
1822         my $migratedfrom = extract_param($param, 'migratedfrom');
1823         raise_param_exc({ migratedfrom => "Only root may use this option." })
1824             if $migratedfrom && $authuser ne 'root@pam';
1825
1826         my $migration_type = extract_param($param, 'migration_type');
1827         raise_param_exc({ migration_type => "Only root may use this option." })
1828             if $migration_type && $authuser ne 'root@pam';
1829
1830         my $migration_network = extract_param($param, 'migration_network');
1831         raise_param_exc({ migration_network => "Only root may use this option." })
1832             if $migration_network && $authuser ne 'root@pam';
1833
1834         my $targetstorage = extract_param($param, 'targetstorage');
1835         raise_param_exc({ targetstorage => "Only root may use this option." })
1836             if $targetstorage && $authuser ne 'root@pam';
1837
1838         raise_param_exc({ targetstorage => "targetstorage can only by used with migratedfrom." })
1839             if $targetstorage && !$migratedfrom;
1840
1841         # read spice ticket from STDIN
1842         my $spice_ticket;
1843         if ($stateuri && ($stateuri eq 'tcp') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
1844             if (defined(my $line = <>)) {
1845                 chomp $line;
1846                 $spice_ticket = $line;
1847             }
1848         }
1849
1850         PVE::Cluster::check_cfs_quorum();
1851
1852         my $storecfg = PVE::Storage::config();
1853
1854         if (PVE::HA::Config::vm_is_ha_managed($vmid) && !$stateuri &&
1855             $rpcenv->{type} ne 'ha') {
1856
1857             my $hacmd = sub {
1858                 my $upid = shift;
1859
1860                 my $service = "vm:$vmid";
1861
1862                 my $cmd = ['ha-manager', 'set', $service, '--state', 'started'];
1863
1864                 print "Requesting HA start for VM $vmid\n";
1865
1866                 PVE::Tools::run_command($cmd);
1867
1868                 return;
1869             };
1870
1871             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1872
1873         } else {
1874
1875             my $realcmd = sub {
1876                 my $upid = shift;
1877
1878                 syslog('info', "start VM $vmid: $upid\n");
1879
1880                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef,
1881                                           $machine, $spice_ticket, $migration_network, $migration_type, $targetstorage);
1882
1883                 return;
1884             };
1885
1886             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1887         }
1888     }});
1889
1890 __PACKAGE__->register_method({
1891     name => 'vm_stop',
1892     path => '{vmid}/status/stop',
1893     method => 'POST',
1894     protected => 1,
1895     proxyto => 'node',
1896     description => "Stop virtual machine. The qemu process will exit immediately. This" .
1897         "is akin to pulling the power plug of a running computer and may damage the VM data",
1898     permissions => {
1899         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1900     },
1901     parameters => {
1902         additionalProperties => 0,
1903         properties => {
1904             node => get_standard_option('pve-node'),
1905             vmid => get_standard_option('pve-vmid',
1906                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
1907             skiplock => get_standard_option('skiplock'),
1908             migratedfrom => get_standard_option('pve-node', { optional => 1 }),
1909             timeout => {
1910                 description => "Wait maximal timeout seconds.",
1911                 type => 'integer',
1912                 minimum => 0,
1913                 optional => 1,
1914             },
1915             keepActive => {
1916                 description => "Do not deactivate storage volumes.",
1917                 type => 'boolean',
1918                 optional => 1,
1919                 default => 0,
1920             }
1921         },
1922     },
1923     returns => {
1924         type => 'string',
1925     },
1926     code => sub {
1927         my ($param) = @_;
1928
1929         my $rpcenv = PVE::RPCEnvironment::get();
1930
1931         my $authuser = $rpcenv->get_user();
1932
1933         my $node = extract_param($param, 'node');
1934
1935         my $vmid = extract_param($param, 'vmid');
1936
1937         my $skiplock = extract_param($param, 'skiplock');
1938         raise_param_exc({ skiplock => "Only root may use this option." })
1939             if $skiplock && $authuser ne 'root@pam';
1940
1941         my $keepActive = extract_param($param, 'keepActive');
1942         raise_param_exc({ keepActive => "Only root may use this option." })
1943             if $keepActive && $authuser ne 'root@pam';
1944
1945         my $migratedfrom = extract_param($param, 'migratedfrom');
1946         raise_param_exc({ migratedfrom => "Only root may use this option." })
1947             if $migratedfrom && $authuser ne 'root@pam';
1948
1949
1950         my $storecfg = PVE::Storage::config();
1951
1952         if (PVE::HA::Config::vm_is_ha_managed($vmid) && ($rpcenv->{type} ne 'ha') && !defined($migratedfrom)) {
1953
1954             my $hacmd = sub {
1955                 my $upid = shift;
1956
1957                 my $service = "vm:$vmid";
1958
1959                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
1960
1961                 print "Requesting HA stop for VM $vmid\n";
1962
1963                 PVE::Tools::run_command($cmd);
1964
1965                 return;
1966             };
1967
1968             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1969
1970         } else {
1971             my $realcmd = sub {
1972                 my $upid = shift;
1973
1974                 syslog('info', "stop VM $vmid: $upid\n");
1975
1976                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1977                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1978
1979                 return;
1980             };
1981
1982             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1983         }
1984     }});
1985
1986 __PACKAGE__->register_method({
1987     name => 'vm_reset',
1988     path => '{vmid}/status/reset',
1989     method => 'POST',
1990     protected => 1,
1991     proxyto => 'node',
1992     description => "Reset virtual machine.",
1993     permissions => {
1994         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1995     },
1996     parameters => {
1997         additionalProperties => 0,
1998         properties => {
1999             node => get_standard_option('pve-node'),
2000             vmid => get_standard_option('pve-vmid',
2001                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2002             skiplock => get_standard_option('skiplock'),
2003         },
2004     },
2005     returns => {
2006         type => 'string',
2007     },
2008     code => sub {
2009         my ($param) = @_;
2010
2011         my $rpcenv = PVE::RPCEnvironment::get();
2012
2013         my $authuser = $rpcenv->get_user();
2014
2015         my $node = extract_param($param, 'node');
2016
2017         my $vmid = extract_param($param, 'vmid');
2018
2019         my $skiplock = extract_param($param, 'skiplock');
2020         raise_param_exc({ skiplock => "Only root may use this option." })
2021             if $skiplock && $authuser ne 'root@pam';
2022
2023         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2024
2025         my $realcmd = sub {
2026             my $upid = shift;
2027
2028             PVE::QemuServer::vm_reset($vmid, $skiplock);
2029
2030             return;
2031         };
2032
2033         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
2034     }});
2035
2036 __PACKAGE__->register_method({
2037     name => 'vm_shutdown',
2038     path => '{vmid}/status/shutdown',
2039     method => 'POST',
2040     protected => 1,
2041     proxyto => 'node',
2042     description => "Shutdown virtual machine. This is similar to pressing the power button on a physical machine." .
2043         "This will send an ACPI event for the guest OS, which should then proceed to a clean shutdown.",
2044     permissions => {
2045         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2046     },
2047     parameters => {
2048         additionalProperties => 0,
2049         properties => {
2050             node => get_standard_option('pve-node'),
2051             vmid => get_standard_option('pve-vmid',
2052                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2053             skiplock => get_standard_option('skiplock'),
2054             timeout => {
2055                 description => "Wait maximal timeout seconds.",
2056                 type => 'integer',
2057                 minimum => 0,
2058                 optional => 1,
2059             },
2060             forceStop => {
2061                 description => "Make sure the VM stops.",
2062                 type => 'boolean',
2063                 optional => 1,
2064                 default => 0,
2065             },
2066             keepActive => {
2067                 description => "Do not deactivate storage volumes.",
2068                 type => 'boolean',
2069                 optional => 1,
2070                 default => 0,
2071             }
2072         },
2073     },
2074     returns => {
2075         type => 'string',
2076     },
2077     code => sub {
2078         my ($param) = @_;
2079
2080         my $rpcenv = PVE::RPCEnvironment::get();
2081
2082         my $authuser = $rpcenv->get_user();
2083
2084         my $node = extract_param($param, 'node');
2085
2086         my $vmid = extract_param($param, 'vmid');
2087
2088         my $skiplock = extract_param($param, 'skiplock');
2089         raise_param_exc({ skiplock => "Only root may use this option." })
2090             if $skiplock && $authuser ne 'root@pam';
2091
2092         my $keepActive = extract_param($param, 'keepActive');
2093         raise_param_exc({ keepActive => "Only root may use this option." })
2094             if $keepActive && $authuser ne 'root@pam';
2095
2096         my $storecfg = PVE::Storage::config();
2097
2098         my $shutdown = 1;
2099
2100         # if vm is paused, do not shutdown (but stop if forceStop = 1)
2101         # otherwise, we will infer a shutdown command, but run into the timeout,
2102         # then when the vm is resumed, it will instantly shutdown
2103         #
2104         # checking the qmp status here to get feedback to the gui/cli/api
2105         # and the status query should not take too long
2106         my $qmpstatus;
2107         eval {
2108             $qmpstatus = PVE::QemuServer::vm_qmp_command($vmid, { execute => "query-status" }, 0);
2109         };
2110         my $err = $@ if $@;
2111
2112         if (!$err && $qmpstatus->{status} eq "paused") {
2113             if ($param->{forceStop}) {
2114                 warn "VM is paused - stop instead of shutdown\n";
2115                 $shutdown = 0;
2116             } else {
2117                 die "VM is paused - cannot shutdown\n";
2118             }
2119         }
2120
2121         if (PVE::HA::Config::vm_is_ha_managed($vmid) &&
2122             ($rpcenv->{type} ne 'ha')) {
2123
2124             my $hacmd = sub {
2125                 my $upid = shift;
2126
2127                 my $service = "vm:$vmid";
2128
2129                 my $cmd = ['ha-manager', 'set', $service, '--state', 'stopped'];
2130
2131                 print "Requesting HA stop for VM $vmid\n";
2132
2133                 PVE::Tools::run_command($cmd);
2134
2135                 return;
2136             };
2137
2138             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
2139
2140         } else {
2141
2142             my $realcmd = sub {
2143                 my $upid = shift;
2144
2145                 syslog('info', "shutdown VM $vmid: $upid\n");
2146
2147                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
2148                                          $shutdown, $param->{forceStop}, $keepActive);
2149
2150                 return;
2151             };
2152
2153             return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
2154         }
2155     }});
2156
2157 __PACKAGE__->register_method({
2158     name => 'vm_suspend',
2159     path => '{vmid}/status/suspend',
2160     method => 'POST',
2161     protected => 1,
2162     proxyto => 'node',
2163     description => "Suspend virtual machine.",
2164     permissions => {
2165         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2166     },
2167     parameters => {
2168         additionalProperties => 0,
2169         properties => {
2170             node => get_standard_option('pve-node'),
2171             vmid => get_standard_option('pve-vmid',
2172                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2173             skiplock => get_standard_option('skiplock'),
2174         },
2175     },
2176     returns => {
2177         type => 'string',
2178     },
2179     code => sub {
2180         my ($param) = @_;
2181
2182         my $rpcenv = PVE::RPCEnvironment::get();
2183
2184         my $authuser = $rpcenv->get_user();
2185
2186         my $node = extract_param($param, 'node');
2187
2188         my $vmid = extract_param($param, 'vmid');
2189
2190         my $skiplock = extract_param($param, 'skiplock');
2191         raise_param_exc({ skiplock => "Only root may use this option." })
2192             if $skiplock && $authuser ne 'root@pam';
2193
2194         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
2195
2196         my $realcmd = sub {
2197             my $upid = shift;
2198
2199             syslog('info', "suspend VM $vmid: $upid\n");
2200
2201             PVE::QemuServer::vm_suspend($vmid, $skiplock);
2202
2203             return;
2204         };
2205
2206         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
2207     }});
2208
2209 __PACKAGE__->register_method({
2210     name => 'vm_resume',
2211     path => '{vmid}/status/resume',
2212     method => 'POST',
2213     protected => 1,
2214     proxyto => 'node',
2215     description => "Resume virtual machine.",
2216     permissions => {
2217         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
2218     },
2219     parameters => {
2220         additionalProperties => 0,
2221         properties => {
2222             node => get_standard_option('pve-node'),
2223             vmid => get_standard_option('pve-vmid',
2224                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2225             skiplock => get_standard_option('skiplock'),
2226             nocheck => { type => 'boolean', optional => 1 },
2227
2228         },
2229     },
2230     returns => {
2231         type => 'string',
2232     },
2233     code => sub {
2234         my ($param) = @_;
2235
2236         my $rpcenv = PVE::RPCEnvironment::get();
2237
2238         my $authuser = $rpcenv->get_user();
2239
2240         my $node = extract_param($param, 'node');
2241
2242         my $vmid = extract_param($param, 'vmid');
2243
2244         my $skiplock = extract_param($param, 'skiplock');
2245         raise_param_exc({ skiplock => "Only root may use this option." })
2246             if $skiplock && $authuser ne 'root@pam';
2247
2248         my $nocheck = extract_param($param, 'nocheck');
2249
2250         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid, $nocheck);
2251
2252         my $realcmd = sub {
2253             my $upid = shift;
2254
2255             syslog('info', "resume VM $vmid: $upid\n");
2256
2257             PVE::QemuServer::vm_resume($vmid, $skiplock, $nocheck);
2258
2259             return;
2260         };
2261
2262         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
2263     }});
2264
2265 __PACKAGE__->register_method({
2266     name => 'vm_sendkey',
2267     path => '{vmid}/sendkey',
2268     method => 'PUT',
2269     protected => 1,
2270     proxyto => 'node',
2271     description => "Send key event to virtual machine.",
2272     permissions => {
2273         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
2274     },
2275     parameters => {
2276         additionalProperties => 0,
2277         properties => {
2278             node => get_standard_option('pve-node'),
2279             vmid => get_standard_option('pve-vmid',
2280                                         { completion => \&PVE::QemuServer::complete_vmid_running }),
2281             skiplock => get_standard_option('skiplock'),
2282             key => {
2283                 description => "The key (qemu monitor encoding).",
2284                 type => 'string'
2285             }
2286         },
2287     },
2288     returns => { type => 'null'},
2289     code => sub {
2290         my ($param) = @_;
2291
2292         my $rpcenv = PVE::RPCEnvironment::get();
2293
2294         my $authuser = $rpcenv->get_user();
2295
2296         my $node = extract_param($param, 'node');
2297
2298         my $vmid = extract_param($param, 'vmid');
2299
2300         my $skiplock = extract_param($param, 'skiplock');
2301         raise_param_exc({ skiplock => "Only root may use this option." })
2302             if $skiplock && $authuser ne 'root@pam';
2303
2304         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
2305
2306         return;
2307     }});
2308
2309 __PACKAGE__->register_method({
2310     name => 'vm_feature',
2311     path => '{vmid}/feature',
2312     method => 'GET',
2313     proxyto => 'node',
2314     protected => 1,
2315     description => "Check if feature for virtual machine is available.",
2316     permissions => {
2317         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2318     },
2319     parameters => {
2320         additionalProperties => 0,
2321         properties => {
2322             node => get_standard_option('pve-node'),
2323             vmid => get_standard_option('pve-vmid'),
2324             feature => {
2325                 description => "Feature to check.",
2326                 type => 'string',
2327                 enum => [ 'snapshot', 'clone', 'copy' ],
2328             },
2329             snapname => get_standard_option('pve-snapshot-name', {
2330                 optional => 1,
2331             }),
2332         },
2333     },
2334     returns => {
2335         type => "object",
2336         properties => {
2337             hasFeature => { type => 'boolean' },
2338             nodes => {
2339                 type => 'array',
2340                 items => { type => 'string' },
2341             }
2342         },
2343     },
2344     code => sub {
2345         my ($param) = @_;
2346
2347         my $node = extract_param($param, 'node');
2348
2349         my $vmid = extract_param($param, 'vmid');
2350
2351         my $snapname = extract_param($param, 'snapname');
2352
2353         my $feature = extract_param($param, 'feature');
2354
2355         my $running = PVE::QemuServer::check_running($vmid);
2356
2357         my $conf = PVE::QemuConfig->load_config($vmid);
2358
2359         if($snapname){
2360             my $snap = $conf->{snapshots}->{$snapname};
2361             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2362             $conf = $snap;
2363         }
2364         my $storecfg = PVE::Storage::config();
2365
2366         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
2367         my $hasFeature = PVE::QemuConfig->has_feature($feature, $conf, $storecfg, $snapname, $running);
2368
2369         return {
2370             hasFeature => $hasFeature,
2371             nodes => [ keys %$nodelist ],
2372         };
2373     }});
2374
2375 __PACKAGE__->register_method({
2376     name => 'clone_vm',
2377     path => '{vmid}/clone',
2378     method => 'POST',
2379     protected => 1,
2380     proxyto => 'node',
2381     description => "Create a copy of virtual machine/template.",
2382     permissions => {
2383         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2384             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2385             "'Datastore.AllocateSpace' on any used storage.",
2386         check =>
2387         [ 'and',
2388           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2389           [ 'or',
2390             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2391             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2392           ],
2393         ]
2394     },
2395     parameters => {
2396         additionalProperties => 0,
2397         properties => {
2398             node => get_standard_option('pve-node'),
2399             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2400             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2401             name => {
2402                 optional => 1,
2403                 type => 'string', format => 'dns-name',
2404                 description => "Set a name for the new VM.",
2405             },
2406             description => {
2407                 optional => 1,
2408                 type => 'string',
2409                 description => "Description for the new VM.",
2410             },
2411             pool => {
2412                 optional => 1,
2413                 type => 'string', format => 'pve-poolid',
2414                 description => "Add the new VM to the specified pool.",
2415             },
2416             snapname => get_standard_option('pve-snapshot-name', {
2417                 optional => 1,
2418             }),
2419             storage => get_standard_option('pve-storage-id', {
2420                 description => "Target storage for full clone.",
2421                 requires => 'full',
2422                 optional => 1,
2423             }),
2424             'format' => {
2425                 description => "Target format for file storage.",
2426                 requires => 'full',
2427                 type => 'string',
2428                 optional => 1,
2429                 enum => [ 'raw', 'qcow2', 'vmdk'],
2430             },
2431             full => {
2432                 optional => 1,
2433                 type => 'boolean',
2434                 description => "Create a full copy of all disk. This is always done when " .
2435                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2436                 default => 0,
2437             },
2438             target => get_standard_option('pve-node', {
2439                 description => "Target node. Only allowed if the original VM is on shared storage.",
2440                 optional => 1,
2441             }),
2442         },
2443     },
2444     returns => {
2445         type => 'string',
2446     },
2447     code => sub {
2448         my ($param) = @_;
2449
2450         my $rpcenv = PVE::RPCEnvironment::get();
2451
2452         my $authuser = $rpcenv->get_user();
2453
2454         my $node = extract_param($param, 'node');
2455
2456         my $vmid = extract_param($param, 'vmid');
2457
2458         my $newid = extract_param($param, 'newid');
2459
2460         my $pool = extract_param($param, 'pool');
2461
2462         if (defined($pool)) {
2463             $rpcenv->check_pool_exist($pool);
2464         }
2465
2466         my $snapname = extract_param($param, 'snapname');
2467
2468         my $storage = extract_param($param, 'storage');
2469
2470         my $format = extract_param($param, 'format');
2471
2472         my $target = extract_param($param, 'target');
2473
2474         my $localnode = PVE::INotify::nodename();
2475
2476         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2477
2478         PVE::Cluster::check_node_exists($target) if $target;
2479
2480         my $storecfg = PVE::Storage::config();
2481
2482         if ($storage) {
2483             # check if storage is enabled on local node
2484             PVE::Storage::storage_check_enabled($storecfg, $storage);
2485             if ($target) {
2486                 # check if storage is available on target node
2487                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2488                 # clone only works if target storage is shared
2489                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2490                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2491             }
2492         }
2493
2494         PVE::Cluster::check_cfs_quorum();
2495
2496         my $running = PVE::QemuServer::check_running($vmid) || 0;
2497
2498         # exclusive lock if VM is running - else shared lock is enough;
2499         my $shared_lock = $running ? 0 : 1;
2500
2501         my $clonefn = sub {
2502
2503             # do all tests after lock
2504             # we also try to do all tests before we fork the worker
2505
2506             my $conf = PVE::QemuConfig->load_config($vmid);
2507
2508             PVE::QemuConfig->check_lock($conf);
2509
2510             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2511
2512             die "unexpected state change\n" if $verify_running != $running;
2513
2514             die "snapshot '$snapname' does not exist\n"
2515                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2516
2517             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2518
2519             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2520
2521             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2522
2523             my $conffile = PVE::QemuConfig->config_file($newid);
2524
2525             die "unable to create VM $newid: config file already exists\n"
2526                 if -f $conffile;
2527
2528             my $newconf = { lock => 'clone' };
2529             my $drives = {};
2530             my $fullclone = {};
2531             my $vollist = [];
2532
2533             foreach my $opt (keys %$oldconf) {
2534                 my $value = $oldconf->{$opt};
2535
2536                 # do not copy snapshot related info
2537                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2538                     $opt eq 'vmstate' || $opt eq 'snapstate';
2539
2540                 # no need to copy unused images, because VMID(owner) changes anyways
2541                 next if $opt =~ m/^unused\d+$/;
2542
2543                 # always change MAC! address
2544                 if ($opt =~ m/^net(\d+)$/) {
2545                     my $net = PVE::QemuServer::parse_net($value);
2546                     my $dc = PVE::Cluster::cfs_read_file('datacenter.cfg');
2547                     $net->{macaddr} =  PVE::Tools::random_ether_addr($dc->{mac_prefix});
2548                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2549                 } elsif (PVE::QemuServer::is_valid_drivename($opt)) {
2550                     my $drive = PVE::QemuServer::parse_drive($opt, $value);
2551                     die "unable to parse drive options for '$opt'\n" if !$drive;
2552                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2553                         $newconf->{$opt} = $value; # simply copy configuration
2554                     } else {
2555                         if ($param->{full}) {
2556                             die "Full clone feature is not supported for drive '$opt'\n"
2557                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2558                             $fullclone->{$opt} = 1;
2559                         } else {
2560                             # not full means clone instead of copy
2561                             die "Linked clone feature is not supported for drive '$opt'\n"
2562                                 if !PVE::Storage::volume_has_feature($storecfg, 'clone', $drive->{file}, $snapname, $running);
2563                         }
2564                         $drives->{$opt} = $drive;
2565                         push @$vollist, $drive->{file};
2566                     }
2567                 } else {
2568                     # copy everything else
2569                     $newconf->{$opt} = $value;
2570                 }
2571             }
2572
2573             # auto generate a new uuid
2574             my ($uuid, $uuid_str);
2575             UUID::generate($uuid);
2576             UUID::unparse($uuid, $uuid_str);
2577             my $smbios1 = PVE::QemuServer::parse_smbios1($newconf->{smbios1} || '');
2578             $smbios1->{uuid} = $uuid_str;
2579             $newconf->{smbios1} = PVE::QemuServer::print_smbios1($smbios1);
2580
2581             delete $newconf->{template};
2582
2583             if ($param->{name}) {
2584                 $newconf->{name} = $param->{name};
2585             } else {
2586                 if ($oldconf->{name}) {
2587                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2588                 } else {
2589                     $newconf->{name} = "Copy-of-VM-$vmid";
2590                 }
2591             }
2592
2593             if ($param->{description}) {
2594                 $newconf->{description} = $param->{description};
2595             }
2596
2597             # create empty/temp config - this fails if VM already exists on other node
2598             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2599
2600             my $realcmd = sub {
2601                 my $upid = shift;
2602
2603                 my $newvollist = [];
2604                 my $jobs = {};
2605
2606                 eval {
2607                     local $SIG{INT} =
2608                         local $SIG{TERM} =
2609                         local $SIG{QUIT} =
2610                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2611
2612                     PVE::Storage::activate_volumes($storecfg, $vollist, $snapname);
2613
2614                     my $total_jobs = scalar(keys %{$drives});
2615                     my $i = 1;
2616
2617                     foreach my $opt (keys %$drives) {
2618                         my $drive = $drives->{$opt};
2619                         my $skipcomplete = ($total_jobs != $i); # finish after last drive
2620
2621                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2622                                                                    $newid, $storage, $format, $fullclone->{$opt}, $newvollist,
2623                                                                    $jobs, $skipcomplete, $oldconf->{agent});
2624
2625                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2626
2627                         PVE::QemuConfig->write_config($newid, $newconf);
2628                         $i++;
2629                     }
2630
2631                     delete $newconf->{lock};
2632                     PVE::QemuConfig->write_config($newid, $newconf);
2633
2634                     if ($target) {
2635                         # always deactivate volumes - avoid lvm LVs to be active on several nodes
2636                         PVE::Storage::deactivate_volumes($storecfg, $vollist, $snapname) if !$running;
2637                         PVE::Storage::deactivate_volumes($storecfg, $newvollist);
2638
2639                         my $newconffile = PVE::QemuConfig->config_file($newid, $target);
2640                         die "Failed to move config to node '$target' - rename failed: $!\n"
2641                             if !rename($conffile, $newconffile);
2642                     }
2643
2644                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2645                 };
2646                 if (my $err = $@) {
2647                     unlink $conffile;
2648
2649                     eval { PVE::QemuServer::qemu_blockjobs_cancel($vmid, $jobs) };
2650
2651                     sleep 1; # some storage like rbd need to wait before release volume - really?
2652
2653                     foreach my $volid (@$newvollist) {
2654                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2655                         warn $@ if $@;
2656                     }
2657                     die "clone failed: $err";
2658                 }
2659
2660                 return;
2661             };
2662
2663             PVE::Firewall::clone_vmfw_conf($vmid, $newid);
2664
2665             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2666         };
2667
2668         return PVE::QemuConfig->lock_config_mode($vmid, 1, $shared_lock, sub {
2669             # Aquire exclusive lock lock for $newid
2670             return PVE::QemuConfig->lock_config_full($newid, 1, $clonefn);
2671         });
2672
2673     }});
2674
2675 __PACKAGE__->register_method({
2676     name => 'move_vm_disk',
2677     path => '{vmid}/move_disk',
2678     method => 'POST',
2679     protected => 1,
2680     proxyto => 'node',
2681     description => "Move volume to different storage.",
2682     permissions => {
2683         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, and 'Datastore.AllocateSpace' permissions on the storage.",
2684         check => [ 'and',
2685                    ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2686                    ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2687             ],
2688     },
2689     parameters => {
2690         additionalProperties => 0,
2691         properties => {
2692             node => get_standard_option('pve-node'),
2693             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2694             disk => {
2695                 type => 'string',
2696                 description => "The disk you want to move.",
2697                 enum => [ PVE::QemuServer::valid_drive_names() ],
2698             },
2699             storage => get_standard_option('pve-storage-id', {
2700                 description => "Target storage.",
2701                 completion => \&PVE::QemuServer::complete_storage,
2702             }),
2703             'format' => {
2704                 type => 'string',
2705                 description => "Target Format.",
2706                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2707                 optional => 1,
2708             },
2709             delete => {
2710                 type => 'boolean',
2711                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2712                 optional => 1,
2713                 default => 0,
2714             },
2715             digest => {
2716                 type => 'string',
2717                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2718                 maxLength => 40,
2719                 optional => 1,
2720             },
2721         },
2722     },
2723     returns => {
2724         type => 'string',
2725         description => "the task ID.",
2726     },
2727     code => sub {
2728         my ($param) = @_;
2729
2730         my $rpcenv = PVE::RPCEnvironment::get();
2731
2732         my $authuser = $rpcenv->get_user();
2733
2734         my $node = extract_param($param, 'node');
2735
2736         my $vmid = extract_param($param, 'vmid');
2737
2738         my $digest = extract_param($param, 'digest');
2739
2740         my $disk = extract_param($param, 'disk');
2741
2742         my $storeid = extract_param($param, 'storage');
2743
2744         my $format = extract_param($param, 'format');
2745
2746         my $storecfg = PVE::Storage::config();
2747
2748         my $updatefn =  sub {
2749
2750             my $conf = PVE::QemuConfig->load_config($vmid);
2751
2752             PVE::QemuConfig->check_lock($conf);
2753
2754             die "checksum missmatch (file change by other user?)\n"
2755                 if $digest && $digest ne $conf->{digest};
2756
2757             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2758
2759             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2760
2761             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2762
2763             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2764
2765             my $oldfmt;
2766             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2767             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2768                 $oldfmt = $1;
2769             }
2770
2771             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2772                 (!$format || !$oldfmt || $oldfmt eq $format);
2773
2774             # this only checks snapshots because $disk is passed!
2775             my $snapshotted = PVE::QemuServer::is_volume_in_use($storecfg, $conf, $disk, $old_volid);
2776             die "you can't move a disk with snapshots and delete the source\n"
2777                 if $snapshotted && $param->{delete};
2778
2779             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2780
2781             my $running = PVE::QemuServer::check_running($vmid);
2782
2783             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2784
2785             my $realcmd = sub {
2786
2787                 my $newvollist = [];
2788
2789                 eval {
2790                     local $SIG{INT} =
2791                         local $SIG{TERM} =
2792                         local $SIG{QUIT} =
2793                         local $SIG{HUP} = sub { die "interrupted by signal\n"; };
2794
2795                     warn "moving disk with snapshots, snapshots will not be moved!\n"
2796                         if $snapshotted;
2797
2798                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2799                                                                $vmid, $storeid, $format, 1, $newvollist);
2800
2801                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2802
2803                     PVE::QemuConfig->add_unused_volume($conf, $old_volid) if !$param->{delete};
2804
2805                     # convert moved disk to base if part of template
2806                     PVE::QemuServer::template_create($vmid, $conf, $disk)
2807                         if PVE::QemuConfig->is_template($conf);
2808
2809                     PVE::QemuConfig->write_config($vmid, $conf);
2810
2811                     eval {
2812                         # try to deactivate volumes - avoid lvm LVs to be active on several nodes
2813                         PVE::Storage::deactivate_volumes($storecfg, [ $newdrive->{file} ])
2814                             if !$running;
2815                     };
2816                     warn $@ if $@;
2817                 };
2818                 if (my $err = $@) {
2819
2820                    foreach my $volid (@$newvollist) {
2821                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2822                         warn $@ if $@;
2823                     }
2824                     die "storage migration failed: $err";
2825                 }
2826
2827                 if ($param->{delete}) {
2828                     eval {
2829                         PVE::Storage::deactivate_volumes($storecfg, [$old_volid]);
2830                         PVE::Storage::vdisk_free($storecfg, $old_volid);
2831                     };
2832                     warn $@ if $@;
2833                 }
2834             };
2835
2836             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2837         };
2838
2839         return PVE::QemuConfig->lock_config($vmid, $updatefn);
2840     }});
2841
2842 __PACKAGE__->register_method({
2843     name => 'migrate_vm',
2844     path => '{vmid}/migrate',
2845     method => 'POST',
2846     protected => 1,
2847     proxyto => 'node',
2848     description => "Migrate virtual machine. Creates a new migration task.",
2849     permissions => {
2850         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2851     },
2852     parameters => {
2853         additionalProperties => 0,
2854         properties => {
2855             node => get_standard_option('pve-node'),
2856             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
2857             target => get_standard_option('pve-node', {
2858                 description => "Target node.",
2859                 completion =>  \&PVE::Cluster::complete_migration_target,
2860             }),
2861             online => {
2862                 type => 'boolean',
2863                 description => "Use online/live migration.",
2864                 optional => 1,
2865             },
2866             force => {
2867                 type => 'boolean',
2868                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2869                 optional => 1,
2870             },
2871             migration_type => {
2872                 type => 'string',
2873                 enum => ['secure', 'insecure'],
2874                 description => "Migration traffic is encrypted using an SSH tunnel by default. On secure, completely private networks this can be disabled to increase performance.",
2875                 optional => 1,
2876             },
2877             migration_network => {
2878                 type => 'string', format => 'CIDR',
2879                 description => "CIDR of the (sub) network that is used for migration.",
2880                 optional => 1,
2881             },
2882             "with-local-disks" => {
2883                 type => 'boolean',
2884                 description => "Enable live storage migration for local disk",
2885                 optional => 1,
2886             },
2887             targetstorage => get_standard_option('pve-storage-id', {
2888                 description => "Default target storage.",
2889                 optional => 1,
2890                 completion => \&PVE::QemuServer::complete_storage,
2891             }),
2892         },
2893     },
2894     returns => {
2895         type => 'string',
2896         description => "the task ID.",
2897     },
2898     code => sub {
2899         my ($param) = @_;
2900
2901         my $rpcenv = PVE::RPCEnvironment::get();
2902
2903         my $authuser = $rpcenv->get_user();
2904
2905         my $target = extract_param($param, 'target');
2906
2907         my $localnode = PVE::INotify::nodename();
2908         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2909
2910         PVE::Cluster::check_cfs_quorum();
2911
2912         PVE::Cluster::check_node_exists($target);
2913
2914         my $targetip = PVE::Cluster::remote_node_ip($target);
2915
2916         my $vmid = extract_param($param, 'vmid');
2917
2918         raise_param_exc({ targetstorage => "Live storage migration can only be done online." })
2919             if !$param->{online} && $param->{targetstorage};
2920
2921         raise_param_exc({ force => "Only root may use this option." })
2922             if $param->{force} && $authuser ne 'root@pam';
2923
2924         raise_param_exc({ migration_type => "Only root may use this option." })
2925             if $param->{migration_type} && $authuser ne 'root@pam';
2926
2927         # allow root only until better network permissions are available
2928         raise_param_exc({ migration_network => "Only root may use this option." })
2929             if $param->{migration_network} && $authuser ne 'root@pam';
2930
2931         # test if VM exists
2932         my $conf = PVE::QemuConfig->load_config($vmid);
2933
2934         # try to detect errors early
2935
2936         PVE::QemuConfig->check_lock($conf);
2937
2938         if (PVE::QemuServer::check_running($vmid)) {
2939             die "cant migrate running VM without --online\n"
2940                 if !$param->{online};
2941         }
2942
2943         my $storecfg = PVE::Storage::config();
2944
2945         if( $param->{targetstorage}) {
2946             PVE::Storage::storage_check_node($storecfg, $param->{targetstorage}, $target);
2947         } else {
2948             PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2949         }
2950
2951         if (PVE::HA::Config::vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2952
2953             my $hacmd = sub {
2954                 my $upid = shift;
2955
2956                 my $service = "vm:$vmid";
2957
2958                 my $cmd = ['ha-manager', 'migrate', $service, $target];
2959
2960                 print "Requesting HA migration for VM $vmid to node $target\n";
2961
2962                 PVE::Tools::run_command($cmd);
2963
2964                 return;
2965             };
2966
2967             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2968
2969         } else {
2970
2971             my $realcmd = sub {
2972                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2973             };
2974
2975             my $worker = sub {
2976                 return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
2977             };
2978
2979             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $worker);
2980         }
2981
2982     }});
2983
2984 __PACKAGE__->register_method({
2985     name => 'monitor',
2986     path => '{vmid}/monitor',
2987     method => 'POST',
2988     protected => 1,
2989     proxyto => 'node',
2990     description => "Execute Qemu monitor commands.",
2991     permissions => {
2992         description => "Sys.Modify is required for (sub)commands which are not read-only ('info *' and 'help')",
2993         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2994     },
2995     parameters => {
2996         additionalProperties => 0,
2997         properties => {
2998             node => get_standard_option('pve-node'),
2999             vmid => get_standard_option('pve-vmid'),
3000             command => {
3001                 type => 'string',
3002                 description => "The monitor command.",
3003             }
3004         },
3005     },
3006     returns => { type => 'string'},
3007     code => sub {
3008         my ($param) = @_;
3009
3010         my $rpcenv = PVE::RPCEnvironment::get();
3011         my $authuser = $rpcenv->get_user();
3012
3013         my $is_ro = sub {
3014             my $command = shift;
3015             return $command =~ m/^\s*info(\s+|$)/
3016                 || $command =~ m/^\s*help\s*$/;
3017         };
3018
3019         $rpcenv->check_full($authuser, "/", ['Sys.Modify'])
3020             if !&$is_ro($param->{command});
3021
3022         my $vmid = $param->{vmid};
3023
3024         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3025
3026         my $res = '';
3027         eval {
3028             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
3029         };
3030         $res = "ERROR: $@" if $@;
3031
3032         return $res;
3033     }});
3034
3035 my $guest_agent_commands = [
3036     'ping',
3037     'get-time',
3038     'info',
3039     'fsfreeze-status',
3040     'fsfreeze-freeze',
3041     'fsfreeze-thaw',
3042     'fstrim',
3043     'network-get-interfaces',
3044     'get-vcpus',
3045     'get-fsinfo',
3046     'get-memory-blocks',
3047     'get-memory-block-info',
3048     'suspend-hybrid',
3049     'suspend-ram',
3050     'suspend-disk',
3051     'shutdown',
3052     ];
3053
3054 __PACKAGE__->register_method({
3055     name => 'agent',
3056     path => '{vmid}/agent',
3057     method => 'POST',
3058     protected => 1,
3059     proxyto => 'node',
3060     description => "Execute Qemu Guest Agent commands.",
3061     permissions => {
3062         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
3063     },
3064     parameters => {
3065         additionalProperties => 0,
3066         properties => {
3067             node => get_standard_option('pve-node'),
3068             vmid => get_standard_option('pve-vmid', {
3069                    completion => \&PVE::QemuServer::complete_vmid_running }),
3070             command => {
3071                 type => 'string',
3072                 description => "The QGA command.",
3073                 enum => $guest_agent_commands,
3074             },
3075         },
3076     },
3077     returns => {
3078         type => 'object',
3079         description => "Returns an object with a single `result` property. The type of that
3080 property depends on the executed command.",
3081     },
3082     code => sub {
3083         my ($param) = @_;
3084
3085         my $vmid = $param->{vmid};
3086
3087         my $conf = PVE::QemuConfig->load_config ($vmid); # check if VM exists
3088
3089         die "No Qemu Guest Agent\n" if !defined($conf->{agent});
3090         die "VM $vmid is not running\n" if !PVE::QemuServer::check_running($vmid);
3091
3092         my $cmd = $param->{command};
3093
3094         my $res = PVE::QemuServer::vm_mon_cmd($vmid, "guest-$cmd");
3095
3096         return { result => $res };
3097     }});
3098
3099 __PACKAGE__->register_method({
3100     name => 'resize_vm',
3101     path => '{vmid}/resize',
3102     method => 'PUT',
3103     protected => 1,
3104     proxyto => 'node',
3105     description => "Extend volume size.",
3106     permissions => {
3107         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
3108     },
3109     parameters => {
3110         additionalProperties => 0,
3111         properties => {
3112             node => get_standard_option('pve-node'),
3113             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3114             skiplock => get_standard_option('skiplock'),
3115             disk => {
3116                 type => 'string',
3117                 description => "The disk you want to resize.",
3118                 enum => [PVE::QemuServer::valid_drive_names()],
3119             },
3120             size => {
3121                 type => 'string',
3122                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
3123                 description => "The new size. With the `+` sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
3124             },
3125             digest => {
3126                 type => 'string',
3127                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
3128                 maxLength => 40,
3129                 optional => 1,
3130             },
3131         },
3132     },
3133     returns => { type => 'null'},
3134     code => sub {
3135         my ($param) = @_;
3136
3137         my $rpcenv = PVE::RPCEnvironment::get();
3138
3139         my $authuser = $rpcenv->get_user();
3140
3141         my $node = extract_param($param, 'node');
3142
3143         my $vmid = extract_param($param, 'vmid');
3144
3145         my $digest = extract_param($param, 'digest');
3146
3147         my $disk = extract_param($param, 'disk');
3148
3149         my $sizestr = extract_param($param, 'size');
3150
3151         my $skiplock = extract_param($param, 'skiplock');
3152         raise_param_exc({ skiplock => "Only root may use this option." })
3153             if $skiplock && $authuser ne 'root@pam';
3154
3155         my $storecfg = PVE::Storage::config();
3156
3157         my $updatefn =  sub {
3158
3159             my $conf = PVE::QemuConfig->load_config($vmid);
3160
3161             die "checksum missmatch (file change by other user?)\n"
3162                 if $digest && $digest ne $conf->{digest};
3163             PVE::QemuConfig->check_lock($conf) if !$skiplock;
3164
3165             die "disk '$disk' does not exist\n" if !$conf->{$disk};
3166
3167             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
3168
3169             my (undef, undef, undef, undef, undef, undef, $format) =
3170                 PVE::Storage::parse_volname($storecfg, $drive->{file});
3171
3172             die "can't resize volume: $disk if snapshot exists\n"
3173                 if %{$conf->{snapshots}} && $format eq 'qcow2';
3174
3175             my $volid = $drive->{file};
3176
3177             die "disk '$disk' has no associated volume\n" if !$volid;
3178
3179             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
3180
3181             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
3182
3183             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
3184
3185             PVE::Storage::activate_volumes($storecfg, [$volid]);
3186             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
3187
3188             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
3189             my ($ext, $newsize, $unit) = ($1, $2, $4);
3190             if ($unit) {
3191                 if ($unit eq 'K') {
3192                     $newsize = $newsize * 1024;
3193                 } elsif ($unit eq 'M') {
3194                     $newsize = $newsize * 1024 * 1024;
3195                 } elsif ($unit eq 'G') {
3196                     $newsize = $newsize * 1024 * 1024 * 1024;
3197                 } elsif ($unit eq 'T') {
3198                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
3199                 }
3200             }
3201             $newsize += $size if $ext;
3202             $newsize = int($newsize);
3203
3204             die "shrinking disks is not supported\n" if $newsize < $size;
3205
3206             return if $size == $newsize;
3207
3208             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
3209
3210             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
3211
3212             $drive->{size} = $newsize;
3213             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
3214
3215             PVE::QemuConfig->write_config($vmid, $conf);
3216         };
3217
3218         PVE::QemuConfig->lock_config($vmid, $updatefn);
3219         return undef;
3220     }});
3221
3222 __PACKAGE__->register_method({
3223     name => 'snapshot_list',
3224     path => '{vmid}/snapshot',
3225     method => 'GET',
3226     description => "List all snapshots.",
3227     permissions => {
3228         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
3229     },
3230     proxyto => 'node',
3231     protected => 1, # qemu pid files are only readable by root
3232     parameters => {
3233         additionalProperties => 0,
3234         properties => {
3235             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3236             node => get_standard_option('pve-node'),
3237         },
3238     },
3239     returns => {
3240         type => 'array',
3241         items => {
3242             type => "object",
3243             properties => {},
3244         },
3245         links => [ { rel => 'child', href => "{name}" } ],
3246     },
3247     code => sub {
3248         my ($param) = @_;
3249
3250         my $vmid = $param->{vmid};
3251
3252         my $conf = PVE::QemuConfig->load_config($vmid);
3253         my $snaphash = $conf->{snapshots} || {};
3254
3255         my $res = [];
3256
3257         foreach my $name (keys %$snaphash) {
3258             my $d = $snaphash->{$name};
3259             my $item = {
3260                 name => $name,
3261                 snaptime => $d->{snaptime} || 0,
3262                 vmstate => $d->{vmstate} ? 1 : 0,
3263                 description => $d->{description} || '',
3264             };
3265             $item->{parent} = $d->{parent} if $d->{parent};
3266             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
3267             push @$res, $item;
3268         }
3269
3270         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
3271         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
3272         $current->{parent} = $conf->{parent} if $conf->{parent};
3273
3274         push @$res, $current;
3275
3276         return $res;
3277     }});
3278
3279 __PACKAGE__->register_method({
3280     name => 'snapshot',
3281     path => '{vmid}/snapshot',
3282     method => 'POST',
3283     protected => 1,
3284     proxyto => 'node',
3285     description => "Snapshot a VM.",
3286     permissions => {
3287         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3288     },
3289     parameters => {
3290         additionalProperties => 0,
3291         properties => {
3292             node => get_standard_option('pve-node'),
3293             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3294             snapname => get_standard_option('pve-snapshot-name'),
3295             vmstate => {
3296                 optional => 1,
3297                 type => 'boolean',
3298                 description => "Save the vmstate",
3299             },
3300             description => {
3301                 optional => 1,
3302                 type => 'string',
3303                 description => "A textual description or comment.",
3304             },
3305         },
3306     },
3307     returns => {
3308         type => 'string',
3309         description => "the task ID.",
3310     },
3311     code => sub {
3312         my ($param) = @_;
3313
3314         my $rpcenv = PVE::RPCEnvironment::get();
3315
3316         my $authuser = $rpcenv->get_user();
3317
3318         my $node = extract_param($param, 'node');
3319
3320         my $vmid = extract_param($param, 'vmid');
3321
3322         my $snapname = extract_param($param, 'snapname');
3323
3324         die "unable to use snapshot name 'current' (reserved name)\n"
3325             if $snapname eq 'current';
3326
3327         my $realcmd = sub {
3328             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
3329             PVE::QemuConfig->snapshot_create($vmid, $snapname, $param->{vmstate},
3330                                              $param->{description});
3331         };
3332
3333         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
3334     }});
3335
3336 __PACKAGE__->register_method({
3337     name => 'snapshot_cmd_idx',
3338     path => '{vmid}/snapshot/{snapname}',
3339     description => '',
3340     method => 'GET',
3341     permissions => {
3342         user => 'all',
3343     },
3344     parameters => {
3345         additionalProperties => 0,
3346         properties => {
3347             vmid => get_standard_option('pve-vmid'),
3348             node => get_standard_option('pve-node'),
3349             snapname => get_standard_option('pve-snapshot-name'),
3350         },
3351     },
3352     returns => {
3353         type => 'array',
3354         items => {
3355             type => "object",
3356             properties => {},
3357         },
3358         links => [ { rel => 'child', href => "{cmd}" } ],
3359     },
3360     code => sub {
3361         my ($param) = @_;
3362
3363         my $res = [];
3364
3365         push @$res, { cmd => 'rollback' };
3366         push @$res, { cmd => 'config' };
3367
3368         return $res;
3369     }});
3370
3371 __PACKAGE__->register_method({
3372     name => 'update_snapshot_config',
3373     path => '{vmid}/snapshot/{snapname}/config',
3374     method => 'PUT',
3375     protected => 1,
3376     proxyto => 'node',
3377     description => "Update snapshot metadata.",
3378     permissions => {
3379         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3380     },
3381     parameters => {
3382         additionalProperties => 0,
3383         properties => {
3384             node => get_standard_option('pve-node'),
3385             vmid => get_standard_option('pve-vmid'),
3386             snapname => get_standard_option('pve-snapshot-name'),
3387             description => {
3388                 optional => 1,
3389                 type => 'string',
3390                 description => "A textual description or comment.",
3391             },
3392         },
3393     },
3394     returns => { type => 'null' },
3395     code => sub {
3396         my ($param) = @_;
3397
3398         my $rpcenv = PVE::RPCEnvironment::get();
3399
3400         my $authuser = $rpcenv->get_user();
3401
3402         my $vmid = extract_param($param, 'vmid');
3403
3404         my $snapname = extract_param($param, 'snapname');
3405
3406         return undef if !defined($param->{description});
3407
3408         my $updatefn =  sub {
3409
3410             my $conf = PVE::QemuConfig->load_config($vmid);
3411
3412             PVE::QemuConfig->check_lock($conf);
3413
3414             my $snap = $conf->{snapshots}->{$snapname};
3415
3416             die "snapshot '$snapname' does not exist\n" if !defined($snap);
3417
3418             $snap->{description} = $param->{description} if defined($param->{description});
3419
3420              PVE::QemuConfig->write_config($vmid, $conf);
3421         };
3422
3423         PVE::QemuConfig->lock_config($vmid, $updatefn);
3424
3425         return undef;
3426     }});
3427
3428 __PACKAGE__->register_method({
3429     name => 'get_snapshot_config',
3430     path => '{vmid}/snapshot/{snapname}/config',
3431     method => 'GET',
3432     proxyto => 'node',
3433     description => "Get snapshot configuration",
3434     permissions => {
3435         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3436     },
3437     parameters => {
3438         additionalProperties => 0,
3439         properties => {
3440             node => get_standard_option('pve-node'),
3441             vmid => get_standard_option('pve-vmid'),
3442             snapname => get_standard_option('pve-snapshot-name'),
3443         },
3444     },
3445     returns => { type => "object" },
3446     code => sub {
3447         my ($param) = @_;
3448
3449         my $rpcenv = PVE::RPCEnvironment::get();
3450
3451         my $authuser = $rpcenv->get_user();
3452
3453         my $vmid = extract_param($param, 'vmid');
3454
3455         my $snapname = extract_param($param, 'snapname');
3456
3457         my $conf = PVE::QemuConfig->load_config($vmid);
3458
3459         my $snap = $conf->{snapshots}->{$snapname};
3460
3461         die "snapshot '$snapname' does not exist\n" if !defined($snap);
3462
3463         return $snap;
3464     }});
3465
3466 __PACKAGE__->register_method({
3467     name => 'rollback',
3468     path => '{vmid}/snapshot/{snapname}/rollback',
3469     method => 'POST',
3470     protected => 1,
3471     proxyto => 'node',
3472     description => "Rollback VM state to specified snapshot.",
3473     permissions => {
3474         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot', 'VM.Snapshot.Rollback' ], any => 1],
3475     },
3476     parameters => {
3477         additionalProperties => 0,
3478         properties => {
3479             node => get_standard_option('pve-node'),
3480             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3481             snapname => get_standard_option('pve-snapshot-name'),
3482         },
3483     },
3484     returns => {
3485         type => 'string',
3486         description => "the task ID.",
3487     },
3488     code => sub {
3489         my ($param) = @_;
3490
3491         my $rpcenv = PVE::RPCEnvironment::get();
3492
3493         my $authuser = $rpcenv->get_user();
3494
3495         my $node = extract_param($param, 'node');
3496
3497         my $vmid = extract_param($param, 'vmid');
3498
3499         my $snapname = extract_param($param, 'snapname');
3500
3501         my $realcmd = sub {
3502             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
3503             PVE::QemuConfig->snapshot_rollback($vmid, $snapname);
3504         };
3505
3506         my $worker = sub {
3507             # hold migration lock, this makes sure that nobody create replication snapshots
3508             return PVE::GuestHelpers::guest_migration_lock($vmid, 10, $realcmd);
3509         };
3510
3511         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $worker);
3512     }});
3513
3514 __PACKAGE__->register_method({
3515     name => 'delsnapshot',
3516     path => '{vmid}/snapshot/{snapname}',
3517     method => 'DELETE',
3518     protected => 1,
3519     proxyto => 'node',
3520     description => "Delete a VM snapshot.",
3521     permissions => {
3522         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
3523     },
3524     parameters => {
3525         additionalProperties => 0,
3526         properties => {
3527             node => get_standard_option('pve-node'),
3528             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid }),
3529             snapname => get_standard_option('pve-snapshot-name'),
3530             force => {
3531                 optional => 1,
3532                 type => 'boolean',
3533                 description => "For removal from config file, even if removing disk snapshots fails.",
3534             },
3535         },
3536     },
3537     returns => {
3538         type => 'string',
3539         description => "the task ID.",
3540     },
3541     code => sub {
3542         my ($param) = @_;
3543
3544         my $rpcenv = PVE::RPCEnvironment::get();
3545
3546         my $authuser = $rpcenv->get_user();
3547
3548         my $node = extract_param($param, 'node');
3549
3550         my $vmid = extract_param($param, 'vmid');
3551
3552         my $snapname = extract_param($param, 'snapname');
3553
3554         my $realcmd = sub {
3555             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
3556             PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
3557         };
3558
3559         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
3560     }});
3561
3562 __PACKAGE__->register_method({
3563     name => 'template',
3564     path => '{vmid}/template',
3565     method => 'POST',
3566     protected => 1,
3567     proxyto => 'node',
3568     description => "Create a Template.",
3569     permissions => {
3570         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3571         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3572     },
3573     parameters => {
3574         additionalProperties => 0,
3575         properties => {
3576             node => get_standard_option('pve-node'),
3577             vmid => get_standard_option('pve-vmid', { completion => \&PVE::QemuServer::complete_vmid_stopped }),
3578             disk => {
3579                 optional => 1,
3580                 type => 'string',
3581                 description => "If you want to convert only 1 disk to base image.",
3582                 enum => [PVE::QemuServer::valid_drive_names()],
3583             },
3584
3585         },
3586     },
3587     returns => { type => 'null'},
3588     code => sub {
3589         my ($param) = @_;
3590
3591         my $rpcenv = PVE::RPCEnvironment::get();
3592
3593         my $authuser = $rpcenv->get_user();
3594
3595         my $node = extract_param($param, 'node');
3596
3597         my $vmid = extract_param($param, 'vmid');
3598
3599         my $disk = extract_param($param, 'disk');
3600
3601         my $updatefn =  sub {
3602
3603             my $conf = PVE::QemuConfig->load_config($vmid);
3604
3605             PVE::QemuConfig->check_lock($conf);
3606
3607             die "unable to create template, because VM contains snapshots\n"
3608                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3609
3610             die "you can't convert a template to a template\n"
3611                 if PVE::QemuConfig->is_template($conf) && !$disk;
3612
3613             die "you can't convert a VM to template if VM is running\n"
3614                 if PVE::QemuServer::check_running($vmid);
3615
3616             my $realcmd = sub {
3617                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3618             };
3619
3620             $conf->{template} = 1;
3621             PVE::QemuConfig->write_config($vmid, $conf);
3622
3623             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3624         };
3625
3626         PVE::QemuConfig->lock_config($vmid, $updatefn);
3627         return undef;
3628     }});
3629
3630 1;