PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6
   7 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
   8 use PVE::SafeSyslog;
   9 use PVE::Tools qw(extract_param);
  10 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
  11 use PVE::Storage;
  12 use PVE::JSONSchema qw(get_standard_option);
  13 use PVE::RESTHandler;
  14 use PVE::QemuServer;
  15 use PVE::QemuMigrate;
  16 use PVE::RPCEnvironment;
  17 use PVE::AccessControl;
  18 use PVE::INotify;
  19 use PVE::Network;
  20
  21 use Data::Dumper; # fixme: remove
  22
  23 use base qw(PVE::RESTHandler);
  24
  25 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  26
  27 my $resolve_cdrom_alias = sub {
  28     my $param = shift;
  29
  30     if (my $value = $param->{cdrom}) {
  31         $value .= ",media=cdrom" if $value !~ m/media=/;
  32         $param->{ide2} = $value;
  33         delete $param->{cdrom};
  34     }
  35 };
  36
  37
  38 my $check_storage_access = sub {
  39    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  40
  41    PVE::QemuServer::foreach_drive($settings, sub {
  42         my ($ds, $drive) = @_;
  43
  44         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  45
  46         my $volid = $drive->{file};
  47
  48         if (!$volid || $volid eq 'none') {
  49             # nothing to check
  50         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  51             $rpcenv->check($authuser, "/", ['Sys.Console']);
  52         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  53             my ($storeid, $size) = ($2 || $default_storage, $3);
  54             die "no storage ID specified (and no default storage)\n" if !$storeid;
  55             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  56         } else {
  57             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  58         }
  59     });
  60 };
  61
  62 my $check_storage_access_clone = sub {
  63    my ($rpcenv, $authuser, $storecfg, $conf, $storage) = @_;
  64
  65    my $sharedvm = 1;
  66
  67    PVE::QemuServer::foreach_drive($conf, sub {
  68         my ($ds, $drive) = @_;
  69
  70         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  71
  72         my $volid = $drive->{file};
  73
  74         return if !$volid || $volid eq 'none';
  75
  76         if ($isCDROM) {
  77             if ($volid eq 'cdrom') {
  78                 $rpcenv->check($authuser, "/", ['Sys.Console']);
  79             } else {
  80                 # we simply allow access
  81                 my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  82                 my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  83                 $sharedvm = 0 if !$scfg->{shared};
  84
  85             }
  86         } else {
  87             my ($sid, $volname) = PVE::Storage::parse_volume_id($volid);
  88             my $scfg = PVE::Storage::storage_config($storecfg, $sid);
  89             $sharedvm = 0 if !$scfg->{shared};
  90
  91             $sid = $storage if $storage;
  92             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.AllocateSpace']);
  93         }
  94     });
  95
  96    return $sharedvm;
  97 };
  98
  99 # Note: $pool is only needed when creating a VM, because pool permissions
 100 # are automatically inherited if VM already exists inside a pool.
 101 my $create_disks = sub {
 102     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
 103
 104     my $vollist = [];
 105
 106     my $res = {};
 107     PVE::QemuServer::foreach_drive($settings, sub {
 108         my ($ds, $disk) = @_;
 109
 110         my $volid = $disk->{file};
 111
 112         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
 113             delete $disk->{size};
 114             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 115         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
 116             my ($storeid, $size) = ($2 || $default_storage, $3);
 117             die "no storage ID specified (and no default storage)\n" if !$storeid;
 118             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
 119             my $fmt = $disk->{format} || $defformat;
 120             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
 121                                                   $fmt, undef, $size*1024*1024);
 122             $disk->{file} = $volid;
 123             $disk->{size} = $size*1024*1024*1024;
 124             push @$vollist, $volid;
 125             delete $disk->{format}; # no longer needed
 126             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 127         } else {
 128
 129             my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
 130
 131             my $volid_is_new = 1;
 132
 133             if ($conf->{$ds}) {
 134                 my $olddrive = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 135                 $volid_is_new = undef if $olddrive->{file} && $olddrive->{file} eq $volid;
 136             }
 137
 138             if ($volid_is_new) {
 139
 140                 my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid, 1);
 141
 142                 PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 143
 144                 my $size = PVE::Storage::volume_size_info($storecfg, $volid);
 145
 146                 die "volume $volid does not exists\n" if !$size;
 147
 148                 $disk->{size} = $size;
 149             }
 150
 151             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
 152         }
 153     });
 154
 155     # free allocated images on error
 156     if (my $err = $@) {
 157         syslog('err', "VM $vmid creating disks failed");
 158         foreach my $volid (@$vollist) {
 159             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 160             warn $@ if $@;
 161         }
 162         die $err;
 163     }
 164
 165     # modify vm config if everything went well
 166     foreach my $ds (keys %$res) {
 167         $conf->{$ds} = $res->{$ds};
 168     }
 169
 170     return $vollist;
 171 };
 172
 173 my $check_vm_modify_config_perm = sub {
 174     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 175
 176     return 1 if $authuser eq 'root@pam';
 177
 178     foreach my $opt (@$key_list) {
 179         # disk checks need to be done somewhere else
 180         next if PVE::QemuServer::valid_drivename($opt);
 181
 182         if ($opt eq 'sockets' || $opt eq 'cores' ||
 183             $opt eq 'cpu' || $opt eq 'smp' ||
 184             $opt eq 'cpulimit' || $opt eq 'cpuunits') {
 185             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 186         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 187             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 188         } elsif ($opt eq 'memory' || $opt eq 'balloon' || $opt eq 'shares') {
 189             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 190         } elsif ($opt eq 'args' || $opt eq 'lock') {
 191             die "only root can set '$opt' config\n";
 192         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' || $opt eq 'machine' ||
 193                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet') {
 194             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 195         } elsif ($opt =~ m/^net\d+$/) {
 196             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 197         } else {
 198             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 199         }
 200     }
 201
 202     return 1;
 203 };
 204
 205 __PACKAGE__->register_method({
 206     name => 'vmlist',
 207     path => '',
 208     method => 'GET',
 209     description => "Virtual machine index (per node).",
 210     permissions => {
 211         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 212         user => 'all',
 213     },
 214     proxyto => 'node',
 215     protected => 1, # qemu pid files are only readable by root
 216     parameters => {
 217         additionalProperties => 0,
 218         properties => {
 219             node => get_standard_option('pve-node'),
 220         },
 221     },
 222     returns => {
 223         type => 'array',
 224         items => {
 225             type => "object",
 226             properties => {},
 227         },
 228         links => [ { rel => 'child', href => "{vmid}" } ],
 229     },
 230     code => sub {
 231         my ($param) = @_;
 232
 233         my $rpcenv = PVE::RPCEnvironment::get();
 234         my $authuser = $rpcenv->get_user();
 235
 236         my $vmstatus = PVE::QemuServer::vmstatus();
 237
 238         my $res = [];
 239         foreach my $vmid (keys %$vmstatus) {
 240             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 241
 242             my $data = $vmstatus->{$vmid};
 243             $data->{vmid} = $vmid;
 244             push @$res, $data;
 245         }
 246
 247         return $res;
 248     }});
 249
 250
 251
 252 __PACKAGE__->register_method({
 253     name => 'create_vm',
 254     path => '',
 255     method => 'POST',
 256     description => "Create or restore a virtual machine.",
 257     permissions => {
 258         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
 259             "For restore (option 'archive'), it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
 260             "If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 261         user => 'all', # check inside
 262     },
 263     protected => 1,
 264     proxyto => 'node',
 265     parameters => {
 266         additionalProperties => 0,
 267         properties => PVE::QemuServer::json_config_properties(
 268             {
 269                 node => get_standard_option('pve-node'),
 270                 vmid => get_standard_option('pve-vmid'),
 271                 archive => {
 272                     description => "The backup file.",
 273                     type => 'string',
 274                     optional => 1,
 275                     maxLength => 255,
 276                 },
 277                 storage => get_standard_option('pve-storage-id', {
 278                     description => "Default storage.",
 279                     optional => 1,
 280                 }),
 281                 force => {
 282                     optional => 1,
 283                     type => 'boolean',
 284                     description => "Allow to overwrite existing VM.",
 285                     requires => 'archive',
 286                 },
 287                 unique => {
 288                     optional => 1,
 289                     type => 'boolean',
 290                     description => "Assign a unique random ethernet address.",
 291                     requires => 'archive',
 292                 },
 293                 pool => {
 294                     optional => 1,
 295                     type => 'string', format => 'pve-poolid',
 296                     description => "Add the VM to the specified pool.",
 297                 },
 298             }),
 299     },
 300     returns => {
 301         type => 'string',
 302     },
 303     code => sub {
 304         my ($param) = @_;
 305
 306         my $rpcenv = PVE::RPCEnvironment::get();
 307
 308         my $authuser = $rpcenv->get_user();
 309
 310         my $node = extract_param($param, 'node');
 311
 312         my $vmid = extract_param($param, 'vmid');
 313
 314         my $archive = extract_param($param, 'archive');
 315
 316         my $storage = extract_param($param, 'storage');
 317
 318         my $force = extract_param($param, 'force');
 319
 320         my $unique = extract_param($param, 'unique');
 321
 322         my $pool = extract_param($param, 'pool');
 323
 324         my $filename = PVE::QemuServer::config_file($vmid);
 325
 326         my $storecfg = PVE::Storage::config();
 327
 328         PVE::Cluster::check_cfs_quorum();
 329
 330         if (defined($pool)) {
 331             $rpcenv->check_pool_exist($pool);
 332         }
 333
 334         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 335             if defined($storage);
 336
 337         if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
 338             # OK
 339         } elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
 340             # OK
 341         } elsif ($archive && $force && (-f $filename) &&
 342                  $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
 343             # OK: user has VM.Backup permissions, and want to restore an existing VM
 344         } else {
 345             raise_perm_exc();
 346         }
 347
 348         if (!$archive) {
 349             &$resolve_cdrom_alias($param);
 350
 351             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 352
 353             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 354
 355             foreach my $opt (keys %$param) {
 356                 if (PVE::QemuServer::valid_drivename($opt)) {
 357                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 358                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 359
 360                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 361                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 362                 }
 363             }
 364
 365             PVE::QemuServer::add_random_macs($param);
 366         } else {
 367             my $keystr = join(' ', keys %$param);
 368             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 369
 370             if ($archive eq '-') {
 371                 die "pipe requires cli environment\n"
 372                     if $rpcenv->{type} ne 'cli';
 373             } else {
 374                 my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $archive);
 375
 376                 PVE::Storage::activate_volumes($storecfg, [ $archive ])
 377                     if PVE::Storage::parse_volume_id ($archive, 1);
 378
 379                 die "can't find archive file '$archive'\n" if !($path && -f $path);
 380                 $archive = $path;
 381             }
 382         }
 383
 384         my $restorefn = sub {
 385
 386             # fixme: this test does not work if VM exists on other node!
 387             if (-f $filename) {
 388                 die "unable to restore vm $vmid: config file already exists\n"
 389                     if !$force;
 390
 391                 die "unable to restore vm $vmid: vm is running\n"
 392                     if PVE::QemuServer::check_running($vmid);
 393             }
 394
 395             my $realcmd = sub {
 396                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 397                     storage => $storage,
 398                     pool => $pool,
 399                     unique => $unique });
 400
 401                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 402             };
 403
 404             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 405         };
 406
 407         my $createfn = sub {
 408
 409             # test after locking
 410             die "unable to create vm $vmid: config file already exists\n"
 411                 if -f $filename;
 412
 413             my $realcmd = sub {
 414
 415                 my $vollist = [];
 416
 417                 my $conf = $param;
 418
 419                 eval {
 420
 421                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 422
 423                     # try to be smart about bootdisk
 424                     my @disks = PVE::QemuServer::disknames();
 425                     my $firstdisk;
 426                     foreach my $ds (reverse @disks) {
 427                         next if !$conf->{$ds};
 428                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 429                         next if PVE::QemuServer::drive_is_cdrom($disk);
 430                         $firstdisk = $ds;
 431                     }
 432
 433                     if (!$conf->{bootdisk} && $firstdisk) {
 434                         $conf->{bootdisk} = $firstdisk;
 435                     }
 436
 437                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 438
 439                 };
 440                 my $err = $@;
 441
 442                 if ($err) {
 443                     foreach my $volid (@$vollist) {
 444                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 445                         warn $@ if $@;
 446                     }
 447                     die "create failed - $err";
 448                 }
 449
 450                 PVE::AccessControl::add_vm_to_pool($vmid, $pool) if $pool;
 451             };
 452
 453             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 454         };
 455
 456         return PVE::QemuServer::lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 457     }});
 458
 459 __PACKAGE__->register_method({
 460     name => 'vmdiridx',
 461     path => '{vmid}',
 462     method => 'GET',
 463     proxyto => 'node',
 464     description => "Directory index",
 465     permissions => {
 466         user => 'all',
 467     },
 468     parameters => {
 469         additionalProperties => 0,
 470         properties => {
 471             node => get_standard_option('pve-node'),
 472             vmid => get_standard_option('pve-vmid'),
 473         },
 474     },
 475     returns => {
 476         type => 'array',
 477         items => {
 478             type => "object",
 479             properties => {
 480                 subdir => { type => 'string' },
 481             },
 482         },
 483         links => [ { rel => 'child', href => "{subdir}" } ],
 484     },
 485     code => sub {
 486         my ($param) = @_;
 487
 488         my $res = [
 489             { subdir => 'config' },
 490             { subdir => 'status' },
 491             { subdir => 'unlink' },
 492             { subdir => 'vncproxy' },
 493             { subdir => 'migrate' },
 494             { subdir => 'resize' },
 495             { subdir => 'move' },
 496             { subdir => 'rrd' },
 497             { subdir => 'rrddata' },
 498             { subdir => 'monitor' },
 499             { subdir => 'snapshot' },
 500             { subdir => 'spiceproxy' },
 501             ];
 502
 503         return $res;
 504     }});
 505
 506 __PACKAGE__->register_method({
 507     name => 'rrd',
 508     path => '{vmid}/rrd',
 509     method => 'GET',
 510     protected => 1, # fixme: can we avoid that?
 511     permissions => {
 512         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 513     },
 514     description => "Read VM RRD statistics (returns PNG)",
 515     parameters => {
 516         additionalProperties => 0,
 517         properties => {
 518             node => get_standard_option('pve-node'),
 519             vmid => get_standard_option('pve-vmid'),
 520             timeframe => {
 521                 description => "Specify the time frame you are interested in.",
 522                 type => 'string',
 523                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 524             },
 525             ds => {
 526                 description => "The list of datasources you want to display.",
 527                 type => 'string', format => 'pve-configid-list',
 528             },
 529             cf => {
 530                 description => "The RRD consolidation function",
 531                 type => 'string',
 532                 enum => [ 'AVERAGE', 'MAX' ],
 533                 optional => 1,
 534             },
 535         },
 536     },
 537     returns => {
 538         type => "object",
 539         properties => {
 540             filename => { type => 'string' },
 541         },
 542     },
 543     code => sub {
 544         my ($param) = @_;
 545
 546         return PVE::Cluster::create_rrd_graph(
 547             "pve2-vm/$param->{vmid}", $param->{timeframe},
 548             $param->{ds}, $param->{cf});
 549
 550     }});
 551
 552 __PACKAGE__->register_method({
 553     name => 'rrddata',
 554     path => '{vmid}/rrddata',
 555     method => 'GET',
 556     protected => 1, # fixme: can we avoid that?
 557     permissions => {
 558         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 559     },
 560     description => "Read VM RRD statistics",
 561     parameters => {
 562         additionalProperties => 0,
 563         properties => {
 564             node => get_standard_option('pve-node'),
 565             vmid => get_standard_option('pve-vmid'),
 566             timeframe => {
 567                 description => "Specify the time frame you are interested in.",
 568                 type => 'string',
 569                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 570             },
 571             cf => {
 572                 description => "The RRD consolidation function",
 573                 type => 'string',
 574                 enum => [ 'AVERAGE', 'MAX' ],
 575                 optional => 1,
 576             },
 577         },
 578     },
 579     returns => {
 580         type => "array",
 581         items => {
 582             type => "object",
 583             properties => {},
 584         },
 585     },
 586     code => sub {
 587         my ($param) = @_;
 588
 589         return PVE::Cluster::create_rrd_data(
 590             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 591     }});
 592
 593
 594 __PACKAGE__->register_method({
 595     name => 'vm_config',
 596     path => '{vmid}/config',
 597     method => 'GET',
 598     proxyto => 'node',
 599     description => "Get virtual machine configuration.",
 600     permissions => {
 601         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 602     },
 603     parameters => {
 604         additionalProperties => 0,
 605         properties => {
 606             node => get_standard_option('pve-node'),
 607             vmid => get_standard_option('pve-vmid'),
 608         },
 609     },
 610     returns => {
 611         type => "object",
 612         properties => {
 613             digest => {
 614                 type => 'string',
 615                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 616             }
 617         },
 618     },
 619     code => sub {
 620         my ($param) = @_;
 621
 622         my $conf = PVE::QemuServer::load_config($param->{vmid});
 623
 624         delete $conf->{snapshots};
 625
 626         return $conf;
 627     }});
 628
 629 my $vm_is_volid_owner = sub {
 630     my ($storecfg, $vmid, $volid) =@_;
 631
 632     if ($volid !~  m|^/|) {
 633         my ($path, $owner);
 634         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 635         if ($owner && ($owner == $vmid)) {
 636             return 1;
 637         }
 638     }
 639
 640     return undef;
 641 };
 642
 643 my $test_deallocate_drive = sub {
 644     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 645
 646     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 647         my $volid = $drive->{file};
 648         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 649             if ($force || $key =~ m/^unused/) {
 650                 my $sid = PVE::Storage::parse_volume_id($volid);
 651                 return $sid;
 652             }
 653         }
 654     }
 655
 656     return undef;
 657 };
 658
 659 my $delete_drive = sub {
 660     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 661
 662     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 663         my $volid = $drive->{file};
 664
 665         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 666             if ($force || $key =~ m/^unused/) {
 667                 eval {
 668                     # check if the disk is really unused
 669                     my $used_paths = PVE::QemuServer::get_used_paths($vmid, $storecfg, $conf, 1, $key);
 670                     my $path = PVE::Storage::path($storecfg, $volid);
 671
 672                     die "unable to delete '$volid' - volume is still in use (snapshot?)\n"
 673                         if $used_paths->{$path};
 674
 675                     PVE::Storage::vdisk_free($storecfg, $volid);
 676                 };
 677                 die $@ if $@;
 678             } else {
 679                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 680             }
 681         }
 682     }
 683
 684     delete $conf->{$key};
 685 };
 686
 687 my $vmconfig_delete_option = sub {
 688     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 689
 690     return if !defined($conf->{$opt});
 691
 692     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 693
 694     if ($isDisk) {
 695         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 696
 697         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 698         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 699             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.Allocate']);
 700         }
 701     }
 702
 703     my $unplugwarning = "";
 704     if($conf->{ostype} && $conf->{ostype} eq 'l26'){
 705         $unplugwarning = "<br>verify that you have acpiphp && pci_hotplug modules loaded in your guest VM";
 706     }elsif($conf->{ostype} && $conf->{ostype} eq 'l24'){
 707         $unplugwarning = "<br>kernel 2.4 don't support hotplug, please disable hotplug in options";
 708     }elsif(!$conf->{ostype} || ($conf->{ostype} && $conf->{ostype} eq 'other')){
 709         $unplugwarning = "<br>verify that your guest support acpi hotplug";
 710     }
 711
 712     if($opt eq 'tablet'){
 713         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
 714     }else{
 715         die "error hot-unplug $opt $unplugwarning" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 716     }
 717
 718     if ($isDisk) {
 719         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 720         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 721     } else {
 722         delete $conf->{$opt};
 723     }
 724
 725     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 726 };
 727
 728 my $safe_num_ne = sub {
 729     my ($a, $b) = @_;
 730
 731     return 0 if !defined($a) && !defined($b);
 732     return 1 if !defined($a);
 733     return 1 if !defined($b);
 734
 735     return $a != $b;
 736 };
 737
 738 my $vmconfig_update_disk = sub {
 739     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 740
 741     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 742
 743     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 744         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 745     } else {
 746         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 747     }
 748
 749     if ($conf->{$opt}) {
 750
 751         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 752
 753             my $media = $drive->{media} || 'disk';
 754             my $oldmedia = $old_drive->{media} || 'disk';
 755             die "unable to change media type\n" if $media ne $oldmedia;
 756
 757             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 758                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 759
 760                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 761                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 762             }
 763
 764             if(&$safe_num_ne($drive->{mbps}, $old_drive->{mbps}) ||
 765                &$safe_num_ne($drive->{mbps_rd}, $old_drive->{mbps_rd}) ||
 766                &$safe_num_ne($drive->{mbps_wr}, $old_drive->{mbps_wr}) ||
 767                &$safe_num_ne($drive->{iops}, $old_drive->{iops}) ||
 768                &$safe_num_ne($drive->{iops_rd}, $old_drive->{iops_rd}) ||
 769                &$safe_num_ne($drive->{iops_wr}, $old_drive->{iops_wr})) {
 770                PVE::QemuServer::qemu_block_set_io_throttle($vmid,"drive-$opt",
 771                                                            ($drive->{mbps} || 0)*1024*1024,
 772                                                            ($drive->{mbps_rd} || 0)*1024*1024,
 773                                                            ($drive->{mbps_wr} || 0)*1024*1024,
 774                                                            $drive->{iops} || 0,
 775                                                            $drive->{iops_rd} || 0,
 776                                                            $drive->{iops_wr} || 0)
 777                    if !PVE::QemuServer::drive_is_cdrom($drive);
 778             }
 779         }
 780     }
 781
 782     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 783     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 784
 785     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 786     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 787
 788     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 789
 790         if (PVE::QemuServer::check_running($vmid)) {
 791             if ($drive->{file} eq 'none') {
 792                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt");
 793             } else {
 794                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 795                 PVE::QemuServer::vm_mon_cmd($vmid, "eject",force => JSON::true,device => "drive-$opt"); #force eject if locked
 796                 PVE::QemuServer::vm_mon_cmd($vmid, "change",device => "drive-$opt",target => "$path") if $path;
 797             }
 798         }
 799
 800     } else { # hotplug new disks
 801
 802         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 803     }
 804 };
 805
 806 my $vmconfig_update_net = sub {
 807     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 808
 809     if ($conf->{$opt} && PVE::QemuServer::check_running($vmid)) {
 810         my $oldnet = PVE::QemuServer::parse_net($conf->{$opt});
 811         my $newnet = PVE::QemuServer::parse_net($value);
 812
 813         if($oldnet->{model} ne $newnet->{model}){
 814             #if model change, we try to hot-unplug
 815             die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 816         }else{
 817
 818             if($newnet->{bridge} && $oldnet->{bridge}){
 819                 my $iface = "tap".$vmid."i".$1 if $opt =~ m/net(\d+)/;
 820
 821                 if($newnet->{rate} ne $oldnet->{rate}){
 822                     PVE::Network::tap_rate_limit($iface, $newnet->{rate});
 823                 }
 824
 825                 if(($newnet->{bridge} ne $oldnet->{bridge}) || ($newnet->{tag} ne $oldnet->{tag})){
 826                     eval{PVE::Network::tap_unplug($iface, $oldnet->{bridge}, $oldnet->{tag});};
 827                     PVE::Network::tap_plug($iface, $newnet->{bridge}, $newnet->{tag});
 828                 }
 829
 830             }else{
 831                 #if bridge/nat mode change, we try to hot-unplug
 832                 die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 833             }
 834         }
 835
 836     }
 837     $conf->{$opt} = $value;
 838     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 839     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 840
 841     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 842
 843     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 844 };
 845
 846 # POST/PUT {vmid}/config implementation
 847 #
 848 # The original API used PUT (idempotent) an we assumed that all operations
 849 # are fast. But it turned out that almost any configuration change can
 850 # involve hot-plug actions, or disk alloc/free. Such actions can take long
 851 # time to complete and have side effects (not idempotent).
 852 #
 853 # The new implementation uses POST and forks a worker process. We added
 854 # a new option 'background_delay'. If specified we wait up to
 855 # 'background_delay' second for the worker task to complete. It returns null
 856 # if the task is finished within that time, else we return the UPID.
 857
 858 my $update_vm_api  = sub {
 859     my ($param, $sync) = @_;
 860
 861     my $rpcenv = PVE::RPCEnvironment::get();
 862
 863     my $authuser = $rpcenv->get_user();
 864
 865     my $node = extract_param($param, 'node');
 866
 867     my $vmid = extract_param($param, 'vmid');
 868
 869     my $digest = extract_param($param, 'digest');
 870
 871     my $background_delay = extract_param($param, 'background_delay');
 872
 873     my @paramarr = (); # used for log message
 874     foreach my $key (keys %$param) {
 875         push @paramarr, "-$key", $param->{$key};
 876     }
 877
 878     my $skiplock = extract_param($param, 'skiplock');
 879     raise_param_exc({ skiplock => "Only root may use this option." })
 880         if $skiplock && $authuser ne 'root@pam';
 881
 882     my $delete_str = extract_param($param, 'delete');
 883
 884     my $force = extract_param($param, 'force');
 885
 886     die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 887
 888     my $storecfg = PVE::Storage::config();
 889
 890     my $defaults = PVE::QemuServer::load_defaults();
 891
 892     &$resolve_cdrom_alias($param);
 893
 894     # now try to verify all parameters
 895
 896     my @delete = ();
 897     foreach my $opt (PVE::Tools::split_list($delete_str)) {
 898         $opt = 'ide2' if $opt eq 'cdrom';
 899         raise_param_exc({ delete => "you can't use '-$opt' and " .
 900                               "-delete $opt' at the same time" })
 901             if defined($param->{$opt});
 902
 903         if (!PVE::QemuServer::option_exists($opt)) {
 904             raise_param_exc({ delete => "unknown option '$opt'" });
 905         }
 906
 907         push @delete, $opt;
 908     }
 909
 910     foreach my $opt (keys %$param) {
 911         if (PVE::QemuServer::valid_drivename($opt)) {
 912             # cleanup drive path
 913             my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 914             PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 915             $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 916         } elsif ($opt =~ m/^net(\d+)$/) {
 917             # add macaddr
 918             my $net = PVE::QemuServer::parse_net($param->{$opt});
 919             $param->{$opt} = PVE::QemuServer::print_net($net);
 920         }
 921     }
 922
 923     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 924
 925     &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 926
 927     &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 928
 929     my $updatefn =  sub {
 930
 931         my $conf = PVE::QemuServer::load_config($vmid);
 932
 933         die "checksum missmatch (file change by other user?)\n"
 934             if $digest && $digest ne $conf->{digest};
 935
 936         PVE::QemuServer::check_lock($conf) if !$skiplock;
 937
 938         if ($param->{memory} || defined($param->{balloon})) {
 939             my $maxmem = $param->{memory} || $conf->{memory} || $defaults->{memory};
 940             my $balloon = defined($param->{balloon}) ?  $param->{balloon} : $conf->{balloon};
 941
 942             die "balloon value too large (must be smaller than assigned memory)\n"
 943                 if $balloon && $balloon > $maxmem;
 944         }
 945
 946         PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
 947
 948         my $worker = sub {
 949
 950             print "update VM $vmid: " . join (' ', @paramarr) . "\n";
 951
 952             foreach my $opt (@delete) { # delete
 953                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 954                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 955             }
 956
 957             my $running = PVE::QemuServer::check_running($vmid);
 958
 959             foreach my $opt (keys %$param) { # add/change
 960
 961                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 962
 963                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
 964
 965                 if (PVE::QemuServer::valid_drivename($opt)) {
 966
 967                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
 968                                            $opt, $param->{$opt}, $force);
 969
 970                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
 971
 972                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
 973                                           $opt, $param->{$opt});
 974
 975                 } else {
 976
 977                     if($opt eq 'tablet' && $param->{$opt} == 1){
 978                         PVE::QemuServer::vm_deviceplug(undef, $conf, $vmid, $opt);
 979                     } elsif($opt eq 'tablet' && $param->{$opt} == 0){
 980                         PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 981                     }
 982
 983                     $conf->{$opt} = $param->{$opt};
 984                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 985                 }
 986             }
 987
 988             # allow manual ballooning if shares is set to zero
 989             if ($running && defined($param->{balloon}) &&
 990                 defined($conf->{shares}) && ($conf->{shares} == 0)) {
 991                 my $balloon = $param->{'balloon'} || $conf->{memory} || $defaults->{memory};
 992                 PVE::QemuServer::vm_mon_cmd($vmid, "balloon", value => $balloon*1024*1024);
 993             }
 994         };
 995
 996         if ($sync) {
 997             &$worker();
 998             return undef;
 999         } else {
1000             my $upid = $rpcenv->fork_worker('qmconfig', $vmid, $authuser, $worker);
1001
1002             if ($background_delay) {
1003
1004                 # Note: It would be better to do that in the Event based HTTPServer
1005                 # to avoid blocking call to sleep.
1006
1007                 my $end_time = time() + $background_delay;
1008
1009                 my $task = PVE::Tools::upid_decode($upid);
1010
1011                 my $running = 1;
1012                 while (time() < $end_time) {
1013                     $running = PVE::ProcFSTools::check_process_running($task->{pid}, $task->{pstart});
1014                     last if !$running;
1015                     sleep(1); # this gets interrupted when child process ends
1016                 }
1017
1018                 if (!$running) {
1019                     my $status = PVE::Tools::upid_read_status($upid);
1020                     return undef if $status eq 'OK';
1021                     die $status;
1022                 }
1023             }
1024
1025             return $upid;
1026         }
1027     };
1028
1029     return PVE::QemuServer::lock_config($vmid, $updatefn);
1030 };
1031
1032 my $vm_config_perm_list = [
1033             'VM.Config.Disk',
1034             'VM.Config.CDROM',
1035             'VM.Config.CPU',
1036             'VM.Config.Memory',
1037             'VM.Config.Network',
1038             'VM.Config.HWType',
1039             'VM.Config.Options',
1040     ];
1041
1042 __PACKAGE__->register_method({
1043     name => 'update_vm_async',
1044     path => '{vmid}/config',
1045     method => 'POST',
1046     protected => 1,
1047     proxyto => 'node',
1048     description => "Set virtual machine options (asynchrounous API).",
1049     permissions => {
1050         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1051     },
1052     parameters => {
1053         additionalProperties => 0,
1054         properties => PVE::QemuServer::json_config_properties(
1055             {
1056                 node => get_standard_option('pve-node'),
1057                 vmid => get_standard_option('pve-vmid'),
1058                 skiplock => get_standard_option('skiplock'),
1059                 delete => {
1060                     type => 'string', format => 'pve-configid-list',
1061                     description => "A list of settings you want to delete.",
1062                     optional => 1,
1063                 },
1064                 force => {
1065                     type => 'boolean',
1066                     description => $opt_force_description,
1067                     optional => 1,
1068                     requires => 'delete',
1069                 },
1070                 digest => {
1071                     type => 'string',
1072                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1073                     maxLength => 40,
1074                     optional => 1,
1075                 },
1076                 background_delay => {
1077                     type => 'integer',
1078                     description => "Time to wait for the task to finish. We return 'null' if the task finish within that time.",
1079                     minimum => 1,
1080                     maximum => 30,
1081                     optional => 1,
1082                 },
1083             }),
1084     },
1085     returns => {
1086         type => 'string',
1087         optional => 1,
1088     },
1089     code => $update_vm_api,
1090 });
1091
1092 __PACKAGE__->register_method({
1093     name => 'update_vm',
1094     path => '{vmid}/config',
1095     method => 'PUT',
1096     protected => 1,
1097     proxyto => 'node',
1098     description => "Set virtual machine options (synchrounous API) - You should consider using the POST method instead for any actions involving hotplug or storage allocation.",
1099     permissions => {
1100         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
1101     },
1102     parameters => {
1103         additionalProperties => 0,
1104         properties => PVE::QemuServer::json_config_properties(
1105             {
1106                 node => get_standard_option('pve-node'),
1107                 vmid => get_standard_option('pve-vmid'),
1108                 skiplock => get_standard_option('skiplock'),
1109                 delete => {
1110                     type => 'string', format => 'pve-configid-list',
1111                     description => "A list of settings you want to delete.",
1112                     optional => 1,
1113                 },
1114                 force => {
1115                     type => 'boolean',
1116                     description => $opt_force_description,
1117                     optional => 1,
1118                     requires => 'delete',
1119                 },
1120                 digest => {
1121                     type => 'string',
1122                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
1123                     maxLength => 40,
1124                     optional => 1,
1125                 },
1126             }),
1127     },
1128     returns => { type => 'null' },
1129     code => sub {
1130         my ($param) = @_;
1131         &$update_vm_api($param, 1);
1132         return undef;
1133     }
1134 });
1135
1136
1137 __PACKAGE__->register_method({
1138     name => 'destroy_vm',
1139     path => '{vmid}',
1140     method => 'DELETE',
1141     protected => 1,
1142     proxyto => 'node',
1143     description => "Destroy the vm (also delete all used/owned volumes).",
1144     permissions => {
1145         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
1146     },
1147     parameters => {
1148         additionalProperties => 0,
1149         properties => {
1150             node => get_standard_option('pve-node'),
1151             vmid => get_standard_option('pve-vmid'),
1152             skiplock => get_standard_option('skiplock'),
1153         },
1154     },
1155     returns => {
1156         type => 'string',
1157     },
1158     code => sub {
1159         my ($param) = @_;
1160
1161         my $rpcenv = PVE::RPCEnvironment::get();
1162
1163         my $authuser = $rpcenv->get_user();
1164
1165         my $vmid = $param->{vmid};
1166
1167         my $skiplock = $param->{skiplock};
1168         raise_param_exc({ skiplock => "Only root may use this option." })
1169             if $skiplock && $authuser ne 'root@pam';
1170
1171         # test if VM exists
1172         my $conf = PVE::QemuServer::load_config($vmid);
1173
1174         my $storecfg = PVE::Storage::config();
1175
1176         my $delVMfromPoolFn = sub {
1177             my $usercfg = cfs_read_file("user.cfg");
1178             if (my $pool = $usercfg->{vms}->{$vmid}) {
1179                 if (my $data = $usercfg->{pools}->{$pool}) {
1180                     delete $data->{vms}->{$vmid};
1181                     delete $usercfg->{vms}->{$vmid};
1182                     cfs_write_file("user.cfg", $usercfg);
1183                 }
1184             }
1185         };
1186
1187         my $realcmd = sub {
1188             my $upid = shift;
1189
1190             syslog('info', "destroy VM $vmid: $upid\n");
1191
1192             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
1193
1194             PVE::AccessControl::remove_vm_from_pool($vmid);
1195         };
1196
1197         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
1198     }});
1199
1200 __PACKAGE__->register_method({
1201     name => 'unlink',
1202     path => '{vmid}/unlink',
1203     method => 'PUT',
1204     protected => 1,
1205     proxyto => 'node',
1206     description => "Unlink/delete disk images.",
1207     permissions => {
1208         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
1209     },
1210     parameters => {
1211         additionalProperties => 0,
1212         properties => {
1213             node => get_standard_option('pve-node'),
1214             vmid => get_standard_option('pve-vmid'),
1215             idlist => {
1216                 type => 'string', format => 'pve-configid-list',
1217                 description => "A list of disk IDs you want to delete.",
1218             },
1219             force => {
1220                 type => 'boolean',
1221                 description => $opt_force_description,
1222                 optional => 1,
1223             },
1224         },
1225     },
1226     returns => { type => 'null'},
1227     code => sub {
1228         my ($param) = @_;
1229
1230         $param->{delete} = extract_param($param, 'idlist');
1231
1232         __PACKAGE__->update_vm($param);
1233
1234         return undef;
1235     }});
1236
1237 my $sslcert;
1238
1239 __PACKAGE__->register_method({
1240     name => 'vncproxy',
1241     path => '{vmid}/vncproxy',
1242     method => 'POST',
1243     protected => 1,
1244     permissions => {
1245         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1246     },
1247     description => "Creates a TCP VNC proxy connections.",
1248     parameters => {
1249         additionalProperties => 0,
1250         properties => {
1251             node => get_standard_option('pve-node'),
1252             vmid => get_standard_option('pve-vmid'),
1253         },
1254     },
1255     returns => {
1256         additionalProperties => 0,
1257         properties => {
1258             user => { type => 'string' },
1259             ticket => { type => 'string' },
1260             cert => { type => 'string' },
1261             port => { type => 'integer' },
1262             upid => { type => 'string' },
1263         },
1264     },
1265     code => sub {
1266         my ($param) = @_;
1267
1268         my $rpcenv = PVE::RPCEnvironment::get();
1269
1270         my $authuser = $rpcenv->get_user();
1271
1272         my $vmid = $param->{vmid};
1273         my $node = $param->{node};
1274
1275         my $authpath = "/vms/$vmid";
1276
1277         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1278
1279         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1280             if !$sslcert;
1281
1282         my $port = PVE::Tools::next_vnc_port();
1283
1284         my $remip;
1285
1286         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1287             $remip = PVE::Cluster::remote_node_ip($node);
1288         }
1289
1290         # NOTE: kvm VNC traffic is already TLS encrypted
1291         my $remcmd = $remip ? ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes', $remip] : [];
1292
1293         my $timeout = 10;
1294
1295         my $realcmd = sub {
1296             my $upid = shift;
1297
1298             syslog('info', "starting vnc proxy $upid\n");
1299
1300             my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1301
1302             my $qmstr = join(' ', @$qmcmd);
1303
1304             # also redirect stderr (else we get RFB protocol errors)
1305             my $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1306
1307             PVE::Tools::run_command($cmd);
1308
1309             return;
1310         };
1311
1312         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1313
1314         PVE::Tools::wait_for_vnc_port($port);
1315
1316         return {
1317             user => $authuser,
1318             ticket => $ticket,
1319             port => $port,
1320             upid => $upid,
1321             cert => $sslcert,
1322         };
1323     }});
1324
1325 __PACKAGE__->register_method({
1326     name => 'spiceproxy',
1327     path => '{vmid}/spiceproxy',
1328     method => 'GET',
1329     protected => 1,
1330     proxyto => 'node', # fixme: use direct connections or ssh tunnel?
1331     permissions => {
1332         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1333     },
1334     description => "Returns a SPICE configuration to connect to the VM.",
1335     parameters => {
1336         additionalProperties => 0,
1337         properties => {
1338             node => get_standard_option('pve-node'),
1339             vmid => get_standard_option('pve-vmid'),
1340         },
1341     },
1342     returns => {
1343         additionalProperties => 1,
1344         properties => {
1345             type => { type => 'string' },
1346             password => { type => 'string' },
1347             proxy => { type => 'string' },
1348             host => { type => 'string' },
1349             port => { type => 'integer' },
1350         },
1351     },
1352     code => sub {
1353         my ($param) = @_;
1354
1355         my $rpcenv = PVE::RPCEnvironment::get();
1356
1357         my $authuser = $rpcenv->get_user();
1358
1359         my $vmid = $param->{vmid};
1360         my $node = $param->{node};
1361
1362         my $remip;
1363
1364         # Note: we currectly use "proxyto => 'node'", so this code will never trigger
1365         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1366             $remip = PVE::Cluster::remote_node_ip($node);
1367         }
1368
1369         my ($ticket, $proxyticket) = PVE::AccessControl::assemble_spice_ticket($authuser, $vmid, $node);
1370
1371         my $timeout = 10;
1372
1373         # Note: this only works if VM is on local node
1374         PVE::QemuServer::vm_mon_cmd($vmid, "set_password", protocol => 'spice', password => $ticket);
1375         PVE::QemuServer::vm_mon_cmd($vmid, "expire_password", protocol => 'spice', time => "+30");
1376
1377         # allow access for group www-data to the spice socket,
1378         # so that spiceproxy can access it
1379         my $socket =  PVE::QemuServer::spice_socket($vmid);
1380         my $gid = getgrnam('www-data') || die "getgrnam failed - $!\n";
1381         chown 0, $gid, $socket;
1382         chmod 0770, $socket;
1383
1384         # fimxe: ??
1385         my $host = `hostname -f` || PVE::INotify::nodename();
1386         chomp $host;
1387
1388         return {
1389             type => 'spice',
1390             host => $proxyticket,
1391             proxy => "http://$host:3128",
1392             port => 0, # not used for now
1393             password => $ticket
1394         };
1395     }});
1396
1397 __PACKAGE__->register_method({
1398     name => 'vmcmdidx',
1399     path => '{vmid}/status',
1400     method => 'GET',
1401     proxyto => 'node',
1402     description => "Directory index",
1403     permissions => {
1404         user => 'all',
1405     },
1406     parameters => {
1407         additionalProperties => 0,
1408         properties => {
1409             node => get_standard_option('pve-node'),
1410             vmid => get_standard_option('pve-vmid'),
1411         },
1412     },
1413     returns => {
1414         type => 'array',
1415         items => {
1416             type => "object",
1417             properties => {
1418                 subdir => { type => 'string' },
1419             },
1420         },
1421         links => [ { rel => 'child', href => "{subdir}" } ],
1422     },
1423     code => sub {
1424         my ($param) = @_;
1425
1426         # test if VM exists
1427         my $conf = PVE::QemuServer::load_config($param->{vmid});
1428
1429         my $res = [
1430             { subdir => 'current' },
1431             { subdir => 'start' },
1432             { subdir => 'stop' },
1433             ];
1434
1435         return $res;
1436     }});
1437
1438 my $vm_is_ha_managed = sub {
1439     my ($vmid) = @_;
1440
1441     my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1442     if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $vmid, 1)) {
1443         return 1;
1444     }
1445     return 0;
1446 };
1447
1448 __PACKAGE__->register_method({
1449     name => 'vm_status',
1450     path => '{vmid}/status/current',
1451     method => 'GET',
1452     proxyto => 'node',
1453     protected => 1, # qemu pid files are only readable by root
1454     description => "Get virtual machine status.",
1455     permissions => {
1456         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1457     },
1458     parameters => {
1459         additionalProperties => 0,
1460         properties => {
1461             node => get_standard_option('pve-node'),
1462             vmid => get_standard_option('pve-vmid'),
1463         },
1464     },
1465     returns => { type => 'object' },
1466     code => sub {
1467         my ($param) = @_;
1468
1469         # test if VM exists
1470         my $conf = PVE::QemuServer::load_config($param->{vmid});
1471
1472         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid}, 1);
1473         my $status = $vmstatus->{$param->{vmid}};
1474
1475         $status->{ha} = &$vm_is_ha_managed($param->{vmid});
1476
1477         if ($conf->{vga} && ($conf->{vga} eq 'qxl')) {
1478             $status->{spice} = 1;
1479         }
1480
1481         return $status;
1482     }});
1483
1484 __PACKAGE__->register_method({
1485     name => 'vm_start',
1486     path => '{vmid}/status/start',
1487     method => 'POST',
1488     protected => 1,
1489     proxyto => 'node',
1490     description => "Start virtual machine.",
1491     permissions => {
1492         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1493     },
1494     parameters => {
1495         additionalProperties => 0,
1496         properties => {
1497             node => get_standard_option('pve-node'),
1498             vmid => get_standard_option('pve-vmid'),
1499             skiplock => get_standard_option('skiplock'),
1500             stateuri => get_standard_option('pve-qm-stateuri'),
1501             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1502             machine => get_standard_option('pve-qm-machine'),
1503         },
1504     },
1505     returns => {
1506         type => 'string',
1507     },
1508     code => sub {
1509         my ($param) = @_;
1510
1511         my $rpcenv = PVE::RPCEnvironment::get();
1512
1513         my $authuser = $rpcenv->get_user();
1514
1515         my $node = extract_param($param, 'node');
1516
1517         my $vmid = extract_param($param, 'vmid');
1518
1519         my $machine = extract_param($param, 'machine');
1520
1521         my $stateuri = extract_param($param, 'stateuri');
1522         raise_param_exc({ stateuri => "Only root may use this option." })
1523             if $stateuri && $authuser ne 'root@pam';
1524
1525         my $skiplock = extract_param($param, 'skiplock');
1526         raise_param_exc({ skiplock => "Only root may use this option." })
1527             if $skiplock && $authuser ne 'root@pam';
1528
1529         my $migratedfrom = extract_param($param, 'migratedfrom');
1530         raise_param_exc({ migratedfrom => "Only root may use this option." })
1531             if $migratedfrom && $authuser ne 'root@pam';
1532
1533         my $storecfg = PVE::Storage::config();
1534
1535         if (&$vm_is_ha_managed($vmid) && !$stateuri &&
1536             $rpcenv->{type} ne 'ha') {
1537
1538             my $hacmd = sub {
1539                 my $upid = shift;
1540
1541                 my $service = "pvevm:$vmid";
1542
1543                 my $cmd = ['clusvcadm', '-e', $service, '-m', $node];
1544
1545                 print "Executing HA start for VM $vmid\n";
1546
1547                 PVE::Tools::run_command($cmd);
1548
1549                 return;
1550             };
1551
1552             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1553
1554         } else {
1555
1556             my $realcmd = sub {
1557                 my $upid = shift;
1558
1559                 syslog('info', "start VM $vmid: $upid\n");
1560
1561                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock, $migratedfrom, undef, $machine);
1562
1563                 return;
1564             };
1565
1566             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1567         }
1568     }});
1569
1570 __PACKAGE__->register_method({
1571     name => 'vm_stop',
1572     path => '{vmid}/status/stop',
1573     method => 'POST',
1574     protected => 1,
1575     proxyto => 'node',
1576     description => "Stop virtual machine.",
1577     permissions => {
1578         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1579     },
1580     parameters => {
1581         additionalProperties => 0,
1582         properties => {
1583             node => get_standard_option('pve-node'),
1584             vmid => get_standard_option('pve-vmid'),
1585             skiplock => get_standard_option('skiplock'),
1586             migratedfrom => get_standard_option('pve-node',{ optional => 1 }),
1587             timeout => {
1588                 description => "Wait maximal timeout seconds.",
1589                 type => 'integer',
1590                 minimum => 0,
1591                 optional => 1,
1592             },
1593             keepActive => {
1594                 description => "Do not decativate storage volumes.",
1595                 type => 'boolean',
1596                 optional => 1,
1597                 default => 0,
1598             }
1599         },
1600     },
1601     returns => {
1602         type => 'string',
1603     },
1604     code => sub {
1605         my ($param) = @_;
1606
1607         my $rpcenv = PVE::RPCEnvironment::get();
1608
1609         my $authuser = $rpcenv->get_user();
1610
1611         my $node = extract_param($param, 'node');
1612
1613         my $vmid = extract_param($param, 'vmid');
1614
1615         my $skiplock = extract_param($param, 'skiplock');
1616         raise_param_exc({ skiplock => "Only root may use this option." })
1617             if $skiplock && $authuser ne 'root@pam';
1618
1619         my $keepActive = extract_param($param, 'keepActive');
1620         raise_param_exc({ keepActive => "Only root may use this option." })
1621             if $keepActive && $authuser ne 'root@pam';
1622
1623         my $migratedfrom = extract_param($param, 'migratedfrom');
1624         raise_param_exc({ migratedfrom => "Only root may use this option." })
1625             if $migratedfrom && $authuser ne 'root@pam';
1626
1627
1628         my $storecfg = PVE::Storage::config();
1629
1630         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1631
1632             my $hacmd = sub {
1633                 my $upid = shift;
1634
1635                 my $service = "pvevm:$vmid";
1636
1637                 my $cmd = ['clusvcadm', '-d', $service];
1638
1639                 print "Executing HA stop for VM $vmid\n";
1640
1641                 PVE::Tools::run_command($cmd);
1642
1643                 return;
1644             };
1645
1646             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1647
1648         } else {
1649             my $realcmd = sub {
1650                 my $upid = shift;
1651
1652                 syslog('info', "stop VM $vmid: $upid\n");
1653
1654                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1655                                          $param->{timeout}, 0, 1, $keepActive, $migratedfrom);
1656
1657                 return;
1658             };
1659
1660             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1661         }
1662     }});
1663
1664 __PACKAGE__->register_method({
1665     name => 'vm_reset',
1666     path => '{vmid}/status/reset',
1667     method => 'POST',
1668     protected => 1,
1669     proxyto => 'node',
1670     description => "Reset virtual machine.",
1671     permissions => {
1672         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1673     },
1674     parameters => {
1675         additionalProperties => 0,
1676         properties => {
1677             node => get_standard_option('pve-node'),
1678             vmid => get_standard_option('pve-vmid'),
1679             skiplock => get_standard_option('skiplock'),
1680         },
1681     },
1682     returns => {
1683         type => 'string',
1684     },
1685     code => sub {
1686         my ($param) = @_;
1687
1688         my $rpcenv = PVE::RPCEnvironment::get();
1689
1690         my $authuser = $rpcenv->get_user();
1691
1692         my $node = extract_param($param, 'node');
1693
1694         my $vmid = extract_param($param, 'vmid');
1695
1696         my $skiplock = extract_param($param, 'skiplock');
1697         raise_param_exc({ skiplock => "Only root may use this option." })
1698             if $skiplock && $authuser ne 'root@pam';
1699
1700         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1701
1702         my $realcmd = sub {
1703             my $upid = shift;
1704
1705             PVE::QemuServer::vm_reset($vmid, $skiplock);
1706
1707             return;
1708         };
1709
1710         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1711     }});
1712
1713 __PACKAGE__->register_method({
1714     name => 'vm_shutdown',
1715     path => '{vmid}/status/shutdown',
1716     method => 'POST',
1717     protected => 1,
1718     proxyto => 'node',
1719     description => "Shutdown virtual machine.",
1720     permissions => {
1721         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1722     },
1723     parameters => {
1724         additionalProperties => 0,
1725         properties => {
1726             node => get_standard_option('pve-node'),
1727             vmid => get_standard_option('pve-vmid'),
1728             skiplock => get_standard_option('skiplock'),
1729             timeout => {
1730                 description => "Wait maximal timeout seconds.",
1731                 type => 'integer',
1732                 minimum => 0,
1733                 optional => 1,
1734             },
1735             forceStop => {
1736                 description => "Make sure the VM stops.",
1737                 type => 'boolean',
1738                 optional => 1,
1739                 default => 0,
1740             },
1741             keepActive => {
1742                 description => "Do not decativate storage volumes.",
1743                 type => 'boolean',
1744                 optional => 1,
1745                 default => 0,
1746             }
1747         },
1748     },
1749     returns => {
1750         type => 'string',
1751     },
1752     code => sub {
1753         my ($param) = @_;
1754
1755         my $rpcenv = PVE::RPCEnvironment::get();
1756
1757         my $authuser = $rpcenv->get_user();
1758
1759         my $node = extract_param($param, 'node');
1760
1761         my $vmid = extract_param($param, 'vmid');
1762
1763         my $skiplock = extract_param($param, 'skiplock');
1764         raise_param_exc({ skiplock => "Only root may use this option." })
1765             if $skiplock && $authuser ne 'root@pam';
1766
1767         my $keepActive = extract_param($param, 'keepActive');
1768         raise_param_exc({ keepActive => "Only root may use this option." })
1769             if $keepActive && $authuser ne 'root@pam';
1770
1771         my $storecfg = PVE::Storage::config();
1772
1773         my $realcmd = sub {
1774             my $upid = shift;
1775
1776             syslog('info', "shutdown VM $vmid: $upid\n");
1777
1778             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1779                                      1, $param->{forceStop}, $keepActive);
1780
1781             return;
1782         };
1783
1784         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1785     }});
1786
1787 __PACKAGE__->register_method({
1788     name => 'vm_suspend',
1789     path => '{vmid}/status/suspend',
1790     method => 'POST',
1791     protected => 1,
1792     proxyto => 'node',
1793     description => "Suspend virtual machine.",
1794     permissions => {
1795         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1796     },
1797     parameters => {
1798         additionalProperties => 0,
1799         properties => {
1800             node => get_standard_option('pve-node'),
1801             vmid => get_standard_option('pve-vmid'),
1802             skiplock => get_standard_option('skiplock'),
1803         },
1804     },
1805     returns => {
1806         type => 'string',
1807     },
1808     code => sub {
1809         my ($param) = @_;
1810
1811         my $rpcenv = PVE::RPCEnvironment::get();
1812
1813         my $authuser = $rpcenv->get_user();
1814
1815         my $node = extract_param($param, 'node');
1816
1817         my $vmid = extract_param($param, 'vmid');
1818
1819         my $skiplock = extract_param($param, 'skiplock');
1820         raise_param_exc({ skiplock => "Only root may use this option." })
1821             if $skiplock && $authuser ne 'root@pam';
1822
1823         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1824
1825         my $realcmd = sub {
1826             my $upid = shift;
1827
1828             syslog('info', "suspend VM $vmid: $upid\n");
1829
1830             PVE::QemuServer::vm_suspend($vmid, $skiplock);
1831
1832             return;
1833         };
1834
1835         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
1836     }});
1837
1838 __PACKAGE__->register_method({
1839     name => 'vm_resume',
1840     path => '{vmid}/status/resume',
1841     method => 'POST',
1842     protected => 1,
1843     proxyto => 'node',
1844     description => "Resume virtual machine.",
1845     permissions => {
1846         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1847     },
1848     parameters => {
1849         additionalProperties => 0,
1850         properties => {
1851             node => get_standard_option('pve-node'),
1852             vmid => get_standard_option('pve-vmid'),
1853             skiplock => get_standard_option('skiplock'),
1854         },
1855     },
1856     returns => {
1857         type => 'string',
1858     },
1859     code => sub {
1860         my ($param) = @_;
1861
1862         my $rpcenv = PVE::RPCEnvironment::get();
1863
1864         my $authuser = $rpcenv->get_user();
1865
1866         my $node = extract_param($param, 'node');
1867
1868         my $vmid = extract_param($param, 'vmid');
1869
1870         my $skiplock = extract_param($param, 'skiplock');
1871         raise_param_exc({ skiplock => "Only root may use this option." })
1872             if $skiplock && $authuser ne 'root@pam';
1873
1874         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1875
1876         my $realcmd = sub {
1877             my $upid = shift;
1878
1879             syslog('info', "resume VM $vmid: $upid\n");
1880
1881             PVE::QemuServer::vm_resume($vmid, $skiplock);
1882
1883             return;
1884         };
1885
1886         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
1887     }});
1888
1889 __PACKAGE__->register_method({
1890     name => 'vm_sendkey',
1891     path => '{vmid}/sendkey',
1892     method => 'PUT',
1893     protected => 1,
1894     proxyto => 'node',
1895     description => "Send key event to virtual machine.",
1896     permissions => {
1897         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1898     },
1899     parameters => {
1900         additionalProperties => 0,
1901         properties => {
1902             node => get_standard_option('pve-node'),
1903             vmid => get_standard_option('pve-vmid'),
1904             skiplock => get_standard_option('skiplock'),
1905             key => {
1906                 description => "The key (qemu monitor encoding).",
1907                 type => 'string'
1908             }
1909         },
1910     },
1911     returns => { type => 'null'},
1912     code => sub {
1913         my ($param) = @_;
1914
1915         my $rpcenv = PVE::RPCEnvironment::get();
1916
1917         my $authuser = $rpcenv->get_user();
1918
1919         my $node = extract_param($param, 'node');
1920
1921         my $vmid = extract_param($param, 'vmid');
1922
1923         my $skiplock = extract_param($param, 'skiplock');
1924         raise_param_exc({ skiplock => "Only root may use this option." })
1925             if $skiplock && $authuser ne 'root@pam';
1926
1927         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
1928
1929         return;
1930     }});
1931
1932 __PACKAGE__->register_method({
1933     name => 'vm_feature',
1934     path => '{vmid}/feature',
1935     method => 'GET',
1936     proxyto => 'node',
1937     protected => 1,
1938     description => "Check if feature for virtual machine is available.",
1939     permissions => {
1940         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1941     },
1942     parameters => {
1943         additionalProperties => 0,
1944         properties => {
1945             node => get_standard_option('pve-node'),
1946             vmid => get_standard_option('pve-vmid'),
1947             feature => {
1948                 description => "Feature to check.",
1949                 type => 'string',
1950                 enum => [ 'snapshot', 'clone', 'copy' ],
1951             },
1952             snapname => get_standard_option('pve-snapshot-name', {
1953                 optional => 1,
1954             }),
1955         },
1956     },
1957     returns => {
1958         type => "object",
1959         properties => {
1960             hasFeature => { type => 'boolean' },
1961             nodes => {
1962                 type => 'array',
1963                 items => { type => 'string' },
1964             }
1965         },
1966     },
1967     code => sub {
1968         my ($param) = @_;
1969
1970         my $node = extract_param($param, 'node');
1971
1972         my $vmid = extract_param($param, 'vmid');
1973
1974         my $snapname = extract_param($param, 'snapname');
1975
1976         my $feature = extract_param($param, 'feature');
1977
1978         my $running = PVE::QemuServer::check_running($vmid);
1979
1980         my $conf = PVE::QemuServer::load_config($vmid);
1981
1982         if($snapname){
1983             my $snap = $conf->{snapshots}->{$snapname};
1984             die "snapshot '$snapname' does not exist\n" if !defined($snap);
1985             $conf = $snap;
1986         }
1987         my $storecfg = PVE::Storage::config();
1988
1989         my $nodelist = PVE::QemuServer::shared_nodes($conf, $storecfg);
1990         my $hasFeature = PVE::QemuServer::has_feature($feature, $conf, $storecfg, $snapname, $running);
1991
1992         return {
1993             hasFeature => $hasFeature,
1994             nodes => [ keys %$nodelist ],
1995         };
1996     }});
1997
1998 __PACKAGE__->register_method({
1999     name => 'clone_vm',
2000     path => '{vmid}/clone',
2001     method => 'POST',
2002     protected => 1,
2003     proxyto => 'node',
2004     description => "Create a copy of virtual machine/template.",
2005     permissions => {
2006         description => "You need 'VM.Clone' permissions on /vms/{vmid}, and 'VM.Allocate' permissions " .
2007             "on /vms/{newid} (or on the VM pool /pool/{pool}). You also need " .
2008             "'Datastore.AllocateSpace' on any used storage.",
2009         check =>
2010         [ 'and',
2011           ['perm', '/vms/{vmid}', [ 'VM.Clone' ]],
2012           [ 'or',
2013             [ 'perm', '/vms/{newid}', ['VM.Allocate']],
2014             [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
2015           ],
2016         ]
2017     },
2018     parameters => {
2019         additionalProperties => 0,
2020         properties => {
2021             node => get_standard_option('pve-node'),
2022             vmid => get_standard_option('pve-vmid'),
2023             newid => get_standard_option('pve-vmid', { description => 'VMID for the clone.' }),
2024             name => {
2025                 optional => 1,
2026                 type => 'string', format => 'dns-name',
2027                 description => "Set a name for the new VM.",
2028             },
2029             description => {
2030                 optional => 1,
2031                 type => 'string',
2032                 description => "Description for the new VM.",
2033             },
2034             pool => {
2035                 optional => 1,
2036                 type => 'string', format => 'pve-poolid',
2037                 description => "Add the new VM to the specified pool.",
2038             },
2039             snapname => get_standard_option('pve-snapshot-name', {
2040                 requires => 'full',
2041                 optional => 1,
2042             }),
2043             storage => get_standard_option('pve-storage-id', {
2044                 description => "Target storage for full clone.",
2045                 requires => 'full',
2046                 optional => 1,
2047             }),
2048             'format' => {
2049                 description => "Target format for file storage.",
2050                 requires => 'full',
2051                 type => 'string',
2052                 optional => 1,
2053                 enum => [ 'raw', 'qcow2', 'vmdk'],
2054             },
2055             full => {
2056                 optional => 1,
2057                 type => 'boolean',
2058                 description => "Create a full copy of all disk. This is always done when " .
2059                     "you clone a normal VM. For VM templates, we try to create a linked clone by default.",
2060                 default => 0,
2061             },
2062             target => get_standard_option('pve-node', {
2063                 description => "Target node. Only allowed if the original VM is on shared storage.",
2064                 optional => 1,
2065             }),
2066         },
2067     },
2068     returns => {
2069         type => 'string',
2070     },
2071     code => sub {
2072         my ($param) = @_;
2073
2074         my $rpcenv = PVE::RPCEnvironment::get();
2075
2076         my $authuser = $rpcenv->get_user();
2077
2078         my $node = extract_param($param, 'node');
2079
2080         my $vmid = extract_param($param, 'vmid');
2081
2082         my $newid = extract_param($param, 'newid');
2083
2084         my $pool = extract_param($param, 'pool');
2085
2086         if (defined($pool)) {
2087             $rpcenv->check_pool_exist($pool);
2088         }
2089
2090         my $snapname = extract_param($param, 'snapname');
2091
2092         my $storage = extract_param($param, 'storage');
2093
2094         my $format = extract_param($param, 'format');
2095
2096         my $target = extract_param($param, 'target');
2097
2098         my $localnode = PVE::INotify::nodename();
2099
2100         undef $target if $target && ($target eq $localnode || $target eq 'localhost');
2101
2102         PVE::Cluster::check_node_exists($target) if $target;
2103
2104         my $storecfg = PVE::Storage::config();
2105
2106         if ($storage) {
2107             # check if storage is enabled on local node
2108             PVE::Storage::storage_check_enabled($storecfg, $storage);
2109             if ($target) {
2110                 # check if storage is available on target node
2111                 PVE::Storage::storage_check_node($storecfg, $storage, $target);
2112                 # clone only works if target storage is shared
2113                 my $scfg = PVE::Storage::storage_config($storecfg, $storage);
2114                 die "can't clone to non-shared storage '$storage'\n" if !$scfg->{shared};
2115             }
2116         }
2117
2118         PVE::Cluster::check_cfs_quorum();
2119
2120         my $running = PVE::QemuServer::check_running($vmid) || 0;
2121
2122         # exclusive lock if VM is running - else shared lock is enough;
2123         my $shared_lock = $running ? 0 : 1;
2124
2125         my $clonefn = sub {
2126
2127             # do all tests after lock
2128             # we also try to do all tests before we fork the worker
2129
2130             my $conf = PVE::QemuServer::load_config($vmid);
2131
2132             PVE::QemuServer::check_lock($conf);
2133
2134             my $verify_running = PVE::QemuServer::check_running($vmid) || 0;
2135
2136             die "unexpected state change\n" if $verify_running != $running;
2137
2138             die "snapshot '$snapname' does not exist\n"
2139                 if $snapname && !defined( $conf->{snapshots}->{$snapname});
2140
2141             my $oldconf = $snapname ? $conf->{snapshots}->{$snapname} : $conf;
2142
2143             my $sharedvm = &$check_storage_access_clone($rpcenv, $authuser, $storecfg, $oldconf, $storage);
2144
2145             die "can't clone VM to node '$target' (VM uses local storage)\n" if $target && !$sharedvm;
2146
2147             my $conffile = PVE::QemuServer::config_file($newid);
2148
2149             die "unable to create VM $newid: config file already exists\n"
2150                 if -f $conffile;
2151
2152             my $newconf = { lock => 'clone' };
2153             my $drives = {};
2154             my $vollist = [];
2155
2156             foreach my $opt (keys %$oldconf) {
2157                 my $value = $oldconf->{$opt};
2158
2159                 # do not copy snapshot related info
2160                 next if $opt eq 'snapshots' ||  $opt eq 'parent' || $opt eq 'snaptime' ||
2161                     $opt eq 'vmstate' || $opt eq 'snapstate';
2162
2163                 # always change MAC! address
2164                 if ($opt =~ m/^net(\d+)$/) {
2165                     my $net = PVE::QemuServer::parse_net($value);
2166                     $net->{macaddr} =  PVE::Tools::random_ether_addr();
2167                     $newconf->{$opt} = PVE::QemuServer::print_net($net);
2168                 } elsif (my $drive = PVE::QemuServer::parse_drive($opt, $value)) {
2169                     if (PVE::QemuServer::drive_is_cdrom($drive)) {
2170                         $newconf->{$opt} = $value; # simply copy configuration
2171                     } else {
2172                         if ($param->{full} || !PVE::Storage::volume_is_base($storecfg,  $drive->{file})) {
2173                             die "Full clone feature is not available"
2174                                 if !PVE::Storage::volume_has_feature($storecfg, 'copy', $drive->{file}, $snapname, $running);
2175                             $drive->{full} = 1;
2176                         }
2177                         $drives->{$opt} = $drive;
2178                         push @$vollist, $drive->{file};
2179                     }
2180                 } else {
2181                     # copy everything else
2182                     $newconf->{$opt} = $value;
2183                 }
2184             }
2185
2186             delete $newconf->{template};
2187
2188             if ($param->{name}) {
2189                 $newconf->{name} = $param->{name};
2190             } else {
2191                 if ($oldconf->{name}) {
2192                     $newconf->{name} = "Copy-of-$oldconf->{name}";
2193                 } else {
2194                     $newconf->{name} = "Copy-of-VM-$vmid";
2195                 }
2196             }
2197
2198             if ($param->{description}) {
2199                 $newconf->{description} = $param->{description};
2200             }
2201
2202             # create empty/temp config - this fails if VM already exists on other node
2203             PVE::Tools::file_set_contents($conffile, "# qmclone temporary file\nlock: clone\n");
2204
2205             my $realcmd = sub {
2206                 my $upid = shift;
2207
2208                 my $newvollist = [];
2209
2210                 eval {
2211                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2212
2213                     PVE::Storage::activate_volumes($storecfg, $vollist);
2214
2215                     foreach my $opt (keys %$drives) {
2216                         my $drive = $drives->{$opt};
2217
2218                         my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $opt, $drive, $snapname,
2219                                                                    $newid, $storage, $format, $drive->{full}, $newvollist);
2220
2221                         $newconf->{$opt} = PVE::QemuServer::print_drive($vmid, $newdrive);
2222
2223                         PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2224                     }
2225
2226                     delete $newconf->{lock};
2227                     PVE::QemuServer::update_config_nolock($newid, $newconf, 1);
2228
2229                     if ($target) {
2230                         my $newconffile = PVE::QemuServer::config_file($newid, $target);
2231                         die "Failed to move config to node '$target' - rename failed: $!\n"
2232                             if !rename($conffile, $newconffile);
2233                     }
2234
2235                     PVE::AccessControl::add_vm_to_pool($newid, $pool) if $pool;
2236                 };
2237                 if (my $err = $@) {
2238                     unlink $conffile;
2239
2240                     sleep 1; # some storage like rbd need to wait before release volume - really?
2241
2242                     foreach my $volid (@$newvollist) {
2243                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2244                         warn $@ if $@;
2245                     }
2246                     die "clone failed: $err";
2247                 }
2248
2249                 return;
2250             };
2251
2252             return $rpcenv->fork_worker('qmclone', $vmid, $authuser, $realcmd);
2253         };
2254
2255         return PVE::QemuServer::lock_config_mode($vmid, 1, $shared_lock, sub {
2256             # Aquire exclusive lock lock for $newid
2257             return PVE::QemuServer::lock_config_full($newid, 1, $clonefn);
2258         });
2259
2260     }});
2261
2262 __PACKAGE__->register_method({
2263     name => 'move_vm_disk',
2264     path => '{vmid}/move_disk',
2265     method => 'POST',
2266     protected => 1,
2267     proxyto => 'node',
2268     description => "Move volume to different storage.",
2269     permissions => {
2270         description => "You need 'VM.Config.Disk' permissions on /vms/{vmid}, " .
2271             "and 'Datastore.AllocateSpace' permissions on the storage.",
2272         check =>
2273         [ 'and',
2274           ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2275           ['perm', '/storage/{storage}', [ 'Datastore.AllocateSpace' ]],
2276         ],
2277     },
2278     parameters => {
2279         additionalProperties => 0,
2280         properties => {
2281             node => get_standard_option('pve-node'),
2282             vmid => get_standard_option('pve-vmid'),
2283             disk => {
2284                 type => 'string',
2285                 description => "The disk you want to move.",
2286                 enum => [ PVE::QemuServer::disknames() ],
2287             },
2288             storage => get_standard_option('pve-storage-id', { description => "Target Storage." }),
2289             'format' => {
2290                 type => 'string',
2291                 description => "Target Format.",
2292                 enum => [ 'raw', 'qcow2', 'vmdk' ],
2293                 optional => 1,
2294             },
2295             delete => {
2296                 type => 'boolean',
2297                 description => "Delete the original disk after successful copy. By default the original disk is kept as unused disk.",
2298                 optional => 1,
2299                 default => 0,
2300             },
2301             digest => {
2302                 type => 'string',
2303                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2304                 maxLength => 40,
2305                 optional => 1,
2306             },
2307         },
2308     },
2309     returns => {
2310         type => 'string',
2311         description => "the task ID.",
2312     },
2313     code => sub {
2314         my ($param) = @_;
2315
2316         my $rpcenv = PVE::RPCEnvironment::get();
2317
2318         my $authuser = $rpcenv->get_user();
2319
2320         my $node = extract_param($param, 'node');
2321
2322         my $vmid = extract_param($param, 'vmid');
2323
2324         my $digest = extract_param($param, 'digest');
2325
2326         my $disk = extract_param($param, 'disk');
2327
2328         my $storeid = extract_param($param, 'storage');
2329
2330         my $format = extract_param($param, 'format');
2331
2332         my $storecfg = PVE::Storage::config();
2333
2334         my $updatefn =  sub {
2335
2336             my $conf = PVE::QemuServer::load_config($vmid);
2337
2338             die "checksum missmatch (file change by other user?)\n"
2339                 if $digest && $digest ne $conf->{digest};
2340
2341             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2342
2343             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2344
2345             my $old_volid = $drive->{file} || die "disk '$disk' has no associated volume\n";
2346
2347             die "you can't move a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2348
2349             my $oldfmt;
2350             my ($oldstoreid, $oldvolname) = PVE::Storage::parse_volume_id($old_volid);
2351             if ($oldvolname =~ m/\.(raw|qcow2|vmdk)$/){
2352                 $oldfmt = $1;
2353             }
2354
2355             die "you can't move on the same storage with same format\n" if $oldstoreid eq $storeid &&
2356                 (!$format || !$oldfmt || $oldfmt eq $format);
2357
2358             PVE::Cluster::log_msg('info', $authuser, "move disk VM $vmid: move --disk $disk --storage $storeid");
2359
2360             my $running = PVE::QemuServer::check_running($vmid);
2361
2362             PVE::Storage::activate_volumes($storecfg, [ $drive->{file} ]);
2363
2364             my $realcmd = sub {
2365
2366                 my $newvollist = [];
2367
2368                 eval {
2369                     local $SIG{INT} = $SIG{TERM} = $SIG{QUIT} = $SIG{HUP} = sub { die "interrupted by signal\n"; };
2370
2371                     my $newdrive = PVE::QemuServer::clone_disk($storecfg, $vmid, $running, $disk, $drive, undef,
2372                                                                $vmid, $storeid, $format, 1, $newvollist);
2373
2374                     $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $newdrive);
2375
2376                     PVE::QemuServer::add_unused_volume($conf, $old_volid) if !$param->{delete};
2377
2378                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2379                 };
2380                 if (my $err = $@) {
2381
2382                    foreach my $volid (@$newvollist) {
2383                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
2384                         warn $@ if $@;
2385                     }
2386                     die "storage migration failed: $err";
2387                 }
2388
2389                 if ($param->{delete}) {
2390                     eval { PVE::Storage::vdisk_free($storecfg, $old_volid); };
2391                     warn $@ if $@;
2392                 }
2393             };
2394
2395             return $rpcenv->fork_worker('qmmove', $vmid, $authuser, $realcmd);
2396         };
2397
2398         return PVE::QemuServer::lock_config($vmid, $updatefn);
2399     }});
2400
2401 __PACKAGE__->register_method({
2402     name => 'migrate_vm',
2403     path => '{vmid}/migrate',
2404     method => 'POST',
2405     protected => 1,
2406     proxyto => 'node',
2407     description => "Migrate virtual machine. Creates a new migration task.",
2408     permissions => {
2409         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
2410     },
2411     parameters => {
2412         additionalProperties => 0,
2413         properties => {
2414             node => get_standard_option('pve-node'),
2415             vmid => get_standard_option('pve-vmid'),
2416             target => get_standard_option('pve-node', { description => "Target node." }),
2417             online => {
2418                 type => 'boolean',
2419                 description => "Use online/live migration.",
2420                 optional => 1,
2421             },
2422             force => {
2423                 type => 'boolean',
2424                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
2425                 optional => 1,
2426             },
2427         },
2428     },
2429     returns => {
2430         type => 'string',
2431         description => "the task ID.",
2432     },
2433     code => sub {
2434         my ($param) = @_;
2435
2436         my $rpcenv = PVE::RPCEnvironment::get();
2437
2438         my $authuser = $rpcenv->get_user();
2439
2440         my $target = extract_param($param, 'target');
2441
2442         my $localnode = PVE::INotify::nodename();
2443         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
2444
2445         PVE::Cluster::check_cfs_quorum();
2446
2447         PVE::Cluster::check_node_exists($target);
2448
2449         my $targetip = PVE::Cluster::remote_node_ip($target);
2450
2451         my $vmid = extract_param($param, 'vmid');
2452
2453         raise_param_exc({ force => "Only root may use this option." })
2454             if $param->{force} && $authuser ne 'root@pam';
2455
2456         # test if VM exists
2457         my $conf = PVE::QemuServer::load_config($vmid);
2458
2459         # try to detect errors early
2460
2461         PVE::QemuServer::check_lock($conf);
2462
2463         if (PVE::QemuServer::check_running($vmid)) {
2464             die "cant migrate running VM without --online\n"
2465                 if !$param->{online};
2466         }
2467
2468         my $storecfg = PVE::Storage::config();
2469         PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
2470
2471         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
2472
2473             my $hacmd = sub {
2474                 my $upid = shift;
2475
2476                 my $service = "pvevm:$vmid";
2477
2478                 my $cmd = ['clusvcadm', '-M', $service, '-m', $target];
2479
2480                 print "Executing HA migrate for VM $vmid to node $target\n";
2481
2482                 PVE::Tools::run_command($cmd);
2483
2484                 return;
2485             };
2486
2487             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
2488
2489         } else {
2490
2491             my $realcmd = sub {
2492                 my $upid = shift;
2493
2494                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
2495             };
2496
2497             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
2498         }
2499
2500     }});
2501
2502 __PACKAGE__->register_method({
2503     name => 'monitor',
2504     path => '{vmid}/monitor',
2505     method => 'POST',
2506     protected => 1,
2507     proxyto => 'node',
2508     description => "Execute Qemu monitor commands.",
2509     permissions => {
2510         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
2511     },
2512     parameters => {
2513         additionalProperties => 0,
2514         properties => {
2515             node => get_standard_option('pve-node'),
2516             vmid => get_standard_option('pve-vmid'),
2517             command => {
2518                 type => 'string',
2519                 description => "The monitor command.",
2520             }
2521         },
2522     },
2523     returns => { type => 'string'},
2524     code => sub {
2525         my ($param) = @_;
2526
2527         my $vmid = $param->{vmid};
2528
2529         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
2530
2531         my $res = '';
2532         eval {
2533             $res = PVE::QemuServer::vm_human_monitor_command($vmid, $param->{command});
2534         };
2535         $res = "ERROR: $@" if $@;
2536
2537         return $res;
2538     }});
2539
2540 __PACKAGE__->register_method({
2541     name => 'resize_vm',
2542     path => '{vmid}/resize',
2543     method => 'PUT',
2544     protected => 1,
2545     proxyto => 'node',
2546     description => "Extend volume size.",
2547     permissions => {
2548         check => ['perm', '/vms/{vmid}', [ 'VM.Config.Disk' ]],
2549     },
2550     parameters => {
2551         additionalProperties => 0,
2552         properties => {
2553             node => get_standard_option('pve-node'),
2554             vmid => get_standard_option('pve-vmid'),
2555             skiplock => get_standard_option('skiplock'),
2556             disk => {
2557                 type => 'string',
2558                 description => "The disk you want to resize.",
2559                 enum => [PVE::QemuServer::disknames()],
2560             },
2561             size => {
2562                 type => 'string',
2563                 pattern => '\+?\d+(\.\d+)?[KMGT]?',
2564                 description => "The new size. With the '+' sign the value is added to the actual size of the volume and without it, the value is taken as an absolute one. Shrinking disk size is not supported.",
2565             },
2566             digest => {
2567                 type => 'string',
2568                 description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
2569                 maxLength => 40,
2570                 optional => 1,
2571             },
2572         },
2573     },
2574     returns => { type => 'null'},
2575     code => sub {
2576         my ($param) = @_;
2577
2578         my $rpcenv = PVE::RPCEnvironment::get();
2579
2580         my $authuser = $rpcenv->get_user();
2581
2582         my $node = extract_param($param, 'node');
2583
2584         my $vmid = extract_param($param, 'vmid');
2585
2586         my $digest = extract_param($param, 'digest');
2587
2588         my $disk = extract_param($param, 'disk');
2589
2590         my $sizestr = extract_param($param, 'size');
2591
2592         my $skiplock = extract_param($param, 'skiplock');
2593         raise_param_exc({ skiplock => "Only root may use this option." })
2594             if $skiplock && $authuser ne 'root@pam';
2595
2596         my $storecfg = PVE::Storage::config();
2597
2598         my $updatefn =  sub {
2599
2600             my $conf = PVE::QemuServer::load_config($vmid);
2601
2602             die "checksum missmatch (file change by other user?)\n"
2603                 if $digest && $digest ne $conf->{digest};
2604             PVE::QemuServer::check_lock($conf) if !$skiplock;
2605
2606             die "disk '$disk' does not exist\n" if !$conf->{$disk};
2607
2608             my $drive = PVE::QemuServer::parse_drive($disk, $conf->{$disk});
2609
2610             my $volid = $drive->{file};
2611
2612             die "disk '$disk' has no associated volume\n" if !$volid;
2613
2614             die "you can't resize a cdrom\n" if PVE::QemuServer::drive_is_cdrom($drive);
2615
2616             die "you can't online resize a virtio windows bootdisk\n"
2617                 if PVE::QemuServer::check_running($vmid) && $conf->{bootdisk} eq $disk && $conf->{ostype} =~ m/^w/ && $disk =~ m/^virtio/;
2618
2619             my ($storeid, $volname) = PVE::Storage::parse_volume_id($volid);
2620
2621             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
2622
2623             my $size = PVE::Storage::volume_size_info($storecfg, $volid, 5);
2624
2625             die "internal error" if $sizestr !~ m/^(\+)?(\d+(\.\d+)?)([KMGT])?$/;
2626             my ($ext, $newsize, $unit) = ($1, $2, $4);
2627             if ($unit) {
2628                 if ($unit eq 'K') {
2629                     $newsize = $newsize * 1024;
2630                 } elsif ($unit eq 'M') {
2631                     $newsize = $newsize * 1024 * 1024;
2632                 } elsif ($unit eq 'G') {
2633                     $newsize = $newsize * 1024 * 1024 * 1024;
2634                 } elsif ($unit eq 'T') {
2635                     $newsize = $newsize * 1024 * 1024 * 1024 * 1024;
2636                 }
2637             }
2638             $newsize += $size if $ext;
2639             $newsize = int($newsize);
2640
2641             die "unable to skrink disk size\n" if $newsize < $size;
2642
2643             return if $size == $newsize;
2644
2645             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: resize --disk $disk --size $sizestr");
2646
2647             PVE::QemuServer::qemu_block_resize($vmid, "drive-$disk", $storecfg, $volid, $newsize);
2648
2649             $drive->{size} = $newsize;
2650             $conf->{$disk} = PVE::QemuServer::print_drive($vmid, $drive);
2651
2652             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2653         };
2654
2655         PVE::QemuServer::lock_config($vmid, $updatefn);
2656         return undef;
2657     }});
2658
2659 __PACKAGE__->register_method({
2660     name => 'snapshot_list',
2661     path => '{vmid}/snapshot',
2662     method => 'GET',
2663     description => "List all snapshots.",
2664     permissions => {
2665         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
2666     },
2667     proxyto => 'node',
2668     protected => 1, # qemu pid files are only readable by root
2669     parameters => {
2670         additionalProperties => 0,
2671         properties => {
2672             vmid => get_standard_option('pve-vmid'),
2673             node => get_standard_option('pve-node'),
2674         },
2675     },
2676     returns => {
2677         type => 'array',
2678         items => {
2679             type => "object",
2680             properties => {},
2681         },
2682         links => [ { rel => 'child', href => "{name}" } ],
2683     },
2684     code => sub {
2685         my ($param) = @_;
2686
2687         my $vmid = $param->{vmid};
2688
2689         my $conf = PVE::QemuServer::load_config($vmid);
2690         my $snaphash = $conf->{snapshots} || {};
2691
2692         my $res = [];
2693
2694         foreach my $name (keys %$snaphash) {
2695             my $d = $snaphash->{$name};
2696             my $item = {
2697                 name => $name,
2698                 snaptime => $d->{snaptime} || 0,
2699                 vmstate => $d->{vmstate} ? 1 : 0,
2700                 description => $d->{description} || '',
2701             };
2702             $item->{parent} = $d->{parent} if $d->{parent};
2703             $item->{snapstate} = $d->{snapstate} if $d->{snapstate};
2704             push @$res, $item;
2705         }
2706
2707         my $running = PVE::QemuServer::check_running($vmid, 1) ? 1 : 0;
2708         my $current = { name => 'current', digest => $conf->{digest}, running => $running };
2709         $current->{parent} = $conf->{parent} if $conf->{parent};
2710
2711         push @$res, $current;
2712
2713         return $res;
2714     }});
2715
2716 __PACKAGE__->register_method({
2717     name => 'snapshot',
2718     path => '{vmid}/snapshot',
2719     method => 'POST',
2720     protected => 1,
2721     proxyto => 'node',
2722     description => "Snapshot a VM.",
2723     permissions => {
2724         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2725     },
2726     parameters => {
2727         additionalProperties => 0,
2728         properties => {
2729             node => get_standard_option('pve-node'),
2730             vmid => get_standard_option('pve-vmid'),
2731             snapname => get_standard_option('pve-snapshot-name'),
2732             vmstate => {
2733                 optional => 1,
2734                 type => 'boolean',
2735                 description => "Save the vmstate",
2736             },
2737             freezefs => {
2738                 optional => 1,
2739                 type => 'boolean',
2740                 description => "Freeze the filesystem",
2741             },
2742             description => {
2743                 optional => 1,
2744                 type => 'string',
2745                 description => "A textual description or comment.",
2746             },
2747         },
2748     },
2749     returns => {
2750         type => 'string',
2751         description => "the task ID.",
2752     },
2753     code => sub {
2754         my ($param) = @_;
2755
2756         my $rpcenv = PVE::RPCEnvironment::get();
2757
2758         my $authuser = $rpcenv->get_user();
2759
2760         my $node = extract_param($param, 'node');
2761
2762         my $vmid = extract_param($param, 'vmid');
2763
2764         my $snapname = extract_param($param, 'snapname');
2765
2766         die "unable to use snapshot name 'current' (reserved name)\n"
2767             if $snapname eq 'current';
2768
2769         my $realcmd = sub {
2770             PVE::Cluster::log_msg('info', $authuser, "snapshot VM $vmid: $snapname");
2771             PVE::QemuServer::snapshot_create($vmid, $snapname, $param->{vmstate},
2772                                              $param->{freezefs}, $param->{description});
2773         };
2774
2775         return $rpcenv->fork_worker('qmsnapshot', $vmid, $authuser, $realcmd);
2776     }});
2777
2778 __PACKAGE__->register_method({
2779     name => 'snapshot_cmd_idx',
2780     path => '{vmid}/snapshot/{snapname}',
2781     description => '',
2782     method => 'GET',
2783     permissions => {
2784         user => 'all',
2785     },
2786     parameters => {
2787         additionalProperties => 0,
2788         properties => {
2789             vmid => get_standard_option('pve-vmid'),
2790             node => get_standard_option('pve-node'),
2791             snapname => get_standard_option('pve-snapshot-name'),
2792         },
2793     },
2794     returns => {
2795         type => 'array',
2796         items => {
2797             type => "object",
2798             properties => {},
2799         },
2800         links => [ { rel => 'child', href => "{cmd}" } ],
2801     },
2802     code => sub {
2803         my ($param) = @_;
2804
2805         my $res = [];
2806
2807         push @$res, { cmd => 'rollback' };
2808         push @$res, { cmd => 'config' };
2809
2810         return $res;
2811     }});
2812
2813 __PACKAGE__->register_method({
2814     name => 'update_snapshot_config',
2815     path => '{vmid}/snapshot/{snapname}/config',
2816     method => 'PUT',
2817     protected => 1,
2818     proxyto => 'node',
2819     description => "Update snapshot metadata.",
2820     permissions => {
2821         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2822     },
2823     parameters => {
2824         additionalProperties => 0,
2825         properties => {
2826             node => get_standard_option('pve-node'),
2827             vmid => get_standard_option('pve-vmid'),
2828             snapname => get_standard_option('pve-snapshot-name'),
2829             description => {
2830                 optional => 1,
2831                 type => 'string',
2832                 description => "A textual description or comment.",
2833             },
2834         },
2835     },
2836     returns => { type => 'null' },
2837     code => sub {
2838         my ($param) = @_;
2839
2840         my $rpcenv = PVE::RPCEnvironment::get();
2841
2842         my $authuser = $rpcenv->get_user();
2843
2844         my $vmid = extract_param($param, 'vmid');
2845
2846         my $snapname = extract_param($param, 'snapname');
2847
2848         return undef if !defined($param->{description});
2849
2850         my $updatefn =  sub {
2851
2852             my $conf = PVE::QemuServer::load_config($vmid);
2853
2854             PVE::QemuServer::check_lock($conf);
2855
2856             my $snap = $conf->{snapshots}->{$snapname};
2857
2858             die "snapshot '$snapname' does not exist\n" if !defined($snap);
2859
2860             $snap->{description} = $param->{description} if defined($param->{description});
2861
2862              PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
2863         };
2864
2865         PVE::QemuServer::lock_config($vmid, $updatefn);
2866
2867         return undef;
2868     }});
2869
2870 __PACKAGE__->register_method({
2871     name => 'get_snapshot_config',
2872     path => '{vmid}/snapshot/{snapname}/config',
2873     method => 'GET',
2874     proxyto => 'node',
2875     description => "Get snapshot configuration",
2876     permissions => {
2877         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2878     },
2879     parameters => {
2880         additionalProperties => 0,
2881         properties => {
2882             node => get_standard_option('pve-node'),
2883             vmid => get_standard_option('pve-vmid'),
2884             snapname => get_standard_option('pve-snapshot-name'),
2885         },
2886     },
2887     returns => { type => "object" },
2888     code => sub {
2889         my ($param) = @_;
2890
2891         my $rpcenv = PVE::RPCEnvironment::get();
2892
2893         my $authuser = $rpcenv->get_user();
2894
2895         my $vmid = extract_param($param, 'vmid');
2896
2897         my $snapname = extract_param($param, 'snapname');
2898
2899         my $conf = PVE::QemuServer::load_config($vmid);
2900
2901         my $snap = $conf->{snapshots}->{$snapname};
2902
2903         die "snapshot '$snapname' does not exist\n" if !defined($snap);
2904
2905         return $snap;
2906     }});
2907
2908 __PACKAGE__->register_method({
2909     name => 'rollback',
2910     path => '{vmid}/snapshot/{snapname}/rollback',
2911     method => 'POST',
2912     protected => 1,
2913     proxyto => 'node',
2914     description => "Rollback VM state to specified snapshot.",
2915     permissions => {
2916         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2917     },
2918     parameters => {
2919         additionalProperties => 0,
2920         properties => {
2921             node => get_standard_option('pve-node'),
2922             vmid => get_standard_option('pve-vmid'),
2923             snapname => get_standard_option('pve-snapshot-name'),
2924         },
2925     },
2926     returns => {
2927         type => 'string',
2928         description => "the task ID.",
2929     },
2930     code => sub {
2931         my ($param) = @_;
2932
2933         my $rpcenv = PVE::RPCEnvironment::get();
2934
2935         my $authuser = $rpcenv->get_user();
2936
2937         my $node = extract_param($param, 'node');
2938
2939         my $vmid = extract_param($param, 'vmid');
2940
2941         my $snapname = extract_param($param, 'snapname');
2942
2943         my $realcmd = sub {
2944             PVE::Cluster::log_msg('info', $authuser, "rollback snapshot VM $vmid: $snapname");
2945             PVE::QemuServer::snapshot_rollback($vmid, $snapname);
2946         };
2947
2948         return $rpcenv->fork_worker('qmrollback', $vmid, $authuser, $realcmd);
2949     }});
2950
2951 __PACKAGE__->register_method({
2952     name => 'delsnapshot',
2953     path => '{vmid}/snapshot/{snapname}',
2954     method => 'DELETE',
2955     protected => 1,
2956     proxyto => 'node',
2957     description => "Delete a VM snapshot.",
2958     permissions => {
2959         check => ['perm', '/vms/{vmid}', [ 'VM.Snapshot' ]],
2960     },
2961     parameters => {
2962         additionalProperties => 0,
2963         properties => {
2964             node => get_standard_option('pve-node'),
2965             vmid => get_standard_option('pve-vmid'),
2966             snapname => get_standard_option('pve-snapshot-name'),
2967             force => {
2968                 optional => 1,
2969                 type => 'boolean',
2970                 description => "For removal from config file, even if removing disk snapshots fails.",
2971             },
2972         },
2973     },
2974     returns => {
2975         type => 'string',
2976         description => "the task ID.",
2977     },
2978     code => sub {
2979         my ($param) = @_;
2980
2981         my $rpcenv = PVE::RPCEnvironment::get();
2982
2983         my $authuser = $rpcenv->get_user();
2984
2985         my $node = extract_param($param, 'node');
2986
2987         my $vmid = extract_param($param, 'vmid');
2988
2989         my $snapname = extract_param($param, 'snapname');
2990
2991         my $realcmd = sub {
2992             PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
2993             PVE::QemuServer::snapshot_delete($vmid, $snapname, $param->{force});
2994         };
2995
2996         return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
2997     }});
2998
2999 __PACKAGE__->register_method({
3000     name => 'template',
3001     path => '{vmid}/template',
3002     method => 'POST',
3003     protected => 1,
3004     proxyto => 'node',
3005     description => "Create a Template.",
3006     permissions => {
3007         description => "You need 'VM.Allocate' permissions on /vms/{vmid}",
3008         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
3009     },
3010     parameters => {
3011         additionalProperties => 0,
3012         properties => {
3013             node => get_standard_option('pve-node'),
3014             vmid => get_standard_option('pve-vmid'),
3015             disk => {
3016                 optional => 1,
3017                 type => 'string',
3018                 description => "If you want to convert only 1 disk to base image.",
3019                 enum => [PVE::QemuServer::disknames()],
3020             },
3021
3022         },
3023     },
3024     returns => { type => 'null'},
3025     code => sub {
3026         my ($param) = @_;
3027
3028         my $rpcenv = PVE::RPCEnvironment::get();
3029
3030         my $authuser = $rpcenv->get_user();
3031
3032         my $node = extract_param($param, 'node');
3033
3034         my $vmid = extract_param($param, 'vmid');
3035
3036         my $disk = extract_param($param, 'disk');
3037
3038         my $updatefn =  sub {
3039
3040             my $conf = PVE::QemuServer::load_config($vmid);
3041
3042             PVE::QemuServer::check_lock($conf);
3043
3044             die "unable to create template, because VM contains snapshots\n"
3045                 if $conf->{snapshots} && scalar(keys %{$conf->{snapshots}});
3046
3047             die "you can't convert a template to a template\n"
3048                 if PVE::QemuServer::is_template($conf) && !$disk;
3049
3050             die "you can't convert a VM to template if VM is running\n"
3051                 if PVE::QemuServer::check_running($vmid);
3052
3053             my $realcmd = sub {
3054                 PVE::QemuServer::template_create($vmid, $conf, $disk);
3055             };
3056
3057             $conf->{template} = 1;
3058             PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
3059
3060             return $rpcenv->fork_worker('qmtemplate', $vmid, $authuser, $realcmd);
3061         };
3062
3063         PVE::QemuServer::lock_config($vmid, $updatefn);
3064         return undef;
3065     }});
3066
3067 1;