PVE/API2/Qemu.pm

   1 package PVE::API2::Qemu;
   2
   3 use strict;
   4 use warnings;
   5 use Cwd 'abs_path';
   6
   7 use PVE::Cluster qw (cfs_read_file cfs_write_file);;
   8 use PVE::SafeSyslog;
   9 use PVE::Tools qw(extract_param);
  10 use PVE::Exception qw(raise raise_param_exc);
  11 use PVE::Storage;
  12 use PVE::JSONSchema qw(get_standard_option);
  13 use PVE::RESTHandler;
  14 use PVE::QemuServer;
  15 use PVE::QemuMigrate;
  16 use PVE::RPCEnvironment;
  17 use PVE::AccessControl;
  18 use PVE::INotify;
  19
  20 use Data::Dumper; # fixme: remove
  21
  22 use base qw(PVE::RESTHandler);
  23
  24 my $opt_force_description = "Force physical removal. Without this, we simple remove the disk from the config file and create an additional configuration entry called 'unused[n]', which contains the volume ID. Unlink of unused[n] always cause physical removal.";
  25
  26 my $resolve_cdrom_alias = sub {
  27     my $param = shift;
  28
  29     if (my $value = $param->{cdrom}) {
  30         $value .= ",media=cdrom" if $value !~ m/media=/;
  31         $param->{ide2} = $value;
  32         delete $param->{cdrom};
  33     }
  34 };
  35
  36
  37 my $check_storage_access = sub {
  38    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
  39
  40    PVE::QemuServer::foreach_drive($settings, sub {
  41         my ($ds, $drive) = @_;
  42
  43         my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
  44
  45         my $volid = $drive->{file};
  46
  47         if (!$volid || $volid eq 'none') {
  48             # nothing to check
  49         } elsif ($isCDROM && ($volid eq 'cdrom')) {
  50             $rpcenv->check($authuser, "/", ['Sys.Console']);
  51         } elsif (!$isCDROM && ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/)) {
  52             my ($storeid, $size) = ($2 || $default_storage, $3);
  53             die "no storage ID specified (and no default storage)\n" if !$storeid;
  54             $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
  55         } else {
  56             $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  57         }
  58     });
  59 };
  60
  61 # Note: $pool is only needed when creating a VM, because pool permissions
  62 # are automatically inherited if VM already exists inside a pool.
  63 my $create_disks = sub {
  64     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $settings, $default_storage) = @_;
  65
  66     my $vollist = [];
  67
  68     my $res = {};
  69     PVE::QemuServer::foreach_drive($settings, sub {
  70         my ($ds, $disk) = @_;
  71
  72         my $volid = $disk->{file};
  73
  74         if (!$volid || $volid eq 'none' || $volid eq 'cdrom') {
  75             $res->{$ds} = $settings->{$ds};
  76         } elsif ($volid =~ m/^(([^:\s]+):)?(\d+(\.\d+)?)$/) {
  77             my ($storeid, $size) = ($2 || $default_storage, $3);
  78             die "no storage ID specified (and no default storage)\n" if !$storeid;
  79             my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
  80             my $fmt = $disk->{format} || $defformat;
  81             my $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid,
  82                                                   $fmt, undef, $size*1024*1024);
  83             $disk->{file} = $volid;
  84             push @$vollist, $volid;
  85             delete $disk->{format}; # no longer needed
  86             $res->{$ds} = PVE::QemuServer::print_drive($vmid, $disk);
  87         } else {
  88             my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $volid);
  89             PVE::Storage::activate_volumes($storecfg, [ $volid ])
  90                 if PVE::Storage::parse_volume_id ($volid, 1);
  91             die "image '$path' does not exists\n" if (!(-f $path || -b $path));
  92             $res->{$ds} = $settings->{$ds};
  93         }
  94     });
  95
  96     # free allocated images on error
  97     if (my $err = $@) {
  98         syslog('err', "VM $vmid creating disks failed");
  99         foreach my $volid (@$vollist) {
 100             eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 101             warn $@ if $@;
 102         }
 103         die $err;
 104     }
 105
 106     # modify vm config if everything went well
 107     foreach my $ds (keys %$res) {
 108         $conf->{$ds} = $res->{$ds};
 109     }
 110
 111     return $vollist;
 112 };
 113
 114 my $check_vm_modify_config_perm = sub {
 115     my ($rpcenv, $authuser, $vmid, $pool, $key_list) = @_;
 116
 117     return 1 if $authuser eq 'root@pam';
 118
 119     foreach my $opt (@$key_list) {
 120         # disk checks need to be done somewhere else
 121         next if PVE::QemuServer::valid_drivename($opt);
 122
 123         if ($opt eq 'sockets' || $opt eq 'cores' ||
 124             $opt eq 'cpu' || $opt eq 'smp' ||
 125             $opt eq 'cpulimit' || $opt eq 'cpuunits') {
 126             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.CPU']);
 127         } elsif ($opt eq 'boot' || $opt eq 'bootdisk') {
 128             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
 129         } elsif ($opt eq 'memory' || $opt eq 'balloon') {
 130             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Memory']);
 131         } elsif ($opt eq 'args' || $opt eq 'lock') {
 132             die "only root can set '$opt' config\n";
 133         } elsif ($opt eq 'cpu' || $opt eq 'kvm' || $opt eq 'acpi' ||
 134                  $opt eq 'vga' || $opt eq 'watchdog' || $opt eq 'tablet') {
 135             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.HWType']);
 136         } elsif ($opt =~ m/^net\d+$/) {
 137             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
 138         } else {
 139             $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Options']);
 140         }
 141     }
 142
 143     return 1;
 144 };
 145
 146 __PACKAGE__->register_method({
 147     name => 'vmlist',
 148     path => '',
 149     method => 'GET',
 150     description => "Virtual machine index (per node).",
 151     permissions => {
 152         description => "Only list VMs where you have VM.Audit permissons on /vms/<vmid>.",
 153         user => 'all',
 154     },
 155     proxyto => 'node',
 156     protected => 1, # qemu pid files are only readable by root
 157     parameters => {
 158         additionalProperties => 0,
 159         properties => {
 160             node => get_standard_option('pve-node'),
 161         },
 162     },
 163     returns => {
 164         type => 'array',
 165         items => {
 166             type => "object",
 167             properties => {},
 168         },
 169         links => [ { rel => 'child', href => "{vmid}" } ],
 170     },
 171     code => sub {
 172         my ($param) = @_;
 173
 174         my $rpcenv = PVE::RPCEnvironment::get();
 175         my $authuser = $rpcenv->get_user();
 176
 177         my $vmstatus = PVE::QemuServer::vmstatus();
 178
 179         my $res = [];
 180         foreach my $vmid (keys %$vmstatus) {
 181             next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1);
 182
 183             my $data = $vmstatus->{$vmid};
 184             $data->{vmid} = $vmid;
 185             push @$res, $data;
 186         }
 187
 188         return $res;
 189     }});
 190
 191 __PACKAGE__->register_method({
 192     name => 'create_vm',
 193     path => '',
 194     method => 'POST',
 195     description => "Create or restore a virtual machine.",
 196     permissions => {
 197         description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. If you create disks you need 'Datastore.AllocateSpace' on any used storage.",
 198         check => [ 'or',
 199                    [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 200                    [ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
 201             ],
 202     },
 203     protected => 1,
 204     proxyto => 'node',
 205     parameters => {
 206         additionalProperties => 0,
 207         properties => PVE::QemuServer::json_config_properties(
 208             {
 209                 node => get_standard_option('pve-node'),
 210                 vmid => get_standard_option('pve-vmid'),
 211                 archive => {
 212                     description => "The backup file.",
 213                     type => 'string',
 214                     optional => 1,
 215                     maxLength => 255,
 216                 },
 217                 storage => get_standard_option('pve-storage-id', {
 218                     description => "Default storage.",
 219                     optional => 1,
 220                 }),
 221                 force => {
 222                     optional => 1,
 223                     type => 'boolean',
 224                     description => "Allow to overwrite existing VM.",
 225                     requires => 'archive',
 226                 },
 227                 unique => {
 228                     optional => 1,
 229                     type => 'boolean',
 230                     description => "Assign a unique random ethernet address.",
 231                     requires => 'archive',
 232                 },
 233                 pool => {
 234                     optional => 1,
 235                     type => 'string', format => 'pve-poolid',
 236                     description => "Add the VM to the specified pool.",
 237                 },
 238             }),
 239     },
 240     returns => {
 241         type => 'string',
 242     },
 243     code => sub {
 244         my ($param) = @_;
 245
 246         my $rpcenv = PVE::RPCEnvironment::get();
 247
 248         my $authuser = $rpcenv->get_user();
 249
 250         my $node = extract_param($param, 'node');
 251
 252         my $vmid = extract_param($param, 'vmid');
 253
 254         my $archive = extract_param($param, 'archive');
 255
 256         my $storage = extract_param($param, 'storage');
 257
 258         my $force = extract_param($param, 'force');
 259
 260         my $unique = extract_param($param, 'unique');
 261
 262         my $pool = extract_param($param, 'pool');
 263
 264         my $filename = PVE::QemuServer::config_file($vmid);
 265
 266         my $storecfg = PVE::Storage::config();
 267
 268         PVE::Cluster::check_cfs_quorum();
 269
 270         if (defined($pool)) {
 271             $rpcenv->check_pool_exist($pool);
 272             $rpcenv->check_perm_modify($authuser, "/pool/$pool");
 273         }
 274
 275         $rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace'])
 276             if defined($storage);
 277
 278         if (!$archive) {
 279             &$resolve_cdrom_alias($param);
 280
 281             &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
 282
 283             &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
 284
 285             foreach my $opt (keys %$param) {
 286                 if (PVE::QemuServer::valid_drivename($opt)) {
 287                     my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 288                     raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
 289
 290                     PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 291                     $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 292                 }
 293             }
 294
 295             PVE::QemuServer::add_random_macs($param);
 296         } else {
 297             my $keystr = join(' ', keys %$param);
 298             raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
 299
 300             if ($archive eq '-') {
 301                 die "pipe requires cli environment\n"
 302                     if $rpcenv->{type} ne 'cli';
 303             } else {
 304                 my $path = $rpcenv->check_volume_access($authuser, $storecfg, $vmid, $archive);
 305
 306                 PVE::Storage::activate_volumes($storecfg, [ $archive ])
 307                     if PVE::Storage::parse_volume_id ($archive, 1);
 308
 309                 die "can't find archive file '$archive'\n" if !($path && -f $path);
 310                 $archive = $path;
 311             }
 312         }
 313
 314         my $addVMtoPoolFn = sub {
 315             my $usercfg = cfs_read_file("user.cfg");
 316             if (my $data = $usercfg->{pools}->{$pool}) {
 317                 $data->{vms}->{$vmid} = 1;
 318                 $usercfg->{vms}->{$vmid} = $pool;
 319                 cfs_write_file("user.cfg", $usercfg);
 320             }
 321         };
 322
 323         my $restorefn = sub {
 324
 325             if (-f $filename) {
 326                 die "unable to restore vm $vmid: config file already exists\n"
 327                     if !$force;
 328
 329                 die "unable to restore vm $vmid: vm is running\n"
 330                     if PVE::QemuServer::check_running($vmid);
 331
 332                 # destroy existing data - keep empty config
 333                 PVE::QemuServer::destroy_vm($storecfg, $vmid, 1);
 334             }
 335
 336             my $realcmd = sub {
 337                 PVE::QemuServer::restore_archive($archive, $vmid, $authuser, {
 338                     storage => $storage,
 339                     pool => $pool,
 340                     unique => $unique });
 341
 342                 PVE::AccessControl::lock_user_config($addVMtoPoolFn, "can't add VM to pool") if $pool;
 343             };
 344
 345             return $rpcenv->fork_worker('qmrestore', $vmid, $authuser, $realcmd);
 346         };
 347
 348         my $createfn = sub {
 349
 350             # test after locking
 351             die "unable to create vm $vmid: config file already exists\n"
 352                 if -f $filename;
 353
 354             my $realcmd = sub {
 355
 356                 my $vollist = [];
 357
 358                 my $conf = $param;
 359
 360                 eval {
 361
 362                     $vollist = &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, $pool, $param, $storage);
 363
 364                     # try to be smart about bootdisk
 365                     my @disks = PVE::QemuServer::disknames();
 366                     my $firstdisk;
 367                     foreach my $ds (reverse @disks) {
 368                         next if !$conf->{$ds};
 369                         my $disk = PVE::QemuServer::parse_drive($ds, $conf->{$ds});
 370                         next if PVE::QemuServer::drive_is_cdrom($disk);
 371                         $firstdisk = $ds;
 372                     }
 373
 374                     if (!$conf->{bootdisk} && $firstdisk) {
 375                         $conf->{bootdisk} = $firstdisk;
 376                     }
 377
 378                     PVE::QemuServer::update_config_nolock($vmid, $conf);
 379
 380                 };
 381                 my $err = $@;
 382
 383                 if ($err) {
 384                     foreach my $volid (@$vollist) {
 385                         eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 386                         warn $@ if $@;
 387                     }
 388                     die "create failed - $err";
 389                 }
 390
 391                 PVE::AccessControl::lock_user_config($addVMtoPoolFn, "can't add VM to pool") if $pool;
 392             };
 393
 394             return $rpcenv->fork_worker('qmcreate', $vmid, $authuser, $realcmd);
 395         };
 396
 397         return PVE::QemuServer::lock_config_full($vmid, 1, $archive ? $restorefn : $createfn);
 398     }});
 399
 400 __PACKAGE__->register_method({
 401     name => 'vmdiridx',
 402     path => '{vmid}',
 403     method => 'GET',
 404     proxyto => 'node',
 405     description => "Directory index",
 406     permissions => {
 407         user => 'all',
 408     },
 409     parameters => {
 410         additionalProperties => 0,
 411         properties => {
 412             node => get_standard_option('pve-node'),
 413             vmid => get_standard_option('pve-vmid'),
 414         },
 415     },
 416     returns => {
 417         type => 'array',
 418         items => {
 419             type => "object",
 420             properties => {
 421                 subdir => { type => 'string' },
 422             },
 423         },
 424         links => [ { rel => 'child', href => "{subdir}" } ],
 425     },
 426     code => sub {
 427         my ($param) = @_;
 428
 429         my $res = [
 430             { subdir => 'config' },
 431             { subdir => 'status' },
 432             { subdir => 'unlink' },
 433             { subdir => 'vncproxy' },
 434             { subdir => 'migrate' },
 435             { subdir => 'rrd' },
 436             { subdir => 'rrddata' },
 437             { subdir => 'monitor' },
 438             ];
 439
 440         return $res;
 441     }});
 442
 443 __PACKAGE__->register_method({
 444     name => 'rrd',
 445     path => '{vmid}/rrd',
 446     method => 'GET',
 447     protected => 1, # fixme: can we avoid that?
 448     permissions => {
 449         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 450     },
 451     description => "Read VM RRD statistics (returns PNG)",
 452     parameters => {
 453         additionalProperties => 0,
 454         properties => {
 455             node => get_standard_option('pve-node'),
 456             vmid => get_standard_option('pve-vmid'),
 457             timeframe => {
 458                 description => "Specify the time frame you are interested in.",
 459                 type => 'string',
 460                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 461             },
 462             ds => {
 463                 description => "The list of datasources you want to display.",
 464                 type => 'string', format => 'pve-configid-list',
 465             },
 466             cf => {
 467                 description => "The RRD consolidation function",
 468                 type => 'string',
 469                 enum => [ 'AVERAGE', 'MAX' ],
 470                 optional => 1,
 471             },
 472         },
 473     },
 474     returns => {
 475         type => "object",
 476         properties => {
 477             filename => { type => 'string' },
 478         },
 479     },
 480     code => sub {
 481         my ($param) = @_;
 482
 483         return PVE::Cluster::create_rrd_graph(
 484             "pve2-vm/$param->{vmid}", $param->{timeframe},
 485             $param->{ds}, $param->{cf});
 486
 487     }});
 488
 489 __PACKAGE__->register_method({
 490     name => 'rrddata',
 491     path => '{vmid}/rrddata',
 492     method => 'GET',
 493     protected => 1, # fixme: can we avoid that?
 494     permissions => {
 495         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 496     },
 497     description => "Read VM RRD statistics",
 498     parameters => {
 499         additionalProperties => 0,
 500         properties => {
 501             node => get_standard_option('pve-node'),
 502             vmid => get_standard_option('pve-vmid'),
 503             timeframe => {
 504                 description => "Specify the time frame you are interested in.",
 505                 type => 'string',
 506                 enum => [ 'hour', 'day', 'week', 'month', 'year' ],
 507             },
 508             cf => {
 509                 description => "The RRD consolidation function",
 510                 type => 'string',
 511                 enum => [ 'AVERAGE', 'MAX' ],
 512                 optional => 1,
 513             },
 514         },
 515     },
 516     returns => {
 517         type => "array",
 518         items => {
 519             type => "object",
 520             properties => {},
 521         },
 522     },
 523     code => sub {
 524         my ($param) = @_;
 525
 526         return PVE::Cluster::create_rrd_data(
 527             "pve2-vm/$param->{vmid}", $param->{timeframe}, $param->{cf});
 528     }});
 529
 530
 531 __PACKAGE__->register_method({
 532     name => 'vm_config',
 533     path => '{vmid}/config',
 534     method => 'GET',
 535     proxyto => 'node',
 536     description => "Get virtual machine configuration.",
 537     permissions => {
 538         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 539     },
 540     parameters => {
 541         additionalProperties => 0,
 542         properties => {
 543             node => get_standard_option('pve-node'),
 544             vmid => get_standard_option('pve-vmid'),
 545         },
 546     },
 547     returns => {
 548         type => "object",
 549         properties => {
 550             digest => {
 551                 type => 'string',
 552                 description => 'SHA1 digest of configuration file. This can be used to prevent concurrent modifications.',
 553             }
 554         },
 555     },
 556     code => sub {
 557         my ($param) = @_;
 558
 559         my $conf = PVE::QemuServer::load_config($param->{vmid});
 560
 561         return $conf;
 562     }});
 563
 564 my $vm_is_volid_owner = sub {
 565     my ($storecfg, $vmid, $volid) =@_;
 566
 567     if ($volid !~  m|^/|) {
 568         my ($path, $owner);
 569         eval { ($path, $owner) = PVE::Storage::path($storecfg, $volid); };
 570         if ($owner && ($owner == $vmid)) {
 571             return 1;
 572         }
 573     }
 574
 575     return undef;
 576 };
 577
 578 my $test_deallocate_drive = sub {
 579     my ($storecfg, $vmid, $key, $drive, $force) = @_;
 580
 581     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 582         my $volid = $drive->{file};
 583         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 584             if ($force || $key =~ m/^unused/) {
 585                 my $sid = PVE::Storage::parse_volume_id($volid);
 586                 return $sid;
 587             }
 588         }
 589     }
 590
 591     return undef;
 592 };
 593
 594 my $delete_drive = sub {
 595     my ($conf, $storecfg, $vmid, $key, $drive, $force) = @_;
 596
 597     if (!PVE::QemuServer::drive_is_cdrom($drive)) {
 598         my $volid = $drive->{file};
 599         if (&$vm_is_volid_owner($storecfg, $vmid, $volid)) {
 600             if ($force || $key =~ m/^unused/) {
 601                 eval { PVE::Storage::vdisk_free($storecfg, $volid); };
 602                 warn $@ if $@;
 603             } else {
 604                 PVE::QemuServer::add_unused_volume($conf, $volid, $vmid);
 605             }
 606         }
 607     }
 608
 609     delete $conf->{$key};
 610 };
 611
 612 my $vmconfig_delete_option = sub {
 613     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force) = @_;
 614
 615     return if !defined($conf->{$opt});
 616
 617     my $isDisk = PVE::QemuServer::valid_drivename($opt)|| ($opt =~ m/^unused/);
 618
 619     if ($isDisk) {
 620         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 621
 622         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 623         if (my $sid = &$test_deallocate_drive($storecfg, $vmid, $opt, $drive, $force)) {
 624             $rpcenv->check($authuser, "/storage/$sid", ['Datastore.Allocate']);
 625         }
 626     }
 627
 628     die "error hot-unplug $opt" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 629
 630     if ($isDisk) {
 631         my $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 632         &$delete_drive($conf, $storecfg, $vmid, $opt, $drive, $force);
 633     } else {
 634         delete $conf->{$opt};
 635     }
 636
 637     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 638 };
 639
 640 my $vmconfig_update_disk = sub {
 641     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value, $force) = @_;
 642
 643     my $drive = PVE::QemuServer::parse_drive($opt, $value);
 644
 645     if (PVE::QemuServer::drive_is_cdrom($drive)) { #cdrom
 646         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
 647     } else {
 648         $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
 649     }
 650
 651     if ($conf->{$opt}) {
 652
 653         if (my $old_drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt}))  {
 654
 655             my $media = $drive->{media} || 'disk';
 656             my $oldmedia = $old_drive->{media} || 'disk';
 657             die "unable to change media type\n" if $media ne $oldmedia;
 658
 659             if (!PVE::QemuServer::drive_is_cdrom($old_drive) &&
 660                 ($drive->{file} ne $old_drive->{file})) {  # delete old disks
 661
 662                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 663                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 664             }
 665         }
 666     }
 667
 668     &$create_disks($rpcenv, $authuser, $conf, $storecfg, $vmid, undef, {$opt => $value});
 669     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 670
 671     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 672     $drive = PVE::QemuServer::parse_drive($opt, $conf->{$opt});
 673
 674     if (PVE::QemuServer::drive_is_cdrom($drive)) { # cdrom
 675
 676         if (PVE::QemuServer::check_running($vmid)) {
 677             if ($drive->{file} eq 'none') {
 678                 PVE::QemuServer::vm_monitor_command($vmid, "eject -f drive-$opt", 0);
 679             } else {
 680                 my $path = PVE::QemuServer::get_iso_path($storecfg, $vmid, $drive->{file});
 681                 PVE::QemuServer::vm_monitor_command($vmid, "eject -f drive-$opt", 0); #force eject if locked
 682                 PVE::QemuServer::vm_monitor_command($vmid, "change drive-$opt \"$path\"", 0) if $path;
 683             }
 684         }
 685
 686     } else { # hotplug new disks
 687
 688         die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $drive);
 689     }
 690 };
 691
 692 my $vmconfig_update_net = sub {
 693     my ($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $value) = @_;
 694
 695     if ($conf->{$opt}) {
 696         #if online update, then unplug first
 697         die "error hot-unplug $opt for update" if !PVE::QemuServer::vm_deviceunplug($vmid, $conf, $opt);
 698     }
 699
 700     $conf->{$opt} = $value;
 701     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 702     $conf = PVE::QemuServer::load_config($vmid); # update/reload
 703
 704     my $net = PVE::QemuServer::parse_net($conf->{$opt});
 705
 706     die "error hotplug $opt" if !PVE::QemuServer::vm_deviceplug($storecfg, $conf, $vmid, $opt, $net);
 707 };
 708
 709 my $vm_config_perm_list = [
 710             'VM.Config.Disk',
 711             'VM.Config.CDROM',
 712             'VM.Config.CPU',
 713             'VM.Config.Memory',
 714             'VM.Config.Network',
 715             'VM.Config.HWType',
 716             'VM.Config.Options',
 717     ];
 718
 719 __PACKAGE__->register_method({
 720     name => 'update_vm',
 721     path => '{vmid}/config',
 722     method => 'PUT',
 723     protected => 1,
 724     proxyto => 'node',
 725     description => "Set virtual machine options.",
 726     permissions => {
 727         check => ['perm', '/vms/{vmid}', $vm_config_perm_list, any => 1],
 728     },
 729     parameters => {
 730         additionalProperties => 0,
 731         properties => PVE::QemuServer::json_config_properties(
 732             {
 733                 node => get_standard_option('pve-node'),
 734                 vmid => get_standard_option('pve-vmid'),
 735                 skiplock => get_standard_option('skiplock'),
 736                 delete => {
 737                     type => 'string', format => 'pve-configid-list',
 738                     description => "A list of settings you want to delete.",
 739                     optional => 1,
 740                 },
 741                 force => {
 742                     type => 'boolean',
 743                     description => $opt_force_description,
 744                     optional => 1,
 745                     requires => 'delete',
 746                 },
 747                 digest => {
 748                     type => 'string',
 749                     description => 'Prevent changes if current configuration file has different SHA1 digest. This can be used to prevent concurrent modifications.',
 750                     maxLength => 40,
 751                     optional => 1,
 752                 }
 753             }),
 754     },
 755     returns => { type => 'null'},
 756     code => sub {
 757         my ($param) = @_;
 758
 759         my $rpcenv = PVE::RPCEnvironment::get();
 760
 761         my $authuser = $rpcenv->get_user();
 762
 763         my $node = extract_param($param, 'node');
 764
 765         my $vmid = extract_param($param, 'vmid');
 766
 767         my $digest = extract_param($param, 'digest');
 768
 769         my @paramarr = (); # used for log message
 770         foreach my $key (keys %$param) {
 771             push @paramarr, "-$key", $param->{$key};
 772         }
 773
 774         my $skiplock = extract_param($param, 'skiplock');
 775         raise_param_exc({ skiplock => "Only root may use this option." })
 776             if $skiplock && $authuser ne 'root@pam';
 777
 778         my $delete_str = extract_param($param, 'delete');
 779
 780         my $force = extract_param($param, 'force');
 781
 782         die "no options specified\n" if !$delete_str && !scalar(keys %$param);
 783
 784         my $storecfg = PVE::Storage::config();
 785
 786         &$resolve_cdrom_alias($param);
 787
 788         # now try to verify all parameters
 789
 790         my @delete = ();
 791         foreach my $opt (PVE::Tools::split_list($delete_str)) {
 792             $opt = 'ide2' if $opt eq 'cdrom';
 793             raise_param_exc({ delete => "you can't use '-$opt' and " .
 794                                   "-delete $opt' at the same time" })
 795                 if defined($param->{$opt});
 796
 797             if (!PVE::QemuServer::option_exists($opt)) {
 798                 raise_param_exc({ delete => "unknown option '$opt'" });
 799             }
 800
 801             push @delete, $opt;
 802         }
 803
 804         foreach my $opt (keys %$param) {
 805             if (PVE::QemuServer::valid_drivename($opt)) {
 806                 # cleanup drive path
 807                 my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
 808                 PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
 809                 $param->{$opt} = PVE::QemuServer::print_drive($vmid, $drive);
 810             } elsif ($opt =~ m/^net(\d+)$/) {
 811                 # add macaddr
 812                 my $net = PVE::QemuServer::parse_net($param->{$opt});
 813                 $param->{$opt} = PVE::QemuServer::print_net($net);
 814             }
 815         }
 816
 817         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [@delete]);
 818
 819         &$check_vm_modify_config_perm($rpcenv, $authuser, $vmid, undef, [keys %$param]);
 820
 821         &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param);
 822
 823         my $updatefn =  sub {
 824
 825             my $conf = PVE::QemuServer::load_config($vmid);
 826
 827             die "checksum missmatch (file change by other user?)\n"
 828                 if $digest && $digest ne $conf->{digest};
 829
 830             PVE::QemuServer::check_lock($conf) if !$skiplock;
 831
 832             PVE::Cluster::log_msg('info', $authuser, "update VM $vmid: " . join (' ', @paramarr));
 833
 834             foreach my $opt (@delete) { # delete
 835                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 836                 &$vmconfig_delete_option($rpcenv, $authuser, $conf, $storecfg, $vmid, $opt, $force);
 837             }
 838
 839             foreach my $opt (keys %$param) { # add/change
 840
 841                 $conf = PVE::QemuServer::load_config($vmid); # update/reload
 842
 843                 next if $conf->{$opt} && ($param->{$opt} eq $conf->{$opt}); # skip if nothing changed
 844
 845                 if (PVE::QemuServer::valid_drivename($opt)) {
 846
 847                     &$vmconfig_update_disk($rpcenv, $authuser, $conf, $storecfg, $vmid,
 848                                            $opt, $param->{$opt}, $force);
 849
 850                 } elsif ($opt =~ m/^net(\d+)$/) { #nics
 851
 852                     &$vmconfig_update_net($rpcenv, $authuser, $conf, $storecfg, $vmid,
 853                                           $opt, $param->{$opt});
 854
 855                 } else {
 856
 857                     $conf->{$opt} = $param->{$opt};
 858                     PVE::QemuServer::update_config_nolock($vmid, $conf, 1);
 859                 }
 860             }
 861         };
 862
 863         PVE::QemuServer::lock_config($vmid, $updatefn);
 864
 865         return undef;
 866     }});
 867
 868
 869 __PACKAGE__->register_method({
 870     name => 'destroy_vm',
 871     path => '{vmid}',
 872     method => 'DELETE',
 873     protected => 1,
 874     proxyto => 'node',
 875     description => "Destroy the vm (also delete all used/owned volumes).",
 876     permissions => {
 877         check => [ 'perm', '/vms/{vmid}', ['VM.Allocate']],
 878     },
 879     parameters => {
 880         additionalProperties => 0,
 881         properties => {
 882             node => get_standard_option('pve-node'),
 883             vmid => get_standard_option('pve-vmid'),
 884             skiplock => get_standard_option('skiplock'),
 885         },
 886     },
 887     returns => {
 888         type => 'string',
 889     },
 890     code => sub {
 891         my ($param) = @_;
 892
 893         my $rpcenv = PVE::RPCEnvironment::get();
 894
 895         my $authuser = $rpcenv->get_user();
 896
 897         my $vmid = $param->{vmid};
 898
 899         my $skiplock = $param->{skiplock};
 900         raise_param_exc({ skiplock => "Only root may use this option." })
 901             if $skiplock && $authuser ne 'root@pam';
 902
 903         # test if VM exists
 904         my $conf = PVE::QemuServer::load_config($vmid);
 905
 906         my $storecfg = PVE::Storage::config();
 907
 908         my $delVMfromPoolFn = sub {
 909             my $usercfg = cfs_read_file("user.cfg");
 910             if (my $pool = $usercfg->{vms}->{$vmid}) {
 911                 if (my $data = $usercfg->{pools}->{$pool}) {
 912                     delete $data->{vms}->{$vmid};
 913                     delete $usercfg->{vms}->{$vmid};
 914                     cfs_write_file("user.cfg", $usercfg);
 915                 }
 916             }
 917         };
 918
 919         my $realcmd = sub {
 920             my $upid = shift;
 921
 922             syslog('info', "destroy VM $vmid: $upid\n");
 923
 924             PVE::QemuServer::vm_destroy($storecfg, $vmid, $skiplock);
 925
 926             PVE::AccessControl::lock_user_config($delVMfromPoolFn, "pool cleanup failed");
 927         };
 928
 929         return $rpcenv->fork_worker('qmdestroy', $vmid, $authuser, $realcmd);
 930     }});
 931
 932 __PACKAGE__->register_method({
 933     name => 'unlink',
 934     path => '{vmid}/unlink',
 935     method => 'PUT',
 936     protected => 1,
 937     proxyto => 'node',
 938     description => "Unlink/delete disk images.",
 939     permissions => {
 940         check => [ 'perm', '/vms/{vmid}', ['VM.Config.Disk']],
 941     },
 942     parameters => {
 943         additionalProperties => 0,
 944         properties => {
 945             node => get_standard_option('pve-node'),
 946             vmid => get_standard_option('pve-vmid'),
 947             idlist => {
 948                 type => 'string', format => 'pve-configid-list',
 949                 description => "A list of disk IDs you want to delete.",
 950             },
 951             force => {
 952                 type => 'boolean',
 953                 description => $opt_force_description,
 954                 optional => 1,
 955             },
 956         },
 957     },
 958     returns => { type => 'null'},
 959     code => sub {
 960         my ($param) = @_;
 961
 962         $param->{delete} = extract_param($param, 'idlist');
 963
 964         __PACKAGE__->update_vm($param);
 965
 966         return undef;
 967     }});
 968
 969 my $sslcert;
 970
 971 __PACKAGE__->register_method({
 972     name => 'vncproxy',
 973     path => '{vmid}/vncproxy',
 974     method => 'POST',
 975     protected => 1,
 976     permissions => {
 977         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 978     },
 979     description => "Creates a TCP VNC proxy connections.",
 980     parameters => {
 981         additionalProperties => 0,
 982         properties => {
 983             node => get_standard_option('pve-node'),
 984             vmid => get_standard_option('pve-vmid'),
 985         },
 986     },
 987     returns => {
 988         additionalProperties => 0,
 989         properties => {
 990             user => { type => 'string' },
 991             ticket => { type => 'string' },
 992             cert => { type => 'string' },
 993             port => { type => 'integer' },
 994             upid => { type => 'string' },
 995         },
 996     },
 997     code => sub {
 998         my ($param) = @_;
 999
1000         my $rpcenv = PVE::RPCEnvironment::get();
1001
1002         my $authuser = $rpcenv->get_user();
1003
1004         my $vmid = $param->{vmid};
1005         my $node = $param->{node};
1006
1007         my $authpath = "/vms/$vmid";
1008
1009         my $ticket = PVE::AccessControl::assemble_vnc_ticket($authuser, $authpath);
1010
1011         $sslcert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192)
1012             if !$sslcert;
1013
1014         my $port = PVE::Tools::next_vnc_port();
1015
1016         my $remip;
1017
1018         if ($node ne 'localhost' && $node ne PVE::INotify::nodename()) {
1019             $remip = PVE::Cluster::remote_node_ip($node);
1020         }
1021
1022         # NOTE: kvm VNC traffic is already TLS encrypted,
1023         # so we select the fastest chipher here (or 'none'?)
1024         my $remcmd = $remip ? ['/usr/bin/ssh', '-T', '-o', 'BatchMode=yes',
1025                                '-c', 'blowfish-cbc', $remip] : [];
1026
1027         my $timeout = 10;
1028
1029         my $realcmd = sub {
1030             my $upid = shift;
1031
1032             syslog('info', "starting vnc proxy $upid\n");
1033
1034             my $qmcmd = [@$remcmd, "/usr/sbin/qm", 'vncproxy', $vmid];
1035
1036             my $qmstr = join(' ', @$qmcmd);
1037
1038             # also redirect stderr (else we get RFB protocol errors)
1039             my $cmd = ['/bin/nc', '-l', '-p', $port, '-w', $timeout, '-c', "$qmstr 2>/dev/null"];
1040
1041             PVE::Tools::run_command($cmd);
1042
1043             return;
1044         };
1045
1046         my $upid = $rpcenv->fork_worker('vncproxy', $vmid, $authuser, $realcmd);
1047
1048         return {
1049             user => $authuser,
1050             ticket => $ticket,
1051             port => $port,
1052             upid => $upid,
1053             cert => $sslcert,
1054         };
1055     }});
1056
1057 __PACKAGE__->register_method({
1058     name => 'vmcmdidx',
1059     path => '{vmid}/status',
1060     method => 'GET',
1061     proxyto => 'node',
1062     description => "Directory index",
1063     permissions => {
1064         user => 'all',
1065     },
1066     parameters => {
1067         additionalProperties => 0,
1068         properties => {
1069             node => get_standard_option('pve-node'),
1070             vmid => get_standard_option('pve-vmid'),
1071         },
1072     },
1073     returns => {
1074         type => 'array',
1075         items => {
1076             type => "object",
1077             properties => {
1078                 subdir => { type => 'string' },
1079             },
1080         },
1081         links => [ { rel => 'child', href => "{subdir}" } ],
1082     },
1083     code => sub {
1084         my ($param) = @_;
1085
1086         # test if VM exists
1087         my $conf = PVE::QemuServer::load_config($param->{vmid});
1088
1089         my $res = [
1090             { subdir => 'current' },
1091             { subdir => 'start' },
1092             { subdir => 'stop' },
1093             ];
1094
1095         return $res;
1096     }});
1097
1098 my $vm_is_ha_managed = sub {
1099     my ($vmid) = @_;
1100
1101     my $cc = PVE::Cluster::cfs_read_file('cluster.conf');
1102     if (PVE::Cluster::cluster_conf_lookup_pvevm($cc, 0, $vmid, 1)) {
1103         return 1;
1104     }
1105     return 0;
1106 };
1107
1108 __PACKAGE__->register_method({
1109     name => 'vm_status',
1110     path => '{vmid}/status/current',
1111     method => 'GET',
1112     proxyto => 'node',
1113     protected => 1, # qemu pid files are only readable by root
1114     description => "Get virtual machine status.",
1115     permissions => {
1116         check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
1117     },
1118     parameters => {
1119         additionalProperties => 0,
1120         properties => {
1121             node => get_standard_option('pve-node'),
1122             vmid => get_standard_option('pve-vmid'),
1123         },
1124     },
1125     returns => { type => 'object' },
1126     code => sub {
1127         my ($param) = @_;
1128
1129         # test if VM exists
1130         my $conf = PVE::QemuServer::load_config($param->{vmid});
1131
1132         my $vmstatus = PVE::QemuServer::vmstatus($param->{vmid});
1133         my $status = $vmstatus->{$param->{vmid}};
1134
1135         $status->{ha} = &$vm_is_ha_managed($param->{vmid});
1136
1137         return $status;
1138     }});
1139
1140 __PACKAGE__->register_method({
1141     name => 'vm_start',
1142     path => '{vmid}/status/start',
1143     method => 'POST',
1144     protected => 1,
1145     proxyto => 'node',
1146     description => "Start virtual machine.",
1147     permissions => {
1148         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1149     },
1150     parameters => {
1151         additionalProperties => 0,
1152         properties => {
1153             node => get_standard_option('pve-node'),
1154             vmid => get_standard_option('pve-vmid'),
1155             skiplock => get_standard_option('skiplock'),
1156             stateuri => get_standard_option('pve-qm-stateuri'),
1157         },
1158     },
1159     returns => {
1160         type => 'string',
1161     },
1162     code => sub {
1163         my ($param) = @_;
1164
1165         my $rpcenv = PVE::RPCEnvironment::get();
1166
1167         my $authuser = $rpcenv->get_user();
1168
1169         my $node = extract_param($param, 'node');
1170
1171         my $vmid = extract_param($param, 'vmid');
1172
1173         my $stateuri = extract_param($param, 'stateuri');
1174         raise_param_exc({ stateuri => "Only root may use this option." })
1175             if $stateuri && $authuser ne 'root@pam';
1176
1177         my $skiplock = extract_param($param, 'skiplock');
1178         raise_param_exc({ skiplock => "Only root may use this option." })
1179             if $skiplock && $authuser ne 'root@pam';
1180
1181         my $storecfg = PVE::Storage::config();
1182
1183         if (&$vm_is_ha_managed($vmid) && !$stateuri &&
1184             $rpcenv->{type} ne 'ha') {
1185
1186             my $hacmd = sub {
1187                 my $upid = shift;
1188
1189                 my $service = "pvevm:$vmid";
1190
1191                 my $cmd = ['clusvcadm', '-e', $service, '-m', $node];
1192
1193                 print "Executing HA start for VM $vmid\n";
1194
1195                 PVE::Tools::run_command($cmd);
1196
1197                 return;
1198             };
1199
1200             return $rpcenv->fork_worker('hastart', $vmid, $authuser, $hacmd);
1201
1202         } else {
1203
1204             my $realcmd = sub {
1205                 my $upid = shift;
1206
1207                 syslog('info', "start VM $vmid: $upid\n");
1208
1209                 PVE::QemuServer::vm_start($storecfg, $vmid, $stateuri, $skiplock);
1210
1211                 return;
1212             };
1213
1214             return $rpcenv->fork_worker('qmstart', $vmid, $authuser, $realcmd);
1215         }
1216     }});
1217
1218 __PACKAGE__->register_method({
1219     name => 'vm_stop',
1220     path => '{vmid}/status/stop',
1221     method => 'POST',
1222     protected => 1,
1223     proxyto => 'node',
1224     description => "Stop virtual machine.",
1225     permissions => {
1226         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1227     },
1228     parameters => {
1229         additionalProperties => 0,
1230         properties => {
1231             node => get_standard_option('pve-node'),
1232             vmid => get_standard_option('pve-vmid'),
1233             skiplock => get_standard_option('skiplock'),
1234             timeout => {
1235                 description => "Wait maximal timeout seconds.",
1236                 type => 'integer',
1237                 minimum => 0,
1238                 optional => 1,
1239             },
1240             keepActive => {
1241                 description => "Do not decativate storage volumes.",
1242                 type => 'boolean',
1243                 optional => 1,
1244                 default => 0,
1245             }
1246         },
1247     },
1248     returns => {
1249         type => 'string',
1250     },
1251     code => sub {
1252         my ($param) = @_;
1253
1254         my $rpcenv = PVE::RPCEnvironment::get();
1255
1256         my $authuser = $rpcenv->get_user();
1257
1258         my $node = extract_param($param, 'node');
1259
1260         my $vmid = extract_param($param, 'vmid');
1261
1262         my $skiplock = extract_param($param, 'skiplock');
1263         raise_param_exc({ skiplock => "Only root may use this option." })
1264             if $skiplock && $authuser ne 'root@pam';
1265
1266         my $keepActive = extract_param($param, 'keepActive');
1267         raise_param_exc({ keepActive => "Only root may use this option." })
1268             if $keepActive && $authuser ne 'root@pam';
1269
1270         my $storecfg = PVE::Storage::config();
1271
1272         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1273
1274             my $hacmd = sub {
1275                 my $upid = shift;
1276
1277                 my $service = "pvevm:$vmid";
1278
1279                 my $cmd = ['clusvcadm', '-d', $service];
1280
1281                 print "Executing HA stop for VM $vmid\n";
1282
1283                 PVE::Tools::run_command($cmd);
1284
1285                 return;
1286             };
1287
1288             return $rpcenv->fork_worker('hastop', $vmid, $authuser, $hacmd);
1289
1290         } else {
1291             my $realcmd = sub {
1292                 my $upid = shift;
1293
1294                 syslog('info', "stop VM $vmid: $upid\n");
1295
1296                 PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0,
1297                                          $param->{timeout}, 0, 1, $keepActive);
1298
1299                 return;
1300             };
1301
1302             return $rpcenv->fork_worker('qmstop', $vmid, $authuser, $realcmd);
1303         }
1304     }});
1305
1306 __PACKAGE__->register_method({
1307     name => 'vm_reset',
1308     path => '{vmid}/status/reset',
1309     method => 'POST',
1310     protected => 1,
1311     proxyto => 'node',
1312     description => "Reset virtual machine.",
1313     permissions => {
1314         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1315     },
1316     parameters => {
1317         additionalProperties => 0,
1318         properties => {
1319             node => get_standard_option('pve-node'),
1320             vmid => get_standard_option('pve-vmid'),
1321             skiplock => get_standard_option('skiplock'),
1322         },
1323     },
1324     returns => {
1325         type => 'string',
1326     },
1327     code => sub {
1328         my ($param) = @_;
1329
1330         my $rpcenv = PVE::RPCEnvironment::get();
1331
1332         my $authuser = $rpcenv->get_user();
1333
1334         my $node = extract_param($param, 'node');
1335
1336         my $vmid = extract_param($param, 'vmid');
1337
1338         my $skiplock = extract_param($param, 'skiplock');
1339         raise_param_exc({ skiplock => "Only root may use this option." })
1340             if $skiplock && $authuser ne 'root@pam';
1341
1342         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1343
1344         my $realcmd = sub {
1345             my $upid = shift;
1346
1347             PVE::QemuServer::vm_reset($vmid, $skiplock);
1348
1349             return;
1350         };
1351
1352         return $rpcenv->fork_worker('qmreset', $vmid, $authuser, $realcmd);
1353     }});
1354
1355 __PACKAGE__->register_method({
1356     name => 'vm_shutdown',
1357     path => '{vmid}/status/shutdown',
1358     method => 'POST',
1359     protected => 1,
1360     proxyto => 'node',
1361     description => "Shutdown virtual machine.",
1362     permissions => {
1363         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1364     },
1365     parameters => {
1366         additionalProperties => 0,
1367         properties => {
1368             node => get_standard_option('pve-node'),
1369             vmid => get_standard_option('pve-vmid'),
1370             skiplock => get_standard_option('skiplock'),
1371             timeout => {
1372                 description => "Wait maximal timeout seconds.",
1373                 type => 'integer',
1374                 minimum => 0,
1375                 optional => 1,
1376             },
1377             forceStop => {
1378                 description => "Make sure the VM stops.",
1379                 type => 'boolean',
1380                 optional => 1,
1381                 default => 0,
1382             },
1383             keepActive => {
1384                 description => "Do not decativate storage volumes.",
1385                 type => 'boolean',
1386                 optional => 1,
1387                 default => 0,
1388             }
1389         },
1390     },
1391     returns => {
1392         type => 'string',
1393     },
1394     code => sub {
1395         my ($param) = @_;
1396
1397         my $rpcenv = PVE::RPCEnvironment::get();
1398
1399         my $authuser = $rpcenv->get_user();
1400
1401         my $node = extract_param($param, 'node');
1402
1403         my $vmid = extract_param($param, 'vmid');
1404
1405         my $skiplock = extract_param($param, 'skiplock');
1406         raise_param_exc({ skiplock => "Only root may use this option." })
1407             if $skiplock && $authuser ne 'root@pam';
1408
1409         my $keepActive = extract_param($param, 'keepActive');
1410         raise_param_exc({ keepActive => "Only root may use this option." })
1411             if $keepActive && $authuser ne 'root@pam';
1412
1413         my $storecfg = PVE::Storage::config();
1414
1415         my $realcmd = sub {
1416             my $upid = shift;
1417
1418             syslog('info', "shutdown VM $vmid: $upid\n");
1419
1420             PVE::QemuServer::vm_stop($storecfg, $vmid, $skiplock, 0, $param->{timeout},
1421                                      1, $param->{forceStop}, $keepActive);
1422
1423             return;
1424         };
1425
1426         return $rpcenv->fork_worker('qmshutdown', $vmid, $authuser, $realcmd);
1427     }});
1428
1429 __PACKAGE__->register_method({
1430     name => 'vm_suspend',
1431     path => '{vmid}/status/suspend',
1432     method => 'POST',
1433     protected => 1,
1434     proxyto => 'node',
1435     description => "Suspend virtual machine.",
1436     permissions => {
1437         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1438     },
1439     parameters => {
1440         additionalProperties => 0,
1441         properties => {
1442             node => get_standard_option('pve-node'),
1443             vmid => get_standard_option('pve-vmid'),
1444             skiplock => get_standard_option('skiplock'),
1445         },
1446     },
1447     returns => {
1448         type => 'string',
1449     },
1450     code => sub {
1451         my ($param) = @_;
1452
1453         my $rpcenv = PVE::RPCEnvironment::get();
1454
1455         my $authuser = $rpcenv->get_user();
1456
1457         my $node = extract_param($param, 'node');
1458
1459         my $vmid = extract_param($param, 'vmid');
1460
1461         my $skiplock = extract_param($param, 'skiplock');
1462         raise_param_exc({ skiplock => "Only root may use this option." })
1463             if $skiplock && $authuser ne 'root@pam';
1464
1465         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1466
1467         my $realcmd = sub {
1468             my $upid = shift;
1469
1470             syslog('info', "suspend VM $vmid: $upid\n");
1471
1472             PVE::QemuServer::vm_suspend($vmid, $skiplock);
1473
1474             return;
1475         };
1476
1477         return $rpcenv->fork_worker('qmsuspend', $vmid, $authuser, $realcmd);
1478     }});
1479
1480 __PACKAGE__->register_method({
1481     name => 'vm_resume',
1482     path => '{vmid}/status/resume',
1483     method => 'POST',
1484     protected => 1,
1485     proxyto => 'node',
1486     description => "Resume virtual machine.",
1487     permissions => {
1488         check => ['perm', '/vms/{vmid}', [ 'VM.PowerMgmt' ]],
1489     },
1490     parameters => {
1491         additionalProperties => 0,
1492         properties => {
1493             node => get_standard_option('pve-node'),
1494             vmid => get_standard_option('pve-vmid'),
1495             skiplock => get_standard_option('skiplock'),
1496         },
1497     },
1498     returns => {
1499         type => 'string',
1500     },
1501     code => sub {
1502         my ($param) = @_;
1503
1504         my $rpcenv = PVE::RPCEnvironment::get();
1505
1506         my $authuser = $rpcenv->get_user();
1507
1508         my $node = extract_param($param, 'node');
1509
1510         my $vmid = extract_param($param, 'vmid');
1511
1512         my $skiplock = extract_param($param, 'skiplock');
1513         raise_param_exc({ skiplock => "Only root may use this option." })
1514             if $skiplock && $authuser ne 'root@pam';
1515
1516         die "VM $vmid not running\n" if !PVE::QemuServer::check_running($vmid);
1517
1518         my $realcmd = sub {
1519             my $upid = shift;
1520
1521             syslog('info', "resume VM $vmid: $upid\n");
1522
1523             PVE::QemuServer::vm_resume($vmid, $skiplock);
1524
1525             return;
1526         };
1527
1528         return $rpcenv->fork_worker('qmresume', $vmid, $authuser, $realcmd);
1529     }});
1530
1531 __PACKAGE__->register_method({
1532     name => 'vm_sendkey',
1533     path => '{vmid}/sendkey',
1534     method => 'PUT',
1535     protected => 1,
1536     proxyto => 'node',
1537     description => "Send key event to virtual machine.",
1538     permissions => {
1539         check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
1540     },
1541     parameters => {
1542         additionalProperties => 0,
1543         properties => {
1544             node => get_standard_option('pve-node'),
1545             vmid => get_standard_option('pve-vmid'),
1546             skiplock => get_standard_option('skiplock'),
1547             key => {
1548                 description => "The key (qemu monitor encoding).",
1549                 type => 'string'
1550             }
1551         },
1552     },
1553     returns => { type => 'null'},
1554     code => sub {
1555         my ($param) = @_;
1556
1557         my $rpcenv = PVE::RPCEnvironment::get();
1558
1559         my $authuser = $rpcenv->get_user();
1560
1561         my $node = extract_param($param, 'node');
1562
1563         my $vmid = extract_param($param, 'vmid');
1564
1565         my $skiplock = extract_param($param, 'skiplock');
1566         raise_param_exc({ skiplock => "Only root may use this option." })
1567             if $skiplock && $authuser ne 'root@pam';
1568
1569         PVE::QemuServer::vm_sendkey($vmid, $skiplock, $param->{key});
1570
1571         return;
1572     }});
1573
1574 __PACKAGE__->register_method({
1575     name => 'migrate_vm',
1576     path => '{vmid}/migrate',
1577     method => 'POST',
1578     protected => 1,
1579     proxyto => 'node',
1580     description => "Migrate virtual machine. Creates a new migration task.",
1581     permissions => {
1582         check => ['perm', '/vms/{vmid}', [ 'VM.Migrate' ]],
1583     },
1584     parameters => {
1585         additionalProperties => 0,
1586         properties => {
1587             node => get_standard_option('pve-node'),
1588             vmid => get_standard_option('pve-vmid'),
1589             target => get_standard_option('pve-node', { description => "Target node." }),
1590             online => {
1591                 type => 'boolean',
1592                 description => "Use online/live migration.",
1593                 optional => 1,
1594             },
1595             force => {
1596                 type => 'boolean',
1597                 description => "Allow to migrate VMs which use local devices. Only root may use this option.",
1598                 optional => 1,
1599             },
1600         },
1601     },
1602     returns => {
1603         type => 'string',
1604         description => "the task ID.",
1605     },
1606     code => sub {
1607         my ($param) = @_;
1608
1609         my $rpcenv = PVE::RPCEnvironment::get();
1610
1611         my $authuser = $rpcenv->get_user();
1612
1613         my $target = extract_param($param, 'target');
1614
1615         my $localnode = PVE::INotify::nodename();
1616         raise_param_exc({ target => "target is local node."}) if $target eq $localnode;
1617
1618         PVE::Cluster::check_cfs_quorum();
1619
1620         PVE::Cluster::check_node_exists($target);
1621
1622         my $targetip = PVE::Cluster::remote_node_ip($target);
1623
1624         my $vmid = extract_param($param, 'vmid');
1625
1626         raise_param_exc({ force => "Only root may use this option." })
1627             if $param->{force} && $authuser ne 'root@pam';
1628
1629         # test if VM exists
1630         my $conf = PVE::QemuServer::load_config($vmid);
1631
1632         # try to detect errors early
1633
1634         PVE::QemuServer::check_lock($conf);
1635
1636         if (PVE::QemuServer::check_running($vmid)) {
1637             die "cant migrate running VM without --online\n"
1638                 if !$param->{online};
1639         }
1640
1641         my $storecfg = PVE::Storage::config();
1642         PVE::QemuServer::check_storage_availability($storecfg, $conf, $target);
1643
1644         if (&$vm_is_ha_managed($vmid) && $rpcenv->{type} ne 'ha') {
1645
1646             my $hacmd = sub {
1647                 my $upid = shift;
1648
1649                 my $service = "pvevm:$vmid";
1650
1651                 my $cmd = ['clusvcadm', '-M', $service, '-m', $target];
1652
1653                 print "Executing HA migrate for VM $vmid to node $target\n";
1654
1655                 PVE::Tools::run_command($cmd);
1656
1657                 return;
1658             };
1659
1660             return $rpcenv->fork_worker('hamigrate', $vmid, $authuser, $hacmd);
1661
1662         } else {
1663
1664             my $realcmd = sub {
1665                 my $upid = shift;
1666
1667                 PVE::QemuMigrate->migrate($target, $targetip, $vmid, $param);
1668             };
1669
1670             return $rpcenv->fork_worker('qmigrate', $vmid, $authuser, $realcmd);
1671         }
1672
1673     }});
1674
1675 __PACKAGE__->register_method({
1676     name => 'monitor',
1677     path => '{vmid}/monitor',
1678     method => 'POST',
1679     protected => 1,
1680     proxyto => 'node',
1681     description => "Execute Qemu monitor commands.",
1682     permissions => {
1683         check => ['perm', '/vms/{vmid}', [ 'VM.Monitor' ]],
1684     },
1685     parameters => {
1686         additionalProperties => 0,
1687         properties => {
1688             node => get_standard_option('pve-node'),
1689             vmid => get_standard_option('pve-vmid'),
1690             command => {
1691                 type => 'string',
1692                 description => "The monitor command.",
1693             }
1694         },
1695     },
1696     returns => { type => 'string'},
1697     code => sub {
1698         my ($param) = @_;
1699
1700         my $vmid = $param->{vmid};
1701
1702         my $conf = PVE::QemuServer::load_config ($vmid); # check if VM exists
1703
1704         my $res = '';
1705         eval {
1706             $res = PVE::QemuServer::vm_monitor_command($vmid, $param->{command});
1707         };
1708         $res = "ERROR: $@" if $@;
1709
1710         return $res;
1711     }});
1712
1713 1;