This document defines the XenEnterprise Management API—an API for remotely configuring and
controlling virtualised guests running on a Xen-enabled cluster.
The API is presented here as a set of Remote Procedure Calls, with a wire format based upon
XML-RPC. No specific language bindings are prescribed, although examples will be given in the
python programming language.
Although we adopt some terminology from object-oriented pro gramming, future client language
bindings may or may not be object oriented. The API reference uses the terminology classes and
objects. For our purposes a class is simply a hierarchical namespace; an object is an instance of
a class with its fields set to specific values. Objects are persistent and exist on the server-side.
Clients may obtain opaque references to these server-side objects and then access their fields via
get/set RPCs.
For each class we specify a list of fields along with their types and qualifiers. A qualifier is one of:
• RO
• RO
• RW : the field is Read/Write. For example, the name of a VM.
A full list of types is given in Chapter 2. However, there are three types tha t require explicit
mention:
• t Ref : signifies a reference to an object of type t.
• t Set: signifies a set containing values of type t.
• (t1, t2) Map: signifies a mapping from values of type t1to values of type t2.
Note that there are a number of cases where Refs are doubly linked—e.g. a VM has a field called
VIFs of type (VIF Ref ) Set ; this field lists the network interfaces attached to a particular VM.
Similarly, the VIF class has a field called VM of type (VM Ref ) which references the VM to which
the interface is connected. These two fields are bound together, in the sense that creating a new
VIF causes the VIFs field of the corresponding VM object to be updated automatically.
The API reference explicitly lists the fields that are bound together in this way. It also contains a
diagram that shows relationships between classes. In this dia gram an edge signifies the existance
of a pair of fields tha t are bound together, using standard crows-foot notation to signify the type
of relationship (e.g. one-many, many-many).
: the field is Read Only. Furthermore, its value is automatically computed at runtime.
run
For example: current CPU load and disk IO throughput.
: the field must be manually set when a new o b ject is created, but is then Read Only
ins
for the dur ation of the object’s life. For example, the maximum memory addressable by a
guest is set before the guest boots.
5
1.1. RPCS ASSOCIATED WITH FIELDSCHAPTER 1. INTRODUCTION
1.1RPCs associated with fields
Each field, f, has an RPC accessor associated with it that returns f’s value:
• “get
f(Ref x)”: takes a Ref that refers to an object and returns the value of f.
Each field, f, with attribute RW and whose outermost type is Set has the following additional
RPCs associated with it:
• an “add
• a “remove
to f(Ref x, v)” RPC adds a new element v to the set1;
from f(Ref x, v)” RPC removes element v from the set;
Each field, f, with attribute RW and whose outermost type is Map has the following additional
RPCs associated with it:
• an “add
to f(Ref x, k, v)” RPC adds new pair (k, v) to the mapping stored in f in
object x. Adding a new pair for duplicate key, k, overwrites any previous mapping for k.
• a “remove from f(Ref x, k)” RPC removes the pair with key k from the mapping stored
in f in object x.
Each field whose outermost type is neither Set nor Map, but whose attribute is RW has an RPC
acessor associated with it that sets its value:
• For RW (Read/W rite), a “set
f(Ref x, v)” RPC function is also provided. This sets field
f on object x to value v.
1.2RPCs associated with classes
• Each c lass has a constructor RPC named “create” that takes as parameters all fields marked
RW and RO
server-side with the specified field values.
. The result of this RPC is that a new persistent object is created on the
ins
• Each class has a get
by uuid(uuid) RPC that returns the object of that class that has the
specified uuid.
• Each class that has a name
label field has a “get by name label(name)” RPC that returns
a set of objects of that class that have the specified label.
• Each class has a “destroy(Ref x)” RPC that explicitly deletes the persistent object spec-
ified by x from the system. This is a non-cascading delete – if the object being removed is
referenced by another object then the destroy call will fail.
1.2.1Additional RPCs
As well as the RPCs enumerated above, some classes have additional RPCs associated with them.
For example, the VM class has RPCs for clo ning, suspending, starting etc. Such additional RPCs
are described explicitly in the API reference.
1
Since sets cannot contain duplicate values this operation has no action in the case that v was already in the
set.
6
1.3. WIRE PROTOCOL FOR REMOTE API CALLSCHAPTER 1. INTRODUCTION
1.3Wire Protocol for Remote API Calls
API calls are sent over a network to a Xen-enabled host using the XML-RPC protocol. In this
Section we describe how the higher-level types used in our API Reference are mapped to primitive
XML-RPC types.
In our API Reference we specify the signatures of API functions in the following style:
(ref_vm Set)VM.get_all()
This specifies that the function with name VM.get
ref vms. These types are mapped onto XML-RPC types in a straight-forward manner:
• Floats, Bools, DateTimes and Strings map directly to the XML-RPC double, boolean,
dateTime.iso8601, and string elements.
• all “ref
the API should not make assumptions about the concrete form of these strings and should
not expect them to remain valid after the client’s session with the server has terminated.
• fields named “uuid” of type “String” are mapped to the XML-RPC String type. The
string itself is the OSF DCE UUID presentation format (as output by uuidgen, etc).
• ints are all assumed to be 64-bit in our API and are encoded as a string of decimal digits
(rather than using XML-RPC’s built-in 32-bit i4 type).
• values of enum types are encoded as strings. For example, a value of destroy of type
on
• for all our types, t, our type t Set simply maps to XML-RPC’s Array type, so for example
a value of type String Set would be transmitted like this:
<array>
</array>
” types are opaque references, enco ded as the XML-RPC’s String type. Use rs of
• for types k and v, our type (k, v) Map maps onto an XML-RPC struct, with the key as
the name of the struct. Note that the (k, v) Map type is only valid when k is a String,
Ref, or Int, and in each case the keys of the maps are stringified as above. For example,
the (String, double) Map containing a the mappings Mike → 2.3 and J ohn → 1.2 would
be represented as :
1.3. WIRE PROTOCOL FOR REMOTE API CALLSCHAPTER 1. INTRODUCTION
<name>John</name>
<value><double>1.2</double></value>
</member>
</struct>
</value>
• our Void type is transmitted as an empty string.
1.3.1Note on References vs UUIDs
References are opaque types — e ncoded as XML-RPC strings on the wire — understood only by
the par ticula r server which generated them. Servers are free to choose any concrete representation
they find convenient; clients should not make any assumptions or attempt to parse the string
contents. References are not guaranteed to be permanent identifiers for objects; clients should not
assume that references generated during one session are valid for any future session. References
do not allow objects to be compared for equality. Two references to the same object are not
guaranteed to be textually identical.
UUIDs are intended to be permanent names for objects. They are guaranteed to be in the OSF
DCE UUID presentation format (as output by uuidgen. Clients may store UUIDs on disk and
use them to lookup objects in subsequent sessions with the server. Clients may also test eq uality
on objects by compar ing UUID strings.
The API provides mechanisms for translating between UUIDs and opaque references. Each class
that contains a UUID field provides:
• A “get
server-side object that has UUID=u;
• A get
returns the UUID of the server-side object that is referenced by r.
by uuid” method that takes a UUID, u, and returns an opaque reference to the
uuid function (a regular “field getter” RPC) that takes an opaque reference, r, and
1.3.2Return Values/Status Codes
The return value of an RPC ca ll is an XML-RPC Struct.
• The first element of the struct is named Status; it contains a string value indicating whether
the result of the call was a “Success” or a “Failure”.
If Status was set to Success then the Struct contains a second element named Value:
• The element of the struct named Value contains the function’s return value.
In the case where Status is set to Failure then the struct contains a second element named
ErrorDescription:
• The element of the struct named ErrorDescription contains an array of string values. The
first element of the array is an error code; the remainder of the array are strings representing
error parameters relating to that code.
For example, an XML-RPC return value from the host.get
look like this:
Where uname and password refer to your username and password respectively, as defined by the
Xen administrator. The session id returned by session.login with password is passed to
subequent RPC calls as an authentication token.
A session can be terminated with the session.logout function:
voidsession.logout(session_id session)
1.4.3Synchronous and Asynchronous invocation
Each method call (apart from methods on “Session” and “Task” objects and “getters” and “setters” derived from fields) can be made either synchronously or asynchronously. A synchronous
RPC call blocks until the return value is received; the return value of a synchronous RPC call is
exactly as s pecified in Section 1.3.2.
Only synchronous API calls are listed explicitly in this document. All asynchronous versions are
in the special Async namespace. For example, synchronous call VM.clone(...) (described in
Chapter 2) has an asynchronous co unterpart, Async.VM.clone(...), that is non-blocking.
Instead of returning its result directly, an asynchronous RPC call returns a task-id; this identifier
is subsequently used to track the status of a running asynchronous RPC. Note that an asychronous
call may fail immediately, before a task-id has even been created—to represent this eventuality,
the returned task-id is wrapped in an XML-RPC struct with a Status, ErrorDescription and
Value fields, exactly as specified in Section 1.3.2.
The task-id is provided in the Value field if Status is set to Success.
The RPC call
(ref_task Set)Task.get_all(session_id s)
9
1.5. EXAMPLE INTERACTIVE SESSIONCHAPTER 1. INTRODUCTION
returns a set of all task IDs known to the system. The status (including any returned result and
error codes) of these tasks can then be queried by accessing the fields of the Task object in the
usual way. Note that, in order to get a consistent snapshot of a task’s state, it is advisable to call
the “get
record” function.
1.5Example interactive session
This section describes how an interactive session might look, using the python XML-RPC client
library.
First, initialise python and import the library xmlrpclib:
\$ python2.4
...
>>> import xmlrpclib
Create a python object referencing the remote server:
Acquire a session reference by logg ing in with a username and password (error-handling ommitted
for brevity; the session reference is returned under the key ’Value’ in the resulting dictionary)
The VM references here have the form OpaqueRef:X, though they may not be that simple in the
future, and you should treat them as opaque strings. Templates are VMs with the is
field set to true. We can find the subset of template VMs using a command like the following:
1.5. EXAMPLE INTERACTIVE SESSIONCHAPTER 1. INTRODUCTION
In this case the start message has been rejected, because the VM is a template, and so an error
response has been returned. These high-level err ors are returned as structured data (rather than
as XML-RPC faults), allowing them to be internationalised.
Rather than querying fields individually, whole records may be returned at once. To retrieve the
record of a single object as a python dictio nary:
Figure 1.1 shows the states that a VM can be in and the API calls that can be used to move the
VM between these s tates.
1.7VM boot parameters
The VM class contains a number of fields that control the way in which the VM is booted. With
reference to the fields defined in the VM class (see later in this document), this section outlines
the boot options available and the mechanisms provided for controlling them.
VM b ooting is controlled by setting one of the two mutually exclusive groups: “PV”, and “HVM”.
If HVM.boot
otherwise the VM will be loaded as an HVM domain, and booted using an emulated BIOS.
When paravirtual booting is in use, the PV/bootloader field indicates the bootloader to use. It
may be “pygrub”, in which case the platform’s default installation of pygrub will be used, or
a full path within the control domain to some other bootloader. The other fields, PV/kernel,
PV/ramdisk, PV/args and PV/bootloader
interpretation of those fields is then specific to the bootloader itself, including the possibility that
the bootloader will ignore some or all of those given values. Finally the paths of all bootable disks
are added to the bootloader commandline (a disk is bootable if its VBD has the bootable flag
set). There may be zero, one or many boota ble disks; the bootloader decides which disk (if any)
to boot from.
If the bootloader is pygrub, then the menu.lst is parsed if pres e nt in the guest’s filesystem, otherwise
the specified kernel and ramdisk ar e used, or an autodetected kernel is used if nothing is specified
and autodetection is possible. PV/args is appended to the kernel command line, no matter which
mechanism is used fo r finding the kernel.
If PV/bootloader is empty but PV/kernel is specified, then the kernel and ramdisk values will be
treated as paths within the control domain. If both PV/bootloader and PV/kernel are empty,
then the behaviour is as if PV/bootloader was specified as “pygrub”.
When using HVM booting, HVM/boot
policy is the empty string, then paravirtual domain building and booting will be used;
args will be passed to the bootloader unmodified, and
policy and HVM/boot params spec ify the boot handling.
12
1.7. VM BOOT PARAMETERSCHAPTER 1. INTRODUCTION
Only one policy is currently defined: “BIOS order”. In this case, HVM/boot params should
contain one key-value pair “order” = “N” where N is the string that will be passed to QEMU.
13
Chapter 2
API Reference
2.1Classes
The following classes a re defined:
NameDescription
sessionA session
taskA long-running asynchronous ta sk
eventAsynchronous event reg istration and handling
poolPool-wide information
pool patchPool-wide patches
VMA virtual machine (or ’guest’)
VM metricsThe metrics associated with a VM
VM guest metricsThe metrics re ported by the guest (as opposed to inferred from
outside)
hostA physical host
host crashdumpRepresents a host crash dump
host patchRepresents a patch stored on a server
host metricsThe metrics associated with a host
host cpuA physical CPU
networkA virtual network
VIFA virtual network interface
VIF metricsThe metrics associated with a virtual network device
PIFA physical network interface (note separate VLANs are repre-
sented as several PIFs)
PIF metricsThe metrics associated with a physical network interface
Bond
VLANA VLAN mux/demux
SMA storage manager plugin
SRA storage repository
VDIA virtual disk image
VBDA virtual block device
VBD metricsThe metrics associated with a virtual block device
PBDThe physical block devices through which hosts access SRs
crashdumpA VM crashdump
VTPMA virtual TPM device
consoleA console
userA user of the system
14
2.2. RELATIONSHIPS BETWEEN CLASSESCHAPTER 2. API REFERENCE
session
host
user
VM
VM_metrics
VM_guest_metrics
console
PBD
host_metrics
host_cpu
network
VIF
VIF_metrics
PIF
PIF_metrics
SR
VDI
VBD
VBD_metrics
PBD_metrics
VTPM
2.2Relationships Between Classes
Fields that are bound together are shown in the following table:
The following represents bound fields (as specified above) diagramatically, using crows-foot notation to specify one-to-one, one-to-many or many-to-many relationships:
15
2.3. TYPESCHAPTER 2. API REFERENCE
2.2.1List of bound fields
2.3Types
2.3.1P rimitives
The following primitive types are used to specify methods and fields in the API Reference:
TypeDescription
Stringtext strings
Int64-bit integers
FloatIEEE double-precision floating-point numbers
Boolboolean
DateTimedate and timestamp
Ref (object name)reference to an object of class name
2.3.2Higher order types
The following type constructors are used:
TypeDescription
List (t)an arbitrary-length list of elements of type t
Map (a → b)a table mapping values of type a to values of type b
2.3.3E numeration types
The following enumeration types are used:
enum event operation
addAn object has been cr e ated
delAn object has been deleted
modAn object has been modified
enum console protocol
vt100VT100 terminal
rfbRemote FrameBuffer protocol (as used in VNC)
rdpRemote Desktop Protocol
enum vbd operations
attachAttempting to attach this VBD to a VM
ejectAttempting to eject the media from this VBD
insertAttempting to insert new media into this VBD
plugAttempting to hotplug this VBD
unplugAttempting to hot unplug this VBD
unplug forceAttempting to forcibly unplug this VBD
16
2.3. TYPESCHAPTER 2. API REFERENCE
enum vdi operations
scanScanning backends for new or deleted VDIs
cloneCloning the VDI
copyCopying the VDI
resizeResizing the VDI
snapshotSnapshotting the VDI
destroyDestroying the VDI
forgetForget about the VDI
force unlockForcibly unlocking the VDI
enum storage operations
scanScanning backends for new or deleted VDIs
destroyDestroying the SR
forgetForgetting ab out SR
plugPlugging a PBD into this SR
unplugUnplugging a PBD from this SR
vdi createCreating a new VDI
vdi introduceIntroducing a new VDI
vdi destroyDestroying a VDI
vdi resizeResizing a VDI
vdi cloneCloneing a VDI
vdi snapshotSnapshotting a VDI
enum vif operations
attachAttempting to attach this VIF to a VM
plugAttempting to hotplug this VIF
unplugAttempting to hot unplug this VIF
enum network operations
attachingIndicates this network is attaching to a VIF or PIF
enum host allowed operations
provisionIndicates this host is able to provision another VM
evacuateIndicates this host is evacuating
enum vm power state
17
2.3. TYPESCHAPTER 2. API REFERENCE
HaltedVM is offline and not using any resources
PausedAll resources have been allocated but the VM itself is paused and its vCPUs are not running
RunningRunning
SuspendedVM state has been saved to disk and it is nolonger running. Note that dis ks remain in-use while the
UnknownSome other unknown state
enum after apply guidance
restartHVMThis patch requires HVM guests to be restarted once applied.
restartPVThis patch requires P V guests to be restarted once applied.
restartHostThis patch requires the host to be restarted once applied.
restartXAPIThis patch requires XAPI to be restarted once applied.
enum task status type
pendingtask is in progress
successtask was completed successfully
failuretask has failed
cancellingtask is being cancelled
cancelledtask has been cancelled
enum task allowed operations
cancelrefers to the operatio n “cancel”
enum vm operations
clonerefers to the operatio n “clone”
copyrefers to the operatio n “copy”
provisionrefers to the operatio n “provision”
startrefers to the operatio n “start”
start onrefers to the operatio n “start on”
pauserefers to the operatio n “pause”
unpauserefers to the operatio n “unpause”
clean shutdownrefers to the operation “clean shutdown”
clean rebootrefers to the operatio n “clean reboot”
hard shutdownrefers to the operation “ hard shutdown”
power state resetrefers to the operation “power state reset”
hard rebootrefers to the operatio n “hard rebo ot”
suspendrefers to the operatio n “suspend”
csvmrefers to the operatio n “csvm”
resumerefers to the operatio n “resume”
resume onrefers to the operatio n “resume on”
pool migraterefers to the operatio n “pool migrate”
18
2.3. TYPESCHAPTER 2. API REFERENCE
migraterefers to the operatio n “migrate”
statisticsrefers to the operatio n “statistics”
get boot recordrefers to the operation “get boot r e c ord”
send sysrqrefers to the operatio n “send sysrq”
send triggerrefers to the operatio n “send trigger”
changing memory liveChanging the memory settings
changing shadow memory liveChanging the shadow memory settings
changing VCPUs liveChanging either the VCPUs number or VCPUs params
assert operation valid
update allowed operations
make into templateTurning this VM into a template
importimporting a VM from a network stream
exportexporting a VM to a network stream
destroyrefers to the act of uninstalling the VM
enum on normal exit
destroydestroy the VM s tate
restartrestart the VM
enum on crash behaviour
destroydestroy the VM state
coredump and destroyrecord a coredump and then destroy the VM state
restartrestart the VM
coredump and restartrecord a coredump and then restart the VM
preserveleave the crashed VM paused
rename restartrename the crashed VM and start a new copy
enum ip configuration mode
NoneDo not acquire an IP address
DHCPAcquire an IP address by DHCP
StaticStatic IP address configuration
enum vdi type
systema disk that may be replaced on upgra de
usera disk that is always preserved on upgrade
ephemerala disk that may be reformatted on upgrade
suspenda disk that stores a suspend image
crashdumpa disk that stores VM crashdump information
19
2.3. TYPESCHAPTER 2. API REFERENCE
enum vbd mode
ROonly read-only access will be allowed
RWread-write access will be allowed
enum vbd type
CDVBD will appear to guest as CD
DiskVBD will appear to guest as disk
uuidstringunique identifier/object reference
this hosthost refCurrently connected host
this useruser refCurrently connected user
last activedatetimeTimestamp for last time session was
active
poolboolTrue if this session relates to a intra-
pool login, false otherwise
RPC name: login
with password
Overview:
Attempt to authenticate the user, returning a session reference if successful.
uuidstringunique identifier/ob ject reference
name/labelstringa human-readable name
name/descriptionstringanotesfieldcontainghuman-
readable description
allowed operations(task allowed operations) Setlist of the operations allowed in this
state. This list is advisory only and
the server state may have changed by
the time this field is read by a client.
current operations(string → task allowed operations) Maplinks each of the running tasks using
this object (by reference) to a current operation enum which describes
the nature of the task.
createddatetimeTime task was created
finisheddatetimeTime task finished (i.e.succeeded
or failed). If task-status is pending,
then the value of this field has no
meaning
statustask status typecurrent status of the task
sessionsession refthe session that created the task
resident onhost refthe host on which the task is running
progressfloatif the task is still pending, this field
contains the estimated fraction complete (0.-1.). If task has c ompleted
(successfully or unsuccessfully) this
should be 1.
externalpidintIf the task has spawned a program,
the field record the PID of the process that the task is waiting on. (-1 if
no waiting completion of an external
program )
stunnelpidintIf the task has been forwarded, this
field records the pid of the stunnel
process spawned to manage the forwarding connection
forwardedboolTrue if this task has been forwarded
to a slave
forwarded tohost refThe host to which the task has been
forwarded
typestringif the task has completed successfully,
this field contains the type of the encoded result (i.e. name of the class
whose reference is in the result field).
Undefined otherwise.
resultstringif the task has completed successfully,
this field contains the result value (either Void or an object refer ence). Undefined otherwise.
26
2.5. CLASS: TASKCHAPTER 2. API REFERENCE
RO
run
error infostring Setif the task has failed, this field
contains the set of as sociated error
strings. Undefined otherwise.
stringlabelshort label for the new task
stringdescriptionlonger description for the new task
Return Type: task ref
The reference of the created task object
RPC name: destroy
Overview:
Destroy the task object.
Signature:
void destroy (session_id s, task ref self)
Arguments:
typenamedescription
task refselfReference to the task object
Return Type: void
RPC name: cancel
Overview:
Request that a task be cancelled. Note that a task may fail to be cancelled and may complete or
fail normally and note that, even when a task does cancel, it might take an arbitrary amount of
time.
Signature:
void cancel (session_id s, task ref task)
Arguments:
typenamedescription
task reftas kThe task
Return Type: void
27
2.5. CLASS: TASKCHAPTER 2. API REFERENCE
Possible Error Codes: OPERATION NOT ALLOWED
RPC name: get
all
Overview:
Return a list of all the tasks known to the system.
Signature:
((task ref) Set) get_all (session_id s)
Return Type: (task ref) Set
references to all objects
RPC name: get
all records
Overview:
Return a map of task references to task records for all tas ks known to the system.