vagrant-xapi 0.0.1 → 1.0.0

data/lib/vagrant-xapi/services/console.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "socket"
+require "uri"
+
+require_relative "base"
+require_relative "rfb"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # Forwards the VM's VNC console (XAPI console tunnel, RFB) to a local
+      # TCP port. Each local connection gets its own HTTP CONNECT to XAPI;
+      # the session goes in a cookie. With a password, a viewer must know it
+      # before the proxy connects to XAPI (Rfb).
+      class Console
+        # @param password [String, nil] the one-time VNC password for viewers
+        def initialize(ctx, password: nil)
+          @ctx = ctx
+          @client = ctx.client
+          @host_ref = nil
+          @password = password
+        end
+
+        # @return [URI] the console location
+        def location(vm)
+          unless @client.call("VM.get_power_state", vm) == "Running"
+            raise Error.new(:console_not_running)
+          end
+
+          consoles = @client.call("VM.get_consoles", vm).map { |c| @client.call("console.get_record", c) }
+          rfb = consoles.find { |c| c["protocol"] == "rfb" }
+          raise Error.new(:console_missing) unless rfb
+
+          # The console lives on the host the VM runs on; connect there with
+          # that host's own (pinned) certificate.
+          @host_ref = @client.call("VM.get_resident_on", vm)
+          URI.parse(rfb["location"])
+        end
+
+        # Opens a listening socket on 127.0.0.1.
+        # @return [TCPServer]
+        def listen(port = 0)
+          TCPServer.new("127.0.0.1", port)
+        end
+
+        # Serves connections until stop.call returns true.
+        def serve(server, uri, stop:)
+          threads = []
+          until stop.call
+            ready = IO.select([server], nil, nil, 0.5)
+            next unless ready
+
+            local = server.accept
+            threads << Thread.new(local) { |sock| bridge(sock, uri) }
+          end
+        ensure
+          server.close unless server.closed?
+          threads.each(&:kill)
+        end
+
+        def bridge(local, uri)
+          if @password && !Rfb.serve_viewer(local, @password)
+            @ctx.logger&.warn("console: a viewer gave the wrong password")
+            return
+          end
+          remote = connect(uri)
+          Rfb.join_server(remote) if @password
+          pipe(local, remote)
+        rescue StandardError => e
+          @ctx.logger&.warn("console connection failed: #{e.message}")
+        ensure
+          [local, remote].compact.each do |s|
+            s.close
+          rescue StandardError
+            nil
+          end
+        end
+
+        # HTTP CONNECT to the console location.
+        def connect(uri)
+          sock = @client.transport_for(@host_ref).open_tls_socket
+          path = uri.request_uri
+          sock.write("CONNECT #{path} HTTP/1.0\r\nHost: #{uri.host}\r\n" \
+                     "Cookie: #{@client.session_cookie}\r\n\r\n")
+          header = +""
+          header << sock.readpartial(1) until header.end_with?("\r\n\r\n") || header.size > 8192
+          status = header.lines.first.to_s
+          raise Error.new(:console_refused, status: status.strip) unless status =~ %r{\AHTTP/1\.[01] 200}
+
+          sock
+        end
+
+        private
+
+        def pipe(a, b)
+          loop do
+            # Data already decrypted into the SSL buffer is invisible to select.
+            readable = [a, b].select { |s| s.respond_to?(:pending) && s.pending.positive? }
+            readable, = IO.select([a, b], nil, nil, 1) if readable.empty?
+            next unless readable
+
+            readable.each do |src|
+              dst = src == a ? b : a
+              data = src.readpartial(65_536)
+              dst.write(data)
+            end
+          end
+        rescue EOFError, IOError, Errno::ECONNRESET, Errno::EPIPE
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/services/content_diff.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "open3"
+require "tmpdir"
+
+require_relative "base"
+require_relative "file_diff"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # The content of changed files for `vagrant xapi diff --content`: a
+      # unified diff, made with the local machine's `diff`, of the copies the
+      # guest made (GuestFiles#contents). The result is for a terminal, so
+      # control and format characters are escaped: a file in the guest must
+      # not be able to send escape sequences (also 8-bit C1 ones such as
+      # U+009B) or reorder what is shown (bidi overrides).
+      module ContentDiff
+        DEFAULT_LIMIT = 1024 * 1024
+        # What one side may copy in total, so a diff after a large upgrade
+        # does not fill the guest's /tmp (often RAM) or the local memory.
+        BUDGET = 16 * 1024 * 1024
+        # Like diff and git: a NUL byte in the first 8000 bytes means binary.
+        # GuestFiles#contents checks the same in the guest.
+        BINARY_PROBE = 8000
+        # As FileDiff.escape, but tab and newline stay: they make the diff.
+        CONTROL = /[[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]&&[^\t\n]]/.freeze
+
+        module_function
+
+        # @param old [String, nil] the content before; nil when the file is new
+        # @param new [String, nil] the content after; nil when it was removed
+        # @return [Hash] { diff: String }, or { skipped: :binary } or
+        #   { skipped: :identical } (both copies exist and are the same, e.g.
+        #   when only hashing a file failed)
+        def render(path, old, new)
+          return { skipped: :binary } if binary?(old) || binary?(new)
+
+          Dir.mktmpdir("vagrant-xapi-content-") do |dir|
+            a = File.join(dir, "a")
+            b = File.join(dir, "b")
+            File.binwrite(a, old.to_s)
+            File.binwrite(b, new.to_s)
+            label = FileDiff.escape(path)
+            labels = [old ? "a#{label}" : "/dev/null", new ? "b#{label}" : "/dev/null"]
+            out, err, status = Open3.capture3("diff", "-u", "--label", labels[0], "--label", labels[1], a, b,
+                                              binmode: true)
+            # 0: equal, 1: different, anything else (also a signal, which has
+            # no exit status): trouble, and the output may be cut off.
+            unless status.success? || status.exitstatus == 1
+              detail = err.strip.empty? ? status.to_s : err.strip
+              raise Error.new(:diff_local_failed, detail: FileDiff.escape(detail[0, 300]))
+            end
+            if status.success?
+              return { skipped: :identical } if old && new
+
+              # An empty file that was added or removed: only the header says so.
+              out = "--- #{labels[0]}\n+++ #{labels[1]}\n"
+            end
+
+            { diff: sanitize(out) }
+          end
+        rescue Errno::ENOENT
+          raise Error.new(:diff_local_missing)
+        end
+
+        def binary?(data)
+          !data.nil? && data.b.byteslice(0, BINARY_PROBE).include?("\0")
+        end
+
+        # The budget per side for a limit per file: a file of limit bytes
+        # always fits.
+        def budget(limit)
+          [BUDGET, limit].max
+        end
+
+        # Valid UTF-8 for the terminal: invalid bytes as \xHH, control and
+        # format characters other than tab and newline as \xHH (ASCII) or
+        # \u{HHHH}, as FileDiff.escape does for paths.
+        def sanitize(text)
+          text.dup.force_encoding(Encoding::UTF_8)
+              .scrub { |bytes| bytes.bytes.map { |byte| format("\\x%02X", byte) }.join }
+              .gsub(CONTROL) { |ch| ch.ord < 0x80 ? format("\\x%02X", ch.ord) : format("\\u{%X}", ch.ord) }
+        end
+
+        # "1M", "512K", "100000" => bytes; nil when it is no size.
+        def parse_size(value)
+          m = /\A(\d+)\s*([kKmM]?)i?[bB]?\z/.match(value.to_s.strip)
+          return nil unless m
+
+          m[1].to_i * { "" => 1, "k" => 1024, "m" => 1024 * 1024 }.fetch(m[2].downcase)
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/services/destroyer.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "diff_disks"
+require_relative "snapshots"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # Removes a VM and everything the plugin created for it. Only objects
+      # carrying this machine's marking are touched; VDIs that belong to a
+      # template are never destroyed.
+      class Destroyer
+        include Helpers
+
+        def initialize(ctx)
+          @ctx = ctx
+          @client = ctx.client
+        end
+
+        # @return [Array<String>] internal network refs the VM used, for
+        #   cleanup by the caller once the VM is gone
+        # @param owner [Hash, nil] :machine and :project the VM must be marked
+        #   with (a copied project directory must not destroy the original's VM)
+        def destroy(vm, require_marking: true, owner: nil)
+          rec = @client.call("VM.get_record", vm)
+          check_owner!(rec, owner) if require_marking
+
+          vm_uuid = rec["uuid"]
+          networks = rec["VIFs"].map { |vif| ignore_missing { @client.call("VIF.get_network", vif) } }.compact.uniq
+
+          unremoved = remove_diff_leftovers(vm)
+          Snapshots.new(@ctx).delete_all(vm)
+
+          owned = owned_vdis(vm, vm_uuid)
+          suspend_vdi = rec["suspend_VDI"]
+          @ctx.ui&.info(:destroying_vm)
+          @client.call("VM.destroy", vm)
+          owned.each { |vdi| ignore_missing { @client.call("VDI.destroy", vdi) } }
+          ignore_missing { @client.call("VDI.destroy", suspend_vdi) } unless null_ref?(suspend_vdi)
+          DiffDisks.new(@ctx).remove_orphans(unremoved, vm_uuid) unless unremoved.empty?
+          networks
+        end
+
+        # Raises unless the VM is marked (and, with owner, marked for that
+        # machine and project). Runs before anything touches the VM.
+        # @param rec [Hash, String] VM record or ref
+        def check_owner!(rec, owner = nil)
+          rec = @client.call("VM.get_record", rec) if rec.is_a?(String)
+          oc = rec["other_config"] || {}
+          raise Error.new(:vm_not_marked, uuid: rec["uuid"]) unless Marking.marked?(oc)
+          return unless owner
+          return if oc[Marking::MACHINE] == owner[:machine].to_s && oc[Marking::PROJECT] == owner[:project].to_s
+
+          raise Error.new(:vm_other_owner, uuid: rec["uuid"], machine: oc[Marking::MACHINE].to_s,
+                                           project: oc[Marking::PROJECT].to_s)
+        end
+
+        private
+
+        # Clones an interrupted `vagrant xapi diff` left. Best effort: the
+        # search is pool-wide, and a destroy (also the rollback of a failed
+        # create) must not fail on it. Attached ones are removed with the
+        # VM's own disks anyway.
+        # @return [Array<DiffDisks::Disk>] the ones that could not be removed,
+        #   tried again once the VM is gone
+        def remove_diff_leftovers(vm)
+          unremoved = []
+          DiffDisks.new(@ctx).cleanup_leftovers(vm, failed: unremoved)
+          unremoved
+        rescue Api::Error => e
+          @ctx.logger&.warn("could not look for leftover diff disks: #{e.message}")
+          unremoved || []
+        end
+
+        # VDIs of the VM's VBDs that we may remove: marked as owned by this
+        # VM, and no disk of a template, even if one is attached to the VM and
+        # carries its marking.
+        def owned_vdis(vm, vm_uuid)
+          vbds_of(vm).filter_map do |_vbd, rec|
+            vdi = rec["VDI"]
+            next if null_ref?(vdi)
+
+            oc = ignore_missing { @client.call("VDI.get_other_config", vdi) } || {}
+            next unless Marking.ours?(oc, Marking::OWNER_VM, vm_uuid)
+            next if template_disk?(vdi)
+
+            vdi
+          end
+        end
+
+        # Asked only for the VDIs about to be destroyed, so a destroy does
+        # not read the disks of every template in the pool.
+        def template_disk?(vdi)
+          vbds = ignore_missing { @client.call("VDI.get_VBDs", vdi) } || []
+          vbds.any? do |vbd|
+            owner = ignore_missing { @client.call("VBD.get_VM", vbd) }
+            owner && ignore_missing { @client.call("VM.get_is_a_template", owner) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-xapi/services/diff_disks.rb

@@ -0,0 +1,346 @@
+# frozen_string_literal: true
+
+require_relative "base"
+require_relative "file_diff"
+require_relative "lock"
+require_relative "snapshots"
+
+module VagrantPlugins
+  module Xapi
+    module Services
+      # The XAPI side of `vagrant xapi diff`: throwaway copy-on-write clones of
+      # a snapshot's disks, attached to the running VM so that the guest can
+      # mount them. Each clone carries vagrant-xapi.vm and vagrant-xapi.diff,
+      # its VBD vagrant-xapi.diff, so the disks of an interrupted run are found
+      # and removed: by the next diff, before the VM boots, and on destroy.
+      class DiffDisks
+        include Helpers
+
+        # One attached clone. vdi is nil for a leftover VBD whose disk is not
+        # ours to destroy.
+        Disk = Struct.new(:vbd, :vdi, :device, :size, keyword_init: true)
+
+        # Linux device names XAPI reports in VBD.device (xvdb, ...)
+        DEVICE = /\A(?:xvd|sd|hd|vd)[a-z]{1,3}\z/.freeze
+        LOCK_TTL = 300
+        LOCK_WAIT = 1800
+        # How long boot and package wait for a diff of the same VM: one can
+        # only still run there when the VM was halted under it.
+        LEFTOVER_LOCK_WAIT = 300
+        DEVICE_WAIT = 30
+        UNPLUG_TIMEOUT = 120
+
+        def self.label(vm_uuid)
+          "vagrant-xapi diff of #{vm_uuid}"
+        end
+
+        def initialize(ctx, sleeper: ->(seconds) { sleep seconds })
+          @ctx = ctx
+          @client = ctx.client
+          @sleeper = sleeper
+        end
+
+        # Runs the block under the lock diff.<vm uuid>, so that two runs on one
+        # VM never remove each other's disks, mounts or directories. Boot and
+        # package take it too before they remove leftovers.
+        def synchronize(vm, wait: LOCK_WAIT, &block)
+          lock(vm, wait: wait).synchronize(&block)
+        end
+
+        # The lock of a VM's diff runs.
+        # @return [Lock]
+        def lock(vm, wait: LOCK_WAIT)
+          Lock.new(@ctx, "diff.#{uuid_of(vm)}", ttl: LOCK_TTL, wait: wait)
+        end
+
+        # Clones every disk of the snapshot and attaches the clones to the
+        # running VM. Read-write: XAPI refuses read-only disks for HVM guests
+        # (DISK_VBD_MUST_BE_READWRITE_FOR_HVM), and a writable device lets the
+        # guest replay the journal of a crash-consistent snapshot. On any
+        # error the disks attached so far are removed again.
+        # @return [Array<Disk>]
+        def attach_snapshot(vm, name, run_id)
+          snap = Snapshots.new(@ctx).find(vm, name)
+          vm_uuid = uuid_of(vm)
+          disks = []
+          begin
+            vbds_of(snap).sort_by { |_vbd, rec| rec["userdevice"].to_i }.each do |_vbd, rec|
+              next unless file_system_disk?(rec)
+              raise Api::TaskCancelled, "diff" if @ctx.cancelled?
+
+              disks << attach_clone(vm, vm_uuid, rec["VDI"], run_id)
+            end
+          rescue Exception # rubocop:disable Lint/RescueException
+            detach(disks)
+            raise
+          end
+          raise Error.new(:diff_snapshot_no_disks, name: name.to_s) if disks.empty?
+
+          disks
+        end
+
+        # Unplugs and destroys the clones. Never raises: a disk that cannot be
+        # removed is reported and removed by the next diff, boot or destroy.
+        def detach(disks)
+          return if disks.empty?
+
+          @ctx.ui&.detail(:diff_detaching)
+          disks.reverse_each { |disk| remove(disk) }
+        end
+
+        # Removes what an interrupted run left: VBDs of this VM marked as diff
+        # disks, and (with unattached) clones that never got a VBD. Only VDIs
+        # marked with vagrant-xapi.diff and this VM are destroyed.
+        #
+        # With required (before the VM boots or is packaged), a copy that is
+        # still attached afterwards raises: it has the same file system UUIDs
+        # as the VM's own disks, so the guest could mount or boot from it, and
+        # a box would take it along without marking.
+        # @return [Integer] number of disks removed
+        # @param failed [Array<Disk>, nil] collects the disks that could not be
+        #   removed instead of warning (destroy retries them once the VM is
+        #   gone, see #remove_orphans)
+        def cleanup_leftovers(vm, unattached: true, required: false, failed: nil)
+          vm_uuid = uuid_of(vm)
+          found = []
+          vbds_of(vm).each do |vbd, rec|
+            next unless diff_vbd?(rec)
+
+            vdi = rec["VDI"]
+            found << Disk.new(vbd: vbd, vdi: !null_ref?(vdi) && diff_vdi?(vdi_other_config(vdi), vm_uuid) ? vdi : nil)
+          end
+          found.concat(unattached_vdis(vm_uuid).map { |vdi| Disk.new(vdi: vdi) }) if unattached
+          return 0 if found.empty?
+
+          @ctx.ui&.detail(:diff_leftovers, count: found.size)
+          found.each { |disk| remove(disk, failed: failed) }
+          check_none_attached!(vm, vm_uuid) if required
+          found.size
+        end
+
+        private
+
+        # Disks with file systems to compare: not CD drives, not read-only
+        # disks, not uploaded ISOs (such as the cloud-init ISO, which is
+        # attached as a read-only disk when the SR refuses a CD).
+        def file_system_disk?(rec)
+          return false if rec["type"] != "Disk" || rec["mode"] == "RO" || null_ref?(rec["VDI"])
+
+          oc = vdi_other_config(rec["VDI"])
+          !oc.key?(Marking::CLOUD_INIT) && !oc.key?(Marking::CONTENT_SHA256)
+        end
+
+        def attach_clone(vm, vm_uuid, source, run_id)
+          vdi = clone(source, vm_uuid, run_id)
+          disk = Disk.new(vdi: vdi)
+          begin
+            mark(vdi, vm_uuid, run_id)
+            disk.vbd = create_vbd(vm, vdi, mode: "RW", type: "Disk", other_config: { Marking::DIFF => run_id.to_s })
+            disk.size = @client.call("VDI.get_virtual_size", vdi).to_i
+            plug(disk.vbd)
+            disk.device = wait_for_device(disk.vbd)
+          rescue Exception # rubocop:disable Lint/RescueException
+            remove(disk)
+            raise
+          end
+          disk
+        end
+
+        # Not cancellable: a clone cancelled half-way could exist without our
+        # marking; Ctrl-C takes effect right after it. When waiting for it
+        # fails all the same (task_timeout, or a lost connection), XAPI may
+        # still have made the clone, without our marking: it is looked for
+        # among the VDIs that were not there before, by what a clone
+        # inherits from its source (name, SR, other_config, no VBD), marked
+        # and removed. One that is not there yet is reported.
+        # @return [String] the clone's ref
+        def clone(source, vm_uuid, run_id)
+          src = @client.call("VDI.get_record", source)
+          before = clones_of(src)
+          begin
+            vdi = @client.run_task("VDI.clone", source, {}, label: "clone snapshot disk").ref
+          rescue Api::TaskTimeout, Api::ConnectionError
+            late = begin
+              clones_of(src) - before
+            rescue Api::Error
+              []
+            end
+            late.each do |ref|
+              # Marked first: if removing it fails, the next diff or destroy
+              # finds it.
+              mark(ref, vm_uuid, run_id)
+              remove(Disk.new(vdi: ref))
+            rescue Api::Error => e
+              @ctx.logger&.warn("late clone #{ref} not removed: #{e.message}")
+            end
+            @ctx.ui&.warn(:diff_clone_unfinished, name: FileDiff.escape(src["name_label"].to_s)) if late.empty?
+            raise
+          end
+          raise Error.new(:diff_clone_failed) unless vdi
+
+          vdi
+        end
+
+        # Unattached VDIs that look like clones of the source: its name, SR
+        # and other_config, not a snapshot. @return [Array<String>] refs
+        def clones_of(src)
+          name = src["name_label"].to_s
+          records = begin
+            @client.call("VDI.get_all_records_where", %(field "name__label"="#{Helpers.where_value(name)}"))
+          rescue Api::XapiError
+            @client.call("VDI.get_all_records")
+          end
+          records.filter_map do |ref, rec|
+            next unless rec["name_label"] == name && rec["SR"] == src["SR"] && !rec["is_a_snapshot"]
+            next unless Array(rec["VBDs"]).empty? && (rec["other_config"] || {}) == (src["other_config"] || {})
+
+            ref
+          end
+        end
+
+        # The name first: it is how a clone without VBD is found again, and
+        # until then the clone carries the source's name. Then
+        # vagrant-xapi.diff, so that a run that dies from here on leaves a
+        # clone the next diff or destroy finds (#unattached_vdis), and only
+        # then the rest. VDI.clone copies other_config, so the clone already
+        # carries vagrant-xapi.vm of this VM when the snapshot disk did; it is
+        # only rewritten when it differs, so it never goes missing in
+        # between. The snapshot disk's other markings (disk name, cloud-init,
+        # checksum) are removed: the clone could otherwise be taken for one of
+        # the VM's own disks. It only belongs to this run.
+        def mark(vdi, vm_uuid, run_id)
+          @client.call("VDI.set_name_label", vdi, self.class.label(vm_uuid))
+          set_oc("VDI", vdi, Marking::DIFF, run_id)
+          oc = @client.call("VDI.get_other_config", vdi)
+          set_oc("VDI", vdi, Marking::OWNER_VM, vm_uuid) unless oc[Marking::OWNER_VM] == vm_uuid
+          oc.each_key do |key|
+            next if [Marking::OWNER_VM, Marking::DIFF].include?(key)
+
+            remove_oc("VDI", vdi, key) if key.start_with?(Marking::PREFIX)
+          end
+        end
+
+        def plug(vbd)
+          @ctx.run_task("VBD.plug", vbd, label: "attach snapshot disk")
+        rescue Api::XapiError => e
+          raise Error.new(:diff_attach_failed, reason: e.code, detail: e.params.join(", "))
+        end
+
+        # XAPI fills in VBD.device from the xenopsd event of the plug, which
+        # may come a moment after the plug task finished.
+        def wait_for_device(vbd)
+          DEVICE_WAIT.times do
+            device = @client.call("VBD.get_device", vbd).to_s
+            return device if DEVICE.match?(device)
+            raise Api::TaskCancelled, "diff" if @ctx.cancelled?
+
+            @sleeper.call(1)
+          end
+          raise Error.new(:diff_device_unknown, device: @client.call("VBD.get_device", vbd).to_s)
+        end
+
+        # Runs after errors and Ctrl-C too, so nothing here is cancellable.
+        def remove(disk, failed: nil)
+          if disk.vbd
+            ignore_missing { unplug(disk.vbd) } if ignore_missing { @client.call("VBD.get_currently_attached", disk.vbd) }
+            ignore_missing { @client.call("VBD.destroy", disk.vbd) }
+          end
+          ignore_missing { @client.call("VDI.destroy", disk.vdi) } if disk.vdi
+          true
+        rescue Api::Error => e
+          @ctx.logger&.warn("diff disk #{disk.vdi || disk.vbd} not removed: #{e.message}")
+          if failed
+            failed << disk
+          else
+            @ctx.ui&.warn(:diff_detach_failed, vdi: disk.vdi.to_s, reason: e.message)
+          end
+          false
+        end
+
+        public
+
+        # Destroys the copies #cleanup_leftovers could not remove during
+        # destroy, now that the VM and its VBDs are gone. Nothing looks for a
+        # copy of a destroyed VM later, so one that still cannot be removed is
+        # named, with how to find and remove it. Never raises.
+        def remove_orphans(disks, vm_uuid)
+          disks.each do |disk|
+            next unless disk.vdi
+
+            begin
+              ignore_missing { @client.call("VDI.destroy", disk.vdi) }
+            rescue Api::Error => e
+              @ctx.logger&.warn("diff disk #{disk.vdi} not removed after destroy: #{e.message}")
+              @ctx.ui&.warn(:diff_leftover_orphaned, uuid: vdi_uuid(disk.vdi), vm: vm_uuid, reason: e.message)
+            end
+          end
+        end
+
+        private
+
+        def vdi_uuid(vdi)
+          @client.call("VDI.get_uuid", vdi)
+        rescue Api::Error
+          vdi
+        end
+
+        # A clone the guest still holds (a busy umount) refuses a clean unplug,
+        # or makes it wait. It is a throwaway copy: force it off rather than
+        # leave a disk with the same file system UUIDs attached to the VM. As
+        # tasks without cancel, so that Ctrl-C does not stop them and a slow
+        # unplug is not cut off by the timeout of a single call.
+        def unplug(vbd)
+          @client.run_task("VBD.unplug", vbd, label: "detach snapshot disk", timeout: UNPLUG_TIMEOUT)
+        rescue Api::XapiError, Api::TaskTimeout => e
+          raise if e.is_a?(Api::XapiError) && e.code == "HANDLE_INVALID"
+
+          @ctx.logger&.warn("unplug of diff disk failed (#{e.message}); forcing")
+          @client.run_task("VBD.unplug_force", vbd, label: "force-detach snapshot disk", timeout: UNPLUG_TIMEOUT)
+        end
+
+        # Clones without VBD of this VM's runs: marked with vagrant-xapi.diff
+        # and this VM, or, when a run died while marking a clone of a snapshot
+        # disk without vagrant-xapi.vm, with vagrant-xapi.diff and the name
+        # #mark gives (which holds the VM's UUID) but no vagrant-xapi.vm yet.
+        def unattached_vdis(vm_uuid)
+          label = self.class.label(vm_uuid)
+          records = begin
+            @client.call("VDI.get_all_records_where", %(field "name__label"="#{Helpers.where_value(label)}"))
+          rescue Api::XapiError
+            @client.call("VDI.get_all_records")
+          end
+          records.filter_map do |ref, rec|
+            oc = rec["other_config"] || {}
+            unmarked_vm = oc.key?(Marking::DIFF) && !oc.key?(Marking::OWNER_VM) && rec["name_label"] == label
+            next unless diff_vdi?(oc, vm_uuid) || unmarked_vm
+            next unless Array(rec["VBDs"]).empty?
+
+            ref
+          end
+        end
+
+        def diff_vdi?(other_config, vm_uuid)
+          oc = other_config || {}
+          oc.key?(Marking::DIFF) && Marking.ours?(oc, Marking::OWNER_VM, vm_uuid)
+        end
+
+        def diff_vbd?(rec)
+          (rec["other_config"] || {}).key?(Marking::DIFF)
+        end
+
+        def check_none_attached!(vm, vm_uuid)
+          left = vbds_of(vm).count { |_vbd, rec| diff_vbd?(rec) }
+          raise Error.new(:diff_leftover_attached, uuid: vm_uuid, count: left) unless left.zero?
+        end
+
+        def vdi_other_config(vdi)
+          ignore_missing { @client.call("VDI.get_other_config", vdi) } || {}
+        end
+
+        def uuid_of(vm)
+          @client.call("VM.get_uuid", vm)
+        end
+      end
+    end
+  end
+end