]> git.proxmox.com Git - qemu-server.git/blobdiff - PVE/API2/Qemu.pm
api: create disks: avoid adding secondary cloud-init drives
[qemu-server.git] / PVE / API2 / Qemu.pm
index 2d3e0124dad9e3de37d848cb34e90cac8af7ff64..3ec31c26898644114c7727d9030a6545626dd849 100644 (file)
@@ -21,8 +21,9 @@ use PVE::ReplicationConfig;
 use PVE::GuestHelpers;
 use PVE::QemuConfig;
 use PVE::QemuServer;
-use PVE::QemuServer::Drive;
 use PVE::QemuServer::CPUConfig;
+use PVE::QemuServer::Drive;
+use PVE::QemuServer::ImportDisk;
 use PVE::QemuServer::Monitor qw(mon_cmd);
 use PVE::QemuServer::Machine;
 use PVE::QemuMigrate;
@@ -63,11 +64,65 @@ my $resolve_cdrom_alias = sub {
     }
 };
 
+# Used in import-enabled API endpoints. Parses drives using the extended '_with_alloc' schema.
+my $foreach_volume_with_alloc = sub {
+    my ($param, $func) = @_;
+
+    for my $opt (sort keys $param->%*) {
+       next if !PVE::QemuServer::is_valid_drivename($opt);
+
+       my $drive = PVE::QemuServer::Drive::parse_drive($opt, $param->{$opt}, 1);
+       next if !$drive;
+
+       $func->($opt, $drive);
+    }
+};
+
 my $NEW_DISK_RE = qr!^(([^/:\s]+):)?(\d+(\.\d+)?)$!;
+
+my $check_drive_param = sub {
+    my ($param, $storecfg, $extra_checks) = @_;
+
+    for my $opt (sort keys $param->%*) {
+       next if !PVE::QemuServer::is_valid_drivename($opt);
+
+       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt}, 1);
+       raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
+
+       if ($drive->{'import-from'}) {
+           if ($drive->{file} !~ $NEW_DISK_RE || $3 != 0) {
+               raise_param_exc({
+                   $opt => "'import-from' requires special syntax - ".
+                       "use <storage ID>:0,import-from=<source>",
+               });
+           }
+
+           if ($opt eq 'efidisk0') {
+               for my $required (qw(efitype pre-enrolled-keys)) {
+                   if (!defined($drive->{$required})) {
+                       raise_param_exc({
+                           $opt => "need to specify '$required' when using 'import-from'",
+                       });
+                   }
+               }
+           } elsif ($opt eq 'tpmstate0') {
+               raise_param_exc({ $opt => "need to specify 'version' when using 'import-from'" })
+                   if !defined($drive->{version});
+           }
+       }
+
+       PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
+
+       $extra_checks->($drive) if $extra_checks;
+
+       $param->{$opt} = PVE::QemuServer::print_drive($drive, 1);
+    }
+};
+
 my $check_storage_access = sub {
    my ($rpcenv, $authuser, $storecfg, $vmid, $settings, $default_storage) = @_;
 
-   PVE::QemuConfig->foreach_volume($settings, sub {
+   $foreach_volume_with_alloc->($settings, sub {
        my ($ds, $drive) = @_;
 
        my $isCDROM = PVE::QemuServer::drive_is_cdrom($drive);
@@ -88,6 +143,26 @@ my $check_storage_access = sub {
                if !$scfg->{content}->{images};
        } else {
            PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
+           if ($storeid) {
+               my ($vtype) = PVE::Storage::parse_volname($storecfg, $volid);
+               raise_param_exc({ $ds => "content type needs to be 'images' or 'iso'" })
+                   if $vtype ne 'images' && $vtype ne 'iso';
+           }
+       }
+
+       if (my $src_image = $drive->{'import-from'}) {
+           my $src_vmid;
+           if (PVE::Storage::parse_volume_id($src_image, 1)) { # PVE-managed volume
+               (my $vtype, undef, $src_vmid) = PVE::Storage::parse_volname($storecfg, $src_image);
+               raise_param_exc({ $ds => "$src_image has wrong type '$vtype' - not an image" })
+                   if $vtype ne 'images';
+           }
+
+           if ($src_vmid) { # might be actively used by VM and will be copied via clone_disk()
+               $rpcenv->check($authuser, "/vms/${src_vmid}", ['VM.Clone']);
+           } else {
+               PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $src_image);
+           }
        }
     });
 
@@ -147,6 +222,91 @@ my $check_storage_access_migrate = sub {
        if !$scfg->{content}->{images};
 };
 
+my $import_from_volid = sub {
+    my ($storecfg, $src_volid, $dest_info, $vollist) = @_;
+
+    die "could not get size of $src_volid\n"
+       if !PVE::Storage::volume_size_info($storecfg, $src_volid, 10);
+
+    die "cannot import from cloudinit disk\n"
+       if PVE::QemuServer::Drive::drive_is_cloudinit({ file => $src_volid });
+
+    my $src_vmid = (PVE::Storage::parse_volname($storecfg, $src_volid))[2];
+
+    my $src_vm_state = sub {
+       my $exists = $src_vmid && PVE::Cluster::get_vmlist()->{ids}->{$src_vmid} ? 1 : 0;
+
+       my $runs = 0;
+       if ($exists) {
+           eval { PVE::QemuConfig::assert_config_exists_on_node($src_vmid); };
+           die "owner VM $src_vmid not on local node\n" if $@;
+           $runs = PVE::QemuServer::Helpers::vm_running_locally($src_vmid) || 0;
+       }
+
+       return ($exists, $runs);
+    };
+
+    my ($src_vm_exists, $running) = $src_vm_state->();
+
+    die "cannot import from '$src_volid' - full clone feature is not supported\n"
+       if !PVE::Storage::volume_has_feature($storecfg, 'copy', $src_volid, undef, $running);
+
+    my $clonefn = sub {
+       my ($src_vm_exists_now, $running_now) = $src_vm_state->();
+
+       die "owner VM $src_vmid changed state unexpectedly\n"
+           if $src_vm_exists_now != $src_vm_exists || $running_now != $running;
+
+       my $src_conf = $src_vm_exists_now ? PVE::QemuConfig->load_config($src_vmid) : {};
+
+       my $src_drive = { file => $src_volid };
+       my $src_drivename;
+       PVE::QemuConfig->foreach_volume($src_conf, sub {
+           my ($ds, $drive) = @_;
+
+           return if $src_drivename;
+
+           if ($drive->{file} eq $src_volid) {
+               $src_drive = $drive;
+               $src_drivename = $ds;
+           }
+       });
+
+       my $source_info = {
+           vmid => $src_vmid,
+           running => $running_now,
+           drivename => $src_drivename,
+           drive => $src_drive,
+           snapname => undef,
+       };
+
+       my ($src_storeid) = PVE::Storage::parse_volume_id($src_volid);
+
+       return PVE::QemuServer::clone_disk(
+           $storecfg,
+           $source_info,
+           $dest_info,
+           1,
+           $vollist,
+           undef,
+           undef,
+           $src_conf->{agent},
+           PVE::Storage::get_bandwidth_limit('clone', [$src_storeid, $dest_info->{storage}]),
+       );
+    };
+
+    my $cloned;
+    if ($running) {
+       $cloned = PVE::QemuConfig->lock_config_full($src_vmid, 30, $clonefn);
+    } elsif ($src_vmid) {
+       $cloned = PVE::QemuConfig->lock_config_shared($src_vmid, 30, $clonefn);
+    } else {
+       $cloned = $clonefn->();
+    }
+
+    return $cloned->@{qw(file size)};
+};
+
 # Note: $pool is only needed when creating a VM, because pool permissions
 # are automatically inherited if VM already exists inside a pool.
 my $create_disks = sub {
@@ -168,6 +328,15 @@ my $create_disks = sub {
        } elsif (defined($volname) && $volname eq 'cloudinit') {
            $storeid = $storeid // $default_storage;
            die "no storage ID specified (and no default storage)\n" if !$storeid;
+
+           if (
+               my $ci_key = PVE::QemuConfig->has_cloudinit($conf, $ds)
+               || PVE::QemuConfig->has_cloudinit($conf->{pending} || {}, $ds)
+               || PVE::QemuConfig->has_cloudinit($res, $ds)
+           ) {
+               die "$ds - cloud-init drive is already attached at '$ci_key'\n";
+           }
+
            my $scfg = PVE::Storage::storage_config($storecfg, $storeid);
            my $name = "vm-$vmid-cloudinit";
 
@@ -187,33 +356,94 @@ my $create_disks = sub {
            push @$vollist, $volid;
            delete $disk->{format}; # no longer needed
            $res->{$ds} = PVE::QemuServer::print_drive($disk);
+           print "$ds: successfully created disk '$res->{$ds}'\n";
        } elsif ($volid =~ $NEW_DISK_RE) {
            my ($storeid, $size) = ($2 || $default_storage, $3);
            die "no storage ID specified (and no default storage)\n" if !$storeid;
-           my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
-           my $fmt = $disk->{format} || $defformat;
-
-           $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
-
-           my $volid;
-           if ($ds eq 'efidisk0') {
-               my $smm = PVE::QemuServer::Machine::machine_type_is_q35($conf);
-               ($volid, $size) = PVE::QemuServer::create_efidisk(
-                   $storecfg, $storeid, $vmid, $fmt, $arch, $disk, $smm);
-           } elsif ($ds eq 'tpmstate0') {
-               # swtpm can only use raw volumes, and uses a fixed size
-               $size = PVE::Tools::convert_size(PVE::QemuServer::Drive::TPMSTATE_DISK_SIZE, 'b' => 'kb');
-               $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, "raw", undef, $size);
+
+           if (my $source = delete $disk->{'import-from'}) {
+               my $dst_volid;
+
+               if (PVE::Storage::parse_volume_id($source, 1)) { # PVE-managed volume
+                   my $dest_info = {
+                       vmid => $vmid,
+                       drivename => $ds,
+                       storage => $storeid,
+                       format => $disk->{format},
+                   };
+
+                   $dest_info->{efisize} = PVE::QemuServer::get_efivars_size($conf, $disk)
+                       if $ds eq 'efidisk0';
+
+                   ($dst_volid, $size) = eval {
+                       $import_from_volid->($storecfg, $source, $dest_info, $vollist);
+                   };
+                   die "cannot import from '$source' - $@" if $@;
+               } else {
+                   $source = PVE::Storage::abs_filesystem_path($storecfg, $source, 1);
+                   $size = PVE::Storage::file_size_info($source);
+                   die "could not get file size of $source\n" if !$size;
+
+                   (undef, $dst_volid) = PVE::QemuServer::ImportDisk::do_import(
+                       $source,
+                       $vmid,
+                       $storeid,
+                       {
+                           drive_name => $ds,
+                           format => $disk->{format},
+                           'skip-config-update' => 1,
+                       },
+                   );
+                   push @$vollist, $dst_volid;
+               }
+
+               $disk->{file} = $dst_volid;
+               $disk->{size} = $size;
+               delete $disk->{format}; # no longer needed
+               $res->{$ds} = PVE::QemuServer::print_drive($disk);
            } else {
-               $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
+               my $defformat = PVE::Storage::storage_default_format($storecfg, $storeid);
+               my $fmt = $disk->{format} || $defformat;
+
+               $size = PVE::Tools::convert_size($size, 'gb' => 'kb'); # vdisk_alloc uses kb
+
+               my $volid;
+               if ($ds eq 'efidisk0') {
+                   my $smm = PVE::QemuServer::Machine::machine_type_is_q35($conf);
+                   ($volid, $size) = PVE::QemuServer::create_efidisk(
+                       $storecfg, $storeid, $vmid, $fmt, $arch, $disk, $smm);
+               } elsif ($ds eq 'tpmstate0') {
+                   # swtpm can only use raw volumes, and uses a fixed size
+                   $size = PVE::Tools::convert_size(PVE::QemuServer::Drive::TPMSTATE_DISK_SIZE, 'b' => 'kb');
+                   $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, "raw", undef, $size);
+               } else {
+                   $volid = PVE::Storage::vdisk_alloc($storecfg, $storeid, $vmid, $fmt, undef, $size);
+               }
+               push @$vollist, $volid;
+               $disk->{file} = $volid;
+               $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
+               delete $disk->{format}; # no longer needed
+               $res->{$ds} = PVE::QemuServer::print_drive($disk);
            }
-           push @$vollist, $volid;
-           $disk->{file} = $volid;
-           $disk->{size} = PVE::Tools::convert_size($size, 'kb' => 'b');
-           delete $disk->{format}; # no longer needed
-           $res->{$ds} = PVE::QemuServer::print_drive($disk);
+
+           print "$ds: successfully created disk '$res->{$ds}'\n";
        } else {
            PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $volid);
+           if ($storeid) {
+               my ($vtype) = PVE::Storage::parse_volname($storecfg, $volid);
+               die "cannot use volume $volid - content type needs to be 'images' or 'iso'"
+                   if $vtype ne 'images' && $vtype ne 'iso';
+
+               if (PVE::QemuServer::Drive::drive_is_cloudinit($disk)) {
+                   if (
+                       my $ci_key = PVE::QemuConfig->has_cloudinit($conf, $ds)
+                       || PVE::QemuConfig->has_cloudinit($conf->{pending} || {}, $ds)
+                       || PVE::QemuConfig->has_cloudinit($res, $ds)
+                   ) {
+                       die "$ds - cloud-init drive is already attached at '$ci_key'\n";
+                   }
+               }
+           }
 
            PVE::Storage::activate_volumes($storecfg, [ $volid ]) if $storeid;
 
@@ -225,7 +455,7 @@ my $create_disks = sub {
        }
     };
 
-    eval { PVE::QemuConfig->foreach_volume($settings, $code); };
+    eval { $foreach_volume_with_alloc->($settings, $code); };
 
     # free allocated images on error
     if (my $err = $@) {
@@ -552,7 +782,9 @@ __PACKAGE__->register_method({
                    default => 0,
                    description => "Start VM after it was created successfully.",
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => {
        type => 'string',
@@ -605,7 +837,31 @@ __PACKAGE__->register_method({
            raise_perm_exc();
        }
 
-       if (!$archive) {
+       if ($archive) {
+           for my $opt (sort keys $param->%*) {
+               if (PVE::QemuServer::Drive::is_valid_drivename($opt)) {
+                   raise_param_exc({ $opt => "option conflicts with option 'archive'" });
+               }
+           }
+
+           if ($archive eq '-') {
+               die "pipe requires cli environment\n" if $rpcenv->{type} ne 'cli';
+               $archive = { type => 'pipe' };
+           } else {
+               PVE::Storage::check_volume_access(
+                   $rpcenv,
+                   $authuser,
+                   $storecfg,
+                   $vmid,
+                   $archive,
+                   'backup',
+               );
+
+               $archive = $parse_restore_archive->($storecfg, $archive);
+           }
+       }
+
+       if (scalar(keys $param->%*) > 0) {
            &$resolve_cdrom_alias($param);
 
            &$check_storage_access($rpcenv, $authuser, $storecfg, $vmid, $param, $storage);
@@ -617,29 +873,9 @@ __PACKAGE__->register_method({
 
            &$check_cpu_model_access($rpcenv, $authuser, $param);
 
-           foreach my $opt (keys %$param) {
-               if (PVE::QemuServer::is_valid_drivename($opt)) {
-                   my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
-                   raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
-
-                   PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
-                   $param->{$opt} = PVE::QemuServer::print_drive($drive);
-               }
-           }
+           $check_drive_param->($param, $storecfg);
 
            PVE::QemuServer::add_random_macs($param);
-       } else {
-           my $keystr = join(' ', keys %$param);
-           raise_param_exc({ archive => "option conflicts with other options ($keystr)"}) if $keystr;
-
-           if ($archive eq '-') {
-               die "pipe requires cli environment\n" if $rpcenv->{type} ne 'cli';
-               $archive = { type => 'pipe' };
-           } else {
-               PVE::Storage::check_volume_access($rpcenv, $authuser, $storecfg, $vmid, $archive);
-
-               $archive = $parse_restore_archive->($storecfg, $archive);
-           }
        }
 
        my $emsg = $is_restore ? "unable to restore VM $vmid -" : "unable to create VM $vmid -";
@@ -662,6 +898,7 @@ __PACKAGE__->register_method({
                    unique => $unique,
                    bwlimit => $bwlimit,
                    live => $live_restore,
+                   override_conf => $param,
                };
                if ($archive->{type} eq 'file' || $archive->{type} eq 'pipe') {
                    die "live-restore is only compatible with backup images from a Proxmox Backup Server\n"
@@ -1195,15 +1432,10 @@ my $update_vm_api  = sub {
        die "cannot add non-replicatable volume to a replicated VM\n";
     };
 
+    $check_drive_param->($param, $storecfg, $check_replication);
+
     foreach my $opt (keys %$param) {
-       if (PVE::QemuServer::is_valid_drivename($opt)) {
-           # cleanup drive path
-           my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
-           raise_param_exc({ $opt => "unable to parse drive options" }) if !$drive;
-           PVE::QemuServer::cleanup_drive_path($opt, $storecfg, $drive);
-           $check_replication->($drive);
-           $param->{$opt} = PVE::QemuServer::print_drive($drive);
-       } elsif ($opt =~ m/^net(\d+)$/) {
+       if ($opt =~ m/^net(\d+)$/) {
            # add macaddr
            my $net = PVE::QemuServer::parse_net($param->{$opt});
            $param->{$opt} = PVE::QemuServer::print_net($net);
@@ -1279,7 +1511,7 @@ my $update_vm_api  = sub {
 
            my $check_drive_perms = sub {
                my ($opt, $val) = @_;
-               my $drive = PVE::QemuServer::parse_drive($opt, $val);
+               my $drive = PVE::QemuServer::parse_drive($opt, $val, 1);
                # FIXME: cloudinit: CDROM or Disk?
                if (PVE::QemuServer::drive_is_cdrom($drive)) { # CDROM
                    $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']);
@@ -1385,7 +1617,7 @@ my $update_vm_api  = sub {
                    # default legacy boot order implies all cdroms anyway
                    if (@bootorder) {
                        # append new CD drives to bootorder to mark them bootable
-                       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt});
+                       my $drive = PVE::QemuServer::parse_drive($opt, $param->{$opt}, 1);
                        if (PVE::QemuServer::drive_is_cdrom($drive, 1) && !grep(/^$opt$/, @bootorder)) {
                            push @bootorder, $opt;
                            $conf->{pending}->{boot} = PVE::QemuServer::print_bootorder(\@bootorder);
@@ -1548,7 +1780,9 @@ __PACKAGE__->register_method({
                    maximum => 30,
                    optional => 1,
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => {
        type => 'string',
@@ -1596,7 +1830,9 @@ __PACKAGE__->register_method({
                    maxLength => 40,
                    optional => 1,
                },
-           }),
+           },
+           1, # with_disk_alloc
+       ),
     },
     returns => { type => 'null' },
     code => sub {
@@ -2224,7 +2460,12 @@ __PACKAGE__->register_method({
 
        $status->{ha} = PVE::HA::Config::get_service_status("vm:$param->{vmid}");
 
-       $status->{spice} = 1 if PVE::QemuServer::vga_conf_has_spice($conf->{vga});
+       if ($conf->{vga}) {
+           my $vga = PVE::QemuServer::parse_vga($conf->{vga});
+           my $spice = defined($vga->{type}) && $vga->{type} =~ /^virtio/;
+           $spice ||= PVE::QemuServer::vga_conf_has_spice($conf->{vga});
+           $status->{spice} = 1 if $spice;
+       }
        $status->{agent} = 1 if PVE::QemuServer::get_qga_key($conf, 'enabled');
 
        return $status;
@@ -2321,7 +2562,7 @@ __PACKAGE__->register_method({
        my $spice_ticket;
        my $nbd_protocol_version = 0;
        my $replicated_volumes = {};
-       my $tpmstate_vol;
+       my $offline_volumes = {};
        if ($stateuri && ($stateuri eq 'tcp' || $stateuri eq 'unix') && $migratedfrom && ($rpcenv->{type} eq 'cli')) {
            while (defined(my $line = <STDIN>)) {
                chomp $line;
@@ -2331,8 +2572,10 @@ __PACKAGE__->register_method({
                    $nbd_protocol_version = $1;
                } elsif ($line =~ m/^replicated_volume: (.*)$/) {
                    $replicated_volumes->{$1} = 1;
-               } elsif ($line =~ m/^tpmstate0: (.*)$/) {
-                   $tpmstate_vol = $1;
+               } elsif ($line =~ m/^tpmstate0: (.*)$/) { # Deprecated, use offline_volume instead
+                   $offline_volumes->{tpmstate0} = $1;
+               } elsif ($line =~ m/^offline_volume: ([^:]+): (.*)$/) {
+                   $offline_volumes->{$1} = $2;
                } elsif (!$spice_ticket) {
                    # fallback for old source node
                    $spice_ticket = $line;
@@ -2374,7 +2617,7 @@ __PACKAGE__->register_method({
                    storagemap => $storagemap,
                    nbd_proto_version => $nbd_protocol_version,
                    replicated_volumes => $replicated_volumes,
-                   tpmstate_vol => $tpmstate_vol,
+                   offline_volumes => $offline_volumes,
                };
 
                my $params = {
@@ -2753,10 +2996,17 @@ __PACKAGE__->register_method({
        # early check for storage permission, for better user feedback
        if ($todisk) {
            $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']);
+           my $conf = PVE::QemuConfig->load_config($vmid);
+
+           # cannot save the state of a non-virtualized PCIe device, so resume cannot really work
+           for my $key (keys %$conf) {
+               next if $key !~ /^hostpci\d+/;
+               die "cannot suspend VM to disk due to passed-through PCI device(s), which lack the"
+                   ." possibility to save/restore their internal state\n";
+           }
 
            if (!$statestorage) {
                # get statestorage from config if none is given
-               my $conf = PVE::QemuConfig->load_config($vmid);
                my $storecfg = PVE::Storage::config();
                $statestorage = PVE::QemuServer::find_vmstate_storage($conf, $storecfg);
            }
@@ -3126,6 +3376,9 @@ __PACKAGE__->register_method({
                # no need to copy unused images, because VMID(owner) changes anyways
                next if $opt =~ m/^unused\d+$/;
 
+               die "cannot clone TPM state while VM is running\n"
+                   if $full && $running && !$snapname && $opt eq 'tpmstate0';
+
                # always change MAC! address
                if ($opt =~ m/^net(\d+)$/) {
                    my $net = PVE::QemuServer::parse_net($value);
@@ -3653,6 +3906,13 @@ __PACKAGE__->register_method({
 
                    $drive->{file} = $new_volid;
 
+                   my $boot_order = PVE::QemuServer::device_bootorder($source_conf);
+                   if (defined(delete $boot_order->{$disk})) {
+                       print "removing disk '$disk' from boot order config\n";
+                       my $boot_devs = [ sort { $boot_order->{$a} <=> $boot_order->{$b} } keys %$boot_order ];
+                       $source_conf->{boot} = PVE::QemuServer::print_bootorder($boot_devs);
+                   }
+
                    delete $source_conf->{$disk};
                    print "removing disk '${disk}' from VM '${vmid}' config\n";
                    PVE::QemuConfig->write_config($vmid, $source_conf);
@@ -4576,11 +4836,25 @@ __PACKAGE__->register_method({
 
        my $snapname = extract_param($param, 'snapname');
 
-       my $realcmd = sub {
+       my $lock_obtained;
+       my $do_delete = sub {
+           $lock_obtained = 1;
            PVE::Cluster::log_msg('info', $authuser, "delete snapshot VM $vmid: $snapname");
            PVE::QemuConfig->snapshot_delete($vmid, $snapname, $param->{force});
        };
 
+       my $realcmd = sub {
+           if ($param->{force}) {
+               $do_delete->();
+           } else {
+               eval { PVE::GuestHelpers::guest_migration_lock($vmid, 10, $do_delete); };
+               if (my $err = $@) {
+                   die $err if $lock_obtained;
+                   die "Failed to obtain guest migration lock - replication running?\n";
+               }
+           }
+       };
+
        return $rpcenv->fork_worker('qmdelsnapshot', $vmid, $authuser, $realcmd);
     }});