[pve-devel] [PATCH v3 qemu-server] fix #3963: Skip TPM startup for template VMs

[pve-devel] [PATCH v3 qemu-server] fix #3963: Skip TPM startup for template VMs

[Filip Schauer]

Skip the software TPM startup when starting a template VM for performing
a backup. This fixes an error that occurs when the TPM state disk is
write-protected.

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
Changes since v2:
* Do not add the TPM to the command line arguments when VM is a template

 PVE/QemuServer.pm | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 484bc7f..aa98d5f 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -3823,7 +3823,9 @@ sub config_to_command {
 	push @$devices, @$audio_devs;
     }
 
-    add_tpm_device($vmid, $devices, $conf);
+    if (!PVE::QemuConfig->is_template($conf)) {
+	add_tpm_device($vmid, $devices, $conf);
+    }
 
     my $sockets = 1;
     $sockets = $conf->{smp} if $conf->{smp}; # old style - no longer iused
@@ -5923,7 +5925,7 @@ sub vm_start_nolock {
 	    PVE::Systemd::enter_systemd_scope($vmid, "Proxmox VE VM $vmid", %systemd_properties);
 
 	    my $tpmpid;
-	    if (my $tpm = $conf->{tpmstate0}) {
+	    if ((my $tpm = $conf->{tpmstate0}) && !PVE::QemuConfig->is_template($conf)) {
 		# start the TPM emulator so QEMU can connect on start
 		$tpmpid = start_swtpm($storecfg, $vmid, $tpm, $migratedfrom);
 	    }
-- 
2.39.2

Re: [pve-devel] [PATCH v3 qemu-server] fix #3963: Skip TPM startup for template VMs

[Fiona Ebner]

Am 09.08.23 um 17:24 schrieb Filip Schauer:
> Skip the software TPM startup when starting a template VM for performing
> a backup. This fixes an error that occurs when the TPM state disk is
> write-protected.
> 
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>

Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>

> ---
> Changes since v2:
> * Do not add the TPM to the command line arguments when VM is a template
> 
>  PVE/QemuServer.pm | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
> index 484bc7f..aa98d5f 100644
> --- a/PVE/QemuServer.pm
> +++ b/PVE/QemuServer.pm
> @@ -3823,7 +3823,9 @@ sub config_to_command {
>  	push @$devices, @$audio_devs;
>      }
>  

Adding a short comment here about why would be nice for future readers.

> -    add_tpm_device($vmid, $devices, $conf);
> +    if (!PVE::QemuConfig->is_template($conf)) {
> +	add_tpm_device($vmid, $devices, $conf);
> +    }

Style nit: could be done in one line by using a post-if

Nit: This also modifies the output of qm showcmd. On the one hand, it's
correct, because it is the actual command the template is started with.
On the other hand, people might expect it to be what the command for a
non-template VM with the same settings would be. But I'd say, it's fine.