From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH qemu-server] vm start: fix migration regression with Windows by only enrolling EFI certs on cold start
Date: Mon, 17 Nov 2025 13:58:42 +0100 [thread overview]
Message-ID: <20251117125858.143552-1-f.ebner@proxmox.com> (raw)
The EFI disk can only be exclusively accessed during cold start, so
skip check_efi_vars() for migration and resume from hibernation.
Also, check_efi_vars() might write the VM configuration, which also
cannot be done in the context of migration at this stage, because the
configuration does not exist on the target yet and it would result in:
> close (rename) atomic file '/etc/pve/nodes/squid176/qemu-server/106.conf' failed: File exists
Fixes: c5b3a314 ("fix #6985: ovmf: auto-enroll Microsoft UEFI CA 2023 for Windows")
Reported-by: Friedrich Weber <f.weber@proxmox.com>
Suggested-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/QemuServer.pm | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 9946e445..b39157af 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5610,7 +5610,11 @@ sub vm_start_nolock {
my $storage_hints = generate_storage_hints($conf, 1);
PVE::Storage::activate_volumes($storecfg, $vollist, undef, $storage_hints);
- check_efi_vars($storecfg, $vmid, $conf) if $conf->{bios} && $conf->{bios} eq 'ovmf';
+ # Can only exclusively access EFI disk during cold start. Also, check_efi_vars() might write
+ # the configuration, which must not be done at this stage of migration on the target.
+ if (!$statefile && !$resume && $conf->{bios} && $conf->{bios} eq 'ovmf') {
+ check_efi_vars($storecfg, $vmid, $conf);
+ }
# Note that for certain cases like templates, the configuration is minimized, so need to ensure
# the rest of the function here uses the same configuration that was used to build the command
--
2.47.3
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next reply other threads:[~2025-11-17 12:59 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-17 12:58 Fiona Ebner [this message]
2025-11-17 14:26 ` [pve-devel] applied: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251117125858.143552-1-f.ebner@proxmox.com \
--to=f.ebner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox